diff --git a/application/single_app/admin_settings_nav.py b/application/single_app/admin_settings_nav.py
index 00dd71d46..e10f54c75 100644
--- a/application/single_app/admin_settings_nav.py
+++ b/application/single_app/admin_settings_nav.py
@@ -19,29 +19,35 @@
         "icon": "bi-palette",
         "tabs": [
             {
-                "id": "general",
-                "label": "General",
-                "icon": "bi-gear",
+                "id": "branding",
+                "label": "Branding",
+                "icon": "bi-palette",
                 "sections": [
                     {"id": "branding-section", "label": "Branding", "icon": "bi-palette"},
                     {"id": "home-page-text-section", "label": "Home Page Text", "icon": "bi-house"},
                     {"id": "appearance-section", "label": "Appearance", "icon": "bi-brush"},
-                    {"id": "health-check-section", "label": "Health Check", "icon": "bi-heart-pulse"},
-                    {"id": "swagger-section", "label": "API Documentation", "icon": "bi-file-earmark-code"},
+                ],
+            },
+            {
+                # Everything the app states to the user before or during use:
+                # banners, notices and the agreements they must accept.
+                "id": "notices",
+                "label": "Notices & Agreements",
+                "icon": "bi-megaphone",
+                "sections": [
                     {"id": "classification-banner-section", "label": "Classification Banner", "icon": "bi-shield-exclamation"},
                     {"id": "ai-notice-section", "label": "Chat AI Notice", "icon": "bi-robot"},
                     {"id": "terms-of-use-section", "label": "Terms of Use", "icon": "bi-door-open"},
-                    {"id": "support-menu-section", "label": "Support", "icon": "bi-life-preserver"},
-                    {"id": "external-links-section", "label": "External Links", "icon": "bi-box-arrow-up-right"},
-                    {"id": "system-settings-section", "label": "System Settings", "icon": "bi-gear-fill"},
+                    {"id": "user-agreement-section", "label": "User Agreement", "icon": "bi-file-earmark-check"},
                 ],
             },
             {
                 "id": "custom-pages",
-                "label": "Custom Pages",
+                "label": "Pages & Links",
                 "icon": "bi-window-plus",
                 "sections": [
                     {"id": "custom-pages-section", "label": "Static Pages", "icon": "bi-file-earmark-richtext"},
+                    {"id": "external-links-section", "label": "External Links", "icon": "bi-box-arrow-up-right"},
                 ],
             },
         ],
@@ -138,7 +144,6 @@
                     {"id": "file-sharing-section", "label": "File Sharing", "icon": "bi-share"},
                     {"id": "metadata-extraction-section", "label": "Metadata Extraction", "icon": "bi-file-earmark-code"},
                     {"id": "multimodal-vision-section", "label": "Multi-Modal Vision Analysis", "icon": "bi-eye"},
-                    {"id": "user-agreement-section", "label": "User Agreement", "icon": "bi-file-earmark-check"},
                 ],
             },
             {
@@ -189,20 +194,40 @@
         "icon": "bi-shield-lock",
         "tabs": [
             {
-                "id": "security",
-                "label": "Security",
-                "icon": "bi-shield-lock",
+                # Who can get in and what role they need. Distinct from Content
+                # Safety, which is about what may be said once you are in.
+                "id": "access-roles",
+                "label": "Access & Roles",
+                "icon": "bi-person-check",
+                "sections": [
+                    {"id": "permissions-section", "label": "Permissions", "icon": "bi-person-check"},
+                ],
+            },
+            {
+                "id": "secrets",
+                "label": "Secrets",
+                "icon": "bi-safe",
                 "sections": [
                     {"id": "keyvault-section", "label": "Key Vault", "icon": "bi-safe"},
                 ],
             },
             {
-                "id": "safety",
-                "label": "Safety",
-                "icon": "bi-shield-check",
+                "id": "content-safety",
+                "label": "Content Safety",
+                "icon": "bi-shield-exclamation",
                 "sections": [
                     {"id": "content-safety-section", "label": "Content Safety", "icon": "bi-shield-exclamation"},
-                    {"id": "permissions-section", "label": "Permissions", "icon": "bi-person-check"},
+                ],
+            },
+            {
+                # Interim home for the mixed System Settings card. Four of its
+                # eight fields are idle-timeout, which is the plurality; the
+                # rest are split out to their real homes in a later change.
+                "id": "session",
+                "label": "Session",
+                "icon": "bi-hourglass-split",
+                "sections": [
+                    {"id": "system-settings-section", "label": "System Settings", "icon": "bi-sliders"},
                 ],
             },
             {
@@ -348,12 +373,14 @@
             },
             {
                 "id": "logging",
-                "label": "Logging",
+                "label": "Logging & Health",
                 "icon": "bi-journal-text",
                 "sections": [
                     {"id": "application-insights-section", "label": "Application Insights", "icon": "bi-graph-up"},
                     {"id": "debug-logging-section", "label": "Debug Logging", "icon": "bi-bug"},
                     {"id": "file-processing-logs-section", "label": "File Process Logging", "icon": "bi-file-earmark-text"},
+                    {"id": "health-check-section", "label": "Health Check", "icon": "bi-heart-pulse"},
+                    {"id": "swagger-section", "label": "API Documentation", "icon": "bi-file-earmark-code"},
                 ],
             },
         ],
@@ -363,6 +390,16 @@
         "label": "Help",
         "icon": "bi-life-preserver",
         "tabs": [
+            {
+                # Where an admin looks first when a user needs help, ahead of
+                # raising it with the project.
+                "id": "support-menu",
+                "label": "Support Menu",
+                "icon": "bi-life-preserver",
+                "sections": [
+                    {"id": "support-menu-section", "label": "Support", "icon": "bi-life-preserver"},
+                ],
+            },
             {
                 "id": "send-feedback",
                 "label": "Send Feedback",
@@ -408,6 +445,18 @@ def get_group_for_tab(tab_id):
     return None
 
 
+def get_landing_tab_id():
+    """Return the tab an admin lands on when no tab is requested.
+
+    This is the first tab of the first group rather than a fixed id, so the
+    landing pane follows the navigation map as cards are regrouped. Latest
+    Features is pinned last precisely so it can never win this.
+    """
+    for _, tab in iter_tabs():
+        return tab["id"]
+    return None
+
+
 def get_section_ids():
     """Return every section target declared across the navigation."""
     return [
diff --git a/application/single_app/app.py b/application/single_app/app.py
index 35cc2d336..d8f837e33 100644
--- a/application/single_app/app.py
+++ b/application/single_app/app.py
@@ -31,7 +31,7 @@
 from functions_content import *
 from functions_documents import *
 from functions_latest_features_nav import should_hide_latest_features_nav
-from admin_settings_nav import ADMIN_NAV
+from admin_settings_nav import ADMIN_NAV, get_landing_tab_id
 from functions_search import *
 from functions_settings import *
 from functions_mcp_server_config import is_mcp_ui_enabled
@@ -600,6 +600,7 @@ def inject_settings():
         user_settings=user_settings,
         custom_pages_nav=custom_pages_nav,
         admin_nav=ADMIN_NAV,
+        admin_landing_tab=get_landing_tab_id(),
         latest_features_current_version=VERSION,
         latest_features_nav_hidden=latest_features_nav_hidden,
         latest_features_nav_hidden_by_development=IS_DEVELOPMENT,
diff --git a/application/single_app/config.py b/application/single_app/config.py
index 0244ed3e0..e1fb9e3b7 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -96,7 +96,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.260.012"
+VERSION = "0.260.013"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax')
diff --git a/application/single_app/static/js/admin/admin_data_management.js b/application/single_app/static/js/admin/admin_data_management.js
index 481b2069f..e8c2761a9 100644
--- a/application/single_app/static/js/admin/admin_data_management.js
+++ b/application/single_app/static/js/admin/admin_data_management.js
@@ -388,7 +388,8 @@ function bindEvents() {
         pendingDataManagementBackupDelete = null;
     });
     elements.dataManagementConfirmBackupDeleteBtn?.addEventListener("click", deleteDataManagementBackup);
-    elements.dataManagementKeyVaultLink?.addEventListener("click", openKeyVaultSettings);
+    // The Key Vault link carries data-admin-link, so admin_card_links.js
+    // resolves the owning tab from the DOM and scrolls to the card.
     elements.dataManagementCosmosEditorOpenDangerBtn?.addEventListener("click", showCosmosEditorDangerModal);
     elements.datamanagementcosmoseditordangeraccept?.addEventListener("change", updateCosmosEditorDangerAcceptState);
     elements.dataManagementCosmosEditorAcceptDangerBtn?.addEventListener("click", acceptCosmosEditorDanger);
@@ -909,20 +910,6 @@ function setKeyStorageAlert(variant, iconClass, title, message, linkText) {
     setText(elements.dataManagementKeyVaultLink, linkText);
 }
 
-function openKeyVaultSettings(event) {
-    event?.preventDefault();
-    const securityTabButton = document.getElementById("security-tab");
-    if (securityTabButton && window.bootstrap?.Tab) {
-        window.bootstrap.Tab.getOrCreateInstance(securityTabButton).show();
-    } else if (securityTabButton) {
-        securityTabButton.click();
-    }
-    window.location.hash = "security";
-    window.setTimeout(() => {
-        document.getElementById("keyvault-section")?.scrollIntoView({ block: "start", behavior: "smooth" });
-    }, 100);
-}
-
 function collectSettings() {
     const backupStorageAuthenticationType = getValue(elements.datamanagementstorageauth) || backupStorageAuthManagedIdentity;
     return {
diff --git a/application/single_app/static/js/admin/admin_sidebar_nav.js b/application/single_app/static/js/admin/admin_sidebar_nav.js
index edad020d8..706c87e5f 100644
--- a/application/single_app/static/js/admin/admin_sidebar_nav.js
+++ b/application/single_app/static/js/admin/admin_sidebar_nav.js
@@ -145,12 +145,15 @@ function initAdminSidebarNav() {
     
     // Set the initial active tab - but only if no tab is already active.
     // Latest Features is deliberately excluded so it never opens by default.
+    // The landing tab is whichever tab the nav map renders first rather than a
+    // hardcoded id, so it stays correct as the information architecture moves.
     const activeTab = document.querySelector('.admin-nav-tab.active, .admin-nav-section.active');
     if (!activeTab) {
-        const firstTab = document.querySelector('.admin-nav-tab[data-tab="general"]');
-        if (firstTab) {
+        const firstTab = document.querySelector('.admin-nav-tab[data-tab]');
+        const firstTabId = firstTab ? firstTab.getAttribute('data-tab') : null;
+        if (firstTabId) {
             firstTab.classList.add('active');
-            showAdminTab('general');
+            showAdminTab(firstTabId);
         }
     } else {
         console.log('initAdminSidebarNav - Found existing active tab, preserving current state:', activeTab.getAttribute('data-tab'));
@@ -288,6 +291,9 @@ function revealAdminGroupForTab(tabId) {
 const LEGACY_TAB_REDIRECTS = {
     'governance': 'feature-governance',
     'scale': 'redis-caching',
+    'general': 'branding',
+    'safety': 'access-roles',
+    'security': 'secrets',
 };
 
 function resolveAdminTabId(tabId) {
diff --git a/application/single_app/templates/admin/_panes/access-roles.html b/application/single_app/templates/admin/_panes/access-roles.html
new file mode 100644
index 000000000..3e93d9ff7
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/access-roles.html
@@ -0,0 +1,49 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'access-roles' %} show active{% endif %}" id="access-roles" role="tabpanel" aria-labelledby="access-roles-tab">
+                <div class="card p-3 mb-3" id="permissions-section"
+                    data-requires="enable_user_feedback"
+                    data-requires-label="User Feedback"
+                    data-requires-target="user-feedback-section"
+                    data-requires-scope="#require_member_of_feedback_admin"
+                    data-requires-description="The FeedbackAdmin role only controls access to the User Feedback report, so it does nothing until User Feedback is enabled.">
+                    <h5>
+                        <i class="bi bi-person-check me-2"></i>Permissions
+                    </h5>
+                    <p class="text-muted">Control which users can access specific administrative views related to safety and feedback.</p>
+
+
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_safety_violation_admin"
+                            name="require_member_of_safety_violation_admin"
+                            {% if settings.require_member_of_safety_violation_admin %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_member_of_safety_violation_admin">
+                            Require SafetyViolationAdmin App Role
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the SafetyViolationAdmin Enterprise App role can access safety violation reports."></i>
+                    </div>
+                     <p class="text-muted small mb-3">
+                        Required app role value: <code>SafetyViolationAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the Safety Violations admin page.
+                    </p>
+
+
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_feedback_admin"
+                            name="require_member_of_feedback_admin"
+                            {% if settings.require_member_of_feedback_admin %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_member_of_feedback_admin">
+                            Require FeedbackAdmin App Role
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the FeedbackAdmin Enterprise App role can access user feedback reports."></i>
+                    </div>
+                     <p class="text-muted small mb-0">
+                        Required app role value: <code>FeedbackAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the User Feedback admin page. Requires <strong>Enable User Feedback</strong> to be active.
+                    </p>
+                </div>
+
+
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/agents.html b/application/single_app/templates/admin/_panes/agents.html
index 5994976d2..622dde43d 100644
--- a/application/single_app/templates/admin/_panes/agents.html
+++ b/application/single_app/templates/admin/_panes/agents.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="agents" role="tabpanel" aria-labelledby="agents-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'agents' %} show active{% endif %}" id="agents" role="tabpanel" aria-labelledby="agents-tab">
 
                 <p class="text-muted">
                     Configure AI agents and actions for enhanced functionality. Agents provide AI-driven task automation while Actions extend functionality with custom tools and integrations.
diff --git a/application/single_app/templates/admin/_panes/ai-models.html b/application/single_app/templates/admin/_panes/ai-models.html
index f12b06236..75437fded 100644
--- a/application/single_app/templates/admin/_panes/ai-models.html
+++ b/application/single_app/templates/admin/_panes/ai-models.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="ai-models" role="tabpanel" aria-labelledby="ai-models-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'ai-models' %} show active{% endif %}" id="ai-models" role="tabpanel" aria-labelledby="ai-models-tab">
 
                 <p class="text-muted">
                     Configure all AI model settings including GPT for text generation, embeddings for semantic search, and image generation capabilities.
diff --git a/application/single_app/templates/admin/_panes/archiving.html b/application/single_app/templates/admin/_panes/archiving.html
index 0d56b6223..d2943f47d 100644
--- a/application/single_app/templates/admin/_panes/archiving.html
+++ b/application/single_app/templates/admin/_panes/archiving.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="archiving" role="tabpanel" aria-labelledby="archiving-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'archiving' %} show active{% endif %}" id="archiving" role="tabpanel" aria-labelledby="archiving-tab">
                 <div class="card p-3 mb-3" id="conversation-archiving-section">
                     <h5>
                         <i class="bi bi-archive me-2"></i>Conversation Archiving
diff --git a/application/single_app/templates/admin/_panes/branding.html b/application/single_app/templates/admin/_panes/branding.html
new file mode 100644
index 000000000..c648c07fa
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/branding.html
@@ -0,0 +1,165 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'branding' %} show active{% endif %}" id="branding" role="tabpanel" aria-labelledby="branding-tab">
+
+                 <p class="text-muted">
+                    Configure general application settings, including the application's title, logo, and landing page text.
+                </p>
+                <div class="card p-3 mb-3" id="branding-section">
+                    <h5>
+                        <i class="bi bi-palette me-2"></i>Branding
+                    </h5>
+                    <p class="text-muted small">
+                        Configure your application's title, logo, and branding elements.
+                    </p>
+                    <div class="mb-3">
+                        <label for="app_title" class="form-label">Application Title</label>
+                        <input type="text" class="form-control" id="app_title" name="app_title" value="{{ settings.app_title }}">
+                    </div>
+                    <h6 class="mt-3">Logo Settings</h6>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox" class="form-check-input" id="show_logo" name="show_logo"
+                            {% if settings.show_logo %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="show_logo">Show Logo</label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display the application logo in the header and navigation areas of the interface."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox" class="form-check-input" id="hide_app_title" name="hide_app_title"
+                            {% if settings.hide_app_title %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="hide_app_title">Hide Application Title</label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Hide the application title from the header and navigation, showing only the logo if enabled."></i>
+                    </div>
+                    <div class="form-group mb-3">
+                        <div class="d-flex justify-content-between align-items-center">
+                            <label for="landing_page_logo_scale_percent" class="form-label mb-0">Main Page Logo Size</label>
+                            <span id="landing-page-logo-scale-value" class="small text-muted fw-semibold">{{ settings.landing_page_logo_scale_percent | default(100) }}%</span>
+                        </div>
+                        <input
+                            type="range"
+                            class="form-range"
+                            id="landing_page_logo_scale_percent"
+                            name="landing_page_logo_scale_percent"
+                            min="50"
+                            max="500"
+                            step="10"
+                            value="{{ settings.landing_page_logo_scale_percent | default(100) }}"
+                            aria-describedby="landing-page-logo-scale-help"
+                        />
+                        <div class="d-flex justify-content-between small text-muted">
+                            <span>50%</span>
+                            <span>500%</span>
+                        </div>
+                        <small id="landing-page-logo-scale-help" class="form-text text-muted">
+                            Adjust the logo size on the home page only. This does not change the logo size in the top or sidebar navigation.
+                        </small>
+                    </div>
+                    <div class="form-group mb-3">
+                        <label for="logo_file">Upload Custom Logo (Light Mode)</label>
+                        <input type="file" class="form-control" name="logo_file" id="logo_file" accept=".png,.jpg,.jpeg">
+                        <small class="form-text text-muted">This logo will be displayed in light mode and stored at up to 500px tall so the main page can render it sharply without keeping oversized assets in settings.</small>
+                    </div>
+                    <div class="form-group mb-3">
+                        <label for="logo_dark_file">Upload Custom Logo (Dark Mode)</label>
+                        <input type="file" class="form-control" name="logo_dark_file" id="logo_dark_file" accept=".png,.jpg,.jpeg">
+                        <small class="form-text text-muted">This logo will be displayed in dark mode. If not provided, the light mode logo will be used in both themes. Dark logos are also stored at up to 500px tall.</small>
+                    </div>
+                    <div class="form-group mb-3">
+                        <label for="favicon_file">Upload Custom Favicon</label>
+                        <input type="file" class="form-control" name="favicon_file" id="favicon_file" accept=".png,.jpg,.jpeg,.ico">
+                        <small class="form-text text-muted">Recommended: 16x16 or 32x32 pixel png or jpg or ico.</small>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="home-page-text-section">
+                    <h5>
+                        <i class="bi bi-house me-2"></i>Home Page Text
+                    </h5>
+                    <p class="text-muted small">Configure the text content displayed on your application's home page using Markdown formatting.</p>
+
+                    <div class="mb-3">
+                        <label for="landing_page_alignment" class="form-label">Markdown Alignment</label>
+                        <select class="form-select" id="landing_page_alignment" name="landing_page_alignment">
+                            <option value="left" {% if settings.landing_page_alignment == "left" or not settings.landing_page_alignment %}selected{% endif %}>Left</option>
+                            <option value="center" {% if settings.landing_page_alignment == "center" %}selected{% endif %}>Center</option>
+                            <option value="right" {% if settings.landing_page_alignment == "right" %}selected{% endif %}>Right</option>
+                        </select>
+                        <small class="form-text text-muted">Choose how the landing page markdown is aligned on the home page.</small>
+                    </div>
+
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="toggleLandingPageEditor"
+                            name="enable_landing_page_editor"
+                            {% if settings.enable_landing_page_editor %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="toggleLandingPageEditor">
+                            Enable Markdown Editor
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the markdown editor for editing landing page content, otherwise text will be displayed as read-only preview."></i>
+                    </div>
+
+                    <div id="landingPageEditorContainer" style="display: none;">
+                        <textarea
+                            class="form-control"
+                            id="landing_page_text_editor"
+                            name="landing_page_text"
+                            rows="5"
+                        >{{ settings.landing_page_text }}</textarea>
+                    </div>
+
+                    <div
+                        id="landingPageMarkdownPreview"
+                        class="p-2 border rounded"
+                        style="white-space: pre-wrap; display: none;"
+                    ></div>
+                </div>
+
+                <div class="card p-3 mb-3" id="appearance-section">
+                    <h5>
+                        <i class="bi bi-brush me-2"></i>Appearance
+                    </h5>
+                    <p class="text-muted small">Configure the app appearance and theme settings.</p>
+
+                    <div class="mb-3">
+                        <label class="form-label">Default Theme</label>
+                        <div class="form-group form-check form-switch mb-3">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="enable_dark_mode_default"
+                                name="enable_dark_mode_default"
+                                {% if settings.enable_dark_mode_default %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="enable_dark_mode_default">
+                                Enable Dark Mode by Default
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Set dark mode as the default theme for new users. Users can still toggle between themes individually."></i>
+                        </div>
+                        <p class="text-muted small">Users can still toggle dark mode individually from the navigation bar.</p>
+                    </div>
+
+                    <div class="mb-3">
+                        <label class="form-label">Default Navigation</label>
+                        <div class="form-group form-check form-switch mb-3">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="enable_left_nav_default"
+                                name="enable_left_nav_default"
+                                {% if settings.enable_left_nav_default %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="enable_left_nav_default">
+                                Enable Left Nav by Default
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show the left navigation sidebar by default for new users. Users can still toggle the sidebar visibility individually."></i>
+                        </div>
+                        <p class="text-muted small">Users can still toggle the left navigation sidebar individually from the header.</p>
+                    </div>
+                </div>
+
+
+
+
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/chat-experience.html b/application/single_app/templates/admin/_panes/chat-experience.html
index 223e1beb0..37d8033a6 100644
--- a/application/single_app/templates/admin/_panes/chat-experience.html
+++ b/application/single_app/templates/admin/_panes/chat-experience.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="chat-experience" role="tabpanel" aria-labelledby="chat-experience-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'chat-experience' %} show active{% endif %}" id="chat-experience" role="tabpanel" aria-labelledby="chat-experience-tab">
                 <div class="card p-3 mb-4" id="processing-thoughts-section">
                     <h5>
                         <i class="bi bi-stars me-2"></i>Processing Thoughts
diff --git a/application/single_app/templates/admin/_panes/citation.html b/application/single_app/templates/admin/_panes/citation.html
index 94f9788e1..4d42286e9 100644
--- a/application/single_app/templates/admin/_panes/citation.html
+++ b/application/single_app/templates/admin/_panes/citation.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="citation" role="tabpanel" aria-labelledby="citation-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'citation' %} show active{% endif %}" id="citation" role="tabpanel" aria-labelledby="citation-tab">
 
                  <p class="text-muted">
                     Configure standard and enhanced citations features for your and group workspaces.
diff --git a/application/single_app/templates/admin/_panes/classification.html b/application/single_app/templates/admin/_panes/classification.html
index 597736e46..425eeedcf 100644
--- a/application/single_app/templates/admin/_panes/classification.html
+++ b/application/single_app/templates/admin/_panes/classification.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="classification" role="tabpanel" aria-labelledby="classification-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'classification' %} show active{% endif %}" id="classification" role="tabpanel" aria-labelledby="classification-tab">
                 <div class="card mb-3 p-3" id="document-classification-section">
                     <h5>
                         <i class="bi bi-tags me-2"></i>Document Classification
diff --git a/application/single_app/templates/admin/_panes/safety.html b/application/single_app/templates/admin/_panes/content-safety.html
similarity index 75%
rename from application/single_app/templates/admin/_panes/safety.html
rename to application/single_app/templates/admin/_panes/content-safety.html
index c4973acdb..88eae95bb 100644
--- a/application/single_app/templates/admin/_panes/safety.html
+++ b/application/single_app/templates/admin/_panes/content-safety.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="safety" role="tabpanel" aria-labelledby="safety-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'content-safety' %} show active{% endif %}" id="content-safety" role="tabpanel" aria-labelledby="content-safety-tab">
 
                  <p class="text-muted">
                     Configure content safety, archiving, and user feedback settings. If Content Safety is enabled, user
@@ -174,49 +174,6 @@ <h5>
 
 
 
-                <div class="card p-3 mb-3" id="permissions-section"
-                    data-requires="enable_user_feedback"
-                    data-requires-label="User Feedback"
-                    data-requires-target="user-feedback-section"
-                    data-requires-scope="#require_member_of_feedback_admin"
-                    data-requires-description="The FeedbackAdmin role only controls access to the User Feedback report, so it does nothing until User Feedback is enabled.">
-                    <h5>
-                        <i class="bi bi-person-check me-2"></i>Permissions
-                    </h5>
-                    <p class="text-muted">Control which users can access specific administrative views related to safety and feedback.</p>
-
-
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_safety_violation_admin"
-                            name="require_member_of_safety_violation_admin"
-                            {% if settings.require_member_of_safety_violation_admin %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_member_of_safety_violation_admin">
-                            Require SafetyViolationAdmin App Role
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the SafetyViolationAdmin Enterprise App role can access safety violation reports."></i>
-                    </div>
-                     <p class="text-muted small mb-3">
-                        Required app role value: <code>SafetyViolationAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the Safety Violations admin page.
-                    </p>
-
-
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_feedback_admin"
-                            name="require_member_of_feedback_admin"
-                            {% if settings.require_member_of_feedback_admin %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_member_of_feedback_admin">
-                            Require FeedbackAdmin App Role
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the FeedbackAdmin Enterprise App role can access user feedback reports."></i>
-                    </div>
-                     <p class="text-muted small mb-0">
-                        Required app role value: <code>FeedbackAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the User Feedback admin page. Requires <strong>Enable User Feedback</strong> to be active.
-                    </p>
-                </div>
 
 
 
diff --git a/application/single_app/templates/admin/_panes/control-center-config.html b/application/single_app/templates/admin/_panes/control-center-config.html
index dd2143276..6567e5537 100644
--- a/application/single_app/templates/admin/_panes/control-center-config.html
+++ b/application/single_app/templates/admin/_panes/control-center-config.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="control-center-config" role="tabpanel" aria-labelledby="control-center-config-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'control-center-config' %} show active{% endif %}" id="control-center-config" role="tabpanel" aria-labelledby="control-center-config-tab">
                 <p class="text-muted">
                     Configure Control Center access and permissions for administrators.
                 </p>
diff --git a/application/single_app/templates/admin/_panes/cosmos.html b/application/single_app/templates/admin/_panes/cosmos.html
index 9d1fa89ca..33cf6b0f3 100644
--- a/application/single_app/templates/admin/_panes/cosmos.html
+++ b/application/single_app/templates/admin/_panes/cosmos.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="cosmos" role="tabpanel" aria-labelledby="cosmos-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'cosmos' %} show active{% endif %}" id="cosmos" role="tabpanel" aria-labelledby="cosmos-tab">
                 <div class="card p-3 mb-3" id="document-access-index-section" data-testid="document-access-index-section">
                     <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
                         <div>
diff --git a/application/single_app/templates/admin/_panes/custom-pages.html b/application/single_app/templates/admin/_panes/custom-pages.html
index a3d0f32ef..00fc68987 100644
--- a/application/single_app/templates/admin/_panes/custom-pages.html
+++ b/application/single_app/templates/admin/_panes/custom-pages.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="custom-pages" role="tabpanel" aria-labelledby="custom-pages-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'custom-pages' %} show active{% endif %}" id="custom-pages" role="tabpanel" aria-labelledby="custom-pages-tab">
                 <p class="text-muted">
                     Enable trusted deployment-time custom pages and manage metadata for simple static pages served from the application custom_pages folders.
                 </p>
@@ -78,4 +78,56 @@ <h6 class="mb-1">Static Page Metadata</h6>
                         </div>
                     </div>
                 </div>
+                <div class="card p-3 mb-3" id="external-links-section">
+                    <h5>
+                        <i class="bi bi-box-arrow-up-right me-2"></i>External Links
+                    </h5>
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" id="enable_external_links" name="enable_external_links"
+                            {% if settings.enable_external_links %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_external_links">
+                            Enable External Links in Navigation
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a menu of external links in the navigation bar for quick access to external resources and websites."></i>
+                    </div>
+                    <p class="text-muted small">When enabled, external links will be displayed in the navigation bar for easy access to external resources.</p>
+
+                    <div id="external_links_settings" {% if not settings.enable_external_links %}style="display: none;"{% endif %}>
+                        <div class="mb-3">
+                            <label for="external_links_menu_name" class="form-label">Menu Name</label>
+                            <input type="text" class="form-control" id="external_links_menu_name" name="external_links_menu_name"
+                                   value="{{ settings.external_links_menu_name or 'External Links' }}" placeholder="External Links">
+                            <small class="form-text text-muted">This name will appear in the navigation bar as the menu title.</small>
+                        </div>
+
+                        <div class="form-check form-switch mb-3">
+                            <input class="form-check-input" type="checkbox" id="external_links_force_menu" name="external_links_force_menu"
+                                {% if settings.external_links_force_menu %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="external_links_force_menu">
+                                Force Menu Display
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Always show external links as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu."></i>
+                            <small class="form-text text-muted d-block">When enabled, external links will always display as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu.</small>
+                        </div>
+
+                        <h6>External Links</h6>
+                        <p class="text-muted small">Define custom links that will appear in the navigation bar for users to access external resources.</p>
+
+                        <table class="table table-sm table-bordered">
+                            <thead>
+                                <tr>
+                                    <th>Label</th>
+                                    <th>URL</th>
+                                    <th>Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="external-links-tbody">
+                                <!-- Populated by JavaScript -->
+                            </tbody>
+                        </table>
+
+                        <button type="button" class="btn btn-sm btn-outline-primary" id="add-external-link-btn">Add New Link</button>
+                        <input type="hidden" name="external_links_json" id="external_links_json">
+                    </div>
+                </div>
             </div>
diff --git a/application/single_app/templates/admin/_panes/data-management.html b/application/single_app/templates/admin/_panes/data-management.html
index aba966397..d99c04990 100644
--- a/application/single_app/templates/admin/_panes/data-management.html
+++ b/application/single_app/templates/admin/_panes/data-management.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="data-management" role="tabpanel" aria-labelledby="data-management-tab" data-testid="data-management-tab-pane" data-ignore-settings-change="true">
+            <div class="tab-pane fade{% if admin_landing_tab == 'data-management' %} show active{% endif %}" id="data-management" role="tabpanel" aria-labelledby="data-management-tab" data-testid="data-management-tab-pane" data-ignore-settings-change="true">
                 <div class="d-flex align-items-center justify-content-between gap-3 mb-2">
                     <div>
                         <h3 class="mb-1">Backup, Migrate &amp; Restore</h3>
@@ -241,7 +241,7 @@ <h5 class="mb-1">Encryption</h5>
                             <div>
                                 <div class="fw-semibold" id="data-management-key-storage-alert-title">Key Vault is strongly recommended</div>
                                 <div class="small" id="data-management-key-storage-alert-message">Generated backup encryption keys are stored in the Data Management settings document when Key Vault is not enabled.</div>
-                                <a href="#security" id="data-management-key-vault-link">Open Key Vault settings</a>
+                                <a href="#keyvault-section" data-admin-link="keyvault-section" id="data-management-key-vault-link">Open Key Vault settings</a>
                             </div>
                         </div>
                     </div>
diff --git a/application/single_app/templates/admin/_panes/feature-governance.html b/application/single_app/templates/admin/_panes/feature-governance.html
index d0f153d74..0b7dcfed1 100644
--- a/application/single_app/templates/admin/_panes/feature-governance.html
+++ b/application/single_app/templates/admin/_panes/feature-governance.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="feature-governance" role="tabpanel" aria-labelledby="feature-governance-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'feature-governance' %} show active{% endif %}" id="feature-governance" role="tabpanel" aria-labelledby="feature-governance-tab">
                 <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-2 mb-3">
                     <p class="text-muted mb-0">
                         Configure governance enforcement for endpoint, agent, and action creation or usage. Governance is disabled by default and only enforced when toggled on.
diff --git a/application/single_app/templates/admin/_panes/feedback-alerts.html b/application/single_app/templates/admin/_panes/feedback-alerts.html
index 4ee6ae562..5488e7242 100644
--- a/application/single_app/templates/admin/_panes/feedback-alerts.html
+++ b/application/single_app/templates/admin/_panes/feedback-alerts.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="feedback-alerts" role="tabpanel" aria-labelledby="feedback-alerts-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'feedback-alerts' %} show active{% endif %}" id="feedback-alerts" role="tabpanel" aria-labelledby="feedback-alerts-tab">
                 <div class="card p-3 mb-3" id="user-feedback-section">
                     <h5>
                         <i class="bi bi-chat-square-heart me-2"></i>User Feedback
diff --git a/application/single_app/templates/admin/_panes/file-sync.html b/application/single_app/templates/admin/_panes/file-sync.html
index 2d56920d2..eb440758a 100644
--- a/application/single_app/templates/admin/_panes/file-sync.html
+++ b/application/single_app/templates/admin/_panes/file-sync.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="file-sync" role="tabpanel" aria-labelledby="file-sync-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'file-sync' %} show active{% endif %}" id="file-sync" role="tabpanel" aria-labelledby="file-sync-tab">
                 <p class="text-muted">
                     Configure file synchronization for personal, group, and public workspaces.
                 </p>
diff --git a/application/single_app/templates/admin/_panes/general.html b/application/single_app/templates/admin/_panes/general.html
deleted file mode 100644
index bd3d5be40..000000000
--- a/application/single_app/templates/admin/_panes/general.html
+++ /dev/null
@@ -1,682 +0,0 @@
-            <div class="tab-pane fade show active" id="general" role="tabpanel" aria-labelledby="general-tab">
-
-                 <p class="text-muted">
-                    Configure general application settings, including the application's title, logo, and landing page text.
-                </p>
-                <div class="card p-3 mb-3" id="branding-section">
-                    <h5>
-                        <i class="bi bi-palette me-2"></i>Branding
-                    </h5>
-                    <p class="text-muted small">
-                        Configure your application's title, logo, and branding elements.
-                    </p>
-                    <div class="mb-3">
-                        <label for="app_title" class="form-label">Application Title</label>
-                        <input type="text" class="form-control" id="app_title" name="app_title" value="{{ settings.app_title }}">
-                    </div>
-                    <h6 class="mt-3">Logo Settings</h6>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox" class="form-check-input" id="show_logo" name="show_logo"
-                            {% if settings.show_logo %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="show_logo">Show Logo</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display the application logo in the header and navigation areas of the interface."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox" class="form-check-input" id="hide_app_title" name="hide_app_title"
-                            {% if settings.hide_app_title %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="hide_app_title">Hide Application Title</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Hide the application title from the header and navigation, showing only the logo if enabled."></i>
-                    </div>
-                    <div class="form-group mb-3">
-                        <div class="d-flex justify-content-between align-items-center">
-                            <label for="landing_page_logo_scale_percent" class="form-label mb-0">Main Page Logo Size</label>
-                            <span id="landing-page-logo-scale-value" class="small text-muted fw-semibold">{{ settings.landing_page_logo_scale_percent | default(100) }}%</span>
-                        </div>
-                        <input
-                            type="range"
-                            class="form-range"
-                            id="landing_page_logo_scale_percent"
-                            name="landing_page_logo_scale_percent"
-                            min="50"
-                            max="500"
-                            step="10"
-                            value="{{ settings.landing_page_logo_scale_percent | default(100) }}"
-                            aria-describedby="landing-page-logo-scale-help"
-                        />
-                        <div class="d-flex justify-content-between small text-muted">
-                            <span>50%</span>
-                            <span>500%</span>
-                        </div>
-                        <small id="landing-page-logo-scale-help" class="form-text text-muted">
-                            Adjust the logo size on the home page only. This does not change the logo size in the top or sidebar navigation.
-                        </small>
-                    </div>
-                    <div class="form-group mb-3">
-                        <label for="logo_file">Upload Custom Logo (Light Mode)</label>
-                        <input type="file" class="form-control" name="logo_file" id="logo_file" accept=".png,.jpg,.jpeg">
-                        <small class="form-text text-muted">This logo will be displayed in light mode and stored at up to 500px tall so the main page can render it sharply without keeping oversized assets in settings.</small>
-                    </div>
-                    <div class="form-group mb-3">
-                        <label for="logo_dark_file">Upload Custom Logo (Dark Mode)</label>
-                        <input type="file" class="form-control" name="logo_dark_file" id="logo_dark_file" accept=".png,.jpg,.jpeg">
-                        <small class="form-text text-muted">This logo will be displayed in dark mode. If not provided, the light mode logo will be used in both themes. Dark logos are also stored at up to 500px tall.</small>
-                    </div>
-                    <div class="form-group mb-3">
-                        <label for="favicon_file">Upload Custom Favicon</label>
-                        <input type="file" class="form-control" name="favicon_file" id="favicon_file" accept=".png,.jpg,.jpeg,.ico">
-                        <small class="form-text text-muted">Recommended: 16x16 or 32x32 pixel png or jpg or ico.</small>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="home-page-text-section">
-                    <h5>
-                        <i class="bi bi-house me-2"></i>Home Page Text
-                    </h5>
-                    <p class="text-muted small">Configure the text content displayed on your application's home page using Markdown formatting.</p>
-
-                    <div class="mb-3">
-                        <label for="landing_page_alignment" class="form-label">Markdown Alignment</label>
-                        <select class="form-select" id="landing_page_alignment" name="landing_page_alignment">
-                            <option value="left" {% if settings.landing_page_alignment == "left" or not settings.landing_page_alignment %}selected{% endif %}>Left</option>
-                            <option value="center" {% if settings.landing_page_alignment == "center" %}selected{% endif %}>Center</option>
-                            <option value="right" {% if settings.landing_page_alignment == "right" %}selected{% endif %}>Right</option>
-                        </select>
-                        <small class="form-text text-muted">Choose how the landing page markdown is aligned on the home page.</small>
-                    </div>
-
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="toggleLandingPageEditor"
-                            name="enable_landing_page_editor"
-                            {% if settings.enable_landing_page_editor %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="toggleLandingPageEditor">
-                            Enable Markdown Editor
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the markdown editor for editing landing page content, otherwise text will be displayed as read-only preview."></i>
-                    </div>
-
-                    <div id="landingPageEditorContainer" style="display: none;">
-                        <textarea
-                            class="form-control"
-                            id="landing_page_text_editor"
-                            name="landing_page_text"
-                            rows="5"
-                        >{{ settings.landing_page_text }}</textarea>
-                    </div>
-
-                    <div
-                        id="landingPageMarkdownPreview"
-                        class="p-2 border rounded"
-                        style="white-space: pre-wrap; display: none;"
-                    ></div>
-                </div>
-
-                <div class="card p-3 mb-3" id="appearance-section">
-                    <h5>
-                        <i class="bi bi-brush me-2"></i>Appearance
-                    </h5>
-                    <p class="text-muted small">Configure the app appearance and theme settings.</p>
-
-                    <div class="mb-3">
-                        <label class="form-label">Default Theme</label>
-                        <div class="form-group form-check form-switch mb-3">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="enable_dark_mode_default"
-                                name="enable_dark_mode_default"
-                                {% if settings.enable_dark_mode_default %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="enable_dark_mode_default">
-                                Enable Dark Mode by Default
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Set dark mode as the default theme for new users. Users can still toggle between themes individually."></i>
-                        </div>
-                        <p class="text-muted small">Users can still toggle dark mode individually from the navigation bar.</p>
-                    </div>
-
-                    <div class="mb-3">
-                        <label class="form-label">Default Navigation</label>
-                        <div class="form-group form-check form-switch mb-3">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="enable_left_nav_default"
-                                name="enable_left_nav_default"
-                                {% if settings.enable_left_nav_default %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="enable_left_nav_default">
-                                Enable Left Nav by Default
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show the left navigation sidebar by default for new users. Users can still toggle the sidebar visibility individually."></i>
-                        </div>
-                        <p class="text-muted small">Users can still toggle the left navigation sidebar individually from the header.</p>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="health-check-section">
-                    <div class="d-flex justify-content-between align-items-center mb-2">
-                        <h5 class="mb-0">
-                            <i class="bi bi-heart-pulse me-2"></i>Health Check
-                        </h5>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#healthCheckInfoModal">
-                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
-                        </button>
-                    </div>
-                    <p class="text-muted mb-3">Configure health check endpoint for external monitoring systems.</p>
-
-                    <div class="row g-3">
-                        <div class="col-lg-6">
-                            <div class="border rounded p-3 h-100 bg-body-tertiary-subtle">
-                                <div class="d-flex align-items-start justify-content-between gap-2">
-                                    <div>
-                                        <h6 class="mb-1">Authenticated Endpoint</h6>
-                                        <p class="text-muted small mb-0">Use when your monitoring system can reach a protected route and you want the endpoint governed by the normal app access boundary.</p>
-                                    </div>
-                                    <span class="badge text-bg-primary">Protected</span>
-                                </div>
-                                <div class="form-check form-switch mt-3 mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="enable_external_healthcheck"
-                                        name="enable_external_healthcheck"
-                                        {% if settings.enable_external_healthcheck %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="enable_external_healthcheck">
-                                        Enable /external/healthcheck
-                                    </label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the authenticated /external/healthcheck endpoint for external monitoring systems."></i>
-                                </div>
-                                <p class="text-muted small mb-0">Best for internal monitors or diagnostics tooling that already authenticates to the application.</p>
-                            </div>
-                        </div>
-                        <div class="col-lg-6">
-                            <div class="border rounded p-3 h-100 border-warning-subtle bg-warning-subtle">
-                                <div class="d-flex align-items-start justify-content-between gap-2">
-                                    <div>
-                                        <h6 class="mb-1">Unauthenticated Endpoint</h6>
-                                        <p class="text-muted small mb-0">Use when a platform health probe cannot sign in and only needs a lightweight availability response.</p>
-                                    </div>
-                                    <span class="badge text-bg-warning">No Auth</span>
-                                </div>
-                                <div class="form-check form-switch mt-3 mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="enable_no_auth_external_healthcheck"
-                                        name="enable_no_auth_external_healthcheck"
-                                        {% if settings.enable_no_auth_external_healthcheck %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="enable_no_auth_external_healthcheck">
-                                        Enable /external/healthcheckz
-                                    </label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the unauthenticated /external/healthcheckz endpoint for probes that cannot authenticate."></i>
-                                </div>
-                                <div class="alert alert-warning small mb-0" role="alert">
-                                    <strong>Security note:</strong> This route is intentionally unauthenticated. Only enable it for trusted health probes or controlled network paths.
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="swagger-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0">
-                            <i class="bi bi-file-earmark-code me-2"></i>API Documentation
-                        </h5>
-                        <div class="btn-group" role="group">
-                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#swaggerInfoModal">
-                                <i class="bi bi-info-circle me-1"></i>Why Enable Swagger?
-                            </button>
-                            <a href="/swagger" class="btn btn-primary btn-sm" target="_blank">
-                                <i class="bi bi-box-arrow-up-right me-1"></i>Open Swagger UI
-                            </a>
-                        </div>
-                    </div>
-                    <p class="text-muted mb-3">Configure automatic OpenAPI/Swagger documentation for API endpoints.</p>
-
-                    <div class="form-check form-switch mb-2">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_swagger"
-                            name="enable_swagger"
-                            {% if settings.enable_swagger %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_swagger">
-                            Enable Swagger/OpenAPI Documentation (/swagger)
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable automatic API documentation with Swagger UI interface for testing and exploring endpoints."></i>
-                    </div>
-                    <p class="text-muted small mb-0">
-                        Provides interactive API documentation, endpoint testing, and schema validation.
-                        Useful for developers, API integration, and system troubleshooting.
-                    </p>
-                </div>
-
-                <div class="card p-3 mb-3" id="classification-banner-section">
-                    <h5>
-                        <i class="bi bi-shield-exclamation me-2"></i>Classification Banner
-                    </h5>
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" id="classification_banner_enabled" name="classification_banner_enabled"
-                            {% if settings.classification_banner_enabled %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="classification_banner_enabled">
-                            Enable Classification Banner
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a security classification banner at the top of every page to indicate data sensitivity level."></i>
-                    </div>
-                    <div class="mb-2">
-                        <label for="classification_banner_text" class="form-label">Banner Text</label>
-                        <input type="text" class="form-control" id="classification_banner_text" name="classification_banner_text"
-                            value="{{ settings.classification_banner_text }}">
-                    </div>
-                    <div class="mb-2">
-                        <label for="classification_banner_color" class="form-label">Banner Color</label>
-                        <input type="color" class="form-control form-control-color" id="classification_banner_color" name="classification_banner_color"
-                            value="{{ settings.classification_banner_color or '#ffc107' }}" style="width: 3rem; height: 2rem;">
-                    </div>
-                    <div class="mb-2">
-                        <label for="classification_banner_text_color" class="form-label">Banner Text Color</label>
-                        <input type="color" class="form-control form-control-color" id="classification_banner_text_color" name="classification_banner_text_color"
-                            value="{{ settings.classification_banner_text_color or '#ffffff' }}" style="width: 3rem; height: 2rem;">
-                    </div>
-                    <div class="mb-2">
-                        <span id="classification-banner-preview"
-                              style="display:inline-block; padding:0.5em 1em; border-radius:0.3em; font-weight:bold; color:{{ settings.classification_banner_text_color or '#ffffff' }}; background:{{ settings.classification_banner_color or '#ffc107' }};">
-                            {{ settings.classification_banner_text or 'Banner Preview' }}
-                        </span>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="ai-notice-section">
-                    <h5>
-                        <i class="bi bi-robot me-2"></i>Chat AI Notice
-                    </h5>
-                    <p class="text-muted small">
-                        Display an administrator-provided reminder directly below the chat input, such as guidance that responses are AI-generated and should be reviewed.
-                    </p>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="enable_ai_notice"
-                            name="enable_ai_notice"
-                            {% if settings.enable_ai_notice %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_ai_notice">
-                            Show a custom AI notice below the chat input
-                        </label>
-                    </div>
-                    <div id="ai_notice_settings" class="{% if not settings.enable_ai_notice %}d-none{% endif %}">
-                        <div class="mb-3">
-                            <label for="ai_notice_message" class="form-label">Notice Text</label>
-                            <textarea
-                                class="form-control"
-                                id="ai_notice_message"
-                                name="ai_notice_message"
-                                rows="3"
-                                maxlength="1000"
-                                placeholder="AI-generated responses may contain errors. Review important information before relying on it."
-                            >{{ settings.ai_notice_message or '' }}</textarea>
-                            <div class="form-text">Plain text only. Line breaks are preserved.</div>
-                        </div>
-                        <div>
-                            <label for="ai_notice_frequency" class="form-label">Display Behavior</label>
-                            <select class="form-select" id="ai_notice_frequency" name="ai_notice_frequency">
-                                <option value="non_dismissible" {% if settings.ai_notice_frequency == 'non_dismissible' %}selected{% endif %}>Always visible; users cannot dismiss it</option>
-                                <option value="every_session" {% if settings.ai_notice_frequency == 'every_session' %}selected{% endif %}>Dismissible once per session</option>
-                                <option value="daily" {% if settings.ai_notice_frequency == 'daily' %}selected{% endif %}>Dismissible once per day</option>
-                                <option value="once" {% if settings.ai_notice_frequency == 'once' %}selected{% endif %}>Dismissible once per message version</option>
-                            </select>
-                            <div class="form-text">Changing the notice text or display behavior creates a new message version and shows it again.</div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="terms-of-use-section">
-                    <h5>
-                        <i class="bi bi-door-open me-2"></i>Terms of Use
-                    </h5>
-                    <p class="text-muted small">
-                        Require users to accept the Terms of Use before using SimpleChat. Standard Microsoft sign-in users see it before authentication; Teams SSO and other passive sign-in flows are gated immediately after the app session is created.
-                    </p>
-
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="enable_terms_of_use"
-                            name="enable_terms_of_use"
-                            {% if settings.enable_terms_of_use %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_terms_of_use">
-                            Require terms of use
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the Terms of Use before accessing authenticated application pages or APIs."></i>
-                    </div>
-
-                    <div class="row g-3">
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_title" class="form-label">Popup Title</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="terms_of_use_title"
-                                name="terms_of_use_title"
-                                maxlength="160"
-                                value="{{ settings.terms_of_use_title or 'Terms of Use' }}"
-                            >
-                        </div>
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_frequency" class="form-label">Show Frequency</label>
-                            <select class="form-select" id="terms_of_use_frequency" name="terms_of_use_frequency">
-                                <option value="every_session" {% if settings.terms_of_use_frequency == 'every_session' %}selected{% endif %}>At the start of every session</option>
-                                <option value="daily" {% if settings.terms_of_use_frequency == 'daily' %}selected{% endif %}>Once per day</option>
-                                <option value="once" {% if settings.terms_of_use_frequency == 'once' %}selected{% endif %}>Just once per terms version</option>
-                            </select>
-                            <small class="form-text text-muted">Changing the title, message, or frequency creates a new terms version that users must accept again.</small>
-                        </div>
-                    </div>
-
-                    <div class="mb-3 mt-3">
-                        <label for="terms_of_use_message" class="form-label">Terms of Use Message</label>
-                        <textarea
-                            class="form-control"
-                            id="terms_of_use_message"
-                            name="terms_of_use_message"
-                            rows="7"
-                            maxlength="10000"
-                            placeholder="Enter the terms, notice, or rules of behavior users must accept before using the application."
-                        >{{ settings.terms_of_use_message or '' }}</textarea>
-                        <small class="form-text text-muted">Plain text is shown to users with line breaks preserved.</small>
-                    </div>
-
-                    <div class="mb-3">
-                        <label for="terms_of_use_decline_redirect_url" class="form-label">Cancel Redirect URL</label>
-                        <input
-                            type="text"
-                            class="form-control"
-                            id="terms_of_use_decline_redirect_url"
-                            name="terms_of_use_decline_redirect_url"
-                            value="{{ settings.terms_of_use_decline_redirect_url or '/' }}"
-                            placeholder="/"
-                        >
-                        <small class="form-text text-muted">Use a local path such as <code>/</code> or an admin-approved HTTP(S) URL. Signed-in users are locally logged out before this redirect.</small>
-                    </div>
-
-                    <div class="row g-3">
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_accept_button_text" class="form-label">Accept Button Text</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="terms_of_use_accept_button_text"
-                                name="terms_of_use_accept_button_text"
-                                maxlength="80"
-                                value="{{ settings.terms_of_use_accept_button_text or 'Accept and continue' }}"
-                            >
-                        </div>
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_decline_button_text" class="form-label">Cancel Button Text</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="terms_of_use_decline_button_text"
-                                name="terms_of_use_decline_button_text"
-                                maxlength="80"
-                                value="{{ settings.terms_of_use_decline_button_text or 'Cancel' }}"
-                            >
-                        </div>
-                    </div>
-
-                    <div class="alert alert-info mt-3 mb-0" role="alert">
-                        <strong>Tracking:</strong> Every-session acceptance is stored in the Flask session. Daily and once-per-version acceptance are stored in user settings, and accepted or declined events are written to the activity log when the user identity is known.
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="support-menu-section">
-                    <h5>
-                        <i class="bi bi-life-preserver me-2"></i>Support
-                    </h5>
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" id="enable_support_menu" name="enable_support_menu"
-                            {% if settings.enable_support_menu %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_support_menu">
-                            Enable Support Menu for End Users
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a Support menu in navigation for signed-in users with the User role."></i>
-                    </div>
-                    <p class="text-muted small">When enabled, users can access Support destinations like Send Feedback and Latest Features directly from navigation.</p>
-
-                    <div id="support_menu_settings" {% if not settings.enable_support_menu %}style="display: none;"{% endif %}>
-                        <div class="mb-3">
-                            <label for="support_menu_name" class="form-label">Menu Name</label>
-                            <input type="text" class="form-control" id="support_menu_name" name="support_menu_name"
-                                   value="{{ settings.support_menu_name or 'Support' }}" placeholder="Support">
-                            <small class="form-text text-muted">This name will appear in user navigation as the Support menu title.</small>
-                        </div>
-
-                        <div class="form-check form-switch mb-2">
-                            <input class="form-check-input" type="checkbox" id="enable_support_send_feedback" name="enable_support_send_feedback"
-                                {% if settings.enable_support_send_feedback %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="enable_support_send_feedback">
-                                Enable Send Feedback Destination
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to prepare support feedback emails that route to your internal recipient."></i>
-                        </div>
-
-                        <div class="mb-3" id="support_feedback_recipient_group" {% if not settings.enable_support_send_feedback %}style="display: none;"{% endif %}>
-                            <label for="support_feedback_recipient_email" class="form-label">Support Recipient Email</label>
-                            <input type="email" class="form-control" id="support_feedback_recipient_email" name="support_feedback_recipient_email"
-                                   value="{{ settings.support_feedback_recipient_email or '' }}" placeholder="support@contoso.com">
-                            <small class="form-text text-muted">User Send Feedback drafts will be addressed to this internal email address.</small>
-                        </div>
-
-                        <div class="form-check form-switch mb-2">
-                            <input class="form-check-input" type="checkbox" id="enable_support_latest_features" name="enable_support_latest_features"
-                                {% if settings.enable_support_latest_features %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="enable_support_latest_features">
-                                Enable Latest Features Destination
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show a user-facing Latest Features page from the Support menu."></i>
-                        </div>
-
-                        <div id="support_latest_features_settings" {% if not settings.enable_support_latest_features %}style="display: none;"{% endif %}>
-                            <h6 class="mt-3">User-Facing Latest Features</h6>
-                            <p class="text-muted small">Choose which recent features are shared on the user Latest Features page. Deployment and Redis start unchecked because they are mainly admin-facing rollout and infrastructure topics.</p>
-                            <div class="form-check form-switch mb-3">
-                                <input class="form-check-input" type="checkbox" id="enable_support_latest_feature_documentation_links" name="enable_support_latest_feature_documentation_links"
-                                    {% if settings.enable_support_latest_feature_documentation_links %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="enable_support_latest_feature_documentation_links">
-                                    Show Simple Chat Documentation Guide Links
-                                </label>
-                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show public documentation guide buttons alongside the in-app Latest Features shortcuts. This is disabled by default."></i>
-                                <small class="form-text text-muted d-block mt-1">When enabled, user-facing Latest Features cards can show public guide buttons in addition to the direct in-app shortcuts.</small>
-                            </div>
-                            {% for release_group in support_latest_feature_release_groups %}
-                            {% set checklist_collapse_id = release_group.collapse_id ~ 'Checklist' %}
-                            <div class="card border-0 bg-body-tertiary mb-3">
-                                <div class="card-body p-3">
-                                    <div class="d-flex flex-column flex-md-row align-items-md-center justify-content-between gap-3">
-                                        <div>
-                                            <h6 class="mb-1">{{ release_group.label }}{% if release_group.release_version %}<span class="badge bg-light text-dark ms-2">v{{ release_group.release_version }}</span>{% endif %}</h6>
-                                            <p class="text-muted small mb-0">{{ release_group.description }}</p>
-                                        </div>
-                                        {% if not release_group.default_expanded %}
-                                        <button
-                                            type="button"
-                                            class="btn btn-sm btn-outline-secondary"
-                                            data-bs-toggle="collapse"
-                                            data-bs-target="#{{ checklist_collapse_id }}"
-                                            aria-expanded="false"
-                                            aria-controls="{{ checklist_collapse_id }}"
-                                        >
-                                            Show {{ release_group.label }}
-                                        </button>
-                                        {% endif %}
-                                    </div>
-                                    <div {% if not release_group.default_expanded %}class="collapse mt-3" id="{{ checklist_collapse_id }}"{% else %}class="mt-3"{% endif %}>
-                                        <div class="row g-2">
-                                            {% for feature in release_group.features %}
-                                            <div class="col-md-6">
-                                                <div class="form-check border rounded p-3 h-100">
-                                                    <input class="form-check-input" type="checkbox" id="support_latest_feature_{{ feature.id }}" name="support_latest_feature_{{ feature.id }}"
-                                                        {% if settings.support_latest_features_visibility.get(feature.id, true) %}checked{% endif %}>
-                                                    <label class="form-check-label ms-2" for="support_latest_feature_{{ feature.id }}">
-                                                        <span class="fw-semibold d-block">{{ feature.title }}</span>
-                                                        <span class="text-muted small">{{ feature.summary }}</span>
-                                                    </label>
-                                                </div>
-                                            </div>
-                                            {% endfor %}
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                            {% endfor %}
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="external-links-section">
-                    <h5>
-                        <i class="bi bi-box-arrow-up-right me-2"></i>External Links
-                    </h5>
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" id="enable_external_links" name="enable_external_links"
-                            {% if settings.enable_external_links %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_external_links">
-                            Enable External Links in Navigation
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a menu of external links in the navigation bar for quick access to external resources and websites."></i>
-                    </div>
-                    <p class="text-muted small">When enabled, external links will be displayed in the navigation bar for easy access to external resources.</p>
-
-                    <div id="external_links_settings" {% if not settings.enable_external_links %}style="display: none;"{% endif %}>
-                        <div class="mb-3">
-                            <label for="external_links_menu_name" class="form-label">Menu Name</label>
-                            <input type="text" class="form-control" id="external_links_menu_name" name="external_links_menu_name"
-                                   value="{{ settings.external_links_menu_name or 'External Links' }}" placeholder="External Links">
-                            <small class="form-text text-muted">This name will appear in the navigation bar as the menu title.</small>
-                        </div>
-
-                        <div class="form-check form-switch mb-3">
-                            <input class="form-check-input" type="checkbox" id="external_links_force_menu" name="external_links_force_menu"
-                                {% if settings.external_links_force_menu %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="external_links_force_menu">
-                                Force Menu Display
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Always show external links as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu."></i>
-                            <small class="form-text text-muted d-block">When enabled, external links will always display as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu.</small>
-                        </div>
-
-                        <h6>External Links</h6>
-                        <p class="text-muted small">Define custom links that will appear in the navigation bar for users to access external resources.</p>
-
-                        <table class="table table-sm table-bordered">
-                            <thead>
-                                <tr>
-                                    <th>Label</th>
-                                    <th>URL</th>
-                                    <th>Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody id="external-links-tbody">
-                                <!-- Populated by JavaScript -->
-                            </tbody>
-                        </table>
-
-                        <button type="button" class="btn btn-sm btn-outline-primary" id="add-external-link-btn">Add New Link</button>
-                        <input type="hidden" name="external_links_json" id="external_links_json">
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="system-settings-section">
-                    <h5>
-                        <i class="bi bi-gear-fill me-2"></i>System Settings
-                    </h5>
-                    <p class="text-muted">
-                        System-level settings that control application behavior, including file size limits, conversation history,
-                        and default prompts.
-                    </p>
-                    <div class="mb-3">
-                        <label for="max_file_size_mb" class="form-label">Maximum File Size (MB)</label>
-                        <input type="number" class="form-control" id="max_file_size_mb" name="max_file_size_mb"
-                            value="{{ settings.max_file_size_mb }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="conversation_history_limit" class="form-label">
-                            Conversation History Limit
-                        </label>
-                        <input type="number" class="form-control" id="conversation_history_limit"
-                            name="conversation_history_limit" value="{{ settings.conversation_history_limit }}">
-                    </div>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_idle_timeout"
-                            name="enable_idle_timeout"
-                            {% if settings.enable_idle_timeout %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_idle_timeout">
-                            Enable Idle Session Timeout and Warning
-                        </label>
-                        <button
-                             type="button"
-                             class="btn btn-link p-0 ms-2"
-                             data-bs-toggle="tooltip"
-                             title="When enabled, inactive users receive a warning and are automatically logged out after the configured timeout."
-                             aria-label="More information about idle timeout settings">
-                             <i class="bi bi-info-circle" aria-hidden="true"></i>
-                         </button>
-                    </div>
-                    <div id="idle_timeout_settings" class="{% if settings.enable_idle_timeout is not defined or not settings.enable_idle_timeout %}d-none{% endif %}">
-                        <div class="mb-3">
-                            <label for="idle_timeout_minutes" class="form-label">Idle Logout Timeout (Minutes)</label>
-                            <input
-                                type="number"
-                                class="form-control"
-                                id="idle_timeout_minutes"
-                                name="idle_timeout_minutes"
-                                min="10"
-                                value="{{ settings.idle_timeout_minutes | default(30) }}">
-                            <small class="form-text text-muted">Users are logged out locally after this many minutes of inactivity. Minimum value: 10 minutes.</small>
-                        </div>
-                        <div class="mb-3">
-                            <label for="idle_warning_minutes" class="form-label">Idle Warning Time (Minutes)</label>
-                            <input
-                                type="number"
-                                class="form-control"
-                                id="idle_warning_minutes"
-                                name="idle_warning_minutes"
-                                min="0"
-                                value="{{ settings.idle_warning_minutes | default(28) }}">
-                            <small class="form-text text-muted">Show the warning modal after this many minutes of inactivity. Set this equal to the logout timeout to disable the warning dialog window.</small>
-                        </div>
-                        <div class="mb-3">
-                            <label for="idle_warning_message" class="form-label">Idle Warning Message</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="idle_warning_message"
-                                name="idle_warning_message"
-                                value="{{ settings.idle_warning_message | default("You've been inactive for a while.") }}">
-                            <small class="form-text text-muted">Custom text shown at the top of the idle warning dialog.</small>
-                        </div>
-                    </div>
-                    <div class="mb-3">
-                        <label for="default_system_prompt" class="form-label">Default System Prompt</label>
-                        <textarea class="form-control" id="default_system_prompt" name="default_system_prompt"
-                            rows="5">{{ settings.default_system_prompt }}</textarea>
-                    </div>
-                    <div class="mb-3">
-                        <label for="access_denied_message" class="form-label">Access Denied Message</label>
-                        <small class="text-muted d-block mb-1">Shown to signed-in users who lack the required roles. Use Enter for line breaks.</small>
-                        <textarea class="form-control" id="access_denied_message" name="access_denied_message"
-                            rows="3">{{ settings.access_denied_message }}</textarea>
-                    </div>
-                </div>
-            </div>
diff --git a/application/single_app/templates/admin/_panes/governance-policies.html b/application/single_app/templates/admin/_panes/governance-policies.html
index 8b9d2130f..da2b94fd1 100644
--- a/application/single_app/templates/admin/_panes/governance-policies.html
+++ b/application/single_app/templates/admin/_panes/governance-policies.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="governance-policies" role="tabpanel" aria-labelledby="governance-policies-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'governance-policies' %} show active{% endif %}" id="governance-policies" role="tabpanel" aria-labelledby="governance-policies-tab">
                 <div class="card p-3 mb-3" id="governance-feature-policies-section">
                     <div class="d-flex justify-content-between align-items-center mb-2">
                         <h5 class="mb-0"><i class="bi bi-sliders2 me-2"></i>Feature Policies</h5>
diff --git a/application/single_app/templates/admin/_panes/latest-features.html b/application/single_app/templates/admin/_panes/latest-features.html
index 0ef37a941..a5d8c5f5d 100644
--- a/application/single_app/templates/admin/_panes/latest-features.html
+++ b/application/single_app/templates/admin/_panes/latest-features.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="latest-features" role="tabpanel" aria-labelledby="latest-features-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'latest-features' %} show active{% endif %}" id="latest-features" role="tabpanel" aria-labelledby="latest-features-tab">
                 <p class="text-muted mb-2">
                     Review the main capabilities introduced in v{{ config['VERSION'] }} and use this page as an admin-facing overview for what to highlight with your teams.
                 </p>
@@ -832,7 +832,7 @@ <h5 class="mb-1">
                         <div class="card card-body">
                             <p class="mb-2">Admins can enable this once and let users see more of the model pipeline, including sending, generating, and responded states with clearer timing information.</p>
                             <div class="alert alert-secondary mb-3" role="alert">
-                                This toggle mirrors the saved value in the <a href="#processing-thoughts-section" data-admin-link="processing-thoughts-section">AI Models</a> tab.
+                                This toggle mirrors the saved value in the <a href="#processing-thoughts-section" data-admin-link="processing-thoughts-section">Chat Experience</a> tab.
                             </div>
                             <div class="form-check form-switch mb-3">
                                 <input
@@ -894,7 +894,7 @@ <h5 class="mb-1">
                                 <li>Admins can choose whether this announcement is visible on the user-facing Latest Features page from <strong>General > User-Facing Latest Features</strong>.</li>
                             </ul>
                             <div class="alert alert-secondary mb-3" role="alert">
-                                Use the <a href="#support-menu-section" data-admin-link="support-menu-section">General</a> tab when you want to show or hide the Fact Memory announcement for end users.
+                                Use the <a href="#support-menu-section" data-admin-link="support-menu-section">Support Menu</a> tab when you want to show or hide the Fact Memory announcement for end users.
                             </div>
                             <div class="latest-feature-gallery">
                                 <button
@@ -967,7 +967,7 @@ <h5 class="mb-1">
                                 <li>This works best when Key Vault is already configured for the app.</li>
                             </ul>
                             <div class="alert alert-secondary mb-3" role="alert">
-                                These controls mirror the saved values in the <a href="#redis-cache-section" data-admin-link="redis-cache-section">Scale</a> tab.
+                                These controls mirror the saved values in the <a href="#redis-cache-section" data-admin-link="redis-cache-section">Redis &amp; Caching</a> tab.
                             </div>
                             <div class="form-check form-switch mb-3">
                                 <input
diff --git a/application/single_app/templates/admin/_panes/logging.html b/application/single_app/templates/admin/_panes/logging.html
index f8cf52e23..a32454471 100644
--- a/application/single_app/templates/admin/_panes/logging.html
+++ b/application/single_app/templates/admin/_panes/logging.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="logging" role="tabpanel" aria-labelledby="logging-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'logging' %} show active{% endif %}" id="logging" role="tabpanel" aria-labelledby="logging-tab">
                 <p class="text-muted">
                     Configure logging settings for monitoring, debugging, and auditing purposes. These settings control various types of logging throughout the application including application insights, debug messages, and file processing events.
                 </p>
@@ -174,4 +174,101 @@ <h6 id="file-processing-log-cleanup-heading">Delete stored logs</h6>
                         </div>
                     </section>
                 </div>
+                <div class="card p-3 mb-3" id="health-check-section">
+                    <div class="d-flex justify-content-between align-items-center mb-2">
+                        <h5 class="mb-0">
+                            <i class="bi bi-heart-pulse me-2"></i>Health Check
+                        </h5>
+                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#healthCheckInfoModal">
+                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
+                        </button>
+                    </div>
+                    <p class="text-muted mb-3">Configure health check endpoint for external monitoring systems.</p>
+
+                    <div class="row g-3">
+                        <div class="col-lg-6">
+                            <div class="border rounded p-3 h-100 bg-body-tertiary-subtle">
+                                <div class="d-flex align-items-start justify-content-between gap-2">
+                                    <div>
+                                        <h6 class="mb-1">Authenticated Endpoint</h6>
+                                        <p class="text-muted small mb-0">Use when your monitoring system can reach a protected route and you want the endpoint governed by the normal app access boundary.</p>
+                                    </div>
+                                    <span class="badge text-bg-primary">Protected</span>
+                                </div>
+                                <div class="form-check form-switch mt-3 mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="enable_external_healthcheck"
+                                        name="enable_external_healthcheck"
+                                        {% if settings.enable_external_healthcheck %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="enable_external_healthcheck">
+                                        Enable /external/healthcheck
+                                    </label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the authenticated /external/healthcheck endpoint for external monitoring systems."></i>
+                                </div>
+                                <p class="text-muted small mb-0">Best for internal monitors or diagnostics tooling that already authenticates to the application.</p>
+                            </div>
+                        </div>
+                        <div class="col-lg-6">
+                            <div class="border rounded p-3 h-100 border-warning-subtle bg-warning-subtle">
+                                <div class="d-flex align-items-start justify-content-between gap-2">
+                                    <div>
+                                        <h6 class="mb-1">Unauthenticated Endpoint</h6>
+                                        <p class="text-muted small mb-0">Use when a platform health probe cannot sign in and only needs a lightweight availability response.</p>
+                                    </div>
+                                    <span class="badge text-bg-warning">No Auth</span>
+                                </div>
+                                <div class="form-check form-switch mt-3 mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="enable_no_auth_external_healthcheck"
+                                        name="enable_no_auth_external_healthcheck"
+                                        {% if settings.enable_no_auth_external_healthcheck %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="enable_no_auth_external_healthcheck">
+                                        Enable /external/healthcheckz
+                                    </label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the unauthenticated /external/healthcheckz endpoint for probes that cannot authenticate."></i>
+                                </div>
+                                <div class="alert alert-warning small mb-0" role="alert">
+                                    <strong>Security note:</strong> This route is intentionally unauthenticated. Only enable it for trusted health probes or controlled network paths.
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="card p-3 mb-3" id="swagger-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0">
+                            <i class="bi bi-file-earmark-code me-2"></i>API Documentation
+                        </h5>
+                        <div class="btn-group" role="group">
+                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#swaggerInfoModal">
+                                <i class="bi bi-info-circle me-1"></i>Why Enable Swagger?
+                            </button>
+                            <a href="/swagger" class="btn btn-primary btn-sm" target="_blank">
+                                <i class="bi bi-box-arrow-up-right me-1"></i>Open Swagger UI
+                            </a>
+                        </div>
+                    </div>
+                    <p class="text-muted mb-3">Configure automatic OpenAPI/Swagger documentation for API endpoints.</p>
+
+                    <div class="form-check form-switch mb-2">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_swagger"
+                            name="enable_swagger"
+                            {% if settings.enable_swagger %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_swagger">
+                            Enable Swagger/OpenAPI Documentation (/swagger)
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable automatic API documentation with Swagger UI interface for testing and exploring endpoints."></i>
+                    </div>
+                    <p class="text-muted small mb-0">
+                        Provides interactive API documentation, endpoint testing, and schema validation.
+                        Useful for developers, API integration, and system troubleshooting.
+                    </p>
+                </div>
             </div>
diff --git a/application/single_app/templates/admin/_panes/mcp-governance.html b/application/single_app/templates/admin/_panes/mcp-governance.html
index 31080591e..8a57389de 100644
--- a/application/single_app/templates/admin/_panes/mcp-governance.html
+++ b/application/single_app/templates/admin/_panes/mcp-governance.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="mcp-governance" role="tabpanel" aria-labelledby="mcp-governance-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'mcp-governance' %} show active{% endif %}" id="mcp-governance" role="tabpanel" aria-labelledby="mcp-governance-tab">
                 <div class="card p-3 mb-3" id="governance-mcp-destination-section">
                     <h5>
                         <i class="bi bi-diagram-3 me-2"></i>MCP Action Destination Governance
diff --git a/application/single_app/templates/admin/_panes/network.html b/application/single_app/templates/admin/_panes/network.html
index 83ba4fb03..0f9216bad 100644
--- a/application/single_app/templates/admin/_panes/network.html
+++ b/application/single_app/templates/admin/_panes/network.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="network" role="tabpanel" aria-labelledby="network-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'network' %} show active{% endif %}" id="network" role="tabpanel" aria-labelledby="network-tab">
                 <div class="card p-3 mb-3" id="front-door-section">
                     <div class="d-flex justify-content-between align-items-center mb-2">
                         <h5 class="mb-0">
diff --git a/application/single_app/templates/admin/_panes/notices.html b/application/single_app/templates/admin/_panes/notices.html
new file mode 100644
index 000000000..c05ac2b68
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/notices.html
@@ -0,0 +1,288 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'notices' %} show active{% endif %}" id="notices" role="tabpanel" aria-labelledby="notices-tab">
+                <div class="card p-3 mb-3" id="classification-banner-section">
+                    <h5>
+                        <i class="bi bi-shield-exclamation me-2"></i>Classification Banner
+                    </h5>
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" id="classification_banner_enabled" name="classification_banner_enabled"
+                            {% if settings.classification_banner_enabled %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="classification_banner_enabled">
+                            Enable Classification Banner
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a security classification banner at the top of every page to indicate data sensitivity level."></i>
+                    </div>
+                    <div class="mb-2">
+                        <label for="classification_banner_text" class="form-label">Banner Text</label>
+                        <input type="text" class="form-control" id="classification_banner_text" name="classification_banner_text"
+                            value="{{ settings.classification_banner_text }}">
+                    </div>
+                    <div class="mb-2">
+                        <label for="classification_banner_color" class="form-label">Banner Color</label>
+                        <input type="color" class="form-control form-control-color" id="classification_banner_color" name="classification_banner_color"
+                            value="{{ settings.classification_banner_color or '#ffc107' }}" style="width: 3rem; height: 2rem;">
+                    </div>
+                    <div class="mb-2">
+                        <label for="classification_banner_text_color" class="form-label">Banner Text Color</label>
+                        <input type="color" class="form-control form-control-color" id="classification_banner_text_color" name="classification_banner_text_color"
+                            value="{{ settings.classification_banner_text_color or '#ffffff' }}" style="width: 3rem; height: 2rem;">
+                    </div>
+                    <div class="mb-2">
+                        <span id="classification-banner-preview"
+                              style="display:inline-block; padding:0.5em 1em; border-radius:0.3em; font-weight:bold; color:{{ settings.classification_banner_text_color or '#ffffff' }}; background:{{ settings.classification_banner_color or '#ffc107' }};">
+                            {{ settings.classification_banner_text or 'Banner Preview' }}
+                        </span>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="ai-notice-section">
+                    <h5>
+                        <i class="bi bi-robot me-2"></i>Chat AI Notice
+                    </h5>
+                    <p class="text-muted small">
+                        Display an administrator-provided reminder directly below the chat input, such as guidance that responses are AI-generated and should be reviewed.
+                    </p>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="enable_ai_notice"
+                            name="enable_ai_notice"
+                            {% if settings.enable_ai_notice %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_ai_notice">
+                            Show a custom AI notice below the chat input
+                        </label>
+                    </div>
+                    <div id="ai_notice_settings" class="{% if not settings.enable_ai_notice %}d-none{% endif %}">
+                        <div class="mb-3">
+                            <label for="ai_notice_message" class="form-label">Notice Text</label>
+                            <textarea
+                                class="form-control"
+                                id="ai_notice_message"
+                                name="ai_notice_message"
+                                rows="3"
+                                maxlength="1000"
+                                placeholder="AI-generated responses may contain errors. Review important information before relying on it."
+                            >{{ settings.ai_notice_message or '' }}</textarea>
+                            <div class="form-text">Plain text only. Line breaks are preserved.</div>
+                        </div>
+                        <div>
+                            <label for="ai_notice_frequency" class="form-label">Display Behavior</label>
+                            <select class="form-select" id="ai_notice_frequency" name="ai_notice_frequency">
+                                <option value="non_dismissible" {% if settings.ai_notice_frequency == 'non_dismissible' %}selected{% endif %}>Always visible; users cannot dismiss it</option>
+                                <option value="every_session" {% if settings.ai_notice_frequency == 'every_session' %}selected{% endif %}>Dismissible once per session</option>
+                                <option value="daily" {% if settings.ai_notice_frequency == 'daily' %}selected{% endif %}>Dismissible once per day</option>
+                                <option value="once" {% if settings.ai_notice_frequency == 'once' %}selected{% endif %}>Dismissible once per message version</option>
+                            </select>
+                            <div class="form-text">Changing the notice text or display behavior creates a new message version and shows it again.</div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="terms-of-use-section">
+                    <h5>
+                        <i class="bi bi-door-open me-2"></i>Terms of Use
+                    </h5>
+                    <p class="text-muted small">
+                        Require users to accept the Terms of Use before using SimpleChat. Standard Microsoft sign-in users see it before authentication; Teams SSO and other passive sign-in flows are gated immediately after the app session is created.
+                    </p>
+
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="enable_terms_of_use"
+                            name="enable_terms_of_use"
+                            {% if settings.enable_terms_of_use %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_terms_of_use">
+                            Require terms of use
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the Terms of Use before accessing authenticated application pages or APIs."></i>
+                    </div>
+
+                    <div class="row g-3">
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_title" class="form-label">Popup Title</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="terms_of_use_title"
+                                name="terms_of_use_title"
+                                maxlength="160"
+                                value="{{ settings.terms_of_use_title or 'Terms of Use' }}"
+                            >
+                        </div>
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_frequency" class="form-label">Show Frequency</label>
+                            <select class="form-select" id="terms_of_use_frequency" name="terms_of_use_frequency">
+                                <option value="every_session" {% if settings.terms_of_use_frequency == 'every_session' %}selected{% endif %}>At the start of every session</option>
+                                <option value="daily" {% if settings.terms_of_use_frequency == 'daily' %}selected{% endif %}>Once per day</option>
+                                <option value="once" {% if settings.terms_of_use_frequency == 'once' %}selected{% endif %}>Just once per terms version</option>
+                            </select>
+                            <small class="form-text text-muted">Changing the title, message, or frequency creates a new terms version that users must accept again.</small>
+                        </div>
+                    </div>
+
+                    <div class="mb-3 mt-3">
+                        <label for="terms_of_use_message" class="form-label">Terms of Use Message</label>
+                        <textarea
+                            class="form-control"
+                            id="terms_of_use_message"
+                            name="terms_of_use_message"
+                            rows="7"
+                            maxlength="10000"
+                            placeholder="Enter the terms, notice, or rules of behavior users must accept before using the application."
+                        >{{ settings.terms_of_use_message or '' }}</textarea>
+                        <small class="form-text text-muted">Plain text is shown to users with line breaks preserved.</small>
+                    </div>
+
+                    <div class="mb-3">
+                        <label for="terms_of_use_decline_redirect_url" class="form-label">Cancel Redirect URL</label>
+                        <input
+                            type="text"
+                            class="form-control"
+                            id="terms_of_use_decline_redirect_url"
+                            name="terms_of_use_decline_redirect_url"
+                            value="{{ settings.terms_of_use_decline_redirect_url or '/' }}"
+                            placeholder="/"
+                        >
+                        <small class="form-text text-muted">Use a local path such as <code>/</code> or an admin-approved HTTP(S) URL. Signed-in users are locally logged out before this redirect.</small>
+                    </div>
+
+                    <div class="row g-3">
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_accept_button_text" class="form-label">Accept Button Text</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="terms_of_use_accept_button_text"
+                                name="terms_of_use_accept_button_text"
+                                maxlength="80"
+                                value="{{ settings.terms_of_use_accept_button_text or 'Accept and continue' }}"
+                            >
+                        </div>
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_decline_button_text" class="form-label">Cancel Button Text</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="terms_of_use_decline_button_text"
+                                name="terms_of_use_decline_button_text"
+                                maxlength="80"
+                                value="{{ settings.terms_of_use_decline_button_text or 'Cancel' }}"
+                            >
+                        </div>
+                    </div>
+
+                    <div class="alert alert-info mt-3 mb-0" role="alert">
+                        <strong>Tracking:</strong> Every-session acceptance is stored in the Flask session. Daily and once-per-version acceptance are stored in user settings, and accepted or declined events are written to the activity log when the user identity is known.
+                    </div>
+                </div>
+
+
+
+                <div class="card mb-3 p-3" id="user-agreement-section">
+                    <h5>
+                        <i class="bi bi-file-earmark-check me-2"></i>User Agreement
+                    </h5>
+                    <p class="text-muted">
+                        Configure a user agreement that users must accept before uploading files.
+                        Supports Markdown formatting.
+                    </p>
+
+                    <!-- Enable Toggle -->
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_user_agreement"
+                            name="enable_user_agreement"
+                            {% if settings.enable_user_agreement %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_user_agreement">
+                            Enable User Agreement
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the agreement before uploading files in the selected workspace types."></i>
+                    </div>
+
+                    <!-- User Agreement Settings (shown when enabled) -->
+                    <div id="user_agreement_settings" {% if not settings.enable_user_agreement %}style="display: none;"{% endif %}>
+                        <hr>
+
+                        <!-- Apply To Checkboxes -->
+                        <div class="mb-3">
+                            <label class="form-label fw-bold">Apply to <span class="text-danger">*</span></label>
+                            <p class="text-muted small mb-2">Select where the user agreement should be shown (at least one required):</p>
+                            <div class="row">
+                                <div class="col-md-6">
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_personal" name="user_agreement_apply_personal"
+                                            {% if settings.user_agreement_apply_to and 'personal' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_personal">
+                                            <i class="bi bi-person me-1"></i>Personal Workspaces
+                                        </label>
+                                    </div>
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_group" name="user_agreement_apply_group"
+                                            {% if settings.user_agreement_apply_to and 'group' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_group">
+                                            <i class="bi bi-people me-1"></i>Group Workspaces
+                                        </label>
+                                    </div>
+                                </div>
+                                <div class="col-md-6">
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_public" name="user_agreement_apply_public"
+                                            {% if settings.user_agreement_apply_to and 'public' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_public">
+                                            <i class="bi bi-globe me-1"></i>Public Workspaces
+                                        </label>
+                                    </div>
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_chat" name="user_agreement_apply_chat"
+                                            {% if settings.user_agreement_apply_to and 'chat' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_chat">
+                                            <i class="bi bi-chat-dots me-1"></i>Chat
+                                        </label>
+                                    </div>
+                                </div>
+                            </div>
+                            <div id="user_agreement_apply_to_validation" class="text-danger small" style="display: none;">
+                                <i class="bi bi-exclamation-circle me-1"></i>At least one location must be selected
+                            </div>
+                        </div>
+
+                        <!-- Agreement Text -->
+                        <div class="mb-3">
+                            <label for="user_agreement_text" class="form-label fw-bold">
+                                Agreement Text <span class="text-danger">*</span>
+                                <span class="text-muted fw-normal ms-2">(Markdown supported)</span>
+                            </label>
+                            <textarea class="form-control" id="user_agreement_text" name="user_agreement_text" rows="6"
+                                placeholder="Enter the agreement text that users must accept before uploading files...&#10;&#10;Example:&#10;**I confirm that:**&#10;- The documents I am uploading do not contain PII&#10;- I have permission to share these documents">{{ settings.user_agreement_text or '' }}</textarea>
+                            <div class="d-flex justify-content-between mt-1">
+                                <small id="user_agreement_word_count" class="text-muted">0 / 200 words</small>
+                                <small id="user_agreement_word_warning" class="text-danger" style="display: none;">
+                                    <i class="bi bi-exclamation-circle me-1"></i>Exceeds 200 word limit
+                                </small>
+                            </div>
+                        </div>
+
+                        <!-- Daily Acceptance Option -->
+                        <div class="form-group form-check form-switch mb-3">
+                            <input type="checkbox" class="form-check-input" id="enable_user_agreement_daily" name="enable_user_agreement_daily"
+                                {% if settings.enable_user_agreement_daily %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="enable_user_agreement_daily">
+                                Allow users to accept once per day
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users only need to accept the agreement once per day instead of every time they upload files."></i>
+                        </div>
+
+                        <!-- Test Preview Button -->
+                        <div class="d-flex gap-2 flex-wrap">
+                            <button type="button" class="btn btn-outline-secondary" id="test_user_agreement_btn">
+                                <i class="bi bi-eye me-1"></i>Test Preview
+                            </button>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/redis-caching.html b/application/single_app/templates/admin/_panes/redis-caching.html
index 16d846c71..5bbaa8c4d 100644
--- a/application/single_app/templates/admin/_panes/redis-caching.html
+++ b/application/single_app/templates/admin/_panes/redis-caching.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="redis-caching" role="tabpanel" aria-labelledby="redis-caching-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'redis-caching' %} show active{% endif %}" id="redis-caching" role="tabpanel" aria-labelledby="redis-caching-tab">
                 {% set enable_dai_debug = settings.enable_dai_debug | default(false) %}
                 <p class="text-muted">
                     Configure Redis cache to improve enterprise scale and performance by caching session data. Enabling Redis allows you to horizontally scale your application across multiple instances without losing session data.
diff --git a/application/single_app/templates/admin/_panes/retention.html b/application/single_app/templates/admin/_panes/retention.html
index c3aa2258a..a2bc06781 100644
--- a/application/single_app/templates/admin/_panes/retention.html
+++ b/application/single_app/templates/admin/_panes/retention.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="retention" role="tabpanel" aria-labelledby="retention-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'retention' %} show active{% endif %}" id="retention" role="tabpanel" aria-labelledby="retention-tab">
                 <div class="card p-3 mb-3" id="retention-policy-section">
                     <h5>
                         <i class="bi bi-hourglass-split me-2"></i>Retention Policy
diff --git a/application/single_app/templates/admin/_panes/search-extract.html b/application/single_app/templates/admin/_panes/search-extract.html
index 1db055f2b..04de8cc88 100644
--- a/application/single_app/templates/admin/_panes/search-extract.html
+++ b/application/single_app/templates/admin/_panes/search-extract.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="search-extract" role="tabpanel" aria-labelledby="search-extract-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'search-extract' %} show active{% endif %}" id="search-extract" role="tabpanel" aria-labelledby="search-extract-tab">
 
                  <p class="text-muted">
                     Configure Azure AI Search, Document Intelligence, and multimedia support settings.
diff --git a/application/single_app/templates/admin/_panes/security.html b/application/single_app/templates/admin/_panes/secrets.html
similarity index 99%
rename from application/single_app/templates/admin/_panes/security.html
rename to application/single_app/templates/admin/_panes/secrets.html
index 40d43e1a9..dbf36ddc0 100644
--- a/application/single_app/templates/admin/_panes/security.html
+++ b/application/single_app/templates/admin/_panes/secrets.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="security" role="tabpanel" aria-labelledby="security-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'secrets' %} show active{% endif %}" id="secrets" role="tabpanel" aria-labelledby="secrets-tab">
                 <p class="text-muted">
                     Manage security settings for key vault and other security configurations.
                 </p>
diff --git a/application/single_app/templates/admin/_panes/send-feedback.html b/application/single_app/templates/admin/_panes/send-feedback.html
index 1d9cdb365..5acd28833 100644
--- a/application/single_app/templates/admin/_panes/send-feedback.html
+++ b/application/single_app/templates/admin/_panes/send-feedback.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="send-feedback" role="tabpanel" aria-labelledby="send-feedback-tab" data-app-version="{{ config['VERSION'] }}">
+            <div class="tab-pane fade{% if admin_landing_tab == 'send-feedback' %} show active{% endif %}" id="send-feedback" role="tabpanel" aria-labelledby="send-feedback-tab" data-app-version="{{ config['VERSION'] }}">
                 <p class="text-muted">
                     Prepare a prefilled email draft for bug reports or feature requests. This utility is separate from saved settings and records each submission intent in the activity log before opening your local email client.
                 </p>
diff --git a/application/single_app/templates/admin/_panes/session.html b/application/single_app/templates/admin/_panes/session.html
new file mode 100644
index 000000000..cb8fe9abe
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/session.html
@@ -0,0 +1,87 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'session' %} show active{% endif %}" id="session" role="tabpanel" aria-labelledby="session-tab">
+                <div class="card p-3 mb-3" id="system-settings-section">
+                    <h5>
+                        <i class="bi bi-gear-fill me-2"></i>System Settings
+                    </h5>
+                    <p class="text-muted">
+                        System-level settings that control application behavior, including file size limits, conversation history,
+                        and default prompts.
+                    </p>
+                    <div class="mb-3">
+                        <label for="max_file_size_mb" class="form-label">Maximum File Size (MB)</label>
+                        <input type="number" class="form-control" id="max_file_size_mb" name="max_file_size_mb"
+                            value="{{ settings.max_file_size_mb }}">
+                    </div>
+                    <div class="mb-3">
+                        <label for="conversation_history_limit" class="form-label">
+                            Conversation History Limit
+                        </label>
+                        <input type="number" class="form-control" id="conversation_history_limit"
+                            name="conversation_history_limit" value="{{ settings.conversation_history_limit }}">
+                    </div>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_idle_timeout"
+                            name="enable_idle_timeout"
+                            {% if settings.enable_idle_timeout %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_idle_timeout">
+                            Enable Idle Session Timeout and Warning
+                        </label>
+                        <button
+                             type="button"
+                             class="btn btn-link p-0 ms-2"
+                             data-bs-toggle="tooltip"
+                             title="When enabled, inactive users receive a warning and are automatically logged out after the configured timeout."
+                             aria-label="More information about idle timeout settings">
+                             <i class="bi bi-info-circle" aria-hidden="true"></i>
+                         </button>
+                    </div>
+                    <div id="idle_timeout_settings" class="{% if settings.enable_idle_timeout is not defined or not settings.enable_idle_timeout %}d-none{% endif %}">
+                        <div class="mb-3">
+                            <label for="idle_timeout_minutes" class="form-label">Idle Logout Timeout (Minutes)</label>
+                            <input
+                                type="number"
+                                class="form-control"
+                                id="idle_timeout_minutes"
+                                name="idle_timeout_minutes"
+                                min="10"
+                                value="{{ settings.idle_timeout_minutes | default(30) }}">
+                            <small class="form-text text-muted">Users are logged out locally after this many minutes of inactivity. Minimum value: 10 minutes.</small>
+                        </div>
+                        <div class="mb-3">
+                            <label for="idle_warning_minutes" class="form-label">Idle Warning Time (Minutes)</label>
+                            <input
+                                type="number"
+                                class="form-control"
+                                id="idle_warning_minutes"
+                                name="idle_warning_minutes"
+                                min="0"
+                                value="{{ settings.idle_warning_minutes | default(28) }}">
+                            <small class="form-text text-muted">Show the warning modal after this many minutes of inactivity. Set this equal to the logout timeout to disable the warning dialog window.</small>
+                        </div>
+                        <div class="mb-3">
+                            <label for="idle_warning_message" class="form-label">Idle Warning Message</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="idle_warning_message"
+                                name="idle_warning_message"
+                                value="{{ settings.idle_warning_message | default("You've been inactive for a while.") }}">
+                            <small class="form-text text-muted">Custom text shown at the top of the idle warning dialog.</small>
+                        </div>
+                    </div>
+                    <div class="mb-3">
+                        <label for="default_system_prompt" class="form-label">Default System Prompt</label>
+                        <textarea class="form-control" id="default_system_prompt" name="default_system_prompt"
+                            rows="5">{{ settings.default_system_prompt }}</textarea>
+                    </div>
+                    <div class="mb-3">
+                        <label for="access_denied_message" class="form-label">Access Denied Message</label>
+                        <small class="text-muted d-block mb-1">Shown to signed-in users who lack the required roles. Use Enter for line breaks.</small>
+                        <textarea class="form-control" id="access_denied_message" name="access_denied_message"
+                            rows="3">{{ settings.access_denied_message }}</textarea>
+                    </div>
+                </div>
+            </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/support-menu.html b/application/single_app/templates/admin/_panes/support-menu.html
new file mode 100644
index 000000000..57c11877b
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/support-menu.html
@@ -0,0 +1,105 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'support-menu' %} show active{% endif %}" id="support-menu" role="tabpanel" aria-labelledby="support-menu-tab">
+                <div class="card p-3 mb-3" id="support-menu-section">
+                    <h5>
+                        <i class="bi bi-life-preserver me-2"></i>Support
+                    </h5>
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" id="enable_support_menu" name="enable_support_menu"
+                            {% if settings.enable_support_menu %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_support_menu">
+                            Enable Support Menu for End Users
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a Support menu in navigation for signed-in users with the User role."></i>
+                    </div>
+                    <p class="text-muted small">When enabled, users can access Support destinations like Send Feedback and Latest Features directly from navigation.</p>
+
+                    <div id="support_menu_settings" {% if not settings.enable_support_menu %}style="display: none;"{% endif %}>
+                        <div class="mb-3">
+                            <label for="support_menu_name" class="form-label">Menu Name</label>
+                            <input type="text" class="form-control" id="support_menu_name" name="support_menu_name"
+                                   value="{{ settings.support_menu_name or 'Support' }}" placeholder="Support">
+                            <small class="form-text text-muted">This name will appear in user navigation as the Support menu title.</small>
+                        </div>
+
+                        <div class="form-check form-switch mb-2">
+                            <input class="form-check-input" type="checkbox" id="enable_support_send_feedback" name="enable_support_send_feedback"
+                                {% if settings.enable_support_send_feedback %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="enable_support_send_feedback">
+                                Enable Send Feedback Destination
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to prepare support feedback emails that route to your internal recipient."></i>
+                        </div>
+
+                        <div class="mb-3" id="support_feedback_recipient_group" {% if not settings.enable_support_send_feedback %}style="display: none;"{% endif %}>
+                            <label for="support_feedback_recipient_email" class="form-label">Support Recipient Email</label>
+                            <input type="email" class="form-control" id="support_feedback_recipient_email" name="support_feedback_recipient_email"
+                                   value="{{ settings.support_feedback_recipient_email or '' }}" placeholder="support@contoso.com">
+                            <small class="form-text text-muted">User Send Feedback drafts will be addressed to this internal email address.</small>
+                        </div>
+
+                        <div class="form-check form-switch mb-2">
+                            <input class="form-check-input" type="checkbox" id="enable_support_latest_features" name="enable_support_latest_features"
+                                {% if settings.enable_support_latest_features %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="enable_support_latest_features">
+                                Enable Latest Features Destination
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show a user-facing Latest Features page from the Support menu."></i>
+                        </div>
+
+                        <div id="support_latest_features_settings" {% if not settings.enable_support_latest_features %}style="display: none;"{% endif %}>
+                            <h6 class="mt-3">User-Facing Latest Features</h6>
+                            <p class="text-muted small">Choose which recent features are shared on the user Latest Features page. Deployment and Redis start unchecked because they are mainly admin-facing rollout and infrastructure topics.</p>
+                            <div class="form-check form-switch mb-3">
+                                <input class="form-check-input" type="checkbox" id="enable_support_latest_feature_documentation_links" name="enable_support_latest_feature_documentation_links"
+                                    {% if settings.enable_support_latest_feature_documentation_links %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="enable_support_latest_feature_documentation_links">
+                                    Show Simple Chat Documentation Guide Links
+                                </label>
+                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show public documentation guide buttons alongside the in-app Latest Features shortcuts. This is disabled by default."></i>
+                                <small class="form-text text-muted d-block mt-1">When enabled, user-facing Latest Features cards can show public guide buttons in addition to the direct in-app shortcuts.</small>
+                            </div>
+                            {% for release_group in support_latest_feature_release_groups %}
+                            {% set checklist_collapse_id = release_group.collapse_id ~ 'Checklist' %}
+                            <div class="card border-0 bg-body-tertiary mb-3">
+                                <div class="card-body p-3">
+                                    <div class="d-flex flex-column flex-md-row align-items-md-center justify-content-between gap-3">
+                                        <div>
+                                            <h6 class="mb-1">{{ release_group.label }}{% if release_group.release_version %}<span class="badge bg-light text-dark ms-2">v{{ release_group.release_version }}</span>{% endif %}</h6>
+                                            <p class="text-muted small mb-0">{{ release_group.description }}</p>
+                                        </div>
+                                        {% if not release_group.default_expanded %}
+                                        <button
+                                            type="button"
+                                            class="btn btn-sm btn-outline-secondary"
+                                            data-bs-toggle="collapse"
+                                            data-bs-target="#{{ checklist_collapse_id }}"
+                                            aria-expanded="false"
+                                            aria-controls="{{ checklist_collapse_id }}"
+                                        >
+                                            Show {{ release_group.label }}
+                                        </button>
+                                        {% endif %}
+                                    </div>
+                                    <div {% if not release_group.default_expanded %}class="collapse mt-3" id="{{ checklist_collapse_id }}"{% else %}class="mt-3"{% endif %}>
+                                        <div class="row g-2">
+                                            {% for feature in release_group.features %}
+                                            <div class="col-md-6">
+                                                <div class="form-check border rounded p-3 h-100">
+                                                    <input class="form-check-input" type="checkbox" id="support_latest_feature_{{ feature.id }}" name="support_latest_feature_{{ feature.id }}"
+                                                        {% if settings.support_latest_features_visibility.get(feature.id, true) %}checked{% endif %}>
+                                                    <label class="form-check-label ms-2" for="support_latest_feature_{{ feature.id }}">
+                                                        <span class="fw-semibold d-block">{{ feature.title }}</span>
+                                                        <span class="text-muted small">{{ feature.summary }}</span>
+                                                    </label>
+                                                </div>
+                                            </div>
+                                            {% endfor %}
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+                            {% endfor %}
+                        </div>
+                    </div>
+                </div>
+            </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/workspace-identities.html b/application/single_app/templates/admin/_panes/workspace-identities.html
index da77b91b5..7c3569ebd 100644
--- a/application/single_app/templates/admin/_panes/workspace-identities.html
+++ b/application/single_app/templates/admin/_panes/workspace-identities.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="workspace-identities" role="tabpanel" aria-labelledby="workspace-identities-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'workspace-identities' %} show active{% endif %}" id="workspace-identities" role="tabpanel" aria-labelledby="workspace-identities-tab">
                 <p class="text-muted">
                     Manage the global authentication profiles that File Sync sources and Actions reuse, so credentials stay scoped and are resolved server-side.
                 </p>
diff --git a/application/single_app/templates/admin/_panes/workspaces.html b/application/single_app/templates/admin/_panes/workspaces.html
index 9200f71d9..690a902af 100644
--- a/application/single_app/templates/admin/_panes/workspaces.html
+++ b/application/single_app/templates/admin/_panes/workspaces.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="workspaces" role="tabpanel" aria-labelledby="workspaces-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'workspaces' %} show active{% endif %}" id="workspaces" role="tabpanel" aria-labelledby="workspaces-tab">
                 <p class="text-muted">
                     Configure workspace settings like personal/group access, multimedia support, metadata, and document classification.
                 </p>
@@ -640,107 +640,4 @@ <h5>
 
 
 
-                <div class="card mb-3 p-3" id="user-agreement-section">
-                    <h5>
-                        <i class="bi bi-file-earmark-check me-2"></i>User Agreement
-                    </h5>
-                    <p class="text-muted">
-                        Configure a user agreement that users must accept before uploading files.
-                        Supports Markdown formatting.
-                    </p>
-
-                    <!-- Enable Toggle -->
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_user_agreement"
-                            name="enable_user_agreement"
-                            {% if settings.enable_user_agreement %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_user_agreement">
-                            Enable User Agreement
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the agreement before uploading files in the selected workspace types."></i>
-                    </div>
-
-                    <!-- User Agreement Settings (shown when enabled) -->
-                    <div id="user_agreement_settings" {% if not settings.enable_user_agreement %}style="display: none;"{% endif %}>
-                        <hr>
-
-                        <!-- Apply To Checkboxes -->
-                        <div class="mb-3">
-                            <label class="form-label fw-bold">Apply to <span class="text-danger">*</span></label>
-                            <p class="text-muted small mb-2">Select where the user agreement should be shown (at least one required):</p>
-                            <div class="row">
-                                <div class="col-md-6">
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_personal" name="user_agreement_apply_personal"
-                                            {% if settings.user_agreement_apply_to and 'personal' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_personal">
-                                            <i class="bi bi-person me-1"></i>Personal Workspaces
-                                        </label>
-                                    </div>
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_group" name="user_agreement_apply_group"
-                                            {% if settings.user_agreement_apply_to and 'group' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_group">
-                                            <i class="bi bi-people me-1"></i>Group Workspaces
-                                        </label>
-                                    </div>
-                                </div>
-                                <div class="col-md-6">
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_public" name="user_agreement_apply_public"
-                                            {% if settings.user_agreement_apply_to and 'public' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_public">
-                                            <i class="bi bi-globe me-1"></i>Public Workspaces
-                                        </label>
-                                    </div>
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_chat" name="user_agreement_apply_chat"
-                                            {% if settings.user_agreement_apply_to and 'chat' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_chat">
-                                            <i class="bi bi-chat-dots me-1"></i>Chat
-                                        </label>
-                                    </div>
-                                </div>
-                            </div>
-                            <div id="user_agreement_apply_to_validation" class="text-danger small" style="display: none;">
-                                <i class="bi bi-exclamation-circle me-1"></i>At least one location must be selected
-                            </div>
-                        </div>
-
-                        <!-- Agreement Text -->
-                        <div class="mb-3">
-                            <label for="user_agreement_text" class="form-label fw-bold">
-                                Agreement Text <span class="text-danger">*</span>
-                                <span class="text-muted fw-normal ms-2">(Markdown supported)</span>
-                            </label>
-                            <textarea class="form-control" id="user_agreement_text" name="user_agreement_text" rows="6"
-                                placeholder="Enter the agreement text that users must accept before uploading files...&#10;&#10;Example:&#10;**I confirm that:**&#10;- The documents I am uploading do not contain PII&#10;- I have permission to share these documents">{{ settings.user_agreement_text or '' }}</textarea>
-                            <div class="d-flex justify-content-between mt-1">
-                                <small id="user_agreement_word_count" class="text-muted">0 / 200 words</small>
-                                <small id="user_agreement_word_warning" class="text-danger" style="display: none;">
-                                    <i class="bi bi-exclamation-circle me-1"></i>Exceeds 200 word limit
-                                </small>
-                            </div>
-                        </div>
-
-                        <!-- Daily Acceptance Option -->
-                        <div class="form-group form-check form-switch mb-3">
-                            <input type="checkbox" class="form-check-input" id="enable_user_agreement_daily" name="enable_user_agreement_daily"
-                                {% if settings.enable_user_agreement_daily %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="enable_user_agreement_daily">
-                                Allow users to accept once per day
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users only need to accept the agreement once per day instead of every time they upload files."></i>
-                        </div>
-
-                        <!-- Test Preview Button -->
-                        <div class="d-flex gap-2 flex-wrap">
-                            <button type="button" class="btn btn-outline-secondary" id="test_user_agreement_btn">
-                                <i class="bi bi-eye me-1"></i>Test Preview
-                            </button>
-                        </div>
-                    </div>
-                </div>
             </div>
diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html
index 65e958b1d..118431f86 100644
--- a/application/single_app/templates/admin_settings.html
+++ b/application/single_app/templates/admin_settings.html
@@ -980,7 +980,10 @@ <h4>12. Enhanced Citations and Image Generation</h4>
            visible whichever governance tab is active. #}
         <div id="governance-status" class="alert d-none" role="alert"></div>
         <div class="tab-content mt-3" id="adminSettingsTabContent">
-            {% include "admin/_panes/security.html" %}
+            {% include "admin/_panes/secrets.html" %}
+            {% include "admin/_panes/access-roles.html" %}
+            {% include "admin/_panes/content-safety.html" %}
+            {% include "admin/_panes/session.html" %}
 
 
             {% include "admin/_panes/agents.html" %}
@@ -994,7 +997,8 @@ <h4>12. Enhanced Citations and Image Generation</h4>
             <!-- Logging Tab Content -->
             {% include "admin/_panes/logging.html" %}
 
-            {% include "admin/_panes/general.html" %}
+            {% include "admin/_panes/branding.html" %}
+            {% include "admin/_panes/notices.html" %}
 
             {% include "admin/_panes/custom-pages.html" %}
 
@@ -1031,11 +1035,11 @@ <h4>12. Enhanced Citations and Image Generation</h4>
             {% include "admin/_panes/feedback-alerts.html" %}
 
 
-            {% include "admin/_panes/safety.html" %}
 
 
             {% include "admin/_panes/search-extract.html" %}
 
+            {% include "admin/_panes/support-menu.html" %}
             {% include "admin/_panes/send-feedback.html" %}
 
             {# Latest Features stays last so it never opens by default #}
diff --git a/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md b/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
index 0e9a7ef64..3632338b9 100644
--- a/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
+++ b/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
@@ -22,8 +22,8 @@ Development ─── feature/admin-settings-ia ──┬── #1297 stage 1
                                                       └──► final PR ──► Development
 ```
 
-Current version: **0.260.012**. Fingerprint: **462 field names / 110 card ids**.
-Navigation: **13 groups / 27 tabs / 88 sections**.
+Current version: **0.260.013**. Fingerprint: **462 field names / 110 card ids**.
+Navigation: **13 groups / 31 tabs / 88 sections**.
 
 ### Shipped
 
@@ -109,6 +109,29 @@ moved from Scale to Security that way.
 | Scale | → Redis & Caching, Cosmos; Front Door moved to Security as Network |
 | Data Lifecycle | **New group.** Retention + Classification pulled from Workspaces, Archiving pulled from Safety |
 | Chat | **New group.** Chat Experience (thoughts from AI Models, file uploads + contents drawer and scope lock from Workspaces), Feedback & Alerts (feedback + desktop notifications from Safety) |
+| Appearance | **General dismantled.** → Branding, Notices & Agreements (+ user agreement from Workspaces), Pages & Links (+ external links) |
+| Security | **Safety dismantled.** → Access & Roles, Secrets, Content Safety, Session, Network |
+| Operations | Logging is now Logging & Health, gaining health check and API documentation from General |
+| Help | Gains Support Menu from General |
+
+### Two hardcoded-id traps found and closed
+
+Both were latent breakage that only surfaced because a tab id changed:
+
+- **`openKeyVaultSettings`** in `admin_data_management.js` switched tabs by the
+  literal id `security-tab`. It was dead weight anyway — the link now carries
+  `data-admin-link` and `admin_card_links.js` resolves the tab from the DOM.
+- **The landing pane** was `show active` hardcoded in one pane's markup and
+  `showAdminTab('general')` hardcoded in the sidebar script. Splitting that
+  pane left Admin Settings with **no active pane at all**. Every pane now
+  renders `{% if admin_landing_tab == '<id>' %} show active{% endif %}`, fed by
+  `get_landing_tab_id()`, and the sidebar reads the first rendered tab.
+
+**Assert durable properties, not current ids.** Four test files hardcoded
+`general` or `security` and had to be rewritten to assert what actually matters
+— Latest Features is last, exactly one pane is active, every tab renders one
+pane. Any new test that names a tab id will need the same treatment next time.
+
 
 ### The cross-pane move tool
 
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index 3d12d8127..8380fa7a2 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,38 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](/explanation/features/) and [Fixes by Version](/explanation/fixes/).
 
+### **(v0.260.013)**
+
+#### User Interface Enhancements
+
+*   **General Tab Broken Up Into Focused Tabs**
+    *   General had grown into a catch-all of eleven unrelated cards: branding sat next to health checks, API documentation, terms of use and system settings.
+    *   Appearance now has **Branding** (branding, home page text, appearance), **Notices & Agreements** (classification banner, chat AI notice, terms of use and the user agreement pulled across from Workspaces) and **Pages & Links** (static pages plus external links).
+    *   Health Check and API Documentation moved to Operations, which is now **Logging & Health** — they report on how the app is running rather than how it looks.
+    *   Support moved to Help as its own **Support Menu** tab, next to Send Feedback.
+    *   (Ref: `branding`, `notices`, `custom-pages`, `logging`, `support-menu`)
+
+*   **Security Split Into Five Purposeful Tabs**
+    *   Security held a single Key Vault card while an unrelated Safety tab mixed content filtering with role permissions, which are different jobs.
+    *   Security is now **Access & Roles** (who gets in and with what role), **Secrets** (Key Vault), **Content Safety** (what may be said once you are in), **Session** (idle timeout and related system settings) and **Network** (Azure Front Door).
+    *   (Ref: `access-roles`, `secrets`, `content-safety`, `session`, `network`)
+
+#### Bug Fixes
+
+*   **"Open Key Vault Settings" Link No Longer Depends On A Hardcoded Tab**
+    *   The link from Data Management to Key Vault switched tabs by a hardcoded id, so it silently stopped working whenever that tab was renamed.
+    *   It now uses the standard card link, which finds the owning tab from the page itself and stays correct however the settings are grouped.
+    *   (Ref: `data-management-key-vault-link`, `admin_card_links.js`, `admin_data_management.js`)
+
+*   **Admin Settings Always Opens On A Real Tab**
+    *   The tab shown on arrival was pinned to a specific id in both the markup and the sidebar script. Regrouping settings could leave Admin Settings opening with no tab selected at all.
+    *   The landing tab is now taken from the navigation map, so it follows the settings and can never be Latest Features.
+    *   (Ref: `admin_landing_tab`, `get_landing_tab_id`, `admin_sidebar_nav.js`)
+
+*   **Stale Tab Names In Latest Features**
+    *   Several Latest Features entries pointed readers at tabs by their old names after the settings moved.
+    *   (Ref: `latest-features` pane)
+
 ### **(v0.260.012)**
 
 #### User Interface Enhancements
diff --git a/functional_tests/test_admin_latest_features_tab.py b/functional_tests/test_admin_latest_features_tab.py
index 322bfea1a..31d96dfc4 100644
--- a/functional_tests/test_admin_latest_features_tab.py
+++ b/functional_tests/test_admin_latest_features_tab.py
@@ -341,7 +341,7 @@ def test_latest_features_sidebar_navigation():
     # Tab order is defined once in the nav map, which the sidebar renders from,
     # so ordering is asserted there rather than against the rendered markup.
     tab_ids = get_tab_ids()
-    assert tab_ids.index('latest-features') > tab_ids.index('general'), 'Latest Features should appear after General'
+    assert tab_ids[-1] == 'latest-features', 'Latest Features should be the last destination of all'
     assert tab_ids.index('latest-features') > tab_ids.index('send-feedback'), 'Latest Features should be the last destination, after Send Feedback'
 
     print('Latest Features sidebar navigation is present')
@@ -372,10 +372,18 @@ def test_latest_features_top_nav_priority():
     )
 
     # Latest Features opened on every visit to Admin Settings, which is why it
-    # is pinned last and General is the landing tab instead.
-    assert 'class="tab-pane fade" id="latest-features" role="tabpanel" aria-labelledby="latest-features-tab"' in template_content, 'Latest Features pane should not be the default active tab'
-    assert 'class="tab-pane fade show active" id="general" role="tabpanel" aria-labelledby="general-tab"' in template_content, 'General pane should be the default active tab'
-    assert tab_ids[0] == 'general', 'General should be the first tab in the navigation map'
+    # is pinned last. The landing pane is not hardcoded: every pane derives its
+    # active state from admin_landing_tab, which is the first tab of the first
+    # group, so regrouping cards can never leave Admin Settings with no pane
+    # showing or with Latest Features showing.
+    assert '<div class="tab-pane fade{% if admin_landing_tab == \'latest-features\' %} show active{% endif %}" id="latest-features"' in template_content, (
+        'Latest Features pane should derive its active state from the nav map like every other pane'
+    )
+    landing_tab = tab_ids[0]
+    assert landing_tab != 'latest-features', 'Latest Features must never be the landing tab'
+    assert f'<div class="tab-pane fade{{% if admin_landing_tab == \'{landing_tab}\' %}} show active{{% endif %}}" id="{landing_tab}"' in template_content, (
+        f"The first tab in the navigation map ('{landing_tab}') should render the landing pane conditional"
+    )
 
     print('Latest Features is last in navigation and not default active')
     return True
@@ -392,8 +400,21 @@ def test_admin_settings_tab_uniqueness():
     duplicates = sorted({t for t in tab_ids if tab_ids.count(t) > 1})
     assert not duplicates, f'Tabs listed more than once in the nav map: {duplicates}'
 
-    assert template_content.count('id="security" role="tabpanel"') == 1, 'Security tab pane should appear exactly once'
-    assert template_content.count('tab-pane fade show active') == 1, 'Only one tab pane should be marked show active'
+    # Every tab in the map must render exactly one pane. Checking all of them
+    # is stronger than naming one tab, and cannot go stale as tabs are renamed.
+    for tab_id in tab_ids:
+        pane_count = template_content.count(f'id="{tab_id}" role="tabpanel"')
+        assert pane_count == 1, f"Tab pane '{tab_id}' should appear exactly once, found {pane_count}"
+    # No pane may hardcode the active state; exactly one resolves it at render
+    # time from the nav map.
+    assert template_content.count('tab-pane fade show active') == 0, (
+        'No pane should hardcode "show active"; it is derived from admin_landing_tab'
+    )
+    landing_conditionals = template_content.count("{% if admin_landing_tab == '")
+    assert landing_conditionals == len(tab_ids), (
+        f'Every one of the {len(tab_ids)} panes should derive its active state '
+        f'from admin_landing_tab, found {landing_conditionals}'
+    )
     assert 'Managesecuritysettingsforkeyvaultandothersecurityconfigurations.</p>' in normalized_template, 'Security intro paragraph should be properly closed'
 
     # Every tab in the map must have a pane to activate.
diff --git a/functional_tests/test_admin_settings_nav_map.py b/functional_tests/test_admin_settings_nav_map.py
index ce015c6f6..0754dddf9 100644
--- a/functional_tests/test_admin_settings_nav_map.py
+++ b/functional_tests/test_admin_settings_nav_map.py
@@ -143,14 +143,23 @@ def test_latest_features_stays_last():
     assert tab_ids[-1] == "latest-features", (
         f"Latest Features must be the last tab, got '{tab_ids[-1]}'"
     )
-    assert tab_ids[0] == "general", (
-        f"General must be the first tab, got '{tab_ids[0]}'"
-    )
     assert ADMIN_NAV[-1]["id"] == "help", (
         "Latest Features should sit in the last group"
     )
 
-    print("Latest Features is last; General leads.")
+    # The landing tab is whatever the map lists first, so it moves freely as the
+    # information architecture changes. What must never drift is that the admin
+    # does not land on Latest Features, which is the whole point of the move.
+    assert tab_ids[0] != "latest-features", (
+        "Latest Features must never be the landing tab"
+    )
+    assert ADMIN_NAV[0]["tabs"], "The first group must expose at least one tab"
+    assert tab_ids[0] == ADMIN_NAV[0]["tabs"][0]["id"], (
+        "The landing tab must be the first tab of the first group, so the "
+        "sidebar and the tab strip agree on where an admin lands"
+    )
+
+    print(f"Latest Features is last; '{tab_ids[0]}' leads.")
 
 
 if __name__ == "__main__":
diff --git a/functional_tests/test_admin_source_review_depth_save.py b/functional_tests/test_admin_source_review_depth_save.py
index fa7a602cd..528bf0c0e 100644
--- a/functional_tests/test_admin_source_review_depth_save.py
+++ b/functional_tests/test_admin_source_review_depth_save.py
@@ -41,9 +41,11 @@ def test_source_review_depth_has_single_form_field():
         f"Expected exactly one source_review_max_depth form field, found {depth_field_name_count}."
     )
 
+    # Bound the Latest Features visibility block by its own container rather
+    # than by a neighbouring card, so the check survives cards moving between
+    # tabs during information architecture work.
     latest_features_start = template_content.index('id="support_latest_features_settings"')
-    external_links_start = template_content.index('id="external-links-section"')
-    latest_features_section = template_content[latest_features_start:external_links_start]
+    latest_features_section = template_content[latest_features_start:latest_features_start + 8000]
 
     assert 'name="source_review_max_depth"' not in latest_features_section, (
         "Latest Features visibility controls must not post source_review_max_depth."
diff --git a/functional_tests/test_data_management_security_patterns.py b/functional_tests/test_data_management_security_patterns.py
index 422e3dfbf..284c123be 100644
--- a/functional_tests/test_data_management_security_patterns.py
+++ b/functional_tests/test_data_management_security_patterns.py
@@ -345,7 +345,6 @@ def test_admin_javascript_uses_safe_dom_patterns():
     for required_snippet in [
         'document.createElement("tr")',
         'document.createElement("td")',
-        'openKeyVaultSettings',
         'buildMigrationPlan()',
         'queueMigration(false)',
         'loadMigrationCatalog(targetType, "reset")',