diff --git a/application/single_app/admin_settings_nav.py b/application/single_app/admin_settings_nav.py
index b5c8b5e6f..48026e3ea 100644
--- a/application/single_app/admin_settings_nav.py
+++ b/application/single_app/admin_settings_nav.py
@@ -94,14 +94,31 @@
         "icon": "bi-cpu",
         "tabs": [
             {
-                "id": "ai-models",
-                "label": "AI Models",
-                "icon": "bi-cpu",
+                # The Chat Model card is reached through the legacy model
+                # settings dialog opened from here, so it is listed with the
+                # endpoints rather than as a tab of its own.
+                "id": "model-endpoints",
+                "label": "Model Endpoints",
+                "icon": "bi-hdd-network",
                 "sections": [
                     {"id": "multi-endpoint-configuration", "label": "Model Endpoints", "icon": "bi-hdd-network"},
+                    {"id": "gpt-config", "label": "Chat Model", "icon": "bi-chat-square-text"},
+                ],
+            },
+            {
+                "id": "embeddings",
+                "label": "Embeddings",
+                "icon": "bi-vector-pen",
+                "sections": [
                     {"id": "embeddings-config", "label": "Embeddings", "icon": "bi-vector-pen"},
+                ],
+            },
+            {
+                "id": "image-generation",
+                "label": "Image Generation",
+                "icon": "bi-image",
+                "sections": [
                     {"id": "image-config", "label": "Image Generation", "icon": "bi-image"},
-                    {"id": "gpt-config", "label": "Chat Model", "icon": "bi-chat-square-text"},
                 ],
             },
         ],
@@ -113,13 +130,30 @@
         "tabs": [
             {
                 "id": "agents",
-                "label": "Agents and Actions",
+                "label": "Agents",
                 "icon": "bi-robot",
                 "sections": [
-                    {"id": "document-action-capabilities-card", "label": "Document Action Capabilities", "icon": "bi-files"},
                     {"id": "agents-config", "label": "Agents Configuration", "icon": "bi-robot"},
                     {"id": "agent-template-approvals-section", "label": "Agent Template Approvals", "icon": "bi-layers", "condition": "enable_agent_template_gallery"},
+                ],
+            },
+            {
+                "id": "actions",
+                "label": "Actions",
+                "icon": "bi-plugin",
+                "sections": [
+                    {"id": "document-action-capabilities-card", "label": "Document Action Capabilities", "icon": "bi-files"},
                     {"id": "actions-config", "label": "Actions Configuration", "icon": "bi-plugin"},
+                ],
+            },
+            {
+                # The whole tab is behind mcp_ui_enabled, so the tab carries the
+                # condition rather than the single section inside it.
+                "id": "inbound-mcp",
+                "label": "Inbound MCP",
+                "icon": "bi-diagram-3",
+                "condition": "mcp_ui_enabled",
+                "sections": [
                     {"id": "inbound-mcp-configuration", "label": "Inbound MCP", "icon": "bi-diagram-3", "condition": "mcp_ui_enabled"},
                 ],
             },
diff --git a/application/single_app/config.py b/application/single_app/config.py
index 992744396..27e50b825 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -96,7 +96,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.260.014"
+VERSION = "0.260.015"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax')
diff --git a/application/single_app/static/js/admin/admin_sidebar_nav.js b/application/single_app/static/js/admin/admin_sidebar_nav.js
index 7e9538f73..1bf0e5e53 100644
--- a/application/single_app/static/js/admin/admin_sidebar_nav.js
+++ b/application/single_app/static/js/admin/admin_sidebar_nav.js
@@ -296,6 +296,7 @@ const LEGACY_TAB_REDIRECTS = {
     'security': 'secrets',
     'workspaces': 'workspace-types',
     'search-extract': 'web-research',
+    'ai-models': 'model-endpoints',
 };
 
 function resolveAdminTabId(tabId) {
diff --git a/application/single_app/templates/_sidebar_nav.html b/application/single_app/templates/_sidebar_nav.html
index 9c1cf3b79..8c2880678 100644
--- a/application/single_app/templates/_sidebar_nav.html
+++ b/application/single_app/templates/_sidebar_nav.html
@@ -517,6 +517,9 @@
           </li>
           {% endif %}
               {% else %}
+              {% if not admin_tab.condition
+                    or (admin_tab.condition == 'enable_agent_template_gallery' and app_settings.enable_agent_template_gallery)
+                    or (admin_tab.condition == 'mcp_ui_enabled' and mcp_ui_enabled) %}
               <li class="nav-item">
                 <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="{{ admin_tab.id }}">
                   <i class="bi {{ admin_tab.icon }} me-2" aria-hidden="true"></i><span class="nav-text">{{ admin_tab.label }}</span>
@@ -538,6 +541,7 @@
                 {% endif %}
               </li>
               {% endif %}
+              {% endif %}
               {% endfor %}
             </ul>
           </li>
diff --git a/application/single_app/templates/admin/_panes/actions.html b/application/single_app/templates/admin/_panes/actions.html
new file mode 100644
index 000000000..221cfac5b
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/actions.html
@@ -0,0 +1,205 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'actions' %} show active{% endif %}" id="actions" role="tabpanel" aria-labelledby="actions-tab">
+                <div class="card p-3 mb-4" id="document-action-capabilities-card">
+                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3 mb-3">
+                        <div>
+                            <h5 class="mb-1"><i class="bi bi-files me-2"></i>Document Action Capabilities</h5>
+                            <p class="text-muted small mb-0">Configure the document actions shown in the <strong>Action</strong> dropdown in Chat and Workflow. These controls live in the Agents and Actions tab, but remain separate from the global agent and custom action cards below.</p>
+                        </div>
+                        <span class="badge text-bg-light border align-self-start align-self-lg-center">Chat: 2-300 | Workflow: 2-1000</span>
+                    </div>
+                    <div class="alert alert-light border small mb-3" role="alert">
+                        Use these settings to explicitly allow Analyze and Document Comparison in the Chat and Workflow <strong>Action</strong> dropdowns without bundling them into the global agent or custom action configuration cards below.
+                    </div>
+                    <div class="row g-3">
+                        <div class="col-xl-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="form-check form-switch mb-3">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="document_action_analyze_enabled" name="document_action_analyze_enabled" {% if analyze_capability.enabled %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="document_action_analyze_enabled">Enable Analyze</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to run deterministic analysis across selected documents in chat and workflows."></i>
+                                </div>
+                                <div class="mb-3">
+                                    <div class="d-flex justify-content-between align-items-center mb-1">
+                                        <label for="document_action_analyze_chat_max_documents" class="form-label mb-0">Chat max documents</label>
+                                        <span id="document_action_analyze_chat_max_documents_value" class="small text-muted fw-semibold">{{ analyze_capability.chat_max_documents }}</span>
+                                    </div>
+                                    <div class="row g-2 align-items-center">
+                                        <div class="col-lg-8">
+                                            <input type="range" class="form-range document-action-capability-range" id="document_action_analyze_chat_max_documents_range" min="2" max="300" step="1" value="{{ analyze_capability.chat_max_documents }}" data-range-sync="document_action_analyze_chat_max_documents" data-range-display="document_action_analyze_chat_max_documents_value" />
+                                        </div>
+                                        <div class="col-lg-4">
+                                            <input type="number" class="form-control" id="document_action_analyze_chat_max_documents" name="document_action_analyze_chat_max_documents" min="2" max="300" value="{{ analyze_capability.chat_max_documents }}" />
+                                        </div>
+                                    </div>
+                                    <div class="d-flex justify-content-between small text-muted">
+                                        <span>2</span>
+                                        <span>300</span>
+                                    </div>
+                                </div>
+                                <div>
+                                    <div class="d-flex justify-content-between align-items-center mb-1">
+                                        <label for="document_action_analyze_workflow_max_documents" class="form-label mb-0">Workflow max documents</label>
+                                        <span id="document_action_analyze_workflow_max_documents_value" class="small text-muted fw-semibold">{{ analyze_capability.workflow_max_documents }}</span>
+                                    </div>
+                                    <div class="row g-2 align-items-center">
+                                        <div class="col-lg-8">
+                                            <input type="range" class="form-range document-action-capability-range" id="document_action_analyze_workflow_max_documents_range" min="2" max="1000" step="1" value="{{ analyze_capability.workflow_max_documents }}" data-range-sync="document_action_analyze_workflow_max_documents" data-range-display="document_action_analyze_workflow_max_documents_value" />
+                                        </div>
+                                        <div class="col-lg-4">
+                                            <input type="number" class="form-control" id="document_action_analyze_workflow_max_documents" name="document_action_analyze_workflow_max_documents" min="2" max="1000" value="{{ analyze_capability.workflow_max_documents }}" />
+                                        </div>
+                                    </div>
+                                    <div class="d-flex justify-content-between small text-muted">
+                                        <span>2</span>
+                                        <span>1000</span>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                        <div class="col-xl-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="form-check form-switch mb-3">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="document_action_comparison_enabled" name="document_action_comparison_enabled" {% if comparison_capability.enabled %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="document_action_comparison_enabled">Enable Document Comparison</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to compare one baseline document against one or more selected documents in chat and workflows."></i>
+                                </div>
+                                <div class="mb-3">
+                                    <div class="d-flex justify-content-between align-items-center mb-1">
+                                        <label for="document_action_comparison_chat_max_documents" class="form-label mb-0">Chat max documents</label>
+                                        <span id="document_action_comparison_chat_max_documents_value" class="small text-muted fw-semibold">{{ comparison_capability.chat_max_documents }}</span>
+                                    </div>
+                                    <div class="row g-2 align-items-center">
+                                        <div class="col-lg-8">
+                                            <input type="range" class="form-range document-action-capability-range" id="document_action_comparison_chat_max_documents_range" min="2" max="300" step="1" value="{{ comparison_capability.chat_max_documents }}" data-range-sync="document_action_comparison_chat_max_documents" data-range-display="document_action_comparison_chat_max_documents_value" />
+                                        </div>
+                                        <div class="col-lg-4">
+                                            <input type="number" class="form-control" id="document_action_comparison_chat_max_documents" name="document_action_comparison_chat_max_documents" min="2" max="300" value="{{ comparison_capability.chat_max_documents }}" />
+                                        </div>
+                                    </div>
+                                    <div class="d-flex justify-content-between small text-muted">
+                                        <span>2</span>
+                                        <span>300</span>
+                                    </div>
+                                </div>
+                                <div>
+                                    <div class="d-flex justify-content-between align-items-center mb-1">
+                                        <label for="document_action_comparison_workflow_max_documents" class="form-label mb-0">Workflow max documents</label>
+                                        <span id="document_action_comparison_workflow_max_documents_value" class="small text-muted fw-semibold">{{ comparison_capability.workflow_max_documents }}</span>
+                                    </div>
+                                    <div class="row g-2 align-items-center">
+                                        <div class="col-lg-8">
+                                            <input type="range" class="form-range document-action-capability-range" id="document_action_comparison_workflow_max_documents_range" min="2" max="1000" step="1" value="{{ comparison_capability.workflow_max_documents }}" data-range-sync="document_action_comparison_workflow_max_documents" data-range-display="document_action_comparison_workflow_max_documents_value" />
+                                        </div>
+                                        <div class="col-lg-4">
+                                            <input type="number" class="form-control" id="document_action_comparison_workflow_max_documents" name="document_action_comparison_workflow_max_documents" min="2" max="1000" value="{{ comparison_capability.workflow_max_documents }}" />
+                                        </div>
+                                    </div>
+                                    <div class="d-flex justify-content-between small text-muted">
+                                        <span>2</span>
+                                        <span>1000</span>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- Agents Configuration Section -->
+                <div class="card p-3 mb-4" id="actions-configuration">
+                    <h5 class="card-title">
+                        <i class="bi bi-plugin me-2"></i>Global Actions Configuration
+                    </h5>
+                    <p class="text-muted small">
+                        Configure custom actions and tools to extend functionality with integrations and specialized capabilities.
+                    </p>
+
+                    {% if not settings.enable_semantic_kernel %}
+                        <div class="alert alert-info">
+                            <strong>Actions are not available while agents are disabled.</strong> Enable agents above to configure actions.
+                        </div>
+                    {% else %}
+                        <div>
+                            <div class="d-flex justify-content-between align-items-center mb-3">
+                                <h6>Global Actions</h6>
+                                <button type="button" class="btn btn-primary btn-sm" id="add-plugin-btn">Add Action</button>
+                            </div>
+                            <p class="text-muted small">Disable a global action to keep the configuration without exposing it to runtime action loading until it is re-enabled.</p>
+                            {% if settings.per_user_semantic_kernel %}
+                            <!-- Action Feature Flags -->
+                                <div class="card p-3 mb-3" id="plugin-feature-toggles">
+                                    <h6 class="mb-2">Workspace Action Feature Toggles</h6>
+                                    <div class="form-check form-switch mb-2">
+                                        <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-user-plugins" name="allow_user_plugins" {% if settings.allow_user_plugins %}checked{% endif %}>
+                                        <label class="form-check-label ms-2" for="toggle-allow-user-plugins">Allow Personal Actions</label>
+                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage their own workspace-level actions/plugins for personal use."></i>
+                                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_user_actions">Govern</button>
+                                    </div>
+                                    <div class="form-check form-switch mb-2">
+                                        <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-group-plugins" name="allow_group_plugins" {% if settings.allow_group_plugins %}checked{% endif %}>
+                                        <label class="form-check-label ms-2" for="toggle-allow-group-plugins">Allow Group Actions</label>
+                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage group-level actions/plugins that can be shared within workgroups."></i>
+                                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_group_actions">Govern</button>
+                                    </div>
+                                </div>
+                            {% endif %}
+
+                            <!-- Core Plugin Toggles -->
+                            <div class="card p-3 mb-3" id="core-plugin-toggles">
+                                <h6 class="mb-2">Core Action Toggles</h6>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-time-plugin" name="enable_time_plugin" {% if settings.enable_time_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-time-plugin">Enable Time Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to get current date, time, and perform time-related calculations and conversions."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-http-plugin" name="enable_http_plugin" {% if settings.enable_http_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-http-plugin">Enable HTTP Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to make HTTP requests to websites for data retrieval and integration."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-wait-plugin" name="enable_wait_plugin" {% if settings.enable_wait_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-wait-plugin">Enable Wait Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to pause execution for specified time periods, useful for delays and timing control in workflows."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-math-plugin" name="enable_math_plugin" {% if settings.enable_math_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-math-plugin">Enable Math Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to perform mathematical calculations, solve equations, and handle complex mathematical operations."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-text-plugin" name="enable_text_plugin" {% if settings.enable_text_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-text-plugin">Enable Text Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to perform text processing operations like formatting, validation, and manipulation of strings and text content."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-default-embedding-model-plugin" name="enable_default_embedding_model_plugin" {% if settings.enable_default_embedding_model_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-default-embedding-model-plugin">Enable Default Embedding Model Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to access and use the default embedding model for text similarity and vector operations."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-fact-memory-plugin" name="enable_fact_memory_plugin" {% if settings.enable_fact_memory_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-fact-memory-plugin">Enable Fact Memory Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to store and retrieve facts and information across conversations for improved memory and context retention."></i>
+                                </div>
+                                <div class="mb-2" id="tabular-processing-toggle-wrapper">
+                                    <div class="d-flex align-items-center">
+                                        <span class="fw-semibold">Tabular Processing Action</span>
+                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Agents can analyze tabular data files (CSV, XLSX) using pandas for aggregations, filtering, and full dataset operations. This action is automatically enabled whenever Enhanced Citations is enabled."></i>
+                                    </div>
+                                    <small class="text-muted d-block ms-4" id="tabular-processing-dependency-note">Automatically enabled when Enhanced Citations is enabled</small>
+                                </div>
+                            </div>
+                            <table class="table table-bordered" id="plugins-table">
+                                <thead>
+                                    <tr>
+                                        <th>Display Name</th>
+                                        <th>Description</th>
+                                        <th>Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="admin-plugins-table-body"></tbody>
+                            </table>
+                        </div>
+                    {% endif %}
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/agents.html b/application/single_app/templates/admin/_panes/agents.html
index 622dde43d..889caa9cc 100644
--- a/application/single_app/templates/admin/_panes/agents.html
+++ b/application/single_app/templates/admin/_panes/agents.html
@@ -23,112 +23,6 @@
 
                 {% set analyze_capability = settings.document_action_capabilities.analyze %}
                 {% set comparison_capability = settings.document_action_capabilities.comparison %}
-                <div class="card p-3 mb-4" id="document-action-capabilities-card">
-                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3 mb-3">
-                        <div>
-                            <h5 class="mb-1"><i class="bi bi-files me-2"></i>Document Action Capabilities</h5>
-                            <p class="text-muted small mb-0">Configure the document actions shown in the <strong>Action</strong> dropdown in Chat and Workflow. These controls live in the Agents and Actions tab, but remain separate from the global agent and custom action cards below.</p>
-                        </div>
-                        <span class="badge text-bg-light border align-self-start align-self-lg-center">Chat: 2-300 | Workflow: 2-1000</span>
-                    </div>
-                    <div class="alert alert-light border small mb-3" role="alert">
-                        Use these settings to explicitly allow Analyze and Document Comparison in the Chat and Workflow <strong>Action</strong> dropdowns without bundling them into the global agent or custom action configuration cards below.
-                    </div>
-                    <div class="row g-3">
-                        <div class="col-xl-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="form-check form-switch mb-3">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="document_action_analyze_enabled" name="document_action_analyze_enabled" {% if analyze_capability.enabled %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="document_action_analyze_enabled">Enable Analyze</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to run deterministic analysis across selected documents in chat and workflows."></i>
-                                </div>
-                                <div class="mb-3">
-                                    <div class="d-flex justify-content-between align-items-center mb-1">
-                                        <label for="document_action_analyze_chat_max_documents" class="form-label mb-0">Chat max documents</label>
-                                        <span id="document_action_analyze_chat_max_documents_value" class="small text-muted fw-semibold">{{ analyze_capability.chat_max_documents }}</span>
-                                    </div>
-                                    <div class="row g-2 align-items-center">
-                                        <div class="col-lg-8">
-                                            <input type="range" class="form-range document-action-capability-range" id="document_action_analyze_chat_max_documents_range" min="2" max="300" step="1" value="{{ analyze_capability.chat_max_documents }}" data-range-sync="document_action_analyze_chat_max_documents" data-range-display="document_action_analyze_chat_max_documents_value" />
-                                        </div>
-                                        <div class="col-lg-4">
-                                            <input type="number" class="form-control" id="document_action_analyze_chat_max_documents" name="document_action_analyze_chat_max_documents" min="2" max="300" value="{{ analyze_capability.chat_max_documents }}" />
-                                        </div>
-                                    </div>
-                                    <div class="d-flex justify-content-between small text-muted">
-                                        <span>2</span>
-                                        <span>300</span>
-                                    </div>
-                                </div>
-                                <div>
-                                    <div class="d-flex justify-content-between align-items-center mb-1">
-                                        <label for="document_action_analyze_workflow_max_documents" class="form-label mb-0">Workflow max documents</label>
-                                        <span id="document_action_analyze_workflow_max_documents_value" class="small text-muted fw-semibold">{{ analyze_capability.workflow_max_documents }}</span>
-                                    </div>
-                                    <div class="row g-2 align-items-center">
-                                        <div class="col-lg-8">
-                                            <input type="range" class="form-range document-action-capability-range" id="document_action_analyze_workflow_max_documents_range" min="2" max="1000" step="1" value="{{ analyze_capability.workflow_max_documents }}" data-range-sync="document_action_analyze_workflow_max_documents" data-range-display="document_action_analyze_workflow_max_documents_value" />
-                                        </div>
-                                        <div class="col-lg-4">
-                                            <input type="number" class="form-control" id="document_action_analyze_workflow_max_documents" name="document_action_analyze_workflow_max_documents" min="2" max="1000" value="{{ analyze_capability.workflow_max_documents }}" />
-                                        </div>
-                                    </div>
-                                    <div class="d-flex justify-content-between small text-muted">
-                                        <span>2</span>
-                                        <span>1000</span>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                        <div class="col-xl-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="form-check form-switch mb-3">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="document_action_comparison_enabled" name="document_action_comparison_enabled" {% if comparison_capability.enabled %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="document_action_comparison_enabled">Enable Document Comparison</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to compare one baseline document against one or more selected documents in chat and workflows."></i>
-                                </div>
-                                <div class="mb-3">
-                                    <div class="d-flex justify-content-between align-items-center mb-1">
-                                        <label for="document_action_comparison_chat_max_documents" class="form-label mb-0">Chat max documents</label>
-                                        <span id="document_action_comparison_chat_max_documents_value" class="small text-muted fw-semibold">{{ comparison_capability.chat_max_documents }}</span>
-                                    </div>
-                                    <div class="row g-2 align-items-center">
-                                        <div class="col-lg-8">
-                                            <input type="range" class="form-range document-action-capability-range" id="document_action_comparison_chat_max_documents_range" min="2" max="300" step="1" value="{{ comparison_capability.chat_max_documents }}" data-range-sync="document_action_comparison_chat_max_documents" data-range-display="document_action_comparison_chat_max_documents_value" />
-                                        </div>
-                                        <div class="col-lg-4">
-                                            <input type="number" class="form-control" id="document_action_comparison_chat_max_documents" name="document_action_comparison_chat_max_documents" min="2" max="300" value="{{ comparison_capability.chat_max_documents }}" />
-                                        </div>
-                                    </div>
-                                    <div class="d-flex justify-content-between small text-muted">
-                                        <span>2</span>
-                                        <span>300</span>
-                                    </div>
-                                </div>
-                                <div>
-                                    <div class="d-flex justify-content-between align-items-center mb-1">
-                                        <label for="document_action_comparison_workflow_max_documents" class="form-label mb-0">Workflow max documents</label>
-                                        <span id="document_action_comparison_workflow_max_documents_value" class="small text-muted fw-semibold">{{ comparison_capability.workflow_max_documents }}</span>
-                                    </div>
-                                    <div class="row g-2 align-items-center">
-                                        <div class="col-lg-8">
-                                            <input type="range" class="form-range document-action-capability-range" id="document_action_comparison_workflow_max_documents_range" min="2" max="1000" step="1" value="{{ comparison_capability.workflow_max_documents }}" data-range-sync="document_action_comparison_workflow_max_documents" data-range-display="document_action_comparison_workflow_max_documents_value" />
-                                        </div>
-                                        <div class="col-lg-4">
-                                            <input type="number" class="form-control" id="document_action_comparison_workflow_max_documents" name="document_action_comparison_workflow_max_documents" min="2" max="1000" value="{{ comparison_capability.workflow_max_documents }}" />
-                                        </div>
-                                    </div>
-                                    <div class="d-flex justify-content-between small text-muted">
-                                        <span>2</span>
-                                        <span>1000</span>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <!-- Agents Configuration Section -->
                 <div class="card p-3 mb-4" id="agents-configuration">
                     <h5 class="card-title">
                         <i class="bi bi-robot me-2"></i>Agents Configuration
@@ -386,636 +280,4 @@ <h5 class="mb-1">
                     </div>
                 </div>
                 {% endif %}
-
-                <!-- Actions Configuration Section -->
-                <div class="card p-3 mb-4" id="actions-configuration">
-                    <h5 class="card-title">
-                        <i class="bi bi-plugin me-2"></i>Global Actions Configuration
-                    </h5>
-                    <p class="text-muted small">
-                        Configure custom actions and tools to extend functionality with integrations and specialized capabilities.
-                    </p>
-
-                    {% if not settings.enable_semantic_kernel %}
-                        <div class="alert alert-info">
-                            <strong>Actions are not available while agents are disabled.</strong> Enable agents above to configure actions.
-                        </div>
-                    {% else %}
-                        <div>
-                            <div class="d-flex justify-content-between align-items-center mb-3">
-                                <h6>Global Actions</h6>
-                                <button type="button" class="btn btn-primary btn-sm" id="add-plugin-btn">Add Action</button>
-                            </div>
-                            <p class="text-muted small">Disable a global action to keep the configuration without exposing it to runtime action loading until it is re-enabled.</p>
-                            {% if settings.per_user_semantic_kernel %}
-                            <!-- Action Feature Flags -->
-                                <div class="card p-3 mb-3" id="plugin-feature-toggles">
-                                    <h6 class="mb-2">Workspace Action Feature Toggles</h6>
-                                    <div class="form-check form-switch mb-2">
-                                        <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-user-plugins" name="allow_user_plugins" {% if settings.allow_user_plugins %}checked{% endif %}>
-                                        <label class="form-check-label ms-2" for="toggle-allow-user-plugins">Allow Personal Actions</label>
-                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage their own workspace-level actions/plugins for personal use."></i>
-                                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_user_actions">Govern</button>
-                                    </div>
-                                    <div class="form-check form-switch mb-2">
-                                        <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-group-plugins" name="allow_group_plugins" {% if settings.allow_group_plugins %}checked{% endif %}>
-                                        <label class="form-check-label ms-2" for="toggle-allow-group-plugins">Allow Group Actions</label>
-                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage group-level actions/plugins that can be shared within workgroups."></i>
-                                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_group_actions">Govern</button>
-                                    </div>
-                                </div>
-                            {% endif %}
-
-                            <!-- Core Plugin Toggles -->
-                            <div class="card p-3 mb-3" id="core-plugin-toggles">
-                                <h6 class="mb-2">Core Action Toggles</h6>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-time-plugin" name="enable_time_plugin" {% if settings.enable_time_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-time-plugin">Enable Time Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to get current date, time, and perform time-related calculations and conversions."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-http-plugin" name="enable_http_plugin" {% if settings.enable_http_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-http-plugin">Enable HTTP Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to make HTTP requests to websites for data retrieval and integration."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-wait-plugin" name="enable_wait_plugin" {% if settings.enable_wait_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-wait-plugin">Enable Wait Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to pause execution for specified time periods, useful for delays and timing control in workflows."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-math-plugin" name="enable_math_plugin" {% if settings.enable_math_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-math-plugin">Enable Math Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to perform mathematical calculations, solve equations, and handle complex mathematical operations."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-text-plugin" name="enable_text_plugin" {% if settings.enable_text_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-text-plugin">Enable Text Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to perform text processing operations like formatting, validation, and manipulation of strings and text content."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-default-embedding-model-plugin" name="enable_default_embedding_model_plugin" {% if settings.enable_default_embedding_model_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-default-embedding-model-plugin">Enable Default Embedding Model Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to access and use the default embedding model for text similarity and vector operations."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-fact-memory-plugin" name="enable_fact_memory_plugin" {% if settings.enable_fact_memory_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-fact-memory-plugin">Enable Fact Memory Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to store and retrieve facts and information across conversations for improved memory and context retention."></i>
-                                </div>
-                                <div class="mb-2" id="tabular-processing-toggle-wrapper">
-                                    <div class="d-flex align-items-center">
-                                        <span class="fw-semibold">Tabular Processing Action</span>
-                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Agents can analyze tabular data files (CSV, XLSX) using pandas for aggregations, filtering, and full dataset operations. This action is automatically enabled whenever Enhanced Citations is enabled."></i>
-                                    </div>
-                                    <small class="text-muted d-block ms-4" id="tabular-processing-dependency-note">Automatically enabled when Enhanced Citations is enabled</small>
-                                </div>
-                            </div>
-                            <table class="table table-bordered" id="plugins-table">
-                                <thead>
-                                    <tr>
-                                        <th>Display Name</th>
-                                        <th>Description</th>
-                                        <th>Actions</th>
-                                    </tr>
-                                </thead>
-                                <tbody id="admin-plugins-table-body"></tbody>
-                            </table>
-                        </div>
-                    {% endif %}
-                </div>
-                {% if mcp_ui_enabled %}
-                <div class="card p-3 mb-4" id="inbound-mcp-configuration" data-default-tenant-id="{{ inbound_mcp_easy_auth_script_context.tenant_id }}">
-                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-3 mb-3">
-                        <div>
-                            <h5 class="card-title mb-1">
-                                <i class="bi bi-diagram-3 me-2"></i>Inbound MCP Server
-                            </h5>
-                            <p class="text-muted small mb-0">
-                                Configure the governed SimpleChat MCP endpoint used by external MCP clients. Personal tools use delegated user tokens by default; tool access remains deny-by-default until authentication, source, client, and governance policy all allow the request.
-                            </p>
-                        </div>
-                        <div class="d-flex flex-column gap-2 align-items-lg-end">
-                            <span class="badge text-bg-warning align-self-start align-self-lg-end">Preview</span>
-                            <button type="button" class="btn btn-sm btn-outline-primary" data-bs-toggle="modal" data-bs-target="#inboundMcpInfoModal">
-                                <i class="bi bi-info-circle me-1"></i>About MCP &amp; Tools
-                            </button>
-                        </div>
-                    </div>
-
-                    <div class="alert alert-info small" role="alert">
-                        Enable only after the Microsoft Entra delegated scope, delegated user app role, client app allowlist, source allowlist, and SimpleChat governance item policies are configured. Personal MCP tools require delegated user context plus an assigned user role. The app-only role is reserved for future non-personal service/admin tools.
-                    </div>
-
-                    <div class="row g-3">
-                        <div class="col-xl-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <h6 class="mb-3">Runtime Gate</h6>
-                                <div class="form-check form-switch mb-3">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="enable_inbound_mcp_server" name="enable_inbound_mcp_server" {% if settings.enable_inbound_mcp_server %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="enable_inbound_mcp_server">Enable inbound MCP server</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Controls whether authenticated requests to the SimpleChat inbound MCP endpoint are accepted."></i>
-                                </div>
-                                <div class="mb-3">
-                                    <label class="form-label" for="inbound_mcp_required_scope">Required delegated scope</label>
-                                    <input class="form-control" type="text" id="inbound_mcp_required_scope" name="inbound_mcp_required_scope" value="{{ settings.inbound_mcp_required_scope }}" autocomplete="off">
-                                    <div class="form-text">Default: <code>DelegatedMcpServerAccess</code>. VS Code and other user clients must present this delegated scope.</div>
-                                </div>
-                                <div class="mb-3">
-                                    <label class="form-label" for="inbound_mcp_required_user_role">Required delegated user role</label>
-                                    <input class="form-control" type="text" id="inbound_mcp_required_user_role" name="inbound_mcp_required_user_role" value="{{ settings.inbound_mcp_required_user_role }}" autocomplete="off">
-                                    <div class="form-text">Default: <code>InboundMCPUserAccess</code>. Governance determines which users/groups can use tools after this Entra role and delegated scope pass.</div>
-                                </div>
-                                <div class="mb-0">
-                                    <label class="form-label" for="inbound_mcp_required_app_role">Required app-only role</label>
-                                    <input class="form-control" type="text" id="inbound_mcp_required_app_role" name="inbound_mcp_required_app_role" value="{{ settings.inbound_mcp_required_app_role }}" autocomplete="off">
-                                    <div class="form-text">Default: <code>InboundMCPAppAccess</code>. Reserved for future app-only MCP tools and still governed separately.</div>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="col-xl-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <h6 class="mb-3">Endpoint Contract</h6>
-                                <dl class="row small mb-0">
-                                    <dt class="col-sm-5">MCP endpoint</dt>
-                                    <dd class="col-sm-7"><code>{{ inbound_mcp_resource_path }}</code></dd>
-                                    <dt class="col-sm-5">Protected resource metadata</dt>
-                                    <dd class="col-sm-7"><code>{{ inbound_mcp_prm_path }}</code></dd>
-                                    <dt class="col-sm-5">Transport</dt>
-                                    <dd class="col-sm-7">Streamable HTTP JSON-RPC</dd>
-                                    <dt class="col-sm-5">Current tool surface</dt>
-                                    <dd class="col-sm-7">Personal delegated tools only.</dd>
-                                    <dt class="col-sm-5">Tool identity</dt>
-                                    <dd class="col-sm-7">Delegated user token required for personal data.</dd>
-                                </dl>
-                                <div class="alert alert-light border small mt-3 mb-0" role="alert">
-                                    Endpoint paths are fixed in application routing for this initial UI slice. Change the app setting below for the source header only.
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="col-12">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-2 mb-3">
-                                    <div>
-                                        <h6 class="mb-1">Request Size &amp; Throttling</h6>
-                                        <div class="small text-muted">Protect the inbound MCP endpoint from oversized payloads and noisy clients. Rate limits are enforced per caller and tool category across app instances.</div>
-                                    </div>
-                                    <div class="form-check form-switch">
-                                        <input class="form-check-input" type="checkbox" role="switch" id="enable_inbound_mcp_rate_limits" name="enable_inbound_mcp_rate_limits" {% if settings.enable_inbound_mcp_rate_limits %}checked{% endif %}>
-                                        <label class="form-check-label ms-2" for="enable_inbound_mcp_rate_limits">Enable tool throttles</label>
-                                    </div>
-                                </div>
-                                <div class="row g-3">
-                                    <div class="col-md-6 col-xl-3">
-                                        <label class="form-label" for="inbound_mcp_max_request_bytes">Max request bytes</label>
-                                        <input class="form-control" type="number" id="inbound_mcp_max_request_bytes" name="inbound_mcp_max_request_bytes" min="1024" max="1048576" step="1" value="{{ settings.inbound_mcp_max_request_bytes }}">
-                                        <div class="form-text">Default: <code>65536</code>. Range: 1 KB to 1 MB.</div>
-                                    </div>
-                                    <div class="col-md-6 col-xl-3">
-                                        <label class="form-label" for="inbound_mcp_rate_limit_window_seconds">Rate window seconds</label>
-                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_window_seconds" name="inbound_mcp_rate_limit_window_seconds" min="10" max="3600" step="1" value="{{ settings.inbound_mcp_rate_limit_window_seconds }}">
-                                        <div class="form-text">Default: <code>60</code>. Applies to each throttle category.</div>
-                                    </div>
-                                    <div class="col-md-4 col-xl-2">
-                                        <label class="form-label" for="inbound_mcp_rate_limit_read_per_window">Read limit</label>
-                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_read_per_window" name="inbound_mcp_rate_limit_read_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_read_per_window }}">
-                                        <div class="form-text">Default: <code>120</code>.</div>
-                                    </div>
-                                    <div class="col-md-4 col-xl-2">
-                                        <label class="form-label" for="inbound_mcp_rate_limit_search_per_window">Search limit</label>
-                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_search_per_window" name="inbound_mcp_rate_limit_search_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_search_per_window }}">
-                                        <div class="form-text">Default: <code>30</code>.</div>
-                                    </div>
-                                    <div class="col-md-4 col-xl-2">
-                                        <label class="form-label" for="inbound_mcp_rate_limit_write_per_window">Write limit</label>
-                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_write_per_window" name="inbound_mcp_rate_limit_write_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_write_per_window }}">
-                                        <div class="form-text">Default: <code>10</code>.</div>
-                                    </div>
-                                </div>
-                                <div class="alert alert-light border small mt-3 mb-0" role="alert">
-                                    Application Insights events include <code>mcp_request_id</code>, caller app, delegated user, source, tool, duration, result status, and rate-limit category without recording prompts, document content, bearer tokens, or secrets.
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="col-12">
-                            <input type="hidden" id="inbound_mcp_allowed_client_app_entries_json" name="inbound_mcp_allowed_client_app_entries_json" value='{{ settings.inbound_mcp_allowed_client_app_entries | default([], true) | tojson }}'>
-                            <input type="hidden" id="inbound_mcp_allowed_tenant_entries_json" name="inbound_mcp_allowed_tenant_entries_json" value='{{ settings.inbound_mcp_allowed_tenant_entries | default([], true) | tojson }}'>
-                            <input type="hidden" id="inbound_mcp_allowed_source_entries_json" name="inbound_mcp_allowed_source_entries_json" value='{{ settings.inbound_mcp_allowed_source_entries | default([], true) | tojson }}'>
-                        </div>
-
-                        <div class="col-12">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="d-flex justify-content-between align-items-start gap-2 mb-2">
-                                    <div>
-                                        <h6 class="mb-1">Allowed client app IDs</h6>
-                                        <div class="small text-muted">Required allowlist. Empty means no MCP clients can connect.</div>
-                                    </div>
-                                    <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="clients">Add</button>
-                                </div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle mb-2">
-                                        <thead>
-                                            <tr>
-                                                <th>Client app ID</th>
-                                                <th>Description</th>
-                                                <th class="text-end">Actions</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="inbound-mcp-client-app-entries-body"></tbody>
-                                    </table>
-                                </div>
-                                <div class="small text-muted" id="inbound-mcp-client-app-entries-summary"></div>
-                            </div>
-                        </div>
-
-                        <div class="col-12">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="inbound_mcp_allow_external_tenants" name="inbound_mcp_allow_external_tenants" {% if settings.inbound_mcp_allow_external_tenants %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="inbound_mcp_allow_external_tenants">Allow additional tenant IDs</label>
-                                </div>
-                                <div class="small text-muted mb-3">
-                                    Off allows only the configured SimpleChat tenant. Turning this on auto-includes the SimpleChat tenant and lets admins add more tenants.
-                                </div>
-                                <div id="inbound-mcp-tenant-list-container" class="{% if not settings.inbound_mcp_allow_external_tenants %}d-none{% endif %}">
-                                    <div class="d-flex justify-content-between align-items-center mb-2">
-                                        <h6 class="mb-0">Allowed tenant IDs</h6>
-                                        <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="tenants">Add</button>
-                                    </div>
-                                    <div class="table-responsive">
-                                        <table class="table table-sm align-middle mb-2">
-                                            <thead>
-                                                <tr>
-                                                    <th>Tenant ID</th>
-                                                    <th>Description</th>
-                                                    <th class="text-end">Actions</th>
-                                                </tr>
-                                            </thead>
-                                            <tbody id="inbound-mcp-tenant-entries-body"></tbody>
-                                        </table>
-                                    </div>
-                                    <div class="small text-muted" id="inbound-mcp-tenant-entries-summary"></div>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="col-12">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="inbound_mcp_allow_all_source_ids" name="inbound_mcp_allow_all_source_ids" {% if settings.inbound_mcp_allow_all_source_ids %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="inbound_mcp_allow_all_source_ids">Allow all source IDs</label>
-                                </div>
-                                <div class="small text-muted mb-3">
-                                    Default on accepts any source signal at the runtime allowlist layer. Turn off to require explicit source values here. In both modes, admins must still create an inbound MCP source governance policy before tools are returned.
-                                </div>
-                                <div class="mb-3">
-                                    <label class="form-label" for="inbound_mcp_source_header">Source header name</label>
-                                    <input class="form-control" type="text" id="inbound_mcp_source_header" name="inbound_mcp_source_header" value="{{ settings.inbound_mcp_source_header }}" autocomplete="off">
-                                    <div class="form-text">Default: <code>X-SimpleChat-MCP-Source</code>.</div>
-                                </div>
-                                <div class="alert alert-warning py-2 small" role="alert">
-                                    Source IDs are read from the configured header when present. This is a client-provided value and can be spoofed unless a trusted gateway, APIM policy, or similar control sets/enforces it.
-                                </div>
-                                <div id="inbound-mcp-all-source-governance-callout" class="alert alert-info py-2 small {% if not settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}" role="alert">
-                                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-2">
-                                        <div>
-                                            Create an <code>inbound_mcp_source</code> policy for <code>*</code> to choose which users or groups can use inbound MCP from any accepted source.
-                                        </div>
-                                        <button
-                                            type="button"
-                                            class="btn btn-sm btn-outline-primary governance-new-inbound-mcp-policy-btn"
-                                            data-governance-inbound-mcp-entity="inbound_mcp_source"
-                                            data-governance-inbound-mcp-item="*"
-                                            data-governance-inbound-mcp-policy-name="Inbound MCP all source access"
-                                            data-governance-inbound-mcp-resource-label="All accepted source IDs (*)"
-                                            data-governance-open-tab="true"
-                                        >
-                                            Create Wildcard Source Policy
-                                        </button>
-                                    </div>
-                                </div>
-                                <div id="inbound-mcp-controlled-source-governance-callout" class="alert alert-info py-2 small {% if settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}" role="alert">
-                                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-2">
-                                        <div>
-                                            After adding allowed source IDs, create an <code>inbound_mcp_source</code> policy for <code>*</code> or a specific source to choose which users or groups can use inbound MCP.
-                                        </div>
-                                        <button
-                                            type="button"
-                                            class="btn btn-sm btn-outline-primary governance-new-inbound-mcp-policy-btn"
-                                            data-governance-inbound-mcp-entity="inbound_mcp_source"
-                                            data-governance-inbound-mcp-policy-name="Inbound MCP source access"
-                                            data-governance-open-tab="true"
-                                        >
-                                            Create Source Policy
-                                        </button>
-                                    </div>
-                                </div>
-                                <div id="inbound-mcp-source-list-container" class="{% if settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}">
-                                    <div class="d-flex justify-content-between align-items-center mb-2">
-                                        <h6 class="mb-0">Allowed source IDs</h6>
-                                        <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="sources">Add</button>
-                                    </div>
-                                    <div class="table-responsive">
-                                        <table class="table table-sm align-middle mb-2">
-                                            <thead>
-                                                <tr>
-                                                    <th>Source value</th>
-                                                    <th>Description</th>
-                                                    <th class="text-end">Actions</th>
-                                                </tr>
-                                            </thead>
-                                            <tbody id="inbound-mcp-source-entries-body"></tbody>
-                                        </table>
-                                    </div>
-                                    <div class="small text-muted" id="inbound-mcp-source-entries-summary"></div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                <div class="modal fade" id="inboundMcpEntryModal" tabindex="-1" aria-labelledby="inboundMcpEntryModalLabel" aria-hidden="true" data-ignore-settings-change="true">
-                    <div class="modal-dialog">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="inboundMcpEntryModalLabel">Add MCP Entry</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <input type="hidden" id="inbound-mcp-entry-list-key">
-                                <input type="hidden" id="inbound-mcp-entry-edit-index">
-                                <div class="mb-3">
-                                    <label class="form-label" for="inbound-mcp-entry-value" id="inbound-mcp-entry-value-label">Value</label>
-                                    <input class="form-control" type="text" id="inbound-mcp-entry-value" autocomplete="off">
-                                    <div class="invalid-feedback" id="inbound-mcp-entry-value-error">Value is required.</div>
-                                </div>
-                                <div class="mb-0">
-                                    <label class="form-label" for="inbound-mcp-entry-description">Description</label>
-                                    <input class="form-control" type="text" id="inbound-mcp-entry-description" autocomplete="off" maxlength="256">
-                                    <div class="form-text">Use descriptions to explain who owns this app, tenant, or source value without making the value easy to guess.</div>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                                <button type="button" class="btn btn-primary" id="inbound-mcp-entry-save-btn">Save Entry</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                <div class="modal fade" id="inboundMcpInfoModal" tabindex="-1" aria-labelledby="inboundMcpInfoModalLabel" aria-hidden="true" data-ignore-settings-change="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="inboundMcpInfoModalLabel">Inbound MCP overview</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-info small" role="alert">
-                                    SimpleChat exposes a governed Streamable HTTP MCP endpoint for approved external MCP clients. Authentication handles tenant, client, delegated scope, and Entra role checks; governance decides which users/groups and source IDs can use tools.
-                                </div>
-                                <div class="row g-3 mb-3">
-                                    <div class="col-lg-6">
-                                        <h6>Runtime checks</h6>
-                                        <ul class="small mb-0">
-                                            <li>Client app ID must be in the allowed client list.</li>
-                                            <li>Tenant must be the SimpleChat tenant unless additional tenants are enabled.</li>
-                                            <li>Delegated personal tools require the configured scope and user role.</li>
-                                            <li>Governance uses <code>inbound_mcp_source</code> policies to decide which users or groups can use each accepted source.</li>
-                                        </ul>
-                                    </div>
-                                    <div class="col-lg-6">
-                                        <h6>Source header guidance</h6>
-                                        <p class="small mb-0">
-                                            The configured source header is an advisory control-plane signal. Treat it like an APIM subscription-key label, not strong identity. For stronger assurance, set or overwrite it at a trusted gateway and avoid relying on client-provided values alone.
-                                        </p>
-                                    </div>
-                                </div>
-                                <h6>Available MCP tools</h6>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th>Tool</th>
-                                                <th>Scope</th>
-                                                <th>Operation</th>
-                                                <th>Description</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody>
-                                            {% for tool in inbound_mcp_tools %}
-                                            <tr>
-                                                <td>
-                                                    <div class="fw-semibold">{{ tool.display_name }}</div>
-                                                    <code>{{ tool.id }}</code>
-                                                </td>
-                                                <td>{{ tool.scope }}</td>
-                                                <td>{{ tool.resource_family }} / {{ tool.operation }}</td>
-                                                <td>{{ tool.description }}</td>
-                                            </tr>
-                                            {% endfor %}
-                                        </tbody>
-                                    </table>
-                                </div>
-                                <hr />
-                                <h6>Application Insights starter queries</h6>
-                                <p class="small text-muted">
-                                    Use these KQL queries in Application Insights Logs to validate inbound MCP traffic, denials, and tool latency. They rely on safe structured dimensions emitted by the inbound MCP route and do not require prompt, message, document, token, or secret values.
-                                </p>
-                                <div class="accordion" id="inbound-mcp-observability-accordion">
-                                    <div class="accordion-item">
-                                        <h2 class="accordion-header" id="inbound-mcp-kql-request-trends-heading">
-                                            <button class="accordion-button" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-request-trends-collapse" aria-expanded="true" aria-controls="inbound-mcp-kql-request-trends-collapse">
-                                                Request and failure trends
-                                            </button>
-                                        </h2>
-                                        <div id="inbound-mcp-kql-request-trends-collapse" class="accordion-collapse collapse show" aria-labelledby="inbound-mcp-kql-request-trends-heading" data-bs-parent="#inbound-mcp-observability-accordion">
-                                            <div class="accordion-body">
-                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-request-trends">
-                                                    <i class="bi bi-clipboard me-1"></i>Copy query
-                                                </button>
-                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-request-trends">traces
-| where timestamp > ago(24h)
-| where message has "[InboundMCP]"
-| summarize requests=count(), failures=countif(tostring(customDimensions.result_status) !in ("", "success", "accepted")) by bin(timestamp, 1h)
-| order by timestamp desc</code></pre>
-                                            </div>
-                                        </div>
-                                    </div>
-                                    <div class="accordion-item">
-                                        <h2 class="accordion-header" id="inbound-mcp-kql-error-categories-heading">
-                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-error-categories-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-error-categories-collapse">
-                                                Error categories by caller and source
-                                            </button>
-                                        </h2>
-                                        <div id="inbound-mcp-kql-error-categories-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-error-categories-heading" data-bs-parent="#inbound-mcp-observability-accordion">
-                                            <div class="accordion-body">
-                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-error-categories">
-                                                    <i class="bi bi-clipboard me-1"></i>Copy query
-                                                </button>
-                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-error-categories">traces
-| where timestamp > ago(24h)
-| where message has "[InboundMCP]"
-| where isnotempty(tostring(customDimensions.error_type))
-| summarize events=count() by tostring(customDimensions.error_type), tostring(customDimensions.caller_app_id), tostring(customDimensions.source_id)
-| order by events desc</code></pre>
-                                            </div>
-                                        </div>
-                                    </div>
-                                    <div class="accordion-item">
-                                        <h2 class="accordion-header" id="inbound-mcp-kql-tool-latency-heading">
-                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-tool-latency-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-tool-latency-collapse">
-                                                Tool latency and result status
-                                            </button>
-                                        </h2>
-                                        <div id="inbound-mcp-kql-tool-latency-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-tool-latency-heading" data-bs-parent="#inbound-mcp-observability-accordion">
-                                            <div class="accordion-body">
-                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-tool-latency">
-                                                    <i class="bi bi-clipboard me-1"></i>Copy query
-                                                </button>
-                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-tool-latency">traces
-| where timestamp > ago(24h)
-| where message has "Inbound MCP tool call"
-| where isnotempty(tostring(customDimensions.tool_id))
-| summarize calls=count(), avg_duration_ms=avg(todouble(customDimensions.duration_ms)), p95_duration_ms=percentile(todouble(customDimensions.duration_ms), 95) by tostring(customDimensions.tool_id), tostring(customDimensions.result_status)
-| order by calls desc</code></pre>
-                                            </div>
-                                        </div>
-                                    </div>
-                                    <div class="accordion-item">
-                                        <h2 class="accordion-header" id="inbound-mcp-kql-rate-limits-heading">
-                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-rate-limits-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-rate-limits-collapse">
-                                                Rate-limit denials
-                                            </button>
-                                        </h2>
-                                        <div id="inbound-mcp-kql-rate-limits-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-rate-limits-heading" data-bs-parent="#inbound-mcp-observability-accordion">
-                                            <div class="accordion-body">
-                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-rate-limits">
-                                                    <i class="bi bi-clipboard me-1"></i>Copy query
-                                                </button>
-                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-rate-limits">traces
-| where timestamp > ago(24h)
-| where message has "Inbound MCP tool call denied by rate limit"
-| summarize denials=count() by tostring(customDimensions.rate_limit_category), tostring(customDimensions.tool_id), tostring(customDimensions.caller_app_id)
-| order by denials desc</code></pre>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                <div class="modal fade" id="inboundMcpEasyAuthModal" tabindex="-1" aria-labelledby="inboundMcpEasyAuthModalLabel" aria-hidden="true" data-ignore-settings-change="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="inboundMcpEasyAuthModalLabel">Verify App Service Authentication exclusions</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-warning">
-                                    <strong>Required before enabling inbound MCP:</strong>
-                                    If Azure App Service Authentication redirects unauthenticated requests, add excluded paths so MCP clients can discover protected resource metadata and so SimpleChat can enforce bearer-token MCP access itself.
-                                </div>
-                                <p>
-                                    Run the following PowerShell with Azure CLI from Azure Cloud Shell or any authenticated terminal. SimpleChat pre-fills the script from this App Service's environment when possible.
-                                </p>
-                                <div class="row g-2 small mb-3">
-                                    <div class="col-lg-6">
-                                        <div class="border rounded p-2 h-100">
-                                            <div class="fw-semibold">Derived deployment values</div>
-                                            <dl class="row mb-0">
-                                                <dt class="col-sm-5">Azure environment</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.azure_environment }}</code></dd>
-                                                <dt class="col-sm-5">Resource Manager</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.resource_manager_endpoint }}</code></dd>
-                                                <dt class="col-sm-5">Resource group</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.resource_group }}</code></dd>
-                                                <dt class="col-sm-5">App Service</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.app_name }}</code></dd>
-                                                <dt class="col-sm-5">Subscription</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.subscription_id or "Current Azure CLI account" }}</code></dd>
-                                                <dt class="col-sm-5">API client ID</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.simplechat_api_client_id }}</code></dd>
-                                                <dt class="col-sm-5">Delegated scope</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_delegated_scope }}</code></dd>
-                                                <dt class="col-sm-5">User role</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_user_roles | join(", ") }}</code></dd>
-                                                <dt class="col-sm-5">App-only role</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_app_roles | join(", ") }}</code></dd>
-                                            </dl>
-                                        </div>
-                                    </div>
-                                    <div class="col-lg-6">
-                                        <div class="border rounded p-2 h-100">
-                                            <div class="fw-semibold">Script behavior</div>
-                                            <ul class="mb-0">
-                                                <li>Sets the Azure CLI cloud before login.</li>
-                                                <li>Logs in with the configured SimpleChat tenant.</li>
-                                                <li>Attempts to verify that the SimpleChat API app exposes the required delegated scope and inbound MCP app roles.</li>
-                                                <li>Uses SimpleChat's Resource Manager endpoint for public, government, or custom clouds.</li>
-                                                <li>Creates a timestamped backup of current <code>authsettingsV2</code> before applying changes.</li>
-                                            </ul>
-                                        </div>
-                                    </div>
-                                </div>
-                                {% if inbound_mcp_easy_auth_script_context.missing_values %}
-                                <div class="alert alert-danger small">
-                                    SimpleChat could not derive every required value. Replace the placeholders in the script before running it:
-                                    <strong>{{ inbound_mcp_easy_auth_script_context.missing_values | join(", ") }}</strong>.
-                                </div>
-                                {% endif %}
-                                {% if inbound_mcp_easy_auth_script_context.scope_check_missing_values %}
-                                <div class="alert alert-warning small">
-                                    SimpleChat could not derive every value needed for the delegated-scope and role preflight. Replace these placeholders if you want the script to validate the app registration before changing Easy Auth:
-                                    <strong>{{ inbound_mcp_easy_auth_script_context.scope_check_missing_values | join(", ") }}</strong>.
-                                </div>
-                                {% endif %}
-                                {% if inbound_mcp_easy_auth_script_context.uses_custom_cloud_match %}
-                                <div class="alert alert-info small">
-                                    This deployment uses a custom Azure environment. The script searches your registered Azure CLI clouds for one with the same Resource Manager endpoint. If none is registered, register the custom cloud first and rerun the script.
-                                </div>
-                                {% endif %}
-                                <div class="position-relative mb-3">
-                                    <button type="button" class="btn btn-outline-secondary btn-sm position-absolute top-0 end-0 m-2" id="inbound-mcp-copy-script" aria-label="Copy PowerShell script">
-                                        <i class="bi bi-clipboard" aria-hidden="true"></i>
-                                    </button>
-                                    <pre class="bg-body-tertiary border rounded p-3 pe-5 small mb-0"><code id="inbound-mcp-easy-auth-script-code">{{ inbound_mcp_easy_auth_script }}</code></pre>
-                                </div>
-                                <div class="alert alert-info small">
-                                    The verification checks these public unauthenticated endpoints and expects SimpleChat JSON responses, not Microsoft sign-in HTML:
-                                    <ul class="mb-0">
-                                        <li><code>/.well-known/oauth-protected-resource</code></li>
-                                        <li><code>/.well-known/oauth-protected-resource/api/mcp</code></li>
-                                        <li><code>/.well-known/oauth-protected-resource/mcp</code></li>
-                                        <li><code>/.well-known/oauth-authorization-server</code></li>
-                                        <li><code>/api/mcp</code></li>
-                                        <li><code>/api/mcp/health</code></li>
-                                    </ul>
-                                </div>
-                                <div class="form-check mb-3">
-                                    <input class="form-check-input" type="checkbox" id="inbound-mcp-easy-auth-confirm">
-                                    <label class="form-check-label" for="inbound-mcp-easy-auth-confirm">
-                                        I have added the required App Service Authentication excluded paths for this SimpleChat App Service.
-                                    </label>
-                                </div>
-                                <div id="inbound-mcp-easy-auth-status" class="alert alert-info d-none" role="status"></div>
-                                <ul id="inbound-mcp-easy-auth-results" class="list-group small d-none"></ul>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Cancel</button>
-                                <button type="button" class="btn btn-primary" id="inbound-mcp-easy-auth-verify" disabled>
-                                    I accept, verify endpoints
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                {% endif %}
             </div>
diff --git a/application/single_app/templates/admin/_panes/chat-experience.html b/application/single_app/templates/admin/_panes/chat-experience.html
index 37d8033a6..be9826832 100644
--- a/application/single_app/templates/admin/_panes/chat-experience.html
+++ b/application/single_app/templates/admin/_panes/chat-experience.html
@@ -97,6 +97,4 @@ <h5>
                         <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users cannot unlock the workspace scope on conversations. Scope automatically locks after the first AI search and remains locked. Disable this to allow users to manually unlock scope."></i>
                     </div>
                 </div>
-
-                <!-- User Agreement Section -->
             </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/classification.html b/application/single_app/templates/admin/_panes/classification.html
index 425eeedcf..8a4dc6e11 100644
--- a/application/single_app/templates/admin/_panes/classification.html
+++ b/application/single_app/templates/admin/_panes/classification.html
@@ -42,6 +42,4 @@ <h6>Classification Categories</h6>
                         <input type="hidden" name="document_classification_categories_json" id="document_classification_categories_json">
                     </div>
                 </div>
-
-                <!-- Retention Policy Section -->
             </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/cosmos.html b/application/single_app/templates/admin/_panes/cosmos.html
index 33cf6b0f3..6163be982 100644
--- a/application/single_app/templates/admin/_panes/cosmos.html
+++ b/application/single_app/templates/admin/_panes/cosmos.html
@@ -1138,6 +1138,4 @@ <h5 class="modal-title" id="cosmosThroughputContainerModalLabel">
                         </div>
                     </div>
                 </div>
-
-                <!-- Front Door Configuration Card -->
             </div>
diff --git a/application/single_app/templates/admin/_panes/embeddings.html b/application/single_app/templates/admin/_panes/embeddings.html
new file mode 100644
index 000000000..f05c7d66f
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/embeddings.html
@@ -0,0 +1,148 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'embeddings' %} show active{% endif %}" id="embeddings" role="tabpanel" aria-labelledby="embeddings-tab">
+                <div class="card p-3 mb-4" id="embeddings-configuration">
+                    <h5 class="card-title">
+                        <i class="bi bi-vector-pen me-2"></i>Embeddings Configuration
+                    </h5>
+                    <p class="text-muted small">
+                        Configure your embeddings settings. These are used for semantic search, knowledge-base lookups, etc.
+                    </p>
+                    <button type="button" class="btn btn-sm btn-outline-secondary mb-3 align-self-start" data-bs-toggle="modal" data-bs-target="#legacyModelDiscoveryIdentityGuideModal">
+                        <i class="bi bi-question-circle me-1"></i>Setup Guide
+                    </button>
+
+                <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                    <input type="checkbox" class="form-check-input me-2" id="enable_embedding_apim"
+                        name="enable_embedding_apim" {% if settings.enable_embedding_apim %}checked{% endif %}>
+                    <label class="form-check-label" for="enable_embedding_apim">Use APIM instead of direct to Azure
+                        OpenAI endpoint</label>
+                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route embedding model requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
+                </div>
+
+                <div id="non_apim_embedding_settings" {% if settings.enable_embedding_apim %}style="display: none;" {%
+                    endif %}>
+                    <div class="card p-3 mb-3">
+                        <div class="mb-3">
+                            <label for="azure_openai_embedding_endpoint" class="form-label">
+                                Azure OpenAI Embedding Endpoint
+                            </label>
+                            <input type="text" class="form-control" id="azure_openai_embedding_endpoint"
+                                name="azure_openai_embedding_endpoint"
+                                value="{{ settings.azure_openai_embedding_endpoint or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_openai_embedding_authentication_type" class="form-label">
+                                Authentication Type
+                            </label>
+                            <select class="form-select" id="azure_openai_embedding_authentication_type"
+                                name="azure_openai_embedding_authentication_type">
+                                <option value="key" {% if settings.azure_openai_embedding_authentication_type=='key'
+                                    %}selected{% endif %}>
+                                    Key
+                                </option>
+                                <option value="managed_identity" {% if
+                                    settings.azure_openai_embedding_authentication_type=='managed_identity' %}selected{% endif %}>
+                                    Managed Identity
+                                </option>
+                            </select>
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_openai_embedding_subscription_id" class="form-label">Subscription
+                                ID</label>
+                            <input type="text" class="form-control" id="azure_openai_embedding_subscription_id"
+                                name="azure_openai_embedding_subscription_id"
+                                value="{{ settings.azure_openai_embedding_subscription_id or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_openai_embedding_resource_group" class="form-label">Resource Group</label>
+                            <input type="text" class="form-control" id="azure_openai_embedding_resource_group"
+                                name="azure_openai_embedding_resource_group"
+                                value="{{ settings.azure_openai_embedding_resource_group or '' }}">
+                        </div>
+                        <div class="mb-3" id="embedding_key_container" {% if
+                            settings.azure_openai_embedding_authentication_type !='key' %}style="display: none;" {%
+                            endif %}>
+                            <label for="azure_openai_embedding_key" class="form-label">Azure OpenAI Embedding
+                                Key</label>
+                            <div class="input-group">
+                                <input type="password" class="form-control" id="azure_openai_embedding_key"
+                                    name="azure_openai_embedding_key"
+                                    value="{{ settings.azure_openai_embedding_key or '' }}">
+                                <button type="button" class="btn btn-outline-secondary"
+                                    id="toggle_embedding_key">Show</button>
+                            </div>
+                        </div>
+                        <div class="mb-3">
+                            <div id="embedding_models_list" class="mt-2 mb-3">
+
+                            </div>
+                            <small>Save pending changes to settings before clicking Fetch Embedding Models</small><br>
+
+                            <input type="hidden" name="embedding_model_json" id="embedding_model_json" />
+
+
+                            <input type="hidden" id="embedding_model" value="{{ settings.embedding_model.selected[0].deploymentName if settings.embedding_model.selected else '' }}" />
+
+
+                            <button type="button" class="btn btn-secondary" id="fetch_embedding_models_btn">
+                                Fetch Embedding Models
+                            </button>
+                        </div>
+                        <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
+                            data-bs-target="#advancedEmbeddingsFields" aria-expanded="false"
+                            aria-controls="advancedEmbeddingsFields">
+                            Show Advanced
+                        </a>
+                        <div class="collapse" id="advancedEmbeddingsFields">
+                            <div class="card card-body mt-2">
+                                <div class="mb-3">
+                                    <label for="azure_openai_embedding_api_version" class="form-label">
+                                        Azure OpenAI Embedding API Version
+                                    </label>
+                                    <input type="text" class="form-control" id="azure_openai_embedding_api_version"
+                                        name="azure_openai_embedding_api_version"
+                                        value="{{ settings.azure_openai_embedding_api_version or '' }}">
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div id="apim_embedding_settings" class="card p-3 mb-3" {% if not settings.enable_embedding_apim
+                    %}style="display: none;" {% endif %}>
+                    <div class="mb-3">
+                        <label for="azure_apim_embedding_endpoint" class="form-label">Azure APIM Endpoint</label>
+                        <input type="text" class="form-control" id="azure_apim_embedding_endpoint"
+                            name="azure_apim_embedding_endpoint"
+                            value="{{ settings.azure_apim_embedding_endpoint or '' }}">
+                    </div>
+                    <div class="mb-3">
+                        <label for="azure_apim_embedding_api_version" class="form-label">Azure APIM API Version</label>
+                        <input type="text" class="form-control" id="azure_apim_embedding_api_version"
+                            name="azure_apim_embedding_api_version"
+                            value="{{ settings.azure_apim_embedding_api_version or '' }}">
+                    </div>
+                    <div class="mb-3">
+                        <label for="azure_apim_embedding_deployment" class="form-label">Azure APIM Deployment</label>
+                        <input type="text" class="form-control" id="azure_apim_embedding_deployment"
+                            name="azure_apim_embedding_deployment"
+                            value="{{ settings.azure_apim_embedding_deployment or '' }}">
+                    </div>
+                    <div class="mb-3">
+                        <label for="azure_apim_embedding_subscription_key" class="form-label">Azure APIM Subscription
+                            Key</label>
+                        <div class="input-group">
+                            <input type="password" class="form-control" id="azure_apim_embedding_subscription_key"
+                                name="azure_apim_embedding_subscription_key"
+                                value="{{ settings.azure_apim_embedding_subscription_key or '' }}">
+                            <button type="button" class="btn btn-outline-secondary"
+                                id="toggle_azure_apim_embedding_subscription_key">Show</button>
+                        </div>
+                    </div>
+                </div>
+
+                <button type="button" class="btn btn-secondary mt-3" id="test_embedding_button">
+                    Test Embedding Connection
+                </button>
+                <div id="test_embedding_result" class="mt-2"></div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/image-generation.html b/application/single_app/templates/admin/_panes/image-generation.html
new file mode 100644
index 000000000..ee9293278
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/image-generation.html
@@ -0,0 +1,165 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'image-generation' %} show active{% endif %}" id="image-generation" role="tabpanel" aria-labelledby="image-generation-tab">
+                <div class="card p-3 mb-4" id="image-generation-configuration">
+                    <h5 class="card-title">
+                        <i class="bi bi-image me-2"></i>Image Generation Configuration
+                    </h5>
+                    <p class="text-muted small">
+                        Configure image generation settings. Enable/disable, set endpoints, and choose a model.
+                    </p>
+                    <button type="button" class="btn btn-sm btn-outline-secondary mb-3 align-self-start" data-bs-toggle="modal" data-bs-target="#legacyModelDiscoveryIdentityGuideModal">
+                        <i class="bi bi-question-circle me-1"></i>Setup Guide
+                    </button>
+
+                <div class="form-group form-check form-switch mb-3">
+                    <input type="checkbox" class="form-check-input" id="enable_image_generation"
+                        name="enable_image_generation" {% if settings.enable_image_generation %}checked{% endif %}>
+                    <label class="form-check-label ms-2" for="enable_image_generation">
+                        Enable Image Generation
+                    </label>
+                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable AI-powered image generation capabilities using DALL-E models for creating images from text descriptions."></i>
+                </div>
+                <div id="image_gen_settings" {% if not settings.enable_image_generation %}style="display: none;" {%
+                    endif %}>
+
+                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                        <input type="checkbox" class="form-check-input me-2" id="enable_image_gen_apim"
+                            name="enable_image_gen_apim" {% if settings.enable_image_gen_apim %}checked{% endif %}>
+                        <label class="form-check-label" for="enable_image_gen_apim">Use APIM instead of direct to Azure
+                            OpenAI endpoint.</label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route image generation requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
+                    </div>
+
+                    <div id="non_apim_image_gen_settings" {% if settings.enable_image_gen_apim %}style="display: none;"
+                        {% endif %}>
+                        <div class="card p-3 mb-3">
+                            <div class="mb-3">
+                                <label for="azure_openai_image_gen_endpoint" class="form-label">
+                                    Azure OpenAI Image Generation Endpoint
+                                </label>
+                                <input type="text" class="form-control" id="azure_openai_image_gen_endpoint"
+                                    name="azure_openai_image_gen_endpoint"
+                                    value="{{ settings.azure_openai_image_gen_endpoint or '' }}">
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_openai_image_gen_authentication_type" class="form-label">
+                                    Authentication Type
+                                </label>
+                                <select class="form-select" id="azure_openai_image_gen_authentication_type"
+                                    name="azure_openai_image_gen_authentication_type">
+                                    <option value="key" {% if settings.azure_openai_image_gen_authentication_type=='key'
+                                        %}selected{% endif %}>
+                                        Key
+                                    </option>
+                                    <option value="managed_identity" {% if
+                                        settings.azure_openai_image_gen_authentication_type=='managed_identity'
+                                        %}selected{% endif %}>
+                                        Managed Identity
+                                    </option>
+                                </select>
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_openai_image_gen_subscription_id" class="form-label">Subscription
+                                    ID</label>
+                                <input type="text" class="form-control" id="azure_openai_image_gen_subscription_id"
+                                    name="azure_openai_image_gen_subscription_id"
+                                    value="{{ settings.azure_openai_image_gen_subscription_id or '' }}">
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_openai_image_gen_resource_group" class="form-label">Resource
+                                    Group</label>
+                                <input type="text" class="form-control" id="azure_openai_image_gen_resource_group"
+                                    name="azure_openai_image_gen_resource_group"
+                                    value="{{ settings.azure_openai_image_gen_resource_group or '' }}">
+                            </div>
+                            <div class="mb-3" id="image_gen_key_container" {% if
+                                settings.azure_openai_image_gen_authentication_type !='key' %}style="display: none;" {%
+                                endif %}>
+                                <label for="azure_openai_image_gen_key" class="form-label">Azure OpenAI Image Generation
+                                    Key</label>
+                                <div class="input-group">
+                                    <input type="password" class="form-control" id="azure_openai_image_gen_key"
+                                        name="azure_openai_image_gen_key"
+                                        value="{{ settings.azure_openai_image_gen_key or '' }}">
+                                    <button type="button" class="btn btn-outline-secondary"
+                                        id="toggle_image_gen_key">Show</button>
+                                </div>
+                            </div>
+                            <div class="mb-3">
+                                <div id="image_models_list" class="mt-2 mb-3">
+
+                                </div>
+
+                                <small>Save pending changes to settings before clicking Fetch Image Generation Models</small><br>
+
+                                <input type="hidden" name="image_gen_model_json" id="image_gen_model_json" />
+
+
+                                <input type="hidden" id="image_gen_model" value="{{ settings.image_gen_model.selected[0].deploymentName if settings.image_gen_model.selected else '' }}" />
+
+
+                                <button type="button" class="btn btn-secondary" id="fetch_image_models_btn">
+                                    Fetch Image Generation Models
+                                </button>
+                            </div>
+                            <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
+                                data-bs-target="#advancedImageGenFields" aria-expanded="false"
+                                aria-controls="advancedImageGenFields">
+                                Show Advanced
+                            </a>
+                            <div class="collapse" id="advancedImageGenFields">
+                                <div class="card card-body mt-2">
+                                    <div class="mb-3">
+                                        <label for="azure_openai_image_gen_api_version" class="form-label">
+                                            Azure OpenAI Image Gen API Version
+                                        </label>
+                                        <input type="text" class="form-control" id="azure_openai_image_gen_api_version"
+                                            name="azure_openai_image_gen_api_version"
+                                            value="{{ settings.azure_openai_image_gen_api_version or '' }}">
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div id="apim_image_gen_settings" class="card p-3 mb-3" {% if not settings.enable_image_gen_apim
+                        %}style="display: none;" {% endif %}>
+                        <div class="mb-3">
+                            <label for="azure_apim_image_gen_endpoint" class="form-label">Azure APIM Endpoint</label>
+                            <input type="text" class="form-control" id="azure_apim_image_gen_endpoint"
+                                name="azure_apim_image_gen_endpoint"
+                                value="{{ settings.azure_apim_image_gen_endpoint or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_apim_image_gen_api_version" class="form-label">Azure APIM API
+                                Version</label>
+                            <input type="text" class="form-control" id="azure_apim_image_gen_api_version"
+                                name="azure_apim_image_gen_api_version"
+                                value="{{ settings.azure_apim_image_gen_api_version or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_apim_image_gen_deployment" class="form-label">Azure APIM
+                                Deployment</label>
+                            <input type="text" class="form-control" id="azure_apim_image_gen_deployment"
+                                name="azure_apim_image_gen_deployment"
+                                value="{{ settings.azure_apim_image_gen_deployment or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_apim_image_gen_subscription_key" class="form-label">Azure APIM
+                                Subscription Key</label>
+                            <div class="input-group">
+                                <input type="password" class="form-control" id="azure_apim_image_gen_subscription_key"
+                                    name="azure_apim_image_gen_subscription_key"
+                                    value="{{ settings.azure_apim_image_gen_subscription_key or '' }}">
+                                <button type="button" class="btn btn-outline-secondary"
+                                    id="toggle_azure_apim_image_gen_subscription_key">Show</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <button type="button" class="btn btn-secondary mt-3" id="test_image_button">
+                    Test Image Connection
+                </button>
+                <div id="test_image_result" class="mt-2"></div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/inbound-mcp.html b/application/single_app/templates/admin/_panes/inbound-mcp.html
new file mode 100644
index 000000000..3676ea641
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/inbound-mcp.html
@@ -0,0 +1,535 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'inbound-mcp' %} show active{% endif %}" id="inbound-mcp" role="tabpanel" aria-labelledby="inbound-mcp-tab">
+                {% if mcp_ui_enabled %}
+                <div class="card p-3 mb-4" id="inbound-mcp-configuration" data-default-tenant-id="{{ inbound_mcp_easy_auth_script_context.tenant_id }}">
+                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-3 mb-3">
+                        <div>
+                            <h5 class="card-title mb-1">
+                                <i class="bi bi-diagram-3 me-2"></i>Inbound MCP Server
+                            </h5>
+                            <p class="text-muted small mb-0">
+                                Configure the governed SimpleChat MCP endpoint used by external MCP clients. Personal tools use delegated user tokens by default; tool access remains deny-by-default until authentication, source, client, and governance policy all allow the request.
+                            </p>
+                        </div>
+                        <div class="d-flex flex-column gap-2 align-items-lg-end">
+                            <span class="badge text-bg-warning align-self-start align-self-lg-end">Preview</span>
+                            <button type="button" class="btn btn-sm btn-outline-primary" data-bs-toggle="modal" data-bs-target="#inboundMcpInfoModal">
+                                <i class="bi bi-info-circle me-1"></i>About MCP &amp; Tools
+                            </button>
+                        </div>
+                    </div>
+
+                    <div class="alert alert-info small" role="alert">
+                        Enable only after the Microsoft Entra delegated scope, delegated user app role, client app allowlist, source allowlist, and SimpleChat governance item policies are configured. Personal MCP tools require delegated user context plus an assigned user role. The app-only role is reserved for future non-personal service/admin tools.
+                    </div>
+
+                    <div class="row g-3">
+                        <div class="col-xl-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <h6 class="mb-3">Runtime Gate</h6>
+                                <div class="form-check form-switch mb-3">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="enable_inbound_mcp_server" name="enable_inbound_mcp_server" {% if settings.enable_inbound_mcp_server %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="enable_inbound_mcp_server">Enable inbound MCP server</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Controls whether authenticated requests to the SimpleChat inbound MCP endpoint are accepted."></i>
+                                </div>
+                                <div class="mb-3">
+                                    <label class="form-label" for="inbound_mcp_required_scope">Required delegated scope</label>
+                                    <input class="form-control" type="text" id="inbound_mcp_required_scope" name="inbound_mcp_required_scope" value="{{ settings.inbound_mcp_required_scope }}" autocomplete="off">
+                                    <div class="form-text">Default: <code>DelegatedMcpServerAccess</code>. VS Code and other user clients must present this delegated scope.</div>
+                                </div>
+                                <div class="mb-3">
+                                    <label class="form-label" for="inbound_mcp_required_user_role">Required delegated user role</label>
+                                    <input class="form-control" type="text" id="inbound_mcp_required_user_role" name="inbound_mcp_required_user_role" value="{{ settings.inbound_mcp_required_user_role }}" autocomplete="off">
+                                    <div class="form-text">Default: <code>InboundMCPUserAccess</code>. Governance determines which users/groups can use tools after this Entra role and delegated scope pass.</div>
+                                </div>
+                                <div class="mb-0">
+                                    <label class="form-label" for="inbound_mcp_required_app_role">Required app-only role</label>
+                                    <input class="form-control" type="text" id="inbound_mcp_required_app_role" name="inbound_mcp_required_app_role" value="{{ settings.inbound_mcp_required_app_role }}" autocomplete="off">
+                                    <div class="form-text">Default: <code>InboundMCPAppAccess</code>. Reserved for future app-only MCP tools and still governed separately.</div>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="col-xl-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <h6 class="mb-3">Endpoint Contract</h6>
+                                <dl class="row small mb-0">
+                                    <dt class="col-sm-5">MCP endpoint</dt>
+                                    <dd class="col-sm-7"><code>{{ inbound_mcp_resource_path }}</code></dd>
+                                    <dt class="col-sm-5">Protected resource metadata</dt>
+                                    <dd class="col-sm-7"><code>{{ inbound_mcp_prm_path }}</code></dd>
+                                    <dt class="col-sm-5">Transport</dt>
+                                    <dd class="col-sm-7">Streamable HTTP JSON-RPC</dd>
+                                    <dt class="col-sm-5">Current tool surface</dt>
+                                    <dd class="col-sm-7">Personal delegated tools only.</dd>
+                                    <dt class="col-sm-5">Tool identity</dt>
+                                    <dd class="col-sm-7">Delegated user token required for personal data.</dd>
+                                </dl>
+                                <div class="alert alert-light border small mt-3 mb-0" role="alert">
+                                    Endpoint paths are fixed in application routing for this initial UI slice. Change the app setting below for the source header only.
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="col-12">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-2 mb-3">
+                                    <div>
+                                        <h6 class="mb-1">Request Size &amp; Throttling</h6>
+                                        <div class="small text-muted">Protect the inbound MCP endpoint from oversized payloads and noisy clients. Rate limits are enforced per caller and tool category across app instances.</div>
+                                    </div>
+                                    <div class="form-check form-switch">
+                                        <input class="form-check-input" type="checkbox" role="switch" id="enable_inbound_mcp_rate_limits" name="enable_inbound_mcp_rate_limits" {% if settings.enable_inbound_mcp_rate_limits %}checked{% endif %}>
+                                        <label class="form-check-label ms-2" for="enable_inbound_mcp_rate_limits">Enable tool throttles</label>
+                                    </div>
+                                </div>
+                                <div class="row g-3">
+                                    <div class="col-md-6 col-xl-3">
+                                        <label class="form-label" for="inbound_mcp_max_request_bytes">Max request bytes</label>
+                                        <input class="form-control" type="number" id="inbound_mcp_max_request_bytes" name="inbound_mcp_max_request_bytes" min="1024" max="1048576" step="1" value="{{ settings.inbound_mcp_max_request_bytes }}">
+                                        <div class="form-text">Default: <code>65536</code>. Range: 1 KB to 1 MB.</div>
+                                    </div>
+                                    <div class="col-md-6 col-xl-3">
+                                        <label class="form-label" for="inbound_mcp_rate_limit_window_seconds">Rate window seconds</label>
+                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_window_seconds" name="inbound_mcp_rate_limit_window_seconds" min="10" max="3600" step="1" value="{{ settings.inbound_mcp_rate_limit_window_seconds }}">
+                                        <div class="form-text">Default: <code>60</code>. Applies to each throttle category.</div>
+                                    </div>
+                                    <div class="col-md-4 col-xl-2">
+                                        <label class="form-label" for="inbound_mcp_rate_limit_read_per_window">Read limit</label>
+                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_read_per_window" name="inbound_mcp_rate_limit_read_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_read_per_window }}">
+                                        <div class="form-text">Default: <code>120</code>.</div>
+                                    </div>
+                                    <div class="col-md-4 col-xl-2">
+                                        <label class="form-label" for="inbound_mcp_rate_limit_search_per_window">Search limit</label>
+                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_search_per_window" name="inbound_mcp_rate_limit_search_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_search_per_window }}">
+                                        <div class="form-text">Default: <code>30</code>.</div>
+                                    </div>
+                                    <div class="col-md-4 col-xl-2">
+                                        <label class="form-label" for="inbound_mcp_rate_limit_write_per_window">Write limit</label>
+                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_write_per_window" name="inbound_mcp_rate_limit_write_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_write_per_window }}">
+                                        <div class="form-text">Default: <code>10</code>.</div>
+                                    </div>
+                                </div>
+                                <div class="alert alert-light border small mt-3 mb-0" role="alert">
+                                    Application Insights events include <code>mcp_request_id</code>, caller app, delegated user, source, tool, duration, result status, and rate-limit category without recording prompts, document content, bearer tokens, or secrets.
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="col-12">
+                            <input type="hidden" id="inbound_mcp_allowed_client_app_entries_json" name="inbound_mcp_allowed_client_app_entries_json" value='{{ settings.inbound_mcp_allowed_client_app_entries | default([], true) | tojson }}'>
+                            <input type="hidden" id="inbound_mcp_allowed_tenant_entries_json" name="inbound_mcp_allowed_tenant_entries_json" value='{{ settings.inbound_mcp_allowed_tenant_entries | default([], true) | tojson }}'>
+                            <input type="hidden" id="inbound_mcp_allowed_source_entries_json" name="inbound_mcp_allowed_source_entries_json" value='{{ settings.inbound_mcp_allowed_source_entries | default([], true) | tojson }}'>
+                        </div>
+
+                        <div class="col-12">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="d-flex justify-content-between align-items-start gap-2 mb-2">
+                                    <div>
+                                        <h6 class="mb-1">Allowed client app IDs</h6>
+                                        <div class="small text-muted">Required allowlist. Empty means no MCP clients can connect.</div>
+                                    </div>
+                                    <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="clients">Add</button>
+                                </div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle mb-2">
+                                        <thead>
+                                            <tr>
+                                                <th>Client app ID</th>
+                                                <th>Description</th>
+                                                <th class="text-end">Actions</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="inbound-mcp-client-app-entries-body"></tbody>
+                                    </table>
+                                </div>
+                                <div class="small text-muted" id="inbound-mcp-client-app-entries-summary"></div>
+                            </div>
+                        </div>
+
+                        <div class="col-12">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="inbound_mcp_allow_external_tenants" name="inbound_mcp_allow_external_tenants" {% if settings.inbound_mcp_allow_external_tenants %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="inbound_mcp_allow_external_tenants">Allow additional tenant IDs</label>
+                                </div>
+                                <div class="small text-muted mb-3">
+                                    Off allows only the configured SimpleChat tenant. Turning this on auto-includes the SimpleChat tenant and lets admins add more tenants.
+                                </div>
+                                <div id="inbound-mcp-tenant-list-container" class="{% if not settings.inbound_mcp_allow_external_tenants %}d-none{% endif %}">
+                                    <div class="d-flex justify-content-between align-items-center mb-2">
+                                        <h6 class="mb-0">Allowed tenant IDs</h6>
+                                        <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="tenants">Add</button>
+                                    </div>
+                                    <div class="table-responsive">
+                                        <table class="table table-sm align-middle mb-2">
+                                            <thead>
+                                                <tr>
+                                                    <th>Tenant ID</th>
+                                                    <th>Description</th>
+                                                    <th class="text-end">Actions</th>
+                                                </tr>
+                                            </thead>
+                                            <tbody id="inbound-mcp-tenant-entries-body"></tbody>
+                                        </table>
+                                    </div>
+                                    <div class="small text-muted" id="inbound-mcp-tenant-entries-summary"></div>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="col-12">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="inbound_mcp_allow_all_source_ids" name="inbound_mcp_allow_all_source_ids" {% if settings.inbound_mcp_allow_all_source_ids %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="inbound_mcp_allow_all_source_ids">Allow all source IDs</label>
+                                </div>
+                                <div class="small text-muted mb-3">
+                                    Default on accepts any source signal at the runtime allowlist layer. Turn off to require explicit source values here. In both modes, admins must still create an inbound MCP source governance policy before tools are returned.
+                                </div>
+                                <div class="mb-3">
+                                    <label class="form-label" for="inbound_mcp_source_header">Source header name</label>
+                                    <input class="form-control" type="text" id="inbound_mcp_source_header" name="inbound_mcp_source_header" value="{{ settings.inbound_mcp_source_header }}" autocomplete="off">
+                                    <div class="form-text">Default: <code>X-SimpleChat-MCP-Source</code>.</div>
+                                </div>
+                                <div class="alert alert-warning py-2 small" role="alert">
+                                    Source IDs are read from the configured header when present. This is a client-provided value and can be spoofed unless a trusted gateway, APIM policy, or similar control sets/enforces it.
+                                </div>
+                                <div id="inbound-mcp-all-source-governance-callout" class="alert alert-info py-2 small {% if not settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}" role="alert">
+                                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-2">
+                                        <div>
+                                            Create an <code>inbound_mcp_source</code> policy for <code>*</code> to choose which users or groups can use inbound MCP from any accepted source.
+                                        </div>
+                                        <button
+                                            type="button"
+                                            class="btn btn-sm btn-outline-primary governance-new-inbound-mcp-policy-btn"
+                                            data-governance-inbound-mcp-entity="inbound_mcp_source"
+                                            data-governance-inbound-mcp-item="*"
+                                            data-governance-inbound-mcp-policy-name="Inbound MCP all source access"
+                                            data-governance-inbound-mcp-resource-label="All accepted source IDs (*)"
+                                            data-governance-open-tab="true"
+                                        >
+                                            Create Wildcard Source Policy
+                                        </button>
+                                    </div>
+                                </div>
+                                <div id="inbound-mcp-controlled-source-governance-callout" class="alert alert-info py-2 small {% if settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}" role="alert">
+                                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-2">
+                                        <div>
+                                            After adding allowed source IDs, create an <code>inbound_mcp_source</code> policy for <code>*</code> or a specific source to choose which users or groups can use inbound MCP.
+                                        </div>
+                                        <button
+                                            type="button"
+                                            class="btn btn-sm btn-outline-primary governance-new-inbound-mcp-policy-btn"
+                                            data-governance-inbound-mcp-entity="inbound_mcp_source"
+                                            data-governance-inbound-mcp-policy-name="Inbound MCP source access"
+                                            data-governance-open-tab="true"
+                                        >
+                                            Create Source Policy
+                                        </button>
+                                    </div>
+                                </div>
+                                <div id="inbound-mcp-source-list-container" class="{% if settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}">
+                                    <div class="d-flex justify-content-between align-items-center mb-2">
+                                        <h6 class="mb-0">Allowed source IDs</h6>
+                                        <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="sources">Add</button>
+                                    </div>
+                                    <div class="table-responsive">
+                                        <table class="table table-sm align-middle mb-2">
+                                            <thead>
+                                                <tr>
+                                                    <th>Source value</th>
+                                                    <th>Description</th>
+                                                    <th class="text-end">Actions</th>
+                                                </tr>
+                                            </thead>
+                                            <tbody id="inbound-mcp-source-entries-body"></tbody>
+                                        </table>
+                                    </div>
+                                    <div class="small text-muted" id="inbound-mcp-source-entries-summary"></div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="modal fade" id="inboundMcpEntryModal" tabindex="-1" aria-labelledby="inboundMcpEntryModalLabel" aria-hidden="true" data-ignore-settings-change="true">
+                    <div class="modal-dialog">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="inboundMcpEntryModalLabel">Add MCP Entry</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <input type="hidden" id="inbound-mcp-entry-list-key">
+                                <input type="hidden" id="inbound-mcp-entry-edit-index">
+                                <div class="mb-3">
+                                    <label class="form-label" for="inbound-mcp-entry-value" id="inbound-mcp-entry-value-label">Value</label>
+                                    <input class="form-control" type="text" id="inbound-mcp-entry-value" autocomplete="off">
+                                    <div class="invalid-feedback" id="inbound-mcp-entry-value-error">Value is required.</div>
+                                </div>
+                                <div class="mb-0">
+                                    <label class="form-label" for="inbound-mcp-entry-description">Description</label>
+                                    <input class="form-control" type="text" id="inbound-mcp-entry-description" autocomplete="off" maxlength="256">
+                                    <div class="form-text">Use descriptions to explain who owns this app, tenant, or source value without making the value easy to guess.</div>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                                <button type="button" class="btn btn-primary" id="inbound-mcp-entry-save-btn">Save Entry</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="modal fade" id="inboundMcpInfoModal" tabindex="-1" aria-labelledby="inboundMcpInfoModalLabel" aria-hidden="true" data-ignore-settings-change="true">
+                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="inboundMcpInfoModalLabel">Inbound MCP overview</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="alert alert-info small" role="alert">
+                                    SimpleChat exposes a governed Streamable HTTP MCP endpoint for approved external MCP clients. Authentication handles tenant, client, delegated scope, and Entra role checks; governance decides which users/groups and source IDs can use tools.
+                                </div>
+                                <div class="row g-3 mb-3">
+                                    <div class="col-lg-6">
+                                        <h6>Runtime checks</h6>
+                                        <ul class="small mb-0">
+                                            <li>Client app ID must be in the allowed client list.</li>
+                                            <li>Tenant must be the SimpleChat tenant unless additional tenants are enabled.</li>
+                                            <li>Delegated personal tools require the configured scope and user role.</li>
+                                            <li>Governance uses <code>inbound_mcp_source</code> policies to decide which users or groups can use each accepted source.</li>
+                                        </ul>
+                                    </div>
+                                    <div class="col-lg-6">
+                                        <h6>Source header guidance</h6>
+                                        <p class="small mb-0">
+                                            The configured source header is an advisory control-plane signal. Treat it like an APIM subscription-key label, not strong identity. For stronger assurance, set or overwrite it at a trusted gateway and avoid relying on client-provided values alone.
+                                        </p>
+                                    </div>
+                                </div>
+                                <h6>Available MCP tools</h6>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th>Tool</th>
+                                                <th>Scope</th>
+                                                <th>Operation</th>
+                                                <th>Description</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody>
+                                            {% for tool in inbound_mcp_tools %}
+                                            <tr>
+                                                <td>
+                                                    <div class="fw-semibold">{{ tool.display_name }}</div>
+                                                    <code>{{ tool.id }}</code>
+                                                </td>
+                                                <td>{{ tool.scope }}</td>
+                                                <td>{{ tool.resource_family }} / {{ tool.operation }}</td>
+                                                <td>{{ tool.description }}</td>
+                                            </tr>
+                                            {% endfor %}
+                                        </tbody>
+                                    </table>
+                                </div>
+                                <hr />
+                                <h6>Application Insights starter queries</h6>
+                                <p class="small text-muted">
+                                    Use these KQL queries in Application Insights Logs to validate inbound MCP traffic, denials, and tool latency. They rely on safe structured dimensions emitted by the inbound MCP route and do not require prompt, message, document, token, or secret values.
+                                </p>
+                                <div class="accordion" id="inbound-mcp-observability-accordion">
+                                    <div class="accordion-item">
+                                        <h2 class="accordion-header" id="inbound-mcp-kql-request-trends-heading">
+                                            <button class="accordion-button" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-request-trends-collapse" aria-expanded="true" aria-controls="inbound-mcp-kql-request-trends-collapse">
+                                                Request and failure trends
+                                            </button>
+                                        </h2>
+                                        <div id="inbound-mcp-kql-request-trends-collapse" class="accordion-collapse collapse show" aria-labelledby="inbound-mcp-kql-request-trends-heading" data-bs-parent="#inbound-mcp-observability-accordion">
+                                            <div class="accordion-body">
+                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-request-trends">
+                                                    <i class="bi bi-clipboard me-1"></i>Copy query
+                                                </button>
+                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-request-trends">traces
+| where timestamp > ago(24h)
+| where message has "[InboundMCP]"
+| summarize requests=count(), failures=countif(tostring(customDimensions.result_status) !in ("", "success", "accepted")) by bin(timestamp, 1h)
+| order by timestamp desc</code></pre>
+                                            </div>
+                                        </div>
+                                    </div>
+                                    <div class="accordion-item">
+                                        <h2 class="accordion-header" id="inbound-mcp-kql-error-categories-heading">
+                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-error-categories-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-error-categories-collapse">
+                                                Error categories by caller and source
+                                            </button>
+                                        </h2>
+                                        <div id="inbound-mcp-kql-error-categories-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-error-categories-heading" data-bs-parent="#inbound-mcp-observability-accordion">
+                                            <div class="accordion-body">
+                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-error-categories">
+                                                    <i class="bi bi-clipboard me-1"></i>Copy query
+                                                </button>
+                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-error-categories">traces
+| where timestamp > ago(24h)
+| where message has "[InboundMCP]"
+| where isnotempty(tostring(customDimensions.error_type))
+| summarize events=count() by tostring(customDimensions.error_type), tostring(customDimensions.caller_app_id), tostring(customDimensions.source_id)
+| order by events desc</code></pre>
+                                            </div>
+                                        </div>
+                                    </div>
+                                    <div class="accordion-item">
+                                        <h2 class="accordion-header" id="inbound-mcp-kql-tool-latency-heading">
+                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-tool-latency-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-tool-latency-collapse">
+                                                Tool latency and result status
+                                            </button>
+                                        </h2>
+                                        <div id="inbound-mcp-kql-tool-latency-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-tool-latency-heading" data-bs-parent="#inbound-mcp-observability-accordion">
+                                            <div class="accordion-body">
+                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-tool-latency">
+                                                    <i class="bi bi-clipboard me-1"></i>Copy query
+                                                </button>
+                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-tool-latency">traces
+| where timestamp > ago(24h)
+| where message has "Inbound MCP tool call"
+| where isnotempty(tostring(customDimensions.tool_id))
+| summarize calls=count(), avg_duration_ms=avg(todouble(customDimensions.duration_ms)), p95_duration_ms=percentile(todouble(customDimensions.duration_ms), 95) by tostring(customDimensions.tool_id), tostring(customDimensions.result_status)
+| order by calls desc</code></pre>
+                                            </div>
+                                        </div>
+                                    </div>
+                                    <div class="accordion-item">
+                                        <h2 class="accordion-header" id="inbound-mcp-kql-rate-limits-heading">
+                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-rate-limits-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-rate-limits-collapse">
+                                                Rate-limit denials
+                                            </button>
+                                        </h2>
+                                        <div id="inbound-mcp-kql-rate-limits-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-rate-limits-heading" data-bs-parent="#inbound-mcp-observability-accordion">
+                                            <div class="accordion-body">
+                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-rate-limits">
+                                                    <i class="bi bi-clipboard me-1"></i>Copy query
+                                                </button>
+                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-rate-limits">traces
+| where timestamp > ago(24h)
+| where message has "Inbound MCP tool call denied by rate limit"
+| summarize denials=count() by tostring(customDimensions.rate_limit_category), tostring(customDimensions.tool_id), tostring(customDimensions.caller_app_id)
+| order by denials desc</code></pre>
+                                            </div>
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="modal fade" id="inboundMcpEasyAuthModal" tabindex="-1" aria-labelledby="inboundMcpEasyAuthModalLabel" aria-hidden="true" data-ignore-settings-change="true">
+                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="inboundMcpEasyAuthModalLabel">Verify App Service Authentication exclusions</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="alert alert-warning">
+                                    <strong>Required before enabling inbound MCP:</strong>
+                                    If Azure App Service Authentication redirects unauthenticated requests, add excluded paths so MCP clients can discover protected resource metadata and so SimpleChat can enforce bearer-token MCP access itself.
+                                </div>
+                                <p>
+                                    Run the following PowerShell with Azure CLI from Azure Cloud Shell or any authenticated terminal. SimpleChat pre-fills the script from this App Service's environment when possible.
+                                </p>
+                                <div class="row g-2 small mb-3">
+                                    <div class="col-lg-6">
+                                        <div class="border rounded p-2 h-100">
+                                            <div class="fw-semibold">Derived deployment values</div>
+                                            <dl class="row mb-0">
+                                                <dt class="col-sm-5">Azure environment</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.azure_environment }}</code></dd>
+                                                <dt class="col-sm-5">Resource Manager</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.resource_manager_endpoint }}</code></dd>
+                                                <dt class="col-sm-5">Resource group</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.resource_group }}</code></dd>
+                                                <dt class="col-sm-5">App Service</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.app_name }}</code></dd>
+                                                <dt class="col-sm-5">Subscription</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.subscription_id or "Current Azure CLI account" }}</code></dd>
+                                                <dt class="col-sm-5">API client ID</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.simplechat_api_client_id }}</code></dd>
+                                                <dt class="col-sm-5">Delegated scope</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_delegated_scope }}</code></dd>
+                                                <dt class="col-sm-5">User role</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_user_roles | join(", ") }}</code></dd>
+                                                <dt class="col-sm-5">App-only role</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_app_roles | join(", ") }}</code></dd>
+                                            </dl>
+                                        </div>
+                                    </div>
+                                    <div class="col-lg-6">
+                                        <div class="border rounded p-2 h-100">
+                                            <div class="fw-semibold">Script behavior</div>
+                                            <ul class="mb-0">
+                                                <li>Sets the Azure CLI cloud before login.</li>
+                                                <li>Logs in with the configured SimpleChat tenant.</li>
+                                                <li>Attempts to verify that the SimpleChat API app exposes the required delegated scope and inbound MCP app roles.</li>
+                                                <li>Uses SimpleChat's Resource Manager endpoint for public, government, or custom clouds.</li>
+                                                <li>Creates a timestamped backup of current <code>authsettingsV2</code> before applying changes.</li>
+                                            </ul>
+                                        </div>
+                                    </div>
+                                </div>
+                                {% if inbound_mcp_easy_auth_script_context.missing_values %}
+                                <div class="alert alert-danger small">
+                                    SimpleChat could not derive every required value. Replace the placeholders in the script before running it:
+                                    <strong>{{ inbound_mcp_easy_auth_script_context.missing_values | join(", ") }}</strong>.
+                                </div>
+                                {% endif %}
+                                {% if inbound_mcp_easy_auth_script_context.scope_check_missing_values %}
+                                <div class="alert alert-warning small">
+                                    SimpleChat could not derive every value needed for the delegated-scope and role preflight. Replace these placeholders if you want the script to validate the app registration before changing Easy Auth:
+                                    <strong>{{ inbound_mcp_easy_auth_script_context.scope_check_missing_values | join(", ") }}</strong>.
+                                </div>
+                                {% endif %}
+                                {% if inbound_mcp_easy_auth_script_context.uses_custom_cloud_match %}
+                                <div class="alert alert-info small">
+                                    This deployment uses a custom Azure environment. The script searches your registered Azure CLI clouds for one with the same Resource Manager endpoint. If none is registered, register the custom cloud first and rerun the script.
+                                </div>
+                                {% endif %}
+                                <div class="position-relative mb-3">
+                                    <button type="button" class="btn btn-outline-secondary btn-sm position-absolute top-0 end-0 m-2" id="inbound-mcp-copy-script" aria-label="Copy PowerShell script">
+                                        <i class="bi bi-clipboard" aria-hidden="true"></i>
+                                    </button>
+                                    <pre class="bg-body-tertiary border rounded p-3 pe-5 small mb-0"><code id="inbound-mcp-easy-auth-script-code">{{ inbound_mcp_easy_auth_script }}</code></pre>
+                                </div>
+                                <div class="alert alert-info small">
+                                    The verification checks these public unauthenticated endpoints and expects SimpleChat JSON responses, not Microsoft sign-in HTML:
+                                    <ul class="mb-0">
+                                        <li><code>/.well-known/oauth-protected-resource</code></li>
+                                        <li><code>/.well-known/oauth-protected-resource/api/mcp</code></li>
+                                        <li><code>/.well-known/oauth-protected-resource/mcp</code></li>
+                                        <li><code>/.well-known/oauth-authorization-server</code></li>
+                                        <li><code>/api/mcp</code></li>
+                                        <li><code>/api/mcp/health</code></li>
+                                    </ul>
+                                </div>
+                                <div class="form-check mb-3">
+                                    <input class="form-check-input" type="checkbox" id="inbound-mcp-easy-auth-confirm">
+                                    <label class="form-check-label" for="inbound-mcp-easy-auth-confirm">
+                                        I have added the required App Service Authentication excluded paths for this SimpleChat App Service.
+                                    </label>
+                                </div>
+                                <div id="inbound-mcp-easy-auth-status" class="alert alert-info d-none" role="status"></div>
+                                <ul id="inbound-mcp-easy-auth-results" class="list-group small d-none"></ul>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Cancel</button>
+                                <button type="button" class="btn btn-primary" id="inbound-mcp-easy-auth-verify" disabled>
+                                    I accept, verify endpoints
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                {% endif %}
+            </div>
diff --git a/application/single_app/templates/admin/_panes/ai-models.html b/application/single_app/templates/admin/_panes/model-endpoints.html
similarity index 53%
rename from application/single_app/templates/admin/_panes/ai-models.html
rename to application/single_app/templates/admin/_panes/model-endpoints.html
index 98e6590d4..5c9683ad4 100644
--- a/application/single_app/templates/admin/_panes/ai-models.html
+++ b/application/single_app/templates/admin/_panes/model-endpoints.html
@@ -1,4 +1,4 @@
-            <div class="tab-pane fade{% if admin_landing_tab == 'ai-models' %} show active{% endif %}" id="ai-models" role="tabpanel" aria-labelledby="ai-models-tab">
+            <div class="tab-pane fade{% if admin_landing_tab == 'model-endpoints' %} show active{% endif %}" id="model-endpoints" role="tabpanel" aria-labelledby="model-endpoints-tab">
 
                 <p class="text-muted">
                     Configure all AI model settings including GPT for text generation, embeddings for semantic search, and image generation capabilities.
@@ -235,396 +235,6 @@ <h6 class="mb-0">Global Endpoints</h6>
                     {% endif %}
                 </div>
 
-                <!-- Embeddings Configuration Section -->
-                <div class="card p-3 mb-4" id="embeddings-configuration">
-                    <h5 class="card-title">
-                        <i class="bi bi-vector-pen me-2"></i>Embeddings Configuration
-                    </h5>
-                    <p class="text-muted small">
-                        Configure your embeddings settings. These are used for semantic search, knowledge-base lookups, etc.
-                    </p>
-                    <button type="button" class="btn btn-sm btn-outline-secondary mb-3 align-self-start" data-bs-toggle="modal" data-bs-target="#legacyModelDiscoveryIdentityGuideModal">
-                        <i class="bi bi-question-circle me-1"></i>Setup Guide
-                    </button>
-
-                <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                    <input type="checkbox" class="form-check-input me-2" id="enable_embedding_apim"
-                        name="enable_embedding_apim" {% if settings.enable_embedding_apim %}checked{% endif %}>
-                    <label class="form-check-label" for="enable_embedding_apim">Use APIM instead of direct to Azure
-                        OpenAI endpoint</label>
-                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route embedding model requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
-                </div>
-
-                <div id="non_apim_embedding_settings" {% if settings.enable_embedding_apim %}style="display: none;" {%
-                    endif %}>
-                    <div class="card p-3 mb-3">
-                        <div class="mb-3">
-                            <label for="azure_openai_embedding_endpoint" class="form-label">
-                                Azure OpenAI Embedding Endpoint
-                            </label>
-                            <input type="text" class="form-control" id="azure_openai_embedding_endpoint"
-                                name="azure_openai_embedding_endpoint"
-                                value="{{ settings.azure_openai_embedding_endpoint or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_openai_embedding_authentication_type" class="form-label">
-                                Authentication Type
-                            </label>
-                            <select class="form-select" id="azure_openai_embedding_authentication_type"
-                                name="azure_openai_embedding_authentication_type">
-                                <option value="key" {% if settings.azure_openai_embedding_authentication_type=='key'
-                                    %}selected{% endif %}>
-                                    Key
-                                </option>
-                                <option value="managed_identity" {% if
-                                    settings.azure_openai_embedding_authentication_type=='managed_identity' %}selected{% endif %}>
-                                    Managed Identity
-                                </option>
-                            </select>
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_openai_embedding_subscription_id" class="form-label">Subscription
-                                ID</label>
-                            <input type="text" class="form-control" id="azure_openai_embedding_subscription_id"
-                                name="azure_openai_embedding_subscription_id"
-                                value="{{ settings.azure_openai_embedding_subscription_id or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_openai_embedding_resource_group" class="form-label">Resource Group</label>
-                            <input type="text" class="form-control" id="azure_openai_embedding_resource_group"
-                                name="azure_openai_embedding_resource_group"
-                                value="{{ settings.azure_openai_embedding_resource_group or '' }}">
-                        </div>
-                        <div class="mb-3" id="embedding_key_container" {% if
-                            settings.azure_openai_embedding_authentication_type !='key' %}style="display: none;" {%
-                            endif %}>
-                            <label for="azure_openai_embedding_key" class="form-label">Azure OpenAI Embedding
-                                Key</label>
-                            <div class="input-group">
-                                <input type="password" class="form-control" id="azure_openai_embedding_key"
-                                    name="azure_openai_embedding_key"
-                                    value="{{ settings.azure_openai_embedding_key or '' }}">
-                                <button type="button" class="btn btn-outline-secondary"
-                                    id="toggle_embedding_key">Show</button>
-                            </div>
-                        </div>
-                        <div class="mb-3">
-                            <div id="embedding_models_list" class="mt-2 mb-3">
-
-                            </div>
-                            <small>Save pending changes to settings before clicking Fetch Embedding Models</small><br>
-
-                            <input type="hidden" name="embedding_model_json" id="embedding_model_json" />
-
-
-                            <input type="hidden" id="embedding_model" value="{{ settings.embedding_model.selected[0].deploymentName if settings.embedding_model.selected else '' }}" />
-
-
-                            <button type="button" class="btn btn-secondary" id="fetch_embedding_models_btn">
-                                Fetch Embedding Models
-                            </button>
-                        </div>
-                        <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
-                            data-bs-target="#advancedEmbeddingsFields" aria-expanded="false"
-                            aria-controls="advancedEmbeddingsFields">
-                            Show Advanced
-                        </a>
-                        <div class="collapse" id="advancedEmbeddingsFields">
-                            <div class="card card-body mt-2">
-                                <div class="mb-3">
-                                    <label for="azure_openai_embedding_api_version" class="form-label">
-                                        Azure OpenAI Embedding API Version
-                                    </label>
-                                    <input type="text" class="form-control" id="azure_openai_embedding_api_version"
-                                        name="azure_openai_embedding_api_version"
-                                        value="{{ settings.azure_openai_embedding_api_version or '' }}">
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div id="apim_embedding_settings" class="card p-3 mb-3" {% if not settings.enable_embedding_apim
-                    %}style="display: none;" {% endif %}>
-                    <div class="mb-3">
-                        <label for="azure_apim_embedding_endpoint" class="form-label">Azure APIM Endpoint</label>
-                        <input type="text" class="form-control" id="azure_apim_embedding_endpoint"
-                            name="azure_apim_embedding_endpoint"
-                            value="{{ settings.azure_apim_embedding_endpoint or '' }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="azure_apim_embedding_api_version" class="form-label">Azure APIM API Version</label>
-                        <input type="text" class="form-control" id="azure_apim_embedding_api_version"
-                            name="azure_apim_embedding_api_version"
-                            value="{{ settings.azure_apim_embedding_api_version or '' }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="azure_apim_embedding_deployment" class="form-label">Azure APIM Deployment</label>
-                        <input type="text" class="form-control" id="azure_apim_embedding_deployment"
-                            name="azure_apim_embedding_deployment"
-                            value="{{ settings.azure_apim_embedding_deployment or '' }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="azure_apim_embedding_subscription_key" class="form-label">Azure APIM Subscription
-                            Key</label>
-                        <div class="input-group">
-                            <input type="password" class="form-control" id="azure_apim_embedding_subscription_key"
-                                name="azure_apim_embedding_subscription_key"
-                                value="{{ settings.azure_apim_embedding_subscription_key or '' }}">
-                            <button type="button" class="btn btn-outline-secondary"
-                                id="toggle_azure_apim_embedding_subscription_key">Show</button>
-                        </div>
-                    </div>
-                </div>
-
-                <button type="button" class="btn btn-secondary mt-3" id="test_embedding_button">
-                    Test Embedding Connection
-                </button>
-                <div id="test_embedding_result" class="mt-2"></div>
-                </div>
-
-                <!-- Image Generation Configuration Section -->
-                <div class="card p-3 mb-4" id="image-generation-configuration">
-                    <h5 class="card-title">
-                        <i class="bi bi-image me-2"></i>Image Generation Configuration
-                    </h5>
-                    <p class="text-muted small">
-                        Configure image generation settings. Enable/disable, set endpoints, and choose a model.
-                    </p>
-                    <button type="button" class="btn btn-sm btn-outline-secondary mb-3 align-self-start" data-bs-toggle="modal" data-bs-target="#legacyModelDiscoveryIdentityGuideModal">
-                        <i class="bi bi-question-circle me-1"></i>Setup Guide
-                    </button>
-
-                <div class="form-group form-check form-switch mb-3">
-                    <input type="checkbox" class="form-check-input" id="enable_image_generation"
-                        name="enable_image_generation" {% if settings.enable_image_generation %}checked{% endif %}>
-                    <label class="form-check-label ms-2" for="enable_image_generation">
-                        Enable Image Generation
-                    </label>
-                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable AI-powered image generation capabilities using DALL-E models for creating images from text descriptions."></i>
-                </div>
-                <div id="image_gen_settings" {% if not settings.enable_image_generation %}style="display: none;" {%
-                    endif %}>
-
-                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                        <input type="checkbox" class="form-check-input me-2" id="enable_image_gen_apim"
-                            name="enable_image_gen_apim" {% if settings.enable_image_gen_apim %}checked{% endif %}>
-                        <label class="form-check-label" for="enable_image_gen_apim">Use APIM instead of direct to Azure
-                            OpenAI endpoint.</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route image generation requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
-                    </div>
-
-                    <div id="non_apim_image_gen_settings" {% if settings.enable_image_gen_apim %}style="display: none;"
-                        {% endif %}>
-                        <div class="card p-3 mb-3">
-                            <div class="mb-3">
-                                <label for="azure_openai_image_gen_endpoint" class="form-label">
-                                    Azure OpenAI Image Generation Endpoint
-                                </label>
-                                <input type="text" class="form-control" id="azure_openai_image_gen_endpoint"
-                                    name="azure_openai_image_gen_endpoint"
-                                    value="{{ settings.azure_openai_image_gen_endpoint or '' }}">
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_openai_image_gen_authentication_type" class="form-label">
-                                    Authentication Type
-                                </label>
-                                <select class="form-select" id="azure_openai_image_gen_authentication_type"
-                                    name="azure_openai_image_gen_authentication_type">
-                                    <option value="key" {% if settings.azure_openai_image_gen_authentication_type=='key'
-                                        %}selected{% endif %}>
-                                        Key
-                                    </option>
-                                    <option value="managed_identity" {% if
-                                        settings.azure_openai_image_gen_authentication_type=='managed_identity'
-                                        %}selected{% endif %}>
-                                        Managed Identity
-                                    </option>
-                                </select>
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_openai_image_gen_subscription_id" class="form-label">Subscription
-                                    ID</label>
-                                <input type="text" class="form-control" id="azure_openai_image_gen_subscription_id"
-                                    name="azure_openai_image_gen_subscription_id"
-                                    value="{{ settings.azure_openai_image_gen_subscription_id or '' }}">
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_openai_image_gen_resource_group" class="form-label">Resource
-                                    Group</label>
-                                <input type="text" class="form-control" id="azure_openai_image_gen_resource_group"
-                                    name="azure_openai_image_gen_resource_group"
-                                    value="{{ settings.azure_openai_image_gen_resource_group or '' }}">
-                            </div>
-                            <div class="mb-3" id="image_gen_key_container" {% if
-                                settings.azure_openai_image_gen_authentication_type !='key' %}style="display: none;" {%
-                                endif %}>
-                                <label for="azure_openai_image_gen_key" class="form-label">Azure OpenAI Image Generation
-                                    Key</label>
-                                <div class="input-group">
-                                    <input type="password" class="form-control" id="azure_openai_image_gen_key"
-                                        name="azure_openai_image_gen_key"
-                                        value="{{ settings.azure_openai_image_gen_key or '' }}">
-                                    <button type="button" class="btn btn-outline-secondary"
-                                        id="toggle_image_gen_key">Show</button>
-                                </div>
-                            </div>
-                            <div class="mb-3">
-                                <div id="image_models_list" class="mt-2 mb-3">
-
-                                </div>
-
-                                <small>Save pending changes to settings before clicking Fetch Image Generation Models</small><br>
-
-                                <input type="hidden" name="image_gen_model_json" id="image_gen_model_json" />
-
-
-                                <input type="hidden" id="image_gen_model" value="{{ settings.image_gen_model.selected[0].deploymentName if settings.image_gen_model.selected else '' }}" />
-
-
-                                <button type="button" class="btn btn-secondary" id="fetch_image_models_btn">
-                                    Fetch Image Generation Models
-                                </button>
-                            </div>
-                            <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
-                                data-bs-target="#advancedImageGenFields" aria-expanded="false"
-                                aria-controls="advancedImageGenFields">
-                                Show Advanced
-                            </a>
-                            <div class="collapse" id="advancedImageGenFields">
-                                <div class="card card-body mt-2">
-                                    <div class="mb-3">
-                                        <label for="azure_openai_image_gen_api_version" class="form-label">
-                                            Azure OpenAI Image Gen API Version
-                                        </label>
-                                        <input type="text" class="form-control" id="azure_openai_image_gen_api_version"
-                                            name="azure_openai_image_gen_api_version"
-                                            value="{{ settings.azure_openai_image_gen_api_version or '' }}">
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div id="apim_image_gen_settings" class="card p-3 mb-3" {% if not settings.enable_image_gen_apim
-                        %}style="display: none;" {% endif %}>
-                        <div class="mb-3">
-                            <label for="azure_apim_image_gen_endpoint" class="form-label">Azure APIM Endpoint</label>
-                            <input type="text" class="form-control" id="azure_apim_image_gen_endpoint"
-                                name="azure_apim_image_gen_endpoint"
-                                value="{{ settings.azure_apim_image_gen_endpoint or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_apim_image_gen_api_version" class="form-label">Azure APIM API
-                                Version</label>
-                            <input type="text" class="form-control" id="azure_apim_image_gen_api_version"
-                                name="azure_apim_image_gen_api_version"
-                                value="{{ settings.azure_apim_image_gen_api_version or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_apim_image_gen_deployment" class="form-label">Azure APIM
-                                Deployment</label>
-                            <input type="text" class="form-control" id="azure_apim_image_gen_deployment"
-                                name="azure_apim_image_gen_deployment"
-                                value="{{ settings.azure_apim_image_gen_deployment or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_apim_image_gen_subscription_key" class="form-label">Azure APIM
-                                Subscription Key</label>
-                            <div class="input-group">
-                                <input type="password" class="form-control" id="azure_apim_image_gen_subscription_key"
-                                    name="azure_apim_image_gen_subscription_key"
-                                    value="{{ settings.azure_apim_image_gen_subscription_key or '' }}">
-                                <button type="button" class="btn btn-outline-secondary"
-                                    id="toggle_azure_apim_image_gen_subscription_key">Show</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <button type="button" class="btn btn-secondary mt-3" id="test_image_button">
-                    Test Image Connection
-                </button>
-                <div id="test_image_result" class="mt-2"></div>
-                </div>
-
-                <div class="modal fade" id="legacyModelDiscoveryIdentityGuideModal" tabindex="-1" aria-labelledby="legacyModelDiscoveryIdentityGuideModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="legacyModelDiscoveryIdentityGuideModalLabel">Azure OpenAI Model Setup Guide</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-info" role="alert">
-                                    <strong>Fetch Models</strong> lists deployments through the Azure management plane. <strong>Test Connection</strong>, chat generation, file uploads, embedding generation, and image generation call the Azure OpenAI data plane. These paths can use different credentials and require different roles.
-                                </div>
-
-                                <h6>Credential purpose</h6>
-                                <div class="table-responsive mb-3">
-                                    <table class="table table-sm table-bordered align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th>Action</th>
-                                                <th>Plane</th>
-                                                <th>Credential used</th>
-                                                <th>Role or secret</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody>
-                                            <tr>
-                                                <td>Legacy GPT, embedding, or image <strong>Fetch Models</strong></td>
-                                                <td>Management plane</td>
-                                                <td>The SimpleChat app registration or service principal, such as the <code>-ar</code> Entra application created for the deployment.</td>
-                                                <td><code>Cognitive Services User</code> on the Azure OpenAI resource, or an equivalent role that can read deployments.</td>
-                                            </tr>
-                                            <tr>
-                                                <td>Global endpoint modal <strong>Fetch Models</strong></td>
-                                                <td>Management plane</td>
-                                                <td>The endpoint modal identity selected for discovery, such as managed identity or service principal.</td>
-                                                <td><code>Cognitive Services User</code> on the Azure OpenAI resource, or an equivalent role that can read deployments.</td>
-                                            </tr>
-                                            <tr>
-                                                <td>GPT, embedding, or image generation with Key authentication selected</td>
-                                                <td>Data plane</td>
-                                                <td>The Azure OpenAI key saved in this settings section.</td>
-                                                <td>Azure OpenAI resource key from <strong>Keys and Endpoint</strong>.</td>
-                                            </tr>
-                                            <tr>
-                                                <td>GPT, embedding, or image generation with Managed Identity selected</td>
-                                                <td>Data plane</td>
-                                                <td>The App Service managed identity, such as the <code>-app</code> managed identity.</td>
-                                                <td><code>Cognitive Services OpenAI User</code> on the Azure OpenAI resource.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-
-                                <h6>Where to get values</h6>
-                                <ol class="mb-3">
-                                    <li>Open the Azure OpenAI resource in the Azure portal.</li>
-                                    <li>Copy the endpoint from <strong>Resource Management</strong> &gt; <strong>Keys and Endpoint</strong>.</li>
-                                    <li>If using Key authentication for runtime calls, copy <strong>Key 1</strong> or <strong>Key 2</strong> from the same page.</li>
-                                    <li>Copy the subscription ID and resource group from the resource <strong>Overview</strong> page. These are required for <strong>Fetch Models</strong>.</li>
-                                    <li>If using APIM, use the APIM endpoint, deployment path or name, API version, and APIM subscription key instead of the direct Azure OpenAI key.</li>
-                                </ol>
-
-                                <h6>Recommended setup</h6>
-                                <ul class="mb-0">
-                                    <li>For key-backed legacy GPT, embeddings, or image generation, grant the SimpleChat service principal the management-plane role so admins can fetch model deployments, then store the Azure OpenAI key for data-plane generation.</li>
-                                    <li>For managed identity runtime, grant the App Service managed identity <code>Cognitive Services OpenAI User</code> for data-plane generation. If the same managed identity should also fetch deployments, grant it the management-plane discovery role too.</li>
-                                    <li>Fetch only discovers deployment names and model metadata. It does not prove that embedding or image generation inference will succeed; use <strong>Test Embedding Connection</strong> or <strong>Test Image Connection</strong> after selecting a deployment.</li>
-                                </ul>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                {% include '_multiendpoint_modal.html' %}
-
                 <!-- Legacy AI Models Modal -->
                 <div class="modal fade" id="legacyModelSettingsModal" tabindex="-1" aria-labelledby="legacyModelSettingsModalLabel" aria-hidden="true">
                     <div class="modal-dialog modal-xl modal-dialog-scrollable">
@@ -786,4 +396,6 @@ <h5 class="card-title">
                         </div>
                     </div>
                 </div>
+
+                {% include '_multiendpoint_modal.html' %}
             </div>
diff --git a/application/single_app/templates/admin/_panes/retention.html b/application/single_app/templates/admin/_panes/retention.html
index a2bc06781..1e90230a4 100644
--- a/application/single_app/templates/admin/_panes/retention.html
+++ b/application/single_app/templates/admin/_panes/retention.html
@@ -265,6 +265,4 @@ <h6 class="mb-3"><i class="bi bi-sliders me-2"></i>Default Retention Policies</h
                         <strong>Important:</strong> Deleted items respect your archiving settings. If conversation archiving is enabled, items will be archived before deletion. Activity logs are created for all deletions.
                     </div>
                 </div>
-
-                <!-- Workspace Scope Lock Section -->
             </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html
index 0d1d9e4b1..a34e450cf 100644
--- a/application/single_app/templates/admin_settings.html
+++ b/application/single_app/templates/admin_settings.html
@@ -953,6 +953,9 @@ <h4>12. Enhanced Citations and Image Generation</h4>
             {% set group_is_first = loop.first %}
             {% for admin_tab in admin_group.tabs %}
             {% set is_default_tab = group_is_first and loop.first %}
+            {% if not admin_tab.condition
+                  or (admin_tab.condition == 'enable_agent_template_gallery' and app_settings.enable_agent_template_gallery)
+                  or (admin_tab.condition == 'mcp_ui_enabled' and mcp_ui_enabled) %}
             <li class="nav-item admin-tab-item"
                 role="presentation"
                 data-admin-group="{{ admin_group.id }}"
@@ -971,6 +974,7 @@ <h4>12. Enhanced Citations and Image Generation</h4>
                     {% endif %}
                 </button>
             </li>
+            {% endif %}
             {% endfor %}
             {% endfor %}
         </ul>
@@ -987,6 +991,8 @@ <h4>12. Enhanced Citations and Image Generation</h4>
 
 
             {% include "admin/_panes/agents.html" %}
+            {% include "admin/_panes/actions.html" %}
+            {% include "admin/_panes/inbound-mcp.html" %}
 
 
             <!-- Governance Tab Content -->
@@ -1003,7 +1009,9 @@ <h4>12. Enhanced Citations and Image Generation</h4>
             {% include "admin/_panes/custom-pages.html" %}
 
 
-            {% include "admin/_panes/ai-models.html" %}
+            {% include "admin/_panes/model-endpoints.html" %}
+            {% include "admin/_panes/embeddings.html" %}
+            {% include "admin/_panes/image-generation.html" %}
 
             <!-- Control Center Configuration Tab -->
             {% include "admin/_panes/control-center-config.html" %}
@@ -1088,6 +1096,83 @@ <h5 class="modal-title" id="fileProcessingLogCleanupModalLabel">Confirm permanen
         <i class="bi bi-floppy"></i> Save Settings
     </button>
 
+<!-- Shared by Model Endpoints, Embeddings and Image Generation, so it lives
+     outside the panes rather than inside any one of them. -->
+<div class="modal fade" id="legacyModelDiscoveryIdentityGuideModal" tabindex="-1" aria-labelledby="legacyModelDiscoveryIdentityGuideModalLabel" aria-hidden="true">
+    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title" id="legacyModelDiscoveryIdentityGuideModalLabel">Azure OpenAI Model Setup Guide</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <div class="alert alert-info" role="alert">
+                    <strong>Fetch Models</strong> lists deployments through the Azure management plane. <strong>Test Connection</strong>, chat generation, file uploads, embedding generation, and image generation call the Azure OpenAI data plane. These paths can use different credentials and require different roles.
+                </div>
+
+                <h6>Credential purpose</h6>
+                <div class="table-responsive mb-3">
+                    <table class="table table-sm table-bordered align-middle">
+                        <thead>
+                            <tr>
+                                <th>Action</th>
+                                <th>Plane</th>
+                                <th>Credential used</th>
+                                <th>Role or secret</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            <tr>
+                                <td>Legacy GPT, embedding, or image <strong>Fetch Models</strong></td>
+                                <td>Management plane</td>
+                                <td>The SimpleChat app registration or service principal, such as the <code>-ar</code> Entra application created for the deployment.</td>
+                                <td><code>Cognitive Services User</code> on the Azure OpenAI resource, or an equivalent role that can read deployments.</td>
+                            </tr>
+                            <tr>
+                                <td>Global endpoint modal <strong>Fetch Models</strong></td>
+                                <td>Management plane</td>
+                                <td>The endpoint modal identity selected for discovery, such as managed identity or service principal.</td>
+                                <td><code>Cognitive Services User</code> on the Azure OpenAI resource, or an equivalent role that can read deployments.</td>
+                            </tr>
+                            <tr>
+                                <td>GPT, embedding, or image generation with Key authentication selected</td>
+                                <td>Data plane</td>
+                                <td>The Azure OpenAI key saved in this settings section.</td>
+                                <td>Azure OpenAI resource key from <strong>Keys and Endpoint</strong>.</td>
+                            </tr>
+                            <tr>
+                                <td>GPT, embedding, or image generation with Managed Identity selected</td>
+                                <td>Data plane</td>
+                                <td>The App Service managed identity, such as the <code>-app</code> managed identity.</td>
+                                <td><code>Cognitive Services OpenAI User</code> on the Azure OpenAI resource.</td>
+                            </tr>
+                        </tbody>
+                    </table>
+                </div>
+
+                <h6>Where to get values</h6>
+                <ol class="mb-3">
+                    <li>Open the Azure OpenAI resource in the Azure portal.</li>
+                    <li>Copy the endpoint from <strong>Resource Management</strong> &gt; <strong>Keys and Endpoint</strong>.</li>
+                    <li>If using Key authentication for runtime calls, copy <strong>Key 1</strong> or <strong>Key 2</strong> from the same page.</li>
+                    <li>Copy the subscription ID and resource group from the resource <strong>Overview</strong> page. These are required for <strong>Fetch Models</strong>.</li>
+                    <li>If using APIM, use the APIM endpoint, deployment path or name, API version, and APIM subscription key instead of the direct Azure OpenAI key.</li>
+                </ol>
+
+                <h6>Recommended setup</h6>
+                <ul class="mb-0">
+                    <li>For key-backed legacy GPT, embeddings, or image generation, grant the SimpleChat service principal the management-plane role so admins can fetch model deployments, then store the Azure OpenAI key for data-plane generation.</li>
+                    <li>For managed identity runtime, grant the App Service managed identity <code>Cognitive Services OpenAI User</code> for data-plane generation. If the same managed identity should also fetch deployments, grant it the management-plane discovery role too.</li>
+                    <li>Fetch only discovers deployment names and model metadata. It does not prove that embedding or image generation inference will succeed; use <strong>Test Embedding Connection</strong> or <strong>Test Image Connection</strong> after selecting a deployment.</li>
+                </ul>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+            </div>
+        </div>
+    </div>
+</div>
+
     <div class="modal fade" id="customPagesRestartModal" tabindex="-1" aria-labelledby="customPagesRestartModalLabel" aria-hidden="true" data-bs-backdrop="static" data-bs-keyboard="false">
         <div class="modal-dialog">
             <div class="modal-content">
diff --git a/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md b/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
index 8fd27d02d..1426a3870 100644
--- a/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
+++ b/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
@@ -22,8 +22,8 @@ Development ─── feature/admin-settings-ia ──┬── #1297 stage 1
                                                       └──► final PR ──► Development
 ```
 
-Current version: **0.260.014**. Fingerprint: **462 field names / 110 card ids**.
-Navigation: **14 groups / 36 tabs / 88 sections**.
+Current version: **0.260.015**. Fingerprint: **462 field names / 110 card ids**.
+Navigation: **14 groups / 40 tabs / 88 sections**.
 
 ### Shipped
 
@@ -116,6 +116,12 @@ moved from Scale to Security that way.
 | Knowledge | **Search & Extract dismantled.** → Web & Research, Search Index, Document Extraction (+ metadata extraction and multi-modal vision from Workspaces), Audio & Video |
 | Workspaces | → Workspace Types, Files & Sharing (+ shared conversation file approvals from AI Models), Global Identities |
 | Workflow | **New group**, split out of Workspaces |
+| AI Models | → Model Endpoints (carries the legacy modal and its nested Chat Model card), Embeddings, Image Generation |
+| Agents & Actions | → Agents, Actions, Inbound MCP (whole tab behind `mcp_ui_enabled`) |
+
+**Only Backup & Recovery is left**, and it is the hardest: complication I4, a
+~985-line migration workflow that must split across Backup / Migrate / Restore
+/ Jobs as one unit.
 
 ### Card container ids are not the nav section ids
 
@@ -137,9 +143,34 @@ Run `list_pane_cards.py` for the real container id rather than assuming.
 ### Trap: gpt-configuration is inside a modal
 
 `gpt-configuration` is **not** a top-level card. It lives inside
-`legacyModelSettingsModal` in the AI Models pane. Splitting AI Models means
-moving a modal, not a card, which is why AI Models and Agents are deliberately
-left for their own change rather than bundled with Knowledge and Workspaces.
+`legacyModelSettingsModal` in the AI Models pane.
+
+**How this was resolved.** The modal was relocated to sit directly after
+`multi-endpoint-configuration`, the card holding its trigger. The split then
+assigned `multi-endpoint-configuration, gpt-configuration` to the same tab, so
+the modal's opening lines, the nested card and the closing lines all landed in
+`model-endpoints.html` in order and the modal reassembled intact.
+
+### Three more splitting rules learned
+
+- **A modal shared by cards that end up in different tabs must go to the
+  shell.** `legacyModelDiscoveryIdentityGuideModal` is opened from endpoints,
+  embeddings and image generation. Check for form fields first: a modal with a
+  `name=` attribute cannot move outside the `<form>` without changing the save
+  payload. That one had none.
+- **The split tool cannot write a target with the same name as its source.**
+  Rename the source (`agents.html` → `agents-src.html`) and split that.
+- **A Jinja conditional wrapping a card and its modals must be lifted out
+  whole.** The inbound MCP block is `{% if mcp_ui_enabled %}` … `{% endif %}`
+  spanning the card and three modals; it was extracted as one unit into its own
+  pane rather than split.
+
+### Tab-level conditions
+
+The nav map now supports `condition` on a **tab**, not just a section, so a tab
+whose entire pane is behind a feature flag disappears rather than rendering
+empty. Both renderers honour it. Verified: 40 tabs with `mcp_ui_enabled`, 39
+without.
 
 
 ### Two hardcoded-id traps found and closed
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index 5d5f6154b..c89efb87f 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,31 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](/explanation/features/) and [Fixes by Version](/explanation/fixes/).
 
+### **(v0.260.015)**
+
+#### User Interface Enhancements
+
+*   **AI Models Split By Model Purpose**
+    *   AI Models presented every model setting on one tab. It is now **Model Endpoints** (endpoint and fallback configuration, plus the Chat Model dialog opened from it), **Embeddings** and **Image Generation**.
+    *   (Ref: `model-endpoints`, `embeddings`, `image-generation`)
+
+*   **Agents And Actions Are Now Separate Tabs**
+    *   A single "Agents and Actions" tab carried agent configuration, template approvals, document action capabilities, action configuration and the whole inbound MCP surface.
+    *   It is now **Agents**, **Actions** and **Inbound MCP**.
+    *   Inbound MCP is a large area with its own dialogs and diagnostics, and the whole tab is hidden when the inbound MCP interface is turned off rather than showing an empty tab.
+    *   (Ref: `agents`, `actions`, `inbound-mcp`)
+
+#### Bug Fixes
+
+*   **Model Setup Guide Available From Every Model Tab**
+    *   The Azure OpenAI Model Setup Guide dialog is opened from the endpoints, embeddings and image generation cards. Once those moved to separate tabs it could only have opened from one of them.
+    *   The dialog now sits outside the tabs, so it opens from all three.
+    *   (Ref: `legacyModelDiscoveryIdentityGuideModal`)
+
+*   **Dangling Section Comments Removed**
+    *   Seven tabs ended with a comment labelling a card that had since moved to another tab.
+    *   (Ref: admin settings tab panes)
+
 ### **(v0.260.014)**
 
 #### User Interface Enhancements
diff --git a/functional_tests/test_admin_document_action_capabilities_location.py b/functional_tests/test_admin_document_action_capabilities_location.py
index f7f586f2e..c055e2e1b 100644
--- a/functional_tests/test_admin_document_action_capabilities_location.py
+++ b/functional_tests/test_admin_document_action_capabilities_location.py
@@ -42,20 +42,22 @@ def test_admin_document_action_capabilities_card_location() -> None:
     )
 
     card_index = template_content.find('id="document-action-capabilities-card"')
-    agents_tab_index = template_content.find('id="agents" role="tabpanel"')
-    agents_config_index = template_content.find('id="agents-configuration"')
+    actions_tab_index = template_content.find('id="actions" role="tabpanel"')
+    actions_config_index = template_content.find('id="actions-configuration"')
 
     assert card_index != -1, "Expected the admin settings template to render the document action capabilities card."
-    assert agents_tab_index != -1, "Expected the admin settings template to render the Agents and Actions tab pane."
-    assert agents_config_index != -1, "Expected the admin settings template to render the agents configuration card."
-    assert agents_tab_index < card_index < agents_config_index, (
-        "Expected the document action capabilities card to appear at the top of the Agents and Actions tab before the existing configuration cards."
+    assert actions_tab_index != -1, "Expected the admin settings template to render the Actions tab pane."
+    assert actions_config_index != -1, "Expected the admin settings template to render the actions configuration card."
+    # The card now leads the Actions tab. Agents configuration moved to its own
+    # tab, so ordering is asserted against the tab this card actually lives in.
+    assert actions_tab_index < card_index < actions_config_index, (
+        "Expected the document action capabilities card to appear at the top of the Actions tab before the actions configuration card."
     )
     assert 'Action</strong> dropdown in Chat and Workflow' in template_content, (
         "Expected the card copy to explain that these settings control the Action dropdown in Chat and Workflow."
     )
     assert 'global agent and custom action cards below' in template_content, (
-        "Expected the card copy to explain that the capability settings remain separate from the cards below in the Agents and Actions tab."
+        "Expected the card copy to explain that the capability settings remain separate from the cards below in the Actions tab."
     )
 
     print("✅ Admin document action capabilities card placement verified")
diff --git a/functional_tests/test_ai_models_tab_embedding_image_location.py b/functional_tests/test_ai_models_tab_embedding_image_location.py
index c1878cce6..e111b1c3d 100644
--- a/functional_tests/test_ai_models_tab_embedding_image_location.py
+++ b/functional_tests/test_ai_models_tab_embedding_image_location.py
@@ -2,14 +2,15 @@
 #!/usr/bin/env python3
 """
 Functional test for AI Models tab placement of embeddings and image generation sections.
-Version: 0.236.014
+Version: 0.260.015
 Implemented in: 0.236.014
 
-This test ensures embeddings and image generation settings remain on the AI Models tab
-and are not nested inside the legacy model modal.
+This test ensures embeddings and image generation settings stay in the AI Models
+group and are not nested inside the legacy model modal.
 """
 
 import os
+import re
 from test_support.templates import compose_if_admin_settings
 
 
@@ -18,6 +19,19 @@ def read_file_text(file_path):
         return compose_if_admin_settings(file_path, file.read())
 
 
+def _modal_span(content, modal_marker):
+    """Return the (start, end) character span of a modal by balancing its divs."""
+    start = content.index(modal_marker)
+    # Back up to the opening tag of the element carrying the id.
+    start = content.rindex("<div", 0, start)
+    depth = 0
+    for match in re.finditer(r"<div\b|</div>", content[start:]):
+        depth += 1 if match.group(0) == "<div" else -1
+        if depth == 0:
+            return start, start + match.end()
+    raise AssertionError(f"Unbalanced markup for {modal_marker}")
+
+
 def test_ai_models_tab_embedding_image_location():
     """Verify embeddings and image generation sections are outside legacy modal markup."""
     repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
@@ -33,14 +47,17 @@ def test_ai_models_tab_embedding_image_location():
     assert image_marker in content, "Image generation configuration section is missing."
     assert legacy_modal_marker in content, "Legacy model modal is missing."
 
-    embeddings_index = content.index(embeddings_marker)
-    image_index = content.index(image_marker)
-    legacy_modal_index = content.index(legacy_modal_marker)
-
-    assert embeddings_index < legacy_modal_index, "Embeddings section should be outside legacy modal."
-    assert image_index < legacy_modal_index, "Image generation section should be outside legacy modal."
+    # These cards now live in their own tab panes, so plain document order no
+    # longer says anything useful. What matters is that neither card sits
+    # *inside* the legacy modal, where it would only be reachable through it.
+    modal_start, modal_end = _modal_span(content, legacy_modal_marker)
+    for name, marker in (("Embeddings", embeddings_marker), ("Image generation", image_marker)):
+        index = content.index(marker)
+        assert not (modal_start < index < modal_end), (
+            f"{name} section should be outside the legacy model modal."
+        )
 
-    print("✅ Embeddings and image generation sections are on the AI Models tab.")
+    print("Embeddings and image generation sections are outside the legacy model modal.")
 
 
 if __name__ == "__main__":