diff --git a/application/single_app/admin_settings_nav.py b/application/single_app/admin_settings_nav.py
index 00dd71d46..b5c8b5e6f 100644
--- a/application/single_app/admin_settings_nav.py
+++ b/application/single_app/admin_settings_nav.py
@@ -19,29 +19,35 @@
         "icon": "bi-palette",
         "tabs": [
             {
-                "id": "general",
-                "label": "General",
-                "icon": "bi-gear",
+                "id": "branding",
+                "label": "Branding",
+                "icon": "bi-palette",
                 "sections": [
                     {"id": "branding-section", "label": "Branding", "icon": "bi-palette"},
                     {"id": "home-page-text-section", "label": "Home Page Text", "icon": "bi-house"},
                     {"id": "appearance-section", "label": "Appearance", "icon": "bi-brush"},
-                    {"id": "health-check-section", "label": "Health Check", "icon": "bi-heart-pulse"},
-                    {"id": "swagger-section", "label": "API Documentation", "icon": "bi-file-earmark-code"},
+                ],
+            },
+            {
+                # Everything the app states to the user before or during use:
+                # banners, notices and the agreements they must accept.
+                "id": "notices",
+                "label": "Notices & Agreements",
+                "icon": "bi-megaphone",
+                "sections": [
                     {"id": "classification-banner-section", "label": "Classification Banner", "icon": "bi-shield-exclamation"},
                     {"id": "ai-notice-section", "label": "Chat AI Notice", "icon": "bi-robot"},
                     {"id": "terms-of-use-section", "label": "Terms of Use", "icon": "bi-door-open"},
-                    {"id": "support-menu-section", "label": "Support", "icon": "bi-life-preserver"},
-                    {"id": "external-links-section", "label": "External Links", "icon": "bi-box-arrow-up-right"},
-                    {"id": "system-settings-section", "label": "System Settings", "icon": "bi-gear-fill"},
+                    {"id": "user-agreement-section", "label": "User Agreement", "icon": "bi-file-earmark-check"},
                 ],
             },
             {
                 "id": "custom-pages",
-                "label": "Custom Pages",
+                "label": "Pages & Links",
                 "icon": "bi-window-plus",
                 "sections": [
                     {"id": "custom-pages-section", "label": "Static Pages", "icon": "bi-file-earmark-richtext"},
+                    {"id": "external-links-section", "label": "External Links", "icon": "bi-box-arrow-up-right"},
                 ],
             },
         ],
@@ -93,7 +99,6 @@
                 "icon": "bi-cpu",
                 "sections": [
                     {"id": "multi-endpoint-configuration", "label": "Model Endpoints", "icon": "bi-hdd-network"},
-                    {"id": "shared-conversation-file-approvals-section", "label": "Shared Conversation File Approvals", "icon": "bi-file-earmark-lock"},
                     {"id": "embeddings-config", "label": "Embeddings", "icon": "bi-vector-pen"},
                     {"id": "image-config", "label": "Image Generation", "icon": "bi-image"},
                     {"id": "gpt-config", "label": "Chat Model", "icon": "bi-chat-square-text"},
@@ -126,19 +131,25 @@
         "icon": "bi-folder",
         "tabs": [
             {
-                "id": "workspaces",
-                "label": "Workspaces",
+                "id": "workspace-types",
+                "label": "Workspace Types",
                 "icon": "bi-folder",
                 "sections": [
                     {"id": "personal-workspaces-section", "label": "Personal Workspaces", "icon": "bi-person"},
-                    {"id": "workflow-settings-section", "label": "Workflow", "icon": "bi-diagram-3"},
-                    {"id": "file-download-settings-section", "label": "File Downloads", "icon": "bi-download"},
                     {"id": "group-workspaces-section", "label": "Group Workspaces", "icon": "bi-people"},
                     {"id": "public-workspaces-section", "label": "Public Workspaces", "icon": "bi-globe"},
+                ],
+            },
+            {
+                # Who may take a file out of a workspace, and who must approve
+                # it first.
+                "id": "files-sharing",
+                "label": "Files & Sharing",
+                "icon": "bi-share",
+                "sections": [
+                    {"id": "file-download-settings-section", "label": "File Downloads", "icon": "bi-download"},
                     {"id": "file-sharing-section", "label": "File Sharing", "icon": "bi-share"},
-                    {"id": "metadata-extraction-section", "label": "Metadata Extraction", "icon": "bi-file-earmark-code"},
-                    {"id": "multimodal-vision-section", "label": "Multi-Modal Vision Analysis", "icon": "bi-eye"},
-                    {"id": "user-agreement-section", "label": "User Agreement", "icon": "bi-file-earmark-check"},
+                    {"id": "shared-conversation-file-approvals-section", "label": "Shared Conversation File Approvals", "icon": "bi-check2-square"},
                 ],
             },
             {
@@ -149,22 +160,65 @@
             },
         ],
     },
+    {
+        # Workflow drives approvals and assignment across workspaces and is
+        # large enough to stand on its own rather than sit inside Workspaces.
+        "id": "workflow",
+        "label": "Workflow",
+        "icon": "bi-diagram-3",
+        "tabs": [
+            {
+                "id": "workflow",
+                "label": "Workflow",
+                "icon": "bi-diagram-3",
+                "sections": [
+                    {"id": "workflow-settings-section", "label": "Workflow", "icon": "bi-diagram-3"},
+                ],
+            },
+        ],
+    },
     {
         "id": "knowledge",
         "label": "Knowledge",
         "icon": "bi-search",
         "tabs": [
             {
-                "id": "search-extract",
-                "label": "Search & Extract",
-                "icon": "bi-search",
+                # Reaching outside the tenant for material.
+                "id": "web-research",
+                "label": "Web & Research",
+                "icon": "bi-globe",
                 "sections": [
                     {"id": "web-search-section", "label": "Web Search", "icon": "bi-globe"},
                     {"id": "url-access-section", "label": "URL Access", "icon": "bi-link-45deg"},
                     {"id": "source-review-section", "label": "Deep Research", "icon": "bi-binoculars"},
+                ],
+            },
+            {
+                "id": "search-index",
+                "label": "Search Index",
+                "icon": "bi-search",
+                "sections": [
                     {"id": "azure-ai-search-section", "label": "Azure AI Search", "icon": "bi-search"},
+                ],
+            },
+            {
+                # Turning a document into something searchable.
+                "id": "extraction",
+                "label": "Document Extraction",
+                "icon": "bi-file-earmark-text",
+                "sections": [
                     {"id": "document-intelligence-section", "label": "Document Intelligence", "icon": "bi-file-earmark-text"},
                     {"id": "chunk-size-section", "label": "Chunk Sizes", "icon": "bi-collection"},
+                    {"id": "metadata-extraction-section", "label": "Metadata Extraction", "icon": "bi-file-earmark-code"},
+                    {"id": "multimodal-vision-section", "label": "Multi-Modal Vision Analysis", "icon": "bi-eye"},
+                ],
+            },
+            {
+                # Voice and video are extraction pipelines, not chat features.
+                "id": "audio-video",
+                "label": "Audio & Video",
+                "icon": "bi-play-circle",
+                "sections": [
                     {"id": "video-intelligence-section", "label": "AI Video Intelligence", "icon": "bi-play-circle"},
                     {"id": "ai-voice-chat-section", "label": "AI Voice Conversations", "icon": "bi-mic"},
                 ],
@@ -189,20 +243,40 @@
         "icon": "bi-shield-lock",
         "tabs": [
             {
-                "id": "security",
-                "label": "Security",
-                "icon": "bi-shield-lock",
+                # Who can get in and what role they need. Distinct from Content
+                # Safety, which is about what may be said once you are in.
+                "id": "access-roles",
+                "label": "Access & Roles",
+                "icon": "bi-person-check",
+                "sections": [
+                    {"id": "permissions-section", "label": "Permissions", "icon": "bi-person-check"},
+                ],
+            },
+            {
+                "id": "secrets",
+                "label": "Secrets",
+                "icon": "bi-safe",
                 "sections": [
                     {"id": "keyvault-section", "label": "Key Vault", "icon": "bi-safe"},
                 ],
             },
             {
-                "id": "safety",
-                "label": "Safety",
-                "icon": "bi-shield-check",
+                "id": "content-safety",
+                "label": "Content Safety",
+                "icon": "bi-shield-exclamation",
                 "sections": [
                     {"id": "content-safety-section", "label": "Content Safety", "icon": "bi-shield-exclamation"},
-                    {"id": "permissions-section", "label": "Permissions", "icon": "bi-person-check"},
+                ],
+            },
+            {
+                # Interim home for the mixed System Settings card. Four of its
+                # eight fields are idle-timeout, which is the plurality; the
+                # rest are split out to their real homes in a later change.
+                "id": "session",
+                "label": "Session",
+                "icon": "bi-hourglass-split",
+                "sections": [
+                    {"id": "system-settings-section", "label": "System Settings", "icon": "bi-sliders"},
                 ],
             },
             {
@@ -348,12 +422,14 @@
             },
             {
                 "id": "logging",
-                "label": "Logging",
+                "label": "Logging & Health",
                 "icon": "bi-journal-text",
                 "sections": [
                     {"id": "application-insights-section", "label": "Application Insights", "icon": "bi-graph-up"},
                     {"id": "debug-logging-section", "label": "Debug Logging", "icon": "bi-bug"},
                     {"id": "file-processing-logs-section", "label": "File Process Logging", "icon": "bi-file-earmark-text"},
+                    {"id": "health-check-section", "label": "Health Check", "icon": "bi-heart-pulse"},
+                    {"id": "swagger-section", "label": "API Documentation", "icon": "bi-file-earmark-code"},
                 ],
             },
         ],
@@ -363,6 +439,16 @@
         "label": "Help",
         "icon": "bi-life-preserver",
         "tabs": [
+            {
+                # Where an admin looks first when a user needs help, ahead of
+                # raising it with the project.
+                "id": "support-menu",
+                "label": "Support Menu",
+                "icon": "bi-life-preserver",
+                "sections": [
+                    {"id": "support-menu-section", "label": "Support", "icon": "bi-life-preserver"},
+                ],
+            },
             {
                 "id": "send-feedback",
                 "label": "Send Feedback",
@@ -408,6 +494,18 @@ def get_group_for_tab(tab_id):
     return None
 
 
+def get_landing_tab_id():
+    """Return the tab an admin lands on when no tab is requested.
+
+    This is the first tab of the first group rather than a fixed id, so the
+    landing pane follows the navigation map as cards are regrouped. Latest
+    Features is pinned last precisely so it can never win this.
+    """
+    for _, tab in iter_tabs():
+        return tab["id"]
+    return None
+
+
 def get_section_ids():
     """Return every section target declared across the navigation."""
     return [
diff --git a/application/single_app/app.py b/application/single_app/app.py
index 35cc2d336..d8f837e33 100644
--- a/application/single_app/app.py
+++ b/application/single_app/app.py
@@ -31,7 +31,7 @@
 from functions_content import *
 from functions_documents import *
 from functions_latest_features_nav import should_hide_latest_features_nav
-from admin_settings_nav import ADMIN_NAV
+from admin_settings_nav import ADMIN_NAV, get_landing_tab_id
 from functions_search import *
 from functions_settings import *
 from functions_mcp_server_config import is_mcp_ui_enabled
@@ -600,6 +600,7 @@ def inject_settings():
         user_settings=user_settings,
         custom_pages_nav=custom_pages_nav,
         admin_nav=ADMIN_NAV,
+        admin_landing_tab=get_landing_tab_id(),
         latest_features_current_version=VERSION,
         latest_features_nav_hidden=latest_features_nav_hidden,
         latest_features_nav_hidden_by_development=IS_DEVELOPMENT,
diff --git a/application/single_app/config.py b/application/single_app/config.py
index 0244ed3e0..992744396 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -96,7 +96,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.260.012"
+VERSION = "0.260.014"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax')
diff --git a/application/single_app/static/js/admin/admin_data_management.js b/application/single_app/static/js/admin/admin_data_management.js
index 481b2069f..e8c2761a9 100644
--- a/application/single_app/static/js/admin/admin_data_management.js
+++ b/application/single_app/static/js/admin/admin_data_management.js
@@ -388,7 +388,8 @@ function bindEvents() {
         pendingDataManagementBackupDelete = null;
     });
     elements.dataManagementConfirmBackupDeleteBtn?.addEventListener("click", deleteDataManagementBackup);
-    elements.dataManagementKeyVaultLink?.addEventListener("click", openKeyVaultSettings);
+    // The Key Vault link carries data-admin-link, so admin_card_links.js
+    // resolves the owning tab from the DOM and scrolls to the card.
     elements.dataManagementCosmosEditorOpenDangerBtn?.addEventListener("click", showCosmosEditorDangerModal);
     elements.datamanagementcosmoseditordangeraccept?.addEventListener("change", updateCosmosEditorDangerAcceptState);
     elements.dataManagementCosmosEditorAcceptDangerBtn?.addEventListener("click", acceptCosmosEditorDanger);
@@ -909,20 +910,6 @@ function setKeyStorageAlert(variant, iconClass, title, message, linkText) {
     setText(elements.dataManagementKeyVaultLink, linkText);
 }
 
-function openKeyVaultSettings(event) {
-    event?.preventDefault();
-    const securityTabButton = document.getElementById("security-tab");
-    if (securityTabButton && window.bootstrap?.Tab) {
-        window.bootstrap.Tab.getOrCreateInstance(securityTabButton).show();
-    } else if (securityTabButton) {
-        securityTabButton.click();
-    }
-    window.location.hash = "security";
-    window.setTimeout(() => {
-        document.getElementById("keyvault-section")?.scrollIntoView({ block: "start", behavior: "smooth" });
-    }, 100);
-}
-
 function collectSettings() {
     const backupStorageAuthenticationType = getValue(elements.datamanagementstorageauth) || backupStorageAuthManagedIdentity;
     return {
diff --git a/application/single_app/static/js/admin/admin_sidebar_nav.js b/application/single_app/static/js/admin/admin_sidebar_nav.js
index edad020d8..7e9538f73 100644
--- a/application/single_app/static/js/admin/admin_sidebar_nav.js
+++ b/application/single_app/static/js/admin/admin_sidebar_nav.js
@@ -145,12 +145,15 @@ function initAdminSidebarNav() {
     
     // Set the initial active tab - but only if no tab is already active.
     // Latest Features is deliberately excluded so it never opens by default.
+    // The landing tab is whichever tab the nav map renders first rather than a
+    // hardcoded id, so it stays correct as the information architecture moves.
     const activeTab = document.querySelector('.admin-nav-tab.active, .admin-nav-section.active');
     if (!activeTab) {
-        const firstTab = document.querySelector('.admin-nav-tab[data-tab="general"]');
-        if (firstTab) {
+        const firstTab = document.querySelector('.admin-nav-tab[data-tab]');
+        const firstTabId = firstTab ? firstTab.getAttribute('data-tab') : null;
+        if (firstTabId) {
             firstTab.classList.add('active');
-            showAdminTab('general');
+            showAdminTab(firstTabId);
         }
     } else {
         console.log('initAdminSidebarNav - Found existing active tab, preserving current state:', activeTab.getAttribute('data-tab'));
@@ -288,6 +291,11 @@ function revealAdminGroupForTab(tabId) {
 const LEGACY_TAB_REDIRECTS = {
     'governance': 'feature-governance',
     'scale': 'redis-caching',
+    'general': 'branding',
+    'safety': 'access-roles',
+    'security': 'secrets',
+    'workspaces': 'workspace-types',
+    'search-extract': 'web-research',
 };
 
 function resolveAdminTabId(tabId) {
diff --git a/application/single_app/templates/admin/_panes/access-roles.html b/application/single_app/templates/admin/_panes/access-roles.html
new file mode 100644
index 000000000..3e93d9ff7
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/access-roles.html
@@ -0,0 +1,49 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'access-roles' %} show active{% endif %}" id="access-roles" role="tabpanel" aria-labelledby="access-roles-tab">
+                <div class="card p-3 mb-3" id="permissions-section"
+                    data-requires="enable_user_feedback"
+                    data-requires-label="User Feedback"
+                    data-requires-target="user-feedback-section"
+                    data-requires-scope="#require_member_of_feedback_admin"
+                    data-requires-description="The FeedbackAdmin role only controls access to the User Feedback report, so it does nothing until User Feedback is enabled.">
+                    <h5>
+                        <i class="bi bi-person-check me-2"></i>Permissions
+                    </h5>
+                    <p class="text-muted">Control which users can access specific administrative views related to safety and feedback.</p>
+
+
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_safety_violation_admin"
+                            name="require_member_of_safety_violation_admin"
+                            {% if settings.require_member_of_safety_violation_admin %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_member_of_safety_violation_admin">
+                            Require SafetyViolationAdmin App Role
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the SafetyViolationAdmin Enterprise App role can access safety violation reports."></i>
+                    </div>
+                     <p class="text-muted small mb-3">
+                        Required app role value: <code>SafetyViolationAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the Safety Violations admin page.
+                    </p>
+
+
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_feedback_admin"
+                            name="require_member_of_feedback_admin"
+                            {% if settings.require_member_of_feedback_admin %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_member_of_feedback_admin">
+                            Require FeedbackAdmin App Role
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the FeedbackAdmin Enterprise App role can access user feedback reports."></i>
+                    </div>
+                     <p class="text-muted small mb-0">
+                        Required app role value: <code>FeedbackAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the User Feedback admin page. Requires <strong>Enable User Feedback</strong> to be active.
+                    </p>
+                </div>
+
+
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/agents.html b/application/single_app/templates/admin/_panes/agents.html
index 5994976d2..622dde43d 100644
--- a/application/single_app/templates/admin/_panes/agents.html
+++ b/application/single_app/templates/admin/_panes/agents.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="agents" role="tabpanel" aria-labelledby="agents-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'agents' %} show active{% endif %}" id="agents" role="tabpanel" aria-labelledby="agents-tab">
 
                 <p class="text-muted">
                     Configure AI agents and actions for enhanced functionality. Agents provide AI-driven task automation while Actions extend functionality with custom tools and integrations.
diff --git a/application/single_app/templates/admin/_panes/ai-models.html b/application/single_app/templates/admin/_panes/ai-models.html
index f12b06236..98e6590d4 100644
--- a/application/single_app/templates/admin/_panes/ai-models.html
+++ b/application/single_app/templates/admin/_panes/ai-models.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="ai-models" role="tabpanel" aria-labelledby="ai-models-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'ai-models' %} show active{% endif %}" id="ai-models" role="tabpanel" aria-labelledby="ai-models-tab">
 
                 <p class="text-muted">
                     Configure all AI model settings including GPT for text generation, embeddings for semantic search, and image generation capabilities.
@@ -235,27 +235,6 @@ <h6 class="mb-0">Global Endpoints</h6>
                     {% endif %}
                 </div>
 
-                <!-- Processing Thoughts Section -->
-                <div class="card p-3 mb-4" id="shared-conversation-file-approvals-section">
-                    <h5>
-                        <i class="bi bi-file-earmark-lock me-2"></i>Shared Conversation File Approvals
-                    </h5>
-                    <p class="text-muted">Files generated by participants in a shared conversation are saved into the conversation owner's storage. When enabled, those files are held until an approver releases them.</p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="require_shared_conversation_file_approval"
-                            name="require_shared_conversation_file_approval"
-                            {% if settings.require_shared_conversation_file_approval %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="require_shared_conversation_file_approval">
-                            Require approval for participant-generated files
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When a participant who does not own a shared conversation generates a downloadable file (CSV, XLSX, DOCX, PDF, JSON, XML), the file is created but withheld until the conversation owner approves it. In group conversations, any group Owner, Admin, or Document Manager can approve. Unapproved files are automatically declined and deleted after 3 days. Generated images and charts are never gated."></i>
-                    </div>
-                </div>
-
                 <!-- Embeddings Configuration Section -->
                 <div class="card p-3 mb-4" id="embeddings-configuration">
                     <h5 class="card-title">
diff --git a/application/single_app/templates/admin/_panes/archiving.html b/application/single_app/templates/admin/_panes/archiving.html
index 0d56b6223..d2943f47d 100644
--- a/application/single_app/templates/admin/_panes/archiving.html
+++ b/application/single_app/templates/admin/_panes/archiving.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="archiving" role="tabpanel" aria-labelledby="archiving-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'archiving' %} show active{% endif %}" id="archiving" role="tabpanel" aria-labelledby="archiving-tab">
                 <div class="card p-3 mb-3" id="conversation-archiving-section">
                     <h5>
                         <i class="bi bi-archive me-2"></i>Conversation Archiving
diff --git a/application/single_app/templates/admin/_panes/audio-video.html b/application/single_app/templates/admin/_panes/audio-video.html
new file mode 100644
index 000000000..fba46cabe
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/audio-video.html
@@ -0,0 +1,472 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'audio-video' %} show active{% endif %}" id="audio-video" role="tabpanel" aria-labelledby="audio-video-tab">
+                <div class="card p-4 mb-4 border-info shadow-sm" id="video-intelligence-section">
+                    <div class="d-flex align-items-center justify-content-between mb-3">
+                        <div class="d-flex align-items-center">
+                            <div class="bg-info text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
+                                <i class="bi bi-camera-video-fill fs-4"></i>
+                            </div>
+                            <div>
+                                <h4 class="mb-1">
+                                    <i class="bi bi-play-circle me-2"></i>AI Video Intelligence
+                                </h4>
+                                <p class="text-muted mb-0 small">Extract insights and make video content searchable and interactive</p>
+                            </div>
+                        </div>
+                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#videoIndexerInfoModal">
+                            <i class="bi bi-info-circle me-1"></i>Setup Guide
+                        </button>
+                    </div>
+
+                    <div class="alert alert-info mb-4">
+                        <i class="bi bi-lightbulb-fill me-2"></i>
+                        <strong>Make Video Content Fully Searchable:</strong> Upload videos to your workspace and automatically extract transcripts, identify speakers, detect topics, and generate searchable timestamps. Your AI can then answer questions about video content, cite specific moments, and provide deep insights.
+                    </div>
+
+                    <!-- Video File Support Toggle -->
+                    <div class="mb-4">
+                        <div class="form-check form-switch mb-2">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="enable_video_file_support"
+                                name="enable_video_file_support"
+                                {% if settings.enable_video_file_support %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2 fw-bold" for="enable_video_file_support">
+                                <i class="bi bi-camera-video me-1"></i> Enable Video File Upload & Processing
+                            </label>
+                        </div>
+                        <p class="text-muted small ms-4 ps-3 mb-2">
+                            Upload video files (MP4, AVI, MOV, etc.) to workspaces where Azure Video Indexer automatically processes them.
+                            Extract spoken content, identify speakers, detect faces, recognize brands, and generate searchable metadata—perfect for meetings, presentations, training videos, and recorded content.
+                        </p>
+                        <div class="ms-4 ps-3">
+                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
+                                <i class="bi bi-search me-1"></i> Full-Text Search
+                            </span>
+                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
+                                <i class="bi bi-person-badge me-1"></i> Speaker ID
+                            </span>
+                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
+                                <i class="bi bi-clock-history me-1"></i> Timestamped Citations
+                            </span>
+                            <span class="badge bg-primary-subtle text-primary-emphasis">
+                                <i class="bi bi-translate me-1"></i> Multi-Language
+                            </span>
+                        </div>
+                    </div>
+
+                    {% set public_video_indexer_endpoint = "https://api.videoindexer.ai" %}
+                    {% set government_video_indexer_endpoint = "https://api.videoindexer.ai.azure.us" %}
+                    {% set configured_video_indexer_endpoint = settings.video_indexer_endpoint or default_video_indexer_endpoint %}
+                    {% if configured_video_indexer_endpoint == government_video_indexer_endpoint %}
+                        {% set video_indexer_cloud = "usgovernment" %}
+                    {% elif configured_video_indexer_endpoint == public_video_indexer_endpoint %}
+                        {% set video_indexer_cloud = "public" %}
+                    {% else %}
+                        {% set video_indexer_cloud = "custom" %}
+                    {% endif %}
+                    {% if azure_environment == "usgovernment" %}
+                        {% set azure_environment_label = "Azure Government" %}
+                    {% elif azure_environment == "custom" %}
+                        {% set azure_environment_label = "Custom Cloud" %}
+                    {% else %}
+                        {% set azure_environment_label = "Azure Public / Commercial" %}
+                    {% endif %}
+
+                    <!-- Video Indexer Configuration (collapsible) -->
+                    <div id="video_indexer_settings" class="border-top pt-3{% if not settings.enable_video_file_support %} d-none{% endif %}">
+                        <h5 class="mb-3">
+                            <i class="bi bi-gear-fill me-2"></i>Azure Video Indexer Configuration
+                        </h5>
+                        <p class="text-muted small mb-3">Connect to your Azure Video Indexer resource for advanced video processing and content extraction.</p>
+
+                        <div class="alert alert-info">
+                            <strong><i class="bi bi-info-circle"></i> Identity overview:</strong>
+                            <ul class="mb-0 mt-2">
+                                <li>Video Indexer can use its own managed identity to reach the linked Storage account during account creation.</li>
+                                <li>SimpleChat authenticates to Video Indexer with the <strong>App Service system-assigned managed identity</strong>.</li>
+                                <li>The App Service managed identity must have <strong>Contributor</strong> on the Video Indexer resource.</li>
+                                <li>See <a href="https://learn.microsoft.com/azure/azure-video-indexer/connect-to-azure" target="_blank">Azure Video Indexer documentation</a> for setup details</li>
+                            </ul>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_cloud" class="form-label">Cloud / Endpoint Mode</label>
+                            <select
+                                class="form-select"
+                                id="video_indexer_cloud"
+                                data-public-endpoint="{{ public_video_indexer_endpoint }}"
+                                data-government-endpoint="{{ government_video_indexer_endpoint }}"
+                                data-runtime-cloud="{{ azure_environment }}"
+                            >
+                                <option value="public" {% if video_indexer_cloud == 'public' %}selected{% endif %}>Azure Public / Commercial</option>
+                                <option value="usgovernment" {% if video_indexer_cloud == 'usgovernment' %}selected{% endif %}>Azure Government</option>
+                                <option value="custom" {% if video_indexer_cloud == 'custom' %}selected{% endif %}>Custom Endpoint</option>
+                            </select>
+                            <div class="form-text">Choose the endpoint family that matches your deployed cloud. Use Custom only when you need a non-standard Video Indexer endpoint.</div>
+                        </div>
+
+                        <div class="alert alert-secondary py-2">
+                            <strong>Current App Service environment:</strong> {{ azure_environment_label }}. This selector saves the Video Indexer API endpoint. If you are switching between Azure Public, Azure Government, or a custom cloud, update <code>AZURE_ENVIRONMENT</code> in your App Service configuration as well.
+                        </div>
+
+                        <div class="alert alert-warning py-2 mb-3 d-none" id="video_indexer_cloud_mismatch_alert">
+                            The selected Video Indexer cloud does not match this app's current <code>AZURE_ENVIRONMENT</code>. Update the App Service configuration if you are moving to a different cloud.
+                        </div>
+
+                        <input type="hidden" id="video_indexer_endpoint" name="video_indexer_endpoint" value="{{ configured_video_indexer_endpoint }}" />
+
+                        <div class="mb-3{% if video_indexer_cloud != 'custom' %} d-none{% endif %}" id="video_indexer_custom_endpoint_group">
+                            <label for="video_indexer_custom_endpoint" class="form-label">Custom API Endpoint</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="video_indexer_custom_endpoint"
+                                value="{% if video_indexer_cloud == 'custom' %}{{ configured_video_indexer_endpoint }}{% endif %}"
+                                placeholder="https://your-video-indexer-endpoint.example.com"
+                            />
+                            <div class="form-text">Only required when using a custom cloud or non-standard Video Indexer endpoint.</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_endpoint_display" class="form-label">Effective API Endpoint</label>
+                            <input type="text" class="form-control" id="video_indexer_endpoint_display" value="{{ configured_video_indexer_endpoint }}" readonly />
+                            <div class="form-text">Saved endpoint value used for Video Indexer API calls.</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_resource_group" class="form-label">Resource Group <span class="text-danger">*</span></label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_resource_group" name="video_indexer_resource_group"
+                                value="{{ settings.video_indexer_resource_group or '' }}"
+                                placeholder="e.g., rg-videoindexer-prod">
+                            <div class="form-text">The Azure resource group containing your Video Indexer account</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_subscription_id" class="form-label">Subscription ID <span class="text-danger">*</span></label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_subscription_id" name="video_indexer_subscription_id"
+                                value="{{ settings.video_indexer_subscription_id or '' }}"
+                                placeholder="e.g., 12345678-1234-1234-1234-123456789abc">
+                            <div class="form-text">Your Azure subscription ID</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_account_name" class="form-label">Account Name <span class="text-danger">*</span></label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_account_name" name="video_indexer_account_name"
+                                value="{{ settings.video_indexer_account_name or '' }}"
+                                placeholder="e.g., my-video-indexer">
+                            <div class="form-text">The name of your Video Indexer account resource</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_location" class="form-label">Location <span class="text-danger">*</span></label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_location" name="video_indexer_location"
+                                value="{{ settings.video_indexer_location or '' }}"
+                                placeholder="e.g., eastus">
+                            <div class="form-text">Azure region where your Video Indexer account is deployed (e.g., eastus, westus2, northeurope)</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_account_id" class="form-label">Account ID <span class="text-danger">*</span></label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_account_id" name="video_indexer_account_id"
+                                value="{{ settings.video_indexer_account_id or '' }}"
+                                placeholder="e.g., 12345678-abcd-1234-abcd-123456789abc">
+                            <div class="form-text">Found in the Video Indexer account Overview page in Azure Portal</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_arm_api_version" class="form-label">ARM API Version</label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_arm_api_version" name="video_indexer_arm_api_version"
+                                value="{{ settings.video_indexer_arm_api_version or default_video_indexer_arm_api_version }}">
+                            <div class="form-text">Default for {{ azure_environment_label }}: {{ default_video_indexer_arm_api_version }}</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_index_timeout" class="form-label">Timeout (seconds)</label>
+                            <input type="number" class="form-control"
+                                id="video_index_timeout" name="video_index_timeout"
+                                value="{{ settings.video_index_timeout or 600 }}">
+                        </div>
+                    </div>
+                </div>
+
+                    <!-- AI Voice Chat Card -->
+                    <div class="card p-4 mb-4 border-primary shadow-sm" id="ai-voice-chat-section">
+                        <div class="d-flex align-items-center justify-content-between mb-3">
+                            <div class="d-flex align-items-center">
+                                <div class="bg-primary text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
+                                    <i class="bi bi-mic-fill fs-4"></i>
+                                </div>
+                                <div>
+                                    <h4 class="mb-1">
+                                        <i class="bi bi-soundwave me-2"></i>AI Voice Conversations
+                                    </h4>
+                                    <p class="text-muted mb-0 small">Transform your AI experience with natural voice interactions</p>
+                                </div>
+                            </div>
+                            <button type="button" class="btn btn-outline-primary btn-sm" data-bs-toggle="modal" data-bs-target="#speechServiceInfoModal">
+                                <i class="bi bi-info-circle me-1"></i>Setup Guide
+                            </button>
+                        </div>
+
+                        <!-- AI Response Completion Audio -->
+                        <div class="mb-4">
+                            <div class="form-check form-switch mb-2">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="enable_chat_completion_audio_cues"
+                                    name="enable_chat_completion_audio_cues"
+                                    {% if settings.enable_chat_completion_audio_cues %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2 fw-bold" for="enable_chat_completion_audio_cues">
+                                    <i class="bi bi-bell-fill me-1"></i> Enable AI Response Completion Audio Cues
+                                </label>
+                            </div>
+                            <p class="text-muted small ms-4 ps-3 mb-0">
+                                Let users opt in to a bundled sound when an AI response finishes outside their active view.
+                                These local cues do not require Azure Speech Service.
+                            </p>
+                        </div>
+
+                        <div class="alert alert-info mb-4" id="speech_service_shared_alert">
+                            <i class="bi bi-lightbulb-fill me-2"></i>
+                            <strong>One Speech resource, three features:</strong> Audio file uploads, Voice Input, and Voice Responses all use the same Azure Speech Service section below. Configure the Speech resource once, then turn on whichever speech features you need.
+                        </div>
+
+                        <!-- Audio File Support -->
+                        <div class="mb-4">
+                            {% set audio_runtime = audio_runtime_capabilities or {} %}
+                            {% set audio_supported_extensions = audio_runtime.supported_extensions or [] %}
+                            {% set audio_direct_extensions = audio_runtime.direct_transcription_extensions or [] %}
+                            <div class="form-check form-switch mb-2">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="enable_audio_file_support"
+                                    name="enable_audio_file_support"
+                                    {% if settings.enable_audio_file_support %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2 fw-bold" for="enable_audio_file_support">
+                                    <i class="bi bi-file-earmark-music me-1"></i> Enable Audio File Upload & Processing
+                                </label>
+                            </div>
+                            <p class="text-muted small ms-4 ps-3 mb-0">
+                                Upload audio files (MP3, WAV, M4A, etc.) to workspaces where they're automatically transcribed and indexed.
+                                The AI can then search, analyze, and answer questions about audio content—perfect for meetings, interviews, lectures, and podcasts.
+                            </p>
+                            <div class="ms-4 ps-3 mt-2">
+                                <div class="small {% if audio_runtime.broad_transcoding_available %}text-success{% else %}text-warning{% endif %}" id="audio_runtime_status">
+                                    <i class="bi {% if audio_runtime.broad_transcoding_available %}bi-check-circle{% else %}bi-exclamation-triangle{% endif %} me-1"></i>{{ audio_runtime.message or 'Audio runtime support has not been checked yet.' }}
+                                </div>
+                                <div class="small text-muted mt-1" id="audio_supported_extensions">
+                                    Supported audio upload extensions: {{ audio_supported_extensions|join(', ') }}
+                                </div>
+                                {% if audio_direct_extensions %}
+                                <div class="small text-muted mt-1">
+                                    Without FFmpeg, source-file fallback is best for: {{ audio_direct_extensions|join(', ') }}. Container builds can include FFmpeg for broader codec support.
+                                </div>
+                                {% endif %}
+                            </div>
+                        </div>
+
+                        <!-- Speech-to-Text -->
+                        <div class="mb-4">
+                            <div class="form-check form-switch mb-2">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="enable_speech_to_text_input"
+                                    name="enable_speech_to_text_input"
+                                    {% if settings.enable_speech_to_text_input %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2 fw-bold" for="enable_speech_to_text_input">
+                                    <i class="bi bi-mic me-1"></i> Enable Voice Input (Speech-to-Text)
+                                </label>
+                            </div>
+                            <p class="text-muted small ms-4 ps-3 mb-2">
+                                Talk to your AI instead of typing. Record voice messages up to 90 seconds directly in the chat interface.
+                                Azure Speech Service instantly transcribes your speech with high accuracy, supporting multiple languages and accents.
+                            </p>
+                            <div class="ms-4 ps-3">
+                                <span class="badge bg-success-subtle text-success-emphasis me-2">
+                                    <i class="bi bi-hand-thumbs-up-fill me-1"></i> Hands-Free
+                                </span>
+                                <span class="badge bg-success-subtle text-success-emphasis me-2">
+                                    <i class="bi bi-universal-access me-1"></i> Accessible
+                                </span>
+                                <span class="badge bg-success-subtle text-success-emphasis">
+                                    <i class="bi bi-lightning-fill me-1"></i> Fast Input
+                                </span>
+                            </div>
+                        </div>
+
+                        <!-- Text-to-Speech -->
+                        <div class="mb-4">
+                            <div class="form-check form-switch mb-2">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="enable_text_to_speech"
+                                    name="enable_text_to_speech"
+                                    {% if settings.enable_text_to_speech %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2 fw-bold" for="enable_text_to_speech">
+                                    <i class="bi bi-volume-up me-1"></i> Enable Voice Responses (Text-to-Speech)
+                                </label>
+                            </div>
+                            <p class="text-muted small ms-4 ps-3 mb-2">
+                                Hear AI responses read aloud in natural, human-like voices powered by Azure's advanced neural Text-to-Speech.
+                                Each message includes a speaker button—click to listen while multitasking, commuting, or whenever reading isn't convenient.
+                            </p>
+                            <div class="ms-4 ps-3">
+                                <span class="badge bg-info-subtle text-info-emphasis me-2">
+                                    <i class="bi bi-ear-fill me-1"></i> Natural Voices
+                                </span>
+                                <span class="badge bg-info-subtle text-info-emphasis me-2">
+                                    <i class="bi bi-arrows-fullscreen me-1"></i> Multitask-Friendly
+                                </span>
+                                <span class="badge bg-info-subtle text-info-emphasis">
+                                    <i class="bi bi-globe me-1"></i> Multi-Language
+                                </span>
+                            </div>
+                        </div>
+
+                        <!-- Speech Service Configuration (collapsible) -->
+                        <div id="audio_service_settings" class="border-top pt-3{% if not (settings.enable_audio_file_support or settings.enable_speech_to_text_input or settings.enable_text_to_speech) %} d-none{% endif %}">
+                            <h5 class="mb-3">
+                                <i class="bi bi-gear-fill me-2"></i>Azure Speech Service Configuration
+                            </h5>
+                            <p class="text-muted small mb-3">Configure the shared Azure Speech resource used by audio transcription, voice input, and text-to-speech.</p>
+
+                        <div class="alert alert-info py-2">
+                            <strong>Shared configuration:</strong> These settings apply to all enabled speech features. If you use managed identity and also enable Voice Responses, fill in the Speech Resource ID field so the Speech SDK can authenticate synthesis requests.
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="speech_service_endpoint" class="form-label">Endpoint</label>
+                            <input type="text" class="form-control"
+                                id="speech_service_endpoint" name="speech_service_endpoint"
+                                value="{{ settings.speech_service_endpoint or '' }}"
+                                placeholder="https://<location or custom domain>.cognitiveservices.azure.<com or us>/">
+                            <div class="form-text">Use the resource-specific custom-domain endpoint when selecting Managed Identity.</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="speech_service_location" class="form-label">Location</label>
+                            <input type="text" class="form-control"
+                                id="speech_service_location" name="speech_service_location"
+                                value="{{ settings.speech_service_location or '' }}">
+                            <div class="form-text">Required for speech recognition locale defaults and for text-to-speech when using Managed Identity.</div>
+                        </div>
+
+                        <div class="mb-3{% if settings.speech_service_authentication_type != 'managed_identity' %} d-none{% endif %}" id="speech_service_resource_id_container">
+                            <div class="alert alert-secondary py-2 mb-3">
+                                <strong>Resource ID builder:</strong> If the full ARM resource ID is hard to find in the portal, enter the subscription ID, resource group, and Speech resource name below. Simple Chat can build the resource ID for you.
+                            </div>
+
+                            <div class="row g-3 mb-3">
+                                <div class="col-md-6">
+                                    <label for="speech_service_subscription_id" class="form-label">Speech Subscription ID</label>
+                                    <input type="text" class="form-control"
+                                        id="speech_service_subscription_id" name="speech_service_subscription_id"
+                                        value="{{ settings.speech_service_subscription_id or '' }}"
+                                        placeholder="12345678-1234-1234-1234-123456789abc">
+                                </div>
+                                <div class="col-md-6">
+                                    <label for="speech_service_resource_group" class="form-label">Speech Resource Group</label>
+                                    <input type="text" class="form-control"
+                                        id="speech_service_resource_group" name="speech_service_resource_group"
+                                        value="{{ settings.speech_service_resource_group or '' }}"
+                                        placeholder="rg-speech-prod">
+                                </div>
+                                <div class="col-md-6">
+                                    <label for="speech_service_resource_name" class="form-label">Speech Resource Name</label>
+                                    <input type="text" class="form-control"
+                                        id="speech_service_resource_name" name="speech_service_resource_name"
+                                        value="{{ settings.speech_service_resource_name or '' }}"
+                                        placeholder="my-speech-resource">
+                                    <div class="form-text">If you use a custom-domain Speech endpoint, this is usually the first part of that hostname.</div>
+                                </div>
+                                <div class="col-md-6 d-flex align-items-end">
+                                    <button type="button" class="btn btn-outline-secondary w-100" id="build_speech_resource_id_btn">
+                                        Build Resource ID
+                                    </button>
+                                </div>
+                            </div>
+
+                            <div class="form-text mb-2" id="speech_resource_id_builder_status">Provide Subscription ID, Resource Group, and Speech Resource Name to auto-build the ARM resource ID.</div>
+
+                            <label for="speech_service_resource_id" class="form-label">Speech Resource ID</label>
+                            <input type="text" class="form-control"
+                                id="speech_service_resource_id" name="speech_service_resource_id"
+                                value="{{ settings.speech_service_resource_id or '' }}"
+                                placeholder="/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<speech-resource>">
+                            <div class="form-text">Required for Voice Responses when using Managed Identity. You can paste the full value manually, or let the fields above build it for you.</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="speech_service_locale" class="form-label">Locale</label>
+                            <input type="text" class="form-control"
+                                id="speech_service_locale" name="speech_service_locale"
+                                value="{{ settings.speech_service_locale or '' }}">
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="speech_service_authentication_type" class="form-label">
+                                Authentication Type
+                            </label>
+                            <select class="form-select" id="speech_service_authentication_type" name="speech_service_authentication_type">
+                                <option value="key" {% if settings.speech_service_authentication_type == 'key' or not settings.speech_service_authentication_type %}selected{% endif %}>
+                                    Key
+                                </option>
+                                <option value="managed_identity" {% if settings.speech_service_authentication_type == 'managed_identity' %}selected{% endif %}>
+                                    Managed Identity
+                                </option>
+                            </select>
+                        </div>
+                        <div class="mb-3{% if settings.speech_service_authentication_type == 'managed_identity' %} d-none{% endif %}" id="speech_service_key_container">
+                            <label for="speech_service_key" class="form-label">
+                                API Key
+                            </label>
+                            <div class="input-group">
+                                <input
+                                    type="password"
+                                    class="form-control"
+                                    id="speech_service_key"
+                                    name="speech_service_key"
+                                    value="{{ settings.speech_service_key or '' }}"
+                                >
+                                <button
+                                    type="button"
+                                    class="btn btn-outline-secondary"
+                                    id="toggle_speech_service_key"
+                                >
+                                    Show
+                                </button>
+                            </div>
+                            <div class="form-text">Required only when Authentication Type is set to Key.</div>
+                        </div>
+
+                        <div class="alert alert-secondary mt-3 mb-0">
+                            <strong>Managed identity roles:</strong> Start with <strong>Cognitive Services Speech User</strong>. If fast transcription or other write-style speech operations still return authorization errors, add <strong>Cognitive Services Speech Contributor</strong>. Managed identity also requires a custom-domain endpoint.
+                        </div>
+
+                    </div>
+                    <p class="mt-2 mb-0">
+                        <small class="text-muted">
+                            <a href="#enhanced-citations-section" data-admin-link="enhanced-citations-section">
+                                Enhanced Citations
+                            </a>
+                             will dramatically improve the citation experience for video and audio files.
+                        </small>
+                    </p>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/branding.html b/application/single_app/templates/admin/_panes/branding.html
new file mode 100644
index 000000000..c648c07fa
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/branding.html
@@ -0,0 +1,165 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'branding' %} show active{% endif %}" id="branding" role="tabpanel" aria-labelledby="branding-tab">
+
+                 <p class="text-muted">
+                    Configure general application settings, including the application's title, logo, and landing page text.
+                </p>
+                <div class="card p-3 mb-3" id="branding-section">
+                    <h5>
+                        <i class="bi bi-palette me-2"></i>Branding
+                    </h5>
+                    <p class="text-muted small">
+                        Configure your application's title, logo, and branding elements.
+                    </p>
+                    <div class="mb-3">
+                        <label for="app_title" class="form-label">Application Title</label>
+                        <input type="text" class="form-control" id="app_title" name="app_title" value="{{ settings.app_title }}">
+                    </div>
+                    <h6 class="mt-3">Logo Settings</h6>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox" class="form-check-input" id="show_logo" name="show_logo"
+                            {% if settings.show_logo %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="show_logo">Show Logo</label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display the application logo in the header and navigation areas of the interface."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox" class="form-check-input" id="hide_app_title" name="hide_app_title"
+                            {% if settings.hide_app_title %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="hide_app_title">Hide Application Title</label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Hide the application title from the header and navigation, showing only the logo if enabled."></i>
+                    </div>
+                    <div class="form-group mb-3">
+                        <div class="d-flex justify-content-between align-items-center">
+                            <label for="landing_page_logo_scale_percent" class="form-label mb-0">Main Page Logo Size</label>
+                            <span id="landing-page-logo-scale-value" class="small text-muted fw-semibold">{{ settings.landing_page_logo_scale_percent | default(100) }}%</span>
+                        </div>
+                        <input
+                            type="range"
+                            class="form-range"
+                            id="landing_page_logo_scale_percent"
+                            name="landing_page_logo_scale_percent"
+                            min="50"
+                            max="500"
+                            step="10"
+                            value="{{ settings.landing_page_logo_scale_percent | default(100) }}"
+                            aria-describedby="landing-page-logo-scale-help"
+                        />
+                        <div class="d-flex justify-content-between small text-muted">
+                            <span>50%</span>
+                            <span>500%</span>
+                        </div>
+                        <small id="landing-page-logo-scale-help" class="form-text text-muted">
+                            Adjust the logo size on the home page only. This does not change the logo size in the top or sidebar navigation.
+                        </small>
+                    </div>
+                    <div class="form-group mb-3">
+                        <label for="logo_file">Upload Custom Logo (Light Mode)</label>
+                        <input type="file" class="form-control" name="logo_file" id="logo_file" accept=".png,.jpg,.jpeg">
+                        <small class="form-text text-muted">This logo will be displayed in light mode and stored at up to 500px tall so the main page can render it sharply without keeping oversized assets in settings.</small>
+                    </div>
+                    <div class="form-group mb-3">
+                        <label for="logo_dark_file">Upload Custom Logo (Dark Mode)</label>
+                        <input type="file" class="form-control" name="logo_dark_file" id="logo_dark_file" accept=".png,.jpg,.jpeg">
+                        <small class="form-text text-muted">This logo will be displayed in dark mode. If not provided, the light mode logo will be used in both themes. Dark logos are also stored at up to 500px tall.</small>
+                    </div>
+                    <div class="form-group mb-3">
+                        <label for="favicon_file">Upload Custom Favicon</label>
+                        <input type="file" class="form-control" name="favicon_file" id="favicon_file" accept=".png,.jpg,.jpeg,.ico">
+                        <small class="form-text text-muted">Recommended: 16x16 or 32x32 pixel png or jpg or ico.</small>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="home-page-text-section">
+                    <h5>
+                        <i class="bi bi-house me-2"></i>Home Page Text
+                    </h5>
+                    <p class="text-muted small">Configure the text content displayed on your application's home page using Markdown formatting.</p>
+
+                    <div class="mb-3">
+                        <label for="landing_page_alignment" class="form-label">Markdown Alignment</label>
+                        <select class="form-select" id="landing_page_alignment" name="landing_page_alignment">
+                            <option value="left" {% if settings.landing_page_alignment == "left" or not settings.landing_page_alignment %}selected{% endif %}>Left</option>
+                            <option value="center" {% if settings.landing_page_alignment == "center" %}selected{% endif %}>Center</option>
+                            <option value="right" {% if settings.landing_page_alignment == "right" %}selected{% endif %}>Right</option>
+                        </select>
+                        <small class="form-text text-muted">Choose how the landing page markdown is aligned on the home page.</small>
+                    </div>
+
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="toggleLandingPageEditor"
+                            name="enable_landing_page_editor"
+                            {% if settings.enable_landing_page_editor %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="toggleLandingPageEditor">
+                            Enable Markdown Editor
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the markdown editor for editing landing page content, otherwise text will be displayed as read-only preview."></i>
+                    </div>
+
+                    <div id="landingPageEditorContainer" style="display: none;">
+                        <textarea
+                            class="form-control"
+                            id="landing_page_text_editor"
+                            name="landing_page_text"
+                            rows="5"
+                        >{{ settings.landing_page_text }}</textarea>
+                    </div>
+
+                    <div
+                        id="landingPageMarkdownPreview"
+                        class="p-2 border rounded"
+                        style="white-space: pre-wrap; display: none;"
+                    ></div>
+                </div>
+
+                <div class="card p-3 mb-3" id="appearance-section">
+                    <h5>
+                        <i class="bi bi-brush me-2"></i>Appearance
+                    </h5>
+                    <p class="text-muted small">Configure the app appearance and theme settings.</p>
+
+                    <div class="mb-3">
+                        <label class="form-label">Default Theme</label>
+                        <div class="form-group form-check form-switch mb-3">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="enable_dark_mode_default"
+                                name="enable_dark_mode_default"
+                                {% if settings.enable_dark_mode_default %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="enable_dark_mode_default">
+                                Enable Dark Mode by Default
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Set dark mode as the default theme for new users. Users can still toggle between themes individually."></i>
+                        </div>
+                        <p class="text-muted small">Users can still toggle dark mode individually from the navigation bar.</p>
+                    </div>
+
+                    <div class="mb-3">
+                        <label class="form-label">Default Navigation</label>
+                        <div class="form-group form-check form-switch mb-3">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="enable_left_nav_default"
+                                name="enable_left_nav_default"
+                                {% if settings.enable_left_nav_default %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="enable_left_nav_default">
+                                Enable Left Nav by Default
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show the left navigation sidebar by default for new users. Users can still toggle the sidebar visibility individually."></i>
+                        </div>
+                        <p class="text-muted small">Users can still toggle the left navigation sidebar individually from the header.</p>
+                    </div>
+                </div>
+
+
+
+
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/chat-experience.html b/application/single_app/templates/admin/_panes/chat-experience.html
index 223e1beb0..37d8033a6 100644
--- a/application/single_app/templates/admin/_panes/chat-experience.html
+++ b/application/single_app/templates/admin/_panes/chat-experience.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="chat-experience" role="tabpanel" aria-labelledby="chat-experience-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'chat-experience' %} show active{% endif %}" id="chat-experience" role="tabpanel" aria-labelledby="chat-experience-tab">
                 <div class="card p-3 mb-4" id="processing-thoughts-section">
                     <h5>
                         <i class="bi bi-stars me-2"></i>Processing Thoughts
diff --git a/application/single_app/templates/admin/_panes/citation.html b/application/single_app/templates/admin/_panes/citation.html
index 94f9788e1..4d42286e9 100644
--- a/application/single_app/templates/admin/_panes/citation.html
+++ b/application/single_app/templates/admin/_panes/citation.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="citation" role="tabpanel" aria-labelledby="citation-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'citation' %} show active{% endif %}" id="citation" role="tabpanel" aria-labelledby="citation-tab">
 
                  <p class="text-muted">
                     Configure standard and enhanced citations features for your and group workspaces.
diff --git a/application/single_app/templates/admin/_panes/classification.html b/application/single_app/templates/admin/_panes/classification.html
index 597736e46..425eeedcf 100644
--- a/application/single_app/templates/admin/_panes/classification.html
+++ b/application/single_app/templates/admin/_panes/classification.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="classification" role="tabpanel" aria-labelledby="classification-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'classification' %} show active{% endif %}" id="classification" role="tabpanel" aria-labelledby="classification-tab">
                 <div class="card mb-3 p-3" id="document-classification-section">
                     <h5>
                         <i class="bi bi-tags me-2"></i>Document Classification
diff --git a/application/single_app/templates/admin/_panes/safety.html b/application/single_app/templates/admin/_panes/content-safety.html
similarity index 75%
rename from application/single_app/templates/admin/_panes/safety.html
rename to application/single_app/templates/admin/_panes/content-safety.html
index c4973acdb..88eae95bb 100644
--- a/application/single_app/templates/admin/_panes/safety.html
+++ b/application/single_app/templates/admin/_panes/content-safety.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="safety" role="tabpanel" aria-labelledby="safety-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'content-safety' %} show active{% endif %}" id="content-safety" role="tabpanel" aria-labelledby="content-safety-tab">
 
                  <p class="text-muted">
                     Configure content safety, archiving, and user feedback settings. If Content Safety is enabled, user
@@ -174,49 +174,6 @@ <h5>
 
 
 
-                <div class="card p-3 mb-3" id="permissions-section"
-                    data-requires="enable_user_feedback"
-                    data-requires-label="User Feedback"
-                    data-requires-target="user-feedback-section"
-                    data-requires-scope="#require_member_of_feedback_admin"
-                    data-requires-description="The FeedbackAdmin role only controls access to the User Feedback report, so it does nothing until User Feedback is enabled.">
-                    <h5>
-                        <i class="bi bi-person-check me-2"></i>Permissions
-                    </h5>
-                    <p class="text-muted">Control which users can access specific administrative views related to safety and feedback.</p>
-
-
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_safety_violation_admin"
-                            name="require_member_of_safety_violation_admin"
-                            {% if settings.require_member_of_safety_violation_admin %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_member_of_safety_violation_admin">
-                            Require SafetyViolationAdmin App Role
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the SafetyViolationAdmin Enterprise App role can access safety violation reports."></i>
-                    </div>
-                     <p class="text-muted small mb-3">
-                        Required app role value: <code>SafetyViolationAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the Safety Violations admin page.
-                    </p>
-
-
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_feedback_admin"
-                            name="require_member_of_feedback_admin"
-                            {% if settings.require_member_of_feedback_admin %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_member_of_feedback_admin">
-                            Require FeedbackAdmin App Role
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the FeedbackAdmin Enterprise App role can access user feedback reports."></i>
-                    </div>
-                     <p class="text-muted small mb-0">
-                        Required app role value: <code>FeedbackAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the User Feedback admin page. Requires <strong>Enable User Feedback</strong> to be active.
-                    </p>
-                </div>
 
 
 
diff --git a/application/single_app/templates/admin/_panes/control-center-config.html b/application/single_app/templates/admin/_panes/control-center-config.html
index dd2143276..6567e5537 100644
--- a/application/single_app/templates/admin/_panes/control-center-config.html
+++ b/application/single_app/templates/admin/_panes/control-center-config.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="control-center-config" role="tabpanel" aria-labelledby="control-center-config-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'control-center-config' %} show active{% endif %}" id="control-center-config" role="tabpanel" aria-labelledby="control-center-config-tab">
                 <p class="text-muted">
                     Configure Control Center access and permissions for administrators.
                 </p>
diff --git a/application/single_app/templates/admin/_panes/cosmos.html b/application/single_app/templates/admin/_panes/cosmos.html
index 9d1fa89ca..33cf6b0f3 100644
--- a/application/single_app/templates/admin/_panes/cosmos.html
+++ b/application/single_app/templates/admin/_panes/cosmos.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="cosmos" role="tabpanel" aria-labelledby="cosmos-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'cosmos' %} show active{% endif %}" id="cosmos" role="tabpanel" aria-labelledby="cosmos-tab">
                 <div class="card p-3 mb-3" id="document-access-index-section" data-testid="document-access-index-section">
                     <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
                         <div>
diff --git a/application/single_app/templates/admin/_panes/custom-pages.html b/application/single_app/templates/admin/_panes/custom-pages.html
index a3d0f32ef..00fc68987 100644
--- a/application/single_app/templates/admin/_panes/custom-pages.html
+++ b/application/single_app/templates/admin/_panes/custom-pages.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="custom-pages" role="tabpanel" aria-labelledby="custom-pages-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'custom-pages' %} show active{% endif %}" id="custom-pages" role="tabpanel" aria-labelledby="custom-pages-tab">
                 <p class="text-muted">
                     Enable trusted deployment-time custom pages and manage metadata for simple static pages served from the application custom_pages folders.
                 </p>
@@ -78,4 +78,56 @@ <h6 class="mb-1">Static Page Metadata</h6>
                         </div>
                     </div>
                 </div>
+                <div class="card p-3 mb-3" id="external-links-section">
+                    <h5>
+                        <i class="bi bi-box-arrow-up-right me-2"></i>External Links
+                    </h5>
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" id="enable_external_links" name="enable_external_links"
+                            {% if settings.enable_external_links %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_external_links">
+                            Enable External Links in Navigation
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a menu of external links in the navigation bar for quick access to external resources and websites."></i>
+                    </div>
+                    <p class="text-muted small">When enabled, external links will be displayed in the navigation bar for easy access to external resources.</p>
+
+                    <div id="external_links_settings" {% if not settings.enable_external_links %}style="display: none;"{% endif %}>
+                        <div class="mb-3">
+                            <label for="external_links_menu_name" class="form-label">Menu Name</label>
+                            <input type="text" class="form-control" id="external_links_menu_name" name="external_links_menu_name"
+                                   value="{{ settings.external_links_menu_name or 'External Links' }}" placeholder="External Links">
+                            <small class="form-text text-muted">This name will appear in the navigation bar as the menu title.</small>
+                        </div>
+
+                        <div class="form-check form-switch mb-3">
+                            <input class="form-check-input" type="checkbox" id="external_links_force_menu" name="external_links_force_menu"
+                                {% if settings.external_links_force_menu %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="external_links_force_menu">
+                                Force Menu Display
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Always show external links as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu."></i>
+                            <small class="form-text text-muted d-block">When enabled, external links will always display as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu.</small>
+                        </div>
+
+                        <h6>External Links</h6>
+                        <p class="text-muted small">Define custom links that will appear in the navigation bar for users to access external resources.</p>
+
+                        <table class="table table-sm table-bordered">
+                            <thead>
+                                <tr>
+                                    <th>Label</th>
+                                    <th>URL</th>
+                                    <th>Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="external-links-tbody">
+                                <!-- Populated by JavaScript -->
+                            </tbody>
+                        </table>
+
+                        <button type="button" class="btn btn-sm btn-outline-primary" id="add-external-link-btn">Add New Link</button>
+                        <input type="hidden" name="external_links_json" id="external_links_json">
+                    </div>
+                </div>
             </div>
diff --git a/application/single_app/templates/admin/_panes/data-management.html b/application/single_app/templates/admin/_panes/data-management.html
index aba966397..d99c04990 100644
--- a/application/single_app/templates/admin/_panes/data-management.html
+++ b/application/single_app/templates/admin/_panes/data-management.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="data-management" role="tabpanel" aria-labelledby="data-management-tab" data-testid="data-management-tab-pane" data-ignore-settings-change="true">
+            <div class="tab-pane fade{% if admin_landing_tab == 'data-management' %} show active{% endif %}" id="data-management" role="tabpanel" aria-labelledby="data-management-tab" data-testid="data-management-tab-pane" data-ignore-settings-change="true">
                 <div class="d-flex align-items-center justify-content-between gap-3 mb-2">
                     <div>
                         <h3 class="mb-1">Backup, Migrate &amp; Restore</h3>
@@ -241,7 +241,7 @@ <h5 class="mb-1">Encryption</h5>
                             <div>
                                 <div class="fw-semibold" id="data-management-key-storage-alert-title">Key Vault is strongly recommended</div>
                                 <div class="small" id="data-management-key-storage-alert-message">Generated backup encryption keys are stored in the Data Management settings document when Key Vault is not enabled.</div>
-                                <a href="#security" id="data-management-key-vault-link">Open Key Vault settings</a>
+                                <a href="#keyvault-section" data-admin-link="keyvault-section" id="data-management-key-vault-link">Open Key Vault settings</a>
                             </div>
                         </div>
                     </div>
diff --git a/application/single_app/templates/admin/_panes/extraction.html b/application/single_app/templates/admin/_panes/extraction.html
new file mode 100644
index 000000000..9a056e8db
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/extraction.html
@@ -0,0 +1,724 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'extraction' %} show active{% endif %}" id="extraction" role="tabpanel" aria-labelledby="extraction-tab">
+                <div class="card p-3 mb-3" id="document-intelligence-section">
+                    <h5><i class="bi bi-file-earmark-text me-2"></i>Document Intelligence</h5>
+                    <p class="text-muted">
+                        Configure Azure Document Intelligence settings. Document Intelligence always powers
+                        <strong>Standard</strong> extraction and is required for workspaces and chat file uploads.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                        <input
+                            type="checkbox"
+                            class="form-check-input me-2"
+                            id="enable_enhanced_extraction"
+                            name="enable_enhanced_extraction"
+                            {% if settings.enable_enhanced_extraction %}checked{% endif %}
+                        >
+                        <label class="form-check-label" for="enable_enhanced_extraction">
+                            Enable Enhanced extraction
+                        </label>
+                        <button
+                            type="button"
+                            class="btn btn-sm btn-outline-secondary rounded-circle ms-2"
+                            data-bs-toggle="modal"
+                            data-bs-target="#documentIntelligenceExtractionHelpModal"
+                            aria-label="Enhanced extraction guidance"
+                            title="Enhanced extraction guidance"
+                        >
+                            <i class="bi bi-question-lg" aria-hidden="true"></i>
+                        </button>
+                    </div>
+
+                    <div id="enhanced_extraction_settings" class="{% if not settings.enable_enhanced_extraction %}d-none{% endif %}">
+                        {% if content_understanding_supported %}
+                        <div class="alert alert-info small" role="note">
+                            Enhanced extraction uses <strong>Azure AI Content Understanding</strong>, which returns tables,
+                            page structure, checkbox states, and AI-generated descriptions of figures, charts, and images.
+                            Configure the connection below.
+                        </div>
+                        {% else %}
+                        <div class="alert alert-secondary small" id="enhanced_extraction_fallback_notice" role="note">
+                            Azure AI Content Understanding is not available in the
+                            <strong>{{ azure_environment }}</strong> cloud, so Enhanced extraction uses
+                            <strong>Document Intelligence Layout</strong> here. There is nothing more to configure —
+                            Enhanced still captures tables, page structure, forms, and checkbox states.
+                        </div>
+                        {% endif %}
+
+                        <div class="mb-3">
+                            <label for="document_intelligence_pdf_image_extraction_mode" class="form-label mb-0">
+                                PDF and Image Extraction Mode
+                            </label>
+                            <select
+                                class="form-select"
+                                id="document_intelligence_pdf_image_extraction_mode"
+                                name="document_intelligence_pdf_image_extraction_mode"
+                            >
+                                <option value="read" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'read' %}selected{% endif %}>
+                                    Standard - faster text extraction
+                                </option>
+                                <option value="layout" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'layout' %}selected{% endif %}>
+                                    Enhanced - richer structure, tables, and checkbox states
+                                </option>
+                                <option value="auto" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'auto' %}selected{% endif %}>
+                                    Auto - sample first pages, then choose Standard or Enhanced
+                                </option>
+                            </select>
+                            <div class="form-text">
+                                Enhanced captures more document detail for PDFs and images, including tables, page structure, and checked or unchecked marks. It adds latency and has a 6X increase for every 1000 pages when selected.
+                            </div>
+                            <div
+                                class="mt-3 {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') != 'auto' %}d-none{% endif %}"
+                                id="document_intelligence_auto_sample_pages_group"
+                            >
+                                <label for="document_intelligence_auto_sample_pages" class="form-label">
+                                    Auto Sample Pages
+                                </label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="document_intelligence_auto_sample_pages"
+                                    name="document_intelligence_auto_sample_pages"
+                                    min="1"
+                                    max="20"
+                                    value="{{ settings.document_intelligence_auto_sample_pages|default(3) }}"
+                                >
+                                <div class="form-text">
+                                    Auto samples this many first PDF pages with Document Intelligence Layout. If it detects tables, selection marks, or figures, the full PDF uses Enhanced; otherwise it finishes with Standard. Images use Enhanced in Auto mode.
+                                </div>
+                            </div>
+                            <div class="alert alert-light border mt-3 mb-0 small" role="note">
+                                <div><strong>Standard:</strong> Document Intelligence Read. Fastest and lowest-cost path for plain text PDFs and images.</div>
+                                <div><strong>Enhanced:</strong> best for tables, section structure, page layout, forms, checkbox states, and figure descriptions. Expect more latency and higher cost.</div>
+                                <div><strong>Auto:</strong> samples the first pages with Document Intelligence Layout, then uses Enhanced only when the sample shows tables, selection marks, or figures.</div>
+                            </div>
+                        </div>
+
+                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                            <input
+                                type="checkbox"
+                                class="form-check-input me-2"
+                                id="enable_document_intelligence_formula_extraction"
+                                name="enable_document_intelligence_formula_extraction"
+                                {% if settings.enable_document_intelligence_formula_extraction %}checked{% endif %}
+                            >
+                            <label class="form-check-label" for="enable_document_intelligence_formula_extraction">
+                                Extract mathematical formulas
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Requests the Document Intelligence formulas add-on so equations are captured as LaTeX instead of approximated as OCR text."></i>
+                        </div>
+                        <div class="form-text mb-3">
+                            Captures equations in PDFs and images as LaTeX rather than approximate OCR text. This is a
+                            <strong>billed Document Intelligence add-on</strong> that adds per-page cost to every Enhanced
+                            extraction, so it is off by default. It applies to the Layout model only, so it has no effect
+                            while extraction is set to Standard.
+                        </div>
+
+                        {% if content_understanding_supported %}
+                        <div class="card p-3 mb-3 bg-body-tertiary" id="content-understanding-section">
+                            <div class="d-flex align-items-center gap-2 flex-wrap mb-2">
+                                <h6 class="mb-0"><i class="bi bi-stars me-2"></i>Azure AI Content Understanding</h6>
+                                <button
+                                    type="button"
+                                    class="btn btn-sm btn-outline-secondary rounded-circle"
+                                    data-bs-toggle="modal"
+                                    data-bs-target="#contentUnderstandingSetupHelpModal"
+                                    aria-label="Content Understanding setup guide"
+                                    title="Content Understanding setup guide"
+                                >
+                                    <i class="bi bi-question-lg" aria-hidden="true"></i>
+                                </button>
+                            </div>
+                            <p class="text-muted small">
+                                Required for Enhanced extraction. Deployed from a Microsoft Foundry resource.
+                                If this is left blank, Enhanced falls back to Document Intelligence Layout.
+                            </p>
+
+                            <div class="mb-3">
+                                <label for="azure_content_understanding_endpoint" class="form-label">
+                                    Foundry Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_content_understanding_endpoint"
+                                    name="azure_content_understanding_endpoint"
+                                    placeholder="https://your-resource.services.ai.azure.com"
+                                    value="{{ settings.azure_content_understanding_endpoint or '' }}"
+                                >
+                                <div class="form-text">
+                                    Your Microsoft Foundry resource endpoint, without a trailing path.
+                                </div>
+                            </div>
+
+                            <div class="mb-3">
+                                <label for="azure_content_understanding_authentication_type" class="form-label">
+                                    Authentication Type
+                                </label>
+                                <select class="form-select" id="azure_content_understanding_authentication_type" name="azure_content_understanding_authentication_type">
+                                    <option value="key" {% if settings.azure_content_understanding_authentication_type != 'managed_identity' %}selected{% endif %}>
+                                        Key
+                                    </option>
+                                    <option value="managed_identity" {% if settings.azure_content_understanding_authentication_type == 'managed_identity' %}selected{% endif %}>
+                                        Managed Identity
+                                    </option>
+                                </select>
+                                <div class="form-text">
+                                    Managed identity requires the <strong>Cognitive Services User</strong> role on the Foundry resource.
+                                </div>
+                            </div>
+
+                            <div class="mb-3 {% if settings.azure_content_understanding_authentication_type == 'managed_identity' %}d-none{% endif %}" id="azure_content_understanding_key_container">
+                                <label for="azure_content_understanding_key" class="form-label">
+                                    Content Understanding Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_content_understanding_key"
+                                        name="azure_content_understanding_key"
+                                        value="{{ settings.azure_content_understanding_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_content_understanding_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+
+                            <div class="row g-3 mb-3">
+                                <div class="col-md-4">
+                                    <label for="azure_content_understanding_api_version" class="form-label">API Version</label>
+                                    <input
+                                        type="text"
+                                        class="form-control"
+                                        id="azure_content_understanding_api_version"
+                                        name="azure_content_understanding_api_version"
+                                        value="{{ settings.azure_content_understanding_api_version or content_understanding_api_version_default }}"
+                                    >
+                                    <div class="form-text">Default: {{ content_understanding_api_version_default }}</div>
+                                </div>
+                                <div class="col-md-4">
+                                    <label for="azure_content_understanding_analyzer_id" class="form-label">Document Analyzer</label>
+                                    <input
+                                        type="text"
+                                        class="form-control"
+                                        id="azure_content_understanding_analyzer_id"
+                                        name="azure_content_understanding_analyzer_id"
+                                        value="{{ settings.azure_content_understanding_analyzer_id or content_understanding_document_analyzer_default }}"
+                                    >
+                                    <div class="form-text">Default: {{ content_understanding_document_analyzer_default }}</div>
+                                </div>
+                                <div class="col-md-4">
+                                    <label for="azure_content_understanding_image_analyzer_id" class="form-label">Image Analyzer</label>
+                                    <input
+                                        type="text"
+                                        class="form-control"
+                                        id="azure_content_understanding_image_analyzer_id"
+                                        name="azure_content_understanding_image_analyzer_id"
+                                        value="{{ settings.azure_content_understanding_image_analyzer_id or content_understanding_image_analyzer_default }}"
+                                    >
+                                    <div class="form-text">Default: {{ content_understanding_image_analyzer_default }}</div>
+                                </div>
+                            </div>
+
+                            <button
+                                type="button"
+                                class="btn btn-secondary"
+                                style="width: auto;"
+                                id="test_content_understanding_button"
+                            >
+                                Test Content Understanding Connection
+                            </button>
+                            <div id="test_content_understanding_result" class="mt-2"></div>
+                        </div>
+                        {% endif %}
+                    </div>
+
+                    <div class="card p-3 mb-3 bg-body-tertiary" id="office-embedded-image-section">
+                        <h6 class="mb-2"><i class="bi bi-images me-2"></i>Images Inside Office Files</h6>
+                        <p class="text-muted small">
+                            Neither extraction engine describes figures inside Word and PowerPoint files. When this is on,
+                            embedded images are pulled out of the file, analyzed with whichever engine backs the selected
+                            extraction mode, and indexed as their own citable chunks. This works with Standard extraction
+                            too, using Document Intelligence.
+                        </p>
+                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                            <input
+                                type="checkbox"
+                                class="form-check-input me-2"
+                                id="enable_office_embedded_image_analysis"
+                                name="enable_office_embedded_image_analysis"
+                                {% if settings.enable_office_embedded_image_analysis %}checked{% endif %}
+                            >
+                            <label class="form-check-label" for="enable_office_embedded_image_analysis">
+                                Analyze images embedded in DOCX and PPTX files
+                            </label>
+                        </div>
+                        <div class="row g-3 {% if not settings.enable_office_embedded_image_analysis %}d-none{% endif %}" id="office_embedded_image_options">
+                            <div class="col-md-6">
+                                <label for="office_embedded_image_min_pixels" class="form-label">Minimum Image Size (pixels)</label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="office_embedded_image_min_pixels"
+                                    name="office_embedded_image_min_pixels"
+                                    min="1"
+                                    max="2000"
+                                    value="{{ settings.office_embedded_image_min_pixels|default(150) }}"
+                                >
+                                <div class="form-text">Images narrower or shorter than this are skipped as icons or spacers.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="office_embedded_image_max_per_document" class="form-label">Maximum Images Per Document</label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="office_embedded_image_max_per_document"
+                                    name="office_embedded_image_max_per_document"
+                                    min="0"
+                                    max="200"
+                                    value="{{ settings.office_embedded_image_max_per_document|default(25) }}"
+                                >
+                                <div class="form-text">Caps per-document cost. Duplicate images are analyzed once.</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="modal fade" id="documentIntelligenceExtractionHelpModal" tabindex="-1" aria-labelledby="documentIntelligenceExtractionHelpModalLabel" aria-hidden="true">
+                        <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                            <div class="modal-content">
+                                <div class="modal-header">
+                                    <h5 class="modal-title" id="documentIntelligenceExtractionHelpModalLabel">Standard, Enhanced, and Auto</h5>
+                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                                </div>
+                                <div class="modal-body">
+                                    <p><strong>Standard</strong> always uses Azure Document Intelligence Read. It is the fastest and lowest-cost path for mostly text-based PDFs and images, and it is what runs when Enhanced extraction is turned off.</p>
+                                    <p><strong>Enhanced</strong> is for documents where structure matters: tables, page layout, headings, forms, checked or unchecked boxes, and figures.</p>
+                                    <ul>
+                                        <li>In Azure commercial clouds, Enhanced uses <strong>Azure AI Content Understanding</strong>, which additionally generates natural-language descriptions of figures, charts, and diagrams.</li>
+                                        <li>In Azure Government and custom clouds, Content Understanding is unavailable, so Enhanced automatically uses <strong>Document Intelligence Layout</strong> instead. Tables and checkbox states still work; figure descriptions do not.</li>
+                                        <li>If Content Understanding is enabled but unreachable, the document falls back to Document Intelligence Layout and the reason is recorded on the document.</li>
+                                    </ul>
+                                    <p><strong>Auto</strong> lets the platform decide per document. It samples the configured number of first PDF pages with Document Intelligence Layout, which is the cheaper detector. If those pages contain tables, selection marks, or figures, the full document is extracted with Enhanced; otherwise it is extracted with Standard. Images always use Enhanced in Auto mode because they are single-page inputs that benefit from figure and spatial analysis.</p>
+                                    <p class="mb-0"><strong>Cost:</strong> Enhanced adds latency and cost on every document. Content Understanding also invokes a language model per document, so it is more expensive than Document Intelligence Layout. Auto is usually the best value.</p>
+                                </div>
+                                <div class="modal-footer">
+                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="modal fade" id="contentUnderstandingSetupHelpModal" tabindex="-1" aria-labelledby="contentUnderstandingSetupHelpModalLabel" aria-hidden="true">
+                        <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                            <div class="modal-content">
+                                <div class="modal-header">
+                                    <h5 class="modal-title" id="contentUnderstandingSetupHelpModalLabel">Set Up Azure AI Content Understanding</h5>
+                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                                </div>
+                                <div class="modal-body">
+                                    <p>Content Understanding is part of Microsoft Foundry. Follow these steps, then paste the endpoint and key below.</p>
+                                    <h6>1. Create a Microsoft Foundry resource</h6>
+                                    <p>
+                                        In the Azure portal, create a <strong>Microsoft Foundry</strong> resource in one of the supported regions:
+                                        East US, East US 2, West US, West US 3, South Central US, North Europe, West Europe, Sweden Central,
+                                        UK South, Australia East, Japan East, or Southeast Asia. You need Contributor or higher on the subscription
+                                        or resource group.
+                                    </p>
+                                    <div class="alert alert-warning small">
+                                        Content Understanding is not offered in Azure Government or other sovereign clouds. In those clouds
+                                        SimpleChat automatically uses Document Intelligence Layout for Enhanced extraction.
+                                    </div>
+                                    <h6>2. Deploy the models Content Understanding needs</h6>
+                                    <p>
+                                        Analyzers that describe figures require a completion model and an embedding model to be deployed and set
+                                        as resource defaults. In the
+                                        <a href="https://contentunderstanding.ai.azure.com/settings" target="_blank" rel="noopener noreferrer">Content Understanding settings page</a>,
+                                        add your Foundry resource and leave
+                                        <em>Enable autodeployment for required models if no defaults are available</em> checked. Without this step,
+                                        analysis requests fail with a missing model deployment error.
+                                    </p>
+                                    <h6>3. Copy the endpoint and key</h6>
+                                    <p>
+                                        In the Azure portal, open the Foundry resource and go to
+                                        <strong>Resource Management &rarr; Keys and Endpoint</strong>. The endpoint looks like
+                                        <code>https://your-resource.services.ai.azure.com</code>. Paste it into
+                                        <strong>Content Understanding Endpoint</strong>, and paste either key into
+                                        <strong>Content Understanding Key</strong>.
+                                    </p>
+                                    <h6>4. Or use managed identity instead of a key</h6>
+                                    <p>
+                                        Set <strong>Authentication Type</strong> to Managed Identity and assign this application's identity the
+                                        <strong>Cognitive Services User</strong> role on the Foundry resource. That role assignment is required even
+                                        for resource owners.
+                                    </p>
+                                    <h6>5. Test the connection</h6>
+                                    <p class="mb-0">
+                                        Use <strong>Test Content Understanding Connection</strong> to confirm the endpoint, credentials, and analyzer
+                                        are reachable before saving.
+                                        See the
+                                        <a href="https://learn.microsoft.com/azure/ai-services/content-understanding/quickstart/use-rest-api" target="_blank" rel="noopener noreferrer">Content Understanding quickstart</a>
+                                        for more detail.
+                                    </p>
+                                </div>
+                                <div class="modal-footer">
+                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                        <input
+                            type="checkbox"
+                            class="form-check-input me-2"
+                            id="enable_document_intelligence_apim"
+                            name="enable_document_intelligence_apim"
+                            {% if settings.enable_document_intelligence_apim %}checked{% endif %}
+                        >
+                        <label class="form-check-label" for="enable_document_intelligence_apim">
+                            Use APIM instead of direct Document Intelligence endpoint
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route Document Intelligence requests through API Management for centralized monitoring and control instead of direct service access."></i>
+                    </div>
+
+                    <div>
+
+                        <div id="non_apim_document_intelligence_settings" {% if settings.enable_document_intelligence_apim %}style="display: none;"{% endif %}>
+                            <div class="mb-3">
+                                <label for="azure_document_intelligence_endpoint" class="form-label">
+                                    Document Intelligence Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_document_intelligence_endpoint"
+                                    name="azure_document_intelligence_endpoint"
+                                    value="{{ settings.azure_document_intelligence_endpoint or '' }}"
+                                >
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_document_intelligence_authentication_type" class="form-label">
+                                    Authentication Type
+                                </label>
+                                <select class="form-select" id="azure_document_intelligence_authentication_type" name="azure_document_intelligence_authentication_type">
+                                    <option value="key" {% if settings.azure_document_intelligence_authentication_type=='key' %}selected{% endif %}>
+                                        Key
+                                    </option>
+                                    <option value="managed_identity" {% if settings.azure_document_intelligence_authentication_type=='managed_identity' %}selected{% endif %}>
+                                        Managed Identity
+                                    </option>
+                                </select>
+                            </div>
+                            <div class="mb-3" id="azure_document_intelligence_key_container" {% if settings.azure_document_intelligence_authentication_type !='key' %}style="display: none;"{% endif %}>
+                                <label for="azure_document_intelligence_key" class="form-label">
+                                    Document Intelligence Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_document_intelligence_key"
+                                        name="azure_document_intelligence_key"
+                                        value="{{ settings.azure_document_intelligence_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_docintel_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <div id="apim_document_intelligence_settings" {% if not settings.enable_document_intelligence_apim %}style="display: none;"{% endif %}>
+                            <div class="mb-3">
+                                <label for="azure_apim_document_intelligence_endpoint" class="form-label">
+                                    Azure APIM Document Intelligence Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_apim_document_intelligence_endpoint"
+                                    name="azure_apim_document_intelligence_endpoint"
+                                    value="{{ settings.azure_apim_document_intelligence_endpoint or '' }}"
+                                >
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_apim_document_intelligence_subscription_key" class="form-label">
+                                    Azure APIM Document Intelligence Subscription Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_apim_document_intelligence_subscription_key"
+                                        name="azure_apim_document_intelligence_subscription_key"
+                                        value="{{ settings.azure_apim_document_intelligence_subscription_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_azure_apim_document_intelligence_subscription_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <button
+                            type="button"
+                            class="btn btn-secondary mt-3"
+                            style="width: auto;"
+                            id="test_azure_doc_intelligence_button"
+                        >
+                            Test Document Intelligence Connection
+                        </button>
+                        <div id="test_azure_doc_intelligence_result" class="mt-2"></div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="chunk-size-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0"><i class="bi bi-collection me-2"></i>Chunk Sizes</h5>
+                        <span class="badge bg-primary-subtle text-primary-emphasis">Cap: {{ chunk_size_cap }}</span>
+                    </div>
+                    <p class="text-muted mb-2 small">Custom chunk sizes apply to new uploads only. Existing documents keep their current chunks.</p>
+                    <div class="alert alert-warning small mb-3">
+                        <strong>Heads up:</strong> Overrides are capped at {{ chunk_size_cap }} (2x embedding context window, fallback 16,384).
+                    </div>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_chunk_size_override"
+                            name="enable_chunk_size_override"
+                            {% if settings.enable_chunk_size_override %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_chunk_size_override">
+                            Enable custom chunk sizes by file type
+                        </label>
+                    </div>
+
+                    <div id="chunk-size-fields" class="{% if not settings.enable_chunk_size_override %}d-none{% endif %}">
+                        <div id="chunk-size-cap-warning" class="alert alert-warning d-none" role="alert">
+                            <span id="chunk-size-cap-warning-text">Chunk sizes above the cap will be reduced automatically.</span>
+                        </div>
+                        <input type="hidden" id="chunk_size_cap" value="{{ chunk_size_cap }}" />
+                        {% set chunk_settings = chunk_size_settings or {} %}
+                        {% set chunk_defaults = chunk_size_defaults or {} %}
+                        <div class="row g-3">
+                            <div class="col-md-6">
+                                <label for="chunk_size_txt" class="form-label">TXT (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="TXT" id="chunk_size_txt" name="chunk_size_txt" value="{{ chunk_settings.get('txt', {}).get('value', chunk_defaults.get('txt', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_log" class="form-label">LOG (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="LOG" id="chunk_size_log" name="chunk_size_log" value="{{ chunk_settings.get('log', {}).get('value', chunk_defaults.get('log', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="chunk_size_doc" class="form-label">DOC (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOC" id="chunk_size_doc" name="chunk_size_doc" value="{{ chunk_settings.get('doc', {}).get('value', chunk_defaults.get('doc', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="chunk_size_docm" class="form-label">DOCM (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOCM" id="chunk_size_docm" name="chunk_size_docm" value="{{ chunk_settings.get('docm', {}).get('value', chunk_defaults.get('docm', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="chunk_size_docx" class="form-label">DOCX (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOCX" id="chunk_size_docx" name="chunk_size_docx" value="{{ chunk_settings.get('docx', {}).get('value', chunk_defaults.get('docx', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_html" class="form-label">HTML (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="HTML" id="chunk_size_html" name="chunk_size_html" value="{{ chunk_settings.get('html', {}).get('value', chunk_defaults.get('html', {}).get('value')) }}">
+                                <div class="form-text">Minimum enforced at 50% of target on merge.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_md" class="form-label">Markdown (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="MD" id="chunk_size_md" name="chunk_size_md" value="{{ chunk_settings.get('md', {}).get('value', chunk_defaults.get('md', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_xml" class="form-label">XML (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="XML" id="chunk_size_xml" name="chunk_size_xml" value="{{ chunk_settings.get('xml', {}).get('value', chunk_defaults.get('xml', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_yaml" class="form-label">YAML (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="YAML" id="chunk_size_yaml" name="chunk_size_yaml" value="{{ chunk_settings.get('yaml', {}).get('value', chunk_defaults.get('yaml', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_yml" class="form-label">YML (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="YML" id="chunk_size_yml" name="chunk_size_yml" value="{{ chunk_settings.get('yml', {}).get('value', chunk_defaults.get('yml', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_json" class="form-label">JSON (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="JSON" id="chunk_size_json" name="chunk_size_json" value="{{ chunk_settings.get('json', {}).get('value', chunk_defaults.get('json', {}).get('value')) }}">
+                            </div>
+                            <!--
+                            <div class="col-md-6">
+                                <label for="chunk_size_csv" class="form-label">CSV (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="CSV" id="chunk_size_csv" name="chunk_size_csv" value="{{ chunk_settings.get('csv', {}).get('value', chunk_defaults.get('csv', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_excel" class="form-label">Excel (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="EXCEL" id="chunk_size_excel" name="chunk_size_excel" value="{{ chunk_settings.get('excel', {}).get('value', chunk_defaults.get('excel', {}).get('value')) }}">
+                            </div>
+                            -->
+                            <div class="col-md-6">
+                                <label for="chunk_size_transcript" class="form-label">Transcripts (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="TRANSCRIPT" id="chunk_size_transcript" name="chunk_size_transcript" value="{{ chunk_settings.get('transcript', {}).get('value', chunk_defaults.get('transcript', {}).get('value')) }}">
+                                <div class="form-text">Applies to new audio transcripts.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_pdf" class="form-label">PDF (pages)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="PDF" id="chunk_size_pdf" name="chunk_size_pdf" value="{{ chunk_settings.get('pdf', {}).get('value', chunk_defaults.get('pdf', {}).get('value')) }}">
+                                <div class="form-text">Pages per chunk after extraction.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_pptx" class="form-label">PPT/PPTX (slides)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="PPT/PPTX" id="chunk_size_pptx" name="chunk_size_pptx" value="{{ chunk_settings.get('pptx', {}).get('value', chunk_defaults.get('pptx', {}).get('value')) }}">
+                                <div class="form-text">Slides per chunk after extraction.</div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- AI Video Intelligence Card -->
+                <div class="card mb-3 p-3" id="metadata-extraction-section">
+                    <h5>
+                        <i class="bi bi-file-earmark-code me-2"></i>Metadata Extraction
+                    </h5>
+                    <p class="text-muted">
+                      Enable this to automatically parse and store file metadata for advanced indexing and search.
+                    </p>
+                    <div class="form-check form-switch mb-3">
+                      <input
+                        type="checkbox"
+                        class="form-check-input"
+                        id="enable_extract_meta_data"
+                        name="enable_extract_meta_data"
+                        {% if settings.enable_extract_meta_data %}checked{% endif %}>
+                      <label class="form-check-label ms-2" for="enable_extract_meta_data">
+                        Enable Extract Meta Data
+                      </label>
+                      <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Automatically extract and index metadata from uploaded files for enhanced search capabilities and content organization."></i>
+                    </div>
+
+                    <div id="metadata_extraction_model_settings" class="mb-3"
+                         {% if not settings.enable_extract_meta_data %}style="display: none;"{% endif %}>
+                                            <label for="metadata_extraction_model" class="form-label">Extraction Model</label>
+                                            <select class="form-select" id="metadata_extraction_model" name="metadata_extraction_model">
+                                                <option value="">No metadata extraction model selected</option>
+                                            </select>
+                                            <input type="hidden" name="metadata_extraction_model_selection_json" id="metadata_extraction_model_selection_json" />
+                                            <div class="form-text">
+                                                Uses Global Endpoints when multi-endpoint model management is enabled; otherwise uses the legacy GPT/APIM deployment settings.
+                                            </div>
+                    </div>
+                </div>
+
+                <!-- Multi-Modal Vision Analysis Section -->
+                <div class="card mb-3 p-3" id="multimodal-vision-section">
+                    <h5>
+                        <i class="bi bi-eye me-2"></i>Multi-Modal Vision Analysis
+                    </h5>
+                    <p class="text-muted">
+                        Enable AI-powered vision analysis for images uploaded to chat or workspace. When enabled alongside Document Intelligence OCR, images will receive both text extraction (OCR) and semantic understanding (vision AI).
+                    </p>
+
+                    <div class="alert alert-info mb-3">
+                        <strong><i class="bi bi-info-circle"></i> How it works:</strong>
+                        <ul class="mb-0 mt-2">
+                            <li><strong>Document Intelligence</strong>: Extracts text from images (OCR)</li>
+                            <li><strong>Vision Model</strong>: Provides semantic analysis, object detection, and contextual understanding</li>
+                            <li>Both analyses are combined and available in citations when Enhanced Citations is enabled</li>
+                        </ul>
+                    </div>
+
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_multimodal_vision"
+                            name="enable_multimodal_vision"
+                            {% if settings.enable_multimodal_vision %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_multimodal_vision">
+                            Enable Multi-Modal Vision Analysis
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Use GPT-4 Vision or similar models to analyze images for semantic content, objects, and contextual information beyond OCR."></i>
+                    </div>
+
+                    <div id="multimodal_vision_model_settings" class="mb-3"
+                         {% if not settings.enable_multimodal_vision %}style="display: none;"{% endif %}>
+                        <label for="multimodal_vision_model" class="form-label">
+                            Vision Model <span class="text-danger">*</span>
+                        </label>
+                        <select class="form-select" id="multimodal_vision_model" name="multimodal_vision_model"
+                                data-prev="{{ settings.multimodal_vision_model or '' }}">
+                            <option value="">Select a vision-capable model...</option>
+
+                            {#
+                                Multi-endpoint aware vision model selection.
+                                Preference order:
+                                1. When multi-endpoint is enabled and model_endpoints has entries, use those.
+                                2. Otherwise, fall back to legacy gpt_model.selected / APIM settings.
+                            #}
+
+                            {% set has_multi_endpoints = settings.enable_multi_model_endpoints and settings.model_endpoints %}
+
+                            {% if has_multi_endpoints %}
+                                {# Iterate all enabled endpoints and models, filter to vision-capable #}
+                                {% for endpoint in settings.model_endpoints if endpoint.enabled %}
+                                    {% for m in endpoint.models if m.enabled %}
+                                        {% if is_vision_capable_model is defined and is_vision_capable_model(m) %}
+                                            {% set option_value = m.deploymentName %}
+                                            <option value="{{ option_value }}"
+                                                data-endpoint-id="{{ endpoint.id or '' }}"
+                                                data-model-id="{{ m.id or '' }}"
+                                                data-provider="{{ endpoint.provider or '' }}"
+                                                data-model-name="{{ m.modelName or '' }}"
+                                                {% if settings.multimodal_vision_model == option_value %}selected{% endif %}>
+                                                {{ m.displayName or m.deploymentName }}{% if m.modelName %} ({{ m.modelName }}){% endif %}
+                                            </option>
+                                        {% endif %}
+                                    {% endfor %}
+                                {% endfor %}
+                            {% elif settings.enable_gpt_apim %}
+                                {# Legacy APIM-based GPT configuration #}
+                                {% for d in (settings.azure_apim_gpt_deployment or '').split(',') if d %}
+                                    {% set d_trim = d.strip() %}
+                                    {% if is_vision_capable_model is defined and is_vision_capable_model(d_trim) %}
+                                        <option value="{{ d_trim }}"
+                                            {% if settings.multimodal_vision_model == d_trim %}selected{% endif %}>
+                                            {{ d_trim }}
+                                        </option>
+                                    {% endif %}
+                                {% endfor %}
+                            {% else %}
+                                {# Legacy single-endpoint GPT configuration #}
+                                {% for m in settings.gpt_model.selected %}
+                                    {% if is_vision_capable_model is defined and is_vision_capable_model(m) %}
+                                        <option value="{{ m.deploymentName }}"
+                                            {% if settings.multimodal_vision_model == m.deploymentName %}selected{% endif %}>
+                                            {{ m.deploymentName }}{% if m.modelName %} ({{ m.modelName }}){% endif %}
+                                        </option>
+                                    {% endif %}
+                                {% endfor %}
+                            {% endif %}
+                        </select>
+                        <div class="form-text">Select a GPT model with vision capabilities (for example, gpt-4o or supported GPT 5 and later models). Only vision-capable models are shown.</div>
+
+                        <button type="button" class="btn btn-secondary mt-3" id="test_multimodal_vision_button">
+                            <i class="bi bi-clipboard-check me-1"></i>Test Vision Analysis
+                        </button>
+                        <div id="test_multimodal_vision_result" class="mt-2"></div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/feature-governance.html b/application/single_app/templates/admin/_panes/feature-governance.html
index d0f153d74..0b7dcfed1 100644
--- a/application/single_app/templates/admin/_panes/feature-governance.html
+++ b/application/single_app/templates/admin/_panes/feature-governance.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="feature-governance" role="tabpanel" aria-labelledby="feature-governance-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'feature-governance' %} show active{% endif %}" id="feature-governance" role="tabpanel" aria-labelledby="feature-governance-tab">
                 <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-2 mb-3">
                     <p class="text-muted mb-0">
                         Configure governance enforcement for endpoint, agent, and action creation or usage. Governance is disabled by default and only enforced when toggled on.
diff --git a/application/single_app/templates/admin/_panes/feedback-alerts.html b/application/single_app/templates/admin/_panes/feedback-alerts.html
index 4ee6ae562..5488e7242 100644
--- a/application/single_app/templates/admin/_panes/feedback-alerts.html
+++ b/application/single_app/templates/admin/_panes/feedback-alerts.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="feedback-alerts" role="tabpanel" aria-labelledby="feedback-alerts-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'feedback-alerts' %} show active{% endif %}" id="feedback-alerts" role="tabpanel" aria-labelledby="feedback-alerts-tab">
                 <div class="card p-3 mb-3" id="user-feedback-section">
                     <h5>
                         <i class="bi bi-chat-square-heart me-2"></i>User Feedback
diff --git a/application/single_app/templates/admin/_panes/file-sync.html b/application/single_app/templates/admin/_panes/file-sync.html
index 2d56920d2..eb440758a 100644
--- a/application/single_app/templates/admin/_panes/file-sync.html
+++ b/application/single_app/templates/admin/_panes/file-sync.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="file-sync" role="tabpanel" aria-labelledby="file-sync-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'file-sync' %} show active{% endif %}" id="file-sync" role="tabpanel" aria-labelledby="file-sync-tab">
                 <p class="text-muted">
                     Configure file synchronization for personal, group, and public workspaces.
                 </p>
diff --git a/application/single_app/templates/admin/_panes/files-sharing.html b/application/single_app/templates/admin/_panes/files-sharing.html
new file mode 100644
index 000000000..a66a04b76
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/files-sharing.html
@@ -0,0 +1,223 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'files-sharing' %} show active{% endif %}" id="files-sharing" role="tabpanel" aria-labelledby="files-sharing-tab">
+                <div class="card mb-3 p-3" id="file-download-settings-section">
+                    <h5>
+                        <i class="bi bi-download me-2"></i>File Downloads
+                    </h5>
+                    <p class="text-muted">
+                        Control when users can download original workspace document files from personal, group, and public workspaces.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="allow_personal_workspace_file_downloads"
+                            name="allow_personal_workspace_file_downloads"
+                            {% if settings.allow_personal_workspace_file_downloads %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="allow_personal_workspace_file_downloads">
+                            Enable Personal Workspace Downloads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to download original files from their personal workspace document menus and bulk selection bar."></i>
+                    </div>
+                    <hr>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="allow_group_workspace_file_downloads"
+                            name="allow_group_workspace_file_downloads"
+                            {% if settings.allow_group_workspace_file_downloads %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="allow_group_workspace_file_downloads">
+                            Enable Group Workspace Downloads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow group workspace document downloads when global policy and each group's local setting allow it."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_group_assignment_for_file_downloads"
+                            name="require_group_assignment_for_file_downloads"
+                            {% if settings.require_group_assignment_for_file_downloads %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_group_assignment_for_file_downloads">
+                            Require Group Assignment for Downloads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only groups selected in Manage Groups can offer document downloads, unless a group owner or admin disables downloads locally."></i>
+                    </div>
+                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
+                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-download-groups-btn" data-bs-toggle="modal" data-bs-target="#fileDownloadGroupAssignmentModal">
+                            <i class="bi bi-people me-1"></i>Manage Groups
+                        </button>
+                        <span class="text-muted small" id="file-download-group-assignment-summary">No groups assigned.</span>
+                    </div>
+                    <textarea class="d-none" id="file_download_allowed_group_ids" name="file_download_allowed_group_ids">{{ settings.file_download_allowed_group_ids|default([], true)|tojson }}</textarea>
+                    <hr>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="allow_public_workspace_file_downloads"
+                            name="allow_public_workspace_file_downloads"
+                            {% if settings.allow_public_workspace_file_downloads %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="allow_public_workspace_file_downloads">
+                            Enable Public Workspace Downloads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow public workspace document downloads when global policy and each workspace's local setting allow it."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_public_workspace_assignment_for_file_downloads"
+                            name="require_public_workspace_assignment_for_file_downloads"
+                            {% if settings.require_public_workspace_assignment_for_file_downloads %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_public_workspace_assignment_for_file_downloads">
+                            Require Public Workspace Assignment for Downloads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only selected public workspaces can offer document downloads, unless a workspace owner or admin disables downloads locally."></i>
+                    </div>
+                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
+                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-download-public-workspaces-btn" data-bs-toggle="modal" data-bs-target="#fileDownloadPublicWorkspaceAssignmentModal">
+                            <i class="bi bi-globe me-1"></i>Manage Public Workspaces
+                        </button>
+                        <span class="text-muted small" id="file-download-public-workspace-assignment-summary">No public workspaces assigned.</span>
+                    </div>
+                    <textarea class="d-none" id="file_download_allowed_public_workspace_ids" name="file_download_allowed_public_workspace_ids">{{ settings.file_download_allowed_public_workspace_ids|default([], true)|tojson }}</textarea>
+                </div>
+
+                <div class="modal fade" id="fileDownloadGroupAssignmentModal" tabindex="-1" aria-labelledby="fileDownloadGroupAssignmentModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <div>
+                                    <h5 class="modal-title mb-0" id="fileDownloadGroupAssignmentModalLabel">File Download Group Assignments</h5>
+                                    <small class="text-muted">Choose which groups can download files when group assignment is required.</small>
+                                </div>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="row g-2 align-items-end mb-3">
+                                    <div class="col">
+                                        <label for="file-download-group-assignment-search" class="form-label">Search Groups</label>
+                                        <input type="search" class="form-control" id="file-download-group-assignment-search" placeholder="Search by group name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
+                                    </div>
+                                    <div class="col-auto">
+                                        <button type="button" class="btn btn-outline-primary" id="file-download-group-assignment-search-btn">
+                                            <i class="bi bi-search me-1"></i>Search
+                                        </button>
+                                    </div>
+                                </div>
+                                <div class="alert alert-danger d-none" id="file-download-group-assignment-error"></div>
+                                <div class="small text-muted mb-2" id="file-download-group-assignment-status">No groups loaded.</div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Group</th>
+                                                <th scope="col">Description</th>
+                                                <th scope="col" class="text-end">Assignment</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="file-download-group-assignment-body">
+                                            <tr>
+                                                <td colspan="3" class="text-center text-muted py-3">Search for groups to assign.</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="fileDownloadPublicWorkspaceAssignmentModal" tabindex="-1" aria-labelledby="fileDownloadPublicWorkspaceAssignmentModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <div>
+                                    <h5 class="modal-title mb-0" id="fileDownloadPublicWorkspaceAssignmentModalLabel">File Download Public Workspace Assignments</h5>
+                                    <small class="text-muted">Choose which public workspaces can download files when public workspace assignment is required.</small>
+                                </div>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="row g-2 align-items-end mb-3">
+                                    <div class="col">
+                                        <label for="file-download-public-workspace-assignment-search" class="form-label">Search Public Workspaces</label>
+                                        <input type="search" class="form-control" id="file-download-public-workspace-assignment-search" placeholder="Search by public workspace name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
+                                    </div>
+                                    <div class="col-auto">
+                                        <button type="button" class="btn btn-outline-primary" id="file-download-public-workspace-assignment-search-btn">
+                                            <i class="bi bi-search me-1"></i>Search
+                                        </button>
+                                    </div>
+                                </div>
+                                <div class="alert alert-danger d-none" id="file-download-public-workspace-assignment-error"></div>
+                                <div class="small text-muted mb-2" id="file-download-public-workspace-assignment-status">Enter at least 2 characters to search.</div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Public Workspace</th>
+                                                <th scope="col">Description</th>
+                                                <th scope="col" class="text-end">Assignment</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="file-download-public-workspace-assignment-body">
+                                            <tr>
+                                                <td colspan="3" class="text-center text-muted py-3">Search for public workspaces to assign.</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+
+                <div class="card mb-3 p-3" id="file-sharing-section">
+                    <h5>
+                        <i class="bi bi-share me-2"></i>File Sharing
+                    </h5>
+                    <p class="text-muted">
+                        Turn this on to enable file sharing capabilities between users and workspaces.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_file_sharing"
+                            name="enable_file_sharing"
+                            {% if settings.enable_file_sharing %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_file_sharing">
+                            Enable File Sharing
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to upload, share, and manage files within workspaces for document-based AI interactions and collaboration."></i>
+                    </div>
+                </div>
+
+
+
+
+
+                <div class="card p-3 mb-4" id="shared-conversation-file-approvals-section">
+                    <h5>
+                        <i class="bi bi-file-earmark-lock me-2"></i>Shared Conversation File Approvals
+                    </h5>
+                    <p class="text-muted">Files generated by participants in a shared conversation are saved into the conversation owner's storage. When enabled, those files are held until an approver releases them.</p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="require_shared_conversation_file_approval"
+                            name="require_shared_conversation_file_approval"
+                            {% if settings.require_shared_conversation_file_approval %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="require_shared_conversation_file_approval">
+                            Require approval for participant-generated files
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When a participant who does not own a shared conversation generates a downloadable file (CSV, XLSX, DOCX, PDF, JSON, XML), the file is created but withheld until the conversation owner approves it. In group conversations, any group Owner, Admin, or Document Manager can approve. Unapproved files are automatically declined and deleted after 3 days. Generated images and charts are never gated."></i>
+                    </div>
+                </div>
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/general.html b/application/single_app/templates/admin/_panes/general.html
deleted file mode 100644
index bd3d5be40..000000000
--- a/application/single_app/templates/admin/_panes/general.html
+++ /dev/null
@@ -1,682 +0,0 @@
-            <div class="tab-pane fade show active" id="general" role="tabpanel" aria-labelledby="general-tab">
-
-                 <p class="text-muted">
-                    Configure general application settings, including the application's title, logo, and landing page text.
-                </p>
-                <div class="card p-3 mb-3" id="branding-section">
-                    <h5>
-                        <i class="bi bi-palette me-2"></i>Branding
-                    </h5>
-                    <p class="text-muted small">
-                        Configure your application's title, logo, and branding elements.
-                    </p>
-                    <div class="mb-3">
-                        <label for="app_title" class="form-label">Application Title</label>
-                        <input type="text" class="form-control" id="app_title" name="app_title" value="{{ settings.app_title }}">
-                    </div>
-                    <h6 class="mt-3">Logo Settings</h6>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox" class="form-check-input" id="show_logo" name="show_logo"
-                            {% if settings.show_logo %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="show_logo">Show Logo</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display the application logo in the header and navigation areas of the interface."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox" class="form-check-input" id="hide_app_title" name="hide_app_title"
-                            {% if settings.hide_app_title %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="hide_app_title">Hide Application Title</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Hide the application title from the header and navigation, showing only the logo if enabled."></i>
-                    </div>
-                    <div class="form-group mb-3">
-                        <div class="d-flex justify-content-between align-items-center">
-                            <label for="landing_page_logo_scale_percent" class="form-label mb-0">Main Page Logo Size</label>
-                            <span id="landing-page-logo-scale-value" class="small text-muted fw-semibold">{{ settings.landing_page_logo_scale_percent | default(100) }}%</span>
-                        </div>
-                        <input
-                            type="range"
-                            class="form-range"
-                            id="landing_page_logo_scale_percent"
-                            name="landing_page_logo_scale_percent"
-                            min="50"
-                            max="500"
-                            step="10"
-                            value="{{ settings.landing_page_logo_scale_percent | default(100) }}"
-                            aria-describedby="landing-page-logo-scale-help"
-                        />
-                        <div class="d-flex justify-content-between small text-muted">
-                            <span>50%</span>
-                            <span>500%</span>
-                        </div>
-                        <small id="landing-page-logo-scale-help" class="form-text text-muted">
-                            Adjust the logo size on the home page only. This does not change the logo size in the top or sidebar navigation.
-                        </small>
-                    </div>
-                    <div class="form-group mb-3">
-                        <label for="logo_file">Upload Custom Logo (Light Mode)</label>
-                        <input type="file" class="form-control" name="logo_file" id="logo_file" accept=".png,.jpg,.jpeg">
-                        <small class="form-text text-muted">This logo will be displayed in light mode and stored at up to 500px tall so the main page can render it sharply without keeping oversized assets in settings.</small>
-                    </div>
-                    <div class="form-group mb-3">
-                        <label for="logo_dark_file">Upload Custom Logo (Dark Mode)</label>
-                        <input type="file" class="form-control" name="logo_dark_file" id="logo_dark_file" accept=".png,.jpg,.jpeg">
-                        <small class="form-text text-muted">This logo will be displayed in dark mode. If not provided, the light mode logo will be used in both themes. Dark logos are also stored at up to 500px tall.</small>
-                    </div>
-                    <div class="form-group mb-3">
-                        <label for="favicon_file">Upload Custom Favicon</label>
-                        <input type="file" class="form-control" name="favicon_file" id="favicon_file" accept=".png,.jpg,.jpeg,.ico">
-                        <small class="form-text text-muted">Recommended: 16x16 or 32x32 pixel png or jpg or ico.</small>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="home-page-text-section">
-                    <h5>
-                        <i class="bi bi-house me-2"></i>Home Page Text
-                    </h5>
-                    <p class="text-muted small">Configure the text content displayed on your application's home page using Markdown formatting.</p>
-
-                    <div class="mb-3">
-                        <label for="landing_page_alignment" class="form-label">Markdown Alignment</label>
-                        <select class="form-select" id="landing_page_alignment" name="landing_page_alignment">
-                            <option value="left" {% if settings.landing_page_alignment == "left" or not settings.landing_page_alignment %}selected{% endif %}>Left</option>
-                            <option value="center" {% if settings.landing_page_alignment == "center" %}selected{% endif %}>Center</option>
-                            <option value="right" {% if settings.landing_page_alignment == "right" %}selected{% endif %}>Right</option>
-                        </select>
-                        <small class="form-text text-muted">Choose how the landing page markdown is aligned on the home page.</small>
-                    </div>
-
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="toggleLandingPageEditor"
-                            name="enable_landing_page_editor"
-                            {% if settings.enable_landing_page_editor %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="toggleLandingPageEditor">
-                            Enable Markdown Editor
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the markdown editor for editing landing page content, otherwise text will be displayed as read-only preview."></i>
-                    </div>
-
-                    <div id="landingPageEditorContainer" style="display: none;">
-                        <textarea
-                            class="form-control"
-                            id="landing_page_text_editor"
-                            name="landing_page_text"
-                            rows="5"
-                        >{{ settings.landing_page_text }}</textarea>
-                    </div>
-
-                    <div
-                        id="landingPageMarkdownPreview"
-                        class="p-2 border rounded"
-                        style="white-space: pre-wrap; display: none;"
-                    ></div>
-                </div>
-
-                <div class="card p-3 mb-3" id="appearance-section">
-                    <h5>
-                        <i class="bi bi-brush me-2"></i>Appearance
-                    </h5>
-                    <p class="text-muted small">Configure the app appearance and theme settings.</p>
-
-                    <div class="mb-3">
-                        <label class="form-label">Default Theme</label>
-                        <div class="form-group form-check form-switch mb-3">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="enable_dark_mode_default"
-                                name="enable_dark_mode_default"
-                                {% if settings.enable_dark_mode_default %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="enable_dark_mode_default">
-                                Enable Dark Mode by Default
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Set dark mode as the default theme for new users. Users can still toggle between themes individually."></i>
-                        </div>
-                        <p class="text-muted small">Users can still toggle dark mode individually from the navigation bar.</p>
-                    </div>
-
-                    <div class="mb-3">
-                        <label class="form-label">Default Navigation</label>
-                        <div class="form-group form-check form-switch mb-3">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="enable_left_nav_default"
-                                name="enable_left_nav_default"
-                                {% if settings.enable_left_nav_default %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="enable_left_nav_default">
-                                Enable Left Nav by Default
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show the left navigation sidebar by default for new users. Users can still toggle the sidebar visibility individually."></i>
-                        </div>
-                        <p class="text-muted small">Users can still toggle the left navigation sidebar individually from the header.</p>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="health-check-section">
-                    <div class="d-flex justify-content-between align-items-center mb-2">
-                        <h5 class="mb-0">
-                            <i class="bi bi-heart-pulse me-2"></i>Health Check
-                        </h5>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#healthCheckInfoModal">
-                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
-                        </button>
-                    </div>
-                    <p class="text-muted mb-3">Configure health check endpoint for external monitoring systems.</p>
-
-                    <div class="row g-3">
-                        <div class="col-lg-6">
-                            <div class="border rounded p-3 h-100 bg-body-tertiary-subtle">
-                                <div class="d-flex align-items-start justify-content-between gap-2">
-                                    <div>
-                                        <h6 class="mb-1">Authenticated Endpoint</h6>
-                                        <p class="text-muted small mb-0">Use when your monitoring system can reach a protected route and you want the endpoint governed by the normal app access boundary.</p>
-                                    </div>
-                                    <span class="badge text-bg-primary">Protected</span>
-                                </div>
-                                <div class="form-check form-switch mt-3 mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="enable_external_healthcheck"
-                                        name="enable_external_healthcheck"
-                                        {% if settings.enable_external_healthcheck %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="enable_external_healthcheck">
-                                        Enable /external/healthcheck
-                                    </label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the authenticated /external/healthcheck endpoint for external monitoring systems."></i>
-                                </div>
-                                <p class="text-muted small mb-0">Best for internal monitors or diagnostics tooling that already authenticates to the application.</p>
-                            </div>
-                        </div>
-                        <div class="col-lg-6">
-                            <div class="border rounded p-3 h-100 border-warning-subtle bg-warning-subtle">
-                                <div class="d-flex align-items-start justify-content-between gap-2">
-                                    <div>
-                                        <h6 class="mb-1">Unauthenticated Endpoint</h6>
-                                        <p class="text-muted small mb-0">Use when a platform health probe cannot sign in and only needs a lightweight availability response.</p>
-                                    </div>
-                                    <span class="badge text-bg-warning">No Auth</span>
-                                </div>
-                                <div class="form-check form-switch mt-3 mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="enable_no_auth_external_healthcheck"
-                                        name="enable_no_auth_external_healthcheck"
-                                        {% if settings.enable_no_auth_external_healthcheck %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="enable_no_auth_external_healthcheck">
-                                        Enable /external/healthcheckz
-                                    </label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the unauthenticated /external/healthcheckz endpoint for probes that cannot authenticate."></i>
-                                </div>
-                                <div class="alert alert-warning small mb-0" role="alert">
-                                    <strong>Security note:</strong> This route is intentionally unauthenticated. Only enable it for trusted health probes or controlled network paths.
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="swagger-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0">
-                            <i class="bi bi-file-earmark-code me-2"></i>API Documentation
-                        </h5>
-                        <div class="btn-group" role="group">
-                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#swaggerInfoModal">
-                                <i class="bi bi-info-circle me-1"></i>Why Enable Swagger?
-                            </button>
-                            <a href="/swagger" class="btn btn-primary btn-sm" target="_blank">
-                                <i class="bi bi-box-arrow-up-right me-1"></i>Open Swagger UI
-                            </a>
-                        </div>
-                    </div>
-                    <p class="text-muted mb-3">Configure automatic OpenAPI/Swagger documentation for API endpoints.</p>
-
-                    <div class="form-check form-switch mb-2">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_swagger"
-                            name="enable_swagger"
-                            {% if settings.enable_swagger %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_swagger">
-                            Enable Swagger/OpenAPI Documentation (/swagger)
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable automatic API documentation with Swagger UI interface for testing and exploring endpoints."></i>
-                    </div>
-                    <p class="text-muted small mb-0">
-                        Provides interactive API documentation, endpoint testing, and schema validation.
-                        Useful for developers, API integration, and system troubleshooting.
-                    </p>
-                </div>
-
-                <div class="card p-3 mb-3" id="classification-banner-section">
-                    <h5>
-                        <i class="bi bi-shield-exclamation me-2"></i>Classification Banner
-                    </h5>
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" id="classification_banner_enabled" name="classification_banner_enabled"
-                            {% if settings.classification_banner_enabled %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="classification_banner_enabled">
-                            Enable Classification Banner
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a security classification banner at the top of every page to indicate data sensitivity level."></i>
-                    </div>
-                    <div class="mb-2">
-                        <label for="classification_banner_text" class="form-label">Banner Text</label>
-                        <input type="text" class="form-control" id="classification_banner_text" name="classification_banner_text"
-                            value="{{ settings.classification_banner_text }}">
-                    </div>
-                    <div class="mb-2">
-                        <label for="classification_banner_color" class="form-label">Banner Color</label>
-                        <input type="color" class="form-control form-control-color" id="classification_banner_color" name="classification_banner_color"
-                            value="{{ settings.classification_banner_color or '#ffc107' }}" style="width: 3rem; height: 2rem;">
-                    </div>
-                    <div class="mb-2">
-                        <label for="classification_banner_text_color" class="form-label">Banner Text Color</label>
-                        <input type="color" class="form-control form-control-color" id="classification_banner_text_color" name="classification_banner_text_color"
-                            value="{{ settings.classification_banner_text_color or '#ffffff' }}" style="width: 3rem; height: 2rem;">
-                    </div>
-                    <div class="mb-2">
-                        <span id="classification-banner-preview"
-                              style="display:inline-block; padding:0.5em 1em; border-radius:0.3em; font-weight:bold; color:{{ settings.classification_banner_text_color or '#ffffff' }}; background:{{ settings.classification_banner_color or '#ffc107' }};">
-                            {{ settings.classification_banner_text or 'Banner Preview' }}
-                        </span>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="ai-notice-section">
-                    <h5>
-                        <i class="bi bi-robot me-2"></i>Chat AI Notice
-                    </h5>
-                    <p class="text-muted small">
-                        Display an administrator-provided reminder directly below the chat input, such as guidance that responses are AI-generated and should be reviewed.
-                    </p>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="enable_ai_notice"
-                            name="enable_ai_notice"
-                            {% if settings.enable_ai_notice %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_ai_notice">
-                            Show a custom AI notice below the chat input
-                        </label>
-                    </div>
-                    <div id="ai_notice_settings" class="{% if not settings.enable_ai_notice %}d-none{% endif %}">
-                        <div class="mb-3">
-                            <label for="ai_notice_message" class="form-label">Notice Text</label>
-                            <textarea
-                                class="form-control"
-                                id="ai_notice_message"
-                                name="ai_notice_message"
-                                rows="3"
-                                maxlength="1000"
-                                placeholder="AI-generated responses may contain errors. Review important information before relying on it."
-                            >{{ settings.ai_notice_message or '' }}</textarea>
-                            <div class="form-text">Plain text only. Line breaks are preserved.</div>
-                        </div>
-                        <div>
-                            <label for="ai_notice_frequency" class="form-label">Display Behavior</label>
-                            <select class="form-select" id="ai_notice_frequency" name="ai_notice_frequency">
-                                <option value="non_dismissible" {% if settings.ai_notice_frequency == 'non_dismissible' %}selected{% endif %}>Always visible; users cannot dismiss it</option>
-                                <option value="every_session" {% if settings.ai_notice_frequency == 'every_session' %}selected{% endif %}>Dismissible once per session</option>
-                                <option value="daily" {% if settings.ai_notice_frequency == 'daily' %}selected{% endif %}>Dismissible once per day</option>
-                                <option value="once" {% if settings.ai_notice_frequency == 'once' %}selected{% endif %}>Dismissible once per message version</option>
-                            </select>
-                            <div class="form-text">Changing the notice text or display behavior creates a new message version and shows it again.</div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="terms-of-use-section">
-                    <h5>
-                        <i class="bi bi-door-open me-2"></i>Terms of Use
-                    </h5>
-                    <p class="text-muted small">
-                        Require users to accept the Terms of Use before using SimpleChat. Standard Microsoft sign-in users see it before authentication; Teams SSO and other passive sign-in flows are gated immediately after the app session is created.
-                    </p>
-
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="enable_terms_of_use"
-                            name="enable_terms_of_use"
-                            {% if settings.enable_terms_of_use %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_terms_of_use">
-                            Require terms of use
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the Terms of Use before accessing authenticated application pages or APIs."></i>
-                    </div>
-
-                    <div class="row g-3">
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_title" class="form-label">Popup Title</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="terms_of_use_title"
-                                name="terms_of_use_title"
-                                maxlength="160"
-                                value="{{ settings.terms_of_use_title or 'Terms of Use' }}"
-                            >
-                        </div>
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_frequency" class="form-label">Show Frequency</label>
-                            <select class="form-select" id="terms_of_use_frequency" name="terms_of_use_frequency">
-                                <option value="every_session" {% if settings.terms_of_use_frequency == 'every_session' %}selected{% endif %}>At the start of every session</option>
-                                <option value="daily" {% if settings.terms_of_use_frequency == 'daily' %}selected{% endif %}>Once per day</option>
-                                <option value="once" {% if settings.terms_of_use_frequency == 'once' %}selected{% endif %}>Just once per terms version</option>
-                            </select>
-                            <small class="form-text text-muted">Changing the title, message, or frequency creates a new terms version that users must accept again.</small>
-                        </div>
-                    </div>
-
-                    <div class="mb-3 mt-3">
-                        <label for="terms_of_use_message" class="form-label">Terms of Use Message</label>
-                        <textarea
-                            class="form-control"
-                            id="terms_of_use_message"
-                            name="terms_of_use_message"
-                            rows="7"
-                            maxlength="10000"
-                            placeholder="Enter the terms, notice, or rules of behavior users must accept before using the application."
-                        >{{ settings.terms_of_use_message or '' }}</textarea>
-                        <small class="form-text text-muted">Plain text is shown to users with line breaks preserved.</small>
-                    </div>
-
-                    <div class="mb-3">
-                        <label for="terms_of_use_decline_redirect_url" class="form-label">Cancel Redirect URL</label>
-                        <input
-                            type="text"
-                            class="form-control"
-                            id="terms_of_use_decline_redirect_url"
-                            name="terms_of_use_decline_redirect_url"
-                            value="{{ settings.terms_of_use_decline_redirect_url or '/' }}"
-                            placeholder="/"
-                        >
-                        <small class="form-text text-muted">Use a local path such as <code>/</code> or an admin-approved HTTP(S) URL. Signed-in users are locally logged out before this redirect.</small>
-                    </div>
-
-                    <div class="row g-3">
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_accept_button_text" class="form-label">Accept Button Text</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="terms_of_use_accept_button_text"
-                                name="terms_of_use_accept_button_text"
-                                maxlength="80"
-                                value="{{ settings.terms_of_use_accept_button_text or 'Accept and continue' }}"
-                            >
-                        </div>
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_decline_button_text" class="form-label">Cancel Button Text</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="terms_of_use_decline_button_text"
-                                name="terms_of_use_decline_button_text"
-                                maxlength="80"
-                                value="{{ settings.terms_of_use_decline_button_text or 'Cancel' }}"
-                            >
-                        </div>
-                    </div>
-
-                    <div class="alert alert-info mt-3 mb-0" role="alert">
-                        <strong>Tracking:</strong> Every-session acceptance is stored in the Flask session. Daily and once-per-version acceptance are stored in user settings, and accepted or declined events are written to the activity log when the user identity is known.
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="support-menu-section">
-                    <h5>
-                        <i class="bi bi-life-preserver me-2"></i>Support
-                    </h5>
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" id="enable_support_menu" name="enable_support_menu"
-                            {% if settings.enable_support_menu %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_support_menu">
-                            Enable Support Menu for End Users
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a Support menu in navigation for signed-in users with the User role."></i>
-                    </div>
-                    <p class="text-muted small">When enabled, users can access Support destinations like Send Feedback and Latest Features directly from navigation.</p>
-
-                    <div id="support_menu_settings" {% if not settings.enable_support_menu %}style="display: none;"{% endif %}>
-                        <div class="mb-3">
-                            <label for="support_menu_name" class="form-label">Menu Name</label>
-                            <input type="text" class="form-control" id="support_menu_name" name="support_menu_name"
-                                   value="{{ settings.support_menu_name or 'Support' }}" placeholder="Support">
-                            <small class="form-text text-muted">This name will appear in user navigation as the Support menu title.</small>
-                        </div>
-
-                        <div class="form-check form-switch mb-2">
-                            <input class="form-check-input" type="checkbox" id="enable_support_send_feedback" name="enable_support_send_feedback"
-                                {% if settings.enable_support_send_feedback %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="enable_support_send_feedback">
-                                Enable Send Feedback Destination
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to prepare support feedback emails that route to your internal recipient."></i>
-                        </div>
-
-                        <div class="mb-3" id="support_feedback_recipient_group" {% if not settings.enable_support_send_feedback %}style="display: none;"{% endif %}>
-                            <label for="support_feedback_recipient_email" class="form-label">Support Recipient Email</label>
-                            <input type="email" class="form-control" id="support_feedback_recipient_email" name="support_feedback_recipient_email"
-                                   value="{{ settings.support_feedback_recipient_email or '' }}" placeholder="support@contoso.com">
-                            <small class="form-text text-muted">User Send Feedback drafts will be addressed to this internal email address.</small>
-                        </div>
-
-                        <div class="form-check form-switch mb-2">
-                            <input class="form-check-input" type="checkbox" id="enable_support_latest_features" name="enable_support_latest_features"
-                                {% if settings.enable_support_latest_features %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="enable_support_latest_features">
-                                Enable Latest Features Destination
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show a user-facing Latest Features page from the Support menu."></i>
-                        </div>
-
-                        <div id="support_latest_features_settings" {% if not settings.enable_support_latest_features %}style="display: none;"{% endif %}>
-                            <h6 class="mt-3">User-Facing Latest Features</h6>
-                            <p class="text-muted small">Choose which recent features are shared on the user Latest Features page. Deployment and Redis start unchecked because they are mainly admin-facing rollout and infrastructure topics.</p>
-                            <div class="form-check form-switch mb-3">
-                                <input class="form-check-input" type="checkbox" id="enable_support_latest_feature_documentation_links" name="enable_support_latest_feature_documentation_links"
-                                    {% if settings.enable_support_latest_feature_documentation_links %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="enable_support_latest_feature_documentation_links">
-                                    Show Simple Chat Documentation Guide Links
-                                </label>
-                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show public documentation guide buttons alongside the in-app Latest Features shortcuts. This is disabled by default."></i>
-                                <small class="form-text text-muted d-block mt-1">When enabled, user-facing Latest Features cards can show public guide buttons in addition to the direct in-app shortcuts.</small>
-                            </div>
-                            {% for release_group in support_latest_feature_release_groups %}
-                            {% set checklist_collapse_id = release_group.collapse_id ~ 'Checklist' %}
-                            <div class="card border-0 bg-body-tertiary mb-3">
-                                <div class="card-body p-3">
-                                    <div class="d-flex flex-column flex-md-row align-items-md-center justify-content-between gap-3">
-                                        <div>
-                                            <h6 class="mb-1">{{ release_group.label }}{% if release_group.release_version %}<span class="badge bg-light text-dark ms-2">v{{ release_group.release_version }}</span>{% endif %}</h6>
-                                            <p class="text-muted small mb-0">{{ release_group.description }}</p>
-                                        </div>
-                                        {% if not release_group.default_expanded %}
-                                        <button
-                                            type="button"
-                                            class="btn btn-sm btn-outline-secondary"
-                                            data-bs-toggle="collapse"
-                                            data-bs-target="#{{ checklist_collapse_id }}"
-                                            aria-expanded="false"
-                                            aria-controls="{{ checklist_collapse_id }}"
-                                        >
-                                            Show {{ release_group.label }}
-                                        </button>
-                                        {% endif %}
-                                    </div>
-                                    <div {% if not release_group.default_expanded %}class="collapse mt-3" id="{{ checklist_collapse_id }}"{% else %}class="mt-3"{% endif %}>
-                                        <div class="row g-2">
-                                            {% for feature in release_group.features %}
-                                            <div class="col-md-6">
-                                                <div class="form-check border rounded p-3 h-100">
-                                                    <input class="form-check-input" type="checkbox" id="support_latest_feature_{{ feature.id }}" name="support_latest_feature_{{ feature.id }}"
-                                                        {% if settings.support_latest_features_visibility.get(feature.id, true) %}checked{% endif %}>
-                                                    <label class="form-check-label ms-2" for="support_latest_feature_{{ feature.id }}">
-                                                        <span class="fw-semibold d-block">{{ feature.title }}</span>
-                                                        <span class="text-muted small">{{ feature.summary }}</span>
-                                                    </label>
-                                                </div>
-                                            </div>
-                                            {% endfor %}
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                            {% endfor %}
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="external-links-section">
-                    <h5>
-                        <i class="bi bi-box-arrow-up-right me-2"></i>External Links
-                    </h5>
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" id="enable_external_links" name="enable_external_links"
-                            {% if settings.enable_external_links %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_external_links">
-                            Enable External Links in Navigation
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a menu of external links in the navigation bar for quick access to external resources and websites."></i>
-                    </div>
-                    <p class="text-muted small">When enabled, external links will be displayed in the navigation bar for easy access to external resources.</p>
-
-                    <div id="external_links_settings" {% if not settings.enable_external_links %}style="display: none;"{% endif %}>
-                        <div class="mb-3">
-                            <label for="external_links_menu_name" class="form-label">Menu Name</label>
-                            <input type="text" class="form-control" id="external_links_menu_name" name="external_links_menu_name"
-                                   value="{{ settings.external_links_menu_name or 'External Links' }}" placeholder="External Links">
-                            <small class="form-text text-muted">This name will appear in the navigation bar as the menu title.</small>
-                        </div>
-
-                        <div class="form-check form-switch mb-3">
-                            <input class="form-check-input" type="checkbox" id="external_links_force_menu" name="external_links_force_menu"
-                                {% if settings.external_links_force_menu %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="external_links_force_menu">
-                                Force Menu Display
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Always show external links as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu."></i>
-                            <small class="form-text text-muted d-block">When enabled, external links will always display as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu.</small>
-                        </div>
-
-                        <h6>External Links</h6>
-                        <p class="text-muted small">Define custom links that will appear in the navigation bar for users to access external resources.</p>
-
-                        <table class="table table-sm table-bordered">
-                            <thead>
-                                <tr>
-                                    <th>Label</th>
-                                    <th>URL</th>
-                                    <th>Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody id="external-links-tbody">
-                                <!-- Populated by JavaScript -->
-                            </tbody>
-                        </table>
-
-                        <button type="button" class="btn btn-sm btn-outline-primary" id="add-external-link-btn">Add New Link</button>
-                        <input type="hidden" name="external_links_json" id="external_links_json">
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="system-settings-section">
-                    <h5>
-                        <i class="bi bi-gear-fill me-2"></i>System Settings
-                    </h5>
-                    <p class="text-muted">
-                        System-level settings that control application behavior, including file size limits, conversation history,
-                        and default prompts.
-                    </p>
-                    <div class="mb-3">
-                        <label for="max_file_size_mb" class="form-label">Maximum File Size (MB)</label>
-                        <input type="number" class="form-control" id="max_file_size_mb" name="max_file_size_mb"
-                            value="{{ settings.max_file_size_mb }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="conversation_history_limit" class="form-label">
-                            Conversation History Limit
-                        </label>
-                        <input type="number" class="form-control" id="conversation_history_limit"
-                            name="conversation_history_limit" value="{{ settings.conversation_history_limit }}">
-                    </div>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_idle_timeout"
-                            name="enable_idle_timeout"
-                            {% if settings.enable_idle_timeout %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_idle_timeout">
-                            Enable Idle Session Timeout and Warning
-                        </label>
-                        <button
-                             type="button"
-                             class="btn btn-link p-0 ms-2"
-                             data-bs-toggle="tooltip"
-                             title="When enabled, inactive users receive a warning and are automatically logged out after the configured timeout."
-                             aria-label="More information about idle timeout settings">
-                             <i class="bi bi-info-circle" aria-hidden="true"></i>
-                         </button>
-                    </div>
-                    <div id="idle_timeout_settings" class="{% if settings.enable_idle_timeout is not defined or not settings.enable_idle_timeout %}d-none{% endif %}">
-                        <div class="mb-3">
-                            <label for="idle_timeout_minutes" class="form-label">Idle Logout Timeout (Minutes)</label>
-                            <input
-                                type="number"
-                                class="form-control"
-                                id="idle_timeout_minutes"
-                                name="idle_timeout_minutes"
-                                min="10"
-                                value="{{ settings.idle_timeout_minutes | default(30) }}">
-                            <small class="form-text text-muted">Users are logged out locally after this many minutes of inactivity. Minimum value: 10 minutes.</small>
-                        </div>
-                        <div class="mb-3">
-                            <label for="idle_warning_minutes" class="form-label">Idle Warning Time (Minutes)</label>
-                            <input
-                                type="number"
-                                class="form-control"
-                                id="idle_warning_minutes"
-                                name="idle_warning_minutes"
-                                min="0"
-                                value="{{ settings.idle_warning_minutes | default(28) }}">
-                            <small class="form-text text-muted">Show the warning modal after this many minutes of inactivity. Set this equal to the logout timeout to disable the warning dialog window.</small>
-                        </div>
-                        <div class="mb-3">
-                            <label for="idle_warning_message" class="form-label">Idle Warning Message</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="idle_warning_message"
-                                name="idle_warning_message"
-                                value="{{ settings.idle_warning_message | default("You've been inactive for a while.") }}">
-                            <small class="form-text text-muted">Custom text shown at the top of the idle warning dialog.</small>
-                        </div>
-                    </div>
-                    <div class="mb-3">
-                        <label for="default_system_prompt" class="form-label">Default System Prompt</label>
-                        <textarea class="form-control" id="default_system_prompt" name="default_system_prompt"
-                            rows="5">{{ settings.default_system_prompt }}</textarea>
-                    </div>
-                    <div class="mb-3">
-                        <label for="access_denied_message" class="form-label">Access Denied Message</label>
-                        <small class="text-muted d-block mb-1">Shown to signed-in users who lack the required roles. Use Enter for line breaks.</small>
-                        <textarea class="form-control" id="access_denied_message" name="access_denied_message"
-                            rows="3">{{ settings.access_denied_message }}</textarea>
-                    </div>
-                </div>
-            </div>
diff --git a/application/single_app/templates/admin/_panes/governance-policies.html b/application/single_app/templates/admin/_panes/governance-policies.html
index 8b9d2130f..da2b94fd1 100644
--- a/application/single_app/templates/admin/_panes/governance-policies.html
+++ b/application/single_app/templates/admin/_panes/governance-policies.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="governance-policies" role="tabpanel" aria-labelledby="governance-policies-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'governance-policies' %} show active{% endif %}" id="governance-policies" role="tabpanel" aria-labelledby="governance-policies-tab">
                 <div class="card p-3 mb-3" id="governance-feature-policies-section">
                     <div class="d-flex justify-content-between align-items-center mb-2">
                         <h5 class="mb-0"><i class="bi bi-sliders2 me-2"></i>Feature Policies</h5>
diff --git a/application/single_app/templates/admin/_panes/latest-features.html b/application/single_app/templates/admin/_panes/latest-features.html
index 0ef37a941..a5d8c5f5d 100644
--- a/application/single_app/templates/admin/_panes/latest-features.html
+++ b/application/single_app/templates/admin/_panes/latest-features.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="latest-features" role="tabpanel" aria-labelledby="latest-features-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'latest-features' %} show active{% endif %}" id="latest-features" role="tabpanel" aria-labelledby="latest-features-tab">
                 <p class="text-muted mb-2">
                     Review the main capabilities introduced in v{{ config['VERSION'] }} and use this page as an admin-facing overview for what to highlight with your teams.
                 </p>
@@ -832,7 +832,7 @@ <h5 class="mb-1">
                         <div class="card card-body">
                             <p class="mb-2">Admins can enable this once and let users see more of the model pipeline, including sending, generating, and responded states with clearer timing information.</p>
                             <div class="alert alert-secondary mb-3" role="alert">
-                                This toggle mirrors the saved value in the <a href="#processing-thoughts-section" data-admin-link="processing-thoughts-section">AI Models</a> tab.
+                                This toggle mirrors the saved value in the <a href="#processing-thoughts-section" data-admin-link="processing-thoughts-section">Chat Experience</a> tab.
                             </div>
                             <div class="form-check form-switch mb-3">
                                 <input
@@ -894,7 +894,7 @@ <h5 class="mb-1">
                                 <li>Admins can choose whether this announcement is visible on the user-facing Latest Features page from <strong>General > User-Facing Latest Features</strong>.</li>
                             </ul>
                             <div class="alert alert-secondary mb-3" role="alert">
-                                Use the <a href="#support-menu-section" data-admin-link="support-menu-section">General</a> tab when you want to show or hide the Fact Memory announcement for end users.
+                                Use the <a href="#support-menu-section" data-admin-link="support-menu-section">Support Menu</a> tab when you want to show or hide the Fact Memory announcement for end users.
                             </div>
                             <div class="latest-feature-gallery">
                                 <button
@@ -967,7 +967,7 @@ <h5 class="mb-1">
                                 <li>This works best when Key Vault is already configured for the app.</li>
                             </ul>
                             <div class="alert alert-secondary mb-3" role="alert">
-                                These controls mirror the saved values in the <a href="#redis-cache-section" data-admin-link="redis-cache-section">Scale</a> tab.
+                                These controls mirror the saved values in the <a href="#redis-cache-section" data-admin-link="redis-cache-section">Redis &amp; Caching</a> tab.
                             </div>
                             <div class="form-check form-switch mb-3">
                                 <input
diff --git a/application/single_app/templates/admin/_panes/logging.html b/application/single_app/templates/admin/_panes/logging.html
index f8cf52e23..a32454471 100644
--- a/application/single_app/templates/admin/_panes/logging.html
+++ b/application/single_app/templates/admin/_panes/logging.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="logging" role="tabpanel" aria-labelledby="logging-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'logging' %} show active{% endif %}" id="logging" role="tabpanel" aria-labelledby="logging-tab">
                 <p class="text-muted">
                     Configure logging settings for monitoring, debugging, and auditing purposes. These settings control various types of logging throughout the application including application insights, debug messages, and file processing events.
                 </p>
@@ -174,4 +174,101 @@ <h6 id="file-processing-log-cleanup-heading">Delete stored logs</h6>
                         </div>
                     </section>
                 </div>
+                <div class="card p-3 mb-3" id="health-check-section">
+                    <div class="d-flex justify-content-between align-items-center mb-2">
+                        <h5 class="mb-0">
+                            <i class="bi bi-heart-pulse me-2"></i>Health Check
+                        </h5>
+                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#healthCheckInfoModal">
+                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
+                        </button>
+                    </div>
+                    <p class="text-muted mb-3">Configure health check endpoint for external monitoring systems.</p>
+
+                    <div class="row g-3">
+                        <div class="col-lg-6">
+                            <div class="border rounded p-3 h-100 bg-body-tertiary-subtle">
+                                <div class="d-flex align-items-start justify-content-between gap-2">
+                                    <div>
+                                        <h6 class="mb-1">Authenticated Endpoint</h6>
+                                        <p class="text-muted small mb-0">Use when your monitoring system can reach a protected route and you want the endpoint governed by the normal app access boundary.</p>
+                                    </div>
+                                    <span class="badge text-bg-primary">Protected</span>
+                                </div>
+                                <div class="form-check form-switch mt-3 mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="enable_external_healthcheck"
+                                        name="enable_external_healthcheck"
+                                        {% if settings.enable_external_healthcheck %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="enable_external_healthcheck">
+                                        Enable /external/healthcheck
+                                    </label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the authenticated /external/healthcheck endpoint for external monitoring systems."></i>
+                                </div>
+                                <p class="text-muted small mb-0">Best for internal monitors or diagnostics tooling that already authenticates to the application.</p>
+                            </div>
+                        </div>
+                        <div class="col-lg-6">
+                            <div class="border rounded p-3 h-100 border-warning-subtle bg-warning-subtle">
+                                <div class="d-flex align-items-start justify-content-between gap-2">
+                                    <div>
+                                        <h6 class="mb-1">Unauthenticated Endpoint</h6>
+                                        <p class="text-muted small mb-0">Use when a platform health probe cannot sign in and only needs a lightweight availability response.</p>
+                                    </div>
+                                    <span class="badge text-bg-warning">No Auth</span>
+                                </div>
+                                <div class="form-check form-switch mt-3 mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="enable_no_auth_external_healthcheck"
+                                        name="enable_no_auth_external_healthcheck"
+                                        {% if settings.enable_no_auth_external_healthcheck %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="enable_no_auth_external_healthcheck">
+                                        Enable /external/healthcheckz
+                                    </label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the unauthenticated /external/healthcheckz endpoint for probes that cannot authenticate."></i>
+                                </div>
+                                <div class="alert alert-warning small mb-0" role="alert">
+                                    <strong>Security note:</strong> This route is intentionally unauthenticated. Only enable it for trusted health probes or controlled network paths.
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="card p-3 mb-3" id="swagger-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0">
+                            <i class="bi bi-file-earmark-code me-2"></i>API Documentation
+                        </h5>
+                        <div class="btn-group" role="group">
+                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#swaggerInfoModal">
+                                <i class="bi bi-info-circle me-1"></i>Why Enable Swagger?
+                            </button>
+                            <a href="/swagger" class="btn btn-primary btn-sm" target="_blank">
+                                <i class="bi bi-box-arrow-up-right me-1"></i>Open Swagger UI
+                            </a>
+                        </div>
+                    </div>
+                    <p class="text-muted mb-3">Configure automatic OpenAPI/Swagger documentation for API endpoints.</p>
+
+                    <div class="form-check form-switch mb-2">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_swagger"
+                            name="enable_swagger"
+                            {% if settings.enable_swagger %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_swagger">
+                            Enable Swagger/OpenAPI Documentation (/swagger)
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable automatic API documentation with Swagger UI interface for testing and exploring endpoints."></i>
+                    </div>
+                    <p class="text-muted small mb-0">
+                        Provides interactive API documentation, endpoint testing, and schema validation.
+                        Useful for developers, API integration, and system troubleshooting.
+                    </p>
+                </div>
             </div>
diff --git a/application/single_app/templates/admin/_panes/mcp-governance.html b/application/single_app/templates/admin/_panes/mcp-governance.html
index 31080591e..8a57389de 100644
--- a/application/single_app/templates/admin/_panes/mcp-governance.html
+++ b/application/single_app/templates/admin/_panes/mcp-governance.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="mcp-governance" role="tabpanel" aria-labelledby="mcp-governance-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'mcp-governance' %} show active{% endif %}" id="mcp-governance" role="tabpanel" aria-labelledby="mcp-governance-tab">
                 <div class="card p-3 mb-3" id="governance-mcp-destination-section">
                     <h5>
                         <i class="bi bi-diagram-3 me-2"></i>MCP Action Destination Governance
diff --git a/application/single_app/templates/admin/_panes/network.html b/application/single_app/templates/admin/_panes/network.html
index 83ba4fb03..0f9216bad 100644
--- a/application/single_app/templates/admin/_panes/network.html
+++ b/application/single_app/templates/admin/_panes/network.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="network" role="tabpanel" aria-labelledby="network-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'network' %} show active{% endif %}" id="network" role="tabpanel" aria-labelledby="network-tab">
                 <div class="card p-3 mb-3" id="front-door-section">
                     <div class="d-flex justify-content-between align-items-center mb-2">
                         <h5 class="mb-0">
diff --git a/application/single_app/templates/admin/_panes/notices.html b/application/single_app/templates/admin/_panes/notices.html
new file mode 100644
index 000000000..c05ac2b68
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/notices.html
@@ -0,0 +1,288 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'notices' %} show active{% endif %}" id="notices" role="tabpanel" aria-labelledby="notices-tab">
+                <div class="card p-3 mb-3" id="classification-banner-section">
+                    <h5>
+                        <i class="bi bi-shield-exclamation me-2"></i>Classification Banner
+                    </h5>
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" id="classification_banner_enabled" name="classification_banner_enabled"
+                            {% if settings.classification_banner_enabled %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="classification_banner_enabled">
+                            Enable Classification Banner
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a security classification banner at the top of every page to indicate data sensitivity level."></i>
+                    </div>
+                    <div class="mb-2">
+                        <label for="classification_banner_text" class="form-label">Banner Text</label>
+                        <input type="text" class="form-control" id="classification_banner_text" name="classification_banner_text"
+                            value="{{ settings.classification_banner_text }}">
+                    </div>
+                    <div class="mb-2">
+                        <label for="classification_banner_color" class="form-label">Banner Color</label>
+                        <input type="color" class="form-control form-control-color" id="classification_banner_color" name="classification_banner_color"
+                            value="{{ settings.classification_banner_color or '#ffc107' }}" style="width: 3rem; height: 2rem;">
+                    </div>
+                    <div class="mb-2">
+                        <label for="classification_banner_text_color" class="form-label">Banner Text Color</label>
+                        <input type="color" class="form-control form-control-color" id="classification_banner_text_color" name="classification_banner_text_color"
+                            value="{{ settings.classification_banner_text_color or '#ffffff' }}" style="width: 3rem; height: 2rem;">
+                    </div>
+                    <div class="mb-2">
+                        <span id="classification-banner-preview"
+                              style="display:inline-block; padding:0.5em 1em; border-radius:0.3em; font-weight:bold; color:{{ settings.classification_banner_text_color or '#ffffff' }}; background:{{ settings.classification_banner_color or '#ffc107' }};">
+                            {{ settings.classification_banner_text or 'Banner Preview' }}
+                        </span>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="ai-notice-section">
+                    <h5>
+                        <i class="bi bi-robot me-2"></i>Chat AI Notice
+                    </h5>
+                    <p class="text-muted small">
+                        Display an administrator-provided reminder directly below the chat input, such as guidance that responses are AI-generated and should be reviewed.
+                    </p>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="enable_ai_notice"
+                            name="enable_ai_notice"
+                            {% if settings.enable_ai_notice %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_ai_notice">
+                            Show a custom AI notice below the chat input
+                        </label>
+                    </div>
+                    <div id="ai_notice_settings" class="{% if not settings.enable_ai_notice %}d-none{% endif %}">
+                        <div class="mb-3">
+                            <label for="ai_notice_message" class="form-label">Notice Text</label>
+                            <textarea
+                                class="form-control"
+                                id="ai_notice_message"
+                                name="ai_notice_message"
+                                rows="3"
+                                maxlength="1000"
+                                placeholder="AI-generated responses may contain errors. Review important information before relying on it."
+                            >{{ settings.ai_notice_message or '' }}</textarea>
+                            <div class="form-text">Plain text only. Line breaks are preserved.</div>
+                        </div>
+                        <div>
+                            <label for="ai_notice_frequency" class="form-label">Display Behavior</label>
+                            <select class="form-select" id="ai_notice_frequency" name="ai_notice_frequency">
+                                <option value="non_dismissible" {% if settings.ai_notice_frequency == 'non_dismissible' %}selected{% endif %}>Always visible; users cannot dismiss it</option>
+                                <option value="every_session" {% if settings.ai_notice_frequency == 'every_session' %}selected{% endif %}>Dismissible once per session</option>
+                                <option value="daily" {% if settings.ai_notice_frequency == 'daily' %}selected{% endif %}>Dismissible once per day</option>
+                                <option value="once" {% if settings.ai_notice_frequency == 'once' %}selected{% endif %}>Dismissible once per message version</option>
+                            </select>
+                            <div class="form-text">Changing the notice text or display behavior creates a new message version and shows it again.</div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="terms-of-use-section">
+                    <h5>
+                        <i class="bi bi-door-open me-2"></i>Terms of Use
+                    </h5>
+                    <p class="text-muted small">
+                        Require users to accept the Terms of Use before using SimpleChat. Standard Microsoft sign-in users see it before authentication; Teams SSO and other passive sign-in flows are gated immediately after the app session is created.
+                    </p>
+
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="enable_terms_of_use"
+                            name="enable_terms_of_use"
+                            {% if settings.enable_terms_of_use %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_terms_of_use">
+                            Require terms of use
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the Terms of Use before accessing authenticated application pages or APIs."></i>
+                    </div>
+
+                    <div class="row g-3">
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_title" class="form-label">Popup Title</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="terms_of_use_title"
+                                name="terms_of_use_title"
+                                maxlength="160"
+                                value="{{ settings.terms_of_use_title or 'Terms of Use' }}"
+                            >
+                        </div>
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_frequency" class="form-label">Show Frequency</label>
+                            <select class="form-select" id="terms_of_use_frequency" name="terms_of_use_frequency">
+                                <option value="every_session" {% if settings.terms_of_use_frequency == 'every_session' %}selected{% endif %}>At the start of every session</option>
+                                <option value="daily" {% if settings.terms_of_use_frequency == 'daily' %}selected{% endif %}>Once per day</option>
+                                <option value="once" {% if settings.terms_of_use_frequency == 'once' %}selected{% endif %}>Just once per terms version</option>
+                            </select>
+                            <small class="form-text text-muted">Changing the title, message, or frequency creates a new terms version that users must accept again.</small>
+                        </div>
+                    </div>
+
+                    <div class="mb-3 mt-3">
+                        <label for="terms_of_use_message" class="form-label">Terms of Use Message</label>
+                        <textarea
+                            class="form-control"
+                            id="terms_of_use_message"
+                            name="terms_of_use_message"
+                            rows="7"
+                            maxlength="10000"
+                            placeholder="Enter the terms, notice, or rules of behavior users must accept before using the application."
+                        >{{ settings.terms_of_use_message or '' }}</textarea>
+                        <small class="form-text text-muted">Plain text is shown to users with line breaks preserved.</small>
+                    </div>
+
+                    <div class="mb-3">
+                        <label for="terms_of_use_decline_redirect_url" class="form-label">Cancel Redirect URL</label>
+                        <input
+                            type="text"
+                            class="form-control"
+                            id="terms_of_use_decline_redirect_url"
+                            name="terms_of_use_decline_redirect_url"
+                            value="{{ settings.terms_of_use_decline_redirect_url or '/' }}"
+                            placeholder="/"
+                        >
+                        <small class="form-text text-muted">Use a local path such as <code>/</code> or an admin-approved HTTP(S) URL. Signed-in users are locally logged out before this redirect.</small>
+                    </div>
+
+                    <div class="row g-3">
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_accept_button_text" class="form-label">Accept Button Text</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="terms_of_use_accept_button_text"
+                                name="terms_of_use_accept_button_text"
+                                maxlength="80"
+                                value="{{ settings.terms_of_use_accept_button_text or 'Accept and continue' }}"
+                            >
+                        </div>
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_decline_button_text" class="form-label">Cancel Button Text</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="terms_of_use_decline_button_text"
+                                name="terms_of_use_decline_button_text"
+                                maxlength="80"
+                                value="{{ settings.terms_of_use_decline_button_text or 'Cancel' }}"
+                            >
+                        </div>
+                    </div>
+
+                    <div class="alert alert-info mt-3 mb-0" role="alert">
+                        <strong>Tracking:</strong> Every-session acceptance is stored in the Flask session. Daily and once-per-version acceptance are stored in user settings, and accepted or declined events are written to the activity log when the user identity is known.
+                    </div>
+                </div>
+
+
+
+                <div class="card mb-3 p-3" id="user-agreement-section">
+                    <h5>
+                        <i class="bi bi-file-earmark-check me-2"></i>User Agreement
+                    </h5>
+                    <p class="text-muted">
+                        Configure a user agreement that users must accept before uploading files.
+                        Supports Markdown formatting.
+                    </p>
+
+                    <!-- Enable Toggle -->
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_user_agreement"
+                            name="enable_user_agreement"
+                            {% if settings.enable_user_agreement %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_user_agreement">
+                            Enable User Agreement
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the agreement before uploading files in the selected workspace types."></i>
+                    </div>
+
+                    <!-- User Agreement Settings (shown when enabled) -->
+                    <div id="user_agreement_settings" {% if not settings.enable_user_agreement %}style="display: none;"{% endif %}>
+                        <hr>
+
+                        <!-- Apply To Checkboxes -->
+                        <div class="mb-3">
+                            <label class="form-label fw-bold">Apply to <span class="text-danger">*</span></label>
+                            <p class="text-muted small mb-2">Select where the user agreement should be shown (at least one required):</p>
+                            <div class="row">
+                                <div class="col-md-6">
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_personal" name="user_agreement_apply_personal"
+                                            {% if settings.user_agreement_apply_to and 'personal' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_personal">
+                                            <i class="bi bi-person me-1"></i>Personal Workspaces
+                                        </label>
+                                    </div>
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_group" name="user_agreement_apply_group"
+                                            {% if settings.user_agreement_apply_to and 'group' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_group">
+                                            <i class="bi bi-people me-1"></i>Group Workspaces
+                                        </label>
+                                    </div>
+                                </div>
+                                <div class="col-md-6">
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_public" name="user_agreement_apply_public"
+                                            {% if settings.user_agreement_apply_to and 'public' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_public">
+                                            <i class="bi bi-globe me-1"></i>Public Workspaces
+                                        </label>
+                                    </div>
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_chat" name="user_agreement_apply_chat"
+                                            {% if settings.user_agreement_apply_to and 'chat' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_chat">
+                                            <i class="bi bi-chat-dots me-1"></i>Chat
+                                        </label>
+                                    </div>
+                                </div>
+                            </div>
+                            <div id="user_agreement_apply_to_validation" class="text-danger small" style="display: none;">
+                                <i class="bi bi-exclamation-circle me-1"></i>At least one location must be selected
+                            </div>
+                        </div>
+
+                        <!-- Agreement Text -->
+                        <div class="mb-3">
+                            <label for="user_agreement_text" class="form-label fw-bold">
+                                Agreement Text <span class="text-danger">*</span>
+                                <span class="text-muted fw-normal ms-2">(Markdown supported)</span>
+                            </label>
+                            <textarea class="form-control" id="user_agreement_text" name="user_agreement_text" rows="6"
+                                placeholder="Enter the agreement text that users must accept before uploading files...&#10;&#10;Example:&#10;**I confirm that:**&#10;- The documents I am uploading do not contain PII&#10;- I have permission to share these documents">{{ settings.user_agreement_text or '' }}</textarea>
+                            <div class="d-flex justify-content-between mt-1">
+                                <small id="user_agreement_word_count" class="text-muted">0 / 200 words</small>
+                                <small id="user_agreement_word_warning" class="text-danger" style="display: none;">
+                                    <i class="bi bi-exclamation-circle me-1"></i>Exceeds 200 word limit
+                                </small>
+                            </div>
+                        </div>
+
+                        <!-- Daily Acceptance Option -->
+                        <div class="form-group form-check form-switch mb-3">
+                            <input type="checkbox" class="form-check-input" id="enable_user_agreement_daily" name="enable_user_agreement_daily"
+                                {% if settings.enable_user_agreement_daily %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="enable_user_agreement_daily">
+                                Allow users to accept once per day
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users only need to accept the agreement once per day instead of every time they upload files."></i>
+                        </div>
+
+                        <!-- Test Preview Button -->
+                        <div class="d-flex gap-2 flex-wrap">
+                            <button type="button" class="btn btn-outline-secondary" id="test_user_agreement_btn">
+                                <i class="bi bi-eye me-1"></i>Test Preview
+                            </button>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/redis-caching.html b/application/single_app/templates/admin/_panes/redis-caching.html
index 16d846c71..5bbaa8c4d 100644
--- a/application/single_app/templates/admin/_panes/redis-caching.html
+++ b/application/single_app/templates/admin/_panes/redis-caching.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="redis-caching" role="tabpanel" aria-labelledby="redis-caching-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'redis-caching' %} show active{% endif %}" id="redis-caching" role="tabpanel" aria-labelledby="redis-caching-tab">
                 {% set enable_dai_debug = settings.enable_dai_debug | default(false) %}
                 <p class="text-muted">
                     Configure Redis cache to improve enterprise scale and performance by caching session data. Enabling Redis allows you to horizontally scale your application across multiple instances without losing session data.
diff --git a/application/single_app/templates/admin/_panes/retention.html b/application/single_app/templates/admin/_panes/retention.html
index c3aa2258a..a2bc06781 100644
--- a/application/single_app/templates/admin/_panes/retention.html
+++ b/application/single_app/templates/admin/_panes/retention.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="retention" role="tabpanel" aria-labelledby="retention-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'retention' %} show active{% endif %}" id="retention" role="tabpanel" aria-labelledby="retention-tab">
                 <div class="card p-3 mb-3" id="retention-policy-section">
                     <h5>
                         <i class="bi bi-hourglass-split me-2"></i>Retention Policy
diff --git a/application/single_app/templates/admin/_panes/search-extract.html b/application/single_app/templates/admin/_panes/search-extract.html
deleted file mode 100644
index 1db055f2b..000000000
--- a/application/single_app/templates/admin/_panes/search-extract.html
+++ /dev/null
@@ -1,1698 +0,0 @@
-            <div class="tab-pane fade" id="search-extract" role="tabpanel" aria-labelledby="search-extract-tab">
-
-                 <p class="text-muted">
-                    Configure Azure AI Search, Document Intelligence, and multimedia support settings.
-                </p>
-
-                <div class="card p-3 mb-3" id="web-search-foundry-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0"><i class="bi bi-globe me-2"></i>Web Search (Azure AI Foundry Agent)</h5>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#webSearchFoundryInfoModal">
-                            <i class="bi bi-info-circle me-1"></i>Setup Guide
-                        </button>
-                    </div>
-                    <p class="text-muted mb-2">Enable web search by routing queries through an Azure AI Foundry agent configured by admins.</p>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_web_search"
-                            name="enable_web_search"
-                            {% if settings.enable_web_search %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_web_search">Enable Web Search via Foundry Agent</label>
-                    </div>
-                    <input
-                        type="hidden"
-                        id="web_search_consent_accepted"
-                        name="web_search_consent_accepted"
-                        value="{{ 'true' if settings.web_search_consent_accepted else 'false' }}"
-                    >
-
-                    <div id="web_search_foundry_settings" class="{% if not settings.enable_web_search %}d-none{% endif %}">
-                        <!-- User Notice Settings -->
-                        <div class="card p-3 mb-3 bg-light">
-                            <h6 class="mb-2"><i class="bi bi-bell me-2"></i>User Data Notice</h6>
-                            <p class="text-muted small mb-2">Optionally show users a one-time notice explaining that their message will be sent to Bing for web search.</p>
-                            <div class="form-check form-switch mb-3">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input mb-3"
-                                    id="enable_web_search_user_notice"
-                                    name="enable_web_search_user_notice"
-                                    {% if settings.enable_web_search_user_notice %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2 mb-3" for="enable_web_search_user_notice">Show data notice to users when web search is used</label>
-                            </div>
-                            <div id="web_search_user_notice_settings" class="{% if not settings.enable_web_search_user_notice %}d-none{% endif %}">
-                                <label for="web_search_user_notice_text" class="form-label">Notice Text</label>
-                                <textarea class="form-control" id="web_search_user_notice_text" name="web_search_user_notice_text" rows="2" placeholder="Your current message will be sent to Microsoft Bing for web search...">{{ settings.web_search_user_notice_text or 'Your current message will be sent to Microsoft Bing for web search. Conversation history is not sent for web search, but any sensitive content you paste into this message may be sent.' }}</textarea>
-                                <div class="form-text">This message will be shown to users once per session when they first use web search.</div>
-                            </div>
-                        </div>
-                        <div class="row g-3">
-                            <div class="col-12" id="web_search_foundry_endpoint_container">
-                                <label for="web_search_foundry_endpoint" class="form-label">Foundry Project Endpoint</label>
-                                <input type="text" class="form-control" id="web_search_foundry_endpoint" name="web_search_foundry_endpoint" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.endpoint if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else settings.web_search_agent.azure_openai_gpt_endpoint or '' }}" placeholder="https://<resource>.services.ai.azure.com/api/projects/<project-name>">
-                                <div class="form-text">Project endpoint format: https://&lt;foundry-resource&gt;.services.ai.azure.com/api/projects/&lt;project-name&gt; (not the inference endpoint).</div>
-                            </div>
-                            <div class="col-md-6" id="web_search_foundry_api_version_container">
-                                <label for="web_search_foundry_api_version" class="form-label">Foundry API Version</label>
-                                <input type="text" class="form-control" id="web_search_foundry_api_version" name="web_search_foundry_api_version" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.api_version if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else settings.web_search_agent.azure_openai_gpt_api_version or '' }}" placeholder="2025-05-01">
-                                <a href="https://learn.microsoft.com/en-us/rest/api/aifoundry/aiprojects/?view=foundry#versioning" target="_blank" class="ms-2" rel="noopener noreferrer">
-                                    AI Foundry Versioning<i class="bi bi-box-arrow-up-right"></i>
-                                </a>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="web_search_foundry_agent_id" class="form-label">Foundry Agent ID</label>
-                                <input type="text" class="form-control" id="web_search_foundry_agent_id" name="web_search_foundry_agent_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.agent_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="ID from Azure AI Foundry. Typically starts with asst_">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="web_search_foundry_auth_type" class="form-label">Authentication Type</label>
-                                <select class="form-select" id="web_search_foundry_auth_type" name="web_search_foundry_auth_type">
-                                    {% set foundry_auth_type = settings.web_search_agent.other_settings.azure_ai_foundry.authentication_type if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else 'managed_identity' %}
-                                    <option value="managed_identity" {% if foundry_auth_type=='managed_identity' %}selected{% endif %}>Managed Identity</option>
-                                    <option value="service_principal" {% if foundry_auth_type=='service_principal' %}selected{% endif %}>Service Principal</option>
-                                </select>
-                                <div class="form-text text-muted">Identity must have Cognitive Services User and AI Developer roles on the Foundry project.</div>
-                            </div>
-                            <div class="col-md-4" id="web_search_foundry_cloud_container">
-                                <label for="web_search_foundry_cloud" class="form-label">Cloud</label>
-                                <select class="form-select" id="web_search_foundry_cloud" name="web_search_foundry_cloud">
-                                    {% set foundry_cloud = settings.web_search_agent.other_settings.azure_ai_foundry.cloud if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' %}
-                                    <option value="" {% if foundry_cloud=='' %}selected{% endif %}>Azure Public</option>
-                                    <option value="usgov" {% if foundry_cloud=='usgov' or foundry_cloud=='usgovernment' or foundry_cloud=='gcc' %}selected{% endif %}>Azure Government</option>
-                                    <option value="custom" {% if foundry_cloud=='custom' %}selected{% endif %}>Custom</option>
-                                </select>
-                            </div>
-                            <div class="col-md-4" id="web_search_foundry_managed_identity_type_container">
-                                <label for="web_search_foundry_managed_identity_type" class="form-label">Managed Identity Type</label>
-                                <select class="form-select" id="web_search_foundry_managed_identity_type" name="web_search_foundry_managed_identity_type">
-                                    {% set foundry_mi_type = settings.web_search_agent.other_settings.azure_ai_foundry.managed_identity_type if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else 'system_assigned' %}
-                                    <option value="system_assigned" {% if foundry_mi_type=='system_assigned' %}selected{% endif %}>System-assigned (SAMI)</option>
-                                    <option value="user_assigned" {% if foundry_mi_type=='user_assigned' %}selected{% endif %}>User-assigned (UAMI)</option>
-                                </select>
-                            </div>
-                            <div class="col-12" id="web_search_foundry_authority_container">
-                                <label for="web_search_foundry_authority" class="form-label">Authority Endpoint (Custom Cloud)</label>
-                                <input type="text" class="form-control" id="web_search_foundry_authority" name="web_search_foundry_authority" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.authority if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="https://login.microsoftonline.com/ or https://login.microsoftonline.us/">
-                            </div>
-                            <div class="col-md-6" id="web_search_foundry_managed_identity_client_id_container">
-                                <label for="web_search_foundry_managed_identity_client_id" class="form-label">Managed Identity Client ID (UAMI)</label>
-                                <input type="text" class="form-control" id="web_search_foundry_managed_identity_client_id" name="web_search_foundry_managed_identity_client_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.managed_identity_client_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Client ID for user-assigned managed identity">
-                            </div>
-                        </div>
-
-                        <div class="row g-3 mt-1" id="web_search_foundry_service_principal_fields">
-                            <div class="col-md-4">
-                                <label for="web_search_foundry_tenant_id" class="form-label">Tenant ID</label>
-                                <input type="text" class="form-control" id="web_search_foundry_tenant_id" name="web_search_foundry_tenant_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.tenant_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Entra tenant ID">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="web_search_foundry_client_id" class="form-label">Client ID</label>
-                                <input type="text" class="form-control" id="web_search_foundry_client_id" name="web_search_foundry_client_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.client_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="App registration client ID">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="web_search_foundry_client_secret" class="form-label">Client Secret</label>
-                                <div class="input-group">
-                                    <input type="password" class="form-control" id="web_search_foundry_client_secret" name="web_search_foundry_client_secret" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.client_secret if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Secret or Key Vault reference">
-                                    <button type="button" class="btn btn-outline-secondary" id="toggle_web_search_foundry_client_secret">Show</button>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="border rounded p-3 mt-3">
-                            <div class="d-flex flex-column flex-lg-row align-items-lg-center justify-content-between gap-2">
-                                <div>
-                                    <h6 class="mb-1"><i class="bi bi-chat-square-dots me-2"></i>Web Search Test</h6>
-                                    <div class="text-muted small">Run the configured Foundry agent with the current unsaved settings.</div>
-                                </div>
-                                <button
-                                    type="button"
-                                    class="btn btn-outline-primary btn-sm"
-                                    id="test_web_search_button"
-                                    data-bs-toggle="modal"
-                                    data-bs-target="#webSearchTestModal"
-                                >
-                                    <i class="bi bi-play-circle me-1"></i>Test Web Search
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="url-access-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0"><i class="bi bi-link-45deg me-2"></i>URL Access</h5>
-                        <span class="badge text-bg-secondary">Shared Policy</span>
-                    </div>
-                    <p class="text-muted mb-2">Control direct URL content fetching for pasted chat links, workflow prompts, and Deep Research source review.</p>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_url_access"
-                            name="enable_url_access"
-                            {% if settings.enable_url_access %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_url_access">Enable URL Access for chat and workflows</label>
-                    </div>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_url_access_user"
-                            name="require_member_of_url_access_user"
-                            {% if settings.require_member_of_url_access_user %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="require_member_of_url_access_user">Require UrlAccessUser App Role</label>
-                        <div class="form-text">Required app role value: <code>UrlAccessUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use URL Access in chat or enable it for workflows.</div>
-                    </div>
-
-                    <div id="url_access_settings" class="{% if not settings.enable_url_access %}d-none{% endif %}">
-                        <div class="alert alert-info small mb-3">
-                            URL Access uses the same server-side URL protections as Deep Research: non-HTTP(S) URLs, credentialed URLs, literal IP targets, localhost, metadata hosts, unsafe redirects, unsupported content types, and oversized pages are blocked before fetch.
-                        </div>
-                        <div class="row g-3 mb-3">
-                            <div class="col-md-6">
-                                <label for="url_access_max_chat_urls_per_turn" class="form-label">Chat URL Limit</label>
-                                <input type="number" min="1" max="100" class="form-control" id="url_access_max_chat_urls_per_turn" name="url_access_max_chat_urls_per_turn" value="{{ settings.url_access_max_chat_urls_per_turn or 10 }}">
-                                <div class="form-text">Hard limit: 100 direct URLs per chat message.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="url_access_max_workflow_urls_per_run" class="form-label">Workflow URL Limit</label>
-                                <input type="number" min="1" max="500" class="form-control" id="url_access_max_workflow_urls_per_run" name="url_access_max_workflow_urls_per_run" value="{{ settings.url_access_max_workflow_urls_per_run or 50 }}">
-                                <div class="form-text">Hard limit: 500 direct URLs per workflow prompt.</div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="row g-3 mt-1">
-                        <div class="col-md-6">
-                            <div class="url-access-policy-editor" data-url-access-policy="url_access_allowed_domains" data-policy-kind="domain">
-                                <label for="url_access_allowed_domains_new" class="form-label">Allowed Domains</label>
-                                <textarea class="d-none" id="url_access_allowed_domains" name="url_access_allowed_domains" aria-hidden="true">{{ settings.url_access_allowed_domains|join('\n') if settings.url_access_allowed_domains else settings.source_review_allowed_domains|join('\n') if settings.source_review_allowed_domains else '' }}</textarea>
-                                <div class="input-group input-group-sm">
-                                    <input type="text" class="form-control" id="url_access_allowed_domains_new" data-policy-new-input placeholder="example.com or *.contoso.com" />
-                                    <button type="button" class="btn btn-outline-primary" data-policy-add-button>
-                                        <i class="bi bi-plus-circle me-1"></i>Add
-                                    </button>
-                                </div>
-                                <div class="list-group mt-2" data-policy-list aria-live="polite"></div>
-                            </div>
-                            <div class="form-text">Leave blank to allow any public domain that passes safety checks. Deep Research uses this same allow list.</div>
-                        </div>
-                        <div class="col-md-6">
-                            <div class="url-access-policy-editor" data-url-access-policy="url_access_blocked_domains" data-policy-kind="domain">
-                                <label for="url_access_blocked_domains_new" class="form-label">Blocked Domains</label>
-                                <textarea class="d-none" id="url_access_blocked_domains" name="url_access_blocked_domains" aria-hidden="true">{{ settings.url_access_blocked_domains|join('\n') if settings.url_access_blocked_domains else settings.source_review_blocked_domains|join('\n') if settings.source_review_blocked_domains else '' }}</textarea>
-                                <div class="input-group input-group-sm">
-                                    <input type="text" class="form-control" id="url_access_blocked_domains_new" data-policy-new-input placeholder="example.org or *.contoso.net" />
-                                    <button type="button" class="btn btn-outline-primary" data-policy-add-button>
-                                        <i class="bi bi-plus-circle me-1"></i>Add
-                                    </button>
-                                </div>
-                                <div class="list-group mt-2" data-policy-list aria-live="polite"></div>
-                            </div>
-                            <div class="form-text">Blocked domains apply to URL Access and Deep Research source-page review.</div>
-                        </div>
-                    </div>
-
-                    <div class="border rounded p-3 mt-3">
-                        <div class="d-flex flex-column flex-lg-row align-items-lg-center justify-content-between gap-2">
-                            <div>
-                                <h6 class="mb-1"><i class="bi bi-shield-check me-2"></i>URL Policy Test</h6>
-                                <div class="text-muted small">Check a URL against the current allowed and blocked domain rules before saving.</div>
-                            </div>
-                            <button
-                                type="button"
-                                class="btn btn-outline-primary btn-sm"
-                                id="open_url_access_policy_test_modal_button"
-                                data-bs-toggle="modal"
-                                data-bs-target="#urlAccessPolicyTestModal"
-                            >
-                                <i class="bi bi-play-circle me-1"></i>Test URL Policy
-                            </button>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="source-review-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0"><i class="bi bi-binoculars me-2"></i>Deep Research</h5>
-                        <div class="d-flex align-items-center gap-2">
-                            <span class="badge text-bg-secondary">Optional</span>
-                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#deepResearchInfoModal">
-                                <i class="bi bi-info-circle me-1"></i>Setup Guide
-                            </button>
-                        </div>
-                    </div>
-                    <p class="text-muted mb-2">Plan bounded web searches, inspect source pages, and keep an internal research ledger for evidence coverage. Direct pasted URLs use the shared URL Access controls above.</p>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_source_review"
-                            name="enable_source_review"
-                            {% if settings.enable_source_review %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_source_review">Enable Deep Research for chat</label>
-                    </div>
-
-                    <div id="source_review_settings" class="{% if not settings.enable_source_review %}d-none{% endif %}">
-                        <div class="alert alert-info small mb-3">
-                            Server-side protections always block non-HTTP(S) URLs, literal IP URL targets, localhost, metadata hosts, credentialed URLs, excessive redirects, unsupported content types, oversized pages, and requests beyond the configured page budget. DNS hostnames that resolve to private/internal addresses require the internal-host opt-in below.
-                        </div>
-
-                        <div class="form-check form-switch mb-3">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="require_member_of_deep_research_user"
-                                name="require_member_of_deep_research_user"
-                                {% if settings.require_member_of_deep_research_user %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="require_member_of_deep_research_user">Require DeepResearchUser App Role</label>
-                            <div class="form-text">Required app role value: <code>DeepResearchUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use Deep Research.</div>
-                        </div>
-
-                        <div class="form-check form-switch mb-3">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="source_review_allow_internal_hosts"
-                                name="source_review_allow_internal_hosts"
-                                {% if settings.source_review_allow_internal_hosts %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="source_review_allow_internal_hosts">Allow internal network hostnames</label>
-                            <div class="form-text">Allows DNS hostnames that resolve to private/internal addresses. Literal IP URL targets, localhost, metadata hosts, link-local addresses, and reserved addresses remain blocked.</div>
-                        </div>
-
-                        <div class="row g-3">
-                            <div class="col-md-4">
-                                <label for="source_review_default_mode" class="form-label">Activation Mode</label>
-                                <select class="form-select" id="source_review_default_mode" disabled>
-                                    <option value="manual" selected>User toggle only</option>
-                                </select>
-                                <input type="hidden" name="source_review_default_mode" value="manual" />
-                                <div class="form-text">Deep Research runs only when the user selects it for the message.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_max_pages_per_turn" class="form-label">Max Pages per Turn</label>
-                                <input type="number" min="1" max="10" class="form-control" id="source_review_max_pages_per_turn" name="source_review_max_pages_per_turn" value="{{ settings.source_review_max_pages_per_turn or 10 }}">
-                                <div class="form-text">Hard limit: 10 pages.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_max_seed_pages_per_turn" class="form-label">Max Seed Pages per Turn</label>
-                                <input type="number" min="1" max="10" class="form-control" id="source_review_max_seed_pages_per_turn" name="source_review_max_seed_pages_per_turn" value="{{ settings.source_review_max_seed_pages_per_turn or 10 }}">
-                                <div class="form-text">Limits initial search-result and direct URL pages so budget remains for child pages.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="deep_research_max_user_urls_per_turn" class="form-label">Max User URLs per Turn</label>
-                                <input type="number" min="1" max="100" class="form-control" id="deep_research_max_user_urls_per_turn" name="deep_research_max_user_urls_per_turn" value="{{ settings.deep_research_max_user_urls_per_turn or 100 }}">
-                                <div class="form-text">Direct URLs beyond this cap are recorded as omitted in the ledger.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="deep_research_max_search_queries_per_turn" class="form-label">Max Search Queries per Turn</label>
-                                <input type="number" min="1" max="8" class="form-control" id="deep_research_max_search_queries_per_turn" name="deep_research_max_search_queries_per_turn" value="{{ settings.deep_research_max_search_queries_per_turn or 8 }}">
-                                <div class="form-text">Includes the original current-message query.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_timeout_seconds" class="form-label">Timeout per Turn</label>
-                                <input type="number" min="3" max="30" class="form-control" id="source_review_timeout_seconds" name="source_review_timeout_seconds" value="{{ settings.source_review_timeout_seconds or 30 }}">
-                                <div class="form-text">Hard limit: 30 seconds.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_max_redirects" class="form-label">Max Redirects</label>
-                                <input type="number" min="0" max="5" class="form-control" id="source_review_max_redirects" name="source_review_max_redirects" value="{{ settings.source_review_max_redirects if settings.source_review_max_redirects is not none else 5 }}">
-                                <div class="form-text">Every redirect target is revalidated.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_max_bytes_per_page_mb" class="form-label">Max MB per Page</label>
-                                <input type="number" min="1" max="5" class="form-control" id="source_review_max_bytes_per_page_mb" name="source_review_max_bytes_per_page_mb" value="{{ (((settings.source_review_max_bytes_per_page|default(5000000, true)|int) / 1000000)|round(0, 'ceil'))|int }}">
-                                <div class="form-text">Hard limit: 5 MB.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_max_depth" class="form-label">Source Traversal Depth</label>
-                                <input type="number" min="0" max="2" class="form-control" id="source_review_max_depth" name="source_review_max_depth" value="{{ settings.source_review_max_depth if settings.source_review_max_depth is not none else 2 }}">
-                                <div class="form-text">Depth 2 follows selected links from seed and child pages.</div>
-                            </div>
-                        </div>
-
-                        <div class="row g-3 mt-1">
-                            <div class="col-md-6">
-                                {% set js_runtime = source_review_runtime_capabilities or {} %}
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="enable_deep_source_review"
-                                        name="enable_deep_source_review"
-                                        {% if settings.enable_deep_source_review %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="enable_deep_source_review">Inspect linked source pages</label>
-                                </div>
-                                <div id="source_review_deep_settings" class="form-text {% if not settings.enable_deep_source_review %}d-none{% endif %}">Deep Research follows only scored, policy-approved links within the page and depth budgets.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="deep_research_enable_query_planning"
-                                        name="deep_research_enable_query_planning"
-                                        {% if settings.deep_research_enable_query_planning %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="deep_research_enable_query_planning">Plan multiple web search queries</label>
-                                </div>
-                                <div class="form-text">The selected chat model can propose bounded current-message-only query variants before page review.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="deep_research_enable_ledger_artifact"
-                                        name="deep_research_enable_ledger_artifact"
-                                        {% if settings.deep_research_enable_ledger_artifact %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="deep_research_enable_ledger_artifact">Save research ledger artifacts</label>
-                                </div>
-                                <div class="form-text">Creates a Markdown chat artifact with search queries, reviewed sources, skipped URLs, and coverage.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="source_review_enable_llm_planning"
-                                        name="source_review_enable_llm_planning"
-                                        {% if settings.source_review_enable_llm_planning %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="source_review_enable_llm_planning">Use model-assisted source link planning</label>
-                                </div>
-                                <div class="form-text">When source pages expose candidate links, the selected chat model can rank those candidates before the server fetches them.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="source_review_allow_js_rendering"
-                                        name="source_review_allow_js_rendering"
-                                        {% if settings.source_review_allow_js_rendering and js_runtime.js_rendering_available %}checked{% endif %}
-                                        {% if not js_runtime.js_rendering_available %}disabled{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="source_review_allow_js_rendering">Allow JavaScript rendering fallback</label>
-                                </div>
-                                <div class="form-text">Requires verified Playwright browser runtime support on the app host.</div>
-                                <div class="small mt-1 {% if js_runtime.js_rendering_available %}text-success{% else %}text-warning{% endif %}" id="source_review_js_runtime_status">
-                                    <i class="bi {% if js_runtime.js_rendering_available %}bi-check-circle{% else %}bi-exclamation-triangle{% endif %} me-1"></i>{{ js_runtime.message or 'Runtime support has not been checked yet.' }}
-                                </div>
-                                {% if not js_runtime.js_rendering_available %}
-                                <div class="small text-muted mt-1">Install/enable the Playwright Chromium runtime, then reload Admin Settings to enable this option.</div>
-                                {% endif %}
-                                {% if js_runtime.sandbox_disabled %}
-                                <div class="small text-warning mt-1">Chromium sandbox is disabled by environment configuration.</div>
-                                {% endif %}
-                            </div>
-                            <div class="col-md-6">
-                                <label for="source_review_js_load_more_clicks" class="form-label">Rendered Load More Clicks</label>
-                                <input type="number" min="0" max="12" class="form-control" id="source_review_js_load_more_clicks" name="source_review_js_load_more_clicks" value="{{ settings.source_review_js_load_more_clicks if settings.source_review_js_load_more_clicks is not none else 12 }}">
-                                <div class="form-text">When JavaScript rendering is enabled, Deep Research can click visible Load More controls until this cap is reached.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="source_review_respect_robots_txt"
-                                        name="source_review_respect_robots_txt"
-                                        {% if settings.source_review_respect_robots_txt %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="source_review_respect_robots_txt">Respect robots.txt</label>
-                                </div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="source_review_audit_logging"
-                                        name="source_review_audit_logging"
-                                        {% if settings.source_review_audit_logging %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="source_review_audit_logging">Log Deep Research activity</label>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="web-search-consent-modal" tabindex="-1" aria-labelledby="web-search-consent-title" aria-hidden="true">
-                    <div class="modal-dialog modal-dialog-centered modal-lg">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="web-search-consent-title">Web Search Consent Required</h5>
-                            </div>
-                            <div class="modal-body">
-                                <p>
-                                    When you use Grounding with Bing Search, your customer data is transferred outside of the Azure compliance boundary to the Grounding with Bing Search service. Grounding with Bing Search is not subject to the same data processing terms (including location of processing) and does not have the same compliance standards and certifications as the Azure AI Agent Service, as described in the <a href="https://www.microsoft.com/en-us/bing/apis/grounding-legal" target="_blank" rel="noopener noreferrer">Grounding with Bing Search TOU</a>. It is your responsibility to assess whether use of Grounding with Bing Search in your agent meets your needs and requirements.
-                                </p>
-                                <div class="alert alert-warning mb-0">
-                                    Only the user's current message is sent for web search. Users should avoid including sensitive content in any message that uses web search.
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" id="web-search-consent-decline">Disagree</button>
-                                <button type="button" class="btn btn-primary" id="web-search-consent-accept">Agree</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="webSearchTestModal" tabindex="-1" aria-labelledby="web-search-test-title" aria-hidden="true">
-                    <div class="modal-dialog modal-dialog-centered modal-lg">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="web-search-test-title">Web Search Test</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <label for="web_search_test_query" class="form-label">Test Prompt</label>
-                                <textarea class="form-control" id="web_search_test_query" rows="3">Use the Grounding with Bing Search tool to find the official Microsoft website. Reply with the page title and URL only.</textarea>
-                                <div id="test_web_search_result" class="mt-3" aria-live="polite"></div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
-                                <button type="button" class="btn btn-primary" id="rerun_web_search_test_button">
-                                    <i class="bi bi-arrow-clockwise me-1"></i>Run Again
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="urlAccessPolicyTestModal" tabindex="-1" aria-labelledby="url-access-policy-test-title" aria-hidden="true">
-                    <div class="modal-dialog modal-dialog-centered modal-lg">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="url-access-policy-test-title">URL Policy Test</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <label for="url_access_policy_test_url" class="form-label">URL</label>
-                                <input type="url" class="form-control" id="url_access_policy_test_url" placeholder="https://www.example.com/page" />
-                                <div id="test_url_access_policy_result" class="mt-3" aria-live="polite"></div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
-                                <button type="button" class="btn btn-primary" id="test_url_access_policy_button">
-                                    <i class="bi bi-shield-check me-1"></i>Run Policy Test
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-
-                <div class="card p-3 mb-3" id="azure-ai-search-section">
-                    <h5><i class="bi bi-search me-2"></i>Azure AI Search</h5>
-                    <p class="text-muted">
-                        Configure Azure AI Search settings.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                        <input
-                            type="checkbox"
-                            class="form-check-input me-2"
-                            id="enable_ai_search_apim"
-                            name="enable_ai_search_apim"
-                            {% if settings.enable_ai_search_apim %}checked{% endif %}
-                        >
-                        <label class="form-check-label" for="enable_ai_search_apim">
-                            Use APIM instead of direct Azure AI Search
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route Azure AI Search requests through API Management for centralized monitoring and control instead of direct service access."></i>
-                    </div>
-
-                    <div>
-
-                        <div id="non_apim_ai_search_settings" {% if settings.enable_ai_search_apim %}style="display: none;"{% endif %}>
-                            <div class="mb-3">
-                                <label for="azure_ai_search_endpoint" class="form-label">Search Endpoint</label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_ai_search_endpoint"
-                                    name="azure_ai_search_endpoint"
-                                    value="{{ settings.azure_ai_search_endpoint or '' }}"
-                                >
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_ai_search_authentication_type" class="form-label">
-                                    Authentication Type
-                                </label>
-                                <select class="form-select" id="azure_ai_search_authentication_type" name="azure_ai_search_authentication_type">
-                                    <option value="key" {% if settings.azure_ai_search_authentication_type=='key' %}selected{% endif %}>
-                                        Key
-                                    </option>
-                                    <option value="managed_identity" {% if settings.azure_ai_search_authentication_type=='managed_identity' %}selected{% endif %}>
-                                        Managed Identity
-                                    </option>
-                                </select>
-                            </div>
-                            <div class="mb-3" id="azure_ai_search_key_container" {% if settings.azure_ai_search_authentication_type !='key' %}style="display: none;"{% endif %}>
-                                <label for="azure_ai_search_key" class="form-label">Search Key</label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_ai_search_key"
-                                        name="azure_ai_search_key"
-                                        value="{{ settings.azure_ai_search_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_search_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <div id="apim_ai_search_settings" {% if not settings.enable_ai_search_apim %}style="display: none;"{% endif %}>
-                            <div class="mb-3">
-                                <label for="azure_apim_ai_search_endpoint" class="form-label">
-                                    Azure APIM AI Search Endpoint
-                                </label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_apim_ai_search_endpoint"
-                                    name="azure_apim_ai_search_endpoint"
-                                    value="{{ settings.azure_apim_ai_search_endpoint or '' }}"
-                                >
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_apim_ai_search_subscription_key" class="form-label">
-                                    Azure APIM AI Search Subscription Key
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_apim_ai_search_subscription_key"
-                                        name="azure_apim_ai_search_subscription_key"
-                                        value="{{ settings.azure_apim_ai_search_subscription_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_azure_apim_ai_search_subscription_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <button
-                            type="button"
-                            class="btn btn-secondary mt-3"
-                            style="width: auto;"
-                            id="test_azure_ai_search_button"
-                        >
-                            Test Azure AI Search Connection
-                        </button>
-                        <div id="test_azure_ai_search_result" class="mt-2"></div>
-                    </div>
-                </div>
-
-
-                <div class="card p-3 mb-3" id="document-intelligence-section">
-                    <h5><i class="bi bi-file-earmark-text me-2"></i>Document Intelligence</h5>
-                    <p class="text-muted">
-                        Configure Azure Document Intelligence settings. Document Intelligence always powers
-                        <strong>Standard</strong> extraction and is required for workspaces and chat file uploads.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                        <input
-                            type="checkbox"
-                            class="form-check-input me-2"
-                            id="enable_enhanced_extraction"
-                            name="enable_enhanced_extraction"
-                            {% if settings.enable_enhanced_extraction %}checked{% endif %}
-                        >
-                        <label class="form-check-label" for="enable_enhanced_extraction">
-                            Enable Enhanced extraction
-                        </label>
-                        <button
-                            type="button"
-                            class="btn btn-sm btn-outline-secondary rounded-circle ms-2"
-                            data-bs-toggle="modal"
-                            data-bs-target="#documentIntelligenceExtractionHelpModal"
-                            aria-label="Enhanced extraction guidance"
-                            title="Enhanced extraction guidance"
-                        >
-                            <i class="bi bi-question-lg" aria-hidden="true"></i>
-                        </button>
-                    </div>
-
-                    <div id="enhanced_extraction_settings" class="{% if not settings.enable_enhanced_extraction %}d-none{% endif %}">
-                        {% if content_understanding_supported %}
-                        <div class="alert alert-info small" role="note">
-                            Enhanced extraction uses <strong>Azure AI Content Understanding</strong>, which returns tables,
-                            page structure, checkbox states, and AI-generated descriptions of figures, charts, and images.
-                            Configure the connection below.
-                        </div>
-                        {% else %}
-                        <div class="alert alert-secondary small" id="enhanced_extraction_fallback_notice" role="note">
-                            Azure AI Content Understanding is not available in the
-                            <strong>{{ azure_environment }}</strong> cloud, so Enhanced extraction uses
-                            <strong>Document Intelligence Layout</strong> here. There is nothing more to configure —
-                            Enhanced still captures tables, page structure, forms, and checkbox states.
-                        </div>
-                        {% endif %}
-
-                        <div class="mb-3">
-                            <label for="document_intelligence_pdf_image_extraction_mode" class="form-label mb-0">
-                                PDF and Image Extraction Mode
-                            </label>
-                            <select
-                                class="form-select"
-                                id="document_intelligence_pdf_image_extraction_mode"
-                                name="document_intelligence_pdf_image_extraction_mode"
-                            >
-                                <option value="read" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'read' %}selected{% endif %}>
-                                    Standard - faster text extraction
-                                </option>
-                                <option value="layout" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'layout' %}selected{% endif %}>
-                                    Enhanced - richer structure, tables, and checkbox states
-                                </option>
-                                <option value="auto" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'auto' %}selected{% endif %}>
-                                    Auto - sample first pages, then choose Standard or Enhanced
-                                </option>
-                            </select>
-                            <div class="form-text">
-                                Enhanced captures more document detail for PDFs and images, including tables, page structure, and checked or unchecked marks. It adds latency and has a 6X increase for every 1000 pages when selected.
-                            </div>
-                            <div
-                                class="mt-3 {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') != 'auto' %}d-none{% endif %}"
-                                id="document_intelligence_auto_sample_pages_group"
-                            >
-                                <label for="document_intelligence_auto_sample_pages" class="form-label">
-                                    Auto Sample Pages
-                                </label>
-                                <input
-                                    type="number"
-                                    class="form-control"
-                                    id="document_intelligence_auto_sample_pages"
-                                    name="document_intelligence_auto_sample_pages"
-                                    min="1"
-                                    max="20"
-                                    value="{{ settings.document_intelligence_auto_sample_pages|default(3) }}"
-                                >
-                                <div class="form-text">
-                                    Auto samples this many first PDF pages with Document Intelligence Layout. If it detects tables, selection marks, or figures, the full PDF uses Enhanced; otherwise it finishes with Standard. Images use Enhanced in Auto mode.
-                                </div>
-                            </div>
-                            <div class="alert alert-light border mt-3 mb-0 small" role="note">
-                                <div><strong>Standard:</strong> Document Intelligence Read. Fastest and lowest-cost path for plain text PDFs and images.</div>
-                                <div><strong>Enhanced:</strong> best for tables, section structure, page layout, forms, checkbox states, and figure descriptions. Expect more latency and higher cost.</div>
-                                <div><strong>Auto:</strong> samples the first pages with Document Intelligence Layout, then uses Enhanced only when the sample shows tables, selection marks, or figures.</div>
-                            </div>
-                        </div>
-
-                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                            <input
-                                type="checkbox"
-                                class="form-check-input me-2"
-                                id="enable_document_intelligence_formula_extraction"
-                                name="enable_document_intelligence_formula_extraction"
-                                {% if settings.enable_document_intelligence_formula_extraction %}checked{% endif %}
-                            >
-                            <label class="form-check-label" for="enable_document_intelligence_formula_extraction">
-                                Extract mathematical formulas
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Requests the Document Intelligence formulas add-on so equations are captured as LaTeX instead of approximated as OCR text."></i>
-                        </div>
-                        <div class="form-text mb-3">
-                            Captures equations in PDFs and images as LaTeX rather than approximate OCR text. This is a
-                            <strong>billed Document Intelligence add-on</strong> that adds per-page cost to every Enhanced
-                            extraction, so it is off by default. It applies to the Layout model only, so it has no effect
-                            while extraction is set to Standard.
-                        </div>
-
-                        {% if content_understanding_supported %}
-                        <div class="card p-3 mb-3 bg-body-tertiary" id="content-understanding-section">
-                            <div class="d-flex align-items-center gap-2 flex-wrap mb-2">
-                                <h6 class="mb-0"><i class="bi bi-stars me-2"></i>Azure AI Content Understanding</h6>
-                                <button
-                                    type="button"
-                                    class="btn btn-sm btn-outline-secondary rounded-circle"
-                                    data-bs-toggle="modal"
-                                    data-bs-target="#contentUnderstandingSetupHelpModal"
-                                    aria-label="Content Understanding setup guide"
-                                    title="Content Understanding setup guide"
-                                >
-                                    <i class="bi bi-question-lg" aria-hidden="true"></i>
-                                </button>
-                            </div>
-                            <p class="text-muted small">
-                                Required for Enhanced extraction. Deployed from a Microsoft Foundry resource.
-                                If this is left blank, Enhanced falls back to Document Intelligence Layout.
-                            </p>
-
-                            <div class="mb-3">
-                                <label for="azure_content_understanding_endpoint" class="form-label">
-                                    Foundry Endpoint
-                                </label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_content_understanding_endpoint"
-                                    name="azure_content_understanding_endpoint"
-                                    placeholder="https://your-resource.services.ai.azure.com"
-                                    value="{{ settings.azure_content_understanding_endpoint or '' }}"
-                                >
-                                <div class="form-text">
-                                    Your Microsoft Foundry resource endpoint, without a trailing path.
-                                </div>
-                            </div>
-
-                            <div class="mb-3">
-                                <label for="azure_content_understanding_authentication_type" class="form-label">
-                                    Authentication Type
-                                </label>
-                                <select class="form-select" id="azure_content_understanding_authentication_type" name="azure_content_understanding_authentication_type">
-                                    <option value="key" {% if settings.azure_content_understanding_authentication_type != 'managed_identity' %}selected{% endif %}>
-                                        Key
-                                    </option>
-                                    <option value="managed_identity" {% if settings.azure_content_understanding_authentication_type == 'managed_identity' %}selected{% endif %}>
-                                        Managed Identity
-                                    </option>
-                                </select>
-                                <div class="form-text">
-                                    Managed identity requires the <strong>Cognitive Services User</strong> role on the Foundry resource.
-                                </div>
-                            </div>
-
-                            <div class="mb-3 {% if settings.azure_content_understanding_authentication_type == 'managed_identity' %}d-none{% endif %}" id="azure_content_understanding_key_container">
-                                <label for="azure_content_understanding_key" class="form-label">
-                                    Content Understanding Key
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_content_understanding_key"
-                                        name="azure_content_understanding_key"
-                                        value="{{ settings.azure_content_understanding_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_content_understanding_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-
-                            <div class="row g-3 mb-3">
-                                <div class="col-md-4">
-                                    <label for="azure_content_understanding_api_version" class="form-label">API Version</label>
-                                    <input
-                                        type="text"
-                                        class="form-control"
-                                        id="azure_content_understanding_api_version"
-                                        name="azure_content_understanding_api_version"
-                                        value="{{ settings.azure_content_understanding_api_version or content_understanding_api_version_default }}"
-                                    >
-                                    <div class="form-text">Default: {{ content_understanding_api_version_default }}</div>
-                                </div>
-                                <div class="col-md-4">
-                                    <label for="azure_content_understanding_analyzer_id" class="form-label">Document Analyzer</label>
-                                    <input
-                                        type="text"
-                                        class="form-control"
-                                        id="azure_content_understanding_analyzer_id"
-                                        name="azure_content_understanding_analyzer_id"
-                                        value="{{ settings.azure_content_understanding_analyzer_id or content_understanding_document_analyzer_default }}"
-                                    >
-                                    <div class="form-text">Default: {{ content_understanding_document_analyzer_default }}</div>
-                                </div>
-                                <div class="col-md-4">
-                                    <label for="azure_content_understanding_image_analyzer_id" class="form-label">Image Analyzer</label>
-                                    <input
-                                        type="text"
-                                        class="form-control"
-                                        id="azure_content_understanding_image_analyzer_id"
-                                        name="azure_content_understanding_image_analyzer_id"
-                                        value="{{ settings.azure_content_understanding_image_analyzer_id or content_understanding_image_analyzer_default }}"
-                                    >
-                                    <div class="form-text">Default: {{ content_understanding_image_analyzer_default }}</div>
-                                </div>
-                            </div>
-
-                            <button
-                                type="button"
-                                class="btn btn-secondary"
-                                style="width: auto;"
-                                id="test_content_understanding_button"
-                            >
-                                Test Content Understanding Connection
-                            </button>
-                            <div id="test_content_understanding_result" class="mt-2"></div>
-                        </div>
-                        {% endif %}
-                    </div>
-
-                    <div class="card p-3 mb-3 bg-body-tertiary" id="office-embedded-image-section">
-                        <h6 class="mb-2"><i class="bi bi-images me-2"></i>Images Inside Office Files</h6>
-                        <p class="text-muted small">
-                            Neither extraction engine describes figures inside Word and PowerPoint files. When this is on,
-                            embedded images are pulled out of the file, analyzed with whichever engine backs the selected
-                            extraction mode, and indexed as their own citable chunks. This works with Standard extraction
-                            too, using Document Intelligence.
-                        </p>
-                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                            <input
-                                type="checkbox"
-                                class="form-check-input me-2"
-                                id="enable_office_embedded_image_analysis"
-                                name="enable_office_embedded_image_analysis"
-                                {% if settings.enable_office_embedded_image_analysis %}checked{% endif %}
-                            >
-                            <label class="form-check-label" for="enable_office_embedded_image_analysis">
-                                Analyze images embedded in DOCX and PPTX files
-                            </label>
-                        </div>
-                        <div class="row g-3 {% if not settings.enable_office_embedded_image_analysis %}d-none{% endif %}" id="office_embedded_image_options">
-                            <div class="col-md-6">
-                                <label for="office_embedded_image_min_pixels" class="form-label">Minimum Image Size (pixels)</label>
-                                <input
-                                    type="number"
-                                    class="form-control"
-                                    id="office_embedded_image_min_pixels"
-                                    name="office_embedded_image_min_pixels"
-                                    min="1"
-                                    max="2000"
-                                    value="{{ settings.office_embedded_image_min_pixels|default(150) }}"
-                                >
-                                <div class="form-text">Images narrower or shorter than this are skipped as icons or spacers.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="office_embedded_image_max_per_document" class="form-label">Maximum Images Per Document</label>
-                                <input
-                                    type="number"
-                                    class="form-control"
-                                    id="office_embedded_image_max_per_document"
-                                    name="office_embedded_image_max_per_document"
-                                    min="0"
-                                    max="200"
-                                    value="{{ settings.office_embedded_image_max_per_document|default(25) }}"
-                                >
-                                <div class="form-text">Caps per-document cost. Duplicate images are analyzed once.</div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="modal fade" id="documentIntelligenceExtractionHelpModal" tabindex="-1" aria-labelledby="documentIntelligenceExtractionHelpModalLabel" aria-hidden="true">
-                        <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                            <div class="modal-content">
-                                <div class="modal-header">
-                                    <h5 class="modal-title" id="documentIntelligenceExtractionHelpModalLabel">Standard, Enhanced, and Auto</h5>
-                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                                </div>
-                                <div class="modal-body">
-                                    <p><strong>Standard</strong> always uses Azure Document Intelligence Read. It is the fastest and lowest-cost path for mostly text-based PDFs and images, and it is what runs when Enhanced extraction is turned off.</p>
-                                    <p><strong>Enhanced</strong> is for documents where structure matters: tables, page layout, headings, forms, checked or unchecked boxes, and figures.</p>
-                                    <ul>
-                                        <li>In Azure commercial clouds, Enhanced uses <strong>Azure AI Content Understanding</strong>, which additionally generates natural-language descriptions of figures, charts, and diagrams.</li>
-                                        <li>In Azure Government and custom clouds, Content Understanding is unavailable, so Enhanced automatically uses <strong>Document Intelligence Layout</strong> instead. Tables and checkbox states still work; figure descriptions do not.</li>
-                                        <li>If Content Understanding is enabled but unreachable, the document falls back to Document Intelligence Layout and the reason is recorded on the document.</li>
-                                    </ul>
-                                    <p><strong>Auto</strong> lets the platform decide per document. It samples the configured number of first PDF pages with Document Intelligence Layout, which is the cheaper detector. If those pages contain tables, selection marks, or figures, the full document is extracted with Enhanced; otherwise it is extracted with Standard. Images always use Enhanced in Auto mode because they are single-page inputs that benefit from figure and spatial analysis.</p>
-                                    <p class="mb-0"><strong>Cost:</strong> Enhanced adds latency and cost on every document. Content Understanding also invokes a language model per document, so it is more expensive than Document Intelligence Layout. Auto is usually the best value.</p>
-                                </div>
-                                <div class="modal-footer">
-                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="modal fade" id="contentUnderstandingSetupHelpModal" tabindex="-1" aria-labelledby="contentUnderstandingSetupHelpModalLabel" aria-hidden="true">
-                        <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                            <div class="modal-content">
-                                <div class="modal-header">
-                                    <h5 class="modal-title" id="contentUnderstandingSetupHelpModalLabel">Set Up Azure AI Content Understanding</h5>
-                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                                </div>
-                                <div class="modal-body">
-                                    <p>Content Understanding is part of Microsoft Foundry. Follow these steps, then paste the endpoint and key below.</p>
-                                    <h6>1. Create a Microsoft Foundry resource</h6>
-                                    <p>
-                                        In the Azure portal, create a <strong>Microsoft Foundry</strong> resource in one of the supported regions:
-                                        East US, East US 2, West US, West US 3, South Central US, North Europe, West Europe, Sweden Central,
-                                        UK South, Australia East, Japan East, or Southeast Asia. You need Contributor or higher on the subscription
-                                        or resource group.
-                                    </p>
-                                    <div class="alert alert-warning small">
-                                        Content Understanding is not offered in Azure Government or other sovereign clouds. In those clouds
-                                        SimpleChat automatically uses Document Intelligence Layout for Enhanced extraction.
-                                    </div>
-                                    <h6>2. Deploy the models Content Understanding needs</h6>
-                                    <p>
-                                        Analyzers that describe figures require a completion model and an embedding model to be deployed and set
-                                        as resource defaults. In the
-                                        <a href="https://contentunderstanding.ai.azure.com/settings" target="_blank" rel="noopener noreferrer">Content Understanding settings page</a>,
-                                        add your Foundry resource and leave
-                                        <em>Enable autodeployment for required models if no defaults are available</em> checked. Without this step,
-                                        analysis requests fail with a missing model deployment error.
-                                    </p>
-                                    <h6>3. Copy the endpoint and key</h6>
-                                    <p>
-                                        In the Azure portal, open the Foundry resource and go to
-                                        <strong>Resource Management &rarr; Keys and Endpoint</strong>. The endpoint looks like
-                                        <code>https://your-resource.services.ai.azure.com</code>. Paste it into
-                                        <strong>Content Understanding Endpoint</strong>, and paste either key into
-                                        <strong>Content Understanding Key</strong>.
-                                    </p>
-                                    <h6>4. Or use managed identity instead of a key</h6>
-                                    <p>
-                                        Set <strong>Authentication Type</strong> to Managed Identity and assign this application's identity the
-                                        <strong>Cognitive Services User</strong> role on the Foundry resource. That role assignment is required even
-                                        for resource owners.
-                                    </p>
-                                    <h6>5. Test the connection</h6>
-                                    <p class="mb-0">
-                                        Use <strong>Test Content Understanding Connection</strong> to confirm the endpoint, credentials, and analyzer
-                                        are reachable before saving.
-                                        See the
-                                        <a href="https://learn.microsoft.com/azure/ai-services/content-understanding/quickstart/use-rest-api" target="_blank" rel="noopener noreferrer">Content Understanding quickstart</a>
-                                        for more detail.
-                                    </p>
-                                </div>
-                                <div class="modal-footer">
-                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                        <input
-                            type="checkbox"
-                            class="form-check-input me-2"
-                            id="enable_document_intelligence_apim"
-                            name="enable_document_intelligence_apim"
-                            {% if settings.enable_document_intelligence_apim %}checked{% endif %}
-                        >
-                        <label class="form-check-label" for="enable_document_intelligence_apim">
-                            Use APIM instead of direct Document Intelligence endpoint
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route Document Intelligence requests through API Management for centralized monitoring and control instead of direct service access."></i>
-                    </div>
-
-                    <div>
-
-                        <div id="non_apim_document_intelligence_settings" {% if settings.enable_document_intelligence_apim %}style="display: none;"{% endif %}>
-                            <div class="mb-3">
-                                <label for="azure_document_intelligence_endpoint" class="form-label">
-                                    Document Intelligence Endpoint
-                                </label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_document_intelligence_endpoint"
-                                    name="azure_document_intelligence_endpoint"
-                                    value="{{ settings.azure_document_intelligence_endpoint or '' }}"
-                                >
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_document_intelligence_authentication_type" class="form-label">
-                                    Authentication Type
-                                </label>
-                                <select class="form-select" id="azure_document_intelligence_authentication_type" name="azure_document_intelligence_authentication_type">
-                                    <option value="key" {% if settings.azure_document_intelligence_authentication_type=='key' %}selected{% endif %}>
-                                        Key
-                                    </option>
-                                    <option value="managed_identity" {% if settings.azure_document_intelligence_authentication_type=='managed_identity' %}selected{% endif %}>
-                                        Managed Identity
-                                    </option>
-                                </select>
-                            </div>
-                            <div class="mb-3" id="azure_document_intelligence_key_container" {% if settings.azure_document_intelligence_authentication_type !='key' %}style="display: none;"{% endif %}>
-                                <label for="azure_document_intelligence_key" class="form-label">
-                                    Document Intelligence Key
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_document_intelligence_key"
-                                        name="azure_document_intelligence_key"
-                                        value="{{ settings.azure_document_intelligence_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_docintel_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <div id="apim_document_intelligence_settings" {% if not settings.enable_document_intelligence_apim %}style="display: none;"{% endif %}>
-                            <div class="mb-3">
-                                <label for="azure_apim_document_intelligence_endpoint" class="form-label">
-                                    Azure APIM Document Intelligence Endpoint
-                                </label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_apim_document_intelligence_endpoint"
-                                    name="azure_apim_document_intelligence_endpoint"
-                                    value="{{ settings.azure_apim_document_intelligence_endpoint or '' }}"
-                                >
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_apim_document_intelligence_subscription_key" class="form-label">
-                                    Azure APIM Document Intelligence Subscription Key
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_apim_document_intelligence_subscription_key"
-                                        name="azure_apim_document_intelligence_subscription_key"
-                                        value="{{ settings.azure_apim_document_intelligence_subscription_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_azure_apim_document_intelligence_subscription_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <button
-                            type="button"
-                            class="btn btn-secondary mt-3"
-                            style="width: auto;"
-                            id="test_azure_doc_intelligence_button"
-                        >
-                            Test Document Intelligence Connection
-                        </button>
-                        <div id="test_azure_doc_intelligence_result" class="mt-2"></div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="chunk-size-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0"><i class="bi bi-collection me-2"></i>Chunk Sizes</h5>
-                        <span class="badge bg-primary-subtle text-primary-emphasis">Cap: {{ chunk_size_cap }}</span>
-                    </div>
-                    <p class="text-muted mb-2 small">Custom chunk sizes apply to new uploads only. Existing documents keep their current chunks.</p>
-                    <div class="alert alert-warning small mb-3">
-                        <strong>Heads up:</strong> Overrides are capped at {{ chunk_size_cap }} (2x embedding context window, fallback 16,384).
-                    </div>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_chunk_size_override"
-                            name="enable_chunk_size_override"
-                            {% if settings.enable_chunk_size_override %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_chunk_size_override">
-                            Enable custom chunk sizes by file type
-                        </label>
-                    </div>
-
-                    <div id="chunk-size-fields" class="{% if not settings.enable_chunk_size_override %}d-none{% endif %}">
-                        <div id="chunk-size-cap-warning" class="alert alert-warning d-none" role="alert">
-                            <span id="chunk-size-cap-warning-text">Chunk sizes above the cap will be reduced automatically.</span>
-                        </div>
-                        <input type="hidden" id="chunk_size_cap" value="{{ chunk_size_cap }}" />
-                        {% set chunk_settings = chunk_size_settings or {} %}
-                        {% set chunk_defaults = chunk_size_defaults or {} %}
-                        <div class="row g-3">
-                            <div class="col-md-6">
-                                <label for="chunk_size_txt" class="form-label">TXT (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="TXT" id="chunk_size_txt" name="chunk_size_txt" value="{{ chunk_settings.get('txt', {}).get('value', chunk_defaults.get('txt', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_log" class="form-label">LOG (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="LOG" id="chunk_size_log" name="chunk_size_log" value="{{ chunk_settings.get('log', {}).get('value', chunk_defaults.get('log', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="chunk_size_doc" class="form-label">DOC (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOC" id="chunk_size_doc" name="chunk_size_doc" value="{{ chunk_settings.get('doc', {}).get('value', chunk_defaults.get('doc', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="chunk_size_docm" class="form-label">DOCM (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOCM" id="chunk_size_docm" name="chunk_size_docm" value="{{ chunk_settings.get('docm', {}).get('value', chunk_defaults.get('docm', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="chunk_size_docx" class="form-label">DOCX (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOCX" id="chunk_size_docx" name="chunk_size_docx" value="{{ chunk_settings.get('docx', {}).get('value', chunk_defaults.get('docx', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_html" class="form-label">HTML (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="HTML" id="chunk_size_html" name="chunk_size_html" value="{{ chunk_settings.get('html', {}).get('value', chunk_defaults.get('html', {}).get('value')) }}">
-                                <div class="form-text">Minimum enforced at 50% of target on merge.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_md" class="form-label">Markdown (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="MD" id="chunk_size_md" name="chunk_size_md" value="{{ chunk_settings.get('md', {}).get('value', chunk_defaults.get('md', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_xml" class="form-label">XML (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="XML" id="chunk_size_xml" name="chunk_size_xml" value="{{ chunk_settings.get('xml', {}).get('value', chunk_defaults.get('xml', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_yaml" class="form-label">YAML (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="YAML" id="chunk_size_yaml" name="chunk_size_yaml" value="{{ chunk_settings.get('yaml', {}).get('value', chunk_defaults.get('yaml', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_yml" class="form-label">YML (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="YML" id="chunk_size_yml" name="chunk_size_yml" value="{{ chunk_settings.get('yml', {}).get('value', chunk_defaults.get('yml', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_json" class="form-label">JSON (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="JSON" id="chunk_size_json" name="chunk_size_json" value="{{ chunk_settings.get('json', {}).get('value', chunk_defaults.get('json', {}).get('value')) }}">
-                            </div>
-                            <!--
-                            <div class="col-md-6">
-                                <label for="chunk_size_csv" class="form-label">CSV (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="CSV" id="chunk_size_csv" name="chunk_size_csv" value="{{ chunk_settings.get('csv', {}).get('value', chunk_defaults.get('csv', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_excel" class="form-label">Excel (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="EXCEL" id="chunk_size_excel" name="chunk_size_excel" value="{{ chunk_settings.get('excel', {}).get('value', chunk_defaults.get('excel', {}).get('value')) }}">
-                            </div>
-                            -->
-                            <div class="col-md-6">
-                                <label for="chunk_size_transcript" class="form-label">Transcripts (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="TRANSCRIPT" id="chunk_size_transcript" name="chunk_size_transcript" value="{{ chunk_settings.get('transcript', {}).get('value', chunk_defaults.get('transcript', {}).get('value')) }}">
-                                <div class="form-text">Applies to new audio transcripts.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_pdf" class="form-label">PDF (pages)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="PDF" id="chunk_size_pdf" name="chunk_size_pdf" value="{{ chunk_settings.get('pdf', {}).get('value', chunk_defaults.get('pdf', {}).get('value')) }}">
-                                <div class="form-text">Pages per chunk after extraction.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_pptx" class="form-label">PPT/PPTX (slides)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="PPT/PPTX" id="chunk_size_pptx" name="chunk_size_pptx" value="{{ chunk_settings.get('pptx', {}).get('value', chunk_defaults.get('pptx', {}).get('value')) }}">
-                                <div class="form-text">Slides per chunk after extraction.</div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <!-- AI Video Intelligence Card -->
-                <div class="card p-4 mb-4 border-info shadow-sm" id="video-intelligence-section">
-                    <div class="d-flex align-items-center justify-content-between mb-3">
-                        <div class="d-flex align-items-center">
-                            <div class="bg-info text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
-                                <i class="bi bi-camera-video-fill fs-4"></i>
-                            </div>
-                            <div>
-                                <h4 class="mb-1">
-                                    <i class="bi bi-play-circle me-2"></i>AI Video Intelligence
-                                </h4>
-                                <p class="text-muted mb-0 small">Extract insights and make video content searchable and interactive</p>
-                            </div>
-                        </div>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#videoIndexerInfoModal">
-                            <i class="bi bi-info-circle me-1"></i>Setup Guide
-                        </button>
-                    </div>
-
-                    <div class="alert alert-info mb-4">
-                        <i class="bi bi-lightbulb-fill me-2"></i>
-                        <strong>Make Video Content Fully Searchable:</strong> Upload videos to your workspace and automatically extract transcripts, identify speakers, detect topics, and generate searchable timestamps. Your AI can then answer questions about video content, cite specific moments, and provide deep insights.
-                    </div>
-
-                    <!-- Video File Support Toggle -->
-                    <div class="mb-4">
-                        <div class="form-check form-switch mb-2">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="enable_video_file_support"
-                                name="enable_video_file_support"
-                                {% if settings.enable_video_file_support %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2 fw-bold" for="enable_video_file_support">
-                                <i class="bi bi-camera-video me-1"></i> Enable Video File Upload & Processing
-                            </label>
-                        </div>
-                        <p class="text-muted small ms-4 ps-3 mb-2">
-                            Upload video files (MP4, AVI, MOV, etc.) to workspaces where Azure Video Indexer automatically processes them.
-                            Extract spoken content, identify speakers, detect faces, recognize brands, and generate searchable metadata—perfect for meetings, presentations, training videos, and recorded content.
-                        </p>
-                        <div class="ms-4 ps-3">
-                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
-                                <i class="bi bi-search me-1"></i> Full-Text Search
-                            </span>
-                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
-                                <i class="bi bi-person-badge me-1"></i> Speaker ID
-                            </span>
-                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
-                                <i class="bi bi-clock-history me-1"></i> Timestamped Citations
-                            </span>
-                            <span class="badge bg-primary-subtle text-primary-emphasis">
-                                <i class="bi bi-translate me-1"></i> Multi-Language
-                            </span>
-                        </div>
-                    </div>
-
-                    {% set public_video_indexer_endpoint = "https://api.videoindexer.ai" %}
-                    {% set government_video_indexer_endpoint = "https://api.videoindexer.ai.azure.us" %}
-                    {% set configured_video_indexer_endpoint = settings.video_indexer_endpoint or default_video_indexer_endpoint %}
-                    {% if configured_video_indexer_endpoint == government_video_indexer_endpoint %}
-                        {% set video_indexer_cloud = "usgovernment" %}
-                    {% elif configured_video_indexer_endpoint == public_video_indexer_endpoint %}
-                        {% set video_indexer_cloud = "public" %}
-                    {% else %}
-                        {% set video_indexer_cloud = "custom" %}
-                    {% endif %}
-                    {% if azure_environment == "usgovernment" %}
-                        {% set azure_environment_label = "Azure Government" %}
-                    {% elif azure_environment == "custom" %}
-                        {% set azure_environment_label = "Custom Cloud" %}
-                    {% else %}
-                        {% set azure_environment_label = "Azure Public / Commercial" %}
-                    {% endif %}
-
-                    <!-- Video Indexer Configuration (collapsible) -->
-                    <div id="video_indexer_settings" class="border-top pt-3{% if not settings.enable_video_file_support %} d-none{% endif %}">
-                        <h5 class="mb-3">
-                            <i class="bi bi-gear-fill me-2"></i>Azure Video Indexer Configuration
-                        </h5>
-                        <p class="text-muted small mb-3">Connect to your Azure Video Indexer resource for advanced video processing and content extraction.</p>
-
-                        <div class="alert alert-info">
-                            <strong><i class="bi bi-info-circle"></i> Identity overview:</strong>
-                            <ul class="mb-0 mt-2">
-                                <li>Video Indexer can use its own managed identity to reach the linked Storage account during account creation.</li>
-                                <li>SimpleChat authenticates to Video Indexer with the <strong>App Service system-assigned managed identity</strong>.</li>
-                                <li>The App Service managed identity must have <strong>Contributor</strong> on the Video Indexer resource.</li>
-                                <li>See <a href="https://learn.microsoft.com/azure/azure-video-indexer/connect-to-azure" target="_blank">Azure Video Indexer documentation</a> for setup details</li>
-                            </ul>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_cloud" class="form-label">Cloud / Endpoint Mode</label>
-                            <select
-                                class="form-select"
-                                id="video_indexer_cloud"
-                                data-public-endpoint="{{ public_video_indexer_endpoint }}"
-                                data-government-endpoint="{{ government_video_indexer_endpoint }}"
-                                data-runtime-cloud="{{ azure_environment }}"
-                            >
-                                <option value="public" {% if video_indexer_cloud == 'public' %}selected{% endif %}>Azure Public / Commercial</option>
-                                <option value="usgovernment" {% if video_indexer_cloud == 'usgovernment' %}selected{% endif %}>Azure Government</option>
-                                <option value="custom" {% if video_indexer_cloud == 'custom' %}selected{% endif %}>Custom Endpoint</option>
-                            </select>
-                            <div class="form-text">Choose the endpoint family that matches your deployed cloud. Use Custom only when you need a non-standard Video Indexer endpoint.</div>
-                        </div>
-
-                        <div class="alert alert-secondary py-2">
-                            <strong>Current App Service environment:</strong> {{ azure_environment_label }}. This selector saves the Video Indexer API endpoint. If you are switching between Azure Public, Azure Government, or a custom cloud, update <code>AZURE_ENVIRONMENT</code> in your App Service configuration as well.
-                        </div>
-
-                        <div class="alert alert-warning py-2 mb-3 d-none" id="video_indexer_cloud_mismatch_alert">
-                            The selected Video Indexer cloud does not match this app's current <code>AZURE_ENVIRONMENT</code>. Update the App Service configuration if you are moving to a different cloud.
-                        </div>
-
-                        <input type="hidden" id="video_indexer_endpoint" name="video_indexer_endpoint" value="{{ configured_video_indexer_endpoint }}" />
-
-                        <div class="mb-3{% if video_indexer_cloud != 'custom' %} d-none{% endif %}" id="video_indexer_custom_endpoint_group">
-                            <label for="video_indexer_custom_endpoint" class="form-label">Custom API Endpoint</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="video_indexer_custom_endpoint"
-                                value="{% if video_indexer_cloud == 'custom' %}{{ configured_video_indexer_endpoint }}{% endif %}"
-                                placeholder="https://your-video-indexer-endpoint.example.com"
-                            />
-                            <div class="form-text">Only required when using a custom cloud or non-standard Video Indexer endpoint.</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_endpoint_display" class="form-label">Effective API Endpoint</label>
-                            <input type="text" class="form-control" id="video_indexer_endpoint_display" value="{{ configured_video_indexer_endpoint }}" readonly />
-                            <div class="form-text">Saved endpoint value used for Video Indexer API calls.</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_resource_group" class="form-label">Resource Group <span class="text-danger">*</span></label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_resource_group" name="video_indexer_resource_group"
-                                value="{{ settings.video_indexer_resource_group or '' }}"
-                                placeholder="e.g., rg-videoindexer-prod">
-                            <div class="form-text">The Azure resource group containing your Video Indexer account</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_subscription_id" class="form-label">Subscription ID <span class="text-danger">*</span></label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_subscription_id" name="video_indexer_subscription_id"
-                                value="{{ settings.video_indexer_subscription_id or '' }}"
-                                placeholder="e.g., 12345678-1234-1234-1234-123456789abc">
-                            <div class="form-text">Your Azure subscription ID</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_account_name" class="form-label">Account Name <span class="text-danger">*</span></label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_account_name" name="video_indexer_account_name"
-                                value="{{ settings.video_indexer_account_name or '' }}"
-                                placeholder="e.g., my-video-indexer">
-                            <div class="form-text">The name of your Video Indexer account resource</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_location" class="form-label">Location <span class="text-danger">*</span></label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_location" name="video_indexer_location"
-                                value="{{ settings.video_indexer_location or '' }}"
-                                placeholder="e.g., eastus">
-                            <div class="form-text">Azure region where your Video Indexer account is deployed (e.g., eastus, westus2, northeurope)</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_account_id" class="form-label">Account ID <span class="text-danger">*</span></label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_account_id" name="video_indexer_account_id"
-                                value="{{ settings.video_indexer_account_id or '' }}"
-                                placeholder="e.g., 12345678-abcd-1234-abcd-123456789abc">
-                            <div class="form-text">Found in the Video Indexer account Overview page in Azure Portal</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_arm_api_version" class="form-label">ARM API Version</label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_arm_api_version" name="video_indexer_arm_api_version"
-                                value="{{ settings.video_indexer_arm_api_version or default_video_indexer_arm_api_version }}">
-                            <div class="form-text">Default for {{ azure_environment_label }}: {{ default_video_indexer_arm_api_version }}</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_index_timeout" class="form-label">Timeout (seconds)</label>
-                            <input type="number" class="form-control"
-                                id="video_index_timeout" name="video_index_timeout"
-                                value="{{ settings.video_index_timeout or 600 }}">
-                        </div>
-                    </div>
-                </div>
-
-                    <!-- AI Voice Chat Card -->
-                    <div class="card p-4 mb-4 border-primary shadow-sm" id="ai-voice-chat-section">
-                        <div class="d-flex align-items-center justify-content-between mb-3">
-                            <div class="d-flex align-items-center">
-                                <div class="bg-primary text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
-                                    <i class="bi bi-mic-fill fs-4"></i>
-                                </div>
-                                <div>
-                                    <h4 class="mb-1">
-                                        <i class="bi bi-soundwave me-2"></i>AI Voice Conversations
-                                    </h4>
-                                    <p class="text-muted mb-0 small">Transform your AI experience with natural voice interactions</p>
-                                </div>
-                            </div>
-                            <button type="button" class="btn btn-outline-primary btn-sm" data-bs-toggle="modal" data-bs-target="#speechServiceInfoModal">
-                                <i class="bi bi-info-circle me-1"></i>Setup Guide
-                            </button>
-                        </div>
-
-                        <!-- AI Response Completion Audio -->
-                        <div class="mb-4">
-                            <div class="form-check form-switch mb-2">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="enable_chat_completion_audio_cues"
-                                    name="enable_chat_completion_audio_cues"
-                                    {% if settings.enable_chat_completion_audio_cues %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2 fw-bold" for="enable_chat_completion_audio_cues">
-                                    <i class="bi bi-bell-fill me-1"></i> Enable AI Response Completion Audio Cues
-                                </label>
-                            </div>
-                            <p class="text-muted small ms-4 ps-3 mb-0">
-                                Let users opt in to a bundled sound when an AI response finishes outside their active view.
-                                These local cues do not require Azure Speech Service.
-                            </p>
-                        </div>
-
-                        <div class="alert alert-info mb-4" id="speech_service_shared_alert">
-                            <i class="bi bi-lightbulb-fill me-2"></i>
-                            <strong>One Speech resource, three features:</strong> Audio file uploads, Voice Input, and Voice Responses all use the same Azure Speech Service section below. Configure the Speech resource once, then turn on whichever speech features you need.
-                        </div>
-
-                        <!-- Audio File Support -->
-                        <div class="mb-4">
-                            {% set audio_runtime = audio_runtime_capabilities or {} %}
-                            {% set audio_supported_extensions = audio_runtime.supported_extensions or [] %}
-                            {% set audio_direct_extensions = audio_runtime.direct_transcription_extensions or [] %}
-                            <div class="form-check form-switch mb-2">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="enable_audio_file_support"
-                                    name="enable_audio_file_support"
-                                    {% if settings.enable_audio_file_support %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2 fw-bold" for="enable_audio_file_support">
-                                    <i class="bi bi-file-earmark-music me-1"></i> Enable Audio File Upload & Processing
-                                </label>
-                            </div>
-                            <p class="text-muted small ms-4 ps-3 mb-0">
-                                Upload audio files (MP3, WAV, M4A, etc.) to workspaces where they're automatically transcribed and indexed.
-                                The AI can then search, analyze, and answer questions about audio content—perfect for meetings, interviews, lectures, and podcasts.
-                            </p>
-                            <div class="ms-4 ps-3 mt-2">
-                                <div class="small {% if audio_runtime.broad_transcoding_available %}text-success{% else %}text-warning{% endif %}" id="audio_runtime_status">
-                                    <i class="bi {% if audio_runtime.broad_transcoding_available %}bi-check-circle{% else %}bi-exclamation-triangle{% endif %} me-1"></i>{{ audio_runtime.message or 'Audio runtime support has not been checked yet.' }}
-                                </div>
-                                <div class="small text-muted mt-1" id="audio_supported_extensions">
-                                    Supported audio upload extensions: {{ audio_supported_extensions|join(', ') }}
-                                </div>
-                                {% if audio_direct_extensions %}
-                                <div class="small text-muted mt-1">
-                                    Without FFmpeg, source-file fallback is best for: {{ audio_direct_extensions|join(', ') }}. Container builds can include FFmpeg for broader codec support.
-                                </div>
-                                {% endif %}
-                            </div>
-                        </div>
-
-                        <!-- Speech-to-Text -->
-                        <div class="mb-4">
-                            <div class="form-check form-switch mb-2">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="enable_speech_to_text_input"
-                                    name="enable_speech_to_text_input"
-                                    {% if settings.enable_speech_to_text_input %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2 fw-bold" for="enable_speech_to_text_input">
-                                    <i class="bi bi-mic me-1"></i> Enable Voice Input (Speech-to-Text)
-                                </label>
-                            </div>
-                            <p class="text-muted small ms-4 ps-3 mb-2">
-                                Talk to your AI instead of typing. Record voice messages up to 90 seconds directly in the chat interface.
-                                Azure Speech Service instantly transcribes your speech with high accuracy, supporting multiple languages and accents.
-                            </p>
-                            <div class="ms-4 ps-3">
-                                <span class="badge bg-success-subtle text-success-emphasis me-2">
-                                    <i class="bi bi-hand-thumbs-up-fill me-1"></i> Hands-Free
-                                </span>
-                                <span class="badge bg-success-subtle text-success-emphasis me-2">
-                                    <i class="bi bi-universal-access me-1"></i> Accessible
-                                </span>
-                                <span class="badge bg-success-subtle text-success-emphasis">
-                                    <i class="bi bi-lightning-fill me-1"></i> Fast Input
-                                </span>
-                            </div>
-                        </div>
-
-                        <!-- Text-to-Speech -->
-                        <div class="mb-4">
-                            <div class="form-check form-switch mb-2">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="enable_text_to_speech"
-                                    name="enable_text_to_speech"
-                                    {% if settings.enable_text_to_speech %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2 fw-bold" for="enable_text_to_speech">
-                                    <i class="bi bi-volume-up me-1"></i> Enable Voice Responses (Text-to-Speech)
-                                </label>
-                            </div>
-                            <p class="text-muted small ms-4 ps-3 mb-2">
-                                Hear AI responses read aloud in natural, human-like voices powered by Azure's advanced neural Text-to-Speech.
-                                Each message includes a speaker button—click to listen while multitasking, commuting, or whenever reading isn't convenient.
-                            </p>
-                            <div class="ms-4 ps-3">
-                                <span class="badge bg-info-subtle text-info-emphasis me-2">
-                                    <i class="bi bi-ear-fill me-1"></i> Natural Voices
-                                </span>
-                                <span class="badge bg-info-subtle text-info-emphasis me-2">
-                                    <i class="bi bi-arrows-fullscreen me-1"></i> Multitask-Friendly
-                                </span>
-                                <span class="badge bg-info-subtle text-info-emphasis">
-                                    <i class="bi bi-globe me-1"></i> Multi-Language
-                                </span>
-                            </div>
-                        </div>
-
-                        <!-- Speech Service Configuration (collapsible) -->
-                        <div id="audio_service_settings" class="border-top pt-3{% if not (settings.enable_audio_file_support or settings.enable_speech_to_text_input or settings.enable_text_to_speech) %} d-none{% endif %}">
-                            <h5 class="mb-3">
-                                <i class="bi bi-gear-fill me-2"></i>Azure Speech Service Configuration
-                            </h5>
-                            <p class="text-muted small mb-3">Configure the shared Azure Speech resource used by audio transcription, voice input, and text-to-speech.</p>
-
-                        <div class="alert alert-info py-2">
-                            <strong>Shared configuration:</strong> These settings apply to all enabled speech features. If you use managed identity and also enable Voice Responses, fill in the Speech Resource ID field so the Speech SDK can authenticate synthesis requests.
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="speech_service_endpoint" class="form-label">Endpoint</label>
-                            <input type="text" class="form-control"
-                                id="speech_service_endpoint" name="speech_service_endpoint"
-                                value="{{ settings.speech_service_endpoint or '' }}"
-                                placeholder="https://<location or custom domain>.cognitiveservices.azure.<com or us>/">
-                            <div class="form-text">Use the resource-specific custom-domain endpoint when selecting Managed Identity.</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="speech_service_location" class="form-label">Location</label>
-                            <input type="text" class="form-control"
-                                id="speech_service_location" name="speech_service_location"
-                                value="{{ settings.speech_service_location or '' }}">
-                            <div class="form-text">Required for speech recognition locale defaults and for text-to-speech when using Managed Identity.</div>
-                        </div>
-
-                        <div class="mb-3{% if settings.speech_service_authentication_type != 'managed_identity' %} d-none{% endif %}" id="speech_service_resource_id_container">
-                            <div class="alert alert-secondary py-2 mb-3">
-                                <strong>Resource ID builder:</strong> If the full ARM resource ID is hard to find in the portal, enter the subscription ID, resource group, and Speech resource name below. Simple Chat can build the resource ID for you.
-                            </div>
-
-                            <div class="row g-3 mb-3">
-                                <div class="col-md-6">
-                                    <label for="speech_service_subscription_id" class="form-label">Speech Subscription ID</label>
-                                    <input type="text" class="form-control"
-                                        id="speech_service_subscription_id" name="speech_service_subscription_id"
-                                        value="{{ settings.speech_service_subscription_id or '' }}"
-                                        placeholder="12345678-1234-1234-1234-123456789abc">
-                                </div>
-                                <div class="col-md-6">
-                                    <label for="speech_service_resource_group" class="form-label">Speech Resource Group</label>
-                                    <input type="text" class="form-control"
-                                        id="speech_service_resource_group" name="speech_service_resource_group"
-                                        value="{{ settings.speech_service_resource_group or '' }}"
-                                        placeholder="rg-speech-prod">
-                                </div>
-                                <div class="col-md-6">
-                                    <label for="speech_service_resource_name" class="form-label">Speech Resource Name</label>
-                                    <input type="text" class="form-control"
-                                        id="speech_service_resource_name" name="speech_service_resource_name"
-                                        value="{{ settings.speech_service_resource_name or '' }}"
-                                        placeholder="my-speech-resource">
-                                    <div class="form-text">If you use a custom-domain Speech endpoint, this is usually the first part of that hostname.</div>
-                                </div>
-                                <div class="col-md-6 d-flex align-items-end">
-                                    <button type="button" class="btn btn-outline-secondary w-100" id="build_speech_resource_id_btn">
-                                        Build Resource ID
-                                    </button>
-                                </div>
-                            </div>
-
-                            <div class="form-text mb-2" id="speech_resource_id_builder_status">Provide Subscription ID, Resource Group, and Speech Resource Name to auto-build the ARM resource ID.</div>
-
-                            <label for="speech_service_resource_id" class="form-label">Speech Resource ID</label>
-                            <input type="text" class="form-control"
-                                id="speech_service_resource_id" name="speech_service_resource_id"
-                                value="{{ settings.speech_service_resource_id or '' }}"
-                                placeholder="/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<speech-resource>">
-                            <div class="form-text">Required for Voice Responses when using Managed Identity. You can paste the full value manually, or let the fields above build it for you.</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="speech_service_locale" class="form-label">Locale</label>
-                            <input type="text" class="form-control"
-                                id="speech_service_locale" name="speech_service_locale"
-                                value="{{ settings.speech_service_locale or '' }}">
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="speech_service_authentication_type" class="form-label">
-                                Authentication Type
-                            </label>
-                            <select class="form-select" id="speech_service_authentication_type" name="speech_service_authentication_type">
-                                <option value="key" {% if settings.speech_service_authentication_type == 'key' or not settings.speech_service_authentication_type %}selected{% endif %}>
-                                    Key
-                                </option>
-                                <option value="managed_identity" {% if settings.speech_service_authentication_type == 'managed_identity' %}selected{% endif %}>
-                                    Managed Identity
-                                </option>
-                            </select>
-                        </div>
-                        <div class="mb-3{% if settings.speech_service_authentication_type == 'managed_identity' %} d-none{% endif %}" id="speech_service_key_container">
-                            <label for="speech_service_key" class="form-label">
-                                API Key
-                            </label>
-                            <div class="input-group">
-                                <input
-                                    type="password"
-                                    class="form-control"
-                                    id="speech_service_key"
-                                    name="speech_service_key"
-                                    value="{{ settings.speech_service_key or '' }}"
-                                >
-                                <button
-                                    type="button"
-                                    class="btn btn-outline-secondary"
-                                    id="toggle_speech_service_key"
-                                >
-                                    Show
-                                </button>
-                            </div>
-                            <div class="form-text">Required only when Authentication Type is set to Key.</div>
-                        </div>
-
-                        <div class="alert alert-secondary mt-3 mb-0">
-                            <strong>Managed identity roles:</strong> Start with <strong>Cognitive Services Speech User</strong>. If fast transcription or other write-style speech operations still return authorization errors, add <strong>Cognitive Services Speech Contributor</strong>. Managed identity also requires a custom-domain endpoint.
-                        </div>
-
-                    </div>
-                    <p class="mt-2 mb-0">
-                        <small class="text-muted">
-                            <a href="#enhanced-citations-section" data-admin-link="enhanced-citations-section">
-                                Enhanced Citations
-                            </a>
-                             will dramatically improve the citation experience for video and audio files.
-                        </small>
-                    </p>
-                </div>
-            </div>
diff --git a/application/single_app/templates/admin/_panes/search-index.html b/application/single_app/templates/admin/_panes/search-index.html
new file mode 100644
index 000000000..285f96da9
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/search-index.html
@@ -0,0 +1,119 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'search-index' %} show active{% endif %}" id="search-index" role="tabpanel" aria-labelledby="search-index-tab">
+                <div class="card p-3 mb-3" id="azure-ai-search-section">
+                    <h5><i class="bi bi-search me-2"></i>Azure AI Search</h5>
+                    <p class="text-muted">
+                        Configure Azure AI Search settings.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                        <input
+                            type="checkbox"
+                            class="form-check-input me-2"
+                            id="enable_ai_search_apim"
+                            name="enable_ai_search_apim"
+                            {% if settings.enable_ai_search_apim %}checked{% endif %}
+                        >
+                        <label class="form-check-label" for="enable_ai_search_apim">
+                            Use APIM instead of direct Azure AI Search
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route Azure AI Search requests through API Management for centralized monitoring and control instead of direct service access."></i>
+                    </div>
+
+                    <div>
+
+                        <div id="non_apim_ai_search_settings" {% if settings.enable_ai_search_apim %}style="display: none;"{% endif %}>
+                            <div class="mb-3">
+                                <label for="azure_ai_search_endpoint" class="form-label">Search Endpoint</label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_ai_search_endpoint"
+                                    name="azure_ai_search_endpoint"
+                                    value="{{ settings.azure_ai_search_endpoint or '' }}"
+                                >
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_ai_search_authentication_type" class="form-label">
+                                    Authentication Type
+                                </label>
+                                <select class="form-select" id="azure_ai_search_authentication_type" name="azure_ai_search_authentication_type">
+                                    <option value="key" {% if settings.azure_ai_search_authentication_type=='key' %}selected{% endif %}>
+                                        Key
+                                    </option>
+                                    <option value="managed_identity" {% if settings.azure_ai_search_authentication_type=='managed_identity' %}selected{% endif %}>
+                                        Managed Identity
+                                    </option>
+                                </select>
+                            </div>
+                            <div class="mb-3" id="azure_ai_search_key_container" {% if settings.azure_ai_search_authentication_type !='key' %}style="display: none;"{% endif %}>
+                                <label for="azure_ai_search_key" class="form-label">Search Key</label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_ai_search_key"
+                                        name="azure_ai_search_key"
+                                        value="{{ settings.azure_ai_search_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_search_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <div id="apim_ai_search_settings" {% if not settings.enable_ai_search_apim %}style="display: none;"{% endif %}>
+                            <div class="mb-3">
+                                <label for="azure_apim_ai_search_endpoint" class="form-label">
+                                    Azure APIM AI Search Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_apim_ai_search_endpoint"
+                                    name="azure_apim_ai_search_endpoint"
+                                    value="{{ settings.azure_apim_ai_search_endpoint or '' }}"
+                                >
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_apim_ai_search_subscription_key" class="form-label">
+                                    Azure APIM AI Search Subscription Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_apim_ai_search_subscription_key"
+                                        name="azure_apim_ai_search_subscription_key"
+                                        value="{{ settings.azure_apim_ai_search_subscription_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_azure_apim_ai_search_subscription_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <button
+                            type="button"
+                            class="btn btn-secondary mt-3"
+                            style="width: auto;"
+                            id="test_azure_ai_search_button"
+                        >
+                            Test Azure AI Search Connection
+                        </button>
+                        <div id="test_azure_ai_search_result" class="mt-2"></div>
+                    </div>
+                </div>
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/security.html b/application/single_app/templates/admin/_panes/secrets.html
similarity index 99%
rename from application/single_app/templates/admin/_panes/security.html
rename to application/single_app/templates/admin/_panes/secrets.html
index 40d43e1a9..dbf36ddc0 100644
--- a/application/single_app/templates/admin/_panes/security.html
+++ b/application/single_app/templates/admin/_panes/secrets.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="security" role="tabpanel" aria-labelledby="security-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'secrets' %} show active{% endif %}" id="secrets" role="tabpanel" aria-labelledby="secrets-tab">
                 <p class="text-muted">
                     Manage security settings for key vault and other security configurations.
                 </p>
diff --git a/application/single_app/templates/admin/_panes/send-feedback.html b/application/single_app/templates/admin/_panes/send-feedback.html
index 1d9cdb365..5acd28833 100644
--- a/application/single_app/templates/admin/_panes/send-feedback.html
+++ b/application/single_app/templates/admin/_panes/send-feedback.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="send-feedback" role="tabpanel" aria-labelledby="send-feedback-tab" data-app-version="{{ config['VERSION'] }}">
+            <div class="tab-pane fade{% if admin_landing_tab == 'send-feedback' %} show active{% endif %}" id="send-feedback" role="tabpanel" aria-labelledby="send-feedback-tab" data-app-version="{{ config['VERSION'] }}">
                 <p class="text-muted">
                     Prepare a prefilled email draft for bug reports or feature requests. This utility is separate from saved settings and records each submission intent in the activity log before opening your local email client.
                 </p>
diff --git a/application/single_app/templates/admin/_panes/session.html b/application/single_app/templates/admin/_panes/session.html
new file mode 100644
index 000000000..cb8fe9abe
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/session.html
@@ -0,0 +1,87 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'session' %} show active{% endif %}" id="session" role="tabpanel" aria-labelledby="session-tab">
+                <div class="card p-3 mb-3" id="system-settings-section">
+                    <h5>
+                        <i class="bi bi-gear-fill me-2"></i>System Settings
+                    </h5>
+                    <p class="text-muted">
+                        System-level settings that control application behavior, including file size limits, conversation history,
+                        and default prompts.
+                    </p>
+                    <div class="mb-3">
+                        <label for="max_file_size_mb" class="form-label">Maximum File Size (MB)</label>
+                        <input type="number" class="form-control" id="max_file_size_mb" name="max_file_size_mb"
+                            value="{{ settings.max_file_size_mb }}">
+                    </div>
+                    <div class="mb-3">
+                        <label for="conversation_history_limit" class="form-label">
+                            Conversation History Limit
+                        </label>
+                        <input type="number" class="form-control" id="conversation_history_limit"
+                            name="conversation_history_limit" value="{{ settings.conversation_history_limit }}">
+                    </div>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_idle_timeout"
+                            name="enable_idle_timeout"
+                            {% if settings.enable_idle_timeout %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_idle_timeout">
+                            Enable Idle Session Timeout and Warning
+                        </label>
+                        <button
+                             type="button"
+                             class="btn btn-link p-0 ms-2"
+                             data-bs-toggle="tooltip"
+                             title="When enabled, inactive users receive a warning and are automatically logged out after the configured timeout."
+                             aria-label="More information about idle timeout settings">
+                             <i class="bi bi-info-circle" aria-hidden="true"></i>
+                         </button>
+                    </div>
+                    <div id="idle_timeout_settings" class="{% if settings.enable_idle_timeout is not defined or not settings.enable_idle_timeout %}d-none{% endif %}">
+                        <div class="mb-3">
+                            <label for="idle_timeout_minutes" class="form-label">Idle Logout Timeout (Minutes)</label>
+                            <input
+                                type="number"
+                                class="form-control"
+                                id="idle_timeout_minutes"
+                                name="idle_timeout_minutes"
+                                min="10"
+                                value="{{ settings.idle_timeout_minutes | default(30) }}">
+                            <small class="form-text text-muted">Users are logged out locally after this many minutes of inactivity. Minimum value: 10 minutes.</small>
+                        </div>
+                        <div class="mb-3">
+                            <label for="idle_warning_minutes" class="form-label">Idle Warning Time (Minutes)</label>
+                            <input
+                                type="number"
+                                class="form-control"
+                                id="idle_warning_minutes"
+                                name="idle_warning_minutes"
+                                min="0"
+                                value="{{ settings.idle_warning_minutes | default(28) }}">
+                            <small class="form-text text-muted">Show the warning modal after this many minutes of inactivity. Set this equal to the logout timeout to disable the warning dialog window.</small>
+                        </div>
+                        <div class="mb-3">
+                            <label for="idle_warning_message" class="form-label">Idle Warning Message</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="idle_warning_message"
+                                name="idle_warning_message"
+                                value="{{ settings.idle_warning_message | default("You've been inactive for a while.") }}">
+                            <small class="form-text text-muted">Custom text shown at the top of the idle warning dialog.</small>
+                        </div>
+                    </div>
+                    <div class="mb-3">
+                        <label for="default_system_prompt" class="form-label">Default System Prompt</label>
+                        <textarea class="form-control" id="default_system_prompt" name="default_system_prompt"
+                            rows="5">{{ settings.default_system_prompt }}</textarea>
+                    </div>
+                    <div class="mb-3">
+                        <label for="access_denied_message" class="form-label">Access Denied Message</label>
+                        <small class="text-muted d-block mb-1">Shown to signed-in users who lack the required roles. Use Enter for line breaks.</small>
+                        <textarea class="form-control" id="access_denied_message" name="access_denied_message"
+                            rows="3">{{ settings.access_denied_message }}</textarea>
+                    </div>
+                </div>
+            </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/support-menu.html b/application/single_app/templates/admin/_panes/support-menu.html
new file mode 100644
index 000000000..57c11877b
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/support-menu.html
@@ -0,0 +1,105 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'support-menu' %} show active{% endif %}" id="support-menu" role="tabpanel" aria-labelledby="support-menu-tab">
+                <div class="card p-3 mb-3" id="support-menu-section">
+                    <h5>
+                        <i class="bi bi-life-preserver me-2"></i>Support
+                    </h5>
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" id="enable_support_menu" name="enable_support_menu"
+                            {% if settings.enable_support_menu %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_support_menu">
+                            Enable Support Menu for End Users
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a Support menu in navigation for signed-in users with the User role."></i>
+                    </div>
+                    <p class="text-muted small">When enabled, users can access Support destinations like Send Feedback and Latest Features directly from navigation.</p>
+
+                    <div id="support_menu_settings" {% if not settings.enable_support_menu %}style="display: none;"{% endif %}>
+                        <div class="mb-3">
+                            <label for="support_menu_name" class="form-label">Menu Name</label>
+                            <input type="text" class="form-control" id="support_menu_name" name="support_menu_name"
+                                   value="{{ settings.support_menu_name or 'Support' }}" placeholder="Support">
+                            <small class="form-text text-muted">This name will appear in user navigation as the Support menu title.</small>
+                        </div>
+
+                        <div class="form-check form-switch mb-2">
+                            <input class="form-check-input" type="checkbox" id="enable_support_send_feedback" name="enable_support_send_feedback"
+                                {% if settings.enable_support_send_feedback %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="enable_support_send_feedback">
+                                Enable Send Feedback Destination
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to prepare support feedback emails that route to your internal recipient."></i>
+                        </div>
+
+                        <div class="mb-3" id="support_feedback_recipient_group" {% if not settings.enable_support_send_feedback %}style="display: none;"{% endif %}>
+                            <label for="support_feedback_recipient_email" class="form-label">Support Recipient Email</label>
+                            <input type="email" class="form-control" id="support_feedback_recipient_email" name="support_feedback_recipient_email"
+                                   value="{{ settings.support_feedback_recipient_email or '' }}" placeholder="support@contoso.com">
+                            <small class="form-text text-muted">User Send Feedback drafts will be addressed to this internal email address.</small>
+                        </div>
+
+                        <div class="form-check form-switch mb-2">
+                            <input class="form-check-input" type="checkbox" id="enable_support_latest_features" name="enable_support_latest_features"
+                                {% if settings.enable_support_latest_features %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="enable_support_latest_features">
+                                Enable Latest Features Destination
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show a user-facing Latest Features page from the Support menu."></i>
+                        </div>
+
+                        <div id="support_latest_features_settings" {% if not settings.enable_support_latest_features %}style="display: none;"{% endif %}>
+                            <h6 class="mt-3">User-Facing Latest Features</h6>
+                            <p class="text-muted small">Choose which recent features are shared on the user Latest Features page. Deployment and Redis start unchecked because they are mainly admin-facing rollout and infrastructure topics.</p>
+                            <div class="form-check form-switch mb-3">
+                                <input class="form-check-input" type="checkbox" id="enable_support_latest_feature_documentation_links" name="enable_support_latest_feature_documentation_links"
+                                    {% if settings.enable_support_latest_feature_documentation_links %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="enable_support_latest_feature_documentation_links">
+                                    Show Simple Chat Documentation Guide Links
+                                </label>
+                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show public documentation guide buttons alongside the in-app Latest Features shortcuts. This is disabled by default."></i>
+                                <small class="form-text text-muted d-block mt-1">When enabled, user-facing Latest Features cards can show public guide buttons in addition to the direct in-app shortcuts.</small>
+                            </div>
+                            {% for release_group in support_latest_feature_release_groups %}
+                            {% set checklist_collapse_id = release_group.collapse_id ~ 'Checklist' %}
+                            <div class="card border-0 bg-body-tertiary mb-3">
+                                <div class="card-body p-3">
+                                    <div class="d-flex flex-column flex-md-row align-items-md-center justify-content-between gap-3">
+                                        <div>
+                                            <h6 class="mb-1">{{ release_group.label }}{% if release_group.release_version %}<span class="badge bg-light text-dark ms-2">v{{ release_group.release_version }}</span>{% endif %}</h6>
+                                            <p class="text-muted small mb-0">{{ release_group.description }}</p>
+                                        </div>
+                                        {% if not release_group.default_expanded %}
+                                        <button
+                                            type="button"
+                                            class="btn btn-sm btn-outline-secondary"
+                                            data-bs-toggle="collapse"
+                                            data-bs-target="#{{ checklist_collapse_id }}"
+                                            aria-expanded="false"
+                                            aria-controls="{{ checklist_collapse_id }}"
+                                        >
+                                            Show {{ release_group.label }}
+                                        </button>
+                                        {% endif %}
+                                    </div>
+                                    <div {% if not release_group.default_expanded %}class="collapse mt-3" id="{{ checklist_collapse_id }}"{% else %}class="mt-3"{% endif %}>
+                                        <div class="row g-2">
+                                            {% for feature in release_group.features %}
+                                            <div class="col-md-6">
+                                                <div class="form-check border rounded p-3 h-100">
+                                                    <input class="form-check-input" type="checkbox" id="support_latest_feature_{{ feature.id }}" name="support_latest_feature_{{ feature.id }}"
+                                                        {% if settings.support_latest_features_visibility.get(feature.id, true) %}checked{% endif %}>
+                                                    <label class="form-check-label ms-2" for="support_latest_feature_{{ feature.id }}">
+                                                        <span class="fw-semibold d-block">{{ feature.title }}</span>
+                                                        <span class="text-muted small">{{ feature.summary }}</span>
+                                                    </label>
+                                                </div>
+                                            </div>
+                                            {% endfor %}
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+                            {% endfor %}
+                        </div>
+                    </div>
+                </div>
+            </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/web-research.html b/application/single_app/templates/admin/_panes/web-research.html
new file mode 100644
index 000000000..7ad547075
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/web-research.html
@@ -0,0 +1,519 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'web-research' %} show active{% endif %}" id="web-research" role="tabpanel" aria-labelledby="web-research-tab">
+
+                 <p class="text-muted">
+                    Configure Azure AI Search, Document Intelligence, and multimedia support settings.
+                </p>
+
+                <div class="card p-3 mb-3" id="web-search-foundry-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0"><i class="bi bi-globe me-2"></i>Web Search (Azure AI Foundry Agent)</h5>
+                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#webSearchFoundryInfoModal">
+                            <i class="bi bi-info-circle me-1"></i>Setup Guide
+                        </button>
+                    </div>
+                    <p class="text-muted mb-2">Enable web search by routing queries through an Azure AI Foundry agent configured by admins.</p>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_web_search"
+                            name="enable_web_search"
+                            {% if settings.enable_web_search %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_web_search">Enable Web Search via Foundry Agent</label>
+                    </div>
+                    <input
+                        type="hidden"
+                        id="web_search_consent_accepted"
+                        name="web_search_consent_accepted"
+                        value="{{ 'true' if settings.web_search_consent_accepted else 'false' }}"
+                    >
+
+                    <div id="web_search_foundry_settings" class="{% if not settings.enable_web_search %}d-none{% endif %}">
+                        <!-- User Notice Settings -->
+                        <div class="card p-3 mb-3 bg-light">
+                            <h6 class="mb-2"><i class="bi bi-bell me-2"></i>User Data Notice</h6>
+                            <p class="text-muted small mb-2">Optionally show users a one-time notice explaining that their message will be sent to Bing for web search.</p>
+                            <div class="form-check form-switch mb-3">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input mb-3"
+                                    id="enable_web_search_user_notice"
+                                    name="enable_web_search_user_notice"
+                                    {% if settings.enable_web_search_user_notice %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2 mb-3" for="enable_web_search_user_notice">Show data notice to users when web search is used</label>
+                            </div>
+                            <div id="web_search_user_notice_settings" class="{% if not settings.enable_web_search_user_notice %}d-none{% endif %}">
+                                <label for="web_search_user_notice_text" class="form-label">Notice Text</label>
+                                <textarea class="form-control" id="web_search_user_notice_text" name="web_search_user_notice_text" rows="2" placeholder="Your current message will be sent to Microsoft Bing for web search...">{{ settings.web_search_user_notice_text or 'Your current message will be sent to Microsoft Bing for web search. Conversation history is not sent for web search, but any sensitive content you paste into this message may be sent.' }}</textarea>
+                                <div class="form-text">This message will be shown to users once per session when they first use web search.</div>
+                            </div>
+                        </div>
+                        <div class="row g-3">
+                            <div class="col-12" id="web_search_foundry_endpoint_container">
+                                <label for="web_search_foundry_endpoint" class="form-label">Foundry Project Endpoint</label>
+                                <input type="text" class="form-control" id="web_search_foundry_endpoint" name="web_search_foundry_endpoint" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.endpoint if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else settings.web_search_agent.azure_openai_gpt_endpoint or '' }}" placeholder="https://<resource>.services.ai.azure.com/api/projects/<project-name>">
+                                <div class="form-text">Project endpoint format: https://&lt;foundry-resource&gt;.services.ai.azure.com/api/projects/&lt;project-name&gt; (not the inference endpoint).</div>
+                            </div>
+                            <div class="col-md-6" id="web_search_foundry_api_version_container">
+                                <label for="web_search_foundry_api_version" class="form-label">Foundry API Version</label>
+                                <input type="text" class="form-control" id="web_search_foundry_api_version" name="web_search_foundry_api_version" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.api_version if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else settings.web_search_agent.azure_openai_gpt_api_version or '' }}" placeholder="2025-05-01">
+                                <a href="https://learn.microsoft.com/en-us/rest/api/aifoundry/aiprojects/?view=foundry#versioning" target="_blank" class="ms-2" rel="noopener noreferrer">
+                                    AI Foundry Versioning<i class="bi bi-box-arrow-up-right"></i>
+                                </a>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="web_search_foundry_agent_id" class="form-label">Foundry Agent ID</label>
+                                <input type="text" class="form-control" id="web_search_foundry_agent_id" name="web_search_foundry_agent_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.agent_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="ID from Azure AI Foundry. Typically starts with asst_">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="web_search_foundry_auth_type" class="form-label">Authentication Type</label>
+                                <select class="form-select" id="web_search_foundry_auth_type" name="web_search_foundry_auth_type">
+                                    {% set foundry_auth_type = settings.web_search_agent.other_settings.azure_ai_foundry.authentication_type if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else 'managed_identity' %}
+                                    <option value="managed_identity" {% if foundry_auth_type=='managed_identity' %}selected{% endif %}>Managed Identity</option>
+                                    <option value="service_principal" {% if foundry_auth_type=='service_principal' %}selected{% endif %}>Service Principal</option>
+                                </select>
+                                <div class="form-text text-muted">Identity must have Cognitive Services User and AI Developer roles on the Foundry project.</div>
+                            </div>
+                            <div class="col-md-4" id="web_search_foundry_cloud_container">
+                                <label for="web_search_foundry_cloud" class="form-label">Cloud</label>
+                                <select class="form-select" id="web_search_foundry_cloud" name="web_search_foundry_cloud">
+                                    {% set foundry_cloud = settings.web_search_agent.other_settings.azure_ai_foundry.cloud if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' %}
+                                    <option value="" {% if foundry_cloud=='' %}selected{% endif %}>Azure Public</option>
+                                    <option value="usgov" {% if foundry_cloud=='usgov' or foundry_cloud=='usgovernment' or foundry_cloud=='gcc' %}selected{% endif %}>Azure Government</option>
+                                    <option value="custom" {% if foundry_cloud=='custom' %}selected{% endif %}>Custom</option>
+                                </select>
+                            </div>
+                            <div class="col-md-4" id="web_search_foundry_managed_identity_type_container">
+                                <label for="web_search_foundry_managed_identity_type" class="form-label">Managed Identity Type</label>
+                                <select class="form-select" id="web_search_foundry_managed_identity_type" name="web_search_foundry_managed_identity_type">
+                                    {% set foundry_mi_type = settings.web_search_agent.other_settings.azure_ai_foundry.managed_identity_type if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else 'system_assigned' %}
+                                    <option value="system_assigned" {% if foundry_mi_type=='system_assigned' %}selected{% endif %}>System-assigned (SAMI)</option>
+                                    <option value="user_assigned" {% if foundry_mi_type=='user_assigned' %}selected{% endif %}>User-assigned (UAMI)</option>
+                                </select>
+                            </div>
+                            <div class="col-12" id="web_search_foundry_authority_container">
+                                <label for="web_search_foundry_authority" class="form-label">Authority Endpoint (Custom Cloud)</label>
+                                <input type="text" class="form-control" id="web_search_foundry_authority" name="web_search_foundry_authority" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.authority if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="https://login.microsoftonline.com/ or https://login.microsoftonline.us/">
+                            </div>
+                            <div class="col-md-6" id="web_search_foundry_managed_identity_client_id_container">
+                                <label for="web_search_foundry_managed_identity_client_id" class="form-label">Managed Identity Client ID (UAMI)</label>
+                                <input type="text" class="form-control" id="web_search_foundry_managed_identity_client_id" name="web_search_foundry_managed_identity_client_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.managed_identity_client_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Client ID for user-assigned managed identity">
+                            </div>
+                        </div>
+
+                        <div class="row g-3 mt-1" id="web_search_foundry_service_principal_fields">
+                            <div class="col-md-4">
+                                <label for="web_search_foundry_tenant_id" class="form-label">Tenant ID</label>
+                                <input type="text" class="form-control" id="web_search_foundry_tenant_id" name="web_search_foundry_tenant_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.tenant_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Entra tenant ID">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="web_search_foundry_client_id" class="form-label">Client ID</label>
+                                <input type="text" class="form-control" id="web_search_foundry_client_id" name="web_search_foundry_client_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.client_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="App registration client ID">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="web_search_foundry_client_secret" class="form-label">Client Secret</label>
+                                <div class="input-group">
+                                    <input type="password" class="form-control" id="web_search_foundry_client_secret" name="web_search_foundry_client_secret" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.client_secret if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Secret or Key Vault reference">
+                                    <button type="button" class="btn btn-outline-secondary" id="toggle_web_search_foundry_client_secret">Show</button>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="border rounded p-3 mt-3">
+                            <div class="d-flex flex-column flex-lg-row align-items-lg-center justify-content-between gap-2">
+                                <div>
+                                    <h6 class="mb-1"><i class="bi bi-chat-square-dots me-2"></i>Web Search Test</h6>
+                                    <div class="text-muted small">Run the configured Foundry agent with the current unsaved settings.</div>
+                                </div>
+                                <button
+                                    type="button"
+                                    class="btn btn-outline-primary btn-sm"
+                                    id="test_web_search_button"
+                                    data-bs-toggle="modal"
+                                    data-bs-target="#webSearchTestModal"
+                                >
+                                    <i class="bi bi-play-circle me-1"></i>Test Web Search
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="url-access-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0"><i class="bi bi-link-45deg me-2"></i>URL Access</h5>
+                        <span class="badge text-bg-secondary">Shared Policy</span>
+                    </div>
+                    <p class="text-muted mb-2">Control direct URL content fetching for pasted chat links, workflow prompts, and Deep Research source review.</p>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_url_access"
+                            name="enable_url_access"
+                            {% if settings.enable_url_access %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_url_access">Enable URL Access for chat and workflows</label>
+                    </div>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_url_access_user"
+                            name="require_member_of_url_access_user"
+                            {% if settings.require_member_of_url_access_user %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="require_member_of_url_access_user">Require UrlAccessUser App Role</label>
+                        <div class="form-text">Required app role value: <code>UrlAccessUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use URL Access in chat or enable it for workflows.</div>
+                    </div>
+
+                    <div id="url_access_settings" class="{% if not settings.enable_url_access %}d-none{% endif %}">
+                        <div class="alert alert-info small mb-3">
+                            URL Access uses the same server-side URL protections as Deep Research: non-HTTP(S) URLs, credentialed URLs, literal IP targets, localhost, metadata hosts, unsafe redirects, unsupported content types, and oversized pages are blocked before fetch.
+                        </div>
+                        <div class="row g-3 mb-3">
+                            <div class="col-md-6">
+                                <label for="url_access_max_chat_urls_per_turn" class="form-label">Chat URL Limit</label>
+                                <input type="number" min="1" max="100" class="form-control" id="url_access_max_chat_urls_per_turn" name="url_access_max_chat_urls_per_turn" value="{{ settings.url_access_max_chat_urls_per_turn or 10 }}">
+                                <div class="form-text">Hard limit: 100 direct URLs per chat message.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="url_access_max_workflow_urls_per_run" class="form-label">Workflow URL Limit</label>
+                                <input type="number" min="1" max="500" class="form-control" id="url_access_max_workflow_urls_per_run" name="url_access_max_workflow_urls_per_run" value="{{ settings.url_access_max_workflow_urls_per_run or 50 }}">
+                                <div class="form-text">Hard limit: 500 direct URLs per workflow prompt.</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="row g-3 mt-1">
+                        <div class="col-md-6">
+                            <div class="url-access-policy-editor" data-url-access-policy="url_access_allowed_domains" data-policy-kind="domain">
+                                <label for="url_access_allowed_domains_new" class="form-label">Allowed Domains</label>
+                                <textarea class="d-none" id="url_access_allowed_domains" name="url_access_allowed_domains" aria-hidden="true">{{ settings.url_access_allowed_domains|join('\n') if settings.url_access_allowed_domains else settings.source_review_allowed_domains|join('\n') if settings.source_review_allowed_domains else '' }}</textarea>
+                                <div class="input-group input-group-sm">
+                                    <input type="text" class="form-control" id="url_access_allowed_domains_new" data-policy-new-input placeholder="example.com or *.contoso.com" />
+                                    <button type="button" class="btn btn-outline-primary" data-policy-add-button>
+                                        <i class="bi bi-plus-circle me-1"></i>Add
+                                    </button>
+                                </div>
+                                <div class="list-group mt-2" data-policy-list aria-live="polite"></div>
+                            </div>
+                            <div class="form-text">Leave blank to allow any public domain that passes safety checks. Deep Research uses this same allow list.</div>
+                        </div>
+                        <div class="col-md-6">
+                            <div class="url-access-policy-editor" data-url-access-policy="url_access_blocked_domains" data-policy-kind="domain">
+                                <label for="url_access_blocked_domains_new" class="form-label">Blocked Domains</label>
+                                <textarea class="d-none" id="url_access_blocked_domains" name="url_access_blocked_domains" aria-hidden="true">{{ settings.url_access_blocked_domains|join('\n') if settings.url_access_blocked_domains else settings.source_review_blocked_domains|join('\n') if settings.source_review_blocked_domains else '' }}</textarea>
+                                <div class="input-group input-group-sm">
+                                    <input type="text" class="form-control" id="url_access_blocked_domains_new" data-policy-new-input placeholder="example.org or *.contoso.net" />
+                                    <button type="button" class="btn btn-outline-primary" data-policy-add-button>
+                                        <i class="bi bi-plus-circle me-1"></i>Add
+                                    </button>
+                                </div>
+                                <div class="list-group mt-2" data-policy-list aria-live="polite"></div>
+                            </div>
+                            <div class="form-text">Blocked domains apply to URL Access and Deep Research source-page review.</div>
+                        </div>
+                    </div>
+
+                    <div class="border rounded p-3 mt-3">
+                        <div class="d-flex flex-column flex-lg-row align-items-lg-center justify-content-between gap-2">
+                            <div>
+                                <h6 class="mb-1"><i class="bi bi-shield-check me-2"></i>URL Policy Test</h6>
+                                <div class="text-muted small">Check a URL against the current allowed and blocked domain rules before saving.</div>
+                            </div>
+                            <button
+                                type="button"
+                                class="btn btn-outline-primary btn-sm"
+                                id="open_url_access_policy_test_modal_button"
+                                data-bs-toggle="modal"
+                                data-bs-target="#urlAccessPolicyTestModal"
+                            >
+                                <i class="bi bi-play-circle me-1"></i>Test URL Policy
+                            </button>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="source-review-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0"><i class="bi bi-binoculars me-2"></i>Deep Research</h5>
+                        <div class="d-flex align-items-center gap-2">
+                            <span class="badge text-bg-secondary">Optional</span>
+                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#deepResearchInfoModal">
+                                <i class="bi bi-info-circle me-1"></i>Setup Guide
+                            </button>
+                        </div>
+                    </div>
+                    <p class="text-muted mb-2">Plan bounded web searches, inspect source pages, and keep an internal research ledger for evidence coverage. Direct pasted URLs use the shared URL Access controls above.</p>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_source_review"
+                            name="enable_source_review"
+                            {% if settings.enable_source_review %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_source_review">Enable Deep Research for chat</label>
+                    </div>
+
+                    <div id="source_review_settings" class="{% if not settings.enable_source_review %}d-none{% endif %}">
+                        <div class="alert alert-info small mb-3">
+                            Server-side protections always block non-HTTP(S) URLs, literal IP URL targets, localhost, metadata hosts, credentialed URLs, excessive redirects, unsupported content types, oversized pages, and requests beyond the configured page budget. DNS hostnames that resolve to private/internal addresses require the internal-host opt-in below.
+                        </div>
+
+                        <div class="form-check form-switch mb-3">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="require_member_of_deep_research_user"
+                                name="require_member_of_deep_research_user"
+                                {% if settings.require_member_of_deep_research_user %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="require_member_of_deep_research_user">Require DeepResearchUser App Role</label>
+                            <div class="form-text">Required app role value: <code>DeepResearchUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use Deep Research.</div>
+                        </div>
+
+                        <div class="form-check form-switch mb-3">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="source_review_allow_internal_hosts"
+                                name="source_review_allow_internal_hosts"
+                                {% if settings.source_review_allow_internal_hosts %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="source_review_allow_internal_hosts">Allow internal network hostnames</label>
+                            <div class="form-text">Allows DNS hostnames that resolve to private/internal addresses. Literal IP URL targets, localhost, metadata hosts, link-local addresses, and reserved addresses remain blocked.</div>
+                        </div>
+
+                        <div class="row g-3">
+                            <div class="col-md-4">
+                                <label for="source_review_default_mode" class="form-label">Activation Mode</label>
+                                <select class="form-select" id="source_review_default_mode" disabled>
+                                    <option value="manual" selected>User toggle only</option>
+                                </select>
+                                <input type="hidden" name="source_review_default_mode" value="manual" />
+                                <div class="form-text">Deep Research runs only when the user selects it for the message.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_max_pages_per_turn" class="form-label">Max Pages per Turn</label>
+                                <input type="number" min="1" max="10" class="form-control" id="source_review_max_pages_per_turn" name="source_review_max_pages_per_turn" value="{{ settings.source_review_max_pages_per_turn or 10 }}">
+                                <div class="form-text">Hard limit: 10 pages.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_max_seed_pages_per_turn" class="form-label">Max Seed Pages per Turn</label>
+                                <input type="number" min="1" max="10" class="form-control" id="source_review_max_seed_pages_per_turn" name="source_review_max_seed_pages_per_turn" value="{{ settings.source_review_max_seed_pages_per_turn or 10 }}">
+                                <div class="form-text">Limits initial search-result and direct URL pages so budget remains for child pages.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="deep_research_max_user_urls_per_turn" class="form-label">Max User URLs per Turn</label>
+                                <input type="number" min="1" max="100" class="form-control" id="deep_research_max_user_urls_per_turn" name="deep_research_max_user_urls_per_turn" value="{{ settings.deep_research_max_user_urls_per_turn or 100 }}">
+                                <div class="form-text">Direct URLs beyond this cap are recorded as omitted in the ledger.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="deep_research_max_search_queries_per_turn" class="form-label">Max Search Queries per Turn</label>
+                                <input type="number" min="1" max="8" class="form-control" id="deep_research_max_search_queries_per_turn" name="deep_research_max_search_queries_per_turn" value="{{ settings.deep_research_max_search_queries_per_turn or 8 }}">
+                                <div class="form-text">Includes the original current-message query.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_timeout_seconds" class="form-label">Timeout per Turn</label>
+                                <input type="number" min="3" max="30" class="form-control" id="source_review_timeout_seconds" name="source_review_timeout_seconds" value="{{ settings.source_review_timeout_seconds or 30 }}">
+                                <div class="form-text">Hard limit: 30 seconds.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_max_redirects" class="form-label">Max Redirects</label>
+                                <input type="number" min="0" max="5" class="form-control" id="source_review_max_redirects" name="source_review_max_redirects" value="{{ settings.source_review_max_redirects if settings.source_review_max_redirects is not none else 5 }}">
+                                <div class="form-text">Every redirect target is revalidated.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_max_bytes_per_page_mb" class="form-label">Max MB per Page</label>
+                                <input type="number" min="1" max="5" class="form-control" id="source_review_max_bytes_per_page_mb" name="source_review_max_bytes_per_page_mb" value="{{ (((settings.source_review_max_bytes_per_page|default(5000000, true)|int) / 1000000)|round(0, 'ceil'))|int }}">
+                                <div class="form-text">Hard limit: 5 MB.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_max_depth" class="form-label">Source Traversal Depth</label>
+                                <input type="number" min="0" max="2" class="form-control" id="source_review_max_depth" name="source_review_max_depth" value="{{ settings.source_review_max_depth if settings.source_review_max_depth is not none else 2 }}">
+                                <div class="form-text">Depth 2 follows selected links from seed and child pages.</div>
+                            </div>
+                        </div>
+
+                        <div class="row g-3 mt-1">
+                            <div class="col-md-6">
+                                {% set js_runtime = source_review_runtime_capabilities or {} %}
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="enable_deep_source_review"
+                                        name="enable_deep_source_review"
+                                        {% if settings.enable_deep_source_review %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="enable_deep_source_review">Inspect linked source pages</label>
+                                </div>
+                                <div id="source_review_deep_settings" class="form-text {% if not settings.enable_deep_source_review %}d-none{% endif %}">Deep Research follows only scored, policy-approved links within the page and depth budgets.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="deep_research_enable_query_planning"
+                                        name="deep_research_enable_query_planning"
+                                        {% if settings.deep_research_enable_query_planning %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="deep_research_enable_query_planning">Plan multiple web search queries</label>
+                                </div>
+                                <div class="form-text">The selected chat model can propose bounded current-message-only query variants before page review.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="deep_research_enable_ledger_artifact"
+                                        name="deep_research_enable_ledger_artifact"
+                                        {% if settings.deep_research_enable_ledger_artifact %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="deep_research_enable_ledger_artifact">Save research ledger artifacts</label>
+                                </div>
+                                <div class="form-text">Creates a Markdown chat artifact with search queries, reviewed sources, skipped URLs, and coverage.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="source_review_enable_llm_planning"
+                                        name="source_review_enable_llm_planning"
+                                        {% if settings.source_review_enable_llm_planning %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="source_review_enable_llm_planning">Use model-assisted source link planning</label>
+                                </div>
+                                <div class="form-text">When source pages expose candidate links, the selected chat model can rank those candidates before the server fetches them.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="source_review_allow_js_rendering"
+                                        name="source_review_allow_js_rendering"
+                                        {% if settings.source_review_allow_js_rendering and js_runtime.js_rendering_available %}checked{% endif %}
+                                        {% if not js_runtime.js_rendering_available %}disabled{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="source_review_allow_js_rendering">Allow JavaScript rendering fallback</label>
+                                </div>
+                                <div class="form-text">Requires verified Playwright browser runtime support on the app host.</div>
+                                <div class="small mt-1 {% if js_runtime.js_rendering_available %}text-success{% else %}text-warning{% endif %}" id="source_review_js_runtime_status">
+                                    <i class="bi {% if js_runtime.js_rendering_available %}bi-check-circle{% else %}bi-exclamation-triangle{% endif %} me-1"></i>{{ js_runtime.message or 'Runtime support has not been checked yet.' }}
+                                </div>
+                                {% if not js_runtime.js_rendering_available %}
+                                <div class="small text-muted mt-1">Install/enable the Playwright Chromium runtime, then reload Admin Settings to enable this option.</div>
+                                {% endif %}
+                                {% if js_runtime.sandbox_disabled %}
+                                <div class="small text-warning mt-1">Chromium sandbox is disabled by environment configuration.</div>
+                                {% endif %}
+                            </div>
+                            <div class="col-md-6">
+                                <label for="source_review_js_load_more_clicks" class="form-label">Rendered Load More Clicks</label>
+                                <input type="number" min="0" max="12" class="form-control" id="source_review_js_load_more_clicks" name="source_review_js_load_more_clicks" value="{{ settings.source_review_js_load_more_clicks if settings.source_review_js_load_more_clicks is not none else 12 }}">
+                                <div class="form-text">When JavaScript rendering is enabled, Deep Research can click visible Load More controls until this cap is reached.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="source_review_respect_robots_txt"
+                                        name="source_review_respect_robots_txt"
+                                        {% if settings.source_review_respect_robots_txt %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="source_review_respect_robots_txt">Respect robots.txt</label>
+                                </div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="source_review_audit_logging"
+                                        name="source_review_audit_logging"
+                                        {% if settings.source_review_audit_logging %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="source_review_audit_logging">Log Deep Research activity</label>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="web-search-consent-modal" tabindex="-1" aria-labelledby="web-search-consent-title" aria-hidden="true">
+                    <div class="modal-dialog modal-dialog-centered modal-lg">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="web-search-consent-title">Web Search Consent Required</h5>
+                            </div>
+                            <div class="modal-body">
+                                <p>
+                                    When you use Grounding with Bing Search, your customer data is transferred outside of the Azure compliance boundary to the Grounding with Bing Search service. Grounding with Bing Search is not subject to the same data processing terms (including location of processing) and does not have the same compliance standards and certifications as the Azure AI Agent Service, as described in the <a href="https://www.microsoft.com/en-us/bing/apis/grounding-legal" target="_blank" rel="noopener noreferrer">Grounding with Bing Search TOU</a>. It is your responsibility to assess whether use of Grounding with Bing Search in your agent meets your needs and requirements.
+                                </p>
+                                <div class="alert alert-warning mb-0">
+                                    Only the user's current message is sent for web search. Users should avoid including sensitive content in any message that uses web search.
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" id="web-search-consent-decline">Disagree</button>
+                                <button type="button" class="btn btn-primary" id="web-search-consent-accept">Agree</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="webSearchTestModal" tabindex="-1" aria-labelledby="web-search-test-title" aria-hidden="true">
+                    <div class="modal-dialog modal-dialog-centered modal-lg">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="web-search-test-title">Web Search Test</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <label for="web_search_test_query" class="form-label">Test Prompt</label>
+                                <textarea class="form-control" id="web_search_test_query" rows="3">Use the Grounding with Bing Search tool to find the official Microsoft website. Reply with the page title and URL only.</textarea>
+                                <div id="test_web_search_result" class="mt-3" aria-live="polite"></div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
+                                <button type="button" class="btn btn-primary" id="rerun_web_search_test_button">
+                                    <i class="bi bi-arrow-clockwise me-1"></i>Run Again
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="urlAccessPolicyTestModal" tabindex="-1" aria-labelledby="url-access-policy-test-title" aria-hidden="true">
+                    <div class="modal-dialog modal-dialog-centered modal-lg">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="url-access-policy-test-title">URL Policy Test</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <label for="url_access_policy_test_url" class="form-label">URL</label>
+                                <input type="url" class="form-control" id="url_access_policy_test_url" placeholder="https://www.example.com/page" />
+                                <div id="test_url_access_policy_result" class="mt-3" aria-live="polite"></div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
+                                <button type="button" class="btn btn-primary" id="test_url_access_policy_button">
+                                    <i class="bi bi-shield-check me-1"></i>Run Policy Test
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/workflow.html b/application/single_app/templates/admin/_panes/workflow.html
new file mode 100644
index 000000000..242119643
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/workflow.html
@@ -0,0 +1,157 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'workflow' %} show active{% endif %}" id="workflow" role="tabpanel" aria-labelledby="workflow-tab">
+                <div class="card mb-3 p-3" id="workflow-settings-section">
+                    <h5>
+                        <i class="bi bi-diagram-3 me-2"></i>Workflow
+                    </h5>
+                    <p class="text-muted">
+                        Control personal and group workflow authoring and execution for users.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="allow_user_workflows"
+                            name="allow_user_workflows"
+                            {% if settings.allow_user_workflows %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="allow_user_workflows">
+                            Enable Personal Workflows
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create personal workflows that run a selected agent or model manually or on an interval schedule."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_workflow_user"
+                            name="require_member_of_workflow_user"
+                            {% if settings.require_member_of_workflow_user %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_member_of_workflow_user">
+                            Require WorkflowUser App Role
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Require the WorkflowUser Enterprise App role before users can open, create, edit, run, or inspect personal workflows."></i>
+                    </div>
+                    <p class="text-muted small mb-0">
+                        Required app role value: <code>WorkflowUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement.
+                    </p>
+
+                    <div class="form-group mt-3 mb-3">
+                        <label for="workflow_max_auto_invoke_attempts" class="form-label">
+                            Workflow Agent Action Limit
+                        </label>
+                        <input type="number"
+                            class="form-control"
+                            id="workflow_max_auto_invoke_attempts"
+                            name="workflow_max_auto_invoke_attempts"
+                            min="1"
+                            max="500"
+                            step="1"
+                            value="{{ settings.workflow_max_auto_invoke_attempts|default(60, true) }}">
+                        <div class="form-text">
+                            Maximum automatic tool or action calls an agent can make during one workflow run. Default is 60; increase for large document sets.
+                        </div>
+                        <div class="alert alert-warning small mb-0 mt-2" role="alert">
+                            Values above 100 are capacity-sensitive. Enable Cosmos DB Throughput automation in SimpleChat so the app can monitor RU pressure and scale up Cosmos when needed, and also monitor Azure OpenAI throttling, App Service CPU and memory, and downstream service latency.
+                        </div>
+                    </div>
+
+                    <div class="form-group mt-3 mb-3">
+                        <label for="workflow_max_tasks" class="form-label">
+                            Workflow Task Limit
+                        </label>
+                        <input type="number"
+                            class="form-control"
+                            id="workflow_max_tasks"
+                            name="workflow_max_tasks"
+                            min="1"
+                            max="100"
+                            step="1"
+                            value="{{ settings.workflow_max_tasks|default(50, true) }}">
+                        <div class="form-text">
+                            Maximum ordered instruction tasks users can add to one workflow. Default is 50; supported range is 1-100.
+                        </div>
+                    </div>
+
+                    <hr>
+
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="allow_group_workflows"
+                            name="allow_group_workflows"
+                            {% if settings.allow_group_workflows %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="allow_group_workflows">
+                            Enable Group Workflows
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow permitted group members to create, manage, and run workflows from group workspaces."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_group_assignment_for_group_workflows"
+                            name="require_group_assignment_for_group_workflows"
+                            {% if settings.require_group_assignment_for_group_workflows %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_group_assignment_for_group_workflows">
+                            Require Group Assignment to Use Workflow
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only groups selected in Manage Groups can create, manage, or run group workflows."></i>
+                    </div>
+                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
+                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-group-workflow-groups-btn" data-bs-toggle="modal" data-bs-target="#groupWorkflowAssignmentModal">
+                            <i class="bi bi-people me-1"></i>Manage Groups
+                        </button>
+                        <span class="text-muted small" id="group-workflow-assignment-summary">No groups assigned.</span>
+                    </div>
+                    <textarea class="d-none" id="group_workflow_allowed_group_ids" name="group_workflow_allowed_group_ids">{{ settings.group_workflow_allowed_group_ids|default([], true)|tojson }}</textarea>
+                    <p class="text-muted small mb-0">
+                        Group workflow authoring is available to group Owners and Admins by default. Enable the owner-only setting below to limit group agent, action, and workflow management to Owners.
+                    </p>
+                </div>
+
+
+
+                <div class="modal fade" id="groupWorkflowAssignmentModal" tabindex="-1" aria-labelledby="groupWorkflowAssignmentModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <div>
+                                    <h5 class="modal-title mb-0" id="groupWorkflowAssignmentModalLabel">Group Workflow Assignments</h5>
+                                    <small class="text-muted">Choose which groups can use group workflows when assignment is required.</small>
+                                </div>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="row g-2 align-items-end mb-3">
+                                    <div class="col">
+                                        <label for="group-workflow-group-search" class="form-label">Search Groups</label>
+                                        <input type="search" class="form-control" id="group-workflow-group-search" placeholder="Search by group name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
+                                    </div>
+                                    <div class="col-auto">
+                                        <button type="button" class="btn btn-outline-primary" id="group-workflow-group-search-btn">
+                                            <i class="bi bi-search me-1"></i>Search
+                                        </button>
+                                    </div>
+                                </div>
+                                <div class="alert alert-danger d-none" id="group-workflow-assignment-error"></div>
+                                <div class="small text-muted mb-2" id="group-workflow-assignment-status">No groups loaded.</div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Group</th>
+                                                <th scope="col">Description</th>
+                                                <th scope="col" class="text-end">Assignment</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="group-workflow-assignment-groups-body">
+                                            <tr>
+                                                <td colspan="3" class="text-center text-muted py-3">Search for groups to assign.</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/workspace-identities.html b/application/single_app/templates/admin/_panes/workspace-identities.html
index da77b91b5..7c3569ebd 100644
--- a/application/single_app/templates/admin/_panes/workspace-identities.html
+++ b/application/single_app/templates/admin/_panes/workspace-identities.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade" id="workspace-identities" role="tabpanel" aria-labelledby="workspace-identities-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'workspace-identities' %} show active{% endif %}" id="workspace-identities" role="tabpanel" aria-labelledby="workspace-identities-tab">
                 <p class="text-muted">
                     Manage the global authentication profiles that File Sync sources and Actions reuse, so credentials stay scoped and are resolved server-side.
                 </p>
diff --git a/application/single_app/templates/admin/_panes/workspace-types.html b/application/single_app/templates/admin/_panes/workspace-types.html
new file mode 100644
index 000000000..83123fd7a
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/workspace-types.html
@@ -0,0 +1,159 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'workspace-types' %} show active{% endif %}" id="workspace-types" role="tabpanel" aria-labelledby="workspace-types-tab">
+                <p class="text-muted">
+                    Configure workspace settings like personal/group access, multimedia support, metadata, and document classification.
+                </p>
+
+
+                <div class="card mb-3 p-3" id="personal-workspaces-section">
+                    <h5>
+                        <i class="bi bi-person me-2"></i>Personal Workspaces
+                    </h5>
+                    <p class="text-muted">
+                        Turn this on to allow access and management of your personal workspace.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_user_workspace"
+                            name="enable_user_workspace"
+                            {% if settings.enable_user_workspace %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_user_workspace">
+                            Enable Personal Workspaces
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage their own private workspaces for document storage, knowledge bases, and personal AI interactions."></i>
+                    </div>
+                </div>
+
+               <div class="card mb-3 p-3" id="group-workspaces-section">
+                    <h5>
+                        <i class="bi bi-people me-2"></i>Group Workspaces
+                    </h5>
+                    <p class="text-muted">
+                        Turn this on to allow access and management of group workspaces, as well as group collaboration features.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_group_workspaces"
+                            name="enable_group_workspaces"
+                            {% if settings.enable_group_workspaces %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_group_workspaces">
+                            Enable Group Workspaces
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and participate in shared group workspaces for team collaboration, document sharing, and collective knowledge building."></i>
+                    </div>
+
+
+                    <div id="create_group_permission_setting" {% if not settings.enable_group_workspaces %}style="display: none;"{% endif %}>
+                        <hr>
+
+                        <!-- Disable Group Creation Setting -->
+                        <div class="form-group form-check form-switch mb-3">
+                            <input type="checkbox"
+                                class="form-check-input"
+                                id="disable_group_creation"
+                                name="disable_group_creation"
+                                {% if not settings.enable_group_creation %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="disable_group_creation">
+                                Disable Group Creation
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Prevent all users from creating new groups system-wide, regardless of app role assignment."></i>
+                        </div>
+                        <p class="text-muted small mb-3">
+                            When enabled, no users will be able to create new groups, regardless of app role assignment. This global setting overrides the <strong>Require CreateGroups App Role</strong> setting below.
+                        </p>
+
+                        <div class="form-group form-check form-switch mb-2">
+                            <input type="checkbox"
+                                class="form-check-input"
+                                id="require_member_of_create_group"
+                                name="require_member_of_create_group"
+                                {% if settings.require_member_of_create_group %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="require_member_of_create_group">
+                                Require CreateGroups App Role
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the CreateGroups Enterprise App role can create new groups."></i>
+                        </div>
+                        <p class="text-muted small mb-0">
+                            Required app role value: <code>CreateGroups</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create groups while group workspaces and group creation are enabled.
+                        </p>
+
+                        <hr>
+
+                        <!-- Require Owner to Manage Group Agents, Actions and Workflows -->
+                        <div class="form-group form-check form-switch mb-2">
+                            <input type="checkbox"
+                                class="form-check-input"
+                                id="require_owner_for_group_agent_management"
+                                name="require_owner_for_group_agent_management"
+                                {% if settings.require_owner_for_group_agent_management %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="require_owner_for_group_agent_management">
+                                Require Owner to Manage Group Agents, Actions and Workflows
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only the group Owner can create, edit, and delete group agents, actions, and workflows. Group Admins will have read-only access."></i>
+                        </div>
+                        <p class="text-muted small mb-0">
+                            If enabled, only the group Owner can create, edit, and delete group agents, group actions, and group workflows. Admins and other roles will only be able to view them.
+                        </p>
+                    </div>
+
+                </div>
+
+                <div class="card mb-3 p-3" id="public-workspaces-section">
+                    <h5>
+                        <i class="bi bi-globe me-2"></i>Public Workspaces
+                    </h5>
+                    <p class="text-muted">
+                        Turn this on to enable public workspaces that are visible to everyone in the organization.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_public_workspaces"
+                            name="enable_public_workspaces"
+                            {% if settings.enable_public_workspaces %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_public_workspaces">
+                            Enable Public Workspaces
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow creation of public workspaces that are visible and accessible to all users in the organization for broad knowledge sharing."></i>
+                    </div>
+
+                    <div class="mb-3">
+                        <label class="form-label" for="public_workspace_display_name">End-user display name</label>
+                        <input
+                            type="text"
+                            class="form-control"
+                            id="public_workspace_display_name"
+                            name="public_workspace_display_name"
+                            maxlength="{{ settings.public_workspace_labels.max_length }}"
+                            value="{{ settings.public_workspace_display_name }}"
+                            placeholder="Public Workspace"
+                            aria-describedby="public-workspace-display-name-help"
+                        >
+                        <div class="form-text" id="public-workspace-display-name-help">
+                            Optional. End users will see this label instead of Public Workspace. Admin settings and internal references continue to use Public Workspace.
+                        </div>
+                    </div>
+
+                    <div id="create_public_workspace_permission_setting" {% if not settings.enable_public_workspaces %}style="display: none;"{% endif %}>
+                        <hr>
+                        <div class="form-group form-check form-switch mb-2">
+                            <input type="checkbox"
+                                class="form-check-input"
+                                id="require_member_of_create_public_workspace"
+                                name="require_member_of_create_public_workspace"
+                                {% if settings.require_member_of_create_public_workspace %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="require_member_of_create_public_workspace">
+                                Require CreatePublicWorkspaces App Role
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the CreatePublicWorkspaces Enterprise App role can create public workspaces."></i>
+                        </div>
+                        <p class="text-muted small mb-0">
+                            Required app role value: <code>CreatePublicWorkspaces</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create public workspaces while public workspaces are enabled.
+                        </p>
+                    </div>
+
+                </div>
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/workspaces.html b/application/single_app/templates/admin/_panes/workspaces.html
deleted file mode 100644
index 9200f71d9..000000000
--- a/application/single_app/templates/admin/_panes/workspaces.html
+++ /dev/null
@@ -1,746 +0,0 @@
-            <div class="tab-pane fade" id="workspaces" role="tabpanel" aria-labelledby="workspaces-tab">
-                <p class="text-muted">
-                    Configure workspace settings like personal/group access, multimedia support, metadata, and document classification.
-                </p>
-
-
-                <div class="card mb-3 p-3" id="personal-workspaces-section">
-                    <h5>
-                        <i class="bi bi-person me-2"></i>Personal Workspaces
-                    </h5>
-                    <p class="text-muted">
-                        Turn this on to allow access and management of your personal workspace.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_user_workspace"
-                            name="enable_user_workspace"
-                            {% if settings.enable_user_workspace %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_user_workspace">
-                            Enable Personal Workspaces
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage their own private workspaces for document storage, knowledge bases, and personal AI interactions."></i>
-                    </div>
-                </div>
-
-                <div class="card mb-3 p-3" id="workflow-settings-section">
-                    <h5>
-                        <i class="bi bi-diagram-3 me-2"></i>Workflow
-                    </h5>
-                    <p class="text-muted">
-                        Control personal and group workflow authoring and execution for users.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="allow_user_workflows"
-                            name="allow_user_workflows"
-                            {% if settings.allow_user_workflows %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="allow_user_workflows">
-                            Enable Personal Workflows
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create personal workflows that run a selected agent or model manually or on an interval schedule."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_workflow_user"
-                            name="require_member_of_workflow_user"
-                            {% if settings.require_member_of_workflow_user %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_member_of_workflow_user">
-                            Require WorkflowUser App Role
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Require the WorkflowUser Enterprise App role before users can open, create, edit, run, or inspect personal workflows."></i>
-                    </div>
-                    <p class="text-muted small mb-0">
-                        Required app role value: <code>WorkflowUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement.
-                    </p>
-
-                    <div class="form-group mt-3 mb-3">
-                        <label for="workflow_max_auto_invoke_attempts" class="form-label">
-                            Workflow Agent Action Limit
-                        </label>
-                        <input type="number"
-                            class="form-control"
-                            id="workflow_max_auto_invoke_attempts"
-                            name="workflow_max_auto_invoke_attempts"
-                            min="1"
-                            max="500"
-                            step="1"
-                            value="{{ settings.workflow_max_auto_invoke_attempts|default(60, true) }}">
-                        <div class="form-text">
-                            Maximum automatic tool or action calls an agent can make during one workflow run. Default is 60; increase for large document sets.
-                        </div>
-                        <div class="alert alert-warning small mb-0 mt-2" role="alert">
-                            Values above 100 are capacity-sensitive. Enable Cosmos DB Throughput automation in SimpleChat so the app can monitor RU pressure and scale up Cosmos when needed, and also monitor Azure OpenAI throttling, App Service CPU and memory, and downstream service latency.
-                        </div>
-                    </div>
-
-                    <div class="form-group mt-3 mb-3">
-                        <label for="workflow_max_tasks" class="form-label">
-                            Workflow Task Limit
-                        </label>
-                        <input type="number"
-                            class="form-control"
-                            id="workflow_max_tasks"
-                            name="workflow_max_tasks"
-                            min="1"
-                            max="100"
-                            step="1"
-                            value="{{ settings.workflow_max_tasks|default(50, true) }}">
-                        <div class="form-text">
-                            Maximum ordered instruction tasks users can add to one workflow. Default is 50; supported range is 1-100.
-                        </div>
-                    </div>
-
-                    <hr>
-
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="allow_group_workflows"
-                            name="allow_group_workflows"
-                            {% if settings.allow_group_workflows %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="allow_group_workflows">
-                            Enable Group Workflows
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow permitted group members to create, manage, and run workflows from group workspaces."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_group_assignment_for_group_workflows"
-                            name="require_group_assignment_for_group_workflows"
-                            {% if settings.require_group_assignment_for_group_workflows %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_group_assignment_for_group_workflows">
-                            Require Group Assignment to Use Workflow
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only groups selected in Manage Groups can create, manage, or run group workflows."></i>
-                    </div>
-                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
-                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-group-workflow-groups-btn" data-bs-toggle="modal" data-bs-target="#groupWorkflowAssignmentModal">
-                            <i class="bi bi-people me-1"></i>Manage Groups
-                        </button>
-                        <span class="text-muted small" id="group-workflow-assignment-summary">No groups assigned.</span>
-                    </div>
-                    <textarea class="d-none" id="group_workflow_allowed_group_ids" name="group_workflow_allowed_group_ids">{{ settings.group_workflow_allowed_group_ids|default([], true)|tojson }}</textarea>
-                    <p class="text-muted small mb-0">
-                        Group workflow authoring is available to group Owners and Admins by default. Enable the owner-only setting below to limit group agent, action, and workflow management to Owners.
-                    </p>
-                </div>
-
-                <div class="card mb-3 p-3" id="file-download-settings-section">
-                    <h5>
-                        <i class="bi bi-download me-2"></i>File Downloads
-                    </h5>
-                    <p class="text-muted">
-                        Control when users can download original workspace document files from personal, group, and public workspaces.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="allow_personal_workspace_file_downloads"
-                            name="allow_personal_workspace_file_downloads"
-                            {% if settings.allow_personal_workspace_file_downloads %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="allow_personal_workspace_file_downloads">
-                            Enable Personal Workspace Downloads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to download original files from their personal workspace document menus and bulk selection bar."></i>
-                    </div>
-                    <hr>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="allow_group_workspace_file_downloads"
-                            name="allow_group_workspace_file_downloads"
-                            {% if settings.allow_group_workspace_file_downloads %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="allow_group_workspace_file_downloads">
-                            Enable Group Workspace Downloads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow group workspace document downloads when global policy and each group's local setting allow it."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_group_assignment_for_file_downloads"
-                            name="require_group_assignment_for_file_downloads"
-                            {% if settings.require_group_assignment_for_file_downloads %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_group_assignment_for_file_downloads">
-                            Require Group Assignment for Downloads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only groups selected in Manage Groups can offer document downloads, unless a group owner or admin disables downloads locally."></i>
-                    </div>
-                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
-                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-download-groups-btn" data-bs-toggle="modal" data-bs-target="#fileDownloadGroupAssignmentModal">
-                            <i class="bi bi-people me-1"></i>Manage Groups
-                        </button>
-                        <span class="text-muted small" id="file-download-group-assignment-summary">No groups assigned.</span>
-                    </div>
-                    <textarea class="d-none" id="file_download_allowed_group_ids" name="file_download_allowed_group_ids">{{ settings.file_download_allowed_group_ids|default([], true)|tojson }}</textarea>
-                    <hr>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="allow_public_workspace_file_downloads"
-                            name="allow_public_workspace_file_downloads"
-                            {% if settings.allow_public_workspace_file_downloads %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="allow_public_workspace_file_downloads">
-                            Enable Public Workspace Downloads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow public workspace document downloads when global policy and each workspace's local setting allow it."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_public_workspace_assignment_for_file_downloads"
-                            name="require_public_workspace_assignment_for_file_downloads"
-                            {% if settings.require_public_workspace_assignment_for_file_downloads %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_public_workspace_assignment_for_file_downloads">
-                            Require Public Workspace Assignment for Downloads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only selected public workspaces can offer document downloads, unless a workspace owner or admin disables downloads locally."></i>
-                    </div>
-                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
-                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-download-public-workspaces-btn" data-bs-toggle="modal" data-bs-target="#fileDownloadPublicWorkspaceAssignmentModal">
-                            <i class="bi bi-globe me-1"></i>Manage Public Workspaces
-                        </button>
-                        <span class="text-muted small" id="file-download-public-workspace-assignment-summary">No public workspaces assigned.</span>
-                    </div>
-                    <textarea class="d-none" id="file_download_allowed_public_workspace_ids" name="file_download_allowed_public_workspace_ids">{{ settings.file_download_allowed_public_workspace_ids|default([], true)|tojson }}</textarea>
-                </div>
-
-                <div class="modal fade" id="groupWorkflowAssignmentModal" tabindex="-1" aria-labelledby="groupWorkflowAssignmentModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title mb-0" id="groupWorkflowAssignmentModalLabel">Group Workflow Assignments</h5>
-                                    <small class="text-muted">Choose which groups can use group workflows when assignment is required.</small>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="row g-2 align-items-end mb-3">
-                                    <div class="col">
-                                        <label for="group-workflow-group-search" class="form-label">Search Groups</label>
-                                        <input type="search" class="form-control" id="group-workflow-group-search" placeholder="Search by group name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
-                                    </div>
-                                    <div class="col-auto">
-                                        <button type="button" class="btn btn-outline-primary" id="group-workflow-group-search-btn">
-                                            <i class="bi bi-search me-1"></i>Search
-                                        </button>
-                                    </div>
-                                </div>
-                                <div class="alert alert-danger d-none" id="group-workflow-assignment-error"></div>
-                                <div class="small text-muted mb-2" id="group-workflow-assignment-status">No groups loaded.</div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Group</th>
-                                                <th scope="col">Description</th>
-                                                <th scope="col" class="text-end">Assignment</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="group-workflow-assignment-groups-body">
-                                            <tr>
-                                                <td colspan="3" class="text-center text-muted py-3">Search for groups to assign.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="fileDownloadGroupAssignmentModal" tabindex="-1" aria-labelledby="fileDownloadGroupAssignmentModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title mb-0" id="fileDownloadGroupAssignmentModalLabel">File Download Group Assignments</h5>
-                                    <small class="text-muted">Choose which groups can download files when group assignment is required.</small>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="row g-2 align-items-end mb-3">
-                                    <div class="col">
-                                        <label for="file-download-group-assignment-search" class="form-label">Search Groups</label>
-                                        <input type="search" class="form-control" id="file-download-group-assignment-search" placeholder="Search by group name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
-                                    </div>
-                                    <div class="col-auto">
-                                        <button type="button" class="btn btn-outline-primary" id="file-download-group-assignment-search-btn">
-                                            <i class="bi bi-search me-1"></i>Search
-                                        </button>
-                                    </div>
-                                </div>
-                                <div class="alert alert-danger d-none" id="file-download-group-assignment-error"></div>
-                                <div class="small text-muted mb-2" id="file-download-group-assignment-status">No groups loaded.</div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Group</th>
-                                                <th scope="col">Description</th>
-                                                <th scope="col" class="text-end">Assignment</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="file-download-group-assignment-body">
-                                            <tr>
-                                                <td colspan="3" class="text-center text-muted py-3">Search for groups to assign.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="fileDownloadPublicWorkspaceAssignmentModal" tabindex="-1" aria-labelledby="fileDownloadPublicWorkspaceAssignmentModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title mb-0" id="fileDownloadPublicWorkspaceAssignmentModalLabel">File Download Public Workspace Assignments</h5>
-                                    <small class="text-muted">Choose which public workspaces can download files when public workspace assignment is required.</small>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="row g-2 align-items-end mb-3">
-                                    <div class="col">
-                                        <label for="file-download-public-workspace-assignment-search" class="form-label">Search Public Workspaces</label>
-                                        <input type="search" class="form-control" id="file-download-public-workspace-assignment-search" placeholder="Search by public workspace name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
-                                    </div>
-                                    <div class="col-auto">
-                                        <button type="button" class="btn btn-outline-primary" id="file-download-public-workspace-assignment-search-btn">
-                                            <i class="bi bi-search me-1"></i>Search
-                                        </button>
-                                    </div>
-                                </div>
-                                <div class="alert alert-danger d-none" id="file-download-public-workspace-assignment-error"></div>
-                                <div class="small text-muted mb-2" id="file-download-public-workspace-assignment-status">Enter at least 2 characters to search.</div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Public Workspace</th>
-                                                <th scope="col">Description</th>
-                                                <th scope="col" class="text-end">Assignment</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="file-download-public-workspace-assignment-body">
-                                            <tr>
-                                                <td colspan="3" class="text-center text-muted py-3">Search for public workspaces to assign.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-
-               <div class="card mb-3 p-3" id="group-workspaces-section">
-                    <h5>
-                        <i class="bi bi-people me-2"></i>Group Workspaces
-                    </h5>
-                    <p class="text-muted">
-                        Turn this on to allow access and management of group workspaces, as well as group collaboration features.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_group_workspaces"
-                            name="enable_group_workspaces"
-                            {% if settings.enable_group_workspaces %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_group_workspaces">
-                            Enable Group Workspaces
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and participate in shared group workspaces for team collaboration, document sharing, and collective knowledge building."></i>
-                    </div>
-
-
-                    <div id="create_group_permission_setting" {% if not settings.enable_group_workspaces %}style="display: none;"{% endif %}>
-                        <hr>
-
-                        <!-- Disable Group Creation Setting -->
-                        <div class="form-group form-check form-switch mb-3">
-                            <input type="checkbox"
-                                class="form-check-input"
-                                id="disable_group_creation"
-                                name="disable_group_creation"
-                                {% if not settings.enable_group_creation %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="disable_group_creation">
-                                Disable Group Creation
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Prevent all users from creating new groups system-wide, regardless of app role assignment."></i>
-                        </div>
-                        <p class="text-muted small mb-3">
-                            When enabled, no users will be able to create new groups, regardless of app role assignment. This global setting overrides the <strong>Require CreateGroups App Role</strong> setting below.
-                        </p>
-
-                        <div class="form-group form-check form-switch mb-2">
-                            <input type="checkbox"
-                                class="form-check-input"
-                                id="require_member_of_create_group"
-                                name="require_member_of_create_group"
-                                {% if settings.require_member_of_create_group %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="require_member_of_create_group">
-                                Require CreateGroups App Role
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the CreateGroups Enterprise App role can create new groups."></i>
-                        </div>
-                        <p class="text-muted small mb-0">
-                            Required app role value: <code>CreateGroups</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create groups while group workspaces and group creation are enabled.
-                        </p>
-
-                        <hr>
-
-                        <!-- Require Owner to Manage Group Agents, Actions and Workflows -->
-                        <div class="form-group form-check form-switch mb-2">
-                            <input type="checkbox"
-                                class="form-check-input"
-                                id="require_owner_for_group_agent_management"
-                                name="require_owner_for_group_agent_management"
-                                {% if settings.require_owner_for_group_agent_management %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="require_owner_for_group_agent_management">
-                                Require Owner to Manage Group Agents, Actions and Workflows
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only the group Owner can create, edit, and delete group agents, actions, and workflows. Group Admins will have read-only access."></i>
-                        </div>
-                        <p class="text-muted small mb-0">
-                            If enabled, only the group Owner can create, edit, and delete group agents, group actions, and group workflows. Admins and other roles will only be able to view them.
-                        </p>
-                    </div>
-
-                </div>
-
-                <div class="card mb-3 p-3" id="public-workspaces-section">
-                    <h5>
-                        <i class="bi bi-globe me-2"></i>Public Workspaces
-                    </h5>
-                    <p class="text-muted">
-                        Turn this on to enable public workspaces that are visible to everyone in the organization.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_public_workspaces"
-                            name="enable_public_workspaces"
-                            {% if settings.enable_public_workspaces %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_public_workspaces">
-                            Enable Public Workspaces
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow creation of public workspaces that are visible and accessible to all users in the organization for broad knowledge sharing."></i>
-                    </div>
-
-                    <div class="mb-3">
-                        <label class="form-label" for="public_workspace_display_name">End-user display name</label>
-                        <input
-                            type="text"
-                            class="form-control"
-                            id="public_workspace_display_name"
-                            name="public_workspace_display_name"
-                            maxlength="{{ settings.public_workspace_labels.max_length }}"
-                            value="{{ settings.public_workspace_display_name }}"
-                            placeholder="Public Workspace"
-                            aria-describedby="public-workspace-display-name-help"
-                        >
-                        <div class="form-text" id="public-workspace-display-name-help">
-                            Optional. End users will see this label instead of Public Workspace. Admin settings and internal references continue to use Public Workspace.
-                        </div>
-                    </div>
-
-                    <div id="create_public_workspace_permission_setting" {% if not settings.enable_public_workspaces %}style="display: none;"{% endif %}>
-                        <hr>
-                        <div class="form-group form-check form-switch mb-2">
-                            <input type="checkbox"
-                                class="form-check-input"
-                                id="require_member_of_create_public_workspace"
-                                name="require_member_of_create_public_workspace"
-                                {% if settings.require_member_of_create_public_workspace %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="require_member_of_create_public_workspace">
-                                Require CreatePublicWorkspaces App Role
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the CreatePublicWorkspaces Enterprise App role can create public workspaces."></i>
-                        </div>
-                        <p class="text-muted small mb-0">
-                            Required app role value: <code>CreatePublicWorkspaces</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create public workspaces while public workspaces are enabled.
-                        </p>
-                    </div>
-
-                </div>
-
-                <div class="card mb-3 p-3" id="file-sharing-section">
-                    <h5>
-                        <i class="bi bi-share me-2"></i>File Sharing
-                    </h5>
-                    <p class="text-muted">
-                        Turn this on to enable file sharing capabilities between users and workspaces.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_file_sharing"
-                            name="enable_file_sharing"
-                            {% if settings.enable_file_sharing %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_file_sharing">
-                            Enable File Sharing
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to upload, share, and manage files within workspaces for document-based AI interactions and collaboration."></i>
-                    </div>
-                </div>
-
-
-                <div class="card mb-3 p-3" id="metadata-extraction-section">
-                    <h5>
-                        <i class="bi bi-file-earmark-code me-2"></i>Metadata Extraction
-                    </h5>
-                    <p class="text-muted">
-                      Enable this to automatically parse and store file metadata for advanced indexing and search.
-                    </p>
-                    <div class="form-check form-switch mb-3">
-                      <input
-                        type="checkbox"
-                        class="form-check-input"
-                        id="enable_extract_meta_data"
-                        name="enable_extract_meta_data"
-                        {% if settings.enable_extract_meta_data %}checked{% endif %}>
-                      <label class="form-check-label ms-2" for="enable_extract_meta_data">
-                        Enable Extract Meta Data
-                      </label>
-                      <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Automatically extract and index metadata from uploaded files for enhanced search capabilities and content organization."></i>
-                    </div>
-
-                    <div id="metadata_extraction_model_settings" class="mb-3"
-                         {% if not settings.enable_extract_meta_data %}style="display: none;"{% endif %}>
-                                            <label for="metadata_extraction_model" class="form-label">Extraction Model</label>
-                                            <select class="form-select" id="metadata_extraction_model" name="metadata_extraction_model">
-                                                <option value="">No metadata extraction model selected</option>
-                                            </select>
-                                            <input type="hidden" name="metadata_extraction_model_selection_json" id="metadata_extraction_model_selection_json" />
-                                            <div class="form-text">
-                                                Uses Global Endpoints when multi-endpoint model management is enabled; otherwise uses the legacy GPT/APIM deployment settings.
-                                            </div>
-                    </div>
-                </div>
-
-                <!-- Multi-Modal Vision Analysis Section -->
-                <div class="card mb-3 p-3" id="multimodal-vision-section">
-                    <h5>
-                        <i class="bi bi-eye me-2"></i>Multi-Modal Vision Analysis
-                    </h5>
-                    <p class="text-muted">
-                        Enable AI-powered vision analysis for images uploaded to chat or workspace. When enabled alongside Document Intelligence OCR, images will receive both text extraction (OCR) and semantic understanding (vision AI).
-                    </p>
-
-                    <div class="alert alert-info mb-3">
-                        <strong><i class="bi bi-info-circle"></i> How it works:</strong>
-                        <ul class="mb-0 mt-2">
-                            <li><strong>Document Intelligence</strong>: Extracts text from images (OCR)</li>
-                            <li><strong>Vision Model</strong>: Provides semantic analysis, object detection, and contextual understanding</li>
-                            <li>Both analyses are combined and available in citations when Enhanced Citations is enabled</li>
-                        </ul>
-                    </div>
-
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_multimodal_vision"
-                            name="enable_multimodal_vision"
-                            {% if settings.enable_multimodal_vision %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_multimodal_vision">
-                            Enable Multi-Modal Vision Analysis
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Use GPT-4 Vision or similar models to analyze images for semantic content, objects, and contextual information beyond OCR."></i>
-                    </div>
-
-                    <div id="multimodal_vision_model_settings" class="mb-3"
-                         {% if not settings.enable_multimodal_vision %}style="display: none;"{% endif %}>
-                        <label for="multimodal_vision_model" class="form-label">
-                            Vision Model <span class="text-danger">*</span>
-                        </label>
-                        <select class="form-select" id="multimodal_vision_model" name="multimodal_vision_model"
-                                data-prev="{{ settings.multimodal_vision_model or '' }}">
-                            <option value="">Select a vision-capable model...</option>
-
-                            {#
-                                Multi-endpoint aware vision model selection.
-                                Preference order:
-                                1. When multi-endpoint is enabled and model_endpoints has entries, use those.
-                                2. Otherwise, fall back to legacy gpt_model.selected / APIM settings.
-                            #}
-
-                            {% set has_multi_endpoints = settings.enable_multi_model_endpoints and settings.model_endpoints %}
-
-                            {% if has_multi_endpoints %}
-                                {# Iterate all enabled endpoints and models, filter to vision-capable #}
-                                {% for endpoint in settings.model_endpoints if endpoint.enabled %}
-                                    {% for m in endpoint.models if m.enabled %}
-                                        {% if is_vision_capable_model is defined and is_vision_capable_model(m) %}
-                                            {% set option_value = m.deploymentName %}
-                                            <option value="{{ option_value }}"
-                                                data-endpoint-id="{{ endpoint.id or '' }}"
-                                                data-model-id="{{ m.id or '' }}"
-                                                data-provider="{{ endpoint.provider or '' }}"
-                                                data-model-name="{{ m.modelName or '' }}"
-                                                {% if settings.multimodal_vision_model == option_value %}selected{% endif %}>
-                                                {{ m.displayName or m.deploymentName }}{% if m.modelName %} ({{ m.modelName }}){% endif %}
-                                            </option>
-                                        {% endif %}
-                                    {% endfor %}
-                                {% endfor %}
-                            {% elif settings.enable_gpt_apim %}
-                                {# Legacy APIM-based GPT configuration #}
-                                {% for d in (settings.azure_apim_gpt_deployment or '').split(',') if d %}
-                                    {% set d_trim = d.strip() %}
-                                    {% if is_vision_capable_model is defined and is_vision_capable_model(d_trim) %}
-                                        <option value="{{ d_trim }}"
-                                            {% if settings.multimodal_vision_model == d_trim %}selected{% endif %}>
-                                            {{ d_trim }}
-                                        </option>
-                                    {% endif %}
-                                {% endfor %}
-                            {% else %}
-                                {# Legacy single-endpoint GPT configuration #}
-                                {% for m in settings.gpt_model.selected %}
-                                    {% if is_vision_capable_model is defined and is_vision_capable_model(m) %}
-                                        <option value="{{ m.deploymentName }}"
-                                            {% if settings.multimodal_vision_model == m.deploymentName %}selected{% endif %}>
-                                            {{ m.deploymentName }}{% if m.modelName %} ({{ m.modelName }}){% endif %}
-                                        </option>
-                                    {% endif %}
-                                {% endfor %}
-                            {% endif %}
-                        </select>
-                        <div class="form-text">Select a GPT model with vision capabilities (for example, gpt-4o or supported GPT 5 and later models). Only vision-capable models are shown.</div>
-
-                        <button type="button" class="btn btn-secondary mt-3" id="test_multimodal_vision_button">
-                            <i class="bi bi-clipboard-check me-1"></i>Test Vision Analysis
-                        </button>
-                        <div id="test_multimodal_vision_result" class="mt-2"></div>
-                    </div>
-                </div>
-
-
-
-                <div class="card mb-3 p-3" id="user-agreement-section">
-                    <h5>
-                        <i class="bi bi-file-earmark-check me-2"></i>User Agreement
-                    </h5>
-                    <p class="text-muted">
-                        Configure a user agreement that users must accept before uploading files.
-                        Supports Markdown formatting.
-                    </p>
-
-                    <!-- Enable Toggle -->
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_user_agreement"
-                            name="enable_user_agreement"
-                            {% if settings.enable_user_agreement %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_user_agreement">
-                            Enable User Agreement
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the agreement before uploading files in the selected workspace types."></i>
-                    </div>
-
-                    <!-- User Agreement Settings (shown when enabled) -->
-                    <div id="user_agreement_settings" {% if not settings.enable_user_agreement %}style="display: none;"{% endif %}>
-                        <hr>
-
-                        <!-- Apply To Checkboxes -->
-                        <div class="mb-3">
-                            <label class="form-label fw-bold">Apply to <span class="text-danger">*</span></label>
-                            <p class="text-muted small mb-2">Select where the user agreement should be shown (at least one required):</p>
-                            <div class="row">
-                                <div class="col-md-6">
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_personal" name="user_agreement_apply_personal"
-                                            {% if settings.user_agreement_apply_to and 'personal' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_personal">
-                                            <i class="bi bi-person me-1"></i>Personal Workspaces
-                                        </label>
-                                    </div>
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_group" name="user_agreement_apply_group"
-                                            {% if settings.user_agreement_apply_to and 'group' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_group">
-                                            <i class="bi bi-people me-1"></i>Group Workspaces
-                                        </label>
-                                    </div>
-                                </div>
-                                <div class="col-md-6">
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_public" name="user_agreement_apply_public"
-                                            {% if settings.user_agreement_apply_to and 'public' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_public">
-                                            <i class="bi bi-globe me-1"></i>Public Workspaces
-                                        </label>
-                                    </div>
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_chat" name="user_agreement_apply_chat"
-                                            {% if settings.user_agreement_apply_to and 'chat' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_chat">
-                                            <i class="bi bi-chat-dots me-1"></i>Chat
-                                        </label>
-                                    </div>
-                                </div>
-                            </div>
-                            <div id="user_agreement_apply_to_validation" class="text-danger small" style="display: none;">
-                                <i class="bi bi-exclamation-circle me-1"></i>At least one location must be selected
-                            </div>
-                        </div>
-
-                        <!-- Agreement Text -->
-                        <div class="mb-3">
-                            <label for="user_agreement_text" class="form-label fw-bold">
-                                Agreement Text <span class="text-danger">*</span>
-                                <span class="text-muted fw-normal ms-2">(Markdown supported)</span>
-                            </label>
-                            <textarea class="form-control" id="user_agreement_text" name="user_agreement_text" rows="6"
-                                placeholder="Enter the agreement text that users must accept before uploading files...&#10;&#10;Example:&#10;**I confirm that:**&#10;- The documents I am uploading do not contain PII&#10;- I have permission to share these documents">{{ settings.user_agreement_text or '' }}</textarea>
-                            <div class="d-flex justify-content-between mt-1">
-                                <small id="user_agreement_word_count" class="text-muted">0 / 200 words</small>
-                                <small id="user_agreement_word_warning" class="text-danger" style="display: none;">
-                                    <i class="bi bi-exclamation-circle me-1"></i>Exceeds 200 word limit
-                                </small>
-                            </div>
-                        </div>
-
-                        <!-- Daily Acceptance Option -->
-                        <div class="form-group form-check form-switch mb-3">
-                            <input type="checkbox" class="form-check-input" id="enable_user_agreement_daily" name="enable_user_agreement_daily"
-                                {% if settings.enable_user_agreement_daily %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="enable_user_agreement_daily">
-                                Allow users to accept once per day
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users only need to accept the agreement once per day instead of every time they upload files."></i>
-                        </div>
-
-                        <!-- Test Preview Button -->
-                        <div class="d-flex gap-2 flex-wrap">
-                            <button type="button" class="btn btn-outline-secondary" id="test_user_agreement_btn">
-                                <i class="bi bi-eye me-1"></i>Test Preview
-                            </button>
-                        </div>
-                    </div>
-                </div>
-            </div>
diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html
index 65e958b1d..0d1d9e4b1 100644
--- a/application/single_app/templates/admin_settings.html
+++ b/application/single_app/templates/admin_settings.html
@@ -980,7 +980,10 @@ <h4>12. Enhanced Citations and Image Generation</h4>
            visible whichever governance tab is active. #}
         <div id="governance-status" class="alert d-none" role="alert"></div>
         <div class="tab-content mt-3" id="adminSettingsTabContent">
-            {% include "admin/_panes/security.html" %}
+            {% include "admin/_panes/secrets.html" %}
+            {% include "admin/_panes/access-roles.html" %}
+            {% include "admin/_panes/content-safety.html" %}
+            {% include "admin/_panes/session.html" %}
 
 
             {% include "admin/_panes/agents.html" %}
@@ -994,7 +997,8 @@ <h4>12. Enhanced Citations and Image Generation</h4>
             <!-- Logging Tab Content -->
             {% include "admin/_panes/logging.html" %}
 
-            {% include "admin/_panes/general.html" %}
+            {% include "admin/_panes/branding.html" %}
+            {% include "admin/_panes/notices.html" %}
 
             {% include "admin/_panes/custom-pages.html" %}
 
@@ -1016,7 +1020,9 @@ <h4>12. Enhanced Citations and Image Generation</h4>
 
             {% include "admin/_panes/file-sync.html" %}
 
-            {% include "admin/_panes/workspaces.html" %}
+            {% include "admin/_panes/workspace-types.html" %}
+            {% include "admin/_panes/files-sharing.html" %}
+            {% include "admin/_panes/workflow.html" %}
 
             {# Data Lifecycle: what happens to user data over time #}
             {% include "admin/_panes/retention.html" %}
@@ -1031,11 +1037,14 @@ <h4>12. Enhanced Citations and Image Generation</h4>
             {% include "admin/_panes/feedback-alerts.html" %}
 
 
-            {% include "admin/_panes/safety.html" %}
 
 
-            {% include "admin/_panes/search-extract.html" %}
+            {% include "admin/_panes/web-research.html" %}
+            {% include "admin/_panes/search-index.html" %}
+            {% include "admin/_panes/extraction.html" %}
+            {% include "admin/_panes/audio-video.html" %}
 
+            {% include "admin/_panes/support-menu.html" %}
             {% include "admin/_panes/send-feedback.html" %}
 
             {# Latest Features stays last so it never opens by default #}
diff --git a/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md b/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
index 0e9a7ef64..8fd27d02d 100644
--- a/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
+++ b/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
@@ -22,8 +22,8 @@ Development ─── feature/admin-settings-ia ──┬── #1297 stage 1
                                                       └──► final PR ──► Development
 ```
 
-Current version: **0.260.012**. Fingerprint: **462 field names / 110 card ids**.
-Navigation: **13 groups / 27 tabs / 88 sections**.
+Current version: **0.260.014**. Fingerprint: **462 field names / 110 card ids**.
+Navigation: **14 groups / 36 tabs / 88 sections**.
 
 ### Shipped
 
@@ -109,6 +109,57 @@ moved from Scale to Security that way.
 | Scale | → Redis & Caching, Cosmos; Front Door moved to Security as Network |
 | Data Lifecycle | **New group.** Retention + Classification pulled from Workspaces, Archiving pulled from Safety |
 | Chat | **New group.** Chat Experience (thoughts from AI Models, file uploads + contents drawer and scope lock from Workspaces), Feedback & Alerts (feedback + desktop notifications from Safety) |
+| Appearance | **General dismantled.** → Branding, Notices & Agreements (+ user agreement from Workspaces), Pages & Links (+ external links) |
+| Security | **Safety dismantled.** → Access & Roles, Secrets, Content Safety, Session, Network |
+| Operations | Logging is now Logging & Health, gaining health check and API documentation from General |
+| Help | Gains Support Menu from General |
+| Knowledge | **Search & Extract dismantled.** → Web & Research, Search Index, Document Extraction (+ metadata extraction and multi-modal vision from Workspaces), Audio & Video |
+| Workspaces | → Workspace Types, Files & Sharing (+ shared conversation file approvals from AI Models), Global Identities |
+| Workflow | **New group**, split out of Workspaces |
+
+### Card container ids are not the nav section ids
+
+Several cards are wrapped in a container whose id differs from the nav map's
+section id, which is an inner anchor:
+
+| Nav section id | Card container id |
+|---|---|
+| `web-search-section` | `web-search-foundry-section` |
+| `embeddings-config` | `embeddings-configuration` |
+| `image-config` | `image-generation-configuration` |
+| `gpt-config` | `gpt-configuration` |
+| `agents-config` | `agents-configuration` |
+| `actions-config` | `actions-configuration` |
+
+**The move and split tools take container ids**; the nav map keeps its own.
+Run `list_pane_cards.py` for the real container id rather than assuming.
+
+### Trap: gpt-configuration is inside a modal
+
+`gpt-configuration` is **not** a top-level card. It lives inside
+`legacyModelSettingsModal` in the AI Models pane. Splitting AI Models means
+moving a modal, not a card, which is why AI Models and Agents are deliberately
+left for their own change rather than bundled with Knowledge and Workspaces.
+
+
+### Two hardcoded-id traps found and closed
+
+Both were latent breakage that only surfaced because a tab id changed:
+
+- **`openKeyVaultSettings`** in `admin_data_management.js` switched tabs by the
+  literal id `security-tab`. It was dead weight anyway — the link now carries
+  `data-admin-link` and `admin_card_links.js` resolves the tab from the DOM.
+- **The landing pane** was `show active` hardcoded in one pane's markup and
+  `showAdminTab('general')` hardcoded in the sidebar script. Splitting that
+  pane left Admin Settings with **no active pane at all**. Every pane now
+  renders `{% if admin_landing_tab == '<id>' %} show active{% endif %}`, fed by
+  `get_landing_tab_id()`, and the sidebar reads the first rendered tab.
+
+**Assert durable properties, not current ids.** Four test files hardcoded
+`general` or `security` and had to be rewritten to assert what actually matters
+— Latest Features is last, exactly one pane is active, every tab renders one
+pane. Any new test that names a tab id will need the same treatment next time.
+
 
 ### The cross-pane move tool
 
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index 3d12d8127..5d5f6154b 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,68 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](/explanation/features/) and [Fixes by Version](/explanation/fixes/).
 
+### **(v0.260.014)**
+
+#### User Interface Enhancements
+
+*   **Knowledge Settings Split By What They Actually Do**
+    *   Search & Extract held eight cards spanning four unrelated jobs, from Bing consent to voice transcription.
+    *   Knowledge now has **Web & Research** (web search, URL access, deep research), **Search Index** (Azure AI Search), **Document Extraction** (document intelligence, chunk sizes, plus metadata extraction and multi-modal vision brought over from Workspaces) and **Audio & Video** (video intelligence, voice conversations), alongside the existing File Sync.
+    *   Voice and video sit under Knowledge rather than Chat because they are extraction pipelines that turn recordings into searchable content.
+    *   (Ref: `web-research`, `search-index`, `extraction`, `audio-video`)
+
+*   **Workspaces Focused On Workspaces**
+    *   Workspaces mixed workspace types with file rules, workflow and extraction settings.
+    *   It is now **Workspace Types** (personal, group, public), **Files & Sharing** (downloads, sharing, and shared conversation file approvals brought over from AI Models) and the existing Global Identities.
+    *   (Ref: `workspace-types`, `files-sharing`)
+
+*   **Workflow Is Its Own Area**
+    *   Workflow drives approvals and assignment across every workspace type and was too large to sit as one card inside Workspaces. It now has its own group.
+    *   (Ref: `workflow`, `workflow-settings-section`)
+
+#### Bug Fixes
+
+*   **Group Workflow Assignment Dialog Could Not Open**
+    *   The Group Workflow Assignment dialog ended up in a different tab from the button that opens it. Because an inactive tab is hidden, the dialog would not have appeared at all.
+    *   The dialog now sits with its button, and a new check verifies this for every dialog in Admin Settings so it cannot happen again.
+    *   (Ref: `groupWorkflowAssignmentModal`, `test_admin_settings_modal_placement.py`)
+
+*   **Misplaced Section Comments In AI Models**
+    *   Two section comments had drifted onto the wrong cards while settings were being regrouped, labelling the embeddings card as processing thoughts.
+    *   (Ref: `ai-models` pane)
+
+### **(v0.260.013)**
+
+#### User Interface Enhancements
+
+*   **General Tab Broken Up Into Focused Tabs**
+    *   General had grown into a catch-all of eleven unrelated cards: branding sat next to health checks, API documentation, terms of use and system settings.
+    *   Appearance now has **Branding** (branding, home page text, appearance), **Notices & Agreements** (classification banner, chat AI notice, terms of use and the user agreement pulled across from Workspaces) and **Pages & Links** (static pages plus external links).
+    *   Health Check and API Documentation moved to Operations, which is now **Logging & Health** — they report on how the app is running rather than how it looks.
+    *   Support moved to Help as its own **Support Menu** tab, next to Send Feedback.
+    *   (Ref: `branding`, `notices`, `custom-pages`, `logging`, `support-menu`)
+
+*   **Security Split Into Five Purposeful Tabs**
+    *   Security held a single Key Vault card while an unrelated Safety tab mixed content filtering with role permissions, which are different jobs.
+    *   Security is now **Access & Roles** (who gets in and with what role), **Secrets** (Key Vault), **Content Safety** (what may be said once you are in), **Session** (idle timeout and related system settings) and **Network** (Azure Front Door).
+    *   (Ref: `access-roles`, `secrets`, `content-safety`, `session`, `network`)
+
+#### Bug Fixes
+
+*   **"Open Key Vault Settings" Link No Longer Depends On A Hardcoded Tab**
+    *   The link from Data Management to Key Vault switched tabs by a hardcoded id, so it silently stopped working whenever that tab was renamed.
+    *   It now uses the standard card link, which finds the owning tab from the page itself and stays correct however the settings are grouped.
+    *   (Ref: `data-management-key-vault-link`, `admin_card_links.js`, `admin_data_management.js`)
+
+*   **Admin Settings Always Opens On A Real Tab**
+    *   The tab shown on arrival was pinned to a specific id in both the markup and the sidebar script. Regrouping settings could leave Admin Settings opening with no tab selected at all.
+    *   The landing tab is now taken from the navigation map, so it follows the settings and can never be Latest Features.
+    *   (Ref: `admin_landing_tab`, `get_landing_tab_id`, `admin_sidebar_nav.js`)
+
+*   **Stale Tab Names In Latest Features**
+    *   Several Latest Features entries pointed readers at tabs by their old names after the settings moved.
+    *   (Ref: `latest-features` pane)
+
 ### **(v0.260.012)**
 
 #### User Interface Enhancements
diff --git a/functional_tests/test_admin_latest_features_tab.py b/functional_tests/test_admin_latest_features_tab.py
index 322bfea1a..31d96dfc4 100644
--- a/functional_tests/test_admin_latest_features_tab.py
+++ b/functional_tests/test_admin_latest_features_tab.py
@@ -341,7 +341,7 @@ def test_latest_features_sidebar_navigation():
     # Tab order is defined once in the nav map, which the sidebar renders from,
     # so ordering is asserted there rather than against the rendered markup.
     tab_ids = get_tab_ids()
-    assert tab_ids.index('latest-features') > tab_ids.index('general'), 'Latest Features should appear after General'
+    assert tab_ids[-1] == 'latest-features', 'Latest Features should be the last destination of all'
     assert tab_ids.index('latest-features') > tab_ids.index('send-feedback'), 'Latest Features should be the last destination, after Send Feedback'
 
     print('Latest Features sidebar navigation is present')
@@ -372,10 +372,18 @@ def test_latest_features_top_nav_priority():
     )
 
     # Latest Features opened on every visit to Admin Settings, which is why it
-    # is pinned last and General is the landing tab instead.
-    assert 'class="tab-pane fade" id="latest-features" role="tabpanel" aria-labelledby="latest-features-tab"' in template_content, 'Latest Features pane should not be the default active tab'
-    assert 'class="tab-pane fade show active" id="general" role="tabpanel" aria-labelledby="general-tab"' in template_content, 'General pane should be the default active tab'
-    assert tab_ids[0] == 'general', 'General should be the first tab in the navigation map'
+    # is pinned last. The landing pane is not hardcoded: every pane derives its
+    # active state from admin_landing_tab, which is the first tab of the first
+    # group, so regrouping cards can never leave Admin Settings with no pane
+    # showing or with Latest Features showing.
+    assert '<div class="tab-pane fade{% if admin_landing_tab == \'latest-features\' %} show active{% endif %}" id="latest-features"' in template_content, (
+        'Latest Features pane should derive its active state from the nav map like every other pane'
+    )
+    landing_tab = tab_ids[0]
+    assert landing_tab != 'latest-features', 'Latest Features must never be the landing tab'
+    assert f'<div class="tab-pane fade{{% if admin_landing_tab == \'{landing_tab}\' %}} show active{{% endif %}}" id="{landing_tab}"' in template_content, (
+        f"The first tab in the navigation map ('{landing_tab}') should render the landing pane conditional"
+    )
 
     print('Latest Features is last in navigation and not default active')
     return True
@@ -392,8 +400,21 @@ def test_admin_settings_tab_uniqueness():
     duplicates = sorted({t for t in tab_ids if tab_ids.count(t) > 1})
     assert not duplicates, f'Tabs listed more than once in the nav map: {duplicates}'
 
-    assert template_content.count('id="security" role="tabpanel"') == 1, 'Security tab pane should appear exactly once'
-    assert template_content.count('tab-pane fade show active') == 1, 'Only one tab pane should be marked show active'
+    # Every tab in the map must render exactly one pane. Checking all of them
+    # is stronger than naming one tab, and cannot go stale as tabs are renamed.
+    for tab_id in tab_ids:
+        pane_count = template_content.count(f'id="{tab_id}" role="tabpanel"')
+        assert pane_count == 1, f"Tab pane '{tab_id}' should appear exactly once, found {pane_count}"
+    # No pane may hardcode the active state; exactly one resolves it at render
+    # time from the nav map.
+    assert template_content.count('tab-pane fade show active') == 0, (
+        'No pane should hardcode "show active"; it is derived from admin_landing_tab'
+    )
+    landing_conditionals = template_content.count("{% if admin_landing_tab == '")
+    assert landing_conditionals == len(tab_ids), (
+        f'Every one of the {len(tab_ids)} panes should derive its active state '
+        f'from admin_landing_tab, found {landing_conditionals}'
+    )
     assert 'Managesecuritysettingsforkeyvaultandothersecurityconfigurations.</p>' in normalized_template, 'Security intro paragraph should be properly closed'
 
     # Every tab in the map must have a pane to activate.
diff --git a/functional_tests/test_admin_settings_modal_placement.py b/functional_tests/test_admin_settings_modal_placement.py
new file mode 100644
index 000000000..483f0ec02
--- /dev/null
+++ b/functional_tests/test_admin_settings_modal_placement.py
@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""
+Functional test for Admin Settings modal placement across tab panes.
+Version: 0.260.014
+Implemented in: 0.260.014
+
+Admin Settings modals are interleaved between cards rather than collected at the
+end of the template, so splitting a tab pane can silently strand a modal in a
+pane that never opens it. A modal inside an inactive tab pane cannot be shown,
+because the pane itself is hidden, so the failure is invisible until a user
+clicks the button.
+
+This test ensures every modal lives in a pane that can actually open it.
+"""
+
+import os
+import re
+import sys
+import collections
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+PANES_DIR = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "application",
+    "single_app",
+    "templates",
+    "admin",
+    "_panes",
+)
+SHELL = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "application",
+    "single_app",
+    "templates",
+    "admin_settings.html",
+)
+
+MODAL_PATTERN = re.compile(r'class="modal fade[^"]*"\s+id="([^"]+)"')
+TRIGGER_PATTERN = re.compile(r'data-bs-target="#([^"]+)"')
+
+# The shell sits outside every pane, so a modal there is reachable from anywhere
+# and a trigger there is not owned by any one pane.
+SHELL_KEY = "__shell__"
+
+
+def _read(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def _collect():
+    """Map each modal id to its pane, and each modal id to the panes opening it."""
+    modal_home = {}
+    trigger_homes = collections.defaultdict(set)
+
+    sources = [(SHELL_KEY, SHELL)]
+    for name in sorted(os.listdir(PANES_DIR)):
+        if name.endswith(".html"):
+            sources.append((name[: -len(".html")], os.path.join(PANES_DIR, name)))
+
+    for pane, path in sources:
+        markup = _read(path)
+        for match in MODAL_PATTERN.finditer(markup):
+            modal_home[match.group(1)] = pane
+        for match in TRIGGER_PATTERN.finditer(markup):
+            trigger_homes[match.group(1)].add(pane)
+
+    return modal_home, trigger_homes
+
+
+def test_modals_live_where_they_are_opened():
+    """Every modal must sit in a pane that can open it, or in the shell."""
+    print("Testing Admin Settings modal placement...")
+
+    modal_home, trigger_homes = _collect()
+    assert modal_home, "No modals found; the collector is probably looking in the wrong place"
+
+    stranded = []
+    for modal_id, home in sorted(modal_home.items()):
+        if home == SHELL_KEY:
+            continue
+        openers = trigger_homes.get(modal_id)
+        if not openers:
+            # Opened from JavaScript rather than markup, which this test cannot
+            # attribute to a pane. Those are covered by the card link tests.
+            continue
+        foreign = {pane for pane in openers if pane not in (home, SHELL_KEY)}
+        if foreign and home not in openers:
+            stranded.append((modal_id, home, sorted(foreign)))
+
+    assert not stranded, "Modals stranded in a pane that never opens them:\n" + "\n".join(
+        f"  '{modal_id}' lives in '{home}' but is only opened from {openers}"
+        for modal_id, home, openers in stranded
+    )
+
+    print(f"All {len(modal_home)} modals sit in a pane that can open them.")
+    return True
+
+
+def test_modal_ids_are_unique():
+    """A duplicated modal id would make the wrong dialog open."""
+    print("Testing Admin Settings modal id uniqueness...")
+
+    counts = collections.Counter()
+    paths = [SHELL] + [
+        os.path.join(PANES_DIR, name)
+        for name in sorted(os.listdir(PANES_DIR))
+        if name.endswith(".html")
+    ]
+    for path in paths:
+        for match in MODAL_PATTERN.finditer(_read(path)):
+            counts[match.group(1)] += 1
+
+    duplicates = sorted(modal_id for modal_id, count in counts.items() if count > 1)
+    assert not duplicates, f"Modal ids declared more than once: {duplicates}"
+
+    print(f"All {len(counts)} modal ids are unique.")
+    return True
+
+
+if __name__ == "__main__":
+    tests = [
+        test_modals_live_where_they_are_opened,
+        test_modal_ids_are_unique,
+    ]
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        try:
+            results.append(bool(test()))
+        except Exception as error:  # noqa: BLE001 - report and continue
+            print(f"Test failed: {error}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} tests passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_admin_settings_nav_map.py b/functional_tests/test_admin_settings_nav_map.py
index ce015c6f6..0754dddf9 100644
--- a/functional_tests/test_admin_settings_nav_map.py
+++ b/functional_tests/test_admin_settings_nav_map.py
@@ -143,14 +143,23 @@ def test_latest_features_stays_last():
     assert tab_ids[-1] == "latest-features", (
         f"Latest Features must be the last tab, got '{tab_ids[-1]}'"
     )
-    assert tab_ids[0] == "general", (
-        f"General must be the first tab, got '{tab_ids[0]}'"
-    )
     assert ADMIN_NAV[-1]["id"] == "help", (
         "Latest Features should sit in the last group"
     )
 
-    print("Latest Features is last; General leads.")
+    # The landing tab is whatever the map lists first, so it moves freely as the
+    # information architecture changes. What must never drift is that the admin
+    # does not land on Latest Features, which is the whole point of the move.
+    assert tab_ids[0] != "latest-features", (
+        "Latest Features must never be the landing tab"
+    )
+    assert ADMIN_NAV[0]["tabs"], "The first group must expose at least one tab"
+    assert tab_ids[0] == ADMIN_NAV[0]["tabs"][0]["id"], (
+        "The landing tab must be the first tab of the first group, so the "
+        "sidebar and the tab strip agree on where an admin lands"
+    )
+
+    print(f"Latest Features is last; '{tab_ids[0]}' leads.")
 
 
 if __name__ == "__main__":
diff --git a/functional_tests/test_admin_source_review_depth_save.py b/functional_tests/test_admin_source_review_depth_save.py
index fa7a602cd..528bf0c0e 100644
--- a/functional_tests/test_admin_source_review_depth_save.py
+++ b/functional_tests/test_admin_source_review_depth_save.py
@@ -41,9 +41,11 @@ def test_source_review_depth_has_single_form_field():
         f"Expected exactly one source_review_max_depth form field, found {depth_field_name_count}."
     )
 
+    # Bound the Latest Features visibility block by its own container rather
+    # than by a neighbouring card, so the check survives cards moving between
+    # tabs during information architecture work.
     latest_features_start = template_content.index('id="support_latest_features_settings"')
-    external_links_start = template_content.index('id="external-links-section"')
-    latest_features_section = template_content[latest_features_start:external_links_start]
+    latest_features_section = template_content[latest_features_start:latest_features_start + 8000]
 
     assert 'name="source_review_max_depth"' not in latest_features_section, (
         "Latest Features visibility controls must not post source_review_max_depth."
diff --git a/functional_tests/test_data_management_security_patterns.py b/functional_tests/test_data_management_security_patterns.py
index 422e3dfbf..284c123be 100644
--- a/functional_tests/test_data_management_security_patterns.py
+++ b/functional_tests/test_data_management_security_patterns.py
@@ -345,7 +345,6 @@ def test_admin_javascript_uses_safe_dom_patterns():
     for required_snippet in [
         'document.createElement("tr")',
         'document.createElement("td")',
-        'openKeyVaultSettings',
         'buildMigrationPlan()',
         'queueMigration(false)',
         'loadMigrationCatalog(targetType, "reset")',