diff --git a/application/single_app/config.py b/application/single_app/config.py
index cfe20b596..959e239f3 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -96,7 +96,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.250.220"
+VERSION = "0.250.221"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax')
diff --git a/application/single_app/functions_content.py b/application/single_app/functions_content.py
index 563544adf..50051cf16 100644
--- a/application/single_app/functions_content.py
+++ b/application/single_app/functions_content.py
@@ -10,6 +10,7 @@
 
 from functions_debug import debug_print
 from config import *
+from functions_office_media import extract_office_embedded_images
 import functions_settings
 from functions_settings import *
 from functions_logging import *
@@ -607,6 +608,85 @@ def extract_content_with_azure_di(file_path, extraction_mode='read', pages=None)
         raise e
 
 
+def resolve_extraction_engine_for_mode(extraction_mode, settings):
+    """Resolve which engine backs the given extraction mode, plus a human-readable reason."""
+    if extraction_mode != 'layout':
+        return functions_settings.EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE, ''
+    return functions_settings.resolve_enhanced_extraction_engine(settings)
+
+
+def extract_content_with_extraction_engine(
+    file_path,
+    extraction_mode,
+    extraction_engine=None,
+    settings=None,
+    pages=None,
+):
+    """Extract page content with the engine that backs the requested extraction mode.
+
+    Standard extraction always uses Document Intelligence ``prebuilt-read``. Enhanced extraction
+    prefers Azure AI Content Understanding, but always falls back to Document Intelligence
+    ``prebuilt-layout`` so a Content Understanding outage never blocks ingestion.
+
+    Returns ``(pages_data, engine_used, fallback_reason)``.
+    """
+    resolved_settings = settings if settings is not None else get_settings()
+    if extraction_engine is None:
+        extraction_engine, _ = resolve_extraction_engine_for_mode(extraction_mode, resolved_settings)
+
+    if (
+        extraction_mode != 'layout'
+        or extraction_engine != functions_settings.EXTRACTION_ENGINE_CONTENT_UNDERSTANDING
+    ):
+        return (
+            extract_content_with_azure_di(file_path, extraction_mode=extraction_mode, pages=pages),
+            functions_settings.EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE,
+            '',
+        )
+
+    from functions_content_understanding import extract_content_with_content_understanding
+
+    try:
+        content_understanding_pages = extract_content_with_content_understanding(
+            file_path,
+            pages=pages,
+            settings=resolved_settings,
+        )
+        if content_understanding_pages:
+            return (
+                content_understanding_pages,
+                functions_settings.EXTRACTION_ENGINE_CONTENT_UNDERSTANDING,
+                '',
+            )
+        fallback_reason = (
+            'Content Understanding returned no content, so Document Intelligence Layout was used'
+        )
+        log_event(
+            f"[EXTRACTION_ENGINE] Content Understanding returned no content for "
+            f"{os.path.basename(file_path)}; falling back to Document Intelligence Layout.",
+            level=logging.WARNING,
+        )
+    except Exception as content_understanding_error:
+        # The reason is persisted and rendered in workspace tooltips, so keep it short.
+        error_summary = " ".join(str(content_understanding_error).split())[:240]
+        fallback_reason = (
+            f'Content Understanding failed ({error_summary}), '
+            'so Document Intelligence Layout was used'
+        )
+        log_event(
+            f"[EXTRACTION_ENGINE] Content Understanding failed for "
+            f"{os.path.basename(file_path)}: {content_understanding_error}. "
+            "Falling back to Document Intelligence Layout.",
+            level=logging.WARNING,
+        )
+
+    return (
+        extract_content_with_azure_di(file_path, extraction_mode='layout', pages=pages),
+        functions_settings.EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE,
+        fallback_reason,
+    )
+
+
 def extract_table_file(file_path, file_ext):
     try:
         if file_ext == '.csv':
diff --git a/application/single_app/functions_content_understanding.py b/application/single_app/functions_content_understanding.py
new file mode 100644
index 000000000..c78098852
--- /dev/null
+++ b/application/single_app/functions_content_understanding.py
@@ -0,0 +1,620 @@
+# functions_content_understanding.py
+
+"""Azure AI Content Understanding client used for Enhanced document extraction.
+
+Standard extraction always uses Azure Document Intelligence ``prebuilt-read``. Enhanced extraction
+uses Azure AI Content Understanding when the app runs in an Azure commercial cloud and the service is
+configured; otherwise callers fall back to Document Intelligence ``prebuilt-layout``.
+
+The public extraction helper intentionally mirrors the return contract of
+``functions_content.extract_content_with_azure_di`` so the ingestion pipeline can swap engines
+without reshaping downstream chunking.
+"""
+
+import json
+import logging
+import os
+import time
+
+import requests
+from azure.identity import DefaultAzureCredential
+
+from config import AZURE_ENVIRONMENT, cognitive_services_scope
+from functions_appinsights import log_event
+from functions_debug import debug_print
+import functions_settings
+
+
+CONTENT_UNDERSTANDING_ANALYZE_TIMEOUT_SECONDS = 600
+CONTENT_UNDERSTANDING_POLL_INTERVAL_SECONDS = 3
+CONTENT_UNDERSTANDING_SUBMIT_TIMEOUT_SECONDS = 300
+CONTENT_UNDERSTANDING_POLL_TIMEOUT_SECONDS = 60
+CONTENT_UNDERSTANDING_TOKEN_REFRESH_BUFFER_SECONDS = 300
+
+# Content Understanding refuses LLM-backed analyzers until the Foundry resource has default model
+# deployments configured. That failure is common enough during setup to deserve its own guidance.
+CONTENT_UNDERSTANDING_MISSING_DEPLOYMENT_HINTS = (
+    'model deployment',
+    'modeldeployment',
+    'no default',
+    'default model',
+    'deployment not found',
+    'deploymentnotfound',
+)
+
+CONTENT_UNDERSTANDING_MISSING_DEPLOYMENT_MESSAGE = (
+    "Content Understanding rejected the request because the Foundry resource has no default model "
+    "deployments. Deploy a completion model and an embedding model, then set them as Content "
+    "Understanding defaults before using Enhanced extraction."
+)
+
+
+class ContentUnderstandingError(Exception):
+    """Raised when a Content Understanding request cannot be completed."""
+
+
+class ContentUnderstandingNotConfiguredError(ContentUnderstandingError):
+    """Raised when Content Understanding is unavailable or missing required configuration."""
+
+
+def _get_settings():
+    return functions_settings.get_settings()
+
+
+def _resolve_config(settings=None, config_override=None):
+    """Return normalized Content Understanding configuration from settings or an explicit override."""
+    if config_override:
+        return {
+            'endpoint': functions_settings.normalize_content_understanding_endpoint(
+                config_override.get('endpoint')
+            ),
+            'key': str(config_override.get('key') or '').strip(),
+            'authentication_type': functions_settings.normalize_content_understanding_authentication_type(
+                config_override.get('authentication_type')
+            ),
+            'api_version': functions_settings.normalize_content_understanding_api_version(
+                config_override.get('api_version')
+            ),
+            'analyzer_id': functions_settings.normalize_content_understanding_analyzer_id(
+                config_override.get('analyzer_id'),
+                functions_settings.CONTENT_UNDERSTANDING_DOCUMENT_ANALYZER_DEFAULT,
+            ),
+            'image_analyzer_id': functions_settings.normalize_content_understanding_analyzer_id(
+                config_override.get('image_analyzer_id'),
+                functions_settings.CONTENT_UNDERSTANDING_IMAGE_ANALYZER_DEFAULT,
+            ),
+        }
+
+    return functions_settings.get_content_understanding_config(
+        settings if settings is not None else _get_settings()
+    )
+
+
+_TOKEN_CACHE = {'token': None, 'expires_on': 0}
+
+
+def _get_bearer_token():
+    """Return a cached Entra ID access token for Content Understanding."""
+    now = time.time()
+    cached_token = _TOKEN_CACHE.get('token')
+    cached_expiry = _TOKEN_CACHE.get('expires_on') or 0
+    if cached_token and cached_expiry - CONTENT_UNDERSTANDING_TOKEN_REFRESH_BUFFER_SECONDS > now:
+        return cached_token
+
+    credential = DefaultAzureCredential()
+    access_token = credential.get_token(cognitive_services_scope)
+    _TOKEN_CACHE['token'] = access_token.token
+    _TOKEN_CACHE['expires_on'] = getattr(access_token, 'expires_on', 0) or 0
+    return access_token.token
+
+
+def _build_auth_headers(config):
+    """Build authentication headers for either key or managed identity access."""
+    if config.get('authentication_type') == 'managed_identity':
+        return {'Authorization': f"Bearer {_get_bearer_token()}"}
+
+    key = config.get('key')
+    if not key:
+        raise ContentUnderstandingNotConfiguredError(
+            "Content Understanding key authentication is selected but no key is configured."
+        )
+    return {'Ocp-Apim-Subscription-Key': key}
+
+
+def _validate_config(config):
+    """Raise when the environment or configuration cannot support a Content Understanding call."""
+    if not functions_settings.is_content_understanding_supported_environment():
+        raise ContentUnderstandingNotConfiguredError(
+            f"Content Understanding is not available in the {AZURE_ENVIRONMENT} cloud."
+        )
+    if not config.get('endpoint'):
+        raise ContentUnderstandingNotConfiguredError(
+            "Content Understanding endpoint is not configured."
+        )
+
+
+def _build_analyze_binary_url(config, analyzer_id, page_range=None):
+    url = (
+        f"{config['endpoint']}/contentunderstanding/analyzers/{analyzer_id}:analyzeBinary"
+        f"?api-version={config['api_version']}"
+    )
+    if page_range:
+        url = f"{url}&range={page_range}"
+    return url
+
+
+def _describe_http_error(response):
+    """Return a readable message for a failed Content Understanding HTTP response."""
+    detail = ''
+    try:
+        payload = response.json()
+        error_payload = payload.get('error') if isinstance(payload, dict) else None
+        if isinstance(error_payload, dict):
+            detail = str(error_payload.get('message') or error_payload.get('code') or '')
+        if not detail and isinstance(payload, dict):
+            detail = str(payload.get('message') or '')
+        if not detail:
+            detail = json.dumps(payload)[:500]
+    except (ValueError, TypeError):
+        detail = (response.text or '')[:500]
+
+    if _looks_like_missing_model_deployment(detail):
+        return CONTENT_UNDERSTANDING_MISSING_DEPLOYMENT_MESSAGE
+
+    return f"Content Understanding request failed with HTTP {response.status_code}: {detail}".strip()
+
+
+def _looks_like_missing_model_deployment(message):
+    normalized_message = str(message or '').lower()
+    return any(hint in normalized_message for hint in CONTENT_UNDERSTANDING_MISSING_DEPLOYMENT_HINTS)
+
+
+def analyze_file_with_content_understanding(
+    file_path,
+    analyzer_id=None,
+    page_range=None,
+    settings=None,
+    config_override=None,
+    max_wait_seconds=CONTENT_UNDERSTANDING_ANALYZE_TIMEOUT_SECONDS,
+):
+    """Submit a local file to Content Understanding and return the completed ``result`` payload."""
+    config = _resolve_config(settings=settings, config_override=config_override)
+    _validate_config(config)
+
+    resolved_analyzer_id = functions_settings.normalize_content_understanding_analyzer_id(
+        analyzer_id,
+        config['analyzer_id'],
+    )
+
+    with open(file_path, 'rb') as file_handle:
+        file_bytes = file_handle.read()
+
+    if not file_bytes:
+        raise ContentUnderstandingError(f"Cannot analyze empty file: {os.path.basename(file_path)}")
+
+    headers = {'Content-Type': 'application/octet-stream'}
+    headers.update(_build_auth_headers(config))
+
+    submit_url = _build_analyze_binary_url(config, resolved_analyzer_id, page_range=page_range)
+    debug_print(
+        f"[CONTENT_UNDERSTANDING] Submitting {os.path.basename(file_path)} "
+        f"({len(file_bytes)} bytes) to analyzer {resolved_analyzer_id}"
+        + (f" range={page_range}" if page_range else "")
+    )
+
+    response = requests.post(
+        submit_url,
+        headers=headers,
+        data=file_bytes,
+        timeout=CONTENT_UNDERSTANDING_SUBMIT_TIMEOUT_SECONDS,
+    )
+
+    if response.status_code >= 400:
+        raise ContentUnderstandingError(_describe_http_error(response))
+
+    # Content extraction analyzers can answer synchronously for small inputs.
+    if response.status_code == 200:
+        payload = response.json()
+        if isinstance(payload, dict) and payload.get('result'):
+            return payload['result']
+        if isinstance(payload, dict) and payload.get('contents'):
+            return payload
+
+    operation_location = response.headers.get('Operation-Location') or response.headers.get('operation-location')
+    if not operation_location:
+        raise ContentUnderstandingError(
+            "Content Understanding did not return an Operation-Location header for the analysis request."
+        )
+
+    return _poll_analysis_result(
+        operation_location,
+        config,
+        max_wait_seconds=max_wait_seconds,
+    )
+
+
+def _poll_analysis_result(operation_location, config, max_wait_seconds):
+    """Poll a Content Understanding operation until it succeeds, fails, or times out."""
+    poll_headers = _build_auth_headers(config)
+    start_time = time.time()
+
+    while True:
+        elapsed_seconds = time.time() - start_time
+        if elapsed_seconds > max_wait_seconds:
+            raise TimeoutError(
+                f"Content Understanding analysis did not finish within {max_wait_seconds} seconds."
+            )
+
+        time.sleep(CONTENT_UNDERSTANDING_POLL_INTERVAL_SECONDS)
+
+        poll_response = requests.get(
+            operation_location,
+            headers=poll_headers,
+            timeout=CONTENT_UNDERSTANDING_POLL_TIMEOUT_SECONDS,
+        )
+        if poll_response.status_code >= 400:
+            raise ContentUnderstandingError(_describe_http_error(poll_response))
+
+        payload = poll_response.json()
+        status = str(payload.get('status') or '').strip().lower()
+
+        if status == 'succeeded':
+            result = payload.get('result')
+            if not result:
+                raise ContentUnderstandingError(
+                    "Content Understanding reported success but returned no result payload."
+                )
+            return result
+
+        if status == 'failed':
+            error_payload = payload.get('error') or {}
+            message = str(error_payload.get('message') or 'Content Understanding analysis failed.')
+            if _looks_like_missing_model_deployment(message):
+                raise ContentUnderstandingError(CONTENT_UNDERSTANDING_MISSING_DEPLOYMENT_MESSAGE)
+            raise ContentUnderstandingError(f"Content Understanding analysis failed: {message}")
+
+        if status == 'canceled':
+            raise ContentUnderstandingError("Content Understanding analysis was canceled.")
+
+
+def _iter_document_contents(result):
+    """Yield document content entries from a Content Understanding result payload."""
+    contents = (result or {}).get('contents')
+    if not isinstance(contents, list):
+        return []
+    return [content for content in contents if isinstance(content, dict)]
+
+
+def _slice_markdown_by_spans(markdown_text, spans):
+    """Return the markdown covered by a page's spans."""
+    if not markdown_text or not spans:
+        return ''
+
+    slices = []
+    for span in spans:
+        if not isinstance(span, dict):
+            continue
+        try:
+            offset = int(span.get('offset', 0))
+            length = int(span.get('length', 0))
+        except (TypeError, ValueError):
+            continue
+        if length <= 0:
+            continue
+        slices.append(markdown_text[offset:offset + length])
+
+    return ''.join(slices)
+
+
+def _build_figure_summaries(content):
+    """Map page-agnostic figure offsets to readable description blocks.
+
+    The description and any structured diagram source are kept separate so de-duplication can drop
+    a description that Content Understanding already inlined into the markdown without discarding
+    the machine-readable diagram alongside it.
+    """
+    figures = content.get('figures')
+    if not isinstance(figures, list):
+        return []
+
+    summaries = []
+    for figure in figures:
+        if not isinstance(figure, dict):
+            continue
+
+        description = str(figure.get('description') or '').strip()
+        figure_content = figure.get('content')
+        figure_kind = str(figure.get('kind') or '').strip().lower()
+
+        diagram_block = ''
+        if figure_kind == 'mermaid' and isinstance(figure_content, str) and figure_content.strip():
+            diagram_block = f"```mermaid\n{figure_content.strip()}\n```"
+        elif figure_kind == 'chart' and isinstance(figure_content, (dict, list)):
+            try:
+                diagram_block = f"```json\n{json.dumps(figure_content, ensure_ascii=False)}\n```"
+            except (TypeError, ValueError):
+                diagram_block = ''
+
+        caption = figure.get('caption')
+        caption_text = ''
+        if isinstance(caption, dict):
+            caption_text = str(caption.get('content') or '').strip()
+        elif isinstance(caption, str):
+            caption_text = caption.strip()
+
+        # Descriptions are optional in the API schema, so a caption alone is still worth indexing.
+        if not description and not diagram_block and not caption_text:
+            continue
+
+        label = caption_text or str(figure.get('id') or '').strip() or 'Figure'
+
+        span = figure.get('span')
+        offset = None
+        if isinstance(span, dict):
+            try:
+                offset = int(span.get('offset'))
+            except (TypeError, ValueError):
+                offset = None
+
+        summaries.append({
+            'offset': offset,
+            'label': label,
+            'description': description,
+            'diagram_block': diagram_block,
+        })
+
+    return summaries
+
+
+def _render_figure_summary(summary, page_text=''):
+    """Render a figure summary block, omitting parts already present in the page markdown."""
+    description = summary.get('description') or ''
+    diagram_block = summary.get('diagram_block') or ''
+    label = summary.get('label') or 'Figure'
+
+    lines = []
+    # prebuilt-documentSearch already inlines most descriptions into the markdown.
+    if description and description not in page_text:
+        lines.append(description)
+    if diagram_block and diagram_block not in page_text:
+        lines.append(diagram_block)
+
+    if not lines:
+        # A caption-only figure still earns a line when nothing else survived de-duplication.
+        if label and label not in page_text:
+            return f"Figure ({label})"
+        return ''
+
+    # The label goes on its own line so a leading code fence still starts at column zero.
+    return f"Figure ({label}):\n" + "\n".join(lines)
+
+
+def _assign_figures_to_pages(figure_summaries, page_ranges):
+    """Group figure summary blocks by the page whose span range contains them."""
+    figures_by_page = {}
+    for summary in figure_summaries:
+        offset = summary.get('offset')
+        target_page = None
+
+        if offset is not None:
+            for page_number, start, end in page_ranges:
+                if start <= offset < end:
+                    target_page = page_number
+                    break
+
+        if target_page is None:
+            target_page = page_ranges[0][0] if page_ranges else 1
+
+        figures_by_page.setdefault(target_page, []).append(summary)
+
+    return figures_by_page
+
+
+def build_pages_from_content_understanding_result(result):
+    """Convert a Content Understanding result into ``[{page_number, content}]`` entries.
+
+    Page text is reconstructed by slicing the content-level ``markdown`` with each page's spans, which
+    is the documented way to recover per-page content. Figure descriptions are appended to the page
+    that contains them when they are not already present in that page's markdown.
+    """
+    pages_data = []
+
+    for content in _iter_document_contents(result):
+        markdown_text = str(content.get('markdown') or '')
+        pages = content.get('pages')
+        start_page_number = content.get('startPageNumber')
+        try:
+            start_page_number = int(start_page_number)
+        except (TypeError, ValueError):
+            start_page_number = 1
+
+        if not isinstance(pages, list) or not pages:
+            fallback_content = markdown_text.strip()
+            # Figures still carry descriptions even when the response has no per-page spans.
+            fallback_blocks = []
+            for summary in _build_figure_summaries(content):
+                rendered_summary = _render_figure_summary(summary, fallback_content)
+                if rendered_summary:
+                    fallback_blocks.append(rendered_summary)
+            if fallback_blocks:
+                fallback_content = (
+                    f"{fallback_content.rstrip()}\n\n" + "\n\n".join(fallback_blocks)
+                ).strip()
+            if fallback_content:
+                pages_data.append({
+                    'page_number': start_page_number or 1,
+                    'content': fallback_content,
+                })
+            continue
+
+        page_ranges = []
+        page_markdown = {}
+        for page in pages:
+            if not isinstance(page, dict):
+                continue
+            try:
+                page_number = int(page.get('pageNumber'))
+            except (TypeError, ValueError):
+                page_number = len(page_markdown) + start_page_number
+
+            spans = page.get('spans') if isinstance(page.get('spans'), list) else []
+            page_markdown[page_number] = _slice_markdown_by_spans(markdown_text, spans)
+
+            span_starts = []
+            span_ends = []
+            for span in spans:
+                if not isinstance(span, dict):
+                    continue
+                try:
+                    offset = int(span.get('offset', 0))
+                    length = int(span.get('length', 0))
+                except (TypeError, ValueError):
+                    continue
+                span_starts.append(offset)
+                span_ends.append(offset + length)
+
+            if span_starts:
+                page_ranges.append((page_number, min(span_starts), max(span_ends)))
+
+        figures_by_page = _assign_figures_to_pages(_build_figure_summaries(content), page_ranges)
+
+        for page_number in sorted(page_markdown.keys()):
+            page_text = page_markdown.get(page_number, '')
+            figure_blocks = []
+            for summary in figures_by_page.get(page_number, []):
+                rendered_summary = _render_figure_summary(summary, page_text)
+                if rendered_summary:
+                    figure_blocks.append(rendered_summary)
+
+            if figure_blocks:
+                page_text = f"{page_text.rstrip()}\n\n" + "\n\n".join(figure_blocks)
+
+            page_text = page_text.strip()
+            if not page_text:
+                continue
+
+            pages_data.append({
+                'page_number': page_number,
+                'content': page_text,
+            })
+
+    return pages_data
+
+
+def extract_content_with_content_understanding(file_path, pages=None, settings=None):
+    """Extract page-by-page content with Content Understanding.
+
+    Mirrors the return contract of ``functions_content.extract_content_with_azure_di`` so the
+    ingestion pipeline can switch engines without reshaping downstream chunking.
+    """
+    result = analyze_file_with_content_understanding(
+        file_path,
+        page_range=str(pages) if pages else None,
+        settings=settings,
+    )
+
+    pages_data = build_pages_from_content_understanding_result(result)
+    debug_print(
+        f"[CONTENT_UNDERSTANDING] Extracted {len(pages_data)} page(s) from "
+        f"{os.path.basename(file_path)}"
+    )
+    return pages_data
+
+
+def analyze_image_with_content_understanding(image_path, settings=None):
+    """Analyze a standalone image and return its description text, or an empty string."""
+    resolved_settings = settings if settings is not None else _get_settings()
+    config = _resolve_config(settings=resolved_settings)
+
+    result = analyze_file_with_content_understanding(
+        image_path,
+        analyzer_id=config['image_analyzer_id'],
+        settings=resolved_settings,
+    )
+
+    text_blocks = []
+    for content in _iter_document_contents(result):
+        markdown_text = str(content.get('markdown') or '').strip()
+        if markdown_text:
+            text_blocks.append(markdown_text)
+
+        for summary in _build_figure_summaries(content):
+            rendered_summary = _render_figure_summary(summary, markdown_text)
+            if rendered_summary:
+                text_blocks.append(rendered_summary)
+
+    return "\n\n".join(block for block in text_blocks if block).strip()
+
+
+def test_content_understanding_connection(config_override, sample_file_path=None):
+    """Validate Content Understanding connectivity and return ``(ok, message)``."""
+    if not functions_settings.is_content_understanding_supported_environment():
+        return False, (
+            f"Content Understanding is not available in the {AZURE_ENVIRONMENT} cloud. "
+            "Enhanced extraction uses Document Intelligence Layout here instead."
+        )
+
+    config = _resolve_config(config_override=config_override)
+
+    if not config['endpoint']:
+        return False, "Content Understanding endpoint is required."
+    if config['authentication_type'] == 'key' and not config['key']:
+        return False, "Content Understanding key is required when key authentication is selected."
+
+    try:
+        headers = _build_auth_headers(config)
+    except ContentUnderstandingError as auth_error:
+        return False, str(auth_error)
+
+    analyzer_id = config['analyzer_id']
+    analyzer_url = (
+        f"{config['endpoint']}/contentunderstanding/analyzers/{analyzer_id}"
+        f"?api-version={config['api_version']}"
+    )
+
+    try:
+        response = requests.get(
+            analyzer_url,
+            headers=headers,
+            timeout=CONTENT_UNDERSTANDING_POLL_TIMEOUT_SECONDS,
+        )
+    except requests.RequestException as request_error:
+        return False, f"Content Understanding connection error: {request_error}"
+
+    if response.status_code == 404:
+        return False, (
+            f"Content Understanding reached the endpoint but analyzer '{analyzer_id}' was not found. "
+            "Verify the analyzer id and API version."
+        )
+    if response.status_code in (401, 403):
+        return False, (
+            "Content Understanding rejected the credentials. For managed identity, assign the "
+            "Cognitive Services User role on the Foundry resource."
+        )
+    if response.status_code >= 400:
+        return False, _describe_http_error(response)
+
+    if not sample_file_path or not os.path.exists(sample_file_path):
+        return True, (
+            f"Content Understanding connection successful. Analyzer '{analyzer_id}' is reachable."
+        )
+
+    try:
+        analyze_file_with_content_understanding(
+            sample_file_path,
+            analyzer_id=analyzer_id,
+            config_override=config,
+            max_wait_seconds=180,
+        )
+    except (ContentUnderstandingError, TimeoutError) as analyze_error:
+        return False, str(analyze_error)
+    except Exception as analyze_error:  # noqa: BLE001 - surface any client failure to the admin
+        log_event(
+            f"[CONTENT_UNDERSTANDING] Test analysis failed: {analyze_error}",
+            level=logging.WARNING,
+        )
+        return False, f"Content Understanding test analysis failed: {analyze_error}"
+
+    return True, (
+        f"Content Understanding connection successful. Analyzer '{analyzer_id}' analyzed the test document."
+    )
diff --git a/application/single_app/functions_document_access_index.py b/application/single_app/functions_document_access_index.py
index f7ba2d743..fa53e9c05 100644
--- a/application/single_app/functions_document_access_index.py
+++ b/application/single_app/functions_document_access_index.py
@@ -1739,6 +1739,8 @@ def _build_base_row(document_item, source_scope, scope_type, scope_id, access_ro
         'publication_date': document_item.get('publication_date'),
         'enhanced_citations': _has_persisted_blob_reference(document_item),
         'document_intelligence_extraction_mode': document_item.get('document_intelligence_extraction_mode'),
+        'extraction_engine': document_item.get('extraction_engine'),
+        'extraction_engine_reason': document_item.get('extraction_engine_reason'),
         'generated_artifact_promotion_status': document_item.get('generated_artifact_promotion_status'),
         'generated_artifact_requested_by_user_id': document_item.get('generated_artifact_requested_by_user_id'),
         'file_sync': document_item.get('file_sync'),
@@ -2153,6 +2155,7 @@ def _query_candidate_projection_rows_for_scope(scope_key, source_scope):
         'c.shared_user_ids, c.shared_group_ids, c.file_name, c.title, c.document_classification, c.tags, c.authors, c.keywords, '
         'c.abstract, c.status, c.percentage_complete, c.number_of_pages, c.publication_date, '
         'c.enhanced_citations, c.document_intelligence_extraction_mode, '
+        'c.extraction_engine, c.extraction_engine_reason, '
         'c.generated_artifact_promotion_status, c.generated_artifact_requested_by_user_id, '
         'c.file_sync, c.created_from_chat_upload, '
         'c.conversation_id, c.conversation_title_at_upload, c.upload_date, c.last_updated, '
@@ -2407,6 +2410,8 @@ def _projection_row_to_document(row, source_scope):
         'publication_date': row.get('publication_date'),
         'enhanced_citations': row.get('enhanced_citations'),
         'document_intelligence_extraction_mode': row.get('document_intelligence_extraction_mode'),
+        'extraction_engine': row.get('extraction_engine'),
+        'extraction_engine_reason': row.get('extraction_engine_reason'),
         'generated_artifact_promotion_status': row.get('generated_artifact_promotion_status'),
         'generated_artifact_requested_by_user_id': row.get('generated_artifact_requested_by_user_id'),
         'file_sync': row.get('file_sync'),
diff --git a/application/single_app/functions_documents.py b/application/single_app/functions_documents.py
index ecf6afa39..f0c735eda 100644
--- a/application/single_app/functions_documents.py
+++ b/application/single_app/functions_documents.py
@@ -26,6 +26,7 @@
 )
 from functions_visio import build_visio_page_markdown, parse_vsdx_pages
 from functions_content import *
+from functions_content_understanding import analyze_image_with_content_understanding
 from functions_settings import *
 from functions_search import *
 from functions_logging import *
@@ -252,6 +253,10 @@ def _resolve_metadata_extraction_client(settings, identity_context=None):
 )
 DI_MARKDOWN_TABLE_SEPARATOR_PATTERN = re.compile(r'(?m)^\s*\|(?:\s*:?-{3,}:?\s*\|)+\s*$')
 DI_MARKDOWN_TABLE_ROW_PATTERN = re.compile(r'(?m)^\s*\|.+\|\s*$')
+# Document Intelligence Layout emits figures as markdown <figure> blocks or image tags. Auto mode
+# treats them as a signal that Enhanced extraction is worth the extra cost, because Content
+# Understanding is the only engine that describes figures.
+DI_MARKDOWN_FIGURE_PATTERN = re.compile(r'(<figure\b|</figure>|!\[[^\]]*\]\()', re.IGNORECASE)
 
 
 def is_pdf_file_name(file_name):
@@ -288,12 +293,155 @@ def _get_document_intelligence_auto_layout_reason(sampled_pages):
         return 'selection marks or checkbox states detected in the sampled pages'
     if DI_MARKDOWN_TABLE_ROW_PATTERN.search(sampled_text) and DI_MARKDOWN_TABLE_SEPARATOR_PATTERN.search(sampled_text):
         return 'table structure detected in the sampled pages'
+    if DI_MARKDOWN_FIGURE_PATTERN.search(sampled_text):
+        return 'figures or images detected in the sampled pages'
     return ''
 
 
+def _analyze_single_embedded_image(image_path, extraction_engine, image_extraction_mode, settings):
+    """Analyze one extracted Office image with the active engine and return its text."""
+    if extraction_engine == EXTRACTION_ENGINE_CONTENT_UNDERSTANDING:
+        return analyze_image_with_content_understanding(image_path, settings=settings)
+
+    image_pages = extract_content_with_azure_di(image_path, extraction_mode=image_extraction_mode)
+    return "\n\n".join(
+        str(page.get('content', '') or '').strip()
+        for page in image_pages or []
+        if isinstance(page, dict) and str(page.get('content', '') or '').strip()
+    ).strip()
+
+
+def _build_office_embedded_image_chunks(
+    file_path,
+    settings,
+    update_callback,
+    starting_page_number=1,
+):
+    """Analyze images embedded in an Office file and return them as labelled content chunks.
+
+    Neither engine describes figures inside Office files, so the images are pulled out of the OOXML
+    package and analyzed individually with whichever engine backs the admin's selected mode.
+
+    Returns ``(chunks, analyzed_count, extraction_engine)``.
+    """
+    if not settings.get('enable_office_embedded_image_analysis', True):
+        return [], 0, EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE
+
+    min_pixels = normalize_office_embedded_image_min_pixels(
+        settings.get('office_embedded_image_min_pixels')
+    )
+    max_images = normalize_office_embedded_image_max_per_document(
+        settings.get('office_embedded_image_max_per_document')
+    )
+    if max_images <= 0:
+        return [], 0, EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE
+
+    # Embedded images are images, so they follow the image side of the admin's configured mode.
+    admin_extraction_mode = get_effective_document_intelligence_pdf_image_extraction_mode(settings)
+    image_extraction_mode = 'read' if admin_extraction_mode == 'read' else 'layout'
+    extraction_engine, _ = _resolve_extraction_engine_for_mode(image_extraction_mode, settings)
+
+    chunks = []
+    analyzed_count = 0
+    temp_image_dir = None
+
+    try:
+        temp_image_dir = tempfile.mkdtemp(prefix='office_images_')
+        embedded_images = extract_office_embedded_images(
+            file_path,
+            temp_image_dir,
+            min_pixels=min_pixels,
+            max_images=max_images,
+        )
+
+        if not embedded_images:
+            return [], 0, extraction_engine
+
+        engine_label = (
+            "Content Understanding"
+            if extraction_engine == EXTRACTION_ENGINE_CONTENT_UNDERSTANDING
+            else "Document Intelligence"
+        )
+        total_images = len(embedded_images)
+        update_callback(
+            status=f"Analyzing {total_images} embedded image(s) with {engine_label}..."
+        )
+
+        for image_index, embedded_image in enumerate(embedded_images, start=1):
+            try:
+                analysis_text = _analyze_single_embedded_image(
+                    embedded_image['path'],
+                    extraction_engine,
+                    image_extraction_mode,
+                    settings,
+                )
+            except Exception as image_error:
+                log_event(
+                    f"[OFFICE_EMBEDDED_IMAGES] Failed to analyze {embedded_image.get('name')}: {image_error}",
+                    level=logging.WARNING,
+                )
+                continue
+
+            if not analysis_text:
+                continue
+
+            location_label = ''
+            slide_number = embedded_image.get('slide_number')
+            if slide_number:
+                location_label = f" on slide {slide_number}"
+
+            heading = (
+                f"### Embedded image {image_index} of {total_images}: "
+                f"{embedded_image.get('name')}{location_label}"
+            )
+            chunks.append({
+                'page_number': starting_page_number + len(chunks),
+                'content': f"{heading}\n\n{analysis_text}",
+            })
+            analyzed_count += 1
+
+        if analyzed_count:
+            update_callback(
+                status=f"Analyzed {analyzed_count} embedded image(s) with {engine_label}."
+            )
+    except Exception as embedded_image_error:
+        log_event(
+            f"[OFFICE_EMBEDDED_IMAGES] Embedded image analysis failed for "
+            f"{os.path.basename(file_path)}: {embedded_image_error}",
+            level=logging.WARNING,
+        )
+    finally:
+        if temp_image_dir and os.path.isdir(temp_image_dir):
+            shutil.rmtree(temp_image_dir, ignore_errors=True)
+
+    return chunks, analyzed_count, extraction_engine
+
+
+def _resolve_extraction_engine_for_mode(extraction_mode, settings):
+    """Resolve which engine backs the given extraction mode, plus a human-readable reason."""
+    return resolve_extraction_engine_for_mode(extraction_mode, settings)
+
+
+def _extract_pages_with_extraction_engine(
+    file_path,
+    extraction_mode,
+    extraction_engine,
+    settings=None,
+    pages=None,
+):
+    """Extract page content with the resolved engine, falling back to Document Intelligence Layout."""
+    return extract_content_with_extraction_engine(
+        file_path,
+        extraction_mode=extraction_mode,
+        extraction_engine=extraction_engine,
+        settings=settings,
+        pages=pages,
+    )
+
+
 def _resolve_document_intelligence_auto_mode(temp_file_path, is_pdf, is_image, page_count, sample_pages, update_callback):
     if is_image:
-        return 'layout', 'image input benefits from Enhanced extraction for spatial structure and selection marks'
+        return 'layout', 'image input benefits from Enhanced extraction for figures, spatial structure, and selection marks'
 
     if not is_pdf:
         return 'read', 'Auto mode is only evaluated for PDFs and images'
@@ -7004,18 +7152,27 @@ def process_di_document(document_id, user_id, temp_file_path, original_filename,
         print(f"Warning: Failed to extract initial metadata for {original_filename}: {e}")
         # Continue processing even if metadata fails
 
-    # --- DI Processing Logic ---
+    # --- Extraction Engine Resolution ---
+    # Standard extraction is always Document Intelligence prebuilt-read. Enhanced prefers Content
+    # Understanding, falling back to Document Intelligence prebuilt-layout when it is unavailable.
     settings = get_settings() # Assuming get_settings is accessible
     chunk_config = get_chunk_size_config(settings)
+    enhanced_extraction_enabled = is_enhanced_extraction_enabled(settings)
     document_intelligence_extraction_mode = 'read'
     document_intelligence_requested_mode = 'read'
     document_intelligence_auto_sample_pages = get_document_intelligence_auto_sample_pages(settings)
     document_intelligence_auto_reason = ''
+    extraction_engine = EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE
+    extraction_engine_reason = ''
     if is_pdf or is_image:
         if extraction_mode_override:
             document_intelligence_requested_mode = normalize_document_intelligence_manual_extraction_mode(extraction_mode_override)
         else:
-            document_intelligence_requested_mode = get_document_intelligence_pdf_image_extraction_mode(settings)
+            document_intelligence_requested_mode = get_effective_document_intelligence_pdf_image_extraction_mode(settings)
+
+        if document_intelligence_requested_mode != 'read' and not enhanced_extraction_enabled:
+            document_intelligence_requested_mode = 'read'
+            extraction_engine_reason = 'Enhanced extraction is disabled, so Standard extraction was used'
 
         if document_intelligence_requested_mode == 'auto':
             document_intelligence_extraction_mode, document_intelligence_auto_reason = _resolve_document_intelligence_auto_mode(
@@ -7030,11 +7187,20 @@ def process_di_document(document_id, user_id, temp_file_path, original_filename,
             document_intelligence_extraction_mode = document_intelligence_requested_mode
             document_intelligence_auto_reason = ''
 
+        resolved_engine, resolved_engine_reason = _resolve_extraction_engine_for_mode(
+            document_intelligence_extraction_mode,
+            settings,
+        )
+        extraction_engine = resolved_engine
+        extraction_engine_reason = resolved_engine_reason or extraction_engine_reason
+
         update_callback(
             document_intelligence_extraction_mode=document_intelligence_extraction_mode,
             document_intelligence_extraction_mode_requested=document_intelligence_requested_mode,
             document_intelligence_auto_sample_pages=document_intelligence_auto_sample_pages,
             document_intelligence_auto_reason=document_intelligence_auto_reason,
+            extraction_engine=extraction_engine,
+            extraction_engine_reason=extraction_engine_reason,
         )
 
     di_limit_bytes = 500 * 1024 * 1024
@@ -7139,29 +7305,44 @@ def process_di_document(document_id, user_id, temp_file_path, original_filename,
             except Exception as e:
                 raise Exception(f"Error extracting content from {chunk_effective_filename} with the legacy PowerPoint extractor: {str(e)}")
         else:
-            # Send chunk to Azure DI
-            update_callback(status=f"Sending {chunk_effective_filename} to Azure Document Intelligence...")
+            # Send chunk to the resolved extraction engine
+            engine_label = (
+                "Azure AI Content Understanding"
+                if extraction_engine == EXTRACTION_ENGINE_CONTENT_UNDERSTANDING
+                else "Azure Document Intelligence"
+            )
+            update_callback(status=f"Sending {chunk_effective_filename} to {engine_label}...")
             try:
-                di_extracted_pages = extract_content_with_azure_di(
+                di_extracted_pages, engine_used, engine_fallback_reason = _extract_pages_with_extraction_engine(
                     chunk_path,
-                    extraction_mode=document_intelligence_extraction_mode
+                    extraction_mode=document_intelligence_extraction_mode,
+                    extraction_engine=extraction_engine,
+                    settings=settings,
                 )
+                if engine_fallback_reason:
+                    extraction_engine = engine_used
+                    extraction_engine_reason = engine_fallback_reason
+                    update_callback(
+                        extraction_engine=engine_used,
+                        extraction_engine_reason=engine_fallback_reason,
+                    )
+
                 num_di_pages = len(di_extracted_pages)
                 conceptual_pages = num_di_pages if not is_image else 1 # Image is one conceptual item
 
                 if not di_extracted_pages and not is_image:
-                    print(f"Warning: Azure DI returned no content pages for {chunk_effective_filename}.")
-                    status_msg = f"Azure DI found no content in {chunk_effective_filename}."
+                    print(f"Warning: {engine_label} returned no content pages for {chunk_effective_filename}.")
+                    status_msg = f"{engine_label} found no content in {chunk_effective_filename}."
                     # Update page count to 0 if nothing found, otherwise keep previous estimate or conceptual count
                     update_callback(number_of_pages=0 if idx == num_file_chunks else conceptual_pages, status=status_msg)
                 elif not di_extracted_pages and is_image:
-                    print(f"Info: Azure DI processed image {chunk_effective_filename}, but extracted no text.")
+                    print(f"Info: {engine_label} processed image {chunk_effective_filename}, but extracted no text.")
                     update_callback(number_of_pages=conceptual_pages, status=f"Processed image {chunk_effective_filename} (no text found).")
                 else:
-                     update_callback(number_of_pages=conceptual_pages, status=f"Received {num_di_pages} content page(s)/slide(s) from Azure DI for {chunk_effective_filename}.")
+                     update_callback(number_of_pages=conceptual_pages, status=f"Received {num_di_pages} content page(s)/slide(s) from {engine_label} for {chunk_effective_filename}.")
 
             except Exception as e:
-                raise Exception(f"Error extracting content from {chunk_effective_filename} with Azure DI: {str(e)}")
+                raise Exception(f"Error extracting content from {chunk_effective_filename} with {engine_label}: {str(e)}")
 
         # --- Multi-Modal Vision Analysis (for images only) - Must happen BEFORE save_chunks ---
         if is_image and enable_enhanced_citations and idx == 1:  # Only run once for first chunk
@@ -7250,6 +7431,30 @@ def process_di_document(document_id, user_id, temp_file_path, original_filename,
                  final_chunks_to_save = di_extracted_pages
             else: final_chunks_to_save = [] # No text extracted
 
+        # --- Embedded Office image analysis (DOCX/DOC/PPTX) ---
+        # Neither extraction engine describes figures inside Office files, so embedded images are
+        # analyzed separately and appended as their own citable chunks.
+        if (is_word or is_ppt) and not is_legacy_doc and not is_legacy_ppt:
+            next_chunk_page_number = max(
+                (int(chunk.get('page_number') or 0) for chunk in final_chunks_to_save),
+                default=0,
+            ) + 1
+
+            embedded_image_chunks, embedded_image_count, embedded_image_engine = _build_office_embedded_image_chunks(
+                chunk_path,
+                settings,
+                update_callback,
+                starting_page_number=next_chunk_page_number,
+            )
+
+            if embedded_image_chunks:
+                final_chunks_to_save = list(final_chunks_to_save) + embedded_image_chunks
+                update_callback(
+                    number_of_pages=len(final_chunks_to_save),
+                    office_embedded_image_count=embedded_image_count,
+                    office_embedded_image_engine=embedded_image_engine,
+                )
+
         # Save Final Chunks to Search Index
         num_final_chunks = len(final_chunks_to_save)
         if not final_chunks_to_save:
@@ -7355,12 +7560,12 @@ def process_di_document(document_id, user_id, temp_file_path, original_filename,
 
 
 def validate_document_reprocess_source(document_item, user_id=None, group_id=None, public_workspace_id=None):
-    """Validate that a PDF has a stored source blob available for DI extraction changes."""
+    """Validate that a PDF or image has a stored source blob available for extraction changes."""
     if not document_item:
         return False, "Document not found."
 
-    if not is_pdf_file_name(document_item.get('file_name')):
-        return False, "Only PDF documents can change extraction between Standard and Enhanced."
+    if not is_pdf_or_image_file_name(document_item.get('file_name')):
+        return False, "Only PDF and image documents can change extraction between Standard and Enhanced."
 
     container_name, blob_path = get_document_blob_storage_info(
         document_item,
@@ -7369,13 +7574,13 @@ def validate_document_reprocess_source(document_item, user_id=None, group_id=Non
         public_workspace_id=public_workspace_id,
     )
     if not container_name or not blob_path:
-        return False, "Source PDF is unavailable. Re-upload this PDF before changing extraction."
+        return False, "Source file is unavailable. Re-upload this document before changing extraction."
 
     try:
         if not _blob_exists(container_name, blob_path):
-            return False, "Stored source PDF was not found in Blob Storage. Re-upload this PDF before changing extraction."
+            return False, "Stored source file was not found in Blob Storage. Re-upload this document before changing extraction."
     except Exception as e:
-        return False, f"Unable to validate stored source PDF: {str(e)}"
+        return False, f"Unable to validate stored source file: {str(e)}"
 
     return True, ""
 
@@ -7388,14 +7593,16 @@ def _download_document_source_to_temp_file(document_item, user_id=None, group_id
         public_workspace_id=public_workspace_id,
     )
     if not container_name or not blob_path:
-        raise FileNotFoundError("Source PDF is unavailable.")
+        raise FileNotFoundError("Source file is unavailable.")
+
+    file_suffix = os.path.splitext(str(document_item.get('file_name') or ''))[-1].lower() or '.pdf'
 
     blob_service_client = _get_blob_service_client()
     blob_client = blob_service_client.get_blob_client(container=container_name, blob=blob_path)
     temp_file_path = None
 
     try:
-        with tempfile.NamedTemporaryFile(delete=False, suffix='.pdf') as temp_file:
+        with tempfile.NamedTemporaryFile(delete=False, suffix=file_suffix) as temp_file:
             temp_file_path = temp_file.name
             download_stream = blob_client.download_blob()
             for chunk in download_stream.chunks():
@@ -7408,7 +7615,7 @@ def _download_document_source_to_temp_file(document_item, user_id=None, group_id
 
 
 def process_document_reprocess_extraction_background(document_id, user_id, target_extraction_mode, group_id=None, public_workspace_id=None):
-    """Extract a stored PDF again with an explicit Standard/Enhanced mode."""
+    """Extract a stored PDF or image again with an explicit Standard/Enhanced mode."""
     is_group = group_id is not None
     is_public_workspace = public_workspace_id is not None
     target_mode = normalize_document_intelligence_manual_extraction_mode(target_extraction_mode)
@@ -7444,6 +7651,13 @@ def update_doc_callback(**kwargs):
             raise ValueError(validation_message)
 
         original_filename = document_item.get('file_name') or f'{document_id}.pdf'
+        source_file_ext = os.path.splitext(original_filename)[-1].lower() or '.pdf'
+        target_engine, target_engine_reason = _resolve_extraction_engine_for_mode(target_mode, get_settings())
+        target_engine_label = (
+            "Content Understanding"
+            if target_engine == EXTRACTION_ENGINE_CONTENT_UNDERSTANDING
+            else "Document Intelligence"
+        )
         update_doc_callback(
             status=f"Queued to extract again with {target_mode_label}",
             percentage_complete=0,
@@ -7454,6 +7668,8 @@ def update_doc_callback(**kwargs):
             document_intelligence_extraction_mode_requested=target_mode,
             document_intelligence_auto_sample_pages=get_document_intelligence_auto_sample_pages(get_settings()),
             document_intelligence_auto_reason='Manual extraction change requested',
+            extraction_engine=target_engine,
+            extraction_engine_reason=target_engine_reason,
         )
 
         temp_file_path = _download_document_source_to_temp_file(
@@ -7466,13 +7682,13 @@ def update_doc_callback(**kwargs):
         update_doc_callback(status=f"Deleting existing chunks before extracting again with {target_mode_label}...")
         delete_document_chunks(document_id, group_id=group_id, public_workspace_id=public_workspace_id)
 
-        update_doc_callback(status=f"Extracting PDF again with Document Intelligence {target_mode_label}...")
+        update_doc_callback(status=f"Extracting again with {target_engine_label} {target_mode_label}...")
         result = process_di_document(
             document_id=document_id,
             user_id=user_id,
             temp_file_path=temp_file_path,
             original_filename=original_filename,
-            file_ext='.pdf',
+            file_ext=source_file_ext,
             enable_enhanced_citations=bool(document_item.get('enhanced_citations')),
             update_callback=update_doc_callback,
             group_id=group_id,
@@ -7489,7 +7705,7 @@ def update_doc_callback(**kwargs):
 
         final_update_args = {
             "number_of_pages": total_chunks_saved,
-            "status": _resolve_processing_complete_status(total_chunks_saved, '.pdf', tuple('.' + ext for ext in IMAGE_EXTENSIONS), tuple('.' + ext for ext in TABULAR_EXTENSIONS), 'disabled'),
+            "status": _resolve_processing_complete_status(total_chunks_saved, source_file_ext, tuple('.' + ext for ext in IMAGE_EXTENSIONS), tuple('.' + ext for ext in TABULAR_EXTENSIONS), 'disabled'),
             "percentage_complete": 100,
             "current_file_chunk": None,
         }
@@ -7499,7 +7715,7 @@ def update_doc_callback(**kwargs):
             final_update_args["embedding_model_deployment_name"] = embedding_model_name
         update_doc_callback(**final_update_args)
 
-        print(f"Document {document_id} extracted again successfully with Document Intelligence {target_mode}.")
+        print(f"Document {document_id} extracted again successfully with {target_engine_label} {target_mode}.")
     except Exception as e:
         print(f"Error extracting document {document_id} again: {repr(e)}\nTraceback:\n{traceback.format_exc()}")
         try:
diff --git a/application/single_app/functions_office_media.py b/application/single_app/functions_office_media.py
new file mode 100644
index 000000000..1b9fca28e
--- /dev/null
+++ b/application/single_app/functions_office_media.py
@@ -0,0 +1,240 @@
+# functions_office_media.py
+
+"""Embedded media extraction for OOXML Office files.
+
+Neither Document Intelligence nor Content Understanding describes figures inside Word and
+PowerPoint files. Pulling the embedded images out of the OOXML package lets the ingestion pipeline
+analyze them individually with whichever engine backs the selected extraction mode.
+
+This module deliberately keeps its imports light so it stays importable without Azure clients.
+"""
+
+import hashlib
+import os
+import re
+import zipfile
+from io import BytesIO
+
+from defusedxml.ElementTree import ParseError as DefusedParseError
+from defusedxml.ElementTree import fromstring as defused_fromstring
+from PIL import Image
+
+
+OFFICE_EMBEDDED_IMAGE_MEDIA_PREFIXES = ('word/media/', 'ppt/media/', 'xl/media/')
+# Restricted to raster formats that both Document Intelligence and Content Understanding accept.
+OFFICE_EMBEDDED_IMAGE_EXTENSIONS = ('.png', '.jpg', '.jpeg', '.bmp', '.tif', '.tiff', '.heif', '.heic')
+OFFICE_EMBEDDED_IMAGE_MIN_BYTES = 2048
+# Uploaded Office files are untrusted, so refuse to decompress an oversized embedded image.
+OFFICE_EMBEDDED_IMAGE_MAX_BYTES = 64 * 1024 * 1024
+# Slide relationship parts are small XML documents; anything larger is not worth decompressing.
+OFFICE_EMBEDDED_RELS_MAX_BYTES = 4 * 1024 * 1024
+# A zip header can understate the uncompressed size, so entries are streamed in bounded chunks.
+OFFICE_ZIP_READ_CHUNK_BYTES = 256 * 1024
+# Caps on how much of a crafted archive is inspected at all.
+OFFICE_ZIP_MAX_ENTRIES = 5000
+OFFICE_ZIP_MAX_RELS_ENTRIES = 500
+# Only the compression methods real OOXML packages use.
+OFFICE_ZIP_ALLOWED_COMPRESSION = (zipfile.ZIP_STORED, zipfile.ZIP_DEFLATED)
+
+_OFFICE_MEDIA_INDEX_PATTERN = re.compile(r'(\d+)')
+_PPTX_SLIDE_RELS_PATTERN = re.compile(r'^ppt/slides/_rels/slide(\d+)\.xml\.rels$', re.IGNORECASE)
+
+
+def _safe_media_base_name(media_name):
+    """Return a plain file name for a zip entry, defeating path traversal in crafted archives.
+
+    Zip entries are untrusted input and may embed ``..`` or platform separators, so both separator
+    styles are collapsed before taking the final component.
+    """
+    normalized_name = str(media_name or '').replace('\\', '/')
+    base_name = normalized_name.rsplit('/', 1)[-1]
+    base_name = os.path.basename(base_name)
+    if base_name in ('', '.', '..'):
+        return ''
+    return base_name
+
+
+def _read_zip_entry_bounded(archive, entry_name, max_bytes):
+    """Read a zip entry without trusting its declared uncompressed size.
+
+    ``ZipInfo.file_size`` comes from the archive header and can be forged. CPython decompresses a
+    chunk before truncating it to the declared size, so a 64 KB entry claiming to be 4 KB can still
+    spike memory into the hundreds of megabytes. Streaming with a bounded per-chunk read keeps the
+    decompressor's output capped, so the only safe limit is enforced here rather than from the header.
+
+    Returns the entry bytes, or ``None`` when the entry is unreadable or exceeds ``max_bytes``.
+    """
+    try:
+        entry_info = archive.getinfo(entry_name)
+    except KeyError:
+        return None
+
+    if entry_info.compress_type not in OFFICE_ZIP_ALLOWED_COMPRESSION:
+        return None
+
+    # Cheap pre-filter for honest archives; never the only bound.
+    if entry_info.file_size > max_bytes:
+        return None
+
+    chunks = []
+    total_bytes = 0
+    try:
+        with archive.open(entry_name) as entry_file:
+            while True:
+                chunk = entry_file.read(OFFICE_ZIP_READ_CHUNK_BYTES)
+                if not chunk:
+                    break
+                total_bytes += len(chunk)
+                if total_bytes > max_bytes:
+                    return None
+                chunks.append(chunk)
+    except (KeyError, ValueError, EOFError, zipfile.BadZipFile, zipfile.LargeZipFile, NotImplementedError):
+        return None
+
+    return b''.join(chunks)
+
+
+def _office_media_sort_key(media_name):
+    """Sort embedded media names naturally so image2 precedes image10."""
+    base_name = media_name.rsplit('/', 1)[-1]
+    match = _OFFICE_MEDIA_INDEX_PATTERN.search(base_name)
+    return (int(match.group(1)) if match else 0, base_name)
+
+
+def _build_pptx_media_slide_map(archive):
+    """Map ``ppt/media/*`` entries to the slide numbers that reference them.
+
+    Slide relationship parts come from an untrusted upload, so they get the same declared-size
+    guard as media entries and are parsed with a hardened XML parser.
+    """
+    media_slide_map = {}
+    inspected_rels = 0
+
+    for entry_name in archive.namelist():
+        if inspected_rels >= OFFICE_ZIP_MAX_RELS_ENTRIES:
+            break
+
+        slide_match = _PPTX_SLIDE_RELS_PATTERN.match(entry_name)
+        if not slide_match:
+            continue
+
+        inspected_rels += 1
+        slide_number = int(slide_match.group(1))
+
+        rels_bytes = _read_zip_entry_bounded(archive, entry_name, OFFICE_EMBEDDED_RELS_MAX_BYTES)
+        if rels_bytes is None:
+            continue
+
+        try:
+            rels_root = defused_fromstring(rels_bytes)
+        except (DefusedParseError, ValueError):
+            continue
+
+        for relationship in rels_root:
+            target = str(relationship.attrib.get('Target') or '').replace('\\', '/')
+            if '/media/' not in target:
+                continue
+            media_name = 'ppt/media/' + target.rsplit('/media/', 1)[-1]
+            # Keep the first slide that references the image so ordering stays stable.
+            media_slide_map.setdefault(media_name, slide_number)
+
+    return media_slide_map
+
+
+def extract_office_embedded_images(file_path, output_dir, min_pixels=150, max_images=25):
+    """Extract analyzable raster images embedded in an OOXML Office file.
+
+    Args:
+        file_path (str): Path to the DOCX/PPTX/XLSX file.
+        output_dir (str): Directory that extracted images are written to.
+        min_pixels (int): Minimum width and height required for an image to be analyzed.
+        max_images (int): Maximum number of images to extract.
+
+    Returns:
+        list: Dicts with ``name``, ``path``, ``width``, ``height``, and ``slide_number`` keys.
+    """
+    if max_images <= 0:
+        return []
+
+    extracted_images = []
+    seen_digests = set()
+
+    try:
+        with zipfile.ZipFile(file_path) as archive:
+            entry_names = archive.namelist()
+            if len(entry_names) > OFFICE_ZIP_MAX_ENTRIES:
+                # A real Office package never has this many parts; refuse to walk a crafted archive.
+                return []
+
+            media_slide_map = _build_pptx_media_slide_map(archive)
+
+            candidate_names = [
+                entry_name for entry_name in entry_names
+                if entry_name.lower().startswith(OFFICE_EMBEDDED_IMAGE_MEDIA_PREFIXES)
+                and entry_name.lower().endswith(OFFICE_EMBEDDED_IMAGE_EXTENSIONS)
+            ]
+
+            inspected_media = 0
+            for media_name in sorted(candidate_names, key=_office_media_sort_key):
+                if len(extracted_images) >= max_images:
+                    break
+                # Bound the work a malformed archive can cause, not just successful extractions.
+                if inspected_media >= max_images * 10:
+                    break
+                inspected_media += 1
+
+                base_name = _safe_media_base_name(media_name)
+                if not base_name:
+                    continue
+
+                image_bytes = _read_zip_entry_bounded(
+                    archive,
+                    media_name,
+                    OFFICE_EMBEDDED_IMAGE_MAX_BYTES,
+                )
+                if image_bytes is None:
+                    continue
+
+                # Small assets are almost always icons, bullets, or spacer graphics.
+                if len(image_bytes) < OFFICE_EMBEDDED_IMAGE_MIN_BYTES:
+                    continue
+
+                digest = hashlib.sha256(image_bytes).hexdigest()
+                if digest in seen_digests:
+                    continue
+
+                try:
+                    with Image.open(BytesIO(image_bytes)) as embedded_image:
+                        width, height = embedded_image.size
+                except Exception:
+                    continue
+
+                if width < min_pixels or height < min_pixels:
+                    continue
+
+                # The output name is generated rather than taken from the archive, so a crafted
+                # entry name can never influence where the file is written.
+                extension = os.path.splitext(base_name)[1].lower()
+                if extension not in OFFICE_EMBEDDED_IMAGE_EXTENSIONS:
+                    continue
+                output_path = os.path.join(output_dir, f"{len(extracted_images) + 1:03d}{extension}")
+
+                seen_digests.add(digest)
+
+                try:
+                    with open(output_path, 'wb') as output_file:
+                        output_file.write(image_bytes)
+                except OSError:
+                    continue
+
+                extracted_images.append({
+                    'name': base_name,
+                    'path': output_path,
+                    'width': width,
+                    'height': height,
+                    'slide_number': media_slide_map.get(media_name),
+                })
+    except (zipfile.BadZipFile, FileNotFoundError, OSError):
+        return []
+
+    return extracted_images
diff --git a/application/single_app/functions_settings.py b/application/single_app/functions_settings.py
index b0b8c32da..c65039416 100644
--- a/application/single_app/functions_settings.py
+++ b/application/single_app/functions_settings.py
@@ -90,6 +90,7 @@
     "azure_apim_ai_search_subscription_key",
     "azure_document_intelligence_key",
     "azure_apim_document_intelligence_subscription_key",
+    "azure_content_understanding_key",
     "speech_service_key",
     "model_endpoint_identity_header_hmac_secret",
 )
@@ -530,6 +531,23 @@ def is_mixed_source_relevance_candidates_enabled(settings):
 DOCUMENT_INTELLIGENCE_MANUAL_EXTRACTION_MODES = {"read", "layout"}
 DOCUMENT_INTELLIGENCE_AUTO_SAMPLE_PAGES_DEFAULT = 3
 DOCUMENT_INTELLIGENCE_AUTO_SAMPLE_PAGES_MAX = 20
+
+# Enhanced extraction engines. Standard extraction is always Document Intelligence prebuilt-read.
+EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE = "document_intelligence"
+EXTRACTION_ENGINE_CONTENT_UNDERSTANDING = "content_understanding"
+EXTRACTION_ENGINES = {EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE, EXTRACTION_ENGINE_CONTENT_UNDERSTANDING}
+
+CONTENT_UNDERSTANDING_AUTHENTICATION_TYPES = {"key", "managed_identity"}
+CONTENT_UNDERSTANDING_API_VERSION_DEFAULT = "2025-11-01"
+CONTENT_UNDERSTANDING_DOCUMENT_ANALYZER_DEFAULT = "prebuilt-documentSearch"
+CONTENT_UNDERSTANDING_IMAGE_ANALYZER_DEFAULT = "prebuilt-imageSearch"
+# Azure AI Content Understanding is only offered in Azure commercial regions today.
+CONTENT_UNDERSTANDING_SUPPORTED_AZURE_ENVIRONMENTS = {"public"}
+
+OFFICE_EMBEDDED_IMAGE_MIN_PIXELS_DEFAULT = 150
+OFFICE_EMBEDDED_IMAGE_MIN_PIXELS_MAX = 2000
+OFFICE_EMBEDDED_IMAGE_MAX_PER_DOCUMENT_DEFAULT = 25
+OFFICE_EMBEDDED_IMAGE_MAX_PER_DOCUMENT_MAX = 200
 AGENTS_PAGE_PROMOTED_POPULAR_ORDER_OPTIONS = {"before", "after", "mixed"}
 AGENTS_PAGE_PROMOTED_POPULAR_WINDOW_OPTIONS = {"all_time", "30_days", "both"}
 AGENTS_PAGE_PROMOTED_POPULAR_TAG_LABEL_DEFAULT = "Promoted"
@@ -701,6 +719,153 @@ def normalize_document_intelligence_manual_extraction_mode(value):
     return normalized_value
 
 
+def normalize_enhanced_extraction_enabled(value):
+    """Normalize the Enhanced extraction master toggle into a strict boolean."""
+    if isinstance(value, bool):
+        return value
+    if isinstance(value, str):
+        normalized_value = value.strip().lower()
+        if normalized_value in {"false", "0", "no", "off", ""}:
+            return False
+        if normalized_value in {"true", "1", "yes", "on"}:
+            return True
+    return bool(value)
+
+
+def is_enhanced_extraction_enabled(settings):
+    """Return whether admins have enabled Enhanced extraction beyond Document Intelligence Standard."""
+    return normalize_enhanced_extraction_enabled((settings or {}).get('enable_enhanced_extraction'))
+
+
+def get_effective_document_intelligence_pdf_image_extraction_mode(settings):
+    """Return the extraction mode actually used, forcing Standard when Enhanced is disabled."""
+    if not is_enhanced_extraction_enabled(settings):
+        return "read"
+    return get_document_intelligence_pdf_image_extraction_mode(settings)
+
+
+def normalize_content_understanding_authentication_type(value):
+    """Normalize the Content Understanding authentication type to key or managed identity."""
+    normalized_value = str(value or "key").strip().lower()
+    if normalized_value not in CONTENT_UNDERSTANDING_AUTHENTICATION_TYPES:
+        return "key"
+    return normalized_value
+
+
+def normalize_content_understanding_endpoint(value):
+    """Normalize the Content Understanding endpoint by trimming whitespace and trailing slashes."""
+    return str(value or "").strip().rstrip("/")
+
+
+def normalize_content_understanding_api_version(value):
+    """Normalize the Content Understanding API version, falling back to the GA version."""
+    normalized_value = str(value or "").strip()
+    return normalized_value or CONTENT_UNDERSTANDING_API_VERSION_DEFAULT
+
+
+def normalize_content_understanding_analyzer_id(value, default_analyzer_id=None):
+    """Normalize a Content Understanding analyzer id, falling back to the supplied prebuilt default."""
+    fallback_analyzer_id = default_analyzer_id or CONTENT_UNDERSTANDING_DOCUMENT_ANALYZER_DEFAULT
+    normalized_value = str(value or "").strip()
+    return normalized_value or fallback_analyzer_id
+
+
+def normalize_office_embedded_image_min_pixels(value):
+    """Normalize the minimum width/height an embedded Office image must have to be analyzed."""
+    try:
+        normalized_value = int(value)
+    except (TypeError, ValueError):
+        normalized_value = OFFICE_EMBEDDED_IMAGE_MIN_PIXELS_DEFAULT
+
+    return max(1, min(normalized_value, OFFICE_EMBEDDED_IMAGE_MIN_PIXELS_MAX))
+
+
+def normalize_office_embedded_image_max_per_document(value):
+    """Normalize how many embedded Office images may be analyzed for a single document."""
+    try:
+        normalized_value = int(value)
+    except (TypeError, ValueError):
+        normalized_value = OFFICE_EMBEDDED_IMAGE_MAX_PER_DOCUMENT_DEFAULT
+
+    return max(0, min(normalized_value, OFFICE_EMBEDDED_IMAGE_MAX_PER_DOCUMENT_MAX))
+
+
+def is_content_understanding_supported_environment(azure_environment=None):
+    """Return whether the running Azure cloud offers Azure AI Content Understanding."""
+    resolved_environment = str(
+        azure_environment if azure_environment is not None else AZURE_ENVIRONMENT
+    ).strip().lower()
+    return resolved_environment in CONTENT_UNDERSTANDING_SUPPORTED_AZURE_ENVIRONMENTS
+
+
+def get_content_understanding_config(settings):
+    """Return the normalized Content Understanding connection settings."""
+    resolved_settings = settings or {}
+    return {
+        'endpoint': normalize_content_understanding_endpoint(
+            resolved_settings.get('azure_content_understanding_endpoint')
+        ),
+        'key': str(resolved_settings.get('azure_content_understanding_key') or '').strip(),
+        'authentication_type': normalize_content_understanding_authentication_type(
+            resolved_settings.get('azure_content_understanding_authentication_type')
+        ),
+        'api_version': normalize_content_understanding_api_version(
+            resolved_settings.get('azure_content_understanding_api_version')
+        ),
+        'analyzer_id': normalize_content_understanding_analyzer_id(
+            resolved_settings.get('azure_content_understanding_analyzer_id'),
+            CONTENT_UNDERSTANDING_DOCUMENT_ANALYZER_DEFAULT,
+        ),
+        'image_analyzer_id': normalize_content_understanding_analyzer_id(
+            resolved_settings.get('azure_content_understanding_image_analyzer_id'),
+            CONTENT_UNDERSTANDING_IMAGE_ANALYZER_DEFAULT,
+        ),
+    }
+
+
+def is_content_understanding_configured(settings):
+    """Return whether Content Understanding has enough configuration to be called."""
+    config = get_content_understanding_config(settings)
+    if not config['endpoint']:
+        return False
+    if config['authentication_type'] == 'key' and not config['key']:
+        return False
+    return True
+
+
+def resolve_enhanced_extraction_engine(settings, azure_environment=None):
+    """Resolve which engine backs Enhanced extraction, plus a human-readable reason.
+
+    Enhanced always falls back to Document Intelligence Layout so Enhanced stays usable in
+    clouds where Content Understanding is unavailable, or before it has been configured.
+    """
+    if not is_content_understanding_supported_environment(azure_environment):
+        resolved_environment = str(
+            azure_environment if azure_environment is not None else AZURE_ENVIRONMENT
+        ).strip().lower()
+        return (
+            EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE,
+            f"Content Understanding is not available in the {resolved_environment} cloud, "
+            "so Enhanced used Document Intelligence Layout",
+        )
+
+    if not is_content_understanding_configured(settings):
+        return (
+            EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE,
+            "Content Understanding is not configured, so Enhanced used Document Intelligence Layout",
+        )
+
+    return (EXTRACTION_ENGINE_CONTENT_UNDERSTANDING, '')
+
+
+def normalize_extraction_engine(value):
+    """Normalize a persisted extraction engine value, defaulting to Document Intelligence."""
+    normalized_value = str(value or "").strip().lower()
+    if normalized_value not in EXTRACTION_ENGINES:
+        return EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE
+    return normalized_value
+
+
 def normalize_app_role_claims(user_roles):
     """Normalize app role claims into a flat string list."""
     if not user_roles:
@@ -1566,6 +1731,20 @@ def get_settings(use_cosmos=False, include_source=False):
         'azure_apim_document_intelligence_endpoint': '',
         'azure_apim_document_intelligence_subscription_key': '',
 
+        # Enhanced extraction. Standard is always Document Intelligence prebuilt-read; Enhanced uses
+        # Azure AI Content Understanding in Azure commercial clouds and falls back to Document
+        # Intelligence prebuilt-layout everywhere else.
+        'enable_enhanced_extraction': False,
+        'azure_content_understanding_endpoint': '',
+        'azure_content_understanding_key': '',
+        'azure_content_understanding_authentication_type': 'key',
+        'azure_content_understanding_api_version': CONTENT_UNDERSTANDING_API_VERSION_DEFAULT,
+        'azure_content_understanding_analyzer_id': CONTENT_UNDERSTANDING_DOCUMENT_ANALYZER_DEFAULT,
+        'azure_content_understanding_image_analyzer_id': CONTENT_UNDERSTANDING_IMAGE_ANALYZER_DEFAULT,
+        'enable_office_embedded_image_analysis': True,
+        'office_embedded_image_min_pixels': OFFICE_EMBEDDED_IMAGE_MIN_PIXELS_DEFAULT,
+        'office_embedded_image_max_per_document': OFFICE_EMBEDDED_IMAGE_MAX_PER_DOCUMENT_DEFAULT,
+
         # Web search (via Azure AI Foundry agent)
         'enable_web_search': False,
         'web_search_consent_accepted': False,
@@ -1798,6 +1977,13 @@ def _format_result(settings_payload, source):
         legacy_control_center_schedule = (
             'control_center_auto_refresh_timezone' not in settings_item
         )
+        # Enhanced extraction gained an explicit enable toggle. Deployments that already selected
+        # Enhanced or Auto must keep it, otherwise they would silently downgrade to Standard and
+        # then lose the stored mode on the next admin settings save.
+        legacy_enhanced_extraction = 'enable_enhanced_extraction' not in settings_item
+        legacy_enhanced_extraction_mode = normalize_document_intelligence_pdf_image_extraction_mode(
+            settings_item.get('document_intelligence_pdf_image_extraction_mode')
+        )
         legacy_control_center_time = settings_item.get('control_center_auto_refresh_time')
         if not isinstance(legacy_control_center_time, str):
             legacy_hour = settings_item.get('control_center_auto_refresh_hour', 6)
@@ -1822,6 +2008,10 @@ def _format_result(settings_payload, source):
                 merged['control_center_auto_refresh_timezone'] = 'UTC'
             merged['control_center_auto_refresh_next_run'] = None
             control_center_schedule_migration_updated = True
+        enhanced_extraction_migration_updated = False
+        if legacy_enhanced_extraction and legacy_enhanced_extraction_mode in ('layout', 'auto'):
+            merged['enable_enhanced_extraction'] = True
+            enhanced_extraction_migration_updated = True
         migration_updated = apply_custom_endpoint_setting_migration(merged)
         assignment_settings_updated = normalize_group_workflow_assignment_settings(merged)
         promoted_popular_settings_updated = normalize_agents_page_promoted_popular_settings(merged)
@@ -1838,6 +2028,7 @@ def _format_result(settings_payload, source):
         if (
             merge_changed
             or control_center_schedule_migration_updated
+            or enhanced_extraction_migration_updated
             or migration_updated
             or assignment_settings_updated
             or promoted_popular_settings_updated
diff --git a/application/single_app/route_backend_documents.py b/application/single_app/route_backend_documents.py
index ec3261c02..dcb60096e 100644
--- a/application/single_app/route_backend_documents.py
+++ b/application/single_app/route_backend_documents.py
@@ -1357,6 +1357,8 @@ def api_reprocess_document_extraction():
         if raw_mode not in DOCUMENT_INTELLIGENCE_MANUAL_EXTRACTION_MODES:
             return jsonify({'error': 'Extraction mode must be Standard or Enhanced.'}), 400
         target_mode = normalize_document_intelligence_manual_extraction_mode(raw_mode)
+        if target_mode == 'layout' and not is_enhanced_extraction_enabled(get_settings()):
+            return jsonify({'error': 'Enhanced extraction is disabled. Enable it in Admin Settings first.'}), 400
 
         document_ids = payload.get('document_ids')
         if not isinstance(document_ids, list):
diff --git a/application/single_app/route_backend_group_documents.py b/application/single_app/route_backend_group_documents.py
index 5b769623f..607f8a7df 100644
--- a/application/single_app/route_backend_group_documents.py
+++ b/application/single_app/route_backend_group_documents.py
@@ -1300,6 +1300,8 @@ def api_reprocess_group_document_extraction():
         if raw_mode not in DOCUMENT_INTELLIGENCE_MANUAL_EXTRACTION_MODES:
             return jsonify({'error': 'Extraction mode must be Standard or Enhanced.'}), 400
         target_mode = normalize_document_intelligence_manual_extraction_mode(raw_mode)
+        if target_mode == 'layout' and not is_enhanced_extraction_enabled(get_settings()):
+            return jsonify({'error': 'Enhanced extraction is disabled. Enable it in Admin Settings first.'}), 400
 
         document_ids = payload.get('document_ids')
         if not isinstance(document_ids, list):
diff --git a/application/single_app/route_backend_public_documents.py b/application/single_app/route_backend_public_documents.py
index 7b7bd6155..3bbc2a445 100644
--- a/application/single_app/route_backend_public_documents.py
+++ b/application/single_app/route_backend_public_documents.py
@@ -1125,6 +1125,8 @@ def api_reprocess_public_document_extraction():
         if raw_mode not in DOCUMENT_INTELLIGENCE_MANUAL_EXTRACTION_MODES:
             return jsonify({'error': 'Extraction mode must be Standard or Enhanced.'}), 400
         target_mode = normalize_document_intelligence_manual_extraction_mode(raw_mode)
+        if target_mode == 'layout' and not is_enhanced_extraction_enabled(get_settings()):
+            return jsonify({'error': 'Enhanced extraction is disabled. Enable it in Admin Settings first.'}), 400
 
         document_ids = payload.get('document_ids')
         if not isinstance(document_ids, list):
diff --git a/application/single_app/route_backend_settings.py b/application/single_app/route_backend_settings.py
index 24736ed14..9f582f7ec 100644
--- a/application/single_app/route_backend_settings.py
+++ b/application/single_app/route_backend_settings.py
@@ -90,6 +90,8 @@ def _resolve_admin_settings_test_secrets(payload):
             _resolve_test_payload_secret(payload, ('apim', 'subscription_key'), settings, 'azure_apim_document_intelligence_subscription_key')
         else:
             _resolve_test_payload_secret(payload, ('direct', 'key'), settings, 'azure_document_intelligence_key')
+    elif test_type == 'content_understanding':
+        _resolve_test_payload_secret(payload, ('key',), settings, 'azure_content_understanding_key')
     elif test_type == 'redis':
         _resolve_test_payload_secret(payload, ('key',), settings, 'redis_key')
     elif test_type == 'web_search':
@@ -746,6 +748,9 @@ def test_connection():
             elif test_type == 'azure_doc_intelligence':
                 return _test_azure_doc_intelligence_connection(data)
 
+            elif test_type == 'content_understanding':
+                return _test_content_understanding_connection(data)
+
             elif test_type == 'multimodal_vision':
                 return _test_multimodal_vision_connection(data)
 
@@ -1997,13 +2002,47 @@ def _test_azure_doc_intelligence_connection(payload):
         time.sleep(10)
 
     if status == "succeeded":
-        if extraction_mode == "auto":
-            return jsonify({'message': 'Azure document intelligence Auto connection successful. Auto samples PDFs with Enhanced extraction during ingestion, then finishes with Standard or Enhanced.'}), 200
-        extraction_mode_label = "Enhanced" if extraction_mode == "layout" else "Standard"
-        return jsonify({'message': f'Azure document intelligence {extraction_mode_label} connection successful'}), 200
+        if test_extraction_mode == "layout":
+            return jsonify({'message': (
+                'Azure document intelligence connection successful. Standard extraction and the '
+                'Layout model used for Auto sampling and Enhanced fallback are both reachable.'
+            )}), 200
+        return jsonify({'message': 'Azure document intelligence Standard connection successful'}), 200
     else:
         return jsonify({'error': f"Document Intelligence error: {status}"}), 500
 
+def _test_content_understanding_connection(payload):
+    """Attempt to reach Azure AI Content Understanding using ephemeral settings."""
+    from functions_content_understanding import test_content_understanding_connection
+
+    config_override = {
+        'endpoint': payload.get('endpoint'),
+        'key': payload.get('key'),
+        'authentication_type': payload.get('authentication_type'),
+        'api_version': payload.get('api_version'),
+        'analyzer_id': payload.get('analyzer_id'),
+        'image_analyzer_id': payload.get('image_analyzer_id'),
+    }
+
+    sample_file_path = None
+    if payload.get('run_sample_analysis'):
+        candidate_path = os.path.join(current_app.root_path, 'static', 'test_files', 'test_document.pdf')
+        if os.path.exists(candidate_path):
+            sample_file_path = candidate_path
+
+    try:
+        is_ok, message = test_content_understanding_connection(
+            config_override,
+            sample_file_path=sample_file_path,
+        )
+    except Exception as e:
+        return jsonify({'error': f'Content Understanding connection error: {str(e)}'}), 500
+
+    if is_ok:
+        return jsonify({'message': message}), 200
+    return jsonify({'error': message}), 400
+
+
 def _test_key_vault_connection(payload):
     """Attempt to connect to Azure Key Vault using ephemeral settings."""
     vault_name = payload.get('vault_name', '').strip()
diff --git a/application/single_app/route_frontend_admin_settings.py b/application/single_app/route_frontend_admin_settings.py
index 48f0329d7..0703e81e3 100644
--- a/application/single_app/route_frontend_admin_settings.py
+++ b/application/single_app/route_frontend_admin_settings.py
@@ -1002,6 +1002,10 @@ def admin_settings():
                 app_settings=settings_for_template,
                 settings=settings_for_template,
                 azure_environment=AZURE_ENVIRONMENT,
+                content_understanding_supported=is_content_understanding_supported_environment(),
+                content_understanding_api_version_default=CONTENT_UNDERSTANDING_API_VERSION_DEFAULT,
+                content_understanding_document_analyzer_default=CONTENT_UNDERSTANDING_DOCUMENT_ANALYZER_DEFAULT,
+                content_understanding_image_analyzer_default=CONTENT_UNDERSTANDING_IMAGE_ANALYZER_DEFAULT,
                 default_video_indexer_endpoint=video_indexer_endpoint,
                 default_video_indexer_arm_api_version=DEFAULT_VIDEO_INDEXER_ARM_API_VERSION,
                 user_settings=user_settings,
@@ -2328,6 +2332,39 @@ def is_valid_url(url):
                 form_data.get('document_intelligence_auto_sample_pages')
             )
 
+            enable_enhanced_extraction = form_data.get('enable_enhanced_extraction') == 'on'
+            enhanced_extraction_was_enabled = is_enhanced_extraction_enabled(settings)
+            if not enable_enhanced_extraction:
+                # Standard is the only mode available while Enhanced is off.
+                document_intelligence_pdf_image_extraction_mode = 'read'
+            elif not enhanced_extraction_was_enabled and document_intelligence_pdf_image_extraction_mode == 'read':
+                # Turning Enhanced on defaults to Auto so it upgrades only when structure is detected.
+                document_intelligence_pdf_image_extraction_mode = 'auto'
+
+            azure_content_understanding_endpoint = normalize_content_understanding_endpoint(
+                form_data.get('azure_content_understanding_endpoint')
+            )
+            azure_content_understanding_authentication_type = normalize_content_understanding_authentication_type(
+                form_data.get('azure_content_understanding_authentication_type')
+            )
+            azure_content_understanding_api_version = normalize_content_understanding_api_version(
+                form_data.get('azure_content_understanding_api_version')
+            )
+            azure_content_understanding_analyzer_id = normalize_content_understanding_analyzer_id(
+                form_data.get('azure_content_understanding_analyzer_id'),
+                CONTENT_UNDERSTANDING_DOCUMENT_ANALYZER_DEFAULT,
+            )
+            azure_content_understanding_image_analyzer_id = normalize_content_understanding_analyzer_id(
+                form_data.get('azure_content_understanding_image_analyzer_id'),
+                CONTENT_UNDERSTANDING_IMAGE_ANALYZER_DEFAULT,
+            )
+            office_embedded_image_min_pixels = normalize_office_embedded_image_min_pixels(
+                form_data.get('office_embedded_image_min_pixels')
+            )
+            office_embedded_image_max_per_document = normalize_office_embedded_image_max_per_document(
+                form_data.get('office_embedded_image_max_per_document')
+            )
+
             # --- Construct new_settings Dictionary ---
             new_settings = {
                 # Logging
@@ -2728,6 +2765,18 @@ def is_valid_url(url):
                 'azure_apim_document_intelligence_endpoint': form_data.get('azure_apim_document_intelligence_endpoint', '').strip(),
                 'azure_apim_document_intelligence_subscription_key': admin_secret('azure_apim_document_intelligence_subscription_key'),
 
+                # Enhanced extraction (Azure AI Content Understanding, with Doc Intelligence Layout fallback)
+                'enable_enhanced_extraction': enable_enhanced_extraction,
+                'azure_content_understanding_endpoint': azure_content_understanding_endpoint,
+                'azure_content_understanding_key': admin_secret('azure_content_understanding_key'),
+                'azure_content_understanding_authentication_type': azure_content_understanding_authentication_type,
+                'azure_content_understanding_api_version': azure_content_understanding_api_version,
+                'azure_content_understanding_analyzer_id': azure_content_understanding_analyzer_id,
+                'azure_content_understanding_image_analyzer_id': azure_content_understanding_image_analyzer_id,
+                'enable_office_embedded_image_analysis': form_data.get('enable_office_embedded_image_analysis') == 'on',
+                'office_embedded_image_min_pixels': office_embedded_image_min_pixels,
+                'office_embedded_image_max_per_document': office_embedded_image_max_per_document,
+
                 'enable_key_vault_secret_storage': form_data.get('enable_key_vault_secret_storage') == 'on',
                 'key_vault_name': form_data.get('key_vault_name', '').strip(),
                 'key_vault_identity': form_data.get('key_vault_identity', ''),
diff --git a/application/single_app/route_frontend_chats.py b/application/single_app/route_frontend_chats.py
index 71adc39dc..4e700465b 100644
--- a/application/single_app/route_frontend_chats.py
+++ b/application/single_app/route_frontend_chats.py
@@ -1317,12 +1317,13 @@ def upload_file():
             if file_ext_nodot in (DOCUMENT_EXTENSIONS | {'html'}) or is_image_file:
                 extraction_mode = 'read'
                 if file_ext == '.pdf' or is_image_file:
-                    extraction_mode = get_document_intelligence_pdf_image_extraction_mode(settings)
+                    extraction_mode = get_effective_document_intelligence_pdf_image_extraction_mode(settings)
                     if extraction_mode == 'auto':
                         extraction_mode = 'layout' if is_image_file else 'read'
-                extracted_content_raw  = extract_content_with_azure_di(
+                extracted_content_raw, _extraction_engine_used, _extraction_engine_fallback = extract_content_with_extraction_engine(
                     temp_file_path,
-                    extraction_mode=extraction_mode
+                    extraction_mode=extraction_mode,
+                    settings=settings
                 )
                 
                 # Convert pages_data list to string
diff --git a/application/single_app/semantic_kernel_plugins/smart_http_plugin.py b/application/single_app/semantic_kernel_plugins/smart_http_plugin.py
index 64e220959..6c148bc57 100644
--- a/application/single_app/semantic_kernel_plugins/smart_http_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/smart_http_plugin.py
@@ -385,8 +385,8 @@ async def _process_pdf_content(self, pdf_bytes: bytes, uri: str, response) -> st
         """Process PDF content using Document Intelligence with large PDF support."""
         try:
             # Import here to avoid circular imports
-            from functions_content import extract_content_with_azure_di
-            from functions_settings import get_document_intelligence_pdf_image_extraction_mode, get_settings
+            from functions_content import extract_content_with_extraction_engine
+            from functions_settings import get_effective_document_intelligence_pdf_image_extraction_mode, get_settings
             from config import initialize_clients, CLIENTS
             
             # Check if pdf_bytes is actually string content (error case)
@@ -425,12 +425,13 @@ async def _process_pdf_content(self, pdf_bytes: bytes, uri: str, response) -> st
                 if pdf_size > max_di_size:
                     return f"📄 **PDF TOO LARGE FOR PROCESSING**\n📍 Source: {uri}\n📊 File size: {pdf_size:,} bytes (exceeds {max_di_size:,} byte limit for Document Intelligence)\n\n⚠️  This PDF is too large for automated text extraction. Please try:\n• A smaller PDF document\n• Specific sections of the document\n• Contact the document provider for a text version"
                 
-                extraction_mode = get_document_intelligence_pdf_image_extraction_mode(settings)
+                extraction_mode = get_effective_document_intelligence_pdf_image_extraction_mode(settings)
                 if extraction_mode == 'auto':
                     extraction_mode = 'read'
-                pages_data = extract_content_with_azure_di(
+                pages_data, _engine_used, _engine_fallback = extract_content_with_extraction_engine(
                     temp_file_path,
-                    extraction_mode=extraction_mode
+                    extraction_mode=extraction_mode,
+                    settings=settings
                 )
                 
                 if not pages_data:
diff --git a/application/single_app/static/js/admin/admin_settings.js b/application/single_app/static/js/admin/admin_settings.js
index 3e99fb82d..aefe16ff1 100644
--- a/application/single_app/static/js/admin/admin_settings.js
+++ b/application/single_app/static/js/admin/admin_settings.js
@@ -6811,6 +6811,59 @@ function setupToggles() {
         documentIntelligenceAutoSamplePages.addEventListener('input', markFormAsModified);
     }
 
+    const enableEnhancedExtraction = document.getElementById('enable_enhanced_extraction');
+    const enhancedExtractionSettings = document.getElementById('enhanced_extraction_settings');
+    const updateEnhancedExtractionControls = () => {
+        if (!enableEnhancedExtraction || !enhancedExtractionSettings) {
+            return;
+        }
+        enhancedExtractionSettings.classList.toggle('d-none', !enableEnhancedExtraction.checked);
+    };
+    if (enableEnhancedExtraction) {
+        updateEnhancedExtractionControls();
+        enableEnhancedExtraction.addEventListener('change', function () {
+            updateEnhancedExtractionControls();
+            // Turning Enhanced on defaults to Auto so it upgrades only when structure is detected.
+            if (this.checked && documentIntelligenceExtractionMode && documentIntelligenceExtractionMode.value === 'read') {
+                documentIntelligenceExtractionMode.value = 'auto';
+                updateDocumentIntelligenceAutoControls();
+            }
+            markFormAsModified();
+        });
+    }
+
+    const contentUnderstandingAuthType = document.getElementById('azure_content_understanding_authentication_type');
+    const contentUnderstandingKeyContainer = document.getElementById('azure_content_understanding_key_container');
+    const updateContentUnderstandingAuthControls = () => {
+        if (!contentUnderstandingAuthType || !contentUnderstandingKeyContainer) {
+            return;
+        }
+        contentUnderstandingKeyContainer.classList.toggle('d-none', contentUnderstandingAuthType.value === 'managed_identity');
+    };
+    if (contentUnderstandingAuthType) {
+        updateContentUnderstandingAuthControls();
+        contentUnderstandingAuthType.addEventListener('change', function () {
+            updateContentUnderstandingAuthControls();
+            markFormAsModified();
+        });
+    }
+
+    const enableOfficeEmbeddedImageAnalysis = document.getElementById('enable_office_embedded_image_analysis');
+    const officeEmbeddedImageOptions = document.getElementById('office_embedded_image_options');
+    const updateOfficeEmbeddedImageControls = () => {
+        if (!enableOfficeEmbeddedImageAnalysis || !officeEmbeddedImageOptions) {
+            return;
+        }
+        officeEmbeddedImageOptions.classList.toggle('d-none', !enableOfficeEmbeddedImageAnalysis.checked);
+    };
+    if (enableOfficeEmbeddedImageAnalysis) {
+        updateOfficeEmbeddedImageControls();
+        enableOfficeEmbeddedImageAnalysis.addEventListener('change', function () {
+            updateOfficeEmbeddedImageControls();
+            markFormAsModified();
+        });
+    }
+
     const enableContentSafetyCheckbox = document.getElementById('enable_content_safety');
     if (enableContentSafetyCheckbox) {
         enableContentSafetyCheckbox.addEventListener('change', function() {
@@ -8363,6 +8416,44 @@ function setupTestButtons() {
         });
     }
 
+    const testContentUnderstandingBtn = document.getElementById('test_content_understanding_button');
+    if (testContentUnderstandingBtn) {
+        testContentUnderstandingBtn.addEventListener('click', async () => {
+            const resultDiv = document.getElementById('test_content_understanding_result');
+            resultDiv.className = 'mt-2';
+            resultDiv.textContent = 'Testing Content Understanding...';
+
+            const payload = {
+                test_type: 'content_understanding',
+                endpoint: document.getElementById('azure_content_understanding_endpoint')?.value || '',
+                authentication_type: document.getElementById('azure_content_understanding_authentication_type')?.value || 'key',
+                key: document.getElementById('azure_content_understanding_key')?.value || '',
+                api_version: document.getElementById('azure_content_understanding_api_version')?.value || '',
+                analyzer_id: document.getElementById('azure_content_understanding_analyzer_id')?.value || '',
+                image_analyzer_id: document.getElementById('azure_content_understanding_image_analyzer_id')?.value || ''
+            };
+
+            try {
+                const resp = await fetch('/api/admin/settings/test_connection', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify(payload)
+                });
+                const data = await resp.json();
+                if (resp.ok) {
+                    resultDiv.className = 'mt-2 text-success';
+                    resultDiv.textContent = data.message;
+                } else {
+                    resultDiv.className = 'mt-2 text-danger';
+                    resultDiv.textContent = data.error || 'Error testing Content Understanding';
+                }
+            } catch (err) {
+                resultDiv.className = 'mt-2 text-danger';
+                resultDiv.textContent = `Error: ${err.message}`;
+            }
+        });
+    }
+
     const testKeyVaultBtn = document.getElementById('test_key_vault_button');
     if (testKeyVaultBtn) {
         testKeyVaultBtn.addEventListener('click', async () => {
@@ -9561,6 +9652,7 @@ togglePassword('toggle_image_gen_key', 'azure_openai_image_gen_key');
 togglePassword('toggle_content_safety_key', 'content_safety_key');
 togglePassword('toggle_search_key', 'azure_ai_search_key');
 togglePassword('toggle_docintel_key', 'azure_document_intelligence_key');
+togglePassword('toggle_content_understanding_key', 'azure_content_understanding_key');
 togglePassword('toggle_azure_apim_gpt_subscription_key', 'azure_apim_gpt_subscription_key');
 togglePassword('toggle_azure_apim_embedding_subscription_key', 'azure_apim_embedding_subscription_key');
 togglePassword('toggle_azure_apim_image_gen_subscription_key', 'azure_apim_image_gen_subscription_key');
@@ -10451,7 +10543,17 @@ function setupWalkthroughFieldListeners() {
             {selector: '#document_intelligence_auto_sample_pages', event: 'input'},
             {selector: '#azure_apim_document_intelligence_endpoint', event: 'input'},
             {selector: '#azure_apim_document_intelligence_subscription_key', event: 'input'},
-            {selector: '#enable_document_intelligence_apim', event: 'change'}
+            {selector: '#enable_document_intelligence_apim', event: 'change'},
+            {selector: '#enable_enhanced_extraction', event: 'change'},
+            {selector: '#azure_content_understanding_endpoint', event: 'input'},
+            {selector: '#azure_content_understanding_key', event: 'input'},
+            {selector: '#azure_content_understanding_authentication_type', event: 'change'},
+            {selector: '#azure_content_understanding_api_version', event: 'input'},
+            {selector: '#azure_content_understanding_analyzer_id', event: 'input'},
+            {selector: '#azure_content_understanding_image_analyzer_id', event: 'input'},
+            {selector: '#enable_office_embedded_image_analysis', event: 'change'},
+            {selector: '#office_embedded_image_min_pixels', event: 'input'},
+            {selector: '#office_embedded_image_max_per_document', event: 'input'}
         ],
         8: [ // Video settings
             {selector: '#enable_video_file_support', event: 'change'},
diff --git a/application/single_app/static/js/public/public_workspace.js b/application/single_app/static/js/public/public_workspace.js
index c75bc2b26..3893d4715 100644
--- a/application/single_app/static/js/public/public_workspace.js
+++ b/application/single_app/static/js/public/public_workspace.js
@@ -1283,7 +1283,7 @@ function appendPublicDocumentMetaPills(container, doc) {
     doc.version ? `v${doc.version}` : null,
     doc.authors ? `By ${doc.authors}` : null,
     doc.number_of_pages ? `${doc.number_of_pages} pages` : null,
-    isPublicPdfDocument(doc) ? getPublicDocumentExtractionModeLabel(doc) : null,
+    supportsPublicExtractionModeChange(doc) ? getPublicDocumentExtractionModeLabel(doc) : null,
     doc.publication_date ? doc.publication_date : null,
   ].filter(Boolean);
 
@@ -1297,10 +1297,34 @@ function appendPublicDocumentMetaPills(container, doc) {
   });
 }
 
+const PUBLIC_EXTRACTION_MODE_CHANGE_IMAGE_EXTENSIONS = ['.jpg', '.jpeg', '.png', '.bmp', '.tiff', '.tif', '.heif', '.heic'];
+const PUBLIC_EXTRACTION_STANDARD_TOOLTIP = 'Standard extraction uses Document Intelligence Read for faster, lower-cost text extraction. Best for plain text PDFs and images.';
+const PUBLIC_EXTRACTION_ENHANCED_CONTENT_UNDERSTANDING_TOOLTIP = 'Enhanced extraction uses Azure AI Content Understanding to preserve tables, page structure, and checkbox states, and to describe figures, charts, and images. Adds latency and higher cost.';
+const PUBLIC_EXTRACTION_ENHANCED_DOCUMENT_INTELLIGENCE_TOOLTIP = 'Enhanced extraction uses Document Intelligence Layout to preserve tables, page structure, forms, and checkbox states. Adds latency and higher cost.';
+
 function isPublicPdfDocument(doc) {
   return String(doc?.file_name || '').toLowerCase().endsWith('.pdf');
 }
 
+function isPublicImageDocument(doc) {
+  const fileName = String(doc?.file_name || '').toLowerCase();
+  return PUBLIC_EXTRACTION_MODE_CHANGE_IMAGE_EXTENSIONS.some((extension) => fileName.endsWith(extension));
+}
+
+function supportsPublicExtractionModeChange(doc) {
+  return isPublicPdfDocument(doc) || isPublicImageDocument(doc);
+}
+
+function getPublicDocumentExtractionEngine(doc) {
+  return String(doc?.extraction_engine || '').trim().toLowerCase();
+}
+
+function getPublicDocumentEnhancedTooltipForEngine(engine) {
+  return engine === 'content_understanding'
+    ? PUBLIC_EXTRACTION_ENHANCED_CONTENT_UNDERSTANDING_TOOLTIP
+    : PUBLIC_EXTRACTION_ENHANCED_DOCUMENT_INTELLIGENCE_TOOLTIP;
+}
+
 function getPublicDocumentExtractionModeLabel(doc) {
   const mode = String(doc?.document_intelligence_extraction_mode || '').trim().toLowerCase();
   return mode === 'layout' ? 'Enhanced' : 'Standard';
@@ -1319,17 +1343,19 @@ function getPublicDocumentExtractionModeLabelFromMode(mode) {
   return mode === 'layout' ? 'Enhanced' : 'Standard';
 }
 
-function getPublicDocumentExtractionChangeTooltip(targetMode) {
+function getPublicDocumentExtractionChangeTooltip(targetMode, engine) {
   return targetMode === 'layout'
-    ? 'Extract again with Enhanced extraction. Enhanced extraction uses Document Intelligence Layout to preserve tables, page structure, forms, and checkbox states. Adds latency and higher cost.'
-    : 'Extract again with Standard extraction. Standard extraction uses Document Intelligence Read for faster text extraction. Best for plain text PDFs and images.';
+    ? `Extract again with Enhanced extraction. ${getPublicDocumentEnhancedTooltipForEngine(engine)}`
+    : `Extract again with Standard extraction. ${PUBLIC_EXTRACTION_STANDARD_TOOLTIP}`;
 }
 
 function getPublicDocumentExtractionModeTooltip(doc) {
   const mode = String(doc?.document_intelligence_extraction_mode || '').trim().toLowerCase();
-  return mode === 'layout'
-    ? 'Enhanced extraction uses Document Intelligence Layout to preserve tables, page structure, forms, and checkbox states. Adds latency and higher cost.'
-    : 'Standard extraction uses Document Intelligence Read for faster text extraction. Best for plain text PDFs and images.';
+  const tooltip = mode === 'layout'
+    ? getPublicDocumentEnhancedTooltipForEngine(getPublicDocumentExtractionEngine(doc))
+    : PUBLIC_EXTRACTION_STANDARD_TOOLTIP;
+  const reason = String(doc?.extraction_engine_reason || '').trim();
+  return reason ? `${tooltip} ${reason}.` : tooltip;
 }
 
 function getPublicDocumentCitationTooltip(doc) {
@@ -1339,7 +1365,7 @@ function getPublicDocumentCitationTooltip(doc) {
 }
 
 function createPublicDocumentExtractionModeBadge(doc) {
-  if (!isPublicPdfDocument(doc)) {
+  if (!supportsPublicExtractionModeChange(doc)) {
     return null;
   }
 
@@ -1355,7 +1381,7 @@ function createPublicDocumentExtractionModeBadge(doc) {
 }
 
 function getPublicDocumentExtractionModeBadgeHtml(doc) {
-  if (!isPublicPdfDocument(doc)) {
+  if (!supportsPublicExtractionModeChange(doc)) {
     return '';
   }
 
@@ -1501,11 +1527,11 @@ function createPublicDocumentCard(doc) {
     if (canManage) {
       dropdownItems.push(createPublicDropdownItem('bi-pencil-fill', 'Edit Metadata', () => window.onEditPublicDocument(docId)));
       dropdownItems.push(createPublicDropdownItem('bi-magic', 'Extract Metadata', () => window.onExtractPublicMetadata(docId, null)));
-      if (isPublicPdfDocument(doc)) {
+      if (supportsPublicExtractionModeChange(doc)) {
         const extractionActionMode = getPublicDocumentTargetExtractionMode(doc);
         const extractionActionLabel = getPublicDocumentExtractionModeLabelFromMode(extractionActionMode);
         const extractionActionIcon = getPublicDocumentExtractionModeIcon(extractionActionMode);
-        const extractionActionTooltip = getPublicDocumentExtractionChangeTooltip(extractionActionMode);
+        const extractionActionTooltip = getPublicDocumentExtractionChangeTooltip(extractionActionMode, getPublicDocumentExtractionEngine(doc));
         dropdownItems.push(createPublicDropdownDivider());
         dropdownItems.push(createPublicDropdownHeader('Change Extraction'));
         dropdownItems.push(createPublicDropdownItem(extractionActionIcon, `Change to ${extractionActionLabel}`, () => window.reprocessPublicDocumentExtraction(docId, extractionActionMode, null), false, extractionActionTooltip));
@@ -1672,7 +1698,7 @@ function renderPublicDocumentRow(doc) {
       const extractionActionMode = getPublicDocumentTargetExtractionMode(doc);
       const extractionActionLabel = getPublicDocumentExtractionModeLabelFromMode(extractionActionMode);
       const extractionActionIcon = getPublicDocumentExtractionModeIcon(extractionActionMode);
-      const extractionActionTooltip = getPublicDocumentExtractionChangeTooltip(extractionActionMode);
+      const extractionActionTooltip = getPublicDocumentExtractionChangeTooltip(extractionActionMode, getPublicDocumentExtractionEngine(doc));
       actionsDropdown += `
           <li><hr class="dropdown-divider"></li>
           <li><a class="dropdown-item" href="#" onclick="window.onEditPublicDocument('${doc.id}'); return false;">
@@ -1681,7 +1707,7 @@ function renderPublicDocumentRow(doc) {
           <li><a class="dropdown-item" href="#" onclick="window.onExtractPublicMetadata('${doc.id}', event); return false;">
             <i class="bi bi-magic me-2"></i>Extract Metadata
           </a></li>
-          ${isPublicPdfDocument(doc) ? `
+          ${supportsPublicExtractionModeChange(doc) ? `
           <li><hr class="dropdown-divider"></li>
           <li><h6 class="dropdown-header">Change Extraction</h6></li>
           <li><a class="dropdown-item" href="#" title="${escapeHtml(extractionActionTooltip)}" onclick="window.reprocessPublicDocumentExtraction('${reprocessDocId}', '${extractionActionMode}', event); return false;">
@@ -1749,7 +1775,7 @@ function renderPublicDocumentRow(doc) {
   const extractionActionMode = getPublicDocumentTargetExtractionMode(doc);
   const extractionActionLabel = getPublicDocumentExtractionModeLabelFromMode(extractionActionMode);
   const extractionActionIcon = getPublicDocumentExtractionModeIcon(extractionActionMode);
-  const extractionActionTooltip = getPublicDocumentExtractionChangeTooltip(extractionActionMode);
+  const extractionActionTooltip = getPublicDocumentExtractionChangeTooltip(extractionActionMode, getPublicDocumentExtractionEngine(doc));
 
   detailsRow.innerHTML = `
     <td colspan="4">
@@ -1759,7 +1785,7 @@ function renderPublicDocumentRow(doc) {
         <p class="mb-1"><strong>Version:</strong> ${escapeHtml(doc.version || '1')}</p>
         <p class="mb-1"><strong>Authors:</strong> ${escapeHtml(doc.authors || 'N/A')}</p>
         <p class="mb-1"><strong>Pages/Chunks:</strong> ${escapeHtml(doc.number_of_pages || 'N/A')}</p>
-        ${isPublicPdfDocument(doc) ? `<p class="mb-1"><strong>Extraction:</strong> ${getPublicDocumentExtractionModeBadgeHtml(doc)}</p>` : ''}
+        ${supportsPublicExtractionModeChange(doc) ? `<p class="mb-1"><strong>Extraction:</strong> ${getPublicDocumentExtractionModeBadgeHtml(doc)}</p>` : ''}
         <p class="mb-1"><strong>Citations:</strong> ${getCitationBadge(doc.enhanced_citations)}</p>
         <p class="mb-1"><strong>Publication Date:</strong> ${escapeHtml(doc.publication_date || 'N/A')}</p>
         <p class="mb-1"><strong>Keywords:</strong> ${escapeHtml(doc.keywords || 'N/A')}</p>
@@ -1774,7 +1800,7 @@ function renderPublicDocumentRow(doc) {
             <button class="btn btn-sm btn-warning" onclick="window.onExtractPublicMetadata('${doc.id}', event)" title="Re-run Metadata Extraction">
               <i class="bi bi-magic"></i> Extract Metadata
             </button>
-            ${isPublicPdfDocument(doc) ? `
+            ${supportsPublicExtractionModeChange(doc) ? `
             <button class="btn btn-sm btn-outline-secondary" onclick="window.reprocessPublicDocumentExtraction('${reprocessDocId}', '${extractionActionMode}', event)" title="${escapeHtml(extractionActionTooltip)}">
               <i class="bi ${extractionActionIcon}"></i> Change to ${extractionActionLabel}
             </button>` : ''}
@@ -3341,10 +3367,10 @@ function buildPublicFolderDocumentsTable(docs) {
         const extractionActionMode = getPublicDocumentTargetExtractionMode(doc);
         const extractionActionLabel = getPublicDocumentExtractionModeLabelFromMode(extractionActionMode);
         const extractionActionIcon = getPublicDocumentExtractionModeIcon(extractionActionMode);
-        const extractionActionTooltip = getPublicDocumentExtractionChangeTooltip(extractionActionMode);
+        const extractionActionTooltip = getPublicDocumentExtractionChangeTooltip(extractionActionMode, getPublicDocumentExtractionEngine(doc));
         actionsHtml += `<li><a class="dropdown-item" href="#" onclick="window.onEditPublicDocument('${doc.id}'); return false;"><i class="bi bi-pencil-fill me-2"></i>Edit Metadata</a></li>
             <li><a class="dropdown-item" href="#" onclick="window.onExtractPublicMetadata('${doc.id}', event); return false;"><i class="bi bi-magic me-2"></i>Extract Metadata</a></li>
-        ${isPublicPdfDocument(doc) ? `<li><hr class="dropdown-divider"></li>
+        ${supportsPublicExtractionModeChange(doc) ? `<li><hr class="dropdown-divider"></li>
         <li><h6 class="dropdown-header">Change Extraction</h6></li>
         <li><a class="dropdown-item" href="#" title="${escapeHtml(extractionActionTooltip)}" onclick="window.reprocessPublicDocumentExtraction('${reprocessDocId}', '${extractionActionMode}', event); return false;"><i class="bi ${extractionActionIcon} me-2"></i>Change to ${extractionActionLabel}</a></li>` : ''}
             <li><hr class="dropdown-divider"></li>
diff --git a/application/single_app/static/js/workspace/workspace-documents.js b/application/single_app/static/js/workspace/workspace-documents.js
index 76c53f539..a887786f5 100644
--- a/application/single_app/static/js/workspace/workspace-documents.js
+++ b/application/single_app/static/js/workspace/workspace-documents.js
@@ -392,12 +392,39 @@ function getDocumentClassificationBadge(doc) {
     return '<span class="badge bg-secondary">None</span>';
 }
 
+const EXTRACTION_MODE_CHANGE_IMAGE_EXTENSIONS = ['.jpg', '.jpeg', '.png', '.bmp', '.tiff', '.tif', '.heif', '.heic'];
+
 function isPdfDocument(doc) {
     return String(doc?.file_name || '').toLowerCase().endsWith('.pdf');
 }
 
-const DOCUMENT_EXTRACTION_STANDARD_TOOLTIP = 'Standard extraction uses Document Intelligence Read for faster text extraction. Best for plain text PDFs and images.';
-const DOCUMENT_EXTRACTION_ENHANCED_TOOLTIP = 'Enhanced extraction uses Document Intelligence Layout to preserve tables, page structure, forms, and checkbox states. Adds latency and higher cost.';
+function isImageDocument(doc) {
+    const fileName = String(doc?.file_name || '').toLowerCase();
+    return EXTRACTION_MODE_CHANGE_IMAGE_EXTENSIONS.some((extension) => fileName.endsWith(extension));
+}
+
+function supportsExtractionModeChange(doc) {
+    return isPdfDocument(doc) || isImageDocument(doc);
+}
+
+const DOCUMENT_EXTRACTION_STANDARD_TOOLTIP = 'Standard extraction uses Document Intelligence Read for faster, lower-cost text extraction. Best for plain text PDFs and images.';
+const DOCUMENT_EXTRACTION_ENHANCED_CONTENT_UNDERSTANDING_TOOLTIP = 'Enhanced extraction uses Azure AI Content Understanding to preserve tables, page structure, and checkbox states, and to describe figures, charts, and images. Adds latency and higher cost.';
+const DOCUMENT_EXTRACTION_ENHANCED_DOCUMENT_INTELLIGENCE_TOOLTIP = 'Enhanced extraction uses Document Intelligence Layout to preserve tables, page structure, forms, and checkbox states. Adds latency and higher cost.';
+
+function getDocumentExtractionEngine(doc) {
+    return String(doc?.extraction_engine || '').trim().toLowerCase();
+}
+
+function getDocumentExtractionEngineReason(doc) {
+    return String(doc?.extraction_engine_reason || '').trim();
+}
+
+function getDocumentEnhancedTooltipForEngine(engine) {
+    return engine === 'content_understanding'
+        ? DOCUMENT_EXTRACTION_ENHANCED_CONTENT_UNDERSTANDING_TOOLTIP
+        : DOCUMENT_EXTRACTION_ENHANCED_DOCUMENT_INTELLIGENCE_TOOLTIP;
+}
+
 const DOCUMENT_CITATION_STANDARD_TOOLTIP = 'Standard citations reference indexed text chunks.';
 const DOCUMENT_CITATION_ENHANCED_TOOLTIP = 'Enhanced citations preserve source-file context for richer citation previews and supported file workflows.';
 
@@ -405,8 +432,10 @@ function getDocumentExtractionModeLabelFromMode(mode) {
     return mode === 'layout' ? 'Enhanced' : 'Standard';
 }
 
-function getDocumentExtractionModeTooltipFromMode(mode) {
-    return mode === 'layout' ? DOCUMENT_EXTRACTION_ENHANCED_TOOLTIP : DOCUMENT_EXTRACTION_STANDARD_TOOLTIP;
+function getDocumentExtractionModeTooltipFromMode(mode, engine) {
+    return mode === 'layout'
+        ? getDocumentEnhancedTooltipForEngine(engine)
+        : DOCUMENT_EXTRACTION_STANDARD_TOOLTIP;
 }
 
 function getDocumentExtractionModeIcon(mode) {
@@ -418,9 +447,9 @@ function getDocumentTargetExtractionMode(doc) {
     return currentMode === 'layout' ? 'read' : 'layout';
 }
 
-function getDocumentExtractionChangeTooltip(targetMode) {
+function getDocumentExtractionChangeTooltip(targetMode, engine) {
     return targetMode === 'layout'
-        ? `Extract again with Enhanced extraction. ${DOCUMENT_EXTRACTION_ENHANCED_TOOLTIP}`
+        ? `Extract again with Enhanced extraction. ${getDocumentEnhancedTooltipForEngine(engine)}`
         : `Extract again with Standard extraction. ${DOCUMENT_EXTRACTION_STANDARD_TOOLTIP}`;
 }
 
@@ -431,7 +460,9 @@ function getDocumentExtractionModeLabel(doc) {
 
 function getDocumentExtractionModeTooltip(doc) {
     const mode = String(doc?.document_intelligence_extraction_mode || '').trim().toLowerCase();
-    return getDocumentExtractionModeTooltipFromMode(mode);
+    const tooltip = getDocumentExtractionModeTooltipFromMode(mode, getDocumentExtractionEngine(doc));
+    const reason = getDocumentExtractionEngineReason(doc);
+    return reason ? `${tooltip} ${reason}.` : tooltip;
 }
 
 function getDocumentCitationTooltip(doc) {
@@ -439,7 +470,7 @@ function getDocumentCitationTooltip(doc) {
 }
 
 function getDocumentExtractionModeBadge(doc) {
-    if (!isPdfDocument(doc)) {
+    if (!supportsExtractionModeChange(doc)) {
         return '';
     }
 
@@ -450,7 +481,7 @@ function getDocumentExtractionModeBadge(doc) {
 }
 
 function getDocumentReprocessDropdownItems(doc) {
-    if (!isPdfDocument(doc)) {
+    if (!supportsExtractionModeChange(doc)) {
         return '';
     }
 
@@ -458,7 +489,7 @@ function getDocumentReprocessDropdownItems(doc) {
     const targetMode = getDocumentTargetExtractionMode(doc);
     const targetLabel = getDocumentExtractionModeLabelFromMode(targetMode);
     const targetIcon = getDocumentExtractionModeIcon(targetMode);
-    const targetTooltip = getDocumentExtractionChangeTooltip(targetMode);
+    const targetTooltip = getDocumentExtractionChangeTooltip(targetMode, getDocumentExtractionEngine(doc));
 
     return `
         <li><hr class="dropdown-divider"></li>
@@ -485,7 +516,7 @@ function getDocumentMetaPills(doc) {
     if (doc.number_of_pages) {
         pills.push(`<span class="document-meta-pill"><i class="bi bi-file-earmark-text"></i>${escapeHtml(String(doc.number_of_pages))} pages</span>`);
     }
-    if (isPdfDocument(doc)) {
+    if (supportsExtractionModeChange(doc)) {
         pills.push(`<span class="document-meta-pill"><i class="bi bi-file-earmark-richtext"></i>${getDocumentExtractionModeLabel(doc)}</span>`);
     }
     if (authors.length) {
@@ -1956,7 +1987,7 @@ function renderDocumentRow(doc) {
                     <p class="mb-1"><strong>Version:</strong> ${escapeHtml(doc.version || "N/A")}</p>
                     <p class="mb-1"><strong>Authors:</strong> ${escapeHtml(Array.isArray(doc.authors) ? doc.authors.join(", ") : doc.authors || "N/A")}</p>
                     <p class="mb-1"><strong>Pages:</strong> ${escapeHtml(doc.number_of_pages || "N/A")}</p>
-                    ${isPdfDocument(doc) ? `<p class="mb-1"><strong>Extraction:</strong> ${getDocumentExtractionModeBadge(doc)}</p>` : ''}
+                    ${supportsExtractionModeChange(doc) ? `<p class="mb-1"><strong>Extraction:</strong> ${getDocumentExtractionModeBadge(doc)}</p>` : ''}
                     <p class="mb-1"><strong>Citations:</strong> ${doc.enhanced_citations ? `<span class="badge bg-success" title="${escapeHtml(getDocumentCitationTooltip(doc))}">Enhanced</span>` : `<span class="badge bg-secondary" title="${escapeHtml(getDocumentCitationTooltip(doc))}">Standard</span>`}</p>
                     <p class="mb-1"><strong>Publication Date:</strong> ${escapeHtml(doc.publication_date || "N/A")}</p>
                     <p class="mb-1"><strong>Keywords:</strong> ${escapeHtml(Array.isArray(doc.keywords) ? doc.keywords.join(", ") : doc.keywords || "N/A")}</p>
@@ -1978,12 +2009,12 @@ function renderDocumentRow(doc) {
             `;
         }
 
-        if (isOwner && isPdfDocument(doc)) {
+        if (isOwner && supportsExtractionModeChange(doc)) {
             const reprocessDocId = escapeHtml(String(docId || ''));
             const extractionActionMode = getDocumentTargetExtractionMode(doc);
             const extractionActionLabel = getDocumentExtractionModeLabelFromMode(extractionActionMode);
             const extractionActionIcon = getDocumentExtractionModeIcon(extractionActionMode);
-            const extractionActionTooltip = getDocumentExtractionChangeTooltip(extractionActionMode);
+            const extractionActionTooltip = getDocumentExtractionChangeTooltip(extractionActionMode, getDocumentExtractionEngine(doc));
             detailsHtml += `
                 <button class="btn btn-sm btn-outline-secondary" onclick="window.reprocessDocumentExtraction('${reprocessDocId}', '${extractionActionMode}', event)" title="${escapeHtml(extractionActionTooltip)}">
                     <i class="bi ${extractionActionIcon}"></i> Change to ${extractionActionLabel}
diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html
index 9827b8f3f..12e2cfc90 100644
--- a/application/single_app/templates/admin_settings.html
+++ b/application/single_app/templates/admin_settings.html
@@ -11707,68 +11707,272 @@ <h5><i class="bi bi-search me-2"></i>Azure AI Search</h5>
                 <div class="card p-3 mb-3" id="document-intelligence-section">
                     <h5><i class="bi bi-file-earmark-text me-2"></i>Document Intelligence</h5>
                     <p class="text-muted">
-                        Configure Azure Document Intelligence settings.
+                        Configure Azure Document Intelligence settings. Document Intelligence always powers
+                        <strong>Standard</strong> extraction and is required for workspaces and chat file uploads.
                     </p>
-                    <div class="mb-3">
-                        <div class="d-flex align-items-center gap-2 flex-wrap">
+                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                        <input
+                            type="checkbox"
+                            class="form-check-input me-2"
+                            id="enable_enhanced_extraction"
+                            name="enable_enhanced_extraction"
+                            {% if settings.enable_enhanced_extraction %}checked{% endif %}
+                        >
+                        <label class="form-check-label" for="enable_enhanced_extraction">
+                            Enable Enhanced extraction
+                        </label>
+                        <button
+                            type="button"
+                            class="btn btn-sm btn-outline-secondary rounded-circle ms-2"
+                            data-bs-toggle="modal"
+                            data-bs-target="#documentIntelligenceExtractionHelpModal"
+                            aria-label="Enhanced extraction guidance"
+                            title="Enhanced extraction guidance"
+                        >
+                            <i class="bi bi-question-lg" aria-hidden="true"></i>
+                        </button>
+                    </div>
+
+                    <div id="enhanced_extraction_settings" class="{% if not settings.enable_enhanced_extraction %}d-none{% endif %}">
+                        {% if content_understanding_supported %}
+                        <div class="alert alert-info small" role="note">
+                            Enhanced extraction uses <strong>Azure AI Content Understanding</strong>, which returns tables,
+                            page structure, checkbox states, and AI-generated descriptions of figures, charts, and images.
+                            Configure the connection below.
+                        </div>
+                        {% else %}
+                        <div class="alert alert-secondary small" id="enhanced_extraction_fallback_notice" role="note">
+                            Azure AI Content Understanding is not available in the
+                            <strong>{{ azure_environment }}</strong> cloud, so Enhanced extraction uses
+                            <strong>Document Intelligence Layout</strong> here. There is nothing more to configure —
+                            Enhanced still captures tables, page structure, forms, and checkbox states.
+                        </div>
+                        {% endif %}
+
+                        <div class="mb-3">
                             <label for="document_intelligence_pdf_image_extraction_mode" class="form-label mb-0">
                                 PDF and Image Extraction Mode
                             </label>
+                            <select
+                                class="form-select"
+                                id="document_intelligence_pdf_image_extraction_mode"
+                                name="document_intelligence_pdf_image_extraction_mode"
+                            >
+                                <option value="read" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'read' %}selected{% endif %}>
+                                    Standard - faster text extraction
+                                </option>
+                                <option value="layout" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'layout' %}selected{% endif %}>
+                                    Enhanced - richer structure, tables, and checkbox states
+                                </option>
+                                <option value="auto" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'auto' %}selected{% endif %}>
+                                    Auto - sample first pages, then choose Standard or Enhanced
+                                </option>
+                            </select>
+                            <div class="form-text">
+                                Enhanced captures more document detail for PDFs and images, including tables, page structure, and checked or unchecked marks. It adds latency and has a 6X increase for every 1000 pages when selected.
+                            </div>
+                            <div
+                                class="mt-3 {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') != 'auto' %}d-none{% endif %}"
+                                id="document_intelligence_auto_sample_pages_group"
+                            >
+                                <label for="document_intelligence_auto_sample_pages" class="form-label">
+                                    Auto Sample Pages
+                                </label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="document_intelligence_auto_sample_pages"
+                                    name="document_intelligence_auto_sample_pages"
+                                    min="1"
+                                    max="20"
+                                    value="{{ settings.document_intelligence_auto_sample_pages|default(3) }}"
+                                >
+                                <div class="form-text">
+                                    Auto samples this many first PDF pages with Document Intelligence Layout. If it detects tables, selection marks, or figures, the full PDF uses Enhanced; otherwise it finishes with Standard. Images use Enhanced in Auto mode.
+                                </div>
+                            </div>
+                            <div class="alert alert-light border mt-3 mb-0 small" role="note">
+                                <div><strong>Standard:</strong> Document Intelligence Read. Fastest and lowest-cost path for plain text PDFs and images.</div>
+                                <div><strong>Enhanced:</strong> best for tables, section structure, page layout, forms, checkbox states, and figure descriptions. Expect more latency and higher cost.</div>
+                                <div><strong>Auto:</strong> samples the first pages with Document Intelligence Layout, then uses Enhanced only when the sample shows tables, selection marks, or figures.</div>
+                            </div>
+                        </div>
+
+                        {% if content_understanding_supported %}
+                        <div class="card p-3 mb-3 bg-body-tertiary" id="content-understanding-section">
+                            <div class="d-flex align-items-center gap-2 flex-wrap mb-2">
+                                <h6 class="mb-0"><i class="bi bi-stars me-2"></i>Azure AI Content Understanding</h6>
+                                <button
+                                    type="button"
+                                    class="btn btn-sm btn-outline-secondary rounded-circle"
+                                    data-bs-toggle="modal"
+                                    data-bs-target="#contentUnderstandingSetupHelpModal"
+                                    aria-label="Content Understanding setup guide"
+                                    title="Content Understanding setup guide"
+                                >
+                                    <i class="bi bi-question-lg" aria-hidden="true"></i>
+                                </button>
+                            </div>
+                            <p class="text-muted small">
+                                Required for Enhanced extraction. Deployed from a Microsoft Foundry resource.
+                                If this is left blank, Enhanced falls back to Document Intelligence Layout.
+                            </p>
+
+                            <div class="mb-3">
+                                <label for="azure_content_understanding_endpoint" class="form-label">
+                                    Content Understanding Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_content_understanding_endpoint"
+                                    name="azure_content_understanding_endpoint"
+                                    placeholder="https://your-resource.services.ai.azure.com"
+                                    value="{{ settings.azure_content_understanding_endpoint or '' }}"
+                                >
+                                <div class="form-text">
+                                    Your Microsoft Foundry resource endpoint, without a trailing path.
+                                </div>
+                            </div>
+
+                            <div class="mb-3">
+                                <label for="azure_content_understanding_authentication_type" class="form-label">
+                                    Authentication Type
+                                </label>
+                                <select class="form-select" id="azure_content_understanding_authentication_type" name="azure_content_understanding_authentication_type">
+                                    <option value="key" {% if settings.azure_content_understanding_authentication_type != 'managed_identity' %}selected{% endif %}>
+                                        Key
+                                    </option>
+                                    <option value="managed_identity" {% if settings.azure_content_understanding_authentication_type == 'managed_identity' %}selected{% endif %}>
+                                        Managed Identity
+                                    </option>
+                                </select>
+                                <div class="form-text">
+                                    Managed identity requires the <strong>Cognitive Services User</strong> role on the Foundry resource.
+                                </div>
+                            </div>
+
+                            <div class="mb-3 {% if settings.azure_content_understanding_authentication_type == 'managed_identity' %}d-none{% endif %}" id="azure_content_understanding_key_container">
+                                <label for="azure_content_understanding_key" class="form-label">
+                                    Content Understanding Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_content_understanding_key"
+                                        name="azure_content_understanding_key"
+                                        value="{{ settings.azure_content_understanding_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_content_understanding_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+
+                            <div class="row g-3 mb-3">
+                                <div class="col-md-4">
+                                    <label for="azure_content_understanding_api_version" class="form-label">API Version</label>
+                                    <input
+                                        type="text"
+                                        class="form-control"
+                                        id="azure_content_understanding_api_version"
+                                        name="azure_content_understanding_api_version"
+                                        value="{{ settings.azure_content_understanding_api_version or content_understanding_api_version_default }}"
+                                    >
+                                    <div class="form-text">Default: {{ content_understanding_api_version_default }}</div>
+                                </div>
+                                <div class="col-md-4">
+                                    <label for="azure_content_understanding_analyzer_id" class="form-label">Document Analyzer</label>
+                                    <input
+                                        type="text"
+                                        class="form-control"
+                                        id="azure_content_understanding_analyzer_id"
+                                        name="azure_content_understanding_analyzer_id"
+                                        value="{{ settings.azure_content_understanding_analyzer_id or content_understanding_document_analyzer_default }}"
+                                    >
+                                    <div class="form-text">Default: {{ content_understanding_document_analyzer_default }}</div>
+                                </div>
+                                <div class="col-md-4">
+                                    <label for="azure_content_understanding_image_analyzer_id" class="form-label">Image Analyzer</label>
+                                    <input
+                                        type="text"
+                                        class="form-control"
+                                        id="azure_content_understanding_image_analyzer_id"
+                                        name="azure_content_understanding_image_analyzer_id"
+                                        value="{{ settings.azure_content_understanding_image_analyzer_id or content_understanding_image_analyzer_default }}"
+                                    >
+                                    <div class="form-text">Default: {{ content_understanding_image_analyzer_default }}</div>
+                                </div>
+                            </div>
+
                             <button
                                 type="button"
-                                class="btn btn-sm btn-outline-secondary rounded-circle"
-                                data-bs-toggle="modal"
-                                data-bs-target="#documentIntelligenceExtractionHelpModal"
-                                aria-label="Document Intelligence extraction guidance"
-                                title="Document Intelligence extraction guidance"
+                                class="btn btn-secondary"
+                                style="width: auto;"
+                                id="test_content_understanding_button"
                             >
-                                <i class="bi bi-question-lg" aria-hidden="true"></i>
+                                Test Content Understanding Connection
                             </button>
+                            <div id="test_content_understanding_result" class="mt-2"></div>
                         </div>
-                        <select
-                            class="form-select"
-                            id="document_intelligence_pdf_image_extraction_mode"
-                            name="document_intelligence_pdf_image_extraction_mode"
-                        >
-                            <option value="read" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'read' %}selected{% endif %}>
-                                Standard - faster text extraction
-                            </option>
-                            <option value="layout" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'layout' %}selected{% endif %}>
-                                Enhanced - richer structure, tables, and checkbox states
-                            </option>
-                            <option value="auto" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'auto' %}selected{% endif %}>
-                                Auto - sample first pages, then choose Standard or Enhanced
-                            </option>
-                        </select>
-                        <div class="form-text">
-                            Enhanced captures more document detail for PDFs and images, including tables, page structure, and checked or unchecked marks. It adds latency and has a 6X increase for every 1000 pages when selected.
-                        </div>
-                        <div
-                            class="mt-3 {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') != 'auto' %}d-none{% endif %}"
-                            id="document_intelligence_auto_sample_pages_group"
-                        >
-                            <label for="document_intelligence_auto_sample_pages" class="form-label">
-                                Auto Sample Pages
-                            </label>
+                        {% endif %}
+                    </div>
+
+                    <div class="card p-3 mb-3 bg-body-tertiary" id="office-embedded-image-section">
+                        <h6 class="mb-2"><i class="bi bi-images me-2"></i>Images Inside Office Files</h6>
+                        <p class="text-muted small">
+                            Neither extraction engine describes figures inside Word and PowerPoint files. When this is on,
+                            embedded images are pulled out of the file, analyzed with whichever engine backs the selected
+                            extraction mode, and indexed as their own citable chunks. This works with Standard extraction
+                            too, using Document Intelligence.
+                        </p>
+                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
                             <input
-                                type="number"
-                                class="form-control"
-                                id="document_intelligence_auto_sample_pages"
-                                name="document_intelligence_auto_sample_pages"
-                                min="1"
-                                max="20"
-                                value="{{ settings.document_intelligence_auto_sample_pages|default(3) }}"
+                                type="checkbox"
+                                class="form-check-input me-2"
+                                id="enable_office_embedded_image_analysis"
+                                name="enable_office_embedded_image_analysis"
+                                {% if settings.enable_office_embedded_image_analysis %}checked{% endif %}
                             >
-                            <div class="form-text">
-                                Auto samples this many first PDF pages with Enhanced extraction. If it detects tables or selection marks, the full PDF uses Enhanced; otherwise it finishes with Standard. Images use Enhanced in Auto mode.
-                            </div>
+                            <label class="form-check-label" for="enable_office_embedded_image_analysis">
+                                Analyze images embedded in DOCX and PPTX files
+                            </label>
                         </div>
-                        <div class="alert alert-light border mt-3 mb-0 small" role="note">
-                            <div><strong>Standard:</strong> fastest and lowest-cost path for plain text PDFs and images.</div>
-                            <div><strong>Enhanced:</strong> best for tables, section structure, page layout, forms, and checkbox states. Expect more latency and a 6X increase for every 1000 pages.</div>
-                            <div><strong>Auto:</strong> samples the first pages, then uses Enhanced only when the sample shows tables or selection marks.</div>
+                        <div class="row g-3 {% if not settings.enable_office_embedded_image_analysis %}d-none{% endif %}" id="office_embedded_image_options">
+                            <div class="col-md-6">
+                                <label for="office_embedded_image_min_pixels" class="form-label">Minimum Image Size (pixels)</label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="office_embedded_image_min_pixels"
+                                    name="office_embedded_image_min_pixels"
+                                    min="1"
+                                    max="2000"
+                                    value="{{ settings.office_embedded_image_min_pixels|default(150) }}"
+                                >
+                                <div class="form-text">Images narrower or shorter than this are skipped as icons or spacers.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="office_embedded_image_max_per_document" class="form-label">Maximum Images Per Document</label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="office_embedded_image_max_per_document"
+                                    name="office_embedded_image_max_per_document"
+                                    min="0"
+                                    max="200"
+                                    value="{{ settings.office_embedded_image_max_per_document|default(25) }}"
+                                >
+                                <div class="form-text">Caps per-document cost. Duplicate images are analyzed once.</div>
+                            </div>
                         </div>
                     </div>
+
                     <div class="modal fade" id="documentIntelligenceExtractionHelpModal" tabindex="-1" aria-labelledby="documentIntelligenceExtractionHelpModalLabel" aria-hidden="true">
                         <div class="modal-dialog modal-lg modal-dialog-scrollable">
                             <div class="modal-content">
@@ -11777,9 +11981,74 @@ <h5 class="modal-title" id="documentIntelligenceExtractionHelpModalLabel">Standa
                                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                                 </div>
                                 <div class="modal-body">
-                                    <p><strong>Choose Standard</strong> for mostly text-based PDFs and images when speed and cost matter most.</p>
-                                    <p><strong>Choose Enhanced</strong> when document structure matters: tables, page layout, headings, forms, checked or unchecked boxes, and selection marks. Enhanced is the better extraction path for those documents, but it adds latency and has a 6X increase for every 1000 pages.</p>
-                                    <p><strong>Choose Auto</strong> when admins want the platform to decide. Auto samples the configured number of first PDF pages with Enhanced extraction. If those pages contain tables or selection marks, the full PDF is extracted with Enhanced; otherwise it is extracted with Standard. Images are extracted with Enhanced in Auto mode because they are single-page inputs and benefit from spatial structure detection.</p>
+                                    <p><strong>Standard</strong> always uses Azure Document Intelligence Read. It is the fastest and lowest-cost path for mostly text-based PDFs and images, and it is what runs when Enhanced extraction is turned off.</p>
+                                    <p><strong>Enhanced</strong> is for documents where structure matters: tables, page layout, headings, forms, checked or unchecked boxes, and figures.</p>
+                                    <ul>
+                                        <li>In Azure commercial clouds, Enhanced uses <strong>Azure AI Content Understanding</strong>, which additionally generates natural-language descriptions of figures, charts, and diagrams.</li>
+                                        <li>In Azure Government and custom clouds, Content Understanding is unavailable, so Enhanced automatically uses <strong>Document Intelligence Layout</strong> instead. Tables and checkbox states still work; figure descriptions do not.</li>
+                                        <li>If Content Understanding is enabled but unreachable, the document falls back to Document Intelligence Layout and the reason is recorded on the document.</li>
+                                    </ul>
+                                    <p><strong>Auto</strong> lets the platform decide per document. It samples the configured number of first PDF pages with Document Intelligence Layout, which is the cheaper detector. If those pages contain tables, selection marks, or figures, the full document is extracted with Enhanced; otherwise it is extracted with Standard. Images always use Enhanced in Auto mode because they are single-page inputs that benefit from figure and spatial analysis.</p>
+                                    <p class="mb-0"><strong>Cost:</strong> Enhanced adds latency and cost on every document. Content Understanding also invokes a language model per document, so it is more expensive than Document Intelligence Layout. Auto is usually the best value.</p>
+                                </div>
+                                <div class="modal-footer">
+                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="modal fade" id="contentUnderstandingSetupHelpModal" tabindex="-1" aria-labelledby="contentUnderstandingSetupHelpModalLabel" aria-hidden="true">
+                        <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                            <div class="modal-content">
+                                <div class="modal-header">
+                                    <h5 class="modal-title" id="contentUnderstandingSetupHelpModalLabel">Set Up Azure AI Content Understanding</h5>
+                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                                </div>
+                                <div class="modal-body">
+                                    <p>Content Understanding is part of Microsoft Foundry. Follow these steps, then paste the endpoint and key below.</p>
+                                    <h6>1. Create a Microsoft Foundry resource</h6>
+                                    <p>
+                                        In the Azure portal, create a <strong>Microsoft Foundry</strong> resource in one of the supported regions:
+                                        East US, East US 2, West US, West US 3, South Central US, North Europe, West Europe, Sweden Central,
+                                        UK South, Australia East, Japan East, or Southeast Asia. You need Contributor or higher on the subscription
+                                        or resource group.
+                                    </p>
+                                    <div class="alert alert-warning small">
+                                        Content Understanding is not offered in Azure Government or other sovereign clouds. In those clouds
+                                        SimpleChat automatically uses Document Intelligence Layout for Enhanced extraction.
+                                    </div>
+                                    <h6>2. Deploy the models Content Understanding needs</h6>
+                                    <p>
+                                        Analyzers that describe figures require a completion model and an embedding model to be deployed and set
+                                        as resource defaults. In the
+                                        <a href="https://contentunderstanding.ai.azure.com/settings" target="_blank" rel="noopener noreferrer">Content Understanding settings page</a>,
+                                        add your Foundry resource and leave
+                                        <em>Enable autodeployment for required models if no defaults are available</em> checked. Without this step,
+                                        analysis requests fail with a missing model deployment error.
+                                    </p>
+                                    <h6>3. Copy the endpoint and key</h6>
+                                    <p>
+                                        In the Azure portal, open the Foundry resource and go to
+                                        <strong>Resource Management &rarr; Keys and Endpoint</strong>. The endpoint looks like
+                                        <code>https://your-resource.services.ai.azure.com</code>. Paste it into
+                                        <strong>Content Understanding Endpoint</strong>, and paste either key into
+                                        <strong>Content Understanding Key</strong>.
+                                    </p>
+                                    <h6>4. Or use managed identity instead of a key</h6>
+                                    <p>
+                                        Set <strong>Authentication Type</strong> to Managed Identity and assign this application's identity the
+                                        <strong>Cognitive Services User</strong> role on the Foundry resource. That role assignment is required even
+                                        for resource owners.
+                                    </p>
+                                    <h6>5. Test the connection</h6>
+                                    <p class="mb-0">
+                                        Use <strong>Test Content Understanding Connection</strong> to confirm the endpoint, credentials, and analyzer
+                                        are reachable before saving.
+                                        See the
+                                        <a href="https://learn.microsoft.com/azure/ai-services/content-understanding/quickstart/use-rest-api" target="_blank" rel="noopener noreferrer">Content Understanding quickstart</a>
+                                        for more detail.
+                                    </p>
                                 </div>
                                 <div class="modal-footer">
                                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
diff --git a/application/single_app/templates/group_workspaces.html b/application/single_app/templates/group_workspaces.html
index 40d8ad40b..18283a58e 100644
--- a/application/single_app/templates/group_workspaces.html
+++ b/application/single_app/templates/group_workspaces.html
@@ -3718,7 +3718,7 @@ <h5 class="modal-title" id="workflowDeleteModalLabel">Delete Group Workflow</h5>
     if (doc.number_of_pages) {
       pills.push(`<span class="document-meta-pill"><i class="bi bi-file-earmark-text"></i>${escapeGroupHtml(String(doc.number_of_pages))} pages</span>`);
     }
-    if (isGroupPdfDocument(doc)) {
+    if (supportsGroupExtractionModeChange(doc)) {
       pills.push(`<span class="document-meta-pill"><i class="bi bi-file-earmark-richtext"></i>${escapeGroupHtml(getGroupDocumentExtractionModeLabel(doc))}</span>`);
     }
     if (authors.length) {
@@ -3734,10 +3734,34 @@ <h5 class="modal-title" id="workflowDeleteModalLabel">Delete Group Workflow</h5>
     return pills.join('');
   }
 
+  const GROUP_EXTRACTION_MODE_CHANGE_IMAGE_EXTENSIONS = ['.jpg', '.jpeg', '.png', '.bmp', '.tiff', '.tif', '.heif', '.heic'];
+  const GROUP_EXTRACTION_STANDARD_TOOLTIP = 'Standard extraction uses Document Intelligence Read for faster, lower-cost text extraction. Best for plain text PDFs and images.';
+  const GROUP_EXTRACTION_ENHANCED_CONTENT_UNDERSTANDING_TOOLTIP = 'Enhanced extraction uses Azure AI Content Understanding to preserve tables, page structure, and checkbox states, and to describe figures, charts, and images. Adds latency and higher cost.';
+  const GROUP_EXTRACTION_ENHANCED_DOCUMENT_INTELLIGENCE_TOOLTIP = 'Enhanced extraction uses Document Intelligence Layout to preserve tables, page structure, forms, and checkbox states. Adds latency and higher cost.';
+
   function isGroupPdfDocument(doc) {
     return String(doc?.file_name || '').toLowerCase().endsWith('.pdf');
   }
 
+  function isGroupImageDocument(doc) {
+    const fileName = String(doc?.file_name || '').toLowerCase();
+    return GROUP_EXTRACTION_MODE_CHANGE_IMAGE_EXTENSIONS.some((extension) => fileName.endsWith(extension));
+  }
+
+  function supportsGroupExtractionModeChange(doc) {
+    return isGroupPdfDocument(doc) || isGroupImageDocument(doc);
+  }
+
+  function getGroupDocumentExtractionEngine(doc) {
+    return String(doc?.extraction_engine || '').trim().toLowerCase();
+  }
+
+  function getGroupDocumentEnhancedTooltipForEngine(engine) {
+    return engine === 'content_understanding'
+      ? GROUP_EXTRACTION_ENHANCED_CONTENT_UNDERSTANDING_TOOLTIP
+      : GROUP_EXTRACTION_ENHANCED_DOCUMENT_INTELLIGENCE_TOOLTIP;
+  }
+
   function getGroupDocumentExtractionModeLabel(doc) {
     const mode = String(doc?.document_intelligence_extraction_mode || '').trim().toLowerCase();
     return mode === 'layout' ? 'Enhanced' : 'Standard';
@@ -3756,17 +3780,19 @@ <h5 class="modal-title" id="workflowDeleteModalLabel">Delete Group Workflow</h5>
     return mode === 'layout' ? 'Enhanced' : 'Standard';
   }
 
-  function getGroupDocumentExtractionChangeTooltip(targetMode) {
+  function getGroupDocumentExtractionChangeTooltip(targetMode, engine) {
     return targetMode === 'layout'
-      ? 'Extract again with Enhanced extraction. Enhanced extraction uses Document Intelligence Layout to preserve tables, page structure, forms, and checkbox states. Adds latency and higher cost.'
-      : 'Extract again with Standard extraction. Standard extraction uses Document Intelligence Read for faster text extraction. Best for plain text PDFs and images.';
+      ? `Extract again with Enhanced extraction. ${getGroupDocumentEnhancedTooltipForEngine(engine)}`
+      : `Extract again with Standard extraction. ${GROUP_EXTRACTION_STANDARD_TOOLTIP}`;
   }
 
   function getGroupDocumentExtractionModeTooltip(doc) {
     const mode = String(doc?.document_intelligence_extraction_mode || '').trim().toLowerCase();
-    return mode === 'layout'
-      ? 'Enhanced extraction uses Document Intelligence Layout to preserve tables, page structure, forms, and checkbox states. Adds latency and higher cost.'
-      : 'Standard extraction uses Document Intelligence Read for faster text extraction. Best for plain text PDFs and images.';
+    const tooltip = mode === 'layout'
+      ? getGroupDocumentEnhancedTooltipForEngine(getGroupDocumentExtractionEngine(doc))
+      : GROUP_EXTRACTION_STANDARD_TOOLTIP;
+    const reason = String(doc?.extraction_engine_reason || '').trim();
+    return reason ? `${tooltip} ${reason}.` : tooltip;
   }
 
   function getGroupDocumentCitationTooltip(doc) {
@@ -3776,7 +3802,7 @@ <h5 class="modal-title" id="workflowDeleteModalLabel">Delete Group Workflow</h5>
   }
 
   function getGroupDocumentExtractionModeBadge(doc) {
-    if (!isGroupPdfDocument(doc)) {
+    if (!supportsGroupExtractionModeChange(doc)) {
       return '';
     }
 
@@ -3787,7 +3813,7 @@ <h5 class="modal-title" id="workflowDeleteModalLabel">Delete Group Workflow</h5>
   }
 
   function getGroupDocumentReprocessDropdownItems(doc) {
-    if (!isGroupPdfDocument(doc)) {
+    if (!supportsGroupExtractionModeChange(doc)) {
       return '';
     }
 
@@ -3795,7 +3821,7 @@ <h5 class="modal-title" id="workflowDeleteModalLabel">Delete Group Workflow</h5>
     const targetMode = getGroupDocumentTargetExtractionMode(doc);
     const targetLabel = getGroupDocumentExtractionModeLabelFromMode(targetMode);
     const targetIcon = getGroupDocumentExtractionModeIcon(targetMode);
-    const targetTooltip = getGroupDocumentExtractionChangeTooltip(targetMode);
+    const targetTooltip = getGroupDocumentExtractionChangeTooltip(targetMode, getGroupDocumentExtractionEngine(doc));
 
     return `
       <li><hr class="dropdown-divider"></li>
@@ -6307,7 +6333,7 @@ <h5 class="modal-title" id="groupDocumentDeleteModalLabel">Delete Group Document
                 <p class="mb-1"><strong>Pages/Chunks:</strong> ${escapeHtml(
                   doc.number_of_pages || "N/A"
                 )}</p> <!-- Assuming number_of_pages stores chunk count -->
-                ${isGroupPdfDocument(doc) ? `<p class="mb-1"><strong>Extraction:</strong> ${getGroupDocumentExtractionModeBadge(doc)}</p>` : ''}
+                ${supportsGroupExtractionModeChange(doc) ? `<p class="mb-1"><strong>Extraction:</strong> ${getGroupDocumentExtractionModeBadge(doc)}</p>` : ''}
                 <p class="mb-1"><strong>Citations:</strong> ${
                   doc.enhanced_citations
                     ? `<span class="badge bg-success" title="${escapeHtml(getGroupDocumentCitationTooltip(doc))}">Enhanced</span>`
@@ -6342,12 +6368,12 @@ <h5 class="modal-title" id="groupDocumentDeleteModalLabel">Delete Group Document
           detailsHtml += `
                       <button class="btn btn-sm btn-warning" onclick="onExtractGroupMetadata('${docId}', event)" title="Re-run Metadata Extraction"> <i class="bi bi-magic"></i> Extract Metadata </button>`;
         }
-        if (isGroupPdfDocument(doc)) {
+        if (supportsGroupExtractionModeChange(doc)) {
           const reprocessDocId = escapeHtml(String(docId || ''));
           const extractionActionMode = getGroupDocumentTargetExtractionMode(doc);
           const extractionActionLabel = getGroupDocumentExtractionModeLabelFromMode(extractionActionMode);
           const extractionActionIcon = getGroupDocumentExtractionModeIcon(extractionActionMode);
-          const extractionActionTooltip = getGroupDocumentExtractionChangeTooltip(extractionActionMode);
+          const extractionActionTooltip = getGroupDocumentExtractionChangeTooltip(extractionActionMode, getGroupDocumentExtractionEngine(doc));
           detailsHtml += `
                       <button class="btn btn-sm btn-outline-secondary" onclick="reprocessGroupDocumentExtraction('${reprocessDocId}', '${extractionActionMode}', event)" title="${escapeHtml(extractionActionTooltip)}"> <i class="bi ${extractionActionIcon}"></i> Change to ${extractionActionLabel} </button>`;
         }
diff --git a/docs/explanation/features/CONTENT_UNDERSTANDING_ENHANCED_EXTRACTION.md b/docs/explanation/features/CONTENT_UNDERSTANDING_ENHANCED_EXTRACTION.md
new file mode 100644
index 000000000..63a513bc3
--- /dev/null
+++ b/docs/explanation/features/CONTENT_UNDERSTANDING_ENHANCED_EXTRACTION.md
@@ -0,0 +1,256 @@
+# Content Understanding Enhanced Extraction
+
+## Overview
+
+SimpleChat extracts document content in two tiers. **Standard** extraction always uses Azure
+Document Intelligence `prebuilt-read`. **Enhanced** extraction uses **Azure AI Content
+Understanding** (`prebuilt-documentSearch`), which returns layout-aware markdown *plus*
+AI-generated descriptions of figures, charts, and diagrams — structure that Document Intelligence
+does not produce.
+
+Enhanced extraction always degrades gracefully: when Content Understanding is unavailable or
+unconfigured, Enhanced automatically uses Document Intelligence `prebuilt-layout` instead.
+
+**Implemented in version: 0.250.221**
+
+**Tracking issue:** [#1277](https://github.com/microsoft/simplechat/issues/1277)
+
+### Dependencies
+
+| Dependency | Purpose | Required |
+| --- | --- | --- |
+| Azure Document Intelligence | Standard extraction, Auto-mode sampling, Enhanced fallback | Yes |
+| Microsoft Foundry resource with Content Understanding | Enhanced extraction and figure descriptions | Only for Enhanced in Azure commercial clouds |
+| Foundry model deployment defaults (a completion model and an embedding model) | Required by `prebuilt-documentSearch` | Only for Enhanced |
+
+No new Python package is required. The client uses `requests`, already pinned in
+`application/single_app/requirements.txt`.
+
+## Architecture
+
+```mermaid
+flowchart TD
+    A[Document upload] --> B{File type}
+    B -->|PDF or image| C{Extraction mode}
+    B -->|DOCX / PPTX| H[Document Intelligence Read]
+    B -->|Other| I[Format-specific extractor]
+
+    C -->|Standard| D[Document Intelligence prebuilt-read]
+    C -->|Auto| E[Sample first N pages with DI Layout]
+    C -->|Enhanced| F{Engine available?}
+
+    E -->|Tables, selection marks, or figures found| F
+    E -->|Nothing found| D
+
+    F -->|Azure Public and configured| G[Content Understanding prebuilt-documentSearch]
+    F -->|Gov / custom / unconfigured| J[Document Intelligence prebuilt-layout]
+    G -->|Request fails| J
+
+    H --> K[Extract embedded images from OOXML]
+    K --> L{Active engine}
+    L -->|Enhanced| M[Content Understanding prebuilt-imageSearch]
+    L -->|Standard| N[Document Intelligence]
+    M --> O[Append as citable chunks]
+    N --> O
+```
+
+### Engine resolution
+
+`resolve_enhanced_extraction_engine()` in `functions_settings.py` returns
+`(engine, reason)` and is the single source of truth:
+
+1. If `AZURE_ENVIRONMENT` is not `public`, return Document Intelligence with a reason naming the
+   cloud. Content Understanding is only offered in 12 Azure commercial regions.
+2. If Content Understanding is not configured (missing endpoint, or key auth without a key), return
+   Document Intelligence with a "not configured" reason.
+3. Otherwise return Content Understanding with an empty reason.
+
+The resolved engine and any fallback reason are persisted on each document as `extraction_engine`
+and `extraction_engine_reason`, and are surfaced in workspace tooltips.
+
+### Content Understanding REST flow
+
+| Step | Call |
+| --- | --- |
+| Submit | `POST {endpoint}/contentunderstanding/analyzers/{analyzerId}:analyzeBinary?api-version=2025-11-01` with raw file bytes and `Content-Type: application/octet-stream`. Optional `&range=1-3` for page sampling. |
+| Poll | `GET` the `Operation-Location` response header until `status` is `Succeeded`, `Failed`, or `Canceled`. |
+| Auth | `Ocp-Apim-Subscription-Key: <key>` or `Authorization: Bearer <token>` for the `https://cognitiveservices.azure.com/.default` scope. |
+
+Per-page content is reconstructed by slicing the content-level `markdown` string with each page's
+`spans` (`{offset, length}`). Figure descriptions from `figures[]` are attributed to the page whose
+span range contains the figure offset, and are skipped when the description is already inlined in
+that page's markdown.
+
+`extract_content_with_content_understanding()` returns the same
+`[{"page_number": int, "content": str}]` shape as `extract_content_with_azure_di()`, so downstream
+chunking is unchanged.
+
+## Configuration
+
+All settings live in **Admin Settings → Extract**.
+
+| Setting | Key | Default |
+| --- | --- | --- |
+| Enable Enhanced extraction | `enable_enhanced_extraction` | `False` |
+| PDF and Image Extraction Mode | `document_intelligence_pdf_image_extraction_mode` | `read` |
+| Auto Sample Pages | `document_intelligence_auto_sample_pages` | `3` |
+| Content Understanding Endpoint | `azure_content_understanding_endpoint` | `""` |
+| Authentication Type | `azure_content_understanding_authentication_type` | `key` |
+| Content Understanding Key | `azure_content_understanding_key` | `""` |
+| API Version | `azure_content_understanding_api_version` | `2025-11-01` |
+| Document Analyzer | `azure_content_understanding_analyzer_id` | `prebuilt-documentSearch` |
+| Image Analyzer | `azure_content_understanding_image_analyzer_id` | `prebuilt-imageSearch` |
+| Analyze images in Office files | `enable_office_embedded_image_analysis` | `True` |
+| Minimum Image Size (pixels) | `office_embedded_image_min_pixels` | `150` |
+| Maximum Images Per Document | `office_embedded_image_max_per_document` | `25` |
+
+The extraction mode values are unchanged (`read`, `layout`, `auto`) so existing documents and search
+index projections need no migration. `layout` now means "Enhanced", which routes to Content
+Understanding when available.
+
+### Upgrade behavior
+
+`enable_enhanced_extraction` is new and defaults to `False`, so `get_settings()` backfills it on
+first read: if the stored settings document has no `enable_enhanced_extraction` key and its
+`document_intelligence_pdf_image_extraction_mode` is `layout` or `auto`, the toggle is set to `True`
+and persisted. Deployments already using Enhanced or Auto therefore keep working across the upgrade
+rather than silently downgrading to Standard.
+
+### Enabling Enhanced extraction
+
+1. Turn on **Enable Enhanced extraction**. The mode selector defaults to **Auto**.
+2. In Azure commercial clouds, the **Azure AI Content Understanding** block appears. In Azure
+   Government and custom clouds, a notice explains that Enhanced uses Document Intelligence Layout
+   and there is nothing more to configure.
+3. Create a **Microsoft Foundry** resource in a supported region: East US, East US 2, West US,
+   West US 3, South Central US, North Europe, West Europe, Sweden Central, UK South, Australia East,
+   Japan East, or Southeast Asia.
+4. On the [Content Understanding settings page](https://contentunderstanding.ai.azure.com/settings),
+   add the Foundry resource and leave *Enable autodeployment for required models if no defaults are
+   available* checked. `prebuilt-documentSearch` requires default completion and embedding model
+   deployments; without them, analysis requests fail.
+5. Copy the endpoint (`https://<resource>.services.ai.azure.com`) and a key from
+   **Resource Management → Keys and Endpoint**, or select **Managed Identity** and assign the app's
+   identity the **Cognitive Services User** role on the Foundry resource.
+6. Use **Test Content Understanding Connection** to verify before saving.
+
+The in-app help modals (`documentIntelligenceExtractionHelpModal` and
+`contentUnderstandingSetupHelpModal`) contain the same guidance.
+
+## Extraction Modes
+
+| Mode | Stored value | Engine | Best for |
+| --- | --- | --- | --- |
+| Standard | `read` | Document Intelligence `prebuilt-read` | Plain-text PDFs and images. Fastest, cheapest. |
+| Enhanced | `layout` | Content Understanding `prebuilt-documentSearch`, falling back to Document Intelligence `prebuilt-layout` | Tables, page structure, forms, checkbox states, and figure descriptions. |
+| Auto | `auto` | Detector + one of the above | Mixed corpora where per-document cost matters. |
+
+Auto samples the first `document_intelligence_auto_sample_pages` pages with Document Intelligence
+Layout, which is the cheaper detector, and upgrades to Enhanced when the sample contains:
+
+- selection marks or checkbox states,
+- markdown table structure, or
+- figures or images (new in this version).
+
+Images are always treated as Enhanced in Auto mode because they are single-page inputs that benefit
+most from figure and spatial analysis.
+
+## Images Inside Office Files
+
+Content Understanding accepts DOCX, DOC, and PPTX as input, but its figure analysis only applies to
+PDFs and images. SimpleChat therefore extracts embedded images from the OOXML package and analyzes
+them separately.
+
+- Sources scanned: `word/media/*`, `ppt/media/*`, `xl/media/*`.
+- Accepted formats: PNG, JPG/JPEG, BMP, TIF/TIFF, HEIF/HEIC. Vector formats such as EMF and WMF are
+  skipped because neither engine accepts them.
+- Filtering: assets under 2 KB or smaller than `office_embedded_image_min_pixels` in either dimension
+  are skipped as icons, bullets, or spacers. Byte-identical images are analyzed once, so a logo
+  repeated in a header does not multiply cost. `office_embedded_image_max_per_document` caps the
+  total.
+- Ordering is natural, so `image2.png` precedes `image10.png`.
+- For PPTX, each image is attributed to the slide that references it via
+  `ppt/slides/_rels/slideN.xml.rels`.
+- Each analyzed image becomes its own citable chunk with a heading such as
+  `### Embedded image 2 of 5: image2.png on slide 3`.
+- Legacy `.doc` and `.ppt` files are OLE containers rather than zip packages, so they are skipped.
+
+Embedded image analysis never fails a document. Individual image failures are logged and skipped.
+
+## API
+
+Content Understanding reuses the existing admin test-connection endpoint. No new Flask route is
+added.
+
+```
+POST /api/admin/settings/test_connection
+{
+  "test_type": "content_understanding",
+  "endpoint": "https://your-resource.services.ai.azure.com",
+  "authentication_type": "key",
+  "key": "...",
+  "api_version": "2025-11-01",
+  "analyzer_id": "prebuilt-documentSearch",
+  "image_analyzer_id": "prebuilt-imageSearch"
+}
+```
+
+Responses call out the common setup failures specifically: a non-public cloud, a missing analyzer,
+rejected credentials with the required RBAC role, and missing Foundry model deployment defaults.
+
+The "Change Extraction" action now accepts PDFs **and** images. It rejects a target of Enhanced when
+Enhanced extraction is disabled.
+
+## File Structure
+
+| File | Role |
+| --- | --- |
+| `application/single_app/functions_content_understanding.py` | Content Understanding REST client, page reconstruction, image analysis, connection test |
+| `application/single_app/functions_office_media.py` | Embedded image extraction from OOXML packages |
+| `application/single_app/functions_content.py` | `extract_content_with_extraction_engine()` engine dispatch with fallback |
+| `application/single_app/functions_documents.py` | Ingestion pipeline, Auto-mode detection, embedded image chunks |
+| `application/single_app/functions_settings.py` | Settings, normalizers, engine resolution |
+| `application/single_app/route_backend_settings.py` | Test-connection handler |
+| `application/single_app/route_frontend_admin_settings.py` | Settings persistence and template context |
+| `application/single_app/templates/admin_settings.html` | Admin UI and setup guide modals |
+| `application/single_app/static/js/admin/admin_settings.js` | Admin UI wiring and test button |
+
+## Security
+
+- `azure_content_understanding_key` is stripped from user-facing settings by
+  `sanitize_settings_for_user()`, which removes any field whose name contains `key`.
+- The key is registered in `ADMIN_SETTINGS_FORM_SECRET_FIELDS`, so the admin form renders a redacted
+  placeholder and an unchanged placeholder resolves back to the stored secret on save.
+- Managed identity uses `DefaultAzureCredential` with the environment-appropriate
+  `cognitive_services_scope`. Tokens are cached and refreshed with a five-minute buffer.
+- `extraction_engine_reason` is server-generated, capped at 240 characters, and HTML-escaped
+  everywhere it is rendered.
+- Uploaded Office files are untrusted input. `functions_office_media.py` generates its own output
+  file names rather than reusing archive entry names, so a crafted entry cannot escape the
+  extraction directory. Entries are read by streaming in bounded chunks rather than trusting the
+  declared `ZipInfo.file_size`, which an archive can understate — CPython decompresses before
+  truncating to it, so a 64 KB entry claiming 4 KB can otherwise spike memory past 140 MB. The
+  module also whitelists the compression methods real OOXML packages use and caps how many archive
+  entries and relationship parts it will inspect. PowerPoint slide relationship parts are parsed
+  with `defusedxml` so entity-expansion payloads are rejected.
+
+## Testing and Validation
+
+| Test | Coverage |
+| --- | --- |
+| `functional_tests/test_content_understanding_extraction_engine.py` | Page reconstruction from spans, figure attribution, description de-duplication, mermaid retention when a description is already inlined, missing-page fallback, model-deployment error guidance, Government cloud gating, engine resolution behavior across cloud and configuration states, effective-mode toggle behavior, limit normalizers, the upgrade migration, and the settings/admin surface contract |
+| `functional_tests/test_office_embedded_image_extraction.py` | Real DOCX and PPTX zip round-trips: extraction, size and duplicate filtering, per-document cap, slide attribution, natural ordering, graceful handling of legacy and missing files, path-traversal defense against crafted entry names, and rejection of zip bombs and entity-expansion relationship parts |
+| `functional_tests/test_document_intelligence_pdf_image_extraction_mode.py` | Updated for the new engine split |
+| `functional_tests/test_document_intelligence_auto_reprocess_contract.py` | Updated for PDF and image extraction changes |
+
+## Known Limitations
+
+- **Azure Government is not supported** by Content Understanding. Enhanced silently uses Document
+  Intelligence Layout there, so figure descriptions are unavailable.
+- `prebuilt-documentSearch` invokes a language model per document, so Enhanced is meaningfully more
+  expensive than Document Intelligence Layout. Auto is the recommended default.
+- Content Understanding limits documents to 200 MB and 300 pages.
+- There is no APIM passthrough option for Content Understanding yet.
+- Content Understanding markdown is denser than Document Intelligence Read output because it
+  includes HTML tables and figure descriptions, so chunks are larger.
+- Legacy `.doc` and `.ppt` files do not support embedded image analysis.
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index 6f29b8bf6..38857b244 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,43 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](/explanation/features/) and [Fixes by Version](/explanation/fixes/).
 
+### **(v0.250.221)**
+
+#### New Features
+
+*   **Enhanced Extraction Now Uses Azure AI Content Understanding**
+    *   Enhanced extraction for PDFs and images now uses Azure AI Content Understanding (`prebuilt-documentSearch`) instead of Document Intelligence Layout. In addition to tables, page structure, and checkbox states, it returns AI-generated descriptions of figures, charts, and diagrams — structure Document Intelligence never produced.
+    *   Standard extraction is unchanged and always uses Document Intelligence, which remains required for workspaces and chat file uploads.
+    *   A new **Enable Enhanced extraction** toggle in Admin Settings reveals the Content Understanding configuration. Turning it on defaults the extraction mode to **Auto**, so documents are only upgraded when the sample shows structure worth paying for.
+    *   Content Understanding supports both key and managed identity authentication, with a **Test Connection** button and an in-app setup guide covering Foundry resource creation, supported regions, required model deployment defaults, and the Cognitive Services User role.
+    *   Enhanced never becomes a hard dependency. Content Understanding is not offered in Azure Government, so Enhanced automatically uses Document Intelligence Layout in Government and custom clouds — the admin UI says so plainly and there is nothing to configure there. Enhanced also falls back when Content Understanding is unconfigured or a request fails, and the reason is recorded on the document and shown in workspace tooltips.
+    *   (Ref: #1277, `functions_content_understanding.py`, `functions_content.py`, `functions_settings.py`, `route_backend_settings.py`, `admin_settings.html`, `CONTENT_UNDERSTANDING_ENHANCED_EXTRACTION.md`)
+
+*   **Images Inside Word and PowerPoint Files Are Now Analyzed**
+    *   Neither extraction engine describes figures inside Office files, so SimpleChat now pulls embedded images out of DOCX and PPTX packages and analyzes them with whichever engine backs the selected extraction mode — Content Understanding when Enhanced is active, Document Intelligence otherwise. This works with Standard extraction too.
+    *   Each analyzed image is indexed as its own citable chunk, and PowerPoint images are attributed to the slide that references them.
+    *   Cost is bounded by design: icons, bullets, and spacer graphics are filtered out by a configurable minimum size, byte-identical images such as repeated header logos are analyzed once, and a per-document cap limits the total.
+    *   Uploaded Office files are treated as untrusted: extracted file names are generated rather than reused from the archive, entries are streamed with a hard byte ceiling instead of trusting the archive's declared size, compression methods and entry counts are bounded, and slide relationship parts are parsed with a hardened XML parser.
+    *   Can be turned off entirely with **Analyze images embedded in DOCX and PPTX files**. Image analysis failures never fail the document.
+    *   (Ref: #1277, `functions_office_media.py`, `functions_documents.py`, embedded Office image analysis)
+
+#### Upgrade Notes
+
+*   **Existing Enhanced and Auto Deployments Keep Their Setting**
+    *   The new **Enable Enhanced extraction** toggle defaults to off, so deployments already set to Enhanced or Auto are migrated automatically on first settings read: the toggle is switched on and persisted, preserving the previously selected mode.
+    *   Without this migration an upgrade would have silently downgraded those deployments to Standard and then overwritten the stored mode on the next settings save.
+    *   (Ref: #1277, `functions_settings.py`, `get_settings()` migration)
+
+#### User Interface Enhancements
+
+*   **Extraction Badges Name the Engine That Actually Ran**
+    *   Extraction tooltips in personal, group, and public workspaces now say whether a document was processed with Azure AI Content Understanding or Document Intelligence Layout, and explain any fallback that occurred.
+    *   The **Change Extraction** action now works for images as well as PDFs, and refuses a change to Enhanced while Enhanced extraction is disabled.
+    *   (Ref: #1277, `workspace-documents.js`, `public_workspace.js`, `group_workspaces.html`, `functions_documents.py`)
+
+*   **Auto Mode Also Upgrades for Figures**
+    *   Auto mode still samples the first pages with Document Intelligence Layout as the cheaper detector, but now upgrades to Enhanced when it finds figures or images, not just tables and selection marks. This matters because figure description is the main reason to use Enhanced.
+    *   (Ref: #1277, `functions_documents.py`, Auto mode detection)
 ### **(v0.250.220)**
 
 #### Bug Fixes
diff --git a/functional_tests/test_content_understanding_extraction_engine.py b/functional_tests/test_content_understanding_extraction_engine.py
new file mode 100644
index 000000000..0c88365c7
--- /dev/null
+++ b/functional_tests/test_content_understanding_extraction_engine.py
@@ -0,0 +1,805 @@
+#!/usr/bin/env python3
+# test_content_understanding_extraction_engine.py
+"""
+Functional test for Enhanced extraction backed by Azure AI Content Understanding.
+Version: 0.250.221
+Implemented in: 0.250.221
+
+This test ensures that the Content Understanding client parses analyzer results into the same
+page shape Document Intelligence returns, that Enhanced extraction resolves to the right engine
+per Azure cloud and configuration, and that Enhanced always falls back to Document Intelligence
+Layout instead of failing ingestion.
+"""
+
+import sys
+import types
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+APP_ROOT = REPO_ROOT / "application" / "single_app"
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from test_support.versioning import assert_app_version_at_least  # noqa: E402
+
+
+def load_content_understanding_module(azure_environment="public"):
+    """Import functions_content_understanding with its Azure-dependent imports stubbed out.
+
+    The real config module builds live Azure clients at import time, so the test injects
+    minimal stand-ins for the handful of names the client module actually uses.
+    """
+    for module_name in (
+        "config",
+        "functions_appinsights",
+        "functions_debug",
+        "functions_settings",
+        "azure",
+        "azure.identity",
+        "functions_content_understanding",
+    ):
+        sys.modules.pop(module_name, None)
+
+    config_module = types.ModuleType("config")
+    config_module.AZURE_ENVIRONMENT = azure_environment
+    config_module.cognitive_services_scope = "https://cognitiveservices.azure.com/.default"
+    sys.modules["config"] = config_module
+
+    appinsights_module = types.ModuleType("functions_appinsights")
+    appinsights_module.log_event = lambda *args, **kwargs: None
+    sys.modules["functions_appinsights"] = appinsights_module
+
+    debug_module = types.ModuleType("functions_debug")
+    debug_module.debug_print = lambda *args, **kwargs: None
+    sys.modules["functions_debug"] = debug_module
+
+    azure_module = types.ModuleType("azure")
+    identity_module = types.ModuleType("azure.identity")
+
+    class _StubCredential:
+        def get_token(self, *args, **kwargs):
+            raise AssertionError("Managed identity token should not be requested in this test.")
+
+    identity_module.DefaultAzureCredential = _StubCredential
+    azure_module.identity = identity_module
+    sys.modules["azure"] = azure_module
+    sys.modules["azure.identity"] = identity_module
+
+    settings_module = _build_settings_stub(azure_environment)
+    sys.modules["functions_settings"] = settings_module
+
+    sys.path.insert(0, str(APP_ROOT))
+    try:
+        import functions_content_understanding  # noqa: PLC0415
+    finally:
+        sys.path.remove(str(APP_ROOT))
+
+    return functions_content_understanding, settings_module
+
+
+def _build_settings_stub(azure_environment):
+    """Build a functions_settings stand-in mirroring the real normalizer contract."""
+    settings_module = types.ModuleType("functions_settings")
+    settings_module.CONTENT_UNDERSTANDING_DOCUMENT_ANALYZER_DEFAULT = "prebuilt-documentSearch"
+    settings_module.CONTENT_UNDERSTANDING_IMAGE_ANALYZER_DEFAULT = "prebuilt-imageSearch"
+    settings_module.CONTENT_UNDERSTANDING_API_VERSION_DEFAULT = "2025-11-01"
+    settings_module.EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE = "document_intelligence"
+    settings_module.EXTRACTION_ENGINE_CONTENT_UNDERSTANDING = "content_understanding"
+
+    settings_module.normalize_content_understanding_endpoint = (
+        lambda value: str(value or "").strip().rstrip("/")
+    )
+    settings_module.normalize_content_understanding_authentication_type = (
+        lambda value: "managed_identity" if str(value or "").strip().lower() == "managed_identity" else "key"
+    )
+    settings_module.normalize_content_understanding_api_version = (
+        lambda value: str(value or "").strip() or "2025-11-01"
+    )
+    settings_module.normalize_content_understanding_analyzer_id = (
+        lambda value, default_analyzer_id=None: str(value or "").strip()
+        or (default_analyzer_id or "prebuilt-documentSearch")
+    )
+    settings_module.is_content_understanding_supported_environment = (
+        lambda *args, **kwargs: azure_environment == "public"
+    )
+    settings_module.get_content_understanding_config = lambda settings: {
+        "endpoint": str((settings or {}).get("azure_content_understanding_endpoint") or "").rstrip("/"),
+        "key": str((settings or {}).get("azure_content_understanding_key") or ""),
+        "authentication_type": (settings or {}).get("azure_content_understanding_authentication_type") or "key",
+        "api_version": "2025-11-01",
+        "analyzer_id": "prebuilt-documentSearch",
+        "image_analyzer_id": "prebuilt-imageSearch",
+    }
+    settings_module.get_settings = lambda: {}
+    return settings_module
+
+
+def build_sample_analyzer_result():
+    """Build a Content Understanding document result shaped like the documented REST response."""
+    page_one_markdown = "# Quarterly Report\n\nRevenue grew.\n\n"
+    page_two_markdown = "| Region | Total |\n| --- | --- |\n| West | 42 |\n"
+    markdown = page_one_markdown + page_two_markdown
+
+    return {
+        "analyzerId": "prebuilt-documentSearch",
+        "apiVersion": "2025-11-01",
+        "contents": [
+            {
+                "kind": "document",
+                "markdown": markdown,
+                "mimeType": "application/pdf",
+                "startPageNumber": 1,
+                "endPageNumber": 2,
+                "unit": "inch",
+                "pages": [
+                    {
+                        "pageNumber": 1,
+                        "spans": [{"offset": 0, "length": len(page_one_markdown)}],
+                    },
+                    {
+                        "pageNumber": 2,
+                        "spans": [
+                            {"offset": len(page_one_markdown), "length": len(page_two_markdown)}
+                        ],
+                    },
+                ],
+                "figures": [
+                    {
+                        "id": "fig-1",
+                        "kind": "chart",
+                        "description": "A bar chart comparing quarterly revenue by region.",
+                        "caption": {"content": "Figure 1: Revenue"},
+                        "span": {"offset": 5, "length": 10},
+                    },
+                    {
+                        "id": "fig-2",
+                        "kind": "mermaid",
+                        "description": "A flowchart of the approval process.",
+                        "content": "graph TD\n  A[Start] --> B{Decision}",
+                        "span": {"offset": len(page_one_markdown) + 3, "length": 8},
+                    },
+                ],
+            }
+        ],
+    }
+
+
+def test_page_reconstruction_from_spans():
+    """Content Understanding markdown must be split back into per-page content."""
+    print("Testing Content Understanding page reconstruction...")
+
+    content_understanding, _ = load_content_understanding_module()
+    pages = content_understanding.build_pages_from_content_understanding_result(
+        build_sample_analyzer_result()
+    )
+
+    if len(pages) != 2:
+        raise AssertionError(f"Expected 2 reconstructed pages, got {len(pages)}: {pages}")
+
+    if pages[0]["page_number"] != 1 or pages[1]["page_number"] != 2:
+        raise AssertionError(f"Page numbers were not preserved: {pages}")
+
+    if "Quarterly Report" not in pages[0]["content"]:
+        raise AssertionError("Page 1 lost its heading content.")
+    if "| Region | Total |" not in pages[1]["content"]:
+        raise AssertionError("Page 2 lost its markdown table.")
+    if "Quarterly Report" in pages[1]["content"]:
+        raise AssertionError("Page 2 incorrectly absorbed page 1 content.")
+
+    print("Page reconstruction test passed!")
+    return True
+
+
+def test_figure_descriptions_attach_to_their_page():
+    """Figure descriptions must land on the page whose span range contains them."""
+    print("Testing Content Understanding figure attribution...")
+
+    content_understanding, _ = load_content_understanding_module()
+    pages = content_understanding.build_pages_from_content_understanding_result(
+        build_sample_analyzer_result()
+    )
+
+    page_one_content = pages[0]["content"]
+    page_two_content = pages[1]["content"]
+
+    if "bar chart comparing quarterly revenue" not in page_one_content:
+        raise AssertionError("Chart figure description was not attached to page 1.")
+    if "flowchart of the approval process" not in page_two_content:
+        raise AssertionError("Mermaid figure description was not attached to page 2.")
+    if "```mermaid" not in page_two_content:
+        raise AssertionError("Mermaid figure content was not preserved.")
+    if "bar chart comparing quarterly revenue" in page_two_content:
+        raise AssertionError("Chart figure description leaked onto page 2.")
+
+    print("Figure attribution test passed!")
+    return True
+
+
+def test_inline_figure_descriptions_are_not_duplicated():
+    """Descriptions already inlined in the markdown must not be appended a second time."""
+    print("Testing Content Understanding figure de-duplication...")
+
+    content_understanding, _ = load_content_understanding_module()
+    description = "A bar chart comparing quarterly revenue by region."
+    markdown = f"# Report\n\n{description}\n"
+
+    result = {
+        "contents": [
+            {
+                "kind": "document",
+                "markdown": markdown,
+                "startPageNumber": 1,
+                "pages": [{"pageNumber": 1, "spans": [{"offset": 0, "length": len(markdown)}]}],
+                "figures": [
+                    {
+                        "id": "fig-1",
+                        "kind": "chart",
+                        "description": description,
+                        "span": {"offset": 10, "length": 5},
+                    }
+                ],
+            }
+        ]
+    }
+
+    pages = content_understanding.build_pages_from_content_understanding_result(result)
+    if pages[0]["content"].count(description) != 1:
+        raise AssertionError(
+            f"Figure description was duplicated on the page: {pages[0]['content']!r}"
+        )
+
+    print("Figure de-duplication test passed!")
+    return True
+
+
+def test_missing_pages_falls_back_to_whole_markdown():
+    """A result without per-page spans still yields a single usable page."""
+    print("Testing Content Understanding page fallback...")
+
+    content_understanding, _ = load_content_understanding_module()
+    result = {"contents": [{"kind": "document", "markdown": "Just some text.", "startPageNumber": 1}]}
+
+    pages = content_understanding.build_pages_from_content_understanding_result(result)
+    if len(pages) != 1 or pages[0]["content"] != "Just some text.":
+        raise AssertionError(f"Unexpected fallback page output: {pages}")
+
+    print("Page fallback test passed!")
+    return True
+
+
+def test_missing_model_deployment_error_is_explained():
+    """The generic Azure model-deployment failure must become actionable admin guidance."""
+    print("Testing Content Understanding model deployment guidance...")
+
+    content_understanding, _ = load_content_understanding_module()
+
+    if not content_understanding._looks_like_missing_model_deployment(
+        "No default model deployment configured for this resource."
+    ):
+        raise AssertionError("Missing model deployment errors were not detected.")
+    if content_understanding._looks_like_missing_model_deployment("Invalid subscription key."):
+        raise AssertionError("Unrelated errors were misclassified as deployment failures.")
+
+    print("Model deployment guidance test passed!")
+    return True
+
+
+def test_government_cloud_blocks_content_understanding():
+    """Content Understanding must refuse to run in clouds where it is unavailable."""
+    print("Testing Content Understanding environment gate...")
+
+    content_understanding, _ = load_content_understanding_module(azure_environment="usgovernment")
+
+    is_ok, message = content_understanding.test_content_understanding_connection(
+        {"endpoint": "https://example.services.ai.azure.com", "key": "fake-key"}
+    )
+    if is_ok:
+        raise AssertionError("Content Understanding should be unavailable in usgovernment.")
+    if "not available" not in message.lower():
+        raise AssertionError(f"Unexpected environment gate message: {message}")
+
+    print("Environment gate test passed!")
+    return True
+
+
+def read_repo_file(relative_path):
+    """Read a repository file as UTF-8 text."""
+    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+
+
+def assert_contains(content, expected_text, description):
+    """Raise a clear assertion error when expected text is missing."""
+    if expected_text not in content:
+        raise AssertionError(f"Missing {description}: {expected_text}")
+
+
+def test_engine_resolution_contract():
+    """The extraction engine resolver must prefer Content Understanding but always fall back."""
+    print("Testing extraction engine resolution contract...")
+
+    settings = read_repo_file("application/single_app/functions_settings.py")
+    content = read_repo_file("application/single_app/functions_content.py")
+
+    assert_contains(settings, 'EXTRACTION_ENGINE_CONTENT_UNDERSTANDING = "content_understanding"', "Content Understanding engine constant")
+    assert_contains(settings, 'EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE = "document_intelligence"', "Document Intelligence engine constant")
+    assert_contains(settings, 'CONTENT_UNDERSTANDING_SUPPORTED_AZURE_ENVIRONMENTS = {"public"}', "supported cloud allowlist")
+    assert_contains(settings, "def resolve_enhanced_extraction_engine", "engine resolver")
+    assert_contains(settings, "def is_content_understanding_supported_environment", "environment gate helper")
+    assert_contains(settings, "def is_content_understanding_configured", "configuration gate helper")
+    assert_contains(settings, "def get_effective_document_intelligence_pdf_image_extraction_mode", "effective mode helper")
+    assert_contains(settings, "def is_enhanced_extraction_enabled", "Enhanced toggle helper")
+
+    assert_contains(content, "def extract_content_with_extraction_engine", "shared engine dispatcher")
+    assert_contains(content, "def resolve_extraction_engine_for_mode", "mode-to-engine resolver")
+    assert_contains(content, "extraction_mode='layout'", "Document Intelligence Layout fallback call")
+    assert_contains(content, "so Document Intelligence Layout was used", "fallback reason text")
+
+    print("Engine resolution contract test passed!")
+    return True
+
+
+def test_settings_and_admin_surface_contract():
+    """New Content Understanding settings must be defaulted, redacted, persisted, and surfaced."""
+    print("Testing Content Understanding settings and admin surface...")
+
+    settings = read_repo_file("application/single_app/functions_settings.py")
+    admin_route = read_repo_file("application/single_app/route_frontend_admin_settings.py")
+    backend_route = read_repo_file("application/single_app/route_backend_settings.py")
+    admin_html = read_repo_file("application/single_app/templates/admin_settings.html")
+    admin_js = read_repo_file("application/single_app/static/js/admin/admin_settings.js")
+
+    assert_contains(settings, "'enable_enhanced_extraction': False", "Enhanced toggle default")
+    assert_contains(settings, "'azure_content_understanding_endpoint': ''", "endpoint default")
+    assert_contains(settings, "'azure_content_understanding_authentication_type': 'key'", "auth type default")
+    assert_contains(settings, '"azure_content_understanding_key",', "key registered as a redacted admin secret")
+    assert_contains(settings, "'enable_office_embedded_image_analysis': True", "Office image analysis default")
+
+    # The key must be stripped from user-facing settings by the shared sanitizer.
+    assert_contains(settings, 'sensitive_terms = ("key",', "sanitizer strips fields containing 'key'")
+
+    assert_contains(admin_route, "'enable_enhanced_extraction': enable_enhanced_extraction", "Enhanced toggle persistence")
+    assert_contains(admin_route, "'azure_content_understanding_endpoint': azure_content_understanding_endpoint", "endpoint persistence")
+    assert_contains(admin_route, "admin_secret('azure_content_understanding_key')", "key persistence via admin secret resolution")
+    assert_contains(admin_route, "document_intelligence_pdf_image_extraction_mode = 'auto'", "Enhanced enable defaults the mode to Auto")
+    assert_contains(admin_route, "content_understanding_supported=is_content_understanding_supported_environment()", "environment flag passed to the template")
+
+    assert_contains(backend_route, "elif test_type == 'content_understanding':", "test connection dispatch")
+    assert_contains(backend_route, "def _test_content_understanding_connection", "test connection handler")
+
+    assert_contains(admin_html, 'id="enable_enhanced_extraction"', "Enhanced toggle input")
+    assert_contains(admin_html, 'id="azure_content_understanding_endpoint"', "endpoint input")
+    assert_contains(admin_html, 'id="azure_content_understanding_authentication_type"', "auth type select")
+    assert_contains(admin_html, 'id="test_content_understanding_button"', "test connection button")
+    assert_contains(admin_html, "contentUnderstandingSetupHelpModal", "Content Understanding setup guide modal")
+    assert_contains(admin_html, "Cognitive Services User", "managed identity role guidance")
+    assert_contains(admin_html, "{% if content_understanding_supported %}", "environment-aware Content Understanding block")
+    assert_contains(admin_html, "is not available in the", "non-public cloud fallback notice")
+    assert_contains(admin_html, 'id="enable_office_embedded_image_analysis"', "Office embedded image toggle")
+
+    assert_contains(admin_js, "test_content_understanding_button", "test connection wiring")
+    assert_contains(admin_js, "test_type: 'content_understanding'", "test connection payload")
+    assert_contains(admin_js, "enhanced_extraction_settings", "Enhanced section visibility wiring")
+
+    print("Settings and admin surface test passed!")
+    return True
+
+
+def test_auto_mode_detects_figures():
+    """Auto mode must upgrade to Enhanced when the sampled pages contain figures."""
+    print("Testing Auto mode figure detection...")
+
+    documents = read_repo_file("application/single_app/functions_documents.py")
+
+    assert_contains(documents, "DI_MARKDOWN_FIGURE_PATTERN", "figure detection pattern")
+    assert_contains(documents, "figures or images detected in the sampled pages", "figure detection reason")
+    assert_contains(documents, "def _build_office_embedded_image_chunks", "Office embedded image chunk builder")
+    assert_contains(documents, "extraction_engine=extraction_engine", "engine recorded on the document")
+    assert_contains(documents, "extraction_engine_reason", "engine fallback reason recorded on the document")
+
+    print("Auto mode figure detection test passed!")
+    return True
+
+
+def load_settings_functions(function_names, azure_environment="public"):
+    """Exec selected functions from the real functions_settings.py source in an isolated namespace.
+
+    functions_settings imports the full Azure config at module load, so the test extracts only the
+    pure helpers under test and runs them against the actual repository source.
+    """
+    import ast
+
+    source = (APP_ROOT / "functions_settings.py").read_text(encoding="utf-8")
+    tree = ast.parse(source)
+
+    wanted = set(function_names)
+    namespace = {
+        "AZURE_ENVIRONMENT": azure_environment,
+        "CONTENT_UNDERSTANDING_SUPPORTED_AZURE_ENVIRONMENTS": {"public"},
+        "CONTENT_UNDERSTANDING_AUTHENTICATION_TYPES": {"key", "managed_identity"},
+        "CONTENT_UNDERSTANDING_API_VERSION_DEFAULT": "2025-11-01",
+        "CONTENT_UNDERSTANDING_DOCUMENT_ANALYZER_DEFAULT": "prebuilt-documentSearch",
+        "CONTENT_UNDERSTANDING_IMAGE_ANALYZER_DEFAULT": "prebuilt-imageSearch",
+        "EXTRACTION_ENGINE_DOCUMENT_INTELLIGENCE": "document_intelligence",
+        "EXTRACTION_ENGINE_CONTENT_UNDERSTANDING": "content_understanding",
+        "DOCUMENT_INTELLIGENCE_PDF_IMAGE_EXTRACTION_MODES": {"read", "layout", "auto"},
+        "OFFICE_EMBEDDED_IMAGE_MIN_PIXELS_DEFAULT": 150,
+        "OFFICE_EMBEDDED_IMAGE_MIN_PIXELS_MAX": 2000,
+        "OFFICE_EMBEDDED_IMAGE_MAX_PER_DOCUMENT_DEFAULT": 25,
+        "OFFICE_EMBEDDED_IMAGE_MAX_PER_DOCUMENT_MAX": 200,
+    }
+
+    found = set()
+    for node in tree.body:
+        if isinstance(node, ast.FunctionDef) and node.name in wanted:
+            exec(compile(ast.Module(body=[node], type_ignores=[]), "functions_settings.py", "exec"), namespace)
+            found.add(node.name)
+
+    missing = wanted - found
+    if missing:
+        raise AssertionError(f"Could not locate settings functions in source: {sorted(missing)}")
+
+    return namespace
+
+
+def test_enhanced_extraction_engine_resolution_behavior():
+    """Enhanced must use Content Understanding only when the cloud and configuration allow it."""
+    print("Testing Enhanced extraction engine resolution behavior...")
+
+    required = [
+        "resolve_enhanced_extraction_engine",
+        "is_content_understanding_supported_environment",
+        "is_content_understanding_configured",
+        "get_content_understanding_config",
+        "normalize_content_understanding_endpoint",
+        "normalize_content_understanding_authentication_type",
+        "normalize_content_understanding_api_version",
+        "normalize_content_understanding_analyzer_id",
+    ]
+
+    public_ns = load_settings_functions(required, azure_environment="public")
+    resolve_public = public_ns["resolve_enhanced_extraction_engine"]
+
+    configured_settings = {
+        "azure_content_understanding_endpoint": "https://example.services.ai.azure.com/",
+        "azure_content_understanding_key": "fake-key",
+        "azure_content_understanding_authentication_type": "key",
+    }
+    engine, reason = resolve_public(configured_settings)
+    if engine != "content_understanding":
+        raise AssertionError(f"Configured public cloud should use Content Understanding, got {engine} ({reason})")
+    if reason:
+        raise AssertionError(f"A successful resolution should carry no fallback reason, got {reason!r}")
+
+    # Key auth without a key is not usable, so Enhanced must fall back rather than fail.
+    engine, reason = resolve_public({**configured_settings, "azure_content_understanding_key": ""})
+    if engine != "document_intelligence" or "not configured" not in reason:
+        raise AssertionError(f"Missing key should fall back to Document Intelligence, got {engine} ({reason})")
+
+    # Managed identity needs no key.
+    engine, _ = resolve_public({
+        "azure_content_understanding_endpoint": "https://example.services.ai.azure.com",
+        "azure_content_understanding_authentication_type": "managed_identity",
+    })
+    if engine != "content_understanding":
+        raise AssertionError("Managed identity without a key should still use Content Understanding.")
+
+    engine, reason = resolve_public({})
+    if engine != "document_intelligence" or "not configured" not in reason:
+        raise AssertionError(f"Empty settings should fall back to Document Intelligence, got {engine} ({reason})")
+
+    gov_ns = load_settings_functions(required, azure_environment="usgovernment")
+    engine, reason = gov_ns["resolve_enhanced_extraction_engine"](configured_settings)
+    if engine != "document_intelligence":
+        raise AssertionError(f"Government cloud must use Document Intelligence, got {engine}")
+    if "usgovernment" not in reason:
+        raise AssertionError(f"Government fallback reason should name the cloud, got {reason!r}")
+
+    print("Engine resolution behavior test passed!")
+    return True
+
+
+def test_effective_extraction_mode_honors_enhanced_toggle():
+    """Turning Enhanced off must force Standard regardless of the stored mode."""
+    print("Testing effective extraction mode behavior...")
+
+    namespace = load_settings_functions([
+        "get_effective_document_intelligence_pdf_image_extraction_mode",
+        "get_document_intelligence_pdf_image_extraction_mode",
+        "normalize_document_intelligence_pdf_image_extraction_mode",
+        "is_enhanced_extraction_enabled",
+        "normalize_enhanced_extraction_enabled",
+    ])
+    get_effective_mode = namespace["get_effective_document_intelligence_pdf_image_extraction_mode"]
+
+    disabled = {
+        "enable_enhanced_extraction": False,
+        "document_intelligence_pdf_image_extraction_mode": "layout",
+    }
+    if get_effective_mode(disabled) != "read":
+        raise AssertionError("Enhanced disabled must force Standard extraction.")
+
+    enabled_layout = {
+        "enable_enhanced_extraction": True,
+        "document_intelligence_pdf_image_extraction_mode": "layout",
+    }
+    if get_effective_mode(enabled_layout) != "layout":
+        raise AssertionError("Enhanced enabled must honor the stored Enhanced mode.")
+
+    enabled_auto = {
+        "enable_enhanced_extraction": True,
+        "document_intelligence_pdf_image_extraction_mode": "auto",
+    }
+    if get_effective_mode(enabled_auto) != "auto":
+        raise AssertionError("Enhanced enabled must honor Auto mode.")
+
+    if get_effective_mode({"enable_enhanced_extraction": True}) != "read":
+        raise AssertionError("An unset mode must default to Standard.")
+
+    print("Effective extraction mode test passed!")
+    return True
+
+
+def test_office_embedded_image_limits_are_clamped():
+    """Embedded image limits must be clamped into safe ranges."""
+    print("Testing embedded image limit normalizers...")
+
+    namespace = load_settings_functions([
+        "normalize_office_embedded_image_min_pixels",
+        "normalize_office_embedded_image_max_per_document",
+    ])
+    normalize_min_pixels = namespace["normalize_office_embedded_image_min_pixels"]
+    normalize_max_images = namespace["normalize_office_embedded_image_max_per_document"]
+
+    cases = [
+        (normalize_min_pixels, None, 150),
+        (normalize_min_pixels, "not a number", 150),
+        (normalize_min_pixels, -5, 1),
+        (normalize_min_pixels, 999999, 2000),
+        (normalize_min_pixels, "300", 300),
+        (normalize_max_images, None, 25),
+        (normalize_max_images, -1, 0),
+        (normalize_max_images, 999999, 200),
+        (normalize_max_images, "10", 10),
+    ]
+
+    for normalizer, raw_value, expected in cases:
+        actual = normalizer(raw_value)
+        if actual != expected:
+            raise AssertionError(
+                f"{normalizer.__name__}({raw_value!r}) returned {actual}, expected {expected}"
+            )
+
+    print("Embedded image limit normalizer test passed!")
+    return True
+
+
+def test_mermaid_content_survives_inlined_description():
+    """A mermaid diagram must be kept even when its description is already inlined in the markdown."""
+    print("Testing mermaid retention with an inlined description...")
+
+    content_understanding, _ = load_content_understanding_module()
+    description = "A flowchart showing the approval process."
+    markdown = f"# Process\n\n{description}\n"
+
+    result = {
+        "contents": [
+            {
+                "kind": "document",
+                "markdown": markdown,
+                "startPageNumber": 1,
+                "pages": [{"pageNumber": 1, "spans": [{"offset": 0, "length": len(markdown)}]}],
+                "figures": [
+                    {
+                        "id": "fig-1",
+                        "kind": "mermaid",
+                        "description": description,
+                        "content": "graph TD\n  A[Start] --> B{Decision}",
+                        "span": {"offset": 10, "length": 5},
+                    }
+                ],
+            }
+        ]
+    }
+
+    pages = content_understanding.build_pages_from_content_understanding_result(result)
+    page_content = pages[0]["content"]
+
+    if "```mermaid" not in page_content:
+        raise AssertionError(
+            f"Mermaid diagram source was dropped alongside the inlined description: {page_content!r}"
+        )
+    if "graph TD" not in page_content:
+        raise AssertionError("Mermaid diagram body was lost.")
+    if page_content.count(description) != 1:
+        raise AssertionError(f"Inlined description was duplicated: {page_content!r}")
+
+    print("Mermaid retention test passed!")
+    return True
+
+
+def test_enhanced_extraction_upgrade_migration_contract():
+    """Existing Enhanced or Auto deployments must keep Enhanced enabled after upgrading."""
+    print("Testing Enhanced extraction upgrade migration...")
+
+    settings = read_repo_file("application/single_app/functions_settings.py")
+
+    assert_contains(settings, "legacy_enhanced_extraction = 'enable_enhanced_extraction' not in settings_item", "legacy toggle detection before merge")
+    assert_contains(settings, "if legacy_enhanced_extraction and legacy_enhanced_extraction_mode in ('layout', 'auto'):", "migration condition")
+    assert_contains(settings, "merged['enable_enhanced_extraction'] = True", "migration backfill")
+    assert_contains(settings, "or enhanced_extraction_migration_updated", "migration persisted to Cosmos")
+
+    # The migration must run before the merge fills the key in with its False default.
+    detection_index = settings.index("legacy_enhanced_extraction = 'enable_enhanced_extraction' not in settings_item")
+    merge_index = settings.index("merge_changed = deep_merge_dicts(default_settings, settings_item)")
+    if detection_index > merge_index:
+        raise AssertionError("Legacy toggle detection must happen before deep_merge_dicts fills the default.")
+
+    print("Upgrade migration test passed!")
+    return True
+
+
+def test_diagram_only_figure_renders_a_valid_fence():
+    """A diagram kept after its description is de-duplicated must still be valid markdown.
+
+    The opening code fence has to start at column zero, otherwise markdown renderers treat it as
+    ordinary paragraph text.
+    """
+    print("Testing diagram-only figure fence placement...")
+
+    content_understanding, _ = load_content_understanding_module()
+    description = "A flowchart showing the approval process."
+    markdown = f"# Process\n\n{description}\n"
+
+    result = {
+        "contents": [
+            {
+                "kind": "document",
+                "markdown": markdown,
+                "startPageNumber": 1,
+                "pages": [{"pageNumber": 1, "spans": [{"offset": 0, "length": len(markdown)}]}],
+                "figures": [
+                    {
+                        "id": "fig-1",
+                        "kind": "mermaid",
+                        "description": description,
+                        "content": "graph TD\n  A[Start] --> B{Decision}",
+                        "span": {"offset": 10, "length": 5},
+                    }
+                ],
+            }
+        ]
+    }
+
+    pages = content_understanding.build_pages_from_content_understanding_result(result)
+    page_content = pages[0]["content"]
+
+    fence_lines = [line for line in page_content.splitlines() if line.startswith("```mermaid")]
+    if not fence_lines:
+        raise AssertionError(
+            f"Opening mermaid fence must start at the beginning of a line: {page_content!r}"
+        )
+
+    # The fence must also close on its own line.
+    closing_lines = [line for line in page_content.splitlines() if line.strip() == "```"]
+    if not closing_lines:
+        raise AssertionError(f"Mermaid fence was not closed on its own line: {page_content!r}")
+
+    print("Diagram fence placement test passed!")
+    return True
+
+
+def test_caption_only_figure_is_not_dropped():
+    """Descriptions are optional in the API schema, so a captioned figure must survive."""
+    print("Testing caption-only figure retention...")
+
+    content_understanding, _ = load_content_understanding_module()
+    markdown = "# Report\n\nSome text.\n"
+
+    result = {
+        "contents": [
+            {
+                "kind": "document",
+                "markdown": markdown,
+                "startPageNumber": 1,
+                "pages": [{"pageNumber": 1, "spans": [{"offset": 0, "length": len(markdown)}]}],
+                "figures": [
+                    {
+                        "id": "fig-7",
+                        "kind": "image",
+                        "caption": {"content": "Figure 4: Site layout"},
+                        "span": {"offset": 5, "length": 3},
+                    }
+                ],
+            }
+        ]
+    }
+
+    pages = content_understanding.build_pages_from_content_understanding_result(result)
+    if "Figure 4: Site layout" not in pages[0]["content"]:
+        raise AssertionError(f"A caption-only figure was dropped: {pages[0]['content']!r}")
+
+    print("Caption-only figure test passed!")
+    return True
+
+
+def test_figures_survive_when_the_result_has_no_pages():
+    """Figure descriptions must not be lost when the response omits per-page spans."""
+    print("Testing figure retention in the no-pages fallback...")
+
+    content_understanding, _ = load_content_understanding_module()
+
+    result = {
+        "contents": [
+            {
+                "kind": "document",
+                "markdown": "Scanned page with a chart.",
+                "startPageNumber": 1,
+                "figures": [
+                    {
+                        "id": "fig-1",
+                        "kind": "chart",
+                        "description": "A pie chart of budget allocation by department.",
+                        "span": {"offset": 2, "length": 4},
+                    }
+                ],
+            }
+        ]
+    }
+
+    pages = content_understanding.build_pages_from_content_understanding_result(result)
+    if len(pages) != 1:
+        raise AssertionError(f"Expected a single fallback page, got {pages}")
+    if "pie chart of budget allocation" not in pages[0]["content"]:
+        raise AssertionError(
+            f"Figure description was lost in the no-pages fallback: {pages[0]['content']!r}"
+        )
+
+    print("No-pages figure retention test passed!")
+    return True
+
+
+def test_version_is_at_least_implementation_version():
+    """The app version must be at or beyond the version this feature shipped in."""
+    print("Testing application version...")
+    assert_app_version_at_least("0.250.221")
+    print("Version test passed!")
+    return True
+
+
+if __name__ == "__main__":
+    tests = [
+        test_page_reconstruction_from_spans,
+        test_figure_descriptions_attach_to_their_page,
+        test_inline_figure_descriptions_are_not_duplicated,
+        test_mermaid_content_survives_inlined_description,
+        test_diagram_only_figure_renders_a_valid_fence,
+        test_caption_only_figure_is_not_dropped,
+        test_figures_survive_when_the_result_has_no_pages,
+        test_missing_pages_falls_back_to_whole_markdown,
+        test_missing_model_deployment_error_is_explained,
+        test_government_cloud_blocks_content_understanding,
+        test_engine_resolution_contract,
+        test_enhanced_extraction_engine_resolution_behavior,
+        test_effective_extraction_mode_honors_enhanced_toggle,
+        test_office_embedded_image_limits_are_clamped,
+        test_settings_and_admin_surface_contract,
+        test_auto_mode_detects_figures,
+        test_enhanced_extraction_upgrade_migration_contract,
+        test_version_is_at_least_implementation_version,
+    ]
+
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        try:
+            results.append(test())
+        except Exception as error:
+            print(f"Test failed: {error}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(1 for result in results if result)}/{len(results)} tests passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_document_intelligence_auto_reprocess_contract.py b/functional_tests/test_document_intelligence_auto_reprocess_contract.py
index 37381b354..7699b1788 100644
--- a/functional_tests/test_document_intelligence_auto_reprocess_contract.py
+++ b/functional_tests/test_document_intelligence_auto_reprocess_contract.py
@@ -16,6 +16,10 @@
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
 
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from test_support.versioning import assert_app_version_at_least  # noqa: E402
+
 
 def read_repo_file(relative_path):
     """Read a repository file as UTF-8 text."""
@@ -46,7 +50,7 @@ def test_document_intelligence_auto_reprocess_contract():
     public_html = read_repo_file("application/single_app/templates/public_workspaces.html")
     public_js = read_repo_file("application/single_app/static/js/public/public_workspace.js")
 
-    assert_contains(config, 'VERSION = "0.241.167"', "current version")
+    assert_app_version_at_least("0.241.167")
 
     assert_contains(settings, '"auto"', "Auto allowed mode")
     assert_contains(settings, "DOCUMENT_INTELLIGENCE_MANUAL_EXTRACTION_MODES", "manual extraction change modes")
@@ -60,7 +64,7 @@ def test_document_intelligence_auto_reprocess_contract():
     assert_contains(documents, "source_file_available", "source blob metadata")
     assert_contains(documents, '"mark_enhanced_citations": False', "source-only blob upload")
     assert_contains(documents, "def validate_document_reprocess_source", "extraction change source validation")
-    assert_contains(documents, "Only PDF documents can change extraction", "PDF-only validation message")
+    assert_contains(documents, "Only PDF and image documents can change extraction", "PDF/image validation message")
     assert_contains(documents, "def process_document_reprocess_extraction_background", "extraction change worker")
     assert_contains(documents, "delete_document_chunks(document_id", "chunk replacement before reindex")
     assert_contains(documents, "extraction_mode_override=target_mode", "forced extraction change mode")
diff --git a/functional_tests/test_document_intelligence_pdf_image_extraction_mode.py b/functional_tests/test_document_intelligence_pdf_image_extraction_mode.py
index 0ae21ad33..155f66c29 100644
--- a/functional_tests/test_document_intelligence_pdf_image_extraction_mode.py
+++ b/functional_tests/test_document_intelligence_pdf_image_extraction_mode.py
@@ -84,7 +84,10 @@ def test_document_intelligence_pdf_image_extraction_mode_contract():
     assert_contains(backend_route, 'test_extraction_mode = "layout" if extraction_mode in ("layout", "auto") else "read"', "backend Auto test mode selection")
     assert_contains(backend_route, 'model_id = "prebuilt-layout" if test_extraction_mode == "layout" else "prebuilt-read"', "backend test model selection")
     assert_contains(backend_route, 'analyze_options["output_content_format"] = "markdown"', "backend layout markdown option")
-    assert_contains(backend_route, 'extraction_mode_label = "Enhanced" if extraction_mode == "layout" else "Standard"', "backend test mode label")
+    # Enhanced is now backed by Content Understanding, so the Document Intelligence test reports
+    # Standard plus the Layout model used for Auto sampling and Enhanced fallback.
+    assert_contains(backend_route, "'Azure document intelligence Standard connection successful'", "backend Standard test message")
+    assert_contains(backend_route, "Layout model used for Auto sampling and Enhanced fallback", "backend Layout test message")
 
     assert_contains(extractor, "def extract_content_with_azure_di(file_path, extraction_mode='read', pages=None)", "extractor mode and pages parameter")
     assert_contains(extractor, "functions_settings.normalize_document_intelligence_pdf_image_extraction_mode(extraction_mode)", "extractor module-qualified mode normalizer call")
@@ -99,9 +102,9 @@ def test_document_intelligence_pdf_image_extraction_mode_contract():
     assert_contains(documents, "extraction_mode=document_intelligence_extraction_mode", "document extractor call")
     assert_contains(documents, '"mark_enhanced_citations": False', "source-only PDF/image blob persistence")
 
-    assert_contains(chat_route, "get_document_intelligence_pdf_image_extraction_mode(settings)", "chat upload mode lookup")
+    assert_contains(chat_route, "get_effective_document_intelligence_pdf_image_extraction_mode(settings)", "chat upload mode lookup")
     assert_contains(chat_route, "extraction_mode = 'layout' if is_image_file else 'read'", "chat upload Auto fallback")
-    assert_contains(smart_http_plugin, "get_document_intelligence_pdf_image_extraction_mode(settings)", "Smart HTTP PDF mode lookup")
+    assert_contains(smart_http_plugin, "get_effective_document_intelligence_pdf_image_extraction_mode(settings)", "Smart HTTP PDF mode lookup")
     assert_contains(smart_http_plugin, "if extraction_mode == 'auto':", "Smart HTTP Auto fallback guard")
 
     print("Document Intelligence PDF/image extraction mode contract passed.")
diff --git a/functional_tests/test_document_intelligence_test_button_fix.py b/functional_tests/test_document_intelligence_test_button_fix.py
index cb35e5ed7..06f24e0ef 100644
--- a/functional_tests/test_document_intelligence_test_button_fix.py
+++ b/functional_tests/test_document_intelligence_test_button_fix.py
@@ -23,7 +23,7 @@ def test_document_intelligence_test_button_api_parameters():
         app_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'application', 'single_app')
         route_file = os.path.join(app_path, 'route_backend_settings.py')
         
-        with open(route_file, 'r') as f:
+        with open(route_file, 'r', encoding='utf-8') as f:
             source_code = f.read()
         
         # Find the _test_azure_doc_intelligence_connection function
@@ -80,10 +80,10 @@ def test_consistency_with_working_implementation():
         route_file = os.path.join(app_path, 'route_backend_settings.py')
         content_file = os.path.join(app_path, 'functions_content.py')
         
-        with open(route_file, 'r') as f:
+        with open(route_file, 'r', encoding='utf-8') as f:
             test_source = f.read()
             
-        with open(content_file, 'r') as f:
+        with open(content_file, 'r', encoding='utf-8') as f:
             content_source = f.read()
         
         # Both should use the same parameter patterns for public cloud
diff --git a/functional_tests/test_legacy_doc_ole_extraction.py b/functional_tests/test_legacy_doc_ole_extraction.py
index 479a52d4f..64e321342 100644
--- a/functional_tests/test_legacy_doc_ole_extraction.py
+++ b/functional_tests/test_legacy_doc_ole_extraction.py
@@ -34,6 +34,13 @@
     "functions_documents.py",
 )
 
+SINGLE_APP_DIR = os.path.join(
+    os.path.dirname(os.path.abspath(__file__)),
+    "..",
+    "application",
+    "single_app",
+)
+
 
 def _load_functions_content_module():
     """Load functions_content with lightweight stubs for config-heavy imports."""
@@ -66,10 +73,19 @@ def _load_functions_content_module():
     sys.modules["functions_settings"] = settings_stub
     sys.modules["functions_logging"] = logging_stub
 
+    # functions_content imports functions_office_media, which only needs stdlib, PIL, and
+    # defusedxml, so it is imported for real rather than stubbed. The stubs above already sit in
+    # sys.modules and take precedence, so widening sys.path cannot pull in the Azure-heavy modules.
+    sys_path_extended = SINGLE_APP_DIR not in sys.path
+    if sys_path_extended:
+        sys.path.insert(0, SINGLE_APP_DIR)
+
     try:
         spec.loader.exec_module(module)
         return module
     finally:
+        if sys_path_extended:
+            sys.path.remove(SINGLE_APP_DIR)
         for module_key, original_module in original_modules.items():
             if original_module is None:
                 sys.modules.pop(module_key, None)
diff --git a/functional_tests/test_office_embedded_image_extraction.py b/functional_tests/test_office_embedded_image_extraction.py
new file mode 100644
index 000000000..91e042845
--- /dev/null
+++ b/functional_tests/test_office_embedded_image_extraction.py
@@ -0,0 +1,540 @@
+#!/usr/bin/env python3
+# test_office_embedded_image_extraction.py
+"""
+Functional test for embedded image extraction from Office files.
+Version: 0.250.221
+Implemented in: 0.250.221
+
+This test ensures that images embedded in DOCX and PPTX packages are pulled out for analysis,
+that decorative assets are filtered, that duplicate images are analyzed only once, and that PPTX
+images are attributed to the slide that references them.
+"""
+
+import os
+import sys
+import tempfile
+import zipfile
+from io import BytesIO
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+APP_ROOT = REPO_ROOT / "application" / "single_app"
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+sys.path.insert(0, str(APP_ROOT))
+
+from PIL import Image  # noqa: E402
+
+from functions_office_media import extract_office_embedded_images  # noqa: E402
+from test_support.versioning import assert_app_version_at_least  # noqa: E402
+
+
+def build_png_bytes(width, height, color):
+    """Build PNG bytes large enough to clear the minimum-size filter."""
+    buffer = BytesIO()
+    image = Image.new("RGB", (width, height), color)
+    # Noise keeps the encoder from compressing the image below the byte-size floor.
+    for x in range(0, width, 3):
+        for y in range(0, height, 3):
+            image.putpixel((x, y), ((x * 7) % 256, (y * 11) % 256, ((x + y) * 13) % 256))
+    image.save(buffer, format="PNG")
+    return buffer.getvalue()
+
+
+def build_docx_package(path, media_entries):
+    """Write a minimal DOCX-shaped OOXML package containing the given word/media entries."""
+    with zipfile.ZipFile(path, "w") as archive:
+        archive.writestr("[Content_Types].xml", "<Types/>")
+        archive.writestr("word/document.xml", "<document/>")
+        for media_name, media_bytes in media_entries.items():
+            archive.writestr(f"word/media/{media_name}", media_bytes)
+
+
+def build_pptx_package(path, media_entries, slide_media_map):
+    """Write a minimal PPTX-shaped OOXML package with slide relationship files."""
+    with zipfile.ZipFile(path, "w") as archive:
+        archive.writestr("[Content_Types].xml", "<Types/>")
+        for media_name, media_bytes in media_entries.items():
+            archive.writestr(f"ppt/media/{media_name}", media_bytes)
+        for slide_number, media_name in slide_media_map.items():
+            rels_xml = (
+                '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>'
+                '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">'
+                f'<Relationship Id="rId2" '
+                'Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" '
+                f'Target="../media/{media_name}"/>'
+                '</Relationships>'
+            )
+            archive.writestr(f"ppt/slides/_rels/slide{slide_number}.xml.rels", rels_xml)
+
+
+def test_docx_images_are_extracted_and_filtered():
+    """Large embedded images are extracted while icons and duplicates are skipped."""
+    print("Testing DOCX embedded image extraction and filtering...")
+
+    large_image = build_png_bytes(400, 300, (10, 120, 200))
+    another_image = build_png_bytes(500, 380, (200, 60, 30))
+    tiny_icon = build_png_bytes(24, 24, (0, 0, 0))
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        docx_path = os.path.join(work_dir, "sample.docx")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+
+        build_docx_package(
+            docx_path,
+            {
+                "image1.png": large_image,
+                "image2.png": tiny_icon,
+                "image3.png": another_image,
+                # Byte-identical duplicate of image1, e.g. a header logo repeated in the document.
+                "image4.png": large_image,
+                # Vector formats are not accepted by either analysis engine.
+                "image5.emf": b"\x01\x00\x00\x00" * 1024,
+            },
+        )
+
+        extracted = extract_office_embedded_images(docx_path, output_dir, min_pixels=150, max_images=25)
+
+    names = [item["name"] for item in extracted]
+    if names != ["image1.png", "image3.png"]:
+        raise AssertionError(f"Unexpected extracted images: {names}")
+
+    if extracted[0]["width"] != 400 or extracted[0]["height"] != 300:
+        raise AssertionError(f"Image dimensions were not reported correctly: {extracted[0]}")
+
+    print("DOCX extraction and filtering test passed!")
+    return True
+
+
+def test_extraction_respects_max_images_cap():
+    """The per-document cap limits how many embedded images are analyzed."""
+    print("Testing embedded image per-document cap...")
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        docx_path = os.path.join(work_dir, "many.docx")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+
+        media_entries = {
+            f"image{index}.png": build_png_bytes(300, 300, (index * 20 % 256, 90, 140))
+            for index in range(1, 8)
+        }
+        build_docx_package(docx_path, media_entries)
+
+        capped = extract_office_embedded_images(docx_path, output_dir, min_pixels=150, max_images=3)
+        disabled = extract_office_embedded_images(docx_path, output_dir, min_pixels=150, max_images=0)
+
+    if len(capped) != 3:
+        raise AssertionError(f"Expected the cap to limit extraction to 3 images, got {len(capped)}")
+    if disabled:
+        raise AssertionError(f"A cap of 0 should extract nothing, got {len(disabled)}")
+
+    print("Per-document cap test passed!")
+    return True
+
+
+def test_pptx_images_map_to_their_slide():
+    """PPTX images are attributed to the slide that references them."""
+    print("Testing PPTX slide attribution...")
+
+    first_image = build_png_bytes(320, 240, (12, 180, 90))
+    second_image = build_png_bytes(360, 260, (180, 30, 120))
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        pptx_path = os.path.join(work_dir, "deck.pptx")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+
+        build_pptx_package(
+            pptx_path,
+            {"image1.png": first_image, "image2.png": second_image},
+            {1: "image1.png", 4: "image2.png"},
+        )
+
+        extracted = extract_office_embedded_images(pptx_path, output_dir, min_pixels=150, max_images=25)
+
+    slide_numbers = {item["name"]: item["slide_number"] for item in extracted}
+    if slide_numbers.get("image1.png") != 1:
+        raise AssertionError(f"image1.png should map to slide 1: {slide_numbers}")
+    if slide_numbers.get("image2.png") != 4:
+        raise AssertionError(f"image2.png should map to slide 4: {slide_numbers}")
+
+    print("PPTX slide attribution test passed!")
+    return True
+
+
+def test_natural_sort_order_is_used():
+    """Embedded media is ordered naturally so image2 precedes image10."""
+    print("Testing embedded image ordering...")
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        docx_path = os.path.join(work_dir, "ordered.docx")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+
+        media_entries = {
+            f"image{index}.png": build_png_bytes(260, 260, (index * 17 % 256, 40, 200))
+            for index in (1, 2, 10, 11)
+        }
+        build_docx_package(docx_path, media_entries)
+
+        extracted = extract_office_embedded_images(docx_path, output_dir, min_pixels=150, max_images=25)
+
+    names = [item["name"] for item in extracted]
+    if names != ["image1.png", "image2.png", "image10.png", "image11.png"]:
+        raise AssertionError(f"Embedded images were not ordered naturally: {names}")
+
+    print("Ordering test passed!")
+    return True
+
+
+def test_non_ooxml_files_return_empty():
+    """Legacy and corrupt files degrade to an empty result instead of raising."""
+    print("Testing non-OOXML handling...")
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        legacy_path = os.path.join(work_dir, "legacy.doc")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+        with open(legacy_path, "wb") as legacy_file:
+            legacy_file.write(b"\xd0\xcf\x11\xe0not a zip archive")
+
+        if extract_office_embedded_images(legacy_path, output_dir):
+            raise AssertionError("Legacy OLE files should yield no embedded images.")
+
+        missing_path = os.path.join(work_dir, "does_not_exist.docx")
+        if extract_office_embedded_images(missing_path, output_dir):
+            raise AssertionError("Missing files should yield no embedded images.")
+
+    print("Non-OOXML handling test passed!")
+    return True
+
+
+def test_pipeline_wires_embedded_image_analysis():
+    """The ingestion pipeline must analyze embedded images with the active engine."""
+    print("Testing embedded image pipeline wiring...")
+
+    documents = (APP_ROOT / "functions_documents.py").read_text(encoding="utf-8")
+    settings = (APP_ROOT / "functions_settings.py").read_text(encoding="utf-8")
+
+    expectations = [
+        (documents, "def _build_office_embedded_image_chunks", "embedded image chunk builder"),
+        (documents, "def _analyze_single_embedded_image", "per-image analysis helper"),
+        (documents, "analyze_image_with_content_understanding", "Content Understanding image analysis"),
+        (documents, "extract_content_with_azure_di(image_path", "Document Intelligence image analysis"),
+        (documents, "office_embedded_image_count", "embedded image count recorded on the document"),
+        (settings, "def normalize_office_embedded_image_min_pixels", "minimum pixel normalizer"),
+        (settings, "def normalize_office_embedded_image_max_per_document", "per-document cap normalizer"),
+    ]
+
+    for content, expected_text, description in expectations:
+        if expected_text not in content:
+            raise AssertionError(f"Missing {description}: {expected_text}")
+
+    print("Pipeline wiring test passed!")
+    return True
+
+
+def test_crafted_entry_names_cannot_escape_output_directory():
+    """Zip entry names are untrusted, so extraction must never write outside the output directory."""
+    print("Testing zip path traversal defenses...")
+
+    payload = build_png_bytes(300, 300, (70, 140, 210))
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        docx_path = os.path.join(work_dir, "crafted.docx")
+        output_dir = os.path.join(work_dir, "nested", "out")
+        os.makedirs(output_dir)
+        sentinel_dir = os.path.join(work_dir, "nested")
+
+        # Both separator styles, because zip entry names are not normalized by the format.
+        with zipfile.ZipFile(docx_path, "w") as archive:
+            archive.writestr("[Content_Types].xml", "<Types/>")
+            archive.writestr("word/media/..\\..\\..\\escaped_backslash.png", payload)
+            archive.writestr("word/media/../../../escaped_forward.png", payload)
+            archive.writestr("word/media/legit.png", payload)
+
+        extracted = extract_office_embedded_images(docx_path, output_dir, min_pixels=150, max_images=25)
+
+        for item in extracted:
+            resolved = os.path.realpath(item["path"])
+            if not resolved.startswith(os.path.realpath(output_dir) + os.sep):
+                raise AssertionError(f"Extraction escaped the output directory: {resolved}")
+
+        escaped = [
+            name for name in os.listdir(sentinel_dir)
+            if name.lower().startswith("escaped")
+        ]
+        if escaped:
+            raise AssertionError(f"Files were written outside the output directory: {escaped}")
+
+        stray = [
+            name for name in os.listdir(work_dir)
+            if name.lower().startswith("escaped")
+        ]
+        if stray:
+            raise AssertionError(f"Files were written outside the output directory: {stray}")
+
+    print("Zip path traversal test passed!")
+    return True
+
+
+def test_oversized_entries_are_skipped_without_decompressing():
+    """An entry declaring an enormous decompressed size must be skipped."""
+    print("Testing decompression bomb guard...")
+
+    import functions_office_media
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        docx_path = os.path.join(work_dir, "bomb.docx")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+
+        # Highly compressible payload that expands well past the per-image ceiling.
+        bomb_payload = b"\x00" * (functions_office_media.OFFICE_EMBEDDED_IMAGE_MAX_BYTES + 1024)
+        with zipfile.ZipFile(docx_path, "w", compression=zipfile.ZIP_DEFLATED) as archive:
+            archive.writestr("[Content_Types].xml", "<Types/>")
+            archive.writestr("word/media/bomb.png", bomb_payload)
+            archive.writestr("word/media/normal.png", build_png_bytes(300, 300, (20, 200, 160)))
+
+        extracted = extract_office_embedded_images(docx_path, output_dir, min_pixels=150, max_images=25)
+
+    names = [item["name"] for item in extracted]
+    if "bomb.png" in names:
+        raise AssertionError("An oversized embedded image should have been skipped.")
+    if names != ["normal.png"]:
+        raise AssertionError(f"Expected only the normal image to survive, got {names}")
+
+    print("Decompression bomb guard test passed!")
+    return True
+
+
+def test_billion_laughs_rels_entry_is_rejected():
+    """A slide relationship part with expanding entities must not be parsed."""
+    print("Testing hardened slide relationship parsing...")
+
+    payload = build_png_bytes(300, 300, (40, 90, 170))
+    entity_bomb = (
+        '<?xml version="1.0"?>'
+        '<!DOCTYPE Relationships ['
+        '<!ENTITY a "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa">'
+        '<!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;">'
+        '<!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">'
+        '<!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">'
+        ']>'
+        '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">'
+        '<Relationship Id="rId2" Target="../media/image1.png"/>'
+        '<Relationship Id="rId3" Target="&d;"/>'
+        '</Relationships>'
+    )
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        pptx_path = os.path.join(work_dir, "bomb.pptx")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+
+        with zipfile.ZipFile(pptx_path, "w", compression=zipfile.ZIP_DEFLATED) as archive:
+            archive.writestr("[Content_Types].xml", "<Types/>")
+            archive.writestr("ppt/media/image1.png", payload)
+            archive.writestr("ppt/slides/_rels/slide1.xml.rels", entity_bomb)
+
+        # Must not raise, must not hang, and must still extract the image itself.
+        extracted = extract_office_embedded_images(pptx_path, output_dir, min_pixels=150, max_images=25)
+
+    names = [item["name"] for item in extracted]
+    if names != ["image1.png"]:
+        raise AssertionError(f"Expected the image to still be extracted, got {names}")
+    if extracted[0]["slide_number"] is not None:
+        raise AssertionError("A rejected relationship part must not produce slide attribution.")
+
+    print("Hardened relationship parsing test passed!")
+    return True
+
+
+def test_oversized_rels_entry_is_skipped():
+    """A slide relationship part larger than the cap must be skipped without decompressing."""
+    print("Testing slide relationship size cap...")
+
+    import functions_office_media
+
+    payload = build_png_bytes(300, 300, (150, 60, 60))
+    oversized_rels = (
+        '<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">'
+        '<Relationship Id="rId2" Target="../media/image1.png"/>'
+        + '<!--' + 'x' * (functions_office_media.OFFICE_EMBEDDED_RELS_MAX_BYTES + 1024) + '-->'
+        + '</Relationships>'
+    )
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        pptx_path = os.path.join(work_dir, "big_rels.pptx")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+
+        with zipfile.ZipFile(pptx_path, "w", compression=zipfile.ZIP_DEFLATED) as archive:
+            archive.writestr("[Content_Types].xml", "<Types/>")
+            archive.writestr("ppt/media/image1.png", payload)
+            archive.writestr("ppt/slides/_rels/slide1.xml.rels", oversized_rels)
+
+        extracted = extract_office_embedded_images(pptx_path, output_dir, min_pixels=150, max_images=25)
+
+    if len(extracted) != 1 or extracted[0]["slide_number"] is not None:
+        raise AssertionError(
+            f"Oversized relationship parts must be skipped without breaking extraction: {extracted}"
+        )
+
+    print("Slide relationship size cap test passed!")
+    return True
+
+
+def test_forged_declared_size_cannot_blow_memory():
+    """A zip header understating the uncompressed size must not cause a large decompression.
+
+    ``ZipInfo.file_size`` is attacker-controlled and CPython decompresses before truncating to it,
+    so a declared-size check alone is not a sound zip-bomb defense.
+    """
+    print("Testing forged declared-size defense...")
+
+    import struct
+    import tracemalloc
+
+    import functions_office_media
+
+    payload_bytes = 64 * 1024 * 1024
+    inner = BytesIO()
+    with zipfile.ZipFile(inner, "w", compression=zipfile.ZIP_DEFLATED) as archive:
+        archive.writestr("word/media/bomb.png", b"\x00" * payload_bytes)
+        archive.writestr("[Content_Types].xml", "<Types/>")
+    raw = bytearray(inner.getvalue())
+    # Understate the uncompressed size everywhere it appears.
+    raw = raw.replace(struct.pack("<I", payload_bytes), struct.pack("<I", 4096))
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        docx_path = os.path.join(work_dir, "forged.docx")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+        with open(docx_path, "wb") as forged_file:
+            forged_file.write(bytes(raw))
+
+        tracemalloc.start()
+        extracted = extract_office_embedded_images(docx_path, output_dir, min_pixels=150, max_images=25)
+        _, peak_bytes = tracemalloc.get_traced_memory()
+        tracemalloc.stop()
+
+    if extracted:
+        raise AssertionError(f"A forged archive should yield no images, got {extracted}")
+
+    peak_mib = peak_bytes / 1024 / 1024
+    # The bounded reader keeps this near the chunk size; the old declared-size check peaked ~141 MiB.
+    if peak_bytes > 8 * 1024 * 1024:
+        raise AssertionError(
+            f"Extraction decompressed too much from a forged archive: peak {peak_mib:.2f} MiB"
+        )
+
+    print(f"Forged declared-size defense test passed! (peak {peak_mib:.2f} MiB)")
+    return True
+
+
+def test_unsupported_compression_is_rejected():
+    """Only the compression methods real OOXML packages use are accepted."""
+    print("Testing compression method whitelist...")
+
+    import functions_office_media
+
+    if zipfile.ZIP_STORED not in functions_office_media.OFFICE_ZIP_ALLOWED_COMPRESSION:
+        raise AssertionError("ZIP_STORED must be allowed.")
+    if zipfile.ZIP_DEFLATED not in functions_office_media.OFFICE_ZIP_ALLOWED_COMPRESSION:
+        raise AssertionError("ZIP_DEFLATED must be allowed.")
+    if zipfile.ZIP_BZIP2 in functions_office_media.OFFICE_ZIP_ALLOWED_COMPRESSION:
+        raise AssertionError("Unusual compression methods should not be allowed.")
+
+    payload = build_png_bytes(300, 300, (90, 30, 190))
+    with tempfile.TemporaryDirectory() as work_dir:
+        docx_path = os.path.join(work_dir, "bzip.docx")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+
+        with zipfile.ZipFile(docx_path, "w") as archive:
+            archive.writestr("[Content_Types].xml", "<Types/>")
+            archive.writestr(
+                zipfile.ZipInfo("word/media/image1.png"),
+                payload,
+                compress_type=zipfile.ZIP_BZIP2,
+            )
+
+        extracted = extract_office_embedded_images(docx_path, output_dir, min_pixels=150, max_images=25)
+
+    if extracted:
+        raise AssertionError(f"Entries using an unsupported compression method must be skipped: {extracted}")
+
+    print("Compression whitelist test passed!")
+    return True
+
+
+def test_archive_entry_count_is_capped():
+    """An archive with an absurd number of entries is refused outright."""
+    print("Testing archive entry cap...")
+
+    import functions_office_media
+
+    with tempfile.TemporaryDirectory() as work_dir:
+        docx_path = os.path.join(work_dir, "many_entries.docx")
+        output_dir = os.path.join(work_dir, "out")
+        os.makedirs(output_dir)
+
+        with zipfile.ZipFile(docx_path, "w") as archive:
+            archive.writestr("[Content_Types].xml", "<Types/>")
+            archive.writestr("word/media/image1.png", build_png_bytes(300, 300, (10, 10, 200)))
+            for index in range(functions_office_media.OFFICE_ZIP_MAX_ENTRIES + 10):
+                archive.writestr(f"word/junk/{index}.txt", "x")
+
+        extracted = extract_office_embedded_images(docx_path, output_dir, min_pixels=150, max_images=25)
+
+    if extracted:
+        raise AssertionError("An archive exceeding the entry cap must be refused.")
+
+    print("Archive entry cap test passed!")
+    return True
+
+
+def test_version_is_at_least_implementation_version():
+    """The app version must be at or beyond the version this feature shipped in."""
+    print("Testing application version...")
+    assert_app_version_at_least("0.250.221")
+    print("Version test passed!")
+    return True
+
+
+if __name__ == "__main__":
+    tests = [
+        test_docx_images_are_extracted_and_filtered,
+        test_extraction_respects_max_images_cap,
+        test_pptx_images_map_to_their_slide,
+        test_natural_sort_order_is_used,
+        test_non_ooxml_files_return_empty,
+        test_crafted_entry_names_cannot_escape_output_directory,
+        test_oversized_entries_are_skipped_without_decompressing,
+        test_billion_laughs_rels_entry_is_rejected,
+        test_oversized_rels_entry_is_skipped,
+        test_forged_declared_size_cannot_blow_memory,
+        test_unsupported_compression_is_rejected,
+        test_archive_entry_count_is_capped,
+        test_pipeline_wires_embedded_image_analysis,
+        test_version_is_at_least_implementation_version,
+    ]
+
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        try:
+            results.append(test())
+        except Exception as error:
+            print(f"Test failed: {error}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(1 for result in results if result)}/{len(results)} tests passed")
+    sys.exit(0 if all(results) else 1)