diff --git a/application/single_app/templates/admin/_panes/agents.html b/application/single_app/templates/admin/_panes/agents.html
new file mode 100644
index 00000000..5994976d
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/agents.html
@@ -0,0 +1,1021 @@
+
+
+
+ Configure AI agents and actions for enhanced functionality. Agents provide AI-driven task automation while Actions extend functionality with custom tools and integrations.
+
+
+
+
+ Agent model lifecycle review lives in AI Models.
+
+
+ Use AI Models to review inherited agents, selectively override explicit agent model choices, and move agents to newer default models as costs or model releases change.
+
+
+
+
+
+
+ Note: All changes to global agents and actions require a restart of the web app to take effect.
+
+
+ {% set analyze_capability = settings.document_action_capabilities.analyze %}
+ {% set comparison_capability = settings.document_action_capabilities.comparison %}
+
+
+
+
Document Action Capabilities
+
Configure the document actions shown in the Action dropdown in Chat and Workflow. These controls live in the Agents and Actions tab, but remain separate from the global agent and custom action cards below.
+
+ Chat: 2-300 | Workflow: 2-1000
+
+
+ Use these settings to explicitly allow Analyze and Document Comparison in the Chat and Workflow Action dropdowns without bundling them into the global agent or custom action configuration cards below.
+
+ Configure custom actions and tools to extend functionality with integrations and specialized capabilities.
+
+
+ {% if not settings.enable_semantic_kernel %}
+
+ Actions are not available while agents are disabled. Enable agents above to configure actions.
+
+ {% else %}
+
+
+
Global Actions
+
+
+
Disable a global action to keep the configuration without exposing it to runtime action loading until it is re-enabled.
+ {% if settings.per_user_semantic_kernel %}
+
+
+
Workspace Action Feature Toggles
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {% endif %}
+
+
+
+
Core Action Toggles
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Tabular Processing Action
+
+
+ Automatically enabled when Enhanced Citations is enabled
+
+
+
+
+
+
Display Name
+
Description
+
Actions
+
+
+
+
+
+ {% endif %}
+
+ {% if mcp_ui_enabled %}
+
+
+
+
+ Inbound MCP Server
+
+
+ Configure the governed SimpleChat MCP endpoint used by external MCP clients. Personal tools use delegated user tokens by default; tool access remains deny-by-default until authentication, source, client, and governance policy all allow the request.
+
+
+
+ Preview
+
+
+
+
+
+ Enable only after the Microsoft Entra delegated scope, delegated user app role, client app allowlist, source allowlist, and SimpleChat governance item policies are configured. Personal MCP tools require delegated user context plus an assigned user role. The app-only role is reserved for future non-personal service/admin tools.
+
+
+
+
+
+
Runtime Gate
+
+
+
+
+
+
+
+
+
Default: DelegatedMcpServerAccess. VS Code and other user clients must present this delegated scope.
+
+
+
+
+
Default: InboundMCPUserAccess. Governance determines which users/groups can use tools after this Entra role and delegated scope pass.
+
+
+
+
+
Default: InboundMCPAppAccess. Reserved for future app-only MCP tools and still governed separately.
+
+
+
+
+
+
+
Endpoint Contract
+
+
MCP endpoint
+
{{ inbound_mcp_resource_path }}
+
Protected resource metadata
+
{{ inbound_mcp_prm_path }}
+
Transport
+
Streamable HTTP JSON-RPC
+
Current tool surface
+
Personal delegated tools only.
+
Tool identity
+
Delegated user token required for personal data.
+
+
+ Endpoint paths are fixed in application routing for this initial UI slice. Change the app setting below for the source header only.
+
+
+
+
+
+
+
+
+
Request Size & Throttling
+
Protect the inbound MCP endpoint from oversized payloads and noisy clients. Rate limits are enforced per caller and tool category across app instances.
+
+
+
+
+
+
+
+
+
+
+
Default: 65536. Range: 1 KB to 1 MB.
+
+
+
+
+
Default: 60. Applies to each throttle category.
+
+
+
+
+
Default: 120.
+
+
+
+
+
Default: 30.
+
+
+
+
+
Default: 10.
+
+
+
+ Application Insights events include mcp_request_id, caller app, delegated user, source, tool, duration, result status, and rate-limit category without recording prompts, document content, bearer tokens, or secrets.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Allowed client app IDs
+
Required allowlist. Empty means no MCP clients can connect.
+
+
+
+
+
+
+
+
Client app ID
+
Description
+
Actions
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Off allows only the configured SimpleChat tenant. Turning this on auto-includes the SimpleChat tenant and lets admins add more tenants.
+
+
+
+
Allowed tenant IDs
+
+
+
+
+
+
+
Tenant ID
+
Description
+
Actions
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Default on accepts any source signal at the runtime allowlist layer. Turn off to require explicit source values here. In both modes, admins must still create an inbound MCP source governance policy before tools are returned.
+
+
+
+
+
Default: X-SimpleChat-MCP-Source.
+
+
+ Source IDs are read from the configured header when present. This is a client-provided value and can be spoofed unless a trusted gateway, APIM policy, or similar control sets/enforces it.
+
+
+
+
+ Create an inbound_mcp_source policy for * to choose which users or groups can use inbound MCP from any accepted source.
+
+
+
+
+
+
+
+ After adding allowed source IDs, create an inbound_mcp_source policy for * or a specific source to choose which users or groups can use inbound MCP.
+
+
+
+
+
+
+
Allowed source IDs
+
+
+
+
+
+
+
Source value
+
Description
+
Actions
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Add MCP Entry
+
+
+
+
+
+
+
+
+
Value is required.
+
+
+
+
+
Use descriptions to explain who owns this app, tenant, or source value without making the value easy to guess.
+
+
+
+
+
+
+
+
+
+
+
Inbound MCP overview
+
+
+
+
+ SimpleChat exposes a governed Streamable HTTP MCP endpoint for approved external MCP clients. Authentication handles tenant, client, delegated scope, and Entra role checks; governance decides which users/groups and source IDs can use tools.
+
+
+
+
Runtime checks
+
+
Client app ID must be in the allowed client list.
+
Tenant must be the SimpleChat tenant unless additional tenants are enabled.
+
Delegated personal tools require the configured scope and user role.
+
Governance uses inbound_mcp_source policies to decide which users or groups can use each accepted source.
+
+
+
+
Source header guidance
+
+ The configured source header is an advisory control-plane signal. Treat it like an APIM subscription-key label, not strong identity. For stronger assurance, set or overwrite it at a trusted gateway and avoid relying on client-provided values alone.
+
+
+
+
Available MCP tools
+
+
+
+
+
Tool
+
Scope
+
Operation
+
Description
+
+
+
+ {% for tool in inbound_mcp_tools %}
+
+
+
{{ tool.display_name }}
+ {{ tool.id }}
+
+
{{ tool.scope }}
+
{{ tool.resource_family }} / {{ tool.operation }}
+
{{ tool.description }}
+
+ {% endfor %}
+
+
+
+
+
Application Insights starter queries
+
+ Use these KQL queries in Application Insights Logs to validate inbound MCP traffic, denials, and tool latency. They rely on safe structured dimensions emitted by the inbound MCP route and do not require prompt, message, document, token, or secret values.
+
+
+
+
+
+
+
+
+
+
traces
+| where timestamp > ago(24h)
+| where message has "[InboundMCP]"
+| summarize requests=count(), failures=countif(tostring(customDimensions.result_status) !in ("", "success", "accepted")) by bin(timestamp, 1h)
+| order by timestamp desc
+
+
+
+
+
+
+
+
+
+
+
traces
+| where timestamp > ago(24h)
+| where message has "[InboundMCP]"
+| where isnotempty(tostring(customDimensions.error_type))
+| summarize events=count() by tostring(customDimensions.error_type), tostring(customDimensions.caller_app_id), tostring(customDimensions.source_id)
+| order by events desc
+
+
+
+
+
+
+
+
+
+
+
traces
+| where timestamp > ago(24h)
+| where message has "Inbound MCP tool call"
+| where isnotempty(tostring(customDimensions.tool_id))
+| summarize calls=count(), avg_duration_ms=avg(todouble(customDimensions.duration_ms)), p95_duration_ms=percentile(todouble(customDimensions.duration_ms), 95) by tostring(customDimensions.tool_id), tostring(customDimensions.result_status)
+| order by calls desc
+
+
+
+
+
+
+
+
+
+
+
traces
+| where timestamp > ago(24h)
+| where message has "Inbound MCP tool call denied by rate limit"
+| summarize denials=count() by tostring(customDimensions.rate_limit_category), tostring(customDimensions.tool_id), tostring(customDimensions.caller_app_id)
+| order by denials desc
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Verify App Service Authentication exclusions
+
+
+
+
+ Required before enabling inbound MCP:
+ If Azure App Service Authentication redirects unauthenticated requests, add excluded paths so MCP clients can discover protected resource metadata and so SimpleChat can enforce bearer-token MCP access itself.
+
+
+ Run the following PowerShell with Azure CLI from Azure Cloud Shell or any authenticated terminal. SimpleChat pre-fills the script from this App Service's environment when possible.
+
Attempts to verify that the SimpleChat API app exposes the required delegated scope and inbound MCP app roles.
+
Uses SimpleChat's Resource Manager endpoint for public, government, or custom clouds.
+
Creates a timestamped backup of current authsettingsV2 before applying changes.
+
+
+
+
+ {% if inbound_mcp_easy_auth_script_context.missing_values %}
+
+ SimpleChat could not derive every required value. Replace the placeholders in the script before running it:
+ {{ inbound_mcp_easy_auth_script_context.missing_values | join(", ") }}.
+
+ {% endif %}
+ {% if inbound_mcp_easy_auth_script_context.scope_check_missing_values %}
+
+ SimpleChat could not derive every value needed for the delegated-scope and role preflight. Replace these placeholders if you want the script to validate the app registration before changing Easy Auth:
+ {{ inbound_mcp_easy_auth_script_context.scope_check_missing_values | join(", ") }}.
+
+ {% endif %}
+ {% if inbound_mcp_easy_auth_script_context.uses_custom_cloud_match %}
+
+ This deployment uses a custom Azure environment. The script searches your registered Azure CLI clouds for one with the same Resource Manager endpoint. If none is registered, register the custom cloud first and rerun the script.
+
+ {% endif %}
+
+
+
{{ inbound_mcp_easy_auth_script }}
+
+
+ The verification checks these public unauthenticated endpoints and expects SimpleChat JSON responses, not Microsoft sign-in HTML:
+
+
/.well-known/oauth-protected-resource
+
/.well-known/oauth-protected-resource/api/mcp
+
/.well-known/oauth-protected-resource/mcp
+
/.well-known/oauth-authorization-server
+
/api/mcp
+
/api/mcp/health
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {% endif %}
+
diff --git a/application/single_app/templates/admin/_panes/ai-models.html b/application/single_app/templates/admin/_panes/ai-models.html
new file mode 100644
index 00000000..3df45b25
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/ai-models.html
@@ -0,0 +1,831 @@
+
+
+
+ Configure all AI model settings including GPT for text generation, embeddings for semantic search, and image generation capabilities.
+
+
+
+
+ Model Endpoints
+
+
+ Manage multiple AI model endpoints (Azure OpenAI and Azure AI Foundry). When enabled, model selection in chat is driven by these endpoints.
+
+
+ {% if not settings.enable_multi_model_endpoints %}
+
+ Review local agents in a modal, bulk-bind inherited agents to the saved default model endpoint, and explicitly override selected agent model choices when you need to manage cost or move to newer models.
+
+
+
+
+
+
+
+ {% if settings.enable_multi_model_endpoints %}
+ Save your AI model settings before reviewing or migrating agents.
+ {% else %}
+ Enable multi-endpoint model management to review and rebind agents to a saved default model.
+ {% endif %}
+
+ Open the review modal to search, filter, and selectively rebind agents to the saved default model.
+
+
+
+
+
+
+
+
+
Agent Default Model Review
+
+ Search, filter, and explicitly choose which agents should adopt the saved default model. Manual review rows are never selected automatically.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
No agents selected.
+
+
+
+
+
Select
+
Scope
+
Agent
+
Status
+
Current Binding
+
Reason
+
+
+
+
+
Run a review to load migration candidates.
+
+
+
+
+
+
+
+
+
+ {% else %}
+
+
+
+
Agent Default Model Review
+
+ Enable Agents first to use default-model review in AI Models. Once enabled, admins can use it to move inherited agents to new defaults, selectively override explicit agent model choices, and manage costs as models evolve.
+
+
+
+
+
+ {% endif %}
+
+
+
+
+
Model Endpoint Identity Header
+
+ Send a stable HMAC-hashed user key to model endpoint backends for APIM counters, quota policies, or routing policies.
+
+
+
+
+
+
+
+
+
+
+
+
Reserved auth/protocol headers cannot be used.
+
+
+
+
+
The selected identity is HMAC-hashed before leaving SimpleChat. Missing identity values omit the header.
+
+
+
+
+
+
+
+
+ Used for tasks such as conversation summarization, fallback, and other operations when an agent is selected.
+
+
+
+
+
+
+
+
+
Global Endpoints
+
+
+
+
+
+
+
+
+
+
Name
+
Provider
+
Selected Models
+
Status
+
Actions
+
+
+
+
+
+
+
+
+ {% if not settings.enable_multi_model_endpoints %}
+
+ {% endif %}
+
+
+
+
+
+ Processing Thoughts
+
+
When enabled, real-time processing steps are shown to users during chat responses and persisted for later review.
+
+
+
+
+
+
+
+
+
+
+ Shared Conversation File Approvals
+
+
Files generated by participants in a shared conversation are saved into the conversation owner's storage. When enabled, those files are held until an approver releases them.
+
+
+
+
+
+
+
+
+
+
+ Embeddings Configuration
+
+
+ Configure your embeddings settings. These are used for semantic search, knowledge-base lookups, etc.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Save pending changes to settings before clicking Fetch Embedding Models
+
+
+
+
+
+
+
+
+
+ Fetch Models lists deployments through the Azure management plane. Test Connection, chat generation, file uploads, embedding generation, and image generation call the Azure OpenAI data plane. These paths can use different credentials and require different roles.
+
+
+
Credential purpose
+
+
+
+
+
Action
+
Plane
+
Credential used
+
Role or secret
+
+
+
+
+
Legacy GPT, embedding, or image Fetch Models
+
Management plane
+
The SimpleChat app registration or service principal, such as the -ar Entra application created for the deployment.
+
Cognitive Services User on the Azure OpenAI resource, or an equivalent role that can read deployments.
+
+
+
Global endpoint modal Fetch Models
+
Management plane
+
The endpoint modal identity selected for discovery, such as managed identity or service principal.
+
Cognitive Services User on the Azure OpenAI resource, or an equivalent role that can read deployments.
+
+
+
GPT, embedding, or image generation with Key authentication selected
+
Data plane
+
The Azure OpenAI key saved in this settings section.
+
Azure OpenAI resource key from Keys and Endpoint.
+
+
+
GPT, embedding, or image generation with Managed Identity selected
+
Data plane
+
The App Service managed identity, such as the -app managed identity.
+
Cognitive Services OpenAI User on the Azure OpenAI resource.
+
+
+
+
+
+
Where to get values
+
+
Open the Azure OpenAI resource in the Azure portal.
+
Copy the endpoint from Resource Management > Keys and Endpoint.
+
If using Key authentication for runtime calls, copy Key 1 or Key 2 from the same page.
+
Copy the subscription ID and resource group from the resource Overview page. These are required for Fetch Models.
+
If using APIM, use the APIM endpoint, deployment path or name, API version, and APIM subscription key instead of the direct Azure OpenAI key.
+
+
+
Recommended setup
+
+
For key-backed legacy GPT, embeddings, or image generation, grant the SimpleChat service principal the management-plane role so admins can fetch model deployments, then store the Azure OpenAI key for data-plane generation.
+
For managed identity runtime, grant the App Service managed identity Cognitive Services OpenAI User for data-plane generation. If the same managed identity should also fetch deployments, grant it the management-plane discovery role too.
+
Fetch only discovers deployment names and model metadata. It does not prove that embedding or image generation inference will succeed; use Test Embedding Connection or Test Image Connection after selecting a deployment.
+
+
+
+
+
+
+
+ {% include '_multiendpoint_modal.html' %}
+
+
+
+
+
+
+
Legacy AI Model Configuration
+
+
+
+
+
+
+ Chat Model
+
+
+ Configure your Chat Model settings. These are used for generating AI text responses.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Each selected model will be available in the Chat UI as an option for the User. You can select multiple models.
+ Save Pending Changes to settings before clicking Fetch Models
+
+
+
+
+ Save pending changes to settings before clicking Fetch Models
+
+
+
+
+
+
+
+
+
+ Each model defined here will be available in the Chat UI as an option for the User. You can include multiple models seperated by a comma (example: gpt-4o, o-1, o-3).
+ NOTE: The APIM GPT Test is against the first model in the list.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/citation.html b/application/single_app/templates/admin/_panes/citation.html
new file mode 100644
index 00000000..3c6542a2
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/citation.html
@@ -0,0 +1,244 @@
+
+
+
+ Configure standard and enhanced citations features for your and group workspaces.
+
+
+
+
+
+ Standard Citations
+
+
+ Standard citations is always enabled for both Your Workspace and Group Workspace.
+
+
+ Users can see text content of the source/citation for documents.
+
+
+
+
+
+
+ Enhanced Citations
+
+
+ Enable Enhanced Citation to store files in a Storage Account,
+ and show direct references (Preview feature, files are saved to storage, presentation
+ layer will be available in a future release).
+
+
+ {% set ec_storage_status = settings.enhanced_citations_storage_status or {} %}
+ {% set ec_storage_state = ec_storage_status.state or 'not_initialized' %}
+ {% if settings.enable_enhanced_citations %}
+
+
Enhanced Citations storage startup status
+
{{ ec_storage_status.message or 'Enhanced Citations storage status is not available for this process.' }}
+
+ Startup skips live storage container checks so storage outages do not block application boot.
+ Use the connection test to validate current storage reachability and container access.
+
+
+
+
+ {% endif %}
+
+
+
+
+
+
+
+
+
+
+
+
+
All filetypes
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Tabular Preview Limits
+
+
+
+
+ Maximum blob size (in MB) allowed for tabular file previews (CSV, XLSX). Files larger than this will not be previewed.
+ Increase for larger files if your compute has sufficient memory, or decrease to protect smaller instances. Default: 200 MB.
+
+
+
+
Large Tabular Run Controls
+
+
+
+
When a prompt includes an explicit large row count, users are asked to continue or narrow scope before the run starts.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/control-center-config.html b/application/single_app/templates/admin/_panes/control-center-config.html
new file mode 100644
index 00000000..dd214327
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/control-center-config.html
@@ -0,0 +1,180 @@
+
+
+ Configure Control Center access and permissions for administrators.
+
+
+
+
+
+
+
+
+
+
+ Automatic Data Refresh
+
+
Run the Control Center metrics refresh overnight on a daily timezone-aware schedule
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Your browser timezone is local time.
+
+
+
+
+
+ {% if settings.control_center_auto_refresh_next_run %}
+ Loading local time...
+ {% else %}
+ Will be calculated when saved
+ {% endif %}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Control Center Access
+
+
Manage who can access Control Center features and administrative tools
+
+
+
+
+
+
+
+ About Control Center: The Control Center is a powerful administrative dashboard that provides user management, group oversight, public workspace control, and detailed activity monitoring. Use role-based access controls below to delegate administrative responsibilities.
+
+
+
+
+
+
+
+
+
+ Required app role value: ControlCenterAdmin. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only users assigned this role can access the Control Center and all management features. Regular Admins will lose access.
+
+
+
+ User Management
+
+
+ Group Management
+
+
+ Public Workspaces
+
+
+ Activity Logs
+
+
+
+
+
+
+
+
+
+
+
+ Dashboard-only app role value: ControlCenterDashboardReader. Assign this role to users or groups in the Enterprise App before enabling dashboard-only access. Users assigned ControlCenterAdmin can also access the dashboard when Control Center app-role enforcement is enabled.
+
+
+ Important: Configure these roles in your identity provider (Entra ID). When role requirements are enabled, standard Admins without the specific roles will be denied access to Control Center features.
+
+
+
+
+
+ Best Practices
+
+
+
ControlCenterAdmin: Grant to IT administrators who need full control over users, groups, and workspaces
+
ControlCenterDashboardReader: Grant to managers, compliance officers, or stakeholders who need visibility into platform usage without administrative powers
+
Separation of Duties: Enable role requirements if you need to restrict Control Center access from general application admins
+
Audit Trail: All Control Center actions are logged in Activity Logs for compliance and security auditing
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/custom-pages.html b/application/single_app/templates/admin/_panes/custom-pages.html
new file mode 100644
index 00000000..a3d0f32e
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/custom-pages.html
@@ -0,0 +1,81 @@
+
+
+ Enable trusted deployment-time custom pages and manage metadata for simple static pages served from the application custom_pages folders.
+
+
+
+
+
+ Custom Pages
+
+
+
+
+
+
+
+
+
+
When disabled, /custom routes return Not Found before loading custom metadata, files, or Python extensions.
+
+
+
+
+
+ This name appears when custom pages are grouped into a menu.
+
+
+
+
+
+ When disabled, 1-2 custom pages show as top-level nav items and 3+ pages show as a menu.
+
+
+
+
+
Static Page Metadata
+
Create metadata contracts for simple pages that use files from custom_pages/html, css, js, assets, and json.
+
+
+
+
+
+
+
+
+
+
+
+
Slug
+
Title
+
Type
+
Access
+
Roles
+
Status
+
Nav
+
Actions
+
+
+
+
+
Loading custom pages...
+
+
+
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/data-management.html b/application/single_app/templates/admin/_panes/data-management.html
new file mode 100644
index 00000000..aba96639
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/data-management.html
@@ -0,0 +1,1621 @@
+
+
+
+
Backup, Migrate & Restore
+
Protect SimpleChat data, move selected workspaces to another environment, and stage restore decisions with guided checks.
+
+
+
+
+
+ We suggest not running backups, restores, or migrations during your operational business hours. These jobs run inside the App Service environment and can affect application performance.
+
+
+
+
+
+
+
+
Start Here
+
Use these checkpoints before running backup, migration, restore, or advanced repair actions.
+
+
+
+
+
+
+
Back up
+
Configure dedicated storage, encryption, schedule, and backup scope before queueing jobs.
+
+
+
+
+
+
Migrate
+
Connect a destination, choose who moves, run preflight, then execute a recoverable transfer.
+
+
+
+
+
+
Restore
+
Review backup readiness and stage restore decisions from Backup Inventory.
+
+
+
+
+
+
RU Boost
+
Temporarily raise eligible Cosmos capacity during approved backup or migration windows.
+
+
+
+
+
+
+
+
+
+
+
+
+
Backup
+
Configure when backups run, where artifacts are stored, and how backup files are encrypted.
+
+
+
+
+
+
+
Schedule
+
Full backups run on the selected cadence; partial backups run daily only.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Default is 03:00 UTC.
+
+
+
+
+
+
+
+
+
+
Automatic cleanup keeps the newest successful full backup as a safety baseline.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ These backup scope controls are advanced. Modify them at your own risk because excluding a surface can create backups that are incomplete for restore or migration scenarios.
+
+
+
+
+
+
+
Core application records required for meaningful restore and migration.
+
+
+
+
+
+
+
Search index schemas and retrievable indexed documents.
+
+
+
+
+
+
+
Original source files used by Enhanced Citations.
+
+
+
+
+
+
+
+
+
+
+
+
Storage
+
Store backup artifacts in Azure Blob Storage.
+
+
+
+
+
+ Use a dedicated backup storage account. Data Management will reject storage that matches the Enhanced Citations connection string or Blob endpoint.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
No connection string saved yet.
+
+
+
+
+
+
+
+
+
+
+
+
Encryption
+
Generate a 256-bit backup encryption key.
+
+
+
+
+
+
+
+
+
Key storage
+
Not configured
+
Key reference
+
Not configured
+
+
+
+
+
Key Vault is strongly recommended
+
Generated backup encryption keys are stored in the Data Management settings document when Key Vault is not enabled.
Backups stream deterministic checkpoint batches and commit only verified work. Higher concurrency can increase source Cosmos cost and pressure.
+
+
+
+
+
+
+
Source Blob Backup Performance
+
Source files stream through bounded chunks and durable per-file checkpoints. Peak transfer buffering is bounded by concurrent transfers multiplied by chunk size.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Defaults bound application transfer buffering to approximately 32 MiB, excluding Azure SDK overhead. Throttling temporarily reduces active transfers.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
The backup records the current source capacity, raises only eligible targets up to 10,000 RU/s, and restores the original setting after completion, cancellation, failure, or recovery. This can increase Cosmos charges and requires source ARM throughput permission.
+
+
+
+
+
+
+
+
Backup Operations
+
Queue immediate full or partial backup jobs using the settings above.
+
+
+
+
+
+
+
Jobs use Cosmos-backed leases so scaled-out App Service workers do not run the same backup twice.
+
+
+
+
+
+
+
+
+ Migration
+
+
Move SimpleChat data through a reviewed, recoverable environment transfer.
+
+
+
+ Not reviewed
+
+
+
+
+
+
+
+
+
+
+
+
+
Connect the destination
+
Configure the services this migration will write to. Stored credentials remain redacted.
+
+ Destination database: SimpleChat
+
+
+
+
+
+
+
Target Cosmos Database
+
Required for every migration.
+
+
+
+
+ Managed identity requires Cosmos DB Data Contributor and target network access.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Fixed app contract.
+
+
+
+
+
+
+
+
+
+
+
+
Target Search
+
Required when AI Search documents are included.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Target Enhanced Citation Storage
+
Required only when source document blobs are included.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Choose who and what moves
+
Selections persist while you search and page. “All” always uses the exhaustive server count.
+
+
0 principal scopes selected
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Available users
+
Search the server catalog.
+
+
+
+
+
+
+
+
+
+
+ Page 1
+
+
+
+
+
+
+
+
+
+ Loading exhaustive count…
+ Every current user record will be resolved by the server when the job starts.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Available groups
+
Search the server catalog.
+
+
+
+
+
+
+
+
+
+
+ Page 1
+
+
+
+
+
+
+
+
+ Loading exhaustive count…
+ Every current group record will be resolved by the server when the job starts.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Available public workspaces
+
Search the server catalog.
+
+
+
+
+
+
+
+
+
+
+ Page 1
+
+
+
+
+
+
+
+
+ Loading exhaustive count…
+ Every current public workspace record will be resolved by the server when the job starts.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Choose what happens at the destination
+
Choose whether to copy only missing items, catch up changes, or make migrated destination data match the source.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Prove the plan is ready
+
Preflight runs server-owned access probes and inventory. Any earlier change makes this review stale.
+
+
+
+
+
+
+
+
+
+ Review has not run.
+ Run preflight to verify target access, counts, collisions, locks, and capacity policy.
+
+
+
+
+
+
+
+
+
+
+
+
Confirm execution
+
Review the final server-normalized plan. Submission is guarded against duplicate requests.
+
+
+
+
Complete preflight review before confirmation.
+
+
+ Destructive destination cleanup. Only destination items previously created by SimpleChat migration may be deleted. Unowned destination data is retained and reported as a conflict.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Operate the migration
+
Progress comes from the durable job record. Cancel, Retry, and Resume retain verified checkpoints.
+
+
+
+
+
+
+
+
+
+ No migration is attached to this workflow yet.
+ After execution, this stage follows the queued job and exposes its recovery actions.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Cosmos DB JSON Editor
+
Query SimpleChat Cosmos DB containers, inspect one document, and save JSON changes with ETag protection.
+
+
+
+
+ This tool can modify production Cosmos DB documents directly. Use it only for targeted admin repair or investigation after you understand the impact.
+
+
+ The Cosmos DB JSON editor is locked. Acknowledge the danger prompt before querying or editing data.
+
+
+
+
+
+
+
Choose a known SimpleChat Cosmos DB container.
+
+
+
+
+
Max 100 per request.
+
+
+
+
+
Empty query returns only the first 100 documents. Custom SELECT queries can page beyond 100 with Next Page.
+
+
+
+
+ No query has run yet.
+
+
+ Query results and the JSON editor open in a modal so the Data Management page stays compact.
+
+
+
+
+
+
+
+
Backup Inventory
+
Track completed full and partial backups created by Data Management jobs.
+
+
+
+
+
+
+
+
+
+
What does Run Retention Cleanup do?
+
+ It permanently deletes backups whose age exceeds the retention period configured in Data Management settings,
+ and removes their stored artifacts from the backup container. Backups newer than the retention cutoff are left alone.
+
+
+
Only backups in a finished state are eligible; running or queued jobs are skipped.
+
When Keep latest full backup is enabled, the most recent successful full backup is protected even if it is past the cutoff.
+
Each run deletes at most 25 backups, so very large cleanups may need several runs.
+
Cleanup also runs automatically on the configured schedule; this button just runs it now.
+
+
+ Seeing “found no expired backups to delete” means every backup is still inside the retention window. That is expected, not an error.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Backup
+
Completed
+
Contents
+
Storage
+
Protection
+
Warnings
+
Actions
+
+
+
+
+
Backup inventory has not loaded yet.
+
+
+
+
+
+
+
+
+
+
+
+
+
Restore Backup
+
Review the target, policy, and backup manifest before queueing a restore job.
+
+
+
+
+
+ Restore writes data into the configured target Cosmos DB, AI Search, and Enhanced Citation Storage services. Create-only mode blocks existing destination collisions; overwrite mode requires a separate phrase.
+
+
+
Selected backup
+
+
Choose Restore from a backup row.
+
+
+
+
Restore policy and surfaces
+
+
+
+
+
Create-only is non-destructive and recommended for first restore attempts.
+
+
+
+
+
+
+
+
+
+ Required phrase: RESTORE WITH OVERWRITE
+
+
+
+
+
+
+
Preflight review
+
Run review to validate the manifest, target access, and restore policy.
+
+
+
+
+
No restore review has run yet.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Job History
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Created
+
Operation
+
Status
+
Progress
+
Message
+
Actions
+
+
+
+
+
Job history has not loaded yet.
+
+
+
+
+
+
+
+
+
+
+
+
+
Cosmos DB JSON Editor Warning
+
This interface can change live application data.
+
+
+
+
+
+ Incorrect edits can break authentication, workspaces, chat history, documents, automations, or activity log integrity. Use this editor only when safer admin tools cannot solve the problem.
+
+
+
Run targeted SELECT queries and page results instead of loading large containers at once.
+
Do not change id or the container partition key value.
+
Review JSON carefully before saving. Saves are audited in Activity Logs.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Cosmos DB Query Results
+
Run a query to load document summaries.
+
No query has run yet.
+
+
+
+
+
+
+
+
+
Results
+
+
+
Run a query to list documents.
+
+
+
+
+
+
+
+
+
Document JSON
+
Select a result to load JSON.
+
+
+
+
+
+
+
+
+
+
The editor blocks id and partition key changes. Saves use the ETag from the loaded document.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Confirm Cosmos DB Document Save
+
Review the change summary before saving.
+
+
+
+
+
+ Saving replaces the selected Cosmos DB document with the JSON currently in the editor. This action is audited and cannot be undone from this screen.
+
+
+ No changes summarized yet.
+
+
+
+
+ Required phrase: I understand this can damage system data
+
+
+
+
+
+
+
+
+
+
+
+
+
Job Details
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Timeline
+
+
+
+
No timeline events loaded.
+
+
+
+
+
+
+
+
Backup Contents
+
+
+
+
No backup artifacts recorded for this job.
+
+
+
+
+
+
+
+
Storage and Manifest
+
+
+
+
+
+
+
+
Warnings
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Request Data Management Job Cancellation
+
+
+
+
+
The worker stops at its next durable checkpoint. Completed items remain available for Retry or Resume.
+
+
+
+
+
+
+
+
+
+
Delete Data Management Backup
+
+
+
+
+
+ Backup deletion removes stored artifacts, job timeline records, and differential sidecar state for this job. Future partial backups will re-export affected unchanged items.
+
+
+
+
+
+
+
+
+
+
+
+
+
Backup, Migrate & Restore Configuration Guide
+
+
+
+
Configure backup, migration, and restore readiness before an incident or cutover window. The safest path is to first prove backups, then rehearse migration or restore decisions from completed backup records.
+
+
Use dedicated backup storage that is separate from Enhanced Citation source files.
+
Generate and protect the backup encryption key, preferably in Key Vault.
+
Run a manual full backup and inspect the Backup Inventory entry.
+
For migration, connect destination Cosmos, Search, and storage services before selecting scope.
+
For restore, open Backup Inventory and stage the selected backup through the Restore workflow.
+
+
+
+
+
+
+
+
+
+
+
Backup Setup Guide
+
+
+
+
Backups create durable artifacts and job records that later migration or restore workflows can inspect. Full backups capture a complete selected snapshot. Partial backups capture daily changes between full backups.
+
+
Storage: Use a dedicated backup account/container so restore and migration artifacts never overwrite source documents.
+
Encryption: Keep backup encryption enabled and store generated keys in Key Vault for production.
+
Scope: Leave Cosmos DB and AI Search enabled unless you are intentionally creating a limited backup.
+
Timing: Queue large backup jobs outside business hours because App Service workers perform the work.
+
+
+
+
+
+
+
+
+
+
+
Migration Guide
+
+
+
+
Migration moves selected SimpleChat users, groups, public workspaces, and their optional documents to another SimpleChat environment.
+
+
Copy missing items only: safest first run; existing destination records are not changed.
+
Catch up changed items: use after a previous completed migration to copy new items and update migration-owned changes.
+
Make destination match source: use only during cutover when migrated destination-only items should be removed.
+
AI Search freeze: freeze external destination writers before moving Search documents because SimpleChat cannot coordinate external writers.
+
+
+
+
+
+
+
+
+
+
+
RU Boost Permission Guide
+
+
+
+
RU Boost temporarily raises eligible Cosmos DB throughput up to 10,000 RU/s and then restores the original setting. It can increase Azure charges and requires Azure management-plane permissions.
+
+
Data copy permissions prove the identity can create, read, and delete probe records in destination Cosmos containers.
+
RU Boost permissions prove the identity can read and write Cosmos throughput settings through Azure Resource Manager.
+
Destination RU Boost also needs the destination subscription ID and resource group because those values are not part of the data-plane endpoint.
+
Use Test RU Boost before a cutover window; it validates capacity permissions separately from migration data access.
+
+
+
+
+
+
+
+
+
+
+
Restore Guide
+
+
+
+
Restore starts from Backup Inventory. The workflow helps admins confirm what is in the backup, what surfaces are safe to restore, and whether backend restore execution is available for the selected backup.
+
+
Prefer full backups for restore decisions because partial backups depend on earlier backup history.
+
Confirm the encryption key is still available before relying on encrypted artifacts.
+
Review warnings and missing surfaces before restoring AI Search or source document blobs.
+
Run restore only in a maintenance window because restored records can affect live users and search results.
+
+
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/file-sync.html b/application/single_app/templates/admin/_panes/file-sync.html
new file mode 100644
index 00000000..fb31daf8
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/file-sync.html
@@ -0,0 +1,411 @@
+
+
+ Configure file synchronization for personal, group, and public workspaces.
+
+
+
+
+
+ File Sync
+
+
+
+
+ Enable File Sync globally, set conservative run limits, and choose whether workspace managers or SimpleChat admins manage sync sources.
+
+
+
+ File Sync can scan large remote shares and create many document versions. Start with narrow filters, conservative schedules, and low per-run limits before enabling broad workspace access.
+
+
+ {% if not settings.file_sync_redis_ready %}
+
+ Redis Cache must be enabled and configured before File Sync can run. Saved File Sync settings remain inactive until Redis is ready.
+
+ {% elif settings.requested_enable_file_sync and not settings.file_sync_effective_enabled %}
+
+ File Sync is saved as requested but is not currently active. Check Redis configuration and scope controls.
+
+ {% endif %}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {% set file_sync_visible_source_types = settings.file_sync_visible_source_types|default(['smb', 'azure_files']) %}
+
+
Visible Source Types
+
+ Choose which source types appear in the Add Source workflow. OneDrive, SharePoint, and Google Workspace connectors are coming soon while validation continues.
+
+
+
+
+
+
+
Available now.
+
+
+
+
+
+
+
Available now.
+
+
+
+
+
+
+
Available now.
+
+
+
+
+
+
+
Coming Soon.
+
+
+
+
+
+
+
Coming Soon.
+
+
+
+
+
+
+
Coming Soon.
+
+
+
+
+
+
+
Cloud drive connector identities
+
+ OneDrive, SharePoint, and Google Workspace File Sync connectors are coming soon. Any existing global connector identities can remain configured for future use.
+
+
+
+
+
+
+
Personal Workspace Sync
+
+
+
+
+
+
+
+
+
+
+
+
+
Required app role value: PersonalFileSyncUser. Assign this role to users or groups in the Enterprise App before enabling the requirement for personal sync.
+
+
+
+
+
+
+
+
+
+
+
+
+
No user selected.
+
+
+
+
+
+
+
Group Workspace Sync
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ No groups assigned.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
No group selected.
+
+
+
+
+
+
+
Public Workspace Sync
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ No public workspaces assigned.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
No public workspace selected.
+
+
+
+
+
+
+ SMB source credentials are stored in Azure Key Vault when Key Vault secret storage is enabled; otherwise they use the app's existing encrypted settings path.
+
+
+
+
+
+
+
+
+
+
Manage File Sync Sources
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
File Sync Group Assignments
+ Choose which groups can use File Sync when group assignment is required.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
No groups loaded.
+
+
+
+
+
Group
+
Description
+
Assignment
+
+
+
+
+
Search for groups to assign.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
File Sync Public Workspace Assignments
+ Choose which public workspaces can use File Sync when public workspace assignment is required.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Enter at least 2 characters to search.
+
+
+
+
+
Public Workspace
+
Description
+
Assignment
+
+
+
+
+
Search for public workspaces to assign.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Personal File Sync App Role Setup
+
+
+
+
+ Create the personal File Sync app role on the SimpleChat app registration, then assign users or groups to the role in the Enterprise App before enabling the personal require-role toggle.
+
+
+
+
+
+
Capability
+
App role value
+
Typical assignment
+
+
+
+
+
Personal File Sync
+
PersonalFileSyncUser
+
Users allowed to manage personal sync sources
+
+
+
+
+
+
Open Microsoft Entra admin center and edit the SimpleChat app registration.
+
Add the app role with allowed member type Users/Groups and value exactly matching the table.
+
Open the Enterprise App for SimpleChat and assign users or groups to the app role.
+
Have affected users sign out and sign back in so their role claims refresh.
+
+
+
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/general.html b/application/single_app/templates/admin/_panes/general.html
new file mode 100644
index 00000000..bd3d5be4
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/general.html
@@ -0,0 +1,682 @@
+
+
+
+ Configure general application settings, including the application's title, logo, and landing page text.
+
+
+
+ Branding
+
+
+ Configure your application's title, logo, and branding elements.
+
+
+ Adjust the logo size on the home page only. This does not change the logo size in the top or sidebar navigation.
+
+
+
+
+
+ This logo will be displayed in light mode and stored at up to 500px tall so the main page can render it sharply without keeping oversized assets in settings.
+
+
+
+
+ This logo will be displayed in dark mode. If not provided, the light mode logo will be used in both themes. Dark logos are also stored at up to 500px tall.
+
+
+
+
+ Recommended: 16x16 or 32x32 pixel png or jpg or ico.
+
+
+
+
+
+ Home Page Text
+
+
Configure the text content displayed on your application's home page using Markdown formatting.
+
+
+
+
+ Choose how the landing page markdown is aligned on the home page.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Appearance
+
+
Configure the app appearance and theme settings.
+
+
+
+
+
+
+
+
+
Users can still toggle dark mode individually from the navigation bar.
+
+
+
+
+
+
+
+
+
+
Users can still toggle the left navigation sidebar individually from the header.
+
+
+
+
+
+
+ Health Check
+
+
+
+
Configure health check endpoint for external monitoring systems.
+
+
+
+
+
+
+
Authenticated Endpoint
+
Use when your monitoring system can reach a protected route and you want the endpoint governed by the normal app access boundary.
+
+ Protected
+
+
+
+
+
+
+
Best for internal monitors or diagnostics tooling that already authenticates to the application.
+
+
+
+
+
+
+
Unauthenticated Endpoint
+
Use when a platform health probe cannot sign in and only needs a lightweight availability response.
+
+ No Auth
+
+
+
+
+
+
+
+ Security note: This route is intentionally unauthenticated. Only enable it for trusted health probes or controlled network paths.
+
Configure automatic OpenAPI/Swagger documentation for API endpoints.
+
+
+
+
+
+
+
+ Provides interactive API documentation, endpoint testing, and schema validation.
+ Useful for developers, API integration, and system troubleshooting.
+
+
+
+
+
+ Classification Banner
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {{ settings.classification_banner_text or 'Banner Preview' }}
+
+
+
+
+
+
+ Chat AI Notice
+
+
+ Display an administrator-provided reminder directly below the chat input, such as guidance that responses are AI-generated and should be reviewed.
+
+
+
+
+
+
+
+
+
+
Plain text only. Line breaks are preserved.
+
+
+
+
+
Changing the notice text or display behavior creates a new message version and shows it again.
+
+
+
+
+
+
+ Terms of Use
+
+
+ Require users to accept the Terms of Use before using SimpleChat. Standard Microsoft sign-in users see it before authentication; Teams SSO and other passive sign-in flows are gated immediately after the app session is created.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Changing the title, message, or frequency creates a new terms version that users must accept again.
+
+
+
+
+
+
+ Plain text is shown to users with line breaks preserved.
+
+
+
+
+
+ Use a local path such as / or an admin-approved HTTP(S) URL. Signed-in users are locally logged out before this redirect.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Tracking: Every-session acceptance is stored in the Flask session. Daily and once-per-version acceptance are stored in user settings, and accepted or declined events are written to the activity log when the user identity is known.
+
+
+
+
+
+ Support
+
+
+
+
+
+
+
When enabled, users can access Support destinations like Send Feedback and Latest Features directly from navigation.
+
+
+
+
+
+ This name will appear in user navigation as the Support menu title.
+
+
+
+
+
+
+
+
+
+
+
+ User Send Feedback drafts will be addressed to this internal email address.
+
+
+
+
+
+
+
+
+
+
User-Facing Latest Features
+
Choose which recent features are shared on the user Latest Features page. Deployment and Redis start unchecked because they are mainly admin-facing rollout and infrastructure topics.
+
+
+
+
+ When enabled, user-facing Latest Features cards can show public guide buttons in addition to the direct in-app shortcuts.
+
+ {% for release_group in support_latest_feature_release_groups %}
+ {% set checklist_collapse_id = release_group.collapse_id ~ 'Checklist' %}
+
+
+
+
+
{{ release_group.label }}{% if release_group.release_version %}v{{ release_group.release_version }}{% endif %}
+
{{ release_group.description }}
+
+ {% if not release_group.default_expanded %}
+
+ {% endif %}
+
+
+
+ {% for feature in release_group.features %}
+
+
+
+
+
+
+ {% endfor %}
+
+
+
+
+ {% endfor %}
+
+
+
+
+
+
+ External Links
+
+
+
+
+
+
+
When enabled, external links will be displayed in the navigation bar for easy access to external resources.
+
+
+
+
+
+ This name will appear in the navigation bar as the menu title.
+
+
+
+
+
+
+ When enabled, external links will always display as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu.
+
+
+
External Links
+
Define custom links that will appear in the navigation bar for users to access external resources.
+
+
+
+
+
Label
+
URL
+
Actions
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ System Settings
+
+
+ System-level settings that control application behavior, including file size limits, conversation history,
+ and default prompts.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Users are logged out locally after this many minutes of inactivity. Minimum value: 10 minutes.
+
+
+
+
+ Show the warning modal after this many minutes of inactivity. Set this equal to the logout timeout to disable the warning dialog window.
+
+
+
+
+ Custom text shown at the top of the idle warning dialog.
+
+
+
+
+
+
+
+
+ Shown to signed-in users who lack the required roles. Use Enter for line breaks.
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/governance.html b/application/single_app/templates/admin/_panes/governance.html
new file mode 100644
index 00000000..450af4b9
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/governance.html
@@ -0,0 +1,250 @@
+
+
+
+ Configure governance enforcement for endpoint, agent, and action creation or usage. Governance is disabled by default and only enforced when toggled on.
+
+
+
+
+
+
+ Governance Feature Toggles
+
+
Turn on governance checks for each feature area. Save with the main Settings button to persist these toggles.
+
+
+
+
Personal Scope
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Group Scope
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Global Scope
+
+
+
+ Always On
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ MCP Action Destination Governance
+
+
+ Restrict outbound remote MCP servers by destination pattern and scope. Destination policies reuse delegated item policies, so admins can allow all users, specific users, or workspace groups for each approved destination.
+
+
+
+
+
+
+
+
+
+
+
+
+ Save with the main Settings button. Unsafe literal-IP blocking can be enabled even before the allowlist is enforced.
+
+
+
+
Supported destination patterns
+
+
* for any remote MCP destination after identity/auth checks.
+
preconfiguration:microsoft_learn or preset:generic.
+
*.contoso.com, https://example.com/mcp*, or transport:streamable-http.
+
group:<group-id>::preconfiguration:github for one group-specific override.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Inbound MCP Source Governance
+
+
+ Control which delegated users and groups can use SimpleChat as an inbound MCP server through source-scoped policies.
+
+
+ Quick-create inbound MCP policies open in restricted user/group mode by default. Only use "Allow all users" when every delegated user with the required Entra role and delegated scope should be able to satisfy that policy.
+
+
+
+
Policy required for inbound MCP
+
+
inbound_mcp_source with delegated item *: allows selected users or groups to use any accepted source ID.
+
inbound_mcp_source with a configured source ID: allows selected users or groups to use only requests with that source value.
+
+
+ Client, tenant, delegated scope, and Entra role checks remain in Inbound MCP configuration. The source ID comes from the configured header when present and is advisory unless a trusted gateway sets or validates it.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Feature Policies
+
+
+
Set allow-all, explicit allow lists, and block lists for each governed feature. Block lists override allow settings.
+
+
+
+
+
Feature
+
Allow All
+
Allow List
+
Block List
+
+
+
+
+
+
+
+
+
+
Delegated Item Policies
+
+
+
+
+
+
Manage delegated governance for configured global resources and action type entitlements that admins assign to specific users or groups.
+
+ Delegated item policies are OR combined allow lists with optional block lists. Blocked users and groups are denied even when Allow All or another allow list would grant access.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Policy
+
Entity Type
+
Item
+
Allow All
+
Actions
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/latest-features.html b/application/single_app/templates/admin/_panes/latest-features.html
new file mode 100644
index 00000000..81d30da6
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/latest-features.html
@@ -0,0 +1,1253 @@
+
+
+ Review the main capabilities introduced in v{{ config['VERSION'] }} and use this page as an admin-facing overview for what to highlight with your teams.
+
+
+ This tab is intentionally curated. It groups related improvements together and mirrors a small number of high-impact settings so admins can enable them from the same overview.
+
+
+ {% for release_group in admin_latest_feature_release_groups %}
+ {% if release_group.id == 'current_release' %}
+
The badge next to the Admin Settings version number shows whether this admin instance is registered for latest release and community call notifications.
This makes long-running responses more reliable for users who navigate into other areas of the app before generation finishes.
+
+
Completion notifications deep-link back into the finished conversation.
+
Unread markers remain visible until the response is actually opened.
+
Personal, workspace, and navigation flows now behave more consistently while chat completion continues in the background.
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Multi-Endpoint GPT Selection
+
+
Admins can expose multiple GPT choices across Azure OpenAI and Azure AI Foundry, set a saved default fallback model, and now review agent rebinding in a modal before applying changes.
This is the high-value admin control for teams that want broader GPT choice without locking every workflow to a single deployment.
+
+
Configure multiple model endpoints and choose which GPT deployments are available to users.
+
Set a default fallback model so summarization, agent requests, and other background flows still resolve a usable GPT when an explicit selection is missing.
+
Use the admin-only Agent Default Model Review modal to inspect inherited agents, search and filter large agent sets, and explicitly choose which review rows should be overridden to the saved default.
+
+
+ Admin-only workflow: The review modal is intended for administrators who need to standardize agents on a new default model, control cost, or intentionally replace older explicit bindings as new models are released.
+
+
+ Review endpoint and fallback configuration in the AI Models tab.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Tabular Data Analysis
+
+
Enhanced citations now unlock a more consistent tabular analysis experience for normal chat and workspace-backed files, not just dedicated agent scenarios.
This is the highest-impact settings area to mirror here because it combines storage-backed citations, tabular previews, and consistent behavior across workspace and chat uploads.
+
+
Tabular files can be analyzed with the same core approach whether they come from chat uploads or any workspace container.
+
Enhanced citations provide the blob-backed dependency for richer tabular processing and citation transparency.
+
Admins can right-size tabular preview limits based on the memory profile of their runtime.
+
+
+ These controls mirror the saved values in the Citations tab.
+
+
+
+
+
+
+
+
+
All filetypes
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Tabular Preview Limits
+
+
+
+
+ Mirror of the Citations setting. Larger values support bigger previews but increase runtime memory pressure.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Citation Improvements
+
+
Conversation history citation replay and citation amplification keep more grounded evidence available across follow-up turns without making the chat history unwieldy.
These improvements make follow-up questions more reliable because the system can reuse prior grounded evidence instead of relying only on the assistant's last prose response.
+
+
Conversation history citations carry forward prior citation summaries so later prompts can reuse earlier grounded results.
+
Citation amplification keeps richer supporting payloads available for inspection and export while keeping prompt history compact.
+
This is especially useful for larger or tabular outputs where users often ask multiple follow-up questions against the same evidence chain.
+
+
+ These improvements complement the Citations configuration and the enhanced-citation storage flow.
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Document Revisioning and Management
+
+
Uploading a document with the same name now creates a new revision instead of overwriting the previous file, while older versions remain available for traceability and later analysis.
Admins can enable this once and let users see more of the model pipeline, including sending, generating, and responded states with clearer timing information.
+
+ This toggle mirrors the saved value in the AI Models tab.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Fact Memory
+
+
Users can now save Instructions and Facts on their profile so the assistant can apply durable preferences every time and recall relevant personal context only when needed.
This is useful for teams standardizing on Key Vault-backed secret storage while still using Redis for cache and session scenarios.
+
+
Use Redis authentication type Key Vault when you want the stored value to represent a secret name instead of a raw Redis key.
+
This works best when Key Vault is already configured for the app.
+
+
+ These controls mirror the saved values in the Scale tab.
+
+
+
+
+
+
+
+
+
Redis Cache Settings
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ When using Key Vault, store the secret name here instead of the raw Redis key.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Send Feedback to the SimpleChat Team
+
+
Admins now have a dedicated Send Feedback tab for bug reports and feature requests that opens a prefilled email draft and writes an audit record to the activity log.
+ Support is now configurable from the General tab so admins can choose exactly what users see.
+
+
+
Admins can enable or disable the Support menu and rename it for user navigation.
+
Send Feedback now routes users to an internal recipient email address defined by admins.
+
The user-facing Latest Features page can be curated feature-by-feature so teams only share the items they want visible.
+
The General tab now includes a dedicated User-Facing Latest Features checklist so admins can quickly confirm which announcements will be visible to end users.
+ These were the headline user-facing items in the earlier v{{ release_group.release_version }} release set. Keeping them here gives admins a simple previous-and-archive release view without mixing older items into the current release list.
+
+
+ {% for feature in release_group.features %}
+
+
+
+
+
+
{{ feature.title }}
+
{{ feature.summary }}
+
+
+ {% if settings.support_latest_features_visibility.get(feature.id, true) %}Shared with Users{% else %}Hidden from Users{% endif %}
+
+
+
{{ feature.details }}
+ {% if feature.guidance %}
+
+ {% for tip in feature.guidance %}
+
{{ tip }}
+ {% endfor %}
+
+ {% endif %}
+ {% if feature.images %}
+
+ {% for image in feature.images %}
+
+ {% endfor %}
+
Visibility still comes from General > User-Facing Latest Features, so admins can keep previous and archived release content available without promoting every item forever.
+
+
+
+ {% endif %}
+ {% endfor %}
+
diff --git a/application/single_app/templates/admin/_panes/logging.html b/application/single_app/templates/admin/_panes/logging.html
new file mode 100644
index 00000000..f8cf52e2
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/logging.html
@@ -0,0 +1,177 @@
+
+
+ Configure logging settings for monitoring, debugging, and auditing purposes. These settings control various types of logging throughout the application including application insights, debug messages, and file processing events.
+
+
+
+
+ Application Insights Logging
+
+
Enable global logging to Application Insights for all agents and orchestration events.
+
+
+
+
+
+
+ Note: Changing this setting requires an application restart to take effect.
+
+
+
+
+
+ Debug Logging
+
+
Control debug print statements across the application for development and troubleshooting.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {% if settings.debug_logging_turnoff_time %}
+ {% if settings.debug_logging_turnoff_time is string %}
+ {{ settings.debug_logging_turnoff_time }}
+ {% else %}
+ {{ settings.debug_logging_turnoff_time.strftime('%Y-%m-%d %H:%M:%S') }}
+ {% endif %}
+ {% else %}
+ Will be calculated when saved
+ {% endif %}
+
+
+
+
+
+
+ Info: This controls all DEBUG print statements throughout the application. Useful for development and troubleshooting. Tokens and keys will be collected during this process.
+
+
+
+
+
+ File Process Logging
+
+
Enable logging of file processing events for debugging and auditing purposes. Logs are stored in the file_processing container in Cosmos DB.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {% if settings.file_processing_logs_turnoff_time %}
+ {% if settings.file_processing_logs_turnoff_time is string %}
+ {{ settings.file_processing_logs_turnoff_time }}
+ {% else %}
+ {{ settings.file_processing_logs_turnoff_time.strftime('%Y-%m-%d %H:%M:%S') }}
+ {% endif %}
+ {% else %}
+ Will be calculated when saved
+ {% endif %}
+
+
+
+
+
+
+
+
Delete stored logs
+
+ Permanently remove file processing logs from Cosmos DB. One month is treated as 30 days.
+
+
+
+
+
+
+ Enter a whole number greater than zero.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/safety.html b/application/single_app/templates/admin/_panes/safety.html
new file mode 100644
index 00000000..b0b57c36
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/safety.html
@@ -0,0 +1,280 @@
+
+
+
+ Configure content safety, archiving, and user feedback settings. If Content Safety is enabled, user
+ messages will be sent to the safety endpoint for analysis. If User Feedback is enabled, users will see
+ thumbs up/down to provide feedback on AI responses.
+
+
+
+ Content Safety
+
+
Enable content safety to filter out inappropriate content.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Displayed when Content Safety blocks a chat message.
+
+
+
+
+
+
+
+
Disable this option to show only the configured message.
+
+
+
+
+
+
+
+
+
+ User Feedback
+
+
Enable user feedback (thumbs up/down) for AI responses.
+
+
+
+
+
+
+
+
+
+ Desktop Conversation Notifications
+
+
+ Allow users to receive an operating system notification when an AI response finishes while SimpleChat is open in a hidden or unfocused browser tab.
+
+
+
+
+
+
+ Users can turn notifications off from Profile. Browser permission is required, and notifications stop when the SimpleChat tab is closed.
+
+
+
+
+
+
+ Permissions
+
+
Control which users can access specific administrative views related to safety and feedback.
+
+
+
+
+
+
+
+
+ Required app role value: SafetyViolationAdmin. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general Admin app role can access the Safety Violations admin page.
+
+
+
+
+
+
+
+
+
+ Required app role value: FeedbackAdmin. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general Admin app role can access the User Feedback admin page. Requires Enable User Feedback to be active.
+
+
+
+
+
+
+
+ Conversation Archiving
+
+
When enabled, conversation deletions will be archived instead of permanently deleted.
+
+
+
+
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/scale.html b/application/single_app/templates/admin/_panes/scale.html
new file mode 100644
index 00000000..ac6786cc
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/scale.html
@@ -0,0 +1,1628 @@
+
+ {% set enable_dai_debug = settings.enable_dai_debug | default(false) %}
+
+ Configure Redis cache to improve enterprise scale and performance by caching session data. Enabling Redis allows you to horizontally scale your application across multiple instances without losing session data.
+
+
+
+ Redis Cache
+
+
+ Enable Redis Cache to store session data in a distributed cache. This is recommended for production and multi-instance deployments.
+
+ Monitor Redis availability, memory pressure, hit rate, evictions, and runtime cache usage before Redis-backed document list caching is enabled.
+
+
+
+
+
+
+
+
+
+
+
+
Configuration
+ Not loaded
+
+
+
+
+
Health
+ Not loaded
+
+
+
+
+
App Cache Runtime
+ Not loaded
+
+
+
+
+
Session Runtime
+ Not loaded
+
+
+
+
+
+
+
Ping Latency
+
Not loaded
+
+
+
+
+
Memory Usage
+
Not loaded
+
Not loaded
+
+
+
+
+
Connected Clients
+
Not loaded
+
+
+
+
+
Ops/sec
+
Not loaded
+
+
+
+
+
Keyspace Hit Rate
+
Not loaded
+
+
+
+
+
Tracked Keys
+
Not loaded
+
+
+
+
+
DAI Version Markers
+
Not loaded
+
Not loaded
+
+
+
+
+
DAI Cache Payloads
+
Not loaded
+
Not loaded
+
+
+
+
+
Expired / Evicted Keys
+
+ Not loaded
+ /
+ Not loaded
+
+
+
+
+
+
Fragmentation Ratio
+
Not loaded
+
+
+
+
+
Error Replies
+
Not loaded
+
+
+
+
+
Rejected Connections
+
Not loaded
+
+
+
+
+
Redis Version
+
Not loaded
+
+
+
+
+
Monitoring Source
+
Not loaded
+
+
+
+
+
Last Checked
+
Not loaded
+
+
+
+
+
Last Error
+
Not loaded
+
+
+
+
+
+
+
+
+
+
+
+
+ Redis Explorer
+
+
+ Read-only key browser with cursor pagination and sanitized value previews.
+
+
+
+
+
+
+
+
+ Value previews are sanitized and restricted for session, token, cookie, credential, password, and secret-like keys. Use this for troubleshooting cache behavior, not for exporting Redis data.
+
+
+
+ Leave the filter blank and select Browse All to page through Redis keys. Cache keys may use uppercase names, prefixes, or internal identifiers; for example, app settings cache entries are stored as APP_SETTINGS_CACHE and APP_SETTINGS_CACHE_VERSION.
+
+
+
+
+
+
+
+
+ Blank filter browses all keys. Filters are case sensitive. Redis SCAN order is server-defined, so use Next Page to keep browsing.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Keys
+
Not loaded
+
+
+
+
+
+
+
+
+
+
+ Select a key to view sanitized metadata and preview content.
+
+
+
+
+
Key
+
Not loaded
+
+
+
Type
+
Not loaded
+
+
+
TTL
+
Not loaded
+
+
+
Memory
+
Not loaded
+
+
+
Sanitization
+
Not loaded
+
+
+
+
SimpleChat Resolution
+
Not resolved
+
Not resolved
+
Not resolved
+
Not resolved
+
+
+
Not loaded
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Conversation Cache
+
+
+ Cache conversation list, feed, and advanced-search results per user. Redis is optional; cache misses and disabled cache paths continue using source Cosmos queries.
+
+
+
+
+
+
+
+
+
+
+
When enabled, list/feed/search payloads are cached by user and version. Disabling this bypasses cache reads and writes without requiring Redis.
+
+
+
+
+
Default 120 seconds. User-scoped version invalidation refreshes changed conversations; set to 0 to skip writing new entries.
+
+
+
+
+
+
Runtime Status
+ Not loaded
+
+
+
+
+
15m Cache Hit Rate
+
Not loaded
+
+
+
+
+
15m Cache Hits / Misses
+
Not loaded
+
+
+
+
+
15m Cache Bypasses / Errors
+
Not loaded
+
+
+
+
+
15m Writes / Invalidations
+
Not loaded
+
+
+
+
+
15m Operation Mix
+
Not loaded
+
+
+
+
+
Last Cache Event
+
Not loaded
+
+
+
+
+
Last Invalidation
+
Not loaded
+
+
+
+
+
+ Conversation cache metrics are lightweight in-process counters for the current app worker. Application Insights logs remain the durable fleet-wide source for cache warnings and fallback behavior.
+
+
+
+
+
+
+
+
+
+ Cosmos Document Access Index
+
+
+ Monitor the document access projection used to remove expensive cross-partition document access queries.
+
+
+
+
+ {% if enable_dai_debug %}
+
+
+ {% endif %}
+
+
+
+
+
+ Document access projection maintenance is automatic. The background scheduler repairs fail-open projection records first, then runs bounded backfill batches repeatedly while work remains. Production read metrics below show DAI-served reads, Redis cache hits, source fallbacks, RU, and latency without requiring shadow validation.
+ {% if enable_dai_debug %}Debug controls and shadow validation diagnostics are visible because enable_dai_debug is enabled in app settings.{% endif %}
+
+
+
+
+
+
+
+
Container
+ Not loaded
+
+
+
+
+
Write-through
+ Not loaded
+
+
+
+
+
Read Path
+ Not loaded
+
+
+
+
+
Redis List Cache
+ Not loaded
+
+
+ {% if enable_dai_debug %}
+
+
+
Shadow Validation
+ Not loaded
+
+
+ {% endif %}
+
+
+
Auto Maintenance
+ Not loaded
+
+
+
+
+
Next Maintenance Action
+
Not loaded
+
+
+
+
+
More Work Pending
+
Not loaded
+
+
+
+
+
Active Loop Interval
+
Not loaded
+
+
+
+
+ {% if enable_dai_debug %}
+
+
Automatic Maintenance and Diagnostics
+
+
+
+
+
+
+
Always on. New and changed documents synchronize into the access index and fail open to repair records if projection updates fail.
+
+
+
+
+
+
+
Always on. Maintenance keeps running bounded repair and backfill batches until DAI is healthy.
+
+
+
+
+
+
+
Compares source list results to projection rows and logs mismatches without changing reads.
+
+
+
+
+
Documents processed per manual or scheduled batch.
+
+
+
+
+
Fail-open repair records reconciled before each backfill batch.
+
+
+
+
+
+
Default Read Path
+
+
+
+
+
+
+
Always on. DAI-backed document and tag list reads are the normal path; source-container fallback remains automatic when backfill is not ready, repairs are pending, or a DAI query fails.
+
+
+
+
+
+
+
Uses Redis read-through caching for DAI document, tag, and legacy-count reads. If Redis is unavailable, reads bypass cache and use DAI directly.
+
+
+
+
+
Default 900 seconds. Scope-version invalidation makes document changes visible immediately; TTL clears unreachable old entries.
+
+
+
+ {% endif %}
+
+
+
+
+
Backfill State
+ Not loaded
+
+
+
+
+
Repair Backlog
+
Not loaded
+
+
+
+
+
15m DAI Read Attempts
+
Not loaded
+
+
+
+
+
15m Redis Cache Hit Rate
+
Not loaded
+
+
+
+
+
15m Cache Hits / Misses
+
Not loaded
+
+
+
+
+
15m Cache Bypasses / Errors
+
Not loaded
+
+
+
+
+
15m Cache Invalidations
+
Not loaded
+
+
+
+
+
15m Served from DAI
+
Not loaded
+
+
+
+
+
15m Source Fallbacks
+
Not loaded
+
+
+
+
+
15m Fallback Rate
+
Not loaded
+
+
+
+
+
15m DAI Read RU
+
Not loaded
+
+
+
+
+
15m Avg / P95 Latency
+
Not loaded
+
+
+
+
+
Last Fallback Reason
+
Not loaded
+
+
+
+
+
Last DAI Read Metric
+
Not loaded
+
+
+
+
+
Last Cache Event
+
Not loaded
+
+
+
+
+
+ Production read metrics are lightweight in-process counters for the current app worker. Application Insights logs remain the durable fleet-wide source for fallback warnings and query failures.
+
+
+ {% if enable_dai_debug %}
+
+
+
Last Shadow Result
+ Not run
+
+
+
+
+
Shadow Mismatches
+
Not loaded
+
+
+
+
+
Source / Validation RU
+
Not loaded
+
+
+
+
+
Validation Index RU
+
Not loaded
+
+
+
+
+
Candidate Read RU
+
Not loaded
+
+
+
+
+
Estimated Wave 5 Savings
+
Not loaded
+
+
+
+
+
Source / Candidate Latency
+
Not loaded
+
+
+
+
+
Estimated Wave 5 Latency
+
Not loaded
+
+
+
+
+
+ Rolling decision metrics aggregate shadow-validation samples over recent windows. Use these totals to compare source container RU with candidate access-index RU before enabling the future read path or Redis document access cache.
+
+
+
+
+
5m Source / Candidate RU
+
Not loaded
+
+
+
+
+
5m Estimated Wave 5 Savings
+
Not loaded
+
+
+
+
+
15m Source / Candidate RU
+
Not loaded
+
+
+
+
+
15m Estimated Wave 5 Savings
+
Not loaded
+
+
+
+
+
15m Validation Overhead
+
Not loaded
+
+
+
+
+
15m Shadow Samples
+
Not loaded
+
+
+ {% endif %}
+
+
+
Current Scope
+
Not loaded
+
+
+
+
+
Completed Scopes
+
Not loaded
+
+
+
+
+
Total Documents Processed
+
Not loaded
+
+
+
+
+
Total Documents Failed
+
Not loaded
+
+
+
+
+
Rows Upserted
+
Not loaded
+
+
+
+
+
Rows Deleted
+
Not loaded
+
+
+
+
+
Last Batch Completed
+
Not loaded
+
+
+
+
+
Last Error
+
Not loaded
+
+
+
+
+
+
+
+
+
+ Cosmos Maintenance
+
+
+ Review expected indexing policies and clean up stale operational cache documents without touching source configuration or user data.
+
+
+
+
+
+
+
+
+
+
+
+
+ Indexing maintenance only adds missing expected composite indexes and preserves existing policy paths. Composite indexes can increase write-index overhead while improving supported lookup and ordered-query speed. Stale cleanup is allowlisted to obsolete cache artifacts, supports dry-run review, and deletes at most one bounded batch per run.
+
+
+
+
+
+
+
Indexing Policy Status
+ Not loaded
+
+
+
+
+
Indexing Mode
+
Not loaded
+
+
+
+
+
Containers Checked
+
Not loaded
+
+
+
+
+
Missing Expected Indexes
+
Not loaded
+
+
+
+
+
Updated Containers
+
Not loaded
+
+
+
+
+
Indexing Failures
+
Not loaded
+
+
+
+
+
Last Indexing Evaluation
+
Not loaded
+
+
+
+
+
Stale Cleanup Status
+ Not loaded
+
+
+
+
+
Cleanup Mode
+
Not loaded
+
+
+
+
+
Cleanup Candidates
+
Not loaded
+
+
+
+
+
Deleted Docs
+
Not loaded
+
+
+
+
+
Cleanup Failures
+
Not loaded
+
+
+
+
+
More Candidates
+
Not loaded
+
+
+
+
+
Cleanup Categories
+
Not loaded
+
+
+
+
+
Last Cleanup Evaluation
+
Not loaded
+
+
+
+
+
+
+
+
+
+
+ Apply Missing Cosmos Indexes
+
+
+
+
+
+ This adds any missing expected composite indexes to the configured hot Cosmos containers. Existing included paths, excluded paths, default indexes, TTL settings, and full-text policies are preserved.
+
+
+ Composite indexes can improve lookup and ordered-query performance, but Cosmos will maintain those indexes on future writes and may temporarily run index transformation after the policy update.
+
+
+ Choose Apply only when you accept the additional write-index overhead for the faster supported query patterns shown in the maintenance status.
+
+
+
+
+
+
+
+
+
+
+
+
+ Delete Stale Cache Documents
+
+
+
+
+
+ This deletes only allowlisted stale cache artifacts from the settings container, such as retired conversation cache version documents and obsolete volatile cache payloads.
+
+
+ It does not delete app settings, active cache-version documents, DAI state, maintenance state, source documents, or user data. Run a dry run first if you want to review the candidate count.
+
+
+
+
+
+
+
+ {% if enable_dai_debug %}
+
+
+
+
+
+ Reset Document Access Backfill
+
+
+
+
+
+ Resetting the checkpoint makes the next batch start from the first source scope again. The operation is idempotent, but it may reprocess documents that already have projection rows.
+
+
+ This does not delete source documents or projection rows. It only resets backfill progress and immediately runs one saved-size backfill batch.
+
+
+
+
+
+
+ {% endif %}
+
+
+
+
+
+ Cosmos DB Throughput
+
+
+ Monitor RU utilization and automatically adjust shared database or dedicated container throughput.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Automation checks Cosmos throughput on the Metrics Window cadence while enabled and saves the last observed database or container view. SimpleChat can scale throughput up or down at 10,000 RU/s or lower. Above 10,000 RU/s, SimpleChat monitors utilization only; use the Azure portal for capacity changes, which can take 4 to 6 hours. Native Cosmos autoscale conversion is separate from SimpleChat scale-up and scale-down automation.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Metrics Window
+
+
+
+
+
+ min
+
+
+
+
+
+
+
Scale Up Policy
+
+
+
+
+
+
+
+
+
+
+
+ %
+
+
+
+
+
+
+ RU/s
+
+
+
+
+
+
+ min
+
+
+
+
+
+
SimpleChat-managed scaling stops at 10,000 RU/s. Use the Azure portal above this limit.
+
+
+
+
+
+
+
+
+
+
+
+
Scale Down Policy
+
+
+
+
+
+
+
+
+
+
+
+ %
+
+
+
+
+
+
+ RU/s
+
+
+
+
+
+
+ min
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Use this when container throughput should follow one standard automation policy instead of per-container overrides. Global policy also applies the Cosmos autoscale conversion setting above to current and future dedicated-throughput containers.
+
+
+
+
+
+
+
+
+
+
Mode
+
Not loaded
+
+
+
+
+
Current RU/s
+
Not loaded
+
+
+
+
+
RU Utilization
+
Not loaded
+
+
+
+
+
Last Checked
+
Not loaded
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Mode
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Actions
+
+
+
+
+
Refresh to load Cosmos metrics.
+
+
+
+
+
+
+
+
+
+
+
+ Cosmos Throughput Setup Guide
+
+
+
+
+
+ Validate Access runs the same read checks automation depends on using the current form values: resource identity, Azure Resource Manager throughput reads, container discovery, and Azure Monitor metrics.
+
+
+
Required Azure Access
+
+
Assign roles to the Azure App Service managed identity service principal, not the Microsoft Entra sign-in app registration. In the Azure portal, open the Web App, select Identity, copy the Object (principal) ID, then find the matching Enterprise Application if you need to inspect it in Microsoft Entra ID.
+
For SimpleChat deployments, assign the custom SimpleChat Cosmos Throughput Operator role to that web app identity at the resource group scope that contains the Cosmos DB account, or directly at the Cosmos account scope.
+
The custom role must include management-plane actions to read the Cosmos account, database, and containers; read and write SQL database and container throughputSettings; run migrateToAutoscale; read throughput operation results; and read Microsoft.Insights/metrics.
+
If the custom role is not available, assign equivalent custom RBAC permissions. Broad built-in roles such as Contributor can validate access, but are not the preferred least-privilege configuration.
+
+
+
+
Capacity Scope
+
+
Database mode scales the shared SimpleChat database throughput.
+
Container-targeted mode scales only containers with dedicated throughput.
+
Containers that inherit shared database throughput are visible but not individually scalable.
+
Manual throughput can be converted to native Cosmos autoscale only when the admin enables conversion globally or for the container policy.
+
+
+
+
Metrics
+
+
RU Utilization is a percentage of available throughput for the selected metrics window.
+
Request Units is the total RU volume consumed during the selected metrics window.
+
Azure Monitor metrics can lag by a few minutes after traffic changes.
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Container Throughput Policies
+
+
+
+
+
+ Dedicated container throughput is controlled per row unless global policy enforcement is enabled. Containers using shared database throughput are shown for visibility, but cannot be scaled or converted individually until they have dedicated throughput. Containers above 10,000 RU/s are monitor-only in SimpleChat; change their capacity in the Azure portal and plan for a 4 to 6 hour provisioning window.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Container
+
Enabled
+
Scale Up
+
Scale Down
+
Cosmos Autoscale
+
Min RU/s
+
Max RU/s
+
Manual
+
+
+
+
+
Refresh Cosmos throughput status to load containers.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Front Door
+
+
+
+
Configure Front Door URL for authentication and redirect flows.
+
+
+
+
+
+
+
+
+
+
+
+ The base URL of your Front Door or load balancer. The system will automatically generate:
+
Identity must have Cognitive Services User and AI Developer roles on the Foundry project.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Web Search Test
+
Run the configured Foundry agent with the current unsaved settings.
+
+
+
+
+
+
+
+
+
+
URL Access
+ Shared Policy
+
+
Control direct URL content fetching for pasted chat links, workflow prompts, and Deep Research source review.
+
+
+
+
+
+
+
+
Required app role value: UrlAccessUser. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use URL Access in chat or enable it for workflows.
+
+
+
+
+ URL Access uses the same server-side URL protections as Deep Research: non-HTTP(S) URLs, credentialed URLs, literal IP targets, localhost, metadata hosts, unsafe redirects, unsupported content types, and oversized pages are blocked before fetch.
+
+
+
+
+
+
Hard limit: 100 direct URLs per chat message.
+
+
+
+
+
Hard limit: 500 direct URLs per workflow prompt.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Leave blank to allow any public domain that passes safety checks. Deep Research uses this same allow list.
+
+
+
+
+
+
+
+
+
+
+
+
Blocked domains apply to URL Access and Deep Research source-page review.
+
+
+
+
+
+
+
URL Policy Test
+
Check a URL against the current allowed and blocked domain rules before saving.
+
+
+
+
+
+
+
+
+
Deep Research
+
+ Optional
+
+
+
+
Plan bounded web searches, inspect source pages, and keep an internal research ledger for evidence coverage. Direct pasted URLs use the shared URL Access controls above.
+
+
+
+
+
+
+
+ Server-side protections always block non-HTTP(S) URLs, literal IP URL targets, localhost, metadata hosts, credentialed URLs, excessive redirects, unsupported content types, oversized pages, and requests beyond the configured page budget. DNS hostnames that resolve to private/internal addresses require the internal-host opt-in below.
+
+
+
+
+
+
Required app role value: DeepResearchUser. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use Deep Research.
+
+
+
+
+
+
Allows DNS hostnames that resolve to private/internal addresses. Literal IP URL targets, localhost, metadata hosts, link-local addresses, and reserved addresses remain blocked.
+
+
+
+
+
+
+
+
Deep Research runs only when the user selects it for the message.
+
+
+
+
+
Hard limit: 10 pages.
+
+
+
+
+
Limits initial search-result and direct URL pages so budget remains for child pages.
+
+
+
+
+
Direct URLs beyond this cap are recorded as omitted in the ledger.
+
+
+
+
+
Includes the original current-message query.
+
+
+
+
+
Hard limit: 30 seconds.
+
+
+
+
+
Every redirect target is revalidated.
+
+
+
+
+
Hard limit: 5 MB.
+
+
+
+
+
Depth 2 follows selected links from seed and child pages.
+
+
+
+
+
+ {% set js_runtime = source_review_runtime_capabilities or {} %}
+
+
+
+
+
Deep Research follows only scored, policy-approved links within the page and depth budgets.
+
+
+
+
+
+
+
The selected chat model can propose bounded current-message-only query variants before page review.
+
+
+
+
+
+
+
Creates a Markdown chat artifact with search queries, reviewed sources, skipped URLs, and coverage.
+
+
+
+
+
+
+
When source pages expose candidate links, the selected chat model can rank those candidates before the server fetches them.
+
+
+
+
+
+
+
Requires verified Playwright browser runtime support on the app host.
+
+ {{ js_runtime.message or 'Runtime support has not been checked yet.' }}
+
+ {% if not js_runtime.js_rendering_available %}
+
Install/enable the Playwright Chromium runtime, then reload Admin Settings to enable this option.
+ {% endif %}
+ {% if js_runtime.sandbox_disabled %}
+
Chromium sandbox is disabled by environment configuration.
+ {% endif %}
+
+
+
+
+
When JavaScript rendering is enabled, Deep Research can click visible Load More controls until this cap is reached.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Web Search Consent Required
+
+
+
+ When you use Grounding with Bing Search, your customer data is transferred outside of the Azure compliance boundary to the Grounding with Bing Search service. Grounding with Bing Search is not subject to the same data processing terms (including location of processing) and does not have the same compliance standards and certifications as the Azure AI Agent Service, as described in the Grounding with Bing Search TOU. It is your responsibility to assess whether use of Grounding with Bing Search in your agent meets your needs and requirements.
+
+
+ Only the user's current message is sent for web search. Users should avoid including sensitive content in any message that uses web search.
+
+
+
+
+
+
+
+
+
+
+
+
Web Search Test
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
URL Policy Test
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Azure AI Search
+
+ Configure Azure AI Search settings.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Document Intelligence
+
+ Configure Azure Document Intelligence settings. Document Intelligence always powers
+ Standard extraction and is required for workspaces and chat file uploads.
+
+
+
+
+
+
+
+
+ {% if content_understanding_supported %}
+
+ Enhanced extraction uses Azure AI Content Understanding, which returns tables,
+ page structure, checkbox states, and AI-generated descriptions of figures, charts, and images.
+ Configure the connection below.
+
+ {% else %}
+
+ Azure AI Content Understanding is not available in the
+ {{ azure_environment }} cloud, so Enhanced extraction uses
+ Document Intelligence Layout here. There is nothing more to configure —
+ Enhanced still captures tables, page structure, forms, and checkbox states.
+
+ {% endif %}
+
+
+
+
+
+ Enhanced captures more document detail for PDFs and images, including tables, page structure, and checked or unchecked marks. It adds latency and has a 6X increase for every 1000 pages when selected.
+
+
+
+
+
+ Auto samples this many first PDF pages with Document Intelligence Layout. If it detects tables, selection marks, or figures, the full PDF uses Enhanced; otherwise it finishes with Standard. Images use Enhanced in Auto mode.
+
+
+
+
Standard: Document Intelligence Read. Fastest and lowest-cost path for plain text PDFs and images.
+
Enhanced: best for tables, section structure, page layout, forms, checkbox states, and figure descriptions. Expect more latency and higher cost.
+
Auto: samples the first pages with Document Intelligence Layout, then uses Enhanced only when the sample shows tables, selection marks, or figures.
+
+
+
+
+
+
+
+
+
+ Captures equations in PDFs and images as LaTeX rather than approximate OCR text. This is a
+ billed Document Intelligence add-on that adds per-page cost to every Enhanced
+ extraction, so it is off by default. It applies to the Layout model only, so it has no effect
+ while extraction is set to Standard.
+
+
+ {% if content_understanding_supported %}
+
+
+
Azure AI Content Understanding
+
+
+
+ Required for Enhanced extraction. Deployed from a Microsoft Foundry resource.
+ If this is left blank, Enhanced falls back to Document Intelligence Layout.
+
+
+
+
+
+
+ Your Microsoft Foundry resource endpoint, without a trailing path.
+
+
+
+
+
+
+
+ Managed identity requires the Cognitive Services User role on the Foundry resource.
+
+ Neither extraction engine describes figures inside Word and PowerPoint files. When this is on,
+ embedded images are pulled out of the file, analyzed with whichever engine backs the selected
+ extraction mode, and indexed as their own citable chunks. This works with Standard extraction
+ too, using Document Intelligence.
+
+
+
+
+
+
+
+
+
+
Images narrower or shorter than this are skipped as icons or spacers.
+
+
+
+
+
Caps per-document cost. Duplicate images are analyzed once.
+
+
+
+
+
+
+
+
+
Standard, Enhanced, and Auto
+
+
+
+
Standard always uses Azure Document Intelligence Read. It is the fastest and lowest-cost path for mostly text-based PDFs and images, and it is what runs when Enhanced extraction is turned off.
+
Enhanced is for documents where structure matters: tables, page layout, headings, forms, checked or unchecked boxes, and figures.
+
+
In Azure commercial clouds, Enhanced uses Azure AI Content Understanding, which additionally generates natural-language descriptions of figures, charts, and diagrams.
+
In Azure Government and custom clouds, Content Understanding is unavailable, so Enhanced automatically uses Document Intelligence Layout instead. Tables and checkbox states still work; figure descriptions do not.
+
If Content Understanding is enabled but unreachable, the document falls back to Document Intelligence Layout and the reason is recorded on the document.
+
+
Auto lets the platform decide per document. It samples the configured number of first PDF pages with Document Intelligence Layout, which is the cheaper detector. If those pages contain tables, selection marks, or figures, the full document is extracted with Enhanced; otherwise it is extracted with Standard. Images always use Enhanced in Auto mode because they are single-page inputs that benefit from figure and spatial analysis.
+
Cost: Enhanced adds latency and cost on every document. Content Understanding also invokes a language model per document, so it is more expensive than Document Intelligence Layout. Auto is usually the best value.
+
+
+
+
+
+
+
+
+
+
+
Set Up Azure AI Content Understanding
+
+
+
+
Content Understanding is part of Microsoft Foundry. Follow these steps, then paste the endpoint and key below.
+
1. Create a Microsoft Foundry resource
+
+ In the Azure portal, create a Microsoft Foundry resource in one of the supported regions:
+ East US, East US 2, West US, West US 3, South Central US, North Europe, West Europe, Sweden Central,
+ UK South, Australia East, Japan East, or Southeast Asia. You need Contributor or higher on the subscription
+ or resource group.
+
+
+ Content Understanding is not offered in Azure Government or other sovereign clouds. In those clouds
+ SimpleChat automatically uses Document Intelligence Layout for Enhanced extraction.
+
+
2. Deploy the models Content Understanding needs
+
+ Analyzers that describe figures require a completion model and an embedding model to be deployed and set
+ as resource defaults. In the
+ Content Understanding settings page,
+ add your Foundry resource and leave
+ Enable autodeployment for required models if no defaults are available checked. Without this step,
+ analysis requests fail with a missing model deployment error.
+
+
3. Copy the endpoint and key
+
+ In the Azure portal, open the Foundry resource and go to
+ Resource Management → Keys and Endpoint. The endpoint looks like
+ https://your-resource.services.ai.azure.com. Paste it into
+ Content Understanding Endpoint, and paste either key into
+ Content Understanding Key.
+
+
4. Or use managed identity instead of a key
+
+ Set Authentication Type to Managed Identity and assign this application's identity the
+ Cognitive Services User role on the Foundry resource. That role assignment is required even
+ for resource owners.
+
+
5. Test the connection
+
+ Use Test Content Understanding Connection to confirm the endpoint, credentials, and analyzer
+ are reachable before saving.
+ See the
+ Content Understanding quickstart
+ for more detail.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Chunk Sizes
+ Cap: {{ chunk_size_cap }}
+
+
Custom chunk sizes apply to new uploads only. Existing documents keep their current chunks.
+
+ Heads up: Overrides are capped at {{ chunk_size_cap }} (2x embedding context window, fallback 16,384).
+
+
+
+
+
+
+
+
+ Chunk sizes above the cap will be reduced automatically.
+
+
+ {% set chunk_settings = chunk_size_settings or {} %}
+ {% set chunk_defaults = chunk_size_defaults or {} %}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Minimum enforced at 50% of target on merge.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Applies to new audio transcripts.
+
+
+
+
+
Pages per chunk after extraction.
+
+
+
+
+
Slides per chunk after extraction.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ AI Video Intelligence
+
+
Extract insights and make video content searchable and interactive
+
+
+
+
+
+
+
+ Make Video Content Fully Searchable: Upload videos to your workspace and automatically extract transcripts, identify speakers, detect topics, and generate searchable timestamps. Your AI can then answer questions about video content, cite specific moments, and provide deep insights.
+
+
+
+
+
+
+
+
+
+ Upload video files (MP4, AVI, MOV, etc.) to workspaces where Azure Video Indexer automatically processes them.
+ Extract spoken content, identify speakers, detect faces, recognize brands, and generate searchable metadata—perfect for meetings, presentations, training videos, and recorded content.
+
Choose the endpoint family that matches your deployed cloud. Use Custom only when you need a non-standard Video Indexer endpoint.
+
+
+
+ Current App Service environment: {{ azure_environment_label }}. This selector saves the Video Indexer API endpoint. If you are switching between Azure Public, Azure Government, or a custom cloud, update AZURE_ENVIRONMENT in your App Service configuration as well.
+
+
+
+ The selected Video Indexer cloud does not match this app's current AZURE_ENVIRONMENT. Update the App Service configuration if you are moving to a different cloud.
+
+
+
+
+
+
+
+
Only required when using a custom cloud or non-standard Video Indexer endpoint.
+
+
+
+
+
+
Saved endpoint value used for Video Indexer API calls.
+
+
+
+
+
+
The Azure resource group containing your Video Indexer account
+
+
+
+
+
+
Your Azure subscription ID
+
+
+
+
+
+
The name of your Video Indexer account resource
+
+
+
+
+
+
Azure region where your Video Indexer account is deployed (e.g., eastus, westus2, northeurope)
+
+
+
+
+
+
Found in the Video Indexer account Overview page in Azure Portal
+
+
+
+
+
+
Default for {{ azure_environment_label }}: {{ default_video_indexer_arm_api_version }}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ AI Voice Conversations
+
+
Transform your AI experience with natural voice interactions
+
+
+
+
+
+
+
+
+
+
+
+
+ Let users opt in to a bundled sound when an AI response finishes outside their active view.
+ These local cues do not require Azure Speech Service.
+
+
+
+
+
+ One Speech resource, three features: Audio file uploads, Voice Input, and Voice Responses all use the same Azure Speech Service section below. Configure the Speech resource once, then turn on whichever speech features you need.
+
+
+
+
+ {% set audio_runtime = audio_runtime_capabilities or {} %}
+ {% set audio_supported_extensions = audio_runtime.supported_extensions or [] %}
+ {% set audio_direct_extensions = audio_runtime.direct_transcription_extensions or [] %}
+
+
+
+
+
+ Upload audio files (MP3, WAV, M4A, etc.) to workspaces where they're automatically transcribed and indexed.
+ The AI can then search, analyze, and answer questions about audio content—perfect for meetings, interviews, lectures, and podcasts.
+
+
+
+ {{ audio_runtime.message or 'Audio runtime support has not been checked yet.' }}
+
+ Without FFmpeg, source-file fallback is best for: {{ audio_direct_extensions|join(', ') }}. Container builds can include FFmpeg for broader codec support.
+
+ {% endif %}
+
+
+
+
+
+
+
+
+
+
+ Talk to your AI instead of typing. Record voice messages up to 90 seconds directly in the chat interface.
+ Azure Speech Service instantly transcribes your speech with high accuracy, supporting multiple languages and accents.
+
+ Hear AI responses read aloud in natural, human-like voices powered by Azure's advanced neural Text-to-Speech.
+ Each message includes a speaker button—click to listen while multitasking, commuting, or whenever reading isn't convenient.
+
Configure the shared Azure Speech resource used by audio transcription, voice input, and text-to-speech.
+
+
+ Shared configuration: These settings apply to all enabled speech features. If you use managed identity and also enable Voice Responses, fill in the Speech Resource ID field so the Speech SDK can authenticate synthesis requests.
+
+
+
+
+
+
Use the resource-specific custom-domain endpoint when selecting Managed Identity.
+
+
+
+
+
+
Required for speech recognition locale defaults and for text-to-speech when using Managed Identity.
+
+
+
+
+ Resource ID builder: If the full ARM resource ID is hard to find in the portal, enter the subscription ID, resource group, and Speech resource name below. Simple Chat can build the resource ID for you.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
If you use a custom-domain Speech endpoint, this is usually the first part of that hostname.
+
+
+
+
+
+
+
Provide Subscription ID, Resource Group, and Speech Resource Name to auto-build the ARM resource ID.
+
+
+
+
Required for Voice Responses when using Managed Identity. You can paste the full value manually, or let the fields above build it for you.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Required only when Authentication Type is set to Key.
+
+
+
+ Managed identity roles: Start with Cognitive Services Speech User. If fast transcription or other write-style speech operations still return authorization errors, add Cognitive Services Speech Contributor. Managed identity also requires a custom-domain endpoint.
+
+
+
+
+
+
+ Enhanced Citations
+
+ will dramatically improve the citation experience for video and audio files.
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/security.html b/application/single_app/templates/admin/_panes/security.html
new file mode 100644
index 00000000..40d43e1a
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/security.html
@@ -0,0 +1,230 @@
+
+
+ Manage security settings for key vault and other security configurations.
+
+
+
+
+ Key Vault
+
+
+
+
+
+ Configure Key Vault settings.
+
+
+
+
+
+
+
+
+
+ ⚠️ Warning: Once you enable Key Vault, you should NOT disable it. Disabling Key Vault after enabling WILL cause loss of access to secrets and break application functionality.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Secret Expiration Reminders
+
+
+ Track SimpleChat-owned Key Vault secrets with expiration dates, in-app reminders, and an admin inventory that maps opaque secret names back to their owner and source.
+
+
+
+
+
+
+ Azure email alerts should still be configured in Azure Monitor or Event Grid for the vault. SimpleChat stores per-secret context so an emailed Key Vault alert can be mapped back to the user, group, action, field, and rotation notes.
+
+
+
+ External automation: SimpleChat emits a queryable Application Insights event named
+ key_vault_expiration_reminder_triggered whenever a reminder notification is created.
+ Use an Azure Monitor scheduled query alert with an action group, Logic App, Function, or webhook to send external notifications. Enable the routing email option below if downstream automation needs to send directly to the configured reminder contact.
+
+ The contact_email column is populated only when the opt-in below is enabled. For workspace-based Log Analytics queries, use the equivalent Application Insights traces table and dimensions/properties fields available in that workspace.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Comma-separated roles for global-scope reminder notifications.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Default off. Enable only when Azure Monitor, Logic Apps, Functions, or webhook automation needs the email address to route notifications directly.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Expires
+
Scope
+
Source
+
Field
+
Contact
+
Status
+
Reminder ID
+
Secret
+
+
+
+
+
Refresh inventory to load tracked secrets.
+
+
+
+
+
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/send-feedback.html b/application/single_app/templates/admin/_panes/send-feedback.html
new file mode 100644
index 00000000..1d9cdb36
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/send-feedback.html
@@ -0,0 +1,72 @@
+
+
+ Prepare a prefilled email draft for bug reports or feature requests. This utility is separate from saved settings and records each submission intent in the activity log before opening your local email client.
+
+
+ Email workflow: This opens a text-only email draft in your local mail client. If you need to share screenshots or files, add them manually after the draft opens.
+
+
+
+
+
+
+ Report a Bug
+
+
Something isn’t working as expected.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Request a Feature
+
+
Suggest an improvement or new capability.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/workspace-identities.html b/application/single_app/templates/admin/_panes/workspace-identities.html
new file mode 100644
index 00000000..da77b91b
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/workspace-identities.html
@@ -0,0 +1,21 @@
+
+
+ Manage the global authentication profiles that File Sync sources and Actions reuse, so credentials stay scoped and are resolved server-side.
+
+
+
+ Global Identities
+
+
+ Identities defined here are available across the deployment. Each one stores its secret in Key Vault when Key Vault is configured, and is referenced by name rather than by value wherever it is used.
+
+
+
+
diff --git a/application/single_app/templates/admin/_panes/workspaces.html b/application/single_app/templates/admin/_panes/workspaces.html
new file mode 100644
index 00000000..3bf8d4aa
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/workspaces.html
@@ -0,0 +1,1138 @@
+
+
+ Configure workspace settings like personal/group access, multimedia support, metadata, and document classification.
+
+
+
+
+
+ Personal Workspaces
+
+
+ Turn this on to allow access and management of your personal workspace.
+
+
+
+
+
+
+
+
+
+
+ Workflow
+
+
+ Control personal and group workflow authoring and execution for users.
+
+
+
+
+
+
+
+
+
+
+
+
+ Required app role value: WorkflowUser. Assign this role to users or groups in the Enterprise App before enabling the requirement.
+
+
+
+
+
+
+ Maximum automatic tool or action calls an agent can make during one workflow run. Default is 60; increase for large document sets.
+
+
+ Values above 100 are capacity-sensitive. Enable Cosmos DB Throughput automation in SimpleChat so the app can monitor RU pressure and scale up Cosmos when needed, and also monitor Azure OpenAI throttling, App Service CPU and memory, and downstream service latency.
+
+
+
+
+
+
+
+ Maximum ordered instruction tasks users can add to one workflow. Default is 50; supported range is 1-100.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ No groups assigned.
+
+
+
+ Group workflow authoring is available to group Owners and Admins by default. Enable the owner-only setting below to limit group agent, action, and workflow management to Owners.
+
+
+
+
+
+ File Downloads
+
+
+ Control when users can download original workspace document files from personal, group, and public workspaces.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ No groups assigned.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ No public workspaces assigned.
+
+
+
+
+
+
+
+
+
+
Group Workflow Assignments
+ Choose which groups can use group workflows when assignment is required.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
No groups loaded.
+
+
+
+
+
Group
+
Description
+
Assignment
+
+
+
+
+
Search for groups to assign.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
File Download Group Assignments
+ Choose which groups can download files when group assignment is required.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
No groups loaded.
+
+
+
+
+
Group
+
Description
+
Assignment
+
+
+
+
+
Search for groups to assign.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
File Download Public Workspace Assignments
+ Choose which public workspaces can download files when public workspace assignment is required.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Enter at least 2 characters to search.
+
+
+
+
+
Public Workspace
+
Description
+
Assignment
+
+
+
+
+
Search for public workspaces to assign.
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Group Workspaces
+
+
+ Turn this on to allow access and management of group workspaces, as well as group collaboration features.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ When enabled, no users will be able to create new groups, regardless of app role assignment. This global setting overrides the Require CreateGroups App Role setting below.
+
+
+
+
+
+
+
+
+ Required app role value: CreateGroups. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create groups while group workspaces and group creation are enabled.
+
+
+
+
+
+
+
+
+
+
+
+ If enabled, only the group Owner can create, edit, and delete group agents, group actions, and group workflows. Admins and other roles will only be able to view them.
+
+
+
+
+
+
+
+ Public Workspaces
+
+
+ Turn this on to enable public workspaces that are visible to everyone in the organization.
+
+
+
+
+
+
+
+
+
+
+
+ Optional. End users will see this label instead of Public Workspace. Admin settings and internal references continue to use Public Workspace.
+
+
+
+
+
+
+
+
+
+
+
+ Required app role value: CreatePublicWorkspaces. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create public workspaces while public workspaces are enabled.
+
+
+
+
+
+
+
+ File Sharing
+
+
+ Turn this on to enable file sharing capabilities between users and workspaces.
+
+
+
+
+
+
+
+
+
+
+ Chat File Uploads
+
+
+ Control whether users can upload files directly into chat conversations.
+
+
+
+
+
+
+
+
+
+ Conversation Contents Drawer
+
+
+ Let users navigate long conversations from a list of their prompts.
+
+
+
+
+
+
+
+ When enabled, users can turn the drawer off for their own account from Profile settings.
+
+
+
+
+
+
+
+
+ Required app role value: ChatFileUploadUser. Assign this role to users or groups in the Enterprise App before enabling the requirement. Existing chat attachments remain visible; this only controls new uploads.
+
+
+
+
+
+ Metadata Extraction
+
+
+ Enable this to automatically parse and store file metadata for advanced indexing and search.
+
+
+
+
+
+
+
+
+
+
+
+
+ Uses Global Endpoints when multi-endpoint model management is enabled; otherwise uses the legacy GPT/APIM deployment settings.
+
+
+
+
+
+
+
+ Multi-Modal Vision Analysis
+
+
+ Enable AI-powered vision analysis for images uploaded to chat or workspace. When enabled alongside Document Intelligence OCR, images will receive both text extraction (OCR) and semantic understanding (vision AI).
+
+
+
+ How it works:
+
+
Document Intelligence: Extracts text from images (OCR)
+
Vision Model: Provides semantic analysis, object detection, and contextual understanding
+
Both analyses are combined and available in citations when Enhanced Citations is enabled
+
+
+
+
+
+
+
+
+
+
+
+
+
Select a GPT model with vision capabilities (for example, gpt-4o or supported GPT 5 and later models). Only vision-capable models are shown.
+
+
+
+
+
+
+
+
+
+
+ Document Classification
+
+
+ Enable this feature to allow users to classify documents uploaded to their workspaces using predefined categories.
+
+
+
+
+
+
+
+
+
+
Classification Categories
+
Define the labels and corresponding colors for document classification.
+
+
+
+
Label
+
Color
+
Actions
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Retention Policy
+
+
Automatically delete aged conversations and documents based on configurable retention periods. Users, group owners, and public workspace admins can set their own retention policies.
+
+
+
+ How it works: Enable retention policy for workspace types below. Users/owners can then configure how many days to retain conversations and documents. Items older than the configured period are automatically deleted. Default is "none" (no deletion) until explicitly set by each user/owner.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Default Retention Policies
+
Set organization-wide default retention periods for each workspace type. Users can override these defaults with their own preferences. Setting a default here means new users/workspaces will start with this retention period.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Force Push: Override all user/group/workspace custom retention policies with the organization defaults above. Users will then use the organization default until they set their own preference.
+
+
+
+
+
+
+
+
+
+
+ Retention policy will run once daily at this hour (UTC timezone).
+
+
+
+
+
+
+
+ {% if settings.retention_policy_last_run %}
+ {{ settings.retention_policy_last_run }}
+ {% else %}
+ Never run
+ {% endif %}
+
+
+
+ Trigger retention policy execution immediately for selected workspace types, bypassing the scheduled time.
+
+
+
+
+
+ Important: Deleted items respect your archiving settings. If conversation archiving is enabled, items will be archived before deletion. Activity logs are created for all deletions.
+
+
+
+
+
+
+ Workspace Scope Lock
+
+
+ Control whether users can unlock workspace scope in chat conversations. When scope is locked, conversations are restricted to the workspaces that produced search results, preventing accidental cross-contamination with other data sources.
+
+
+
+
+
+
+
+
+
+
+
+ User Agreement
+
+
+ Configure a user agreement that users must accept before uploading files.
+ Supports Markdown formatting.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Select where the user agreement should be shown (at least one required):
- Manage security settings for key vault and other security configurations.
-
-
-
-
- Key Vault
-
-
-
-
-
- Configure Key Vault settings.
-
-
-
-
-
-
-
-
-
- ⚠️ Warning: Once you enable Key Vault, you should NOT disable it. Disabling Key Vault after enabling WILL cause loss of access to secrets and break application functionality.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Secret Expiration Reminders
-
-
- Track SimpleChat-owned Key Vault secrets with expiration dates, in-app reminders, and an admin inventory that maps opaque secret names back to their owner and source.
-
-
-
-
-
-
- Azure email alerts should still be configured in Azure Monitor or Event Grid for the vault. SimpleChat stores per-secret context so an emailed Key Vault alert can be mapped back to the user, group, action, field, and rotation notes.
-
-
-
- External automation: SimpleChat emits a queryable Application Insights event named
- key_vault_expiration_reminder_triggered whenever a reminder notification is created.
- Use an Azure Monitor scheduled query alert with an action group, Logic App, Function, or webhook to send external notifications. Enable the routing email option below if downstream automation needs to send directly to the configured reminder contact.
-
- The contact_email column is populated only when the opt-in below is enabled. For workspace-based Log Analytics queries, use the equivalent Application Insights traces table and dimensions/properties fields available in that workspace.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Comma-separated roles for global-scope reminder notifications.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Default off. Enable only when Azure Monitor, Logic Apps, Functions, or webhook automation needs the email address to route notifications directly.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Expires
-
Scope
-
Source
-
Field
-
Contact
-
Status
-
Reminder ID
-
Secret
-
-
-
-
-
Refresh inventory to load tracked secrets.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Configure AI agents and actions for enhanced functionality. Agents provide AI-driven task automation while Actions extend functionality with custom tools and integrations.
-
-
-
-
- Agent model lifecycle review lives in AI Models.
-
-
- Use AI Models to review inherited agents, selectively override explicit agent model choices, and move agents to newer default models as costs or model releases change.
-
-
-
-
-
-
- Note: All changes to global agents and actions require a restart of the web app to take effect.
-
-
- {% set analyze_capability = settings.document_action_capabilities.analyze %}
- {% set comparison_capability = settings.document_action_capabilities.comparison %}
-
-
-
-
Document Action Capabilities
-
Configure the document actions shown in the Action dropdown in Chat and Workflow. These controls live in the Agents and Actions tab, but remain separate from the global agent and custom action cards below.
-
- Chat: 2-300 | Workflow: 2-1000
-
-
- Use these settings to explicitly allow Analyze and Document Comparison in the Chat and Workflow Action dropdowns without bundling them into the global agent or custom action configuration cards below.
-
- Configure custom actions and tools to extend functionality with integrations and specialized capabilities.
-
-
- {% if not settings.enable_semantic_kernel %}
-
- Actions are not available while agents are disabled. Enable agents above to configure actions.
-
- {% else %}
-
-
-
Global Actions
-
-
-
Disable a global action to keep the configuration without exposing it to runtime action loading until it is re-enabled.
- {% if settings.per_user_semantic_kernel %}
-
-
-
Workspace Action Feature Toggles
-
-
-
-
-
-
-
-
-
-
-
-
-
- {% endif %}
-
-
-
-
Core Action Toggles
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Tabular Processing Action
-
-
- Automatically enabled when Enhanced Citations is enabled
-
-
-
-
-
-
Display Name
-
Description
-
Actions
-
-
-
-
-
- {% endif %}
-
- {% if mcp_ui_enabled %}
-
-
-
-
- Inbound MCP Server
-
-
- Configure the governed SimpleChat MCP endpoint used by external MCP clients. Personal tools use delegated user tokens by default; tool access remains deny-by-default until authentication, source, client, and governance policy all allow the request.
-
-
-
- Preview
-
-
-
-
-
- Enable only after the Microsoft Entra delegated scope, delegated user app role, client app allowlist, source allowlist, and SimpleChat governance item policies are configured. Personal MCP tools require delegated user context plus an assigned user role. The app-only role is reserved for future non-personal service/admin tools.
-
-
-
-
-
-
Runtime Gate
-
-
-
-
-
-
-
-
-
Default: DelegatedMcpServerAccess. VS Code and other user clients must present this delegated scope.
-
-
-
-
-
Default: InboundMCPUserAccess. Governance determines which users/groups can use tools after this Entra role and delegated scope pass.
-
-
-
-
-
Default: InboundMCPAppAccess. Reserved for future app-only MCP tools and still governed separately.
-
-
-
-
-
-
-
Endpoint Contract
-
-
MCP endpoint
-
{{ inbound_mcp_resource_path }}
-
Protected resource metadata
-
{{ inbound_mcp_prm_path }}
-
Transport
-
Streamable HTTP JSON-RPC
-
Current tool surface
-
Personal delegated tools only.
-
Tool identity
-
Delegated user token required for personal data.
-
-
- Endpoint paths are fixed in application routing for this initial UI slice. Change the app setting below for the source header only.
-
-
-
-
-
-
-
-
-
Request Size & Throttling
-
Protect the inbound MCP endpoint from oversized payloads and noisy clients. Rate limits are enforced per caller and tool category across app instances.
-
-
-
-
-
-
-
-
-
-
-
Default: 65536. Range: 1 KB to 1 MB.
-
-
-
-
-
Default: 60. Applies to each throttle category.
-
-
-
-
-
Default: 120.
-
-
-
-
-
Default: 30.
-
-
-
-
-
Default: 10.
-
-
-
- Application Insights events include mcp_request_id, caller app, delegated user, source, tool, duration, result status, and rate-limit category without recording prompts, document content, bearer tokens, or secrets.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Allowed client app IDs
-
Required allowlist. Empty means no MCP clients can connect.
-
-
-
-
-
-
-
-
Client app ID
-
Description
-
Actions
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Off allows only the configured SimpleChat tenant. Turning this on auto-includes the SimpleChat tenant and lets admins add more tenants.
-
-
-
-
Allowed tenant IDs
-
-
-
-
-
-
-
Tenant ID
-
Description
-
Actions
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Default on accepts any source signal at the runtime allowlist layer. Turn off to require explicit source values here. In both modes, admins must still create an inbound MCP source governance policy before tools are returned.
-
-
-
-
-
Default: X-SimpleChat-MCP-Source.
-
-
- Source IDs are read from the configured header when present. This is a client-provided value and can be spoofed unless a trusted gateway, APIM policy, or similar control sets/enforces it.
-
-
-
-
- Create an inbound_mcp_source policy for * to choose which users or groups can use inbound MCP from any accepted source.
-
-
-
-
-
-
-
- After adding allowed source IDs, create an inbound_mcp_source policy for * or a specific source to choose which users or groups can use inbound MCP.
-
-
-
-
-
-
-
Allowed source IDs
-
-
-
-
-
-
-
Source value
-
Description
-
Actions
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Add MCP Entry
-
-
-
-
-
-
-
-
-
Value is required.
-
-
-
-
-
Use descriptions to explain who owns this app, tenant, or source value without making the value easy to guess.
-
-
-
-
-
-
-
-
-
-
-
Inbound MCP overview
-
-
-
-
- SimpleChat exposes a governed Streamable HTTP MCP endpoint for approved external MCP clients. Authentication handles tenant, client, delegated scope, and Entra role checks; governance decides which users/groups and source IDs can use tools.
-
-
-
-
Runtime checks
-
-
Client app ID must be in the allowed client list.
-
Tenant must be the SimpleChat tenant unless additional tenants are enabled.
-
Delegated personal tools require the configured scope and user role.
-
Governance uses inbound_mcp_source policies to decide which users or groups can use each accepted source.
-
-
-
-
Source header guidance
-
- The configured source header is an advisory control-plane signal. Treat it like an APIM subscription-key label, not strong identity. For stronger assurance, set or overwrite it at a trusted gateway and avoid relying on client-provided values alone.
-
-
-
-
Available MCP tools
-
-
-
-
-
Tool
-
Scope
-
Operation
-
Description
-
-
-
- {% for tool in inbound_mcp_tools %}
-
-
-
{{ tool.display_name }}
- {{ tool.id }}
-
-
{{ tool.scope }}
-
{{ tool.resource_family }} / {{ tool.operation }}
-
{{ tool.description }}
-
- {% endfor %}
-
-
-
-
-
Application Insights starter queries
-
- Use these KQL queries in Application Insights Logs to validate inbound MCP traffic, denials, and tool latency. They rely on safe structured dimensions emitted by the inbound MCP route and do not require prompt, message, document, token, or secret values.
-
-
-
-
-
-
-
-
-
-
traces
-| where timestamp > ago(24h)
-| where message has "[InboundMCP]"
-| summarize requests=count(), failures=countif(tostring(customDimensions.result_status) !in ("", "success", "accepted")) by bin(timestamp, 1h)
-| order by timestamp desc
-
-
-
-
-
-
-
-
-
-
-
traces
-| where timestamp > ago(24h)
-| where message has "[InboundMCP]"
-| where isnotempty(tostring(customDimensions.error_type))
-| summarize events=count() by tostring(customDimensions.error_type), tostring(customDimensions.caller_app_id), tostring(customDimensions.source_id)
-| order by events desc
-
-
-
-
-
-
-
-
-
-
-
traces
-| where timestamp > ago(24h)
-| where message has "Inbound MCP tool call"
-| where isnotempty(tostring(customDimensions.tool_id))
-| summarize calls=count(), avg_duration_ms=avg(todouble(customDimensions.duration_ms)), p95_duration_ms=percentile(todouble(customDimensions.duration_ms), 95) by tostring(customDimensions.tool_id), tostring(customDimensions.result_status)
-| order by calls desc
-
-
-
-
-
-
-
-
-
-
-
traces
-| where timestamp > ago(24h)
-| where message has "Inbound MCP tool call denied by rate limit"
-| summarize denials=count() by tostring(customDimensions.rate_limit_category), tostring(customDimensions.tool_id), tostring(customDimensions.caller_app_id)
-| order by denials desc
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Verify App Service Authentication exclusions
-
-
-
-
- Required before enabling inbound MCP:
- If Azure App Service Authentication redirects unauthenticated requests, add excluded paths so MCP clients can discover protected resource metadata and so SimpleChat can enforce bearer-token MCP access itself.
-
-
- Run the following PowerShell with Azure CLI from Azure Cloud Shell or any authenticated terminal. SimpleChat pre-fills the script from this App Service's environment when possible.
-
Attempts to verify that the SimpleChat API app exposes the required delegated scope and inbound MCP app roles.
-
Uses SimpleChat's Resource Manager endpoint for public, government, or custom clouds.
-
Creates a timestamped backup of current authsettingsV2 before applying changes.
-
-
-
-
- {% if inbound_mcp_easy_auth_script_context.missing_values %}
-
- SimpleChat could not derive every required value. Replace the placeholders in the script before running it:
- {{ inbound_mcp_easy_auth_script_context.missing_values | join(", ") }}.
-
- {% endif %}
- {% if inbound_mcp_easy_auth_script_context.scope_check_missing_values %}
-
- SimpleChat could not derive every value needed for the delegated-scope and role preflight. Replace these placeholders if you want the script to validate the app registration before changing Easy Auth:
- {{ inbound_mcp_easy_auth_script_context.scope_check_missing_values | join(", ") }}.
-
- {% endif %}
- {% if inbound_mcp_easy_auth_script_context.uses_custom_cloud_match %}
-
- This deployment uses a custom Azure environment. The script searches your registered Azure CLI clouds for one with the same Resource Manager endpoint. If none is registered, register the custom cloud first and rerun the script.
-
- {% endif %}
-
-
-
{{ inbound_mcp_easy_auth_script }}
-
-
- The verification checks these public unauthenticated endpoints and expects SimpleChat JSON responses, not Microsoft sign-in HTML:
-
-
/.well-known/oauth-protected-resource
-
/.well-known/oauth-protected-resource/api/mcp
-
/.well-known/oauth-protected-resource/mcp
-
/.well-known/oauth-authorization-server
-
/api/mcp
-
/api/mcp/health
-
-
-
-
-
-
-
-
-
-
-
-
-
- {% endif %}
-
-
-
-
-
-
-
- Configure governance enforcement for endpoint, agent, and action creation or usage. Governance is disabled by default and only enforced when toggled on.
-
-
-
-
-
-
- Governance Feature Toggles
-
-
Turn on governance checks for each feature area. Save with the main Settings button to persist these toggles.
-
-
-
-
Personal Scope
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Group Scope
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Global Scope
-
-
-
- Always On
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- MCP Action Destination Governance
-
-
- Restrict outbound remote MCP servers by destination pattern and scope. Destination policies reuse delegated item policies, so admins can allow all users, specific users, or workspace groups for each approved destination.
-
-
-
-
-
-
-
-
-
-
-
-
- Save with the main Settings button. Unsafe literal-IP blocking can be enabled even before the allowlist is enforced.
-
-
-
-
Supported destination patterns
-
-
* for any remote MCP destination after identity/auth checks.
-
preconfiguration:microsoft_learn or preset:generic.
-
*.contoso.com, https://example.com/mcp*, or transport:streamable-http.
-
group:<group-id>::preconfiguration:github for one group-specific override.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Inbound MCP Source Governance
-
-
- Control which delegated users and groups can use SimpleChat as an inbound MCP server through source-scoped policies.
-
-
- Quick-create inbound MCP policies open in restricted user/group mode by default. Only use "Allow all users" when every delegated user with the required Entra role and delegated scope should be able to satisfy that policy.
-
-
-
-
Policy required for inbound MCP
-
-
inbound_mcp_source with delegated item *: allows selected users or groups to use any accepted source ID.
-
inbound_mcp_source with a configured source ID: allows selected users or groups to use only requests with that source value.
-
-
- Client, tenant, delegated scope, and Entra role checks remain in Inbound MCP configuration. The source ID comes from the configured header when present and is advisory unless a trusted gateway sets or validates it.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Feature Policies
-
-
-
Set allow-all, explicit allow lists, and block lists for each governed feature. Block lists override allow settings.
-
-
-
-
-
Feature
-
Allow All
-
Allow List
-
Block List
-
-
-
-
-
-
-
-
-
-
Delegated Item Policies
-
-
-
-
-
-
Manage delegated governance for configured global resources and action type entitlements that admins assign to specific users or groups.
-
- Delegated item policies are OR combined allow lists with optional block lists. Blocked users and groups are denied even when Allow All or another allow list would grant access.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Policy
-
Entity Type
-
Item
-
Allow All
-
Actions
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Configure logging settings for monitoring, debugging, and auditing purposes. These settings control various types of logging throughout the application including application insights, debug messages, and file processing events.
-
-
-
-
- Application Insights Logging
-
-
Enable global logging to Application Insights for all agents and orchestration events.
-
-
-
-
-
-
- Note: Changing this setting requires an application restart to take effect.
-
-
-
-
-
- Debug Logging
-
-
Control debug print statements across the application for development and troubleshooting.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- {% if settings.debug_logging_turnoff_time %}
- {% if settings.debug_logging_turnoff_time is string %}
- {{ settings.debug_logging_turnoff_time }}
- {% else %}
- {{ settings.debug_logging_turnoff_time.strftime('%Y-%m-%d %H:%M:%S') }}
- {% endif %}
- {% else %}
- Will be calculated when saved
- {% endif %}
-
-
-
-
-
-
- Info: This controls all DEBUG print statements throughout the application. Useful for development and troubleshooting. Tokens and keys will be collected during this process.
-
-
-
-
-
- File Process Logging
-
-
Enable logging of file processing events for debugging and auditing purposes. Logs are stored in the file_processing container in Cosmos DB.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- {% if settings.file_processing_logs_turnoff_time %}
- {% if settings.file_processing_logs_turnoff_time is string %}
- {{ settings.file_processing_logs_turnoff_time }}
- {% else %}
- {{ settings.file_processing_logs_turnoff_time.strftime('%Y-%m-%d %H:%M:%S') }}
- {% endif %}
- {% else %}
- Will be calculated when saved
- {% endif %}
-
-
-
-
-
-
-
-
Delete stored logs
-
- Permanently remove file processing logs from Cosmos DB. One month is treated as 30 days.
-
-
-
-
-
-
- Enter a whole number greater than zero.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Configure general application settings, including the application's title, logo, and landing page text.
-
-
-
- Branding
-
-
- Configure your application's title, logo, and branding elements.
-
-
- Adjust the logo size on the home page only. This does not change the logo size in the top or sidebar navigation.
-
-
-
-
-
- This logo will be displayed in light mode and stored at up to 500px tall so the main page can render it sharply without keeping oversized assets in settings.
-
-
-
-
- This logo will be displayed in dark mode. If not provided, the light mode logo will be used in both themes. Dark logos are also stored at up to 500px tall.
-
-
-
-
- Recommended: 16x16 or 32x32 pixel png or jpg or ico.
-
-
-
-
-
- Home Page Text
-
-
Configure the text content displayed on your application's home page using Markdown formatting.
-
-
-
-
- Choose how the landing page markdown is aligned on the home page.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Appearance
-
-
Configure the app appearance and theme settings.
-
-
-
-
-
-
-
-
-
Users can still toggle dark mode individually from the navigation bar.
-
-
-
-
-
-
-
-
-
-
Users can still toggle the left navigation sidebar individually from the header.
-
-
-
-
-
-
- Health Check
-
-
-
-
Configure health check endpoint for external monitoring systems.
-
-
-
-
-
-
-
Authenticated Endpoint
-
Use when your monitoring system can reach a protected route and you want the endpoint governed by the normal app access boundary.
-
- Protected
-
-
-
-
-
-
-
Best for internal monitors or diagnostics tooling that already authenticates to the application.
-
-
-
-
-
-
-
Unauthenticated Endpoint
-
Use when a platform health probe cannot sign in and only needs a lightweight availability response.
-
- No Auth
-
-
-
-
-
-
-
- Security note: This route is intentionally unauthenticated. Only enable it for trusted health probes or controlled network paths.
-
Configure automatic OpenAPI/Swagger documentation for API endpoints.
-
-
-
-
-
-
-
- Provides interactive API documentation, endpoint testing, and schema validation.
- Useful for developers, API integration, and system troubleshooting.
-
-
-
-
-
- Classification Banner
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- {{ settings.classification_banner_text or 'Banner Preview' }}
-
-
-
-
-
-
- Chat AI Notice
-
-
- Display an administrator-provided reminder directly below the chat input, such as guidance that responses are AI-generated and should be reviewed.
-
-
-
-
-
-
-
-
-
-
Plain text only. Line breaks are preserved.
-
-
-
-
-
Changing the notice text or display behavior creates a new message version and shows it again.
-
-
-
-
-
-
- Terms of Use
-
-
- Require users to accept the Terms of Use before using SimpleChat. Standard Microsoft sign-in users see it before authentication; Teams SSO and other passive sign-in flows are gated immediately after the app session is created.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Changing the title, message, or frequency creates a new terms version that users must accept again.
-
-
-
-
-
-
- Plain text is shown to users with line breaks preserved.
-
-
-
-
-
- Use a local path such as / or an admin-approved HTTP(S) URL. Signed-in users are locally logged out before this redirect.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Tracking: Every-session acceptance is stored in the Flask session. Daily and once-per-version acceptance are stored in user settings, and accepted or declined events are written to the activity log when the user identity is known.
-
-
-
-
-
- Support
-
-
-
-
-
-
-
When enabled, users can access Support destinations like Send Feedback and Latest Features directly from navigation.
-
-
-
-
-
- This name will appear in user navigation as the Support menu title.
-
-
-
-
-
-
-
-
-
-
-
- User Send Feedback drafts will be addressed to this internal email address.
-
-
-
-
-
-
-
-
-
-
User-Facing Latest Features
-
Choose which recent features are shared on the user Latest Features page. Deployment and Redis start unchecked because they are mainly admin-facing rollout and infrastructure topics.
-
-
-
-
- When enabled, user-facing Latest Features cards can show public guide buttons in addition to the direct in-app shortcuts.
-
- {% for release_group in support_latest_feature_release_groups %}
- {% set checklist_collapse_id = release_group.collapse_id ~ 'Checklist' %}
-
-
-
-
-
{{ release_group.label }}{% if release_group.release_version %}v{{ release_group.release_version }}{% endif %}
-
{{ release_group.description }}
-
- {% if not release_group.default_expanded %}
-
- {% endif %}
-
-
-
- {% for feature in release_group.features %}
-
-
-
-
-
-
- {% endfor %}
-
-
-
-
- {% endfor %}
-
-
-
-
-
-
- External Links
-
-
-
-
-
-
-
When enabled, external links will be displayed in the navigation bar for easy access to external resources.
-
-
-
-
-
- This name will appear in the navigation bar as the menu title.
-
-
-
-
-
-
- When enabled, external links will always display as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu.
-
-
-
External Links
-
Define custom links that will appear in the navigation bar for users to access external resources.
-
-
-
-
-
Label
-
URL
-
Actions
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- System Settings
-
-
- System-level settings that control application behavior, including file size limits, conversation history,
- and default prompts.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Users are logged out locally after this many minutes of inactivity. Minimum value: 10 minutes.
-
-
-
-
- Show the warning modal after this many minutes of inactivity. Set this equal to the logout timeout to disable the warning dialog window.
-
-
-
-
- Custom text shown at the top of the idle warning dialog.
-
-
-
-
-
-
-
-
- Shown to signed-in users who lack the required roles. Use Enter for line breaks.
-
-
-
-
-
-
-
- Review the main capabilities introduced in v{{ config['VERSION'] }} and use this page as an admin-facing overview for what to highlight with your teams.
-
-
- This tab is intentionally curated. It groups related improvements together and mirrors a small number of high-impact settings so admins can enable them from the same overview.
-
-
- {% for release_group in admin_latest_feature_release_groups %}
- {% if release_group.id == 'current_release' %}
-
The badge next to the Admin Settings version number shows whether this admin instance is registered for latest release and community call notifications.
This makes long-running responses more reliable for users who navigate into other areas of the app before generation finishes.
-
-
Completion notifications deep-link back into the finished conversation.
-
Unread markers remain visible until the response is actually opened.
-
Personal, workspace, and navigation flows now behave more consistently while chat completion continues in the background.
-
-
-
-
-
-
-
-
-
-
-
-
-
- Multi-Endpoint GPT Selection
-
-
Admins can expose multiple GPT choices across Azure OpenAI and Azure AI Foundry, set a saved default fallback model, and now review agent rebinding in a modal before applying changes.
This is the high-value admin control for teams that want broader GPT choice without locking every workflow to a single deployment.
-
-
Configure multiple model endpoints and choose which GPT deployments are available to users.
-
Set a default fallback model so summarization, agent requests, and other background flows still resolve a usable GPT when an explicit selection is missing.
-
Use the admin-only Agent Default Model Review modal to inspect inherited agents, search and filter large agent sets, and explicitly choose which review rows should be overridden to the saved default.
-
-
- Admin-only workflow: The review modal is intended for administrators who need to standardize agents on a new default model, control cost, or intentionally replace older explicit bindings as new models are released.
-
-
- Review endpoint and fallback configuration in the AI Models tab.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Tabular Data Analysis
-
-
Enhanced citations now unlock a more consistent tabular analysis experience for normal chat and workspace-backed files, not just dedicated agent scenarios.
This is the highest-impact settings area to mirror here because it combines storage-backed citations, tabular previews, and consistent behavior across workspace and chat uploads.
-
-
Tabular files can be analyzed with the same core approach whether they come from chat uploads or any workspace container.
-
Enhanced citations provide the blob-backed dependency for richer tabular processing and citation transparency.
-
Admins can right-size tabular preview limits based on the memory profile of their runtime.
-
-
- These controls mirror the saved values in the Citations tab.
-
-
-
-
-
-
-
-
-
All filetypes
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Tabular Preview Limits
-
-
-
-
- Mirror of the Citations setting. Larger values support bigger previews but increase runtime memory pressure.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Citation Improvements
-
-
Conversation history citation replay and citation amplification keep more grounded evidence available across follow-up turns without making the chat history unwieldy.
These improvements make follow-up questions more reliable because the system can reuse prior grounded evidence instead of relying only on the assistant's last prose response.
-
-
Conversation history citations carry forward prior citation summaries so later prompts can reuse earlier grounded results.
-
Citation amplification keeps richer supporting payloads available for inspection and export while keeping prompt history compact.
-
This is especially useful for larger or tabular outputs where users often ask multiple follow-up questions against the same evidence chain.
-
-
- These improvements complement the Citations configuration and the enhanced-citation storage flow.
-
-
-
-
-
-
-
-
-
-
-
-
-
- Document Revisioning and Management
-
-
Uploading a document with the same name now creates a new revision instead of overwriting the previous file, while older versions remain available for traceability and later analysis.
Admins can enable this once and let users see more of the model pipeline, including sending, generating, and responded states with clearer timing information.
-
- This toggle mirrors the saved value in the AI Models tab.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Fact Memory
-
-
Users can now save Instructions and Facts on their profile so the assistant can apply durable preferences every time and recall relevant personal context only when needed.
This is useful for teams standardizing on Key Vault-backed secret storage while still using Redis for cache and session scenarios.
-
-
Use Redis authentication type Key Vault when you want the stored value to represent a secret name instead of a raw Redis key.
-
This works best when Key Vault is already configured for the app.
-
-
- These controls mirror the saved values in the Scale tab.
-
-
-
-
-
-
-
-
-
Redis Cache Settings
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- When using Key Vault, store the secret name here instead of the raw Redis key.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Send Feedback to the SimpleChat Team
-
-
Admins now have a dedicated Send Feedback tab for bug reports and feature requests that opens a prefilled email draft and writes an audit record to the activity log.
- Support is now configurable from the General tab so admins can choose exactly what users see.
-
-
-
Admins can enable or disable the Support menu and rename it for user navigation.
-
Send Feedback now routes users to an internal recipient email address defined by admins.
-
The user-facing Latest Features page can be curated feature-by-feature so teams only share the items they want visible.
-
The General tab now includes a dedicated User-Facing Latest Features checklist so admins can quickly confirm which announcements will be visible to end users.
- These were the headline user-facing items in the earlier v{{ release_group.release_version }} release set. Keeping them here gives admins a simple previous-and-archive release view without mixing older items into the current release list.
-
-
- {% for feature in release_group.features %}
-
-
-
-
-
-
{{ feature.title }}
-
{{ feature.summary }}
-
-
- {% if settings.support_latest_features_visibility.get(feature.id, true) %}Shared with Users{% else %}Hidden from Users{% endif %}
-
-
-
{{ feature.details }}
- {% if feature.guidance %}
-
- {% for tip in feature.guidance %}
-
{{ tip }}
- {% endfor %}
-
- {% endif %}
- {% if feature.images %}
-
- {% for image in feature.images %}
-
- {% endfor %}
-
Visibility still comes from General > User-Facing Latest Features, so admins can keep previous and archived release content available without promoting every item forever.
-
-
-
- {% endif %}
- {% endfor %}
-
-
-
-
- Enable trusted deployment-time custom pages and manage metadata for simple static pages served from the application custom_pages folders.
-
-
-
-
-
- Custom Pages
-
-
-
-
-
-
-
-
-
-
When disabled, /custom routes return Not Found before loading custom metadata, files, or Python extensions.
-
-
-
-
-
- This name appears when custom pages are grouped into a menu.
-
-
-
-
-
- When disabled, 1-2 custom pages show as top-level nav items and 3+ pages show as a menu.
-
-
-
-
-
Static Page Metadata
-
Create metadata contracts for simple pages that use files from custom_pages/html, css, js, assets, and json.
-
-
-
-
-
-
-
-
-
-
-
-
Slug
-
Title
-
Type
-
Access
-
Roles
-
Status
-
Nav
-
Actions
-
-
-
-
-
Loading custom pages...
-
-
-
-
-
-
-
-
-
-
-
-
- Configure all AI model settings including GPT for text generation, embeddings for semantic search, and image generation capabilities.
-
-
-
-
- Model Endpoints
-
-
- Manage multiple AI model endpoints (Azure OpenAI and Azure AI Foundry). When enabled, model selection in chat is driven by these endpoints.
-
-
- {% if not settings.enable_multi_model_endpoints %}
-
- Review local agents in a modal, bulk-bind inherited agents to the saved default model endpoint, and explicitly override selected agent model choices when you need to manage cost or move to newer models.
-
-
-
-
-
-
-
- {% if settings.enable_multi_model_endpoints %}
- Save your AI model settings before reviewing or migrating agents.
- {% else %}
- Enable multi-endpoint model management to review and rebind agents to a saved default model.
- {% endif %}
-
- Open the review modal to search, filter, and selectively rebind agents to the saved default model.
-
-
-
-
-
-
-
-
-
Agent Default Model Review
-
- Search, filter, and explicitly choose which agents should adopt the saved default model. Manual review rows are never selected automatically.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
No agents selected.
-
-
-
-
-
Select
-
Scope
-
Agent
-
Status
-
Current Binding
-
Reason
-
-
-
-
-
Run a review to load migration candidates.
-
-
-
-
-
-
-
-
-
- {% else %}
-
-
-
-
Agent Default Model Review
-
- Enable Agents first to use default-model review in AI Models. Once enabled, admins can use it to move inherited agents to new defaults, selectively override explicit agent model choices, and manage costs as models evolve.
-
-
-
-
-
- {% endif %}
-
-
-
-
-
Model Endpoint Identity Header
-
- Send a stable HMAC-hashed user key to model endpoint backends for APIM counters, quota policies, or routing policies.
-
-
-
-
-
-
-
-
-
-
-
-
Reserved auth/protocol headers cannot be used.
-
-
-
-
-
The selected identity is HMAC-hashed before leaving SimpleChat. Missing identity values omit the header.
-
-
-
-
-
-
-
-
- Used for tasks such as conversation summarization, fallback, and other operations when an agent is selected.
-
-
-
-
-
-
-
-
-
Global Endpoints
-
-
-
-
-
-
-
-
-
-
Name
-
Provider
-
Selected Models
-
Status
-
Actions
-
-
-
-
-
-
-
-
- {% if not settings.enable_multi_model_endpoints %}
-
- {% endif %}
-
-
-
-
-
- Processing Thoughts
-
-
When enabled, real-time processing steps are shown to users during chat responses and persisted for later review.
-
-
-
-
-
-
-
-
-
-
- Shared Conversation File Approvals
-
-
Files generated by participants in a shared conversation are saved into the conversation owner's storage. When enabled, those files are held until an approver releases them.
-
-
-
-
-
-
-
-
-
-
- Embeddings Configuration
-
-
- Configure your embeddings settings. These are used for semantic search, knowledge-base lookups, etc.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Save pending changes to settings before clicking Fetch Embedding Models
-
-
-
-
-
-
-
-
-
- Fetch Models lists deployments through the Azure management plane. Test Connection, chat generation, file uploads, embedding generation, and image generation call the Azure OpenAI data plane. These paths can use different credentials and require different roles.
-
-
-
Credential purpose
-
-
-
-
-
Action
-
Plane
-
Credential used
-
Role or secret
-
-
-
-
-
Legacy GPT, embedding, or image Fetch Models
-
Management plane
-
The SimpleChat app registration or service principal, such as the -ar Entra application created for the deployment.
-
Cognitive Services User on the Azure OpenAI resource, or an equivalent role that can read deployments.
-
-
-
Global endpoint modal Fetch Models
-
Management plane
-
The endpoint modal identity selected for discovery, such as managed identity or service principal.
-
Cognitive Services User on the Azure OpenAI resource, or an equivalent role that can read deployments.
-
-
-
GPT, embedding, or image generation with Key authentication selected
-
Data plane
-
The Azure OpenAI key saved in this settings section.
-
Azure OpenAI resource key from Keys and Endpoint.
-
-
-
GPT, embedding, or image generation with Managed Identity selected
-
Data plane
-
The App Service managed identity, such as the -app managed identity.
-
Cognitive Services OpenAI User on the Azure OpenAI resource.
-
-
-
-
-
-
Where to get values
-
-
Open the Azure OpenAI resource in the Azure portal.
-
Copy the endpoint from Resource Management > Keys and Endpoint.
-
If using Key authentication for runtime calls, copy Key 1 or Key 2 from the same page.
-
Copy the subscription ID and resource group from the resource Overview page. These are required for Fetch Models.
-
If using APIM, use the APIM endpoint, deployment path or name, API version, and APIM subscription key instead of the direct Azure OpenAI key.
-
-
-
Recommended setup
-
-
For key-backed legacy GPT, embeddings, or image generation, grant the SimpleChat service principal the management-plane role so admins can fetch model deployments, then store the Azure OpenAI key for data-plane generation.
-
For managed identity runtime, grant the App Service managed identity Cognitive Services OpenAI User for data-plane generation. If the same managed identity should also fetch deployments, grant it the management-plane discovery role too.
-
Fetch only discovers deployment names and model metadata. It does not prove that embedding or image generation inference will succeed; use Test Embedding Connection or Test Image Connection after selecting a deployment.
-
-
-
-
-
-
-
- {% include '_multiendpoint_modal.html' %}
-
-
-
-
-
-
-
Legacy AI Model Configuration
-
-
-
-
-
-
- Chat Model
-
-
- Configure your Chat Model settings. These are used for generating AI text responses.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Each selected model will be available in the Chat UI as an option for the User. You can select multiple models.
- Save Pending Changes to settings before clicking Fetch Models
-
-
-
-
- Save pending changes to settings before clicking Fetch Models
-
-
-
-
-
-
-
-
-
- Each model defined here will be available in the Chat UI as an option for the User. You can include multiple models seperated by a comma (example: gpt-4o, o-1, o-3).
- NOTE: The APIM GPT Test is against the first model in the list.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Configure Control Center access and permissions for administrators.
-
-
-
-
-
-
-
-
-
-
- Automatic Data Refresh
-
-
Run the Control Center metrics refresh overnight on a daily timezone-aware schedule
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Your browser timezone is local time.
-
-
-
-
-
- {% if settings.control_center_auto_refresh_next_run %}
- Loading local time...
- {% else %}
- Will be calculated when saved
- {% endif %}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Control Center Access
-
-
Manage who can access Control Center features and administrative tools
-
-
-
-
-
-
-
- About Control Center: The Control Center is a powerful administrative dashboard that provides user management, group oversight, public workspace control, and detailed activity monitoring. Use role-based access controls below to delegate administrative responsibilities.
-
-
-
-
-
-
-
-
-
- Required app role value: ControlCenterAdmin. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only users assigned this role can access the Control Center and all management features. Regular Admins will lose access.
-
-
-
- User Management
-
-
- Group Management
-
-
- Public Workspaces
-
-
- Activity Logs
-
-
-
-
-
-
-
-
-
-
-
- Dashboard-only app role value: ControlCenterDashboardReader. Assign this role to users or groups in the Enterprise App before enabling dashboard-only access. Users assigned ControlCenterAdmin can also access the dashboard when Control Center app-role enforcement is enabled.
-
-
- Important: Configure these roles in your identity provider (Entra ID). When role requirements are enabled, standard Admins without the specific roles will be denied access to Control Center features.
-
-
-
-
-
- Best Practices
-
-
-
ControlCenterAdmin: Grant to IT administrators who need full control over users, groups, and workspaces
-
ControlCenterDashboardReader: Grant to managers, compliance officers, or stakeholders who need visibility into platform usage without administrative powers
-
Separation of Duties: Enable role requirements if you need to restrict Control Center access from general application admins
-
Audit Trail: All Control Center actions are logged in Activity Logs for compliance and security auditing
-
-
-
-
-
-
-
-
-
Backup, Migrate & Restore
-
Protect SimpleChat data, move selected workspaces to another environment, and stage restore decisions with guided checks.
-
-
-
-
-
- We suggest not running backups, restores, or migrations during your operational business hours. These jobs run inside the App Service environment and can affect application performance.
-
-
-
-
-
-
-
-
Start Here
-
Use these checkpoints before running backup, migration, restore, or advanced repair actions.
-
-
-
-
-
-
-
Back up
-
Configure dedicated storage, encryption, schedule, and backup scope before queueing jobs.
-
-
-
-
-
-
Migrate
-
Connect a destination, choose who moves, run preflight, then execute a recoverable transfer.
-
-
-
-
-
-
Restore
-
Review backup readiness and stage restore decisions from Backup Inventory.
-
-
-
-
-
-
RU Boost
-
Temporarily raise eligible Cosmos capacity during approved backup or migration windows.
-
-
-
-
-
-
-
-
-
-
-
-
-
Backup
-
Configure when backups run, where artifacts are stored, and how backup files are encrypted.
-
-
-
-
-
-
-
Schedule
-
Full backups run on the selected cadence; partial backups run daily only.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Default is 03:00 UTC.
-
-
-
-
-
-
-
-
-
-
Automatic cleanup keeps the newest successful full backup as a safety baseline.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- These backup scope controls are advanced. Modify them at your own risk because excluding a surface can create backups that are incomplete for restore or migration scenarios.
-
-
-
-
-
-
-
Core application records required for meaningful restore and migration.
-
-
-
-
-
-
-
Search index schemas and retrievable indexed documents.
-
-
-
-
-
-
-
Original source files used by Enhanced Citations.
-
-
-
-
-
-
-
-
-
-
-
-
Storage
-
Store backup artifacts in Azure Blob Storage.
-
-
-
-
-
- Use a dedicated backup storage account. Data Management will reject storage that matches the Enhanced Citations connection string or Blob endpoint.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
No connection string saved yet.
-
-
-
-
-
-
-
-
-
-
-
-
Encryption
-
Generate a 256-bit backup encryption key.
-
-
-
-
-
-
-
-
-
Key storage
-
Not configured
-
Key reference
-
Not configured
-
-
-
-
-
Key Vault is strongly recommended
-
Generated backup encryption keys are stored in the Data Management settings document when Key Vault is not enabled.
Backups stream deterministic checkpoint batches and commit only verified work. Higher concurrency can increase source Cosmos cost and pressure.
-
-
-
-
-
-
-
Source Blob Backup Performance
-
Source files stream through bounded chunks and durable per-file checkpoints. Peak transfer buffering is bounded by concurrent transfers multiplied by chunk size.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Defaults bound application transfer buffering to approximately 32 MiB, excluding Azure SDK overhead. Throttling temporarily reduces active transfers.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
The backup records the current source capacity, raises only eligible targets up to 10,000 RU/s, and restores the original setting after completion, cancellation, failure, or recovery. This can increase Cosmos charges and requires source ARM throughput permission.
-
-
-
-
-
-
-
-
Backup Operations
-
Queue immediate full or partial backup jobs using the settings above.
-
-
-
-
-
-
-
Jobs use Cosmos-backed leases so scaled-out App Service workers do not run the same backup twice.
-
-
-
-
-
-
-
-
- Migration
-
-
Move SimpleChat data through a reviewed, recoverable environment transfer.
-
-
-
- Not reviewed
-
-
-
-
-
-
-
-
-
-
-
-
-
Connect the destination
-
Configure the services this migration will write to. Stored credentials remain redacted.
-
- Destination database: SimpleChat
-
-
-
-
-
-
-
Target Cosmos Database
-
Required for every migration.
-
-
-
-
- Managed identity requires Cosmos DB Data Contributor and target network access.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Fixed app contract.
-
-
-
-
-
-
-
-
-
-
-
-
Target Search
-
Required when AI Search documents are included.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Target Enhanced Citation Storage
-
Required only when source document blobs are included.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Choose who and what moves
-
Selections persist while you search and page. “All” always uses the exhaustive server count.
-
-
0 principal scopes selected
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Available users
-
Search the server catalog.
-
-
-
-
-
-
-
-
-
-
- Page 1
-
-
-
-
-
-
-
-
-
- Loading exhaustive count…
- Every current user record will be resolved by the server when the job starts.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Available groups
-
Search the server catalog.
-
-
-
-
-
-
-
-
-
-
- Page 1
-
-
-
-
-
-
-
-
- Loading exhaustive count…
- Every current group record will be resolved by the server when the job starts.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Available public workspaces
-
Search the server catalog.
-
-
-
-
-
-
-
-
-
-
- Page 1
-
-
-
-
-
-
-
-
- Loading exhaustive count…
- Every current public workspace record will be resolved by the server when the job starts.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Choose what happens at the destination
-
Choose whether to copy only missing items, catch up changes, or make migrated destination data match the source.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Prove the plan is ready
-
Preflight runs server-owned access probes and inventory. Any earlier change makes this review stale.
-
-
-
-
-
-
-
-
-
- Review has not run.
- Run preflight to verify target access, counts, collisions, locks, and capacity policy.
-
-
-
-
-
-
-
-
-
-
-
-
Confirm execution
-
Review the final server-normalized plan. Submission is guarded against duplicate requests.
-
-
-
-
Complete preflight review before confirmation.
-
-
- Destructive destination cleanup. Only destination items previously created by SimpleChat migration may be deleted. Unowned destination data is retained and reported as a conflict.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Operate the migration
-
Progress comes from the durable job record. Cancel, Retry, and Resume retain verified checkpoints.
-
-
-
-
-
-
-
-
-
- No migration is attached to this workflow yet.
- After execution, this stage follows the queued job and exposes its recovery actions.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Cosmos DB JSON Editor
-
Query SimpleChat Cosmos DB containers, inspect one document, and save JSON changes with ETag protection.
-
-
-
-
- This tool can modify production Cosmos DB documents directly. Use it only for targeted admin repair or investigation after you understand the impact.
-
-
- The Cosmos DB JSON editor is locked. Acknowledge the danger prompt before querying or editing data.
-
-
-
-
-
-
-
Choose a known SimpleChat Cosmos DB container.
-
-
-
-
-
Max 100 per request.
-
-
-
-
-
Empty query returns only the first 100 documents. Custom SELECT queries can page beyond 100 with Next Page.
-
-
-
-
- No query has run yet.
-
-
- Query results and the JSON editor open in a modal so the Data Management page stays compact.
-
-
-
-
-
-
-
-
Backup Inventory
-
Track completed full and partial backups created by Data Management jobs.
-
-
-
-
-
-
-
-
-
-
What does Run Retention Cleanup do?
-
- It permanently deletes backups whose age exceeds the retention period configured in Data Management settings,
- and removes their stored artifacts from the backup container. Backups newer than the retention cutoff are left alone.
-
-
-
Only backups in a finished state are eligible; running or queued jobs are skipped.
-
When Keep latest full backup is enabled, the most recent successful full backup is protected even if it is past the cutoff.
-
Each run deletes at most 25 backups, so very large cleanups may need several runs.
-
Cleanup also runs automatically on the configured schedule; this button just runs it now.
-
-
- Seeing “found no expired backups to delete” means every backup is still inside the retention window. That is expected, not an error.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Backup
-
Completed
-
Contents
-
Storage
-
Protection
-
Warnings
-
Actions
-
-
-
-
-
Backup inventory has not loaded yet.
-
-
-
-
-
-
-
-
-
-
-
-
-
Restore Backup
-
Review the target, policy, and backup manifest before queueing a restore job.
-
-
-
-
-
- Restore writes data into the configured target Cosmos DB, AI Search, and Enhanced Citation Storage services. Create-only mode blocks existing destination collisions; overwrite mode requires a separate phrase.
-
-
-
Selected backup
-
-
Choose Restore from a backup row.
-
-
-
-
Restore policy and surfaces
-
-
-
-
-
Create-only is non-destructive and recommended for first restore attempts.
-
-
-
-
-
-
-
-
-
- Required phrase: RESTORE WITH OVERWRITE
-
-
-
-
-
-
-
Preflight review
-
Run review to validate the manifest, target access, and restore policy.
-
-
-
-
-
No restore review has run yet.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Job History
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Created
-
Operation
-
Status
-
Progress
-
Message
-
Actions
-
-
-
-
-
Job history has not loaded yet.
-
-
-
-
-
-
-
-
-
-
-
-
-
Cosmos DB JSON Editor Warning
-
This interface can change live application data.
-
-
-
-
-
- Incorrect edits can break authentication, workspaces, chat history, documents, automations, or activity log integrity. Use this editor only when safer admin tools cannot solve the problem.
-
-
-
Run targeted SELECT queries and page results instead of loading large containers at once.
-
Do not change id or the container partition key value.
-
Review JSON carefully before saving. Saves are audited in Activity Logs.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Cosmos DB Query Results
-
Run a query to load document summaries.
-
No query has run yet.
-
-
-
-
-
-
-
-
-
Results
-
-
-
Run a query to list documents.
-
-
-
-
-
-
-
-
-
Document JSON
-
Select a result to load JSON.
-
-
-
-
-
-
-
-
-
-
The editor blocks id and partition key changes. Saves use the ETag from the loaded document.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Confirm Cosmos DB Document Save
-
Review the change summary before saving.
-
-
-
-
-
- Saving replaces the selected Cosmos DB document with the JSON currently in the editor. This action is audited and cannot be undone from this screen.
-
-
- No changes summarized yet.
-
-
-
-
- Required phrase: I understand this can damage system data
-
-
-
-
-
-
-
-
-
-
-
-
-
Job Details
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Timeline
-
-
-
-
No timeline events loaded.
-
-
-
-
-
-
-
-
Backup Contents
-
-
-
-
No backup artifacts recorded for this job.
-
-
-
-
-
-
-
-
Storage and Manifest
-
-
-
-
-
-
-
-
Warnings
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Request Data Management Job Cancellation
-
-
-
-
-
The worker stops at its next durable checkpoint. Completed items remain available for Retry or Resume.
-
-
-
-
-
-
-
-
-
-
Delete Data Management Backup
-
-
-
-
-
- Backup deletion removes stored artifacts, job timeline records, and differential sidecar state for this job. Future partial backups will re-export affected unchanged items.
-
-
-
-
-
-
-
-
-
-
-
-
-
Backup, Migrate & Restore Configuration Guide
-
-
-
-
Configure backup, migration, and restore readiness before an incident or cutover window. The safest path is to first prove backups, then rehearse migration or restore decisions from completed backup records.
-
-
Use dedicated backup storage that is separate from Enhanced Citation source files.
-
Generate and protect the backup encryption key, preferably in Key Vault.
-
Run a manual full backup and inspect the Backup Inventory entry.
-
For migration, connect destination Cosmos, Search, and storage services before selecting scope.
-
For restore, open Backup Inventory and stage the selected backup through the Restore workflow.
-
-
-
-
-
-
-
-
-
-
-
Backup Setup Guide
-
-
-
-
Backups create durable artifacts and job records that later migration or restore workflows can inspect. Full backups capture a complete selected snapshot. Partial backups capture daily changes between full backups.
-
-
Storage: Use a dedicated backup account/container so restore and migration artifacts never overwrite source documents.
-
Encryption: Keep backup encryption enabled and store generated keys in Key Vault for production.
-
Scope: Leave Cosmos DB and AI Search enabled unless you are intentionally creating a limited backup.
-
Timing: Queue large backup jobs outside business hours because App Service workers perform the work.
-
-
-
-
-
-
-
-
-
-
-
Migration Guide
-
-
-
-
Migration moves selected SimpleChat users, groups, public workspaces, and their optional documents to another SimpleChat environment.
-
-
Copy missing items only: safest first run; existing destination records are not changed.
-
Catch up changed items: use after a previous completed migration to copy new items and update migration-owned changes.
-
Make destination match source: use only during cutover when migrated destination-only items should be removed.
-
AI Search freeze: freeze external destination writers before moving Search documents because SimpleChat cannot coordinate external writers.
-
-
-
-
-
-
-
-
-
-
-
RU Boost Permission Guide
-
-
-
-
RU Boost temporarily raises eligible Cosmos DB throughput up to 10,000 RU/s and then restores the original setting. It can increase Azure charges and requires Azure management-plane permissions.
-
-
Data copy permissions prove the identity can create, read, and delete probe records in destination Cosmos containers.
-
RU Boost permissions prove the identity can read and write Cosmos throughput settings through Azure Resource Manager.
-
Destination RU Boost also needs the destination subscription ID and resource group because those values are not part of the data-plane endpoint.
-
Use Test RU Boost before a cutover window; it validates capacity permissions separately from migration data access.
-
-
-
-
-
-
-
-
-
-
-
Restore Guide
-
-
-
-
Restore starts from Backup Inventory. The workflow helps admins confirm what is in the backup, what surfaces are safe to restore, and whether backend restore execution is available for the selected backup.
-
-
Prefer full backups for restore decisions because partial backups depend on earlier backup history.
-
Confirm the encryption key is still available before relying on encrypted artifacts.
-
Review warnings and missing surfaces before restoring AI Search or source document blobs.
-
Run restore only in a maintenance window because restored records can affect live users and search results.
-
-
-
-
-
-
-
-
- {% set enable_dai_debug = settings.enable_dai_debug | default(false) %}
-
- Configure Redis cache to improve enterprise scale and performance by caching session data. Enabling Redis allows you to horizontally scale your application across multiple instances without losing session data.
-
-
-
- Redis Cache
-
-
- Enable Redis Cache to store session data in a distributed cache. This is recommended for production and multi-instance deployments.
-
- Monitor Redis availability, memory pressure, hit rate, evictions, and runtime cache usage before Redis-backed document list caching is enabled.
-
-
-
-
-
-
-
-
-
-
-
-
Configuration
- Not loaded
-
-
-
-
-
Health
- Not loaded
-
-
-
-
-
App Cache Runtime
- Not loaded
-
-
-
-
-
Session Runtime
- Not loaded
-
-
-
-
-
-
-
Ping Latency
-
Not loaded
-
-
-
-
-
Memory Usage
-
Not loaded
-
Not loaded
-
-
-
-
-
Connected Clients
-
Not loaded
-
-
-
-
-
Ops/sec
-
Not loaded
-
-
-
-
-
Keyspace Hit Rate
-
Not loaded
-
-
-
-
-
Tracked Keys
-
Not loaded
-
-
-
-
-
DAI Version Markers
-
Not loaded
-
Not loaded
-
-
-
-
-
DAI Cache Payloads
-
Not loaded
-
Not loaded
-
-
-
-
-
Expired / Evicted Keys
-
- Not loaded
- /
- Not loaded
-
-
-
-
-
-
Fragmentation Ratio
-
Not loaded
-
-
-
-
-
Error Replies
-
Not loaded
-
-
-
-
-
Rejected Connections
-
Not loaded
-
-
-
-
-
Redis Version
-
Not loaded
-
-
-
-
-
Monitoring Source
-
Not loaded
-
-
-
-
-
Last Checked
-
Not loaded
-
-
-
-
-
Last Error
-
Not loaded
-
-
-
-
-
-
-
-
-
-
-
-
- Redis Explorer
-
-
- Read-only key browser with cursor pagination and sanitized value previews.
-
-
-
-
-
-
-
-
- Value previews are sanitized and restricted for session, token, cookie, credential, password, and secret-like keys. Use this for troubleshooting cache behavior, not for exporting Redis data.
-
-
-
- Leave the filter blank and select Browse All to page through Redis keys. Cache keys may use uppercase names, prefixes, or internal identifiers; for example, app settings cache entries are stored as APP_SETTINGS_CACHE and APP_SETTINGS_CACHE_VERSION.
-
-
-
-
-
-
-
-
- Blank filter browses all keys. Filters are case sensitive. Redis SCAN order is server-defined, so use Next Page to keep browsing.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Keys
-
Not loaded
-
-
-
-
-
-
-
-
-
-
- Select a key to view sanitized metadata and preview content.
-
-
-
-
-
Key
-
Not loaded
-
-
-
Type
-
Not loaded
-
-
-
TTL
-
Not loaded
-
-
-
Memory
-
Not loaded
-
-
-
Sanitization
-
Not loaded
-
-
-
-
SimpleChat Resolution
-
Not resolved
-
Not resolved
-
Not resolved
-
Not resolved
-
-
-
Not loaded
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Conversation Cache
-
-
- Cache conversation list, feed, and advanced-search results per user. Redis is optional; cache misses and disabled cache paths continue using source Cosmos queries.
-
-
-
-
-
-
-
-
-
-
-
When enabled, list/feed/search payloads are cached by user and version. Disabling this bypasses cache reads and writes without requiring Redis.
-
-
-
-
-
Default 120 seconds. User-scoped version invalidation refreshes changed conversations; set to 0 to skip writing new entries.
-
-
-
-
-
-
Runtime Status
- Not loaded
-
-
-
-
-
15m Cache Hit Rate
-
Not loaded
-
-
-
-
-
15m Cache Hits / Misses
-
Not loaded
-
-
-
-
-
15m Cache Bypasses / Errors
-
Not loaded
-
-
-
-
-
15m Writes / Invalidations
-
Not loaded
-
-
-
-
-
15m Operation Mix
-
Not loaded
-
-
-
-
-
Last Cache Event
-
Not loaded
-
-
-
-
-
Last Invalidation
-
Not loaded
-
-
-
-
-
- Conversation cache metrics are lightweight in-process counters for the current app worker. Application Insights logs remain the durable fleet-wide source for cache warnings and fallback behavior.
-
-
-
-
-
-
-
-
-
- Cosmos Document Access Index
-
-
- Monitor the document access projection used to remove expensive cross-partition document access queries.
-
-
-
-
- {% if enable_dai_debug %}
-
-
- {% endif %}
-
-
-
-
-
- Document access projection maintenance is automatic. The background scheduler repairs fail-open projection records first, then runs bounded backfill batches repeatedly while work remains. Production read metrics below show DAI-served reads, Redis cache hits, source fallbacks, RU, and latency without requiring shadow validation.
- {% if enable_dai_debug %}Debug controls and shadow validation diagnostics are visible because enable_dai_debug is enabled in app settings.{% endif %}
-
-
-
-
-
-
-
-
Container
- Not loaded
-
-
-
-
-
Write-through
- Not loaded
-
-
-
-
-
Read Path
- Not loaded
-
-
-
-
-
Redis List Cache
- Not loaded
-
-
- {% if enable_dai_debug %}
-
-
-
Shadow Validation
- Not loaded
-
-
- {% endif %}
-
-
-
Auto Maintenance
- Not loaded
-
-
-
-
-
Next Maintenance Action
-
Not loaded
-
-
-
-
-
More Work Pending
-
Not loaded
-
-
-
-
-
Active Loop Interval
-
Not loaded
-
-
-
-
- {% if enable_dai_debug %}
-
-
Automatic Maintenance and Diagnostics
-
-
-
-
-
-
-
Always on. New and changed documents synchronize into the access index and fail open to repair records if projection updates fail.
-
-
-
-
-
-
-
Always on. Maintenance keeps running bounded repair and backfill batches until DAI is healthy.
-
-
-
-
-
-
-
Compares source list results to projection rows and logs mismatches without changing reads.
-
-
-
-
-
Documents processed per manual or scheduled batch.
-
-
-
-
-
Fail-open repair records reconciled before each backfill batch.
-
-
-
-
-
-
Default Read Path
-
-
-
-
-
-
-
Always on. DAI-backed document and tag list reads are the normal path; source-container fallback remains automatic when backfill is not ready, repairs are pending, or a DAI query fails.
-
-
-
-
-
-
-
Uses Redis read-through caching for DAI document, tag, and legacy-count reads. If Redis is unavailable, reads bypass cache and use DAI directly.
-
-
-
-
-
Default 900 seconds. Scope-version invalidation makes document changes visible immediately; TTL clears unreachable old entries.
-
-
-
- {% endif %}
-
-
-
-
-
Backfill State
- Not loaded
-
-
-
-
-
Repair Backlog
-
Not loaded
-
-
-
-
-
15m DAI Read Attempts
-
Not loaded
-
-
-
-
-
15m Redis Cache Hit Rate
-
Not loaded
-
-
-
-
-
15m Cache Hits / Misses
-
Not loaded
-
-
-
-
-
15m Cache Bypasses / Errors
-
Not loaded
-
-
-
-
-
15m Cache Invalidations
-
Not loaded
-
-
-
-
-
15m Served from DAI
-
Not loaded
-
-
-
-
-
15m Source Fallbacks
-
Not loaded
-
-
-
-
-
15m Fallback Rate
-
Not loaded
-
-
-
-
-
15m DAI Read RU
-
Not loaded
-
-
-
-
-
15m Avg / P95 Latency
-
Not loaded
-
-
-
-
-
Last Fallback Reason
-
Not loaded
-
-
-
-
-
Last DAI Read Metric
-
Not loaded
-
-
-
-
-
Last Cache Event
-
Not loaded
-
-
-
-
-
- Production read metrics are lightweight in-process counters for the current app worker. Application Insights logs remain the durable fleet-wide source for fallback warnings and query failures.
-
-
- {% if enable_dai_debug %}
-
-
-
Last Shadow Result
- Not run
-
-
-
-
-
Shadow Mismatches
-
Not loaded
-
-
-
-
-
Source / Validation RU
-
Not loaded
-
-
-
-
-
Validation Index RU
-
Not loaded
-
-
-
-
-
Candidate Read RU
-
Not loaded
-
-
-
-
-
Estimated Wave 5 Savings
-
Not loaded
-
-
-
-
-
Source / Candidate Latency
-
Not loaded
-
-
-
-
-
Estimated Wave 5 Latency
-
Not loaded
-
-
-
-
-
- Rolling decision metrics aggregate shadow-validation samples over recent windows. Use these totals to compare source container RU with candidate access-index RU before enabling the future read path or Redis document access cache.
-
-
-
-
-
5m Source / Candidate RU
-
Not loaded
-
-
-
-
-
5m Estimated Wave 5 Savings
-
Not loaded
-
-
-
-
-
15m Source / Candidate RU
-
Not loaded
-
-
-
-
-
15m Estimated Wave 5 Savings
-
Not loaded
-
-
-
-
-
15m Validation Overhead
-
Not loaded
-
-
-
-
-
15m Shadow Samples
-
Not loaded
-
-
- {% endif %}
-
-
-
Current Scope
-
Not loaded
-
-
-
-
-
Completed Scopes
-
Not loaded
-
-
-
-
-
Total Documents Processed
-
Not loaded
-
-
-
-
-
Total Documents Failed
-
Not loaded
-
-
-
-
-
Rows Upserted
-
Not loaded
-
-
-
-
-
Rows Deleted
-
Not loaded
-
-
-
-
-
Last Batch Completed
-
Not loaded
-
-
-
-
-
Last Error
-
Not loaded
-
-
-
-
-
-
-
-
-
- Cosmos Maintenance
-
-
- Review expected indexing policies and clean up stale operational cache documents without touching source configuration or user data.
-
-
-
-
-
-
-
-
-
-
-
-
- Indexing maintenance only adds missing expected composite indexes and preserves existing policy paths. Composite indexes can increase write-index overhead while improving supported lookup and ordered-query speed. Stale cleanup is allowlisted to obsolete cache artifacts, supports dry-run review, and deletes at most one bounded batch per run.
-
-
-
-
-
-
-
Indexing Policy Status
- Not loaded
-
-
-
-
-
Indexing Mode
-
Not loaded
-
-
-
-
-
Containers Checked
-
Not loaded
-
-
-
-
-
Missing Expected Indexes
-
Not loaded
-
-
-
-
-
Updated Containers
-
Not loaded
-
-
-
-
-
Indexing Failures
-
Not loaded
-
-
-
-
-
Last Indexing Evaluation
-
Not loaded
-
-
-
-
-
Stale Cleanup Status
- Not loaded
-
-
-
-
-
Cleanup Mode
-
Not loaded
-
-
-
-
-
Cleanup Candidates
-
Not loaded
-
-
-
-
-
Deleted Docs
-
Not loaded
-
-
-
-
-
Cleanup Failures
-
Not loaded
-
-
-
-
-
More Candidates
-
Not loaded
-
-
-
-
-
Cleanup Categories
-
Not loaded
-
-
-
-
-
Last Cleanup Evaluation
-
Not loaded
-
-
-
-
-
-
-
-
-
-
- Apply Missing Cosmos Indexes
-
-
-
-
-
- This adds any missing expected composite indexes to the configured hot Cosmos containers. Existing included paths, excluded paths, default indexes, TTL settings, and full-text policies are preserved.
-
-
- Composite indexes can improve lookup and ordered-query performance, but Cosmos will maintain those indexes on future writes and may temporarily run index transformation after the policy update.
-
-
- Choose Apply only when you accept the additional write-index overhead for the faster supported query patterns shown in the maintenance status.
-
-
-
-
-
-
-
-
-
-
-
-
- Delete Stale Cache Documents
-
-
-
-
-
- This deletes only allowlisted stale cache artifacts from the settings container, such as retired conversation cache version documents and obsolete volatile cache payloads.
-
-
- It does not delete app settings, active cache-version documents, DAI state, maintenance state, source documents, or user data. Run a dry run first if you want to review the candidate count.
-
-
-
-
-
-
-
- {% if enable_dai_debug %}
-
-
-
-
-
- Reset Document Access Backfill
-
-
-
-
-
- Resetting the checkpoint makes the next batch start from the first source scope again. The operation is idempotent, but it may reprocess documents that already have projection rows.
-
-
- This does not delete source documents or projection rows. It only resets backfill progress and immediately runs one saved-size backfill batch.
-
-
-
-
-
-
- {% endif %}
-
-
-
-
-
- Cosmos DB Throughput
-
-
- Monitor RU utilization and automatically adjust shared database or dedicated container throughput.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Automation checks Cosmos throughput on the Metrics Window cadence while enabled and saves the last observed database or container view. SimpleChat can scale throughput up or down at 10,000 RU/s or lower. Above 10,000 RU/s, SimpleChat monitors utilization only; use the Azure portal for capacity changes, which can take 4 to 6 hours. Native Cosmos autoscale conversion is separate from SimpleChat scale-up and scale-down automation.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Metrics Window
-
-
-
-
-
- min
-
-
-
-
-
-
-
Scale Up Policy
-
-
-
-
-
-
-
-
-
-
-
- %
-
-
-
-
-
-
- RU/s
-
-
-
-
-
-
- min
-
-
-
-
-
-
SimpleChat-managed scaling stops at 10,000 RU/s. Use the Azure portal above this limit.
-
-
-
-
-
-
-
-
-
-
-
-
Scale Down Policy
-
-
-
-
-
-
-
-
-
-
-
- %
-
-
-
-
-
-
- RU/s
-
-
-
-
-
-
- min
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Use this when container throughput should follow one standard automation policy instead of per-container overrides. Global policy also applies the Cosmos autoscale conversion setting above to current and future dedicated-throughput containers.
-
-
-
-
-
-
-
-
-
-
Mode
-
Not loaded
-
-
-
-
-
Current RU/s
-
Not loaded
-
-
-
-
-
RU Utilization
-
Not loaded
-
-
-
-
-
Last Checked
-
Not loaded
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Mode
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Actions
-
-
-
-
-
Refresh to load Cosmos metrics.
-
-
-
-
-
-
-
-
-
-
-
- Cosmos Throughput Setup Guide
-
-
-
-
-
- Validate Access runs the same read checks automation depends on using the current form values: resource identity, Azure Resource Manager throughput reads, container discovery, and Azure Monitor metrics.
-
-
-
Required Azure Access
-
-
Assign roles to the Azure App Service managed identity service principal, not the Microsoft Entra sign-in app registration. In the Azure portal, open the Web App, select Identity, copy the Object (principal) ID, then find the matching Enterprise Application if you need to inspect it in Microsoft Entra ID.
-
For SimpleChat deployments, assign the custom SimpleChat Cosmos Throughput Operator role to that web app identity at the resource group scope that contains the Cosmos DB account, or directly at the Cosmos account scope.
-
The custom role must include management-plane actions to read the Cosmos account, database, and containers; read and write SQL database and container throughputSettings; run migrateToAutoscale; read throughput operation results; and read Microsoft.Insights/metrics.
-
If the custom role is not available, assign equivalent custom RBAC permissions. Broad built-in roles such as Contributor can validate access, but are not the preferred least-privilege configuration.
-
-
-
-
Capacity Scope
-
-
Database mode scales the shared SimpleChat database throughput.
-
Container-targeted mode scales only containers with dedicated throughput.
-
Containers that inherit shared database throughput are visible but not individually scalable.
-
Manual throughput can be converted to native Cosmos autoscale only when the admin enables conversion globally or for the container policy.
-
-
-
-
Metrics
-
-
RU Utilization is a percentage of available throughput for the selected metrics window.
-
Request Units is the total RU volume consumed during the selected metrics window.
-
Azure Monitor metrics can lag by a few minutes after traffic changes.
-
-
-
-
-
-
-
-
-
-
-
-
-
- Container Throughput Policies
-
-
-
-
-
- Dedicated container throughput is controlled per row unless global policy enforcement is enabled. Containers using shared database throughput are shown for visibility, but cannot be scaled or converted individually until they have dedicated throughput. Containers above 10,000 RU/s are monitor-only in SimpleChat; change their capacity in the Azure portal and plan for a 4 to 6 hour provisioning window.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Container
-
Enabled
-
Scale Up
-
Scale Down
-
Cosmos Autoscale
-
Min RU/s
-
Max RU/s
-
Manual
-
-
-
-
-
Refresh Cosmos throughput status to load containers.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Front Door
-
-
-
-
Configure Front Door URL for authentication and redirect flows.
-
-
-
-
-
-
-
-
-
-
-
- The base URL of your Front Door or load balancer. The system will automatically generate:
-
- Configure file synchronization for personal, group, and public workspaces.
-
-
-
-
-
- File Sync
-
-
-
-
- Enable File Sync globally, set conservative run limits, and choose whether workspace managers or SimpleChat admins manage sync sources.
-
-
-
- File Sync can scan large remote shares and create many document versions. Start with narrow filters, conservative schedules, and low per-run limits before enabling broad workspace access.
-
-
- {% if not settings.file_sync_redis_ready %}
-
- Redis Cache must be enabled and configured before File Sync can run. Saved File Sync settings remain inactive until Redis is ready.
-
- {% elif settings.requested_enable_file_sync and not settings.file_sync_effective_enabled %}
-
- File Sync is saved as requested but is not currently active. Check Redis configuration and scope controls.
-
- {% endif %}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- {% set file_sync_visible_source_types = settings.file_sync_visible_source_types|default(['smb', 'azure_files']) %}
-
-
Visible Source Types
-
- Choose which source types appear in the Add Source workflow. OneDrive, SharePoint, and Google Workspace connectors are coming soon while validation continues.
-
-
-
-
-
-
-
Available now.
-
-
-
-
-
-
-
Available now.
-
-
-
-
-
-
-
Available now.
-
-
-
-
-
-
-
Coming Soon.
-
-
-
-
-
-
-
Coming Soon.
-
-
-
-
-
-
-
Coming Soon.
-
-
-
-
-
-
-
Cloud drive connector identities
-
- OneDrive, SharePoint, and Google Workspace File Sync connectors are coming soon. Any existing global connector identities can remain configured for future use.
-
-
-
-
-
-
-
Personal Workspace Sync
-
-
-
-
-
-
-
-
-
-
-
-
-
Required app role value: PersonalFileSyncUser. Assign this role to users or groups in the Enterprise App before enabling the requirement for personal sync.
-
-
-
-
-
-
-
-
-
-
-
-
-
No user selected.
-
-
-
-
-
-
-
Group Workspace Sync
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- No groups assigned.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
No group selected.
-
-
-
-
-
-
-
Public Workspace Sync
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- No public workspaces assigned.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
No public workspace selected.
-
-
-
-
-
-
- SMB source credentials are stored in Azure Key Vault when Key Vault secret storage is enabled; otherwise they use the app's existing encrypted settings path.
-
-
-
-
-
-
-
-
-
-
Manage File Sync Sources
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
File Sync Group Assignments
- Choose which groups can use File Sync when group assignment is required.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
No groups loaded.
-
-
-
-
-
Group
-
Description
-
Assignment
-
-
-
-
-
Search for groups to assign.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
File Sync Public Workspace Assignments
- Choose which public workspaces can use File Sync when public workspace assignment is required.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Enter at least 2 characters to search.
-
-
-
-
-
Public Workspace
-
Description
-
Assignment
-
-
-
-
-
Search for public workspaces to assign.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Personal File Sync App Role Setup
-
-
-
-
- Create the personal File Sync app role on the SimpleChat app registration, then assign users or groups to the role in the Enterprise App before enabling the personal require-role toggle.
-
-
-
-
-
-
Capability
-
App role value
-
Typical assignment
-
-
-
-
-
Personal File Sync
-
PersonalFileSyncUser
-
Users allowed to manage personal sync sources
-
-
-
-
-
-
Open Microsoft Entra admin center and edit the SimpleChat app registration.
-
Add the app role with allowed member type Users/Groups and value exactly matching the table.
-
Open the Enterprise App for SimpleChat and assign users or groups to the app role.
-
Have affected users sign out and sign back in so their role claims refresh.
-
-
-
-
-
-
-
-
-
-
- Configure workspace settings like personal/group access, multimedia support, metadata, and document classification.
-
-
-
-
-
- Personal Workspaces
-
-
- Turn this on to allow access and management of your personal workspace.
-
-
-
-
-
-
-
-
-
-
- Workflow
-
-
- Control personal and group workflow authoring and execution for users.
-
-
-
-
-
-
-
-
-
-
-
-
- Required app role value: WorkflowUser. Assign this role to users or groups in the Enterprise App before enabling the requirement.
-
-
-
-
-
-
- Maximum automatic tool or action calls an agent can make during one workflow run. Default is 60; increase for large document sets.
-
-
- Values above 100 are capacity-sensitive. Enable Cosmos DB Throughput automation in SimpleChat so the app can monitor RU pressure and scale up Cosmos when needed, and also monitor Azure OpenAI throttling, App Service CPU and memory, and downstream service latency.
-
-
-
-
-
-
-
- Maximum ordered instruction tasks users can add to one workflow. Default is 50; supported range is 1-100.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- No groups assigned.
-
-
-
- Group workflow authoring is available to group Owners and Admins by default. Enable the owner-only setting below to limit group agent, action, and workflow management to Owners.
-
-
-
-
-
- File Downloads
-
-
- Control when users can download original workspace document files from personal, group, and public workspaces.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- No groups assigned.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- No public workspaces assigned.
-
-
-
-
-
-
-
-
-
-
Group Workflow Assignments
- Choose which groups can use group workflows when assignment is required.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
No groups loaded.
-
-
-
-
-
Group
-
Description
-
Assignment
-
-
-
-
-
Search for groups to assign.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
File Download Group Assignments
- Choose which groups can download files when group assignment is required.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
No groups loaded.
-
-
-
-
-
Group
-
Description
-
Assignment
-
-
-
-
-
Search for groups to assign.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
File Download Public Workspace Assignments
- Choose which public workspaces can download files when public workspace assignment is required.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Enter at least 2 characters to search.
-
-
-
-
-
Public Workspace
-
Description
-
Assignment
-
-
-
-
-
Search for public workspaces to assign.
-
-
-
-
-
-
-
-
-
-
-
-
-
- Group Workspaces
-
-
- Turn this on to allow access and management of group workspaces, as well as group collaboration features.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- When enabled, no users will be able to create new groups, regardless of app role assignment. This global setting overrides the Require CreateGroups App Role setting below.
-
-
-
-
-
-
-
-
- Required app role value: CreateGroups. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create groups while group workspaces and group creation are enabled.
-
-
-
-
-
-
-
-
-
-
-
- If enabled, only the group Owner can create, edit, and delete group agents, group actions, and group workflows. Admins and other roles will only be able to view them.
-
-
-
-
-
-
-
- Public Workspaces
-
-
- Turn this on to enable public workspaces that are visible to everyone in the organization.
-
-
-
-
-
-
-
-
-
-
-
- Optional. End users will see this label instead of Public Workspace. Admin settings and internal references continue to use Public Workspace.
-
-
-
-
-
-
-
-
-
-
-
- Required app role value: CreatePublicWorkspaces. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create public workspaces while public workspaces are enabled.
-
-
-
-
-
-
-
- File Sharing
-
-
- Turn this on to enable file sharing capabilities between users and workspaces.
-
-
-
-
-
-
-
-
-
-
- Chat File Uploads
-
-
- Control whether users can upload files directly into chat conversations.
-
-
-
-
-
-
-
-
-
- Conversation Contents Drawer
-
-
- Let users navigate long conversations from a list of their prompts.
-
-
-
-
-
-
-
- When enabled, users can turn the drawer off for their own account from Profile settings.
-
-
-
-
-
-
-
-
- Required app role value: ChatFileUploadUser. Assign this role to users or groups in the Enterprise App before enabling the requirement. Existing chat attachments remain visible; this only controls new uploads.
-
-
-
-
-
- Metadata Extraction
-
-
- Enable this to automatically parse and store file metadata for advanced indexing and search.
-
-
-
-
-
-
-
-
-
-
-
-
- Uses Global Endpoints when multi-endpoint model management is enabled; otherwise uses the legacy GPT/APIM deployment settings.
-
-
-
-
-
-
-
- Multi-Modal Vision Analysis
-
-
- Enable AI-powered vision analysis for images uploaded to chat or workspace. When enabled alongside Document Intelligence OCR, images will receive both text extraction (OCR) and semantic understanding (vision AI).
-
-
-
- How it works:
-
-
Document Intelligence: Extracts text from images (OCR)
-
Vision Model: Provides semantic analysis, object detection, and contextual understanding
-
Both analyses are combined and available in citations when Enhanced Citations is enabled
-
-
-
-
-
-
-
-
-
-
-
-
-
Select a GPT model with vision capabilities (for example, gpt-4o or supported GPT 5 and later models). Only vision-capable models are shown.
-
-
-
-
-
-
-
-
-
-
- Document Classification
-
-
- Enable this feature to allow users to classify documents uploaded to their workspaces using predefined categories.
-
-
-
-
-
-
-
-
-
-
Classification Categories
-
Define the labels and corresponding colors for document classification.
-
-
-
-
Label
-
Color
-
Actions
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Retention Policy
-
-
Automatically delete aged conversations and documents based on configurable retention periods. Users, group owners, and public workspace admins can set their own retention policies.
-
-
-
- How it works: Enable retention policy for workspace types below. Users/owners can then configure how many days to retain conversations and documents. Items older than the configured period are automatically deleted. Default is "none" (no deletion) until explicitly set by each user/owner.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Default Retention Policies
-
Set organization-wide default retention periods for each workspace type. Users can override these defaults with their own preferences. Setting a default here means new users/workspaces will start with this retention period.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Force Push: Override all user/group/workspace custom retention policies with the organization defaults above. Users will then use the organization default until they set their own preference.
-
-
-
-
-
-
-
-
-
-
- Retention policy will run once daily at this hour (UTC timezone).
-
-
-
-
-
-
-
- {% if settings.retention_policy_last_run %}
- {{ settings.retention_policy_last_run }}
- {% else %}
- Never run
- {% endif %}
-
-
-
- Trigger retention policy execution immediately for selected workspace types, bypassing the scheduled time.
-
-
-
-
-
- Important: Deleted items respect your archiving settings. If conversation archiving is enabled, items will be archived before deletion. Activity logs are created for all deletions.
-
-
-
-
-
-
- Workspace Scope Lock
-
-
- Control whether users can unlock workspace scope in chat conversations. When scope is locked, conversations are restricted to the workspaces that produced search results, preventing accidental cross-contamination with other data sources.
-
-
-
-
-
-
-
-
-
-
-
- User Agreement
-
-
- Configure a user agreement that users must accept before uploading files.
- Supports Markdown formatting.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Select where the user agreement should be shown (at least one required):
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- At least one location must be selected
-
-
-
-
-
-
-
-
- 0 / 200 words
-
- Exceeds 200 word limit
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Configure standard and enhanced citations features for your and group workspaces.
-
-
-
-
-
- Standard Citations
-
-
- Standard citations is always enabled for both Your Workspace and Group Workspace.
-
-
- Users can see text content of the source/citation for documents.
-
-
-
-
-
-
- Enhanced Citations
-
-
- Enable Enhanced Citation to store files in a Storage Account,
- and show direct references (Preview feature, files are saved to storage, presentation
- layer will be available in a future release).
-
-
- {% set ec_storage_status = settings.enhanced_citations_storage_status or {} %}
- {% set ec_storage_state = ec_storage_status.state or 'not_initialized' %}
- {% if settings.enable_enhanced_citations %}
-
-
Enhanced Citations storage startup status
-
{{ ec_storage_status.message or 'Enhanced Citations storage status is not available for this process.' }}
-
- Startup skips live storage container checks so storage outages do not block application boot.
- Use the connection test to validate current storage reachability and container access.
-
-
-
-
- {% endif %}
-
-
-
-
-
-
-
-
-
-
-
-
-
All filetypes
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Tabular Preview Limits
-
-
-
-
- Maximum blob size (in MB) allowed for tabular file previews (CSV, XLSX). Files larger than this will not be previewed.
- Increase for larger files if your compute has sufficient memory, or decrease to protect smaller instances. Default: 200 MB.
-
-
-
-
Large Tabular Run Controls
-
-
-
-
When a prompt includes an explicit large row count, users are asked to continue or narrow scope before the run starts.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Configure content safety, archiving, and user feedback settings. If Content Safety is enabled, user
- messages will be sent to the safety endpoint for analysis. If User Feedback is enabled, users will see
- thumbs up/down to provide feedback on AI responses.
-
-
-
- Content Safety
-
-
Enable content safety to filter out inappropriate content.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Displayed when Content Safety blocks a chat message.
-
-
-
-
-
-
-
-
Disable this option to show only the configured message.
-
-
-
-
-
-
-
-
-
- User Feedback
-
-
Enable user feedback (thumbs up/down) for AI responses.
-
-
-
-
-
-
-
-
-
- Desktop Conversation Notifications
-
-
- Allow users to receive an operating system notification when an AI response finishes while SimpleChat is open in a hidden or unfocused browser tab.
-
-
-
-
-
-
- Users can turn notifications off from Profile. Browser permission is required, and notifications stop when the SimpleChat tab is closed.
-
-
-
-
-
-
- Permissions
-
-
Control which users can access specific administrative views related to safety and feedback.
-
-
-
-
-
-
-
-
- Required app role value: SafetyViolationAdmin. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general Admin app role can access the Safety Violations admin page.
-
-
-
-
-
-
-
-
-
- Required app role value: FeedbackAdmin. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general Admin app role can access the User Feedback admin page. Requires Enable User Feedback to be active.
-
-
-
-
-
-
-
- Conversation Archiving
-
-
When enabled, conversation deletions will be archived instead of permanently deleted.
-
-
-
-
-
-
-
-
-
-
-
-
-
- Configure Azure AI Search, Document Intelligence, and multimedia support settings.
-
-
-
-
-
Web Search (Azure AI Foundry Agent)
-
-
-
Enable web search by routing queries through an Azure AI Foundry agent configured by admins.
-
-
-
-
-
-
-
-
-
-
User Data Notice
-
Optionally show users a one-time notice explaining that their message will be sent to Bing for web search.
-
-
-
-
-
-
-
-
This message will be shown to users once per session when they first use web search.
-
-
-
-
-
-
-
Project endpoint format: https://<foundry-resource>.services.ai.azure.com/api/projects/<project-name> (not the inference endpoint).
Identity must have Cognitive Services User and AI Developer roles on the Foundry project.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Web Search Test
-
Run the configured Foundry agent with the current unsaved settings.
-
-
-
-
-
-
-
-
-
-
URL Access
- Shared Policy
-
-
Control direct URL content fetching for pasted chat links, workflow prompts, and Deep Research source review.
-
-
-
-
-
-
-
-
Required app role value: UrlAccessUser. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use URL Access in chat or enable it for workflows.
-
-
-
-
- URL Access uses the same server-side URL protections as Deep Research: non-HTTP(S) URLs, credentialed URLs, literal IP targets, localhost, metadata hosts, unsafe redirects, unsupported content types, and oversized pages are blocked before fetch.
-
-
-
-
-
-
Hard limit: 100 direct URLs per chat message.
-
-
-
-
-
Hard limit: 500 direct URLs per workflow prompt.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Leave blank to allow any public domain that passes safety checks. Deep Research uses this same allow list.
-
-
-
-
-
-
-
-
-
-
-
-
Blocked domains apply to URL Access and Deep Research source-page review.
-
-
-
-
-
-
-
URL Policy Test
-
Check a URL against the current allowed and blocked domain rules before saving.
-
-
-
-
-
-
-
-
-
Deep Research
-
- Optional
-
-
-
-
Plan bounded web searches, inspect source pages, and keep an internal research ledger for evidence coverage. Direct pasted URLs use the shared URL Access controls above.
-
-
-
-
-
-
-
- Server-side protections always block non-HTTP(S) URLs, literal IP URL targets, localhost, metadata hosts, credentialed URLs, excessive redirects, unsupported content types, oversized pages, and requests beyond the configured page budget. DNS hostnames that resolve to private/internal addresses require the internal-host opt-in below.
-
-
-
-
-
-
Required app role value: DeepResearchUser. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use Deep Research.
-
-
-
-
-
-
Allows DNS hostnames that resolve to private/internal addresses. Literal IP URL targets, localhost, metadata hosts, link-local addresses, and reserved addresses remain blocked.
-
-
-
-
-
-
-
-
Deep Research runs only when the user selects it for the message.
-
-
-
-
-
Hard limit: 10 pages.
-
-
-
-
-
Limits initial search-result and direct URL pages so budget remains for child pages.
-
-
-
-
-
Direct URLs beyond this cap are recorded as omitted in the ledger.
-
-
-
-
-
Includes the original current-message query.
-
-
-
-
-
Hard limit: 30 seconds.
-
-
-
-
-
Every redirect target is revalidated.
-
-
-
-
-
Hard limit: 5 MB.
-
-
-
-
-
Depth 2 follows selected links from seed and child pages.
-
-
-
-
-
- {% set js_runtime = source_review_runtime_capabilities or {} %}
-
-
-
-
-
Deep Research follows only scored, policy-approved links within the page and depth budgets.
-
-
-
-
-
-
-
The selected chat model can propose bounded current-message-only query variants before page review.
-
-
-
-
-
-
-
Creates a Markdown chat artifact with search queries, reviewed sources, skipped URLs, and coverage.
-
-
-
-
-
-
-
When source pages expose candidate links, the selected chat model can rank those candidates before the server fetches them.
-
-
-
-
-
-
-
Requires verified Playwright browser runtime support on the app host.
-
- {{ js_runtime.message or 'Runtime support has not been checked yet.' }}
-
- {% if not js_runtime.js_rendering_available %}
-
Install/enable the Playwright Chromium runtime, then reload Admin Settings to enable this option.
- {% endif %}
- {% if js_runtime.sandbox_disabled %}
-
Chromium sandbox is disabled by environment configuration.
- {% endif %}
-
-
-
-
-
When JavaScript rendering is enabled, Deep Research can click visible Load More controls until this cap is reached.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Web Search Consent Required
-
-
-
- When you use Grounding with Bing Search, your customer data is transferred outside of the Azure compliance boundary to the Grounding with Bing Search service. Grounding with Bing Search is not subject to the same data processing terms (including location of processing) and does not have the same compliance standards and certifications as the Azure AI Agent Service, as described in the Grounding with Bing Search TOU. It is your responsibility to assess whether use of Grounding with Bing Search in your agent meets your needs and requirements.
-
-
- Only the user's current message is sent for web search. Users should avoid including sensitive content in any message that uses web search.
-
-
-
-
-
-
-
-
-
-
-
-
Web Search Test
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
URL Policy Test
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Azure AI Search
-
- Configure Azure AI Search settings.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Document Intelligence
-
- Configure Azure Document Intelligence settings. Document Intelligence always powers
- Standard extraction and is required for workspaces and chat file uploads.
-
-
-
-
-
-
-
-
- {% if content_understanding_supported %}
-
- Enhanced extraction uses Azure AI Content Understanding, which returns tables,
- page structure, checkbox states, and AI-generated descriptions of figures, charts, and images.
- Configure the connection below.
-
- {% else %}
-
- Azure AI Content Understanding is not available in the
- {{ azure_environment }} cloud, so Enhanced extraction uses
- Document Intelligence Layout here. There is nothing more to configure —
- Enhanced still captures tables, page structure, forms, and checkbox states.
-
- {% endif %}
-
-
-
-
-
- Enhanced captures more document detail for PDFs and images, including tables, page structure, and checked or unchecked marks. It adds latency and has a 6X increase for every 1000 pages when selected.
-
-
-
-
-
- Auto samples this many first PDF pages with Document Intelligence Layout. If it detects tables, selection marks, or figures, the full PDF uses Enhanced; otherwise it finishes with Standard. Images use Enhanced in Auto mode.
-
-
-
-
Standard: Document Intelligence Read. Fastest and lowest-cost path for plain text PDFs and images.
-
Enhanced: best for tables, section structure, page layout, forms, checkbox states, and figure descriptions. Expect more latency and higher cost.
-
Auto: samples the first pages with Document Intelligence Layout, then uses Enhanced only when the sample shows tables, selection marks, or figures.
-
-
-
-
-
-
-
-
-
- Captures equations in PDFs and images as LaTeX rather than approximate OCR text. This is a
- billed Document Intelligence add-on that adds per-page cost to every Enhanced
- extraction, so it is off by default. It applies to the Layout model only, so it has no effect
- while extraction is set to Standard.
-
-
- {% if content_understanding_supported %}
-
-
-
Azure AI Content Understanding
-
-
-
- Required for Enhanced extraction. Deployed from a Microsoft Foundry resource.
- If this is left blank, Enhanced falls back to Document Intelligence Layout.
-
-
-
-
-
-
- Your Microsoft Foundry resource endpoint, without a trailing path.
-
-
-
-
-
-
-
- Managed identity requires the Cognitive Services User role on the Foundry resource.
-
- Neither extraction engine describes figures inside Word and PowerPoint files. When this is on,
- embedded images are pulled out of the file, analyzed with whichever engine backs the selected
- extraction mode, and indexed as their own citable chunks. This works with Standard extraction
- too, using Document Intelligence.
-
-
-
-
-
-
-
-
-
-
Images narrower or shorter than this are skipped as icons or spacers.
-
-
-
-
-
Caps per-document cost. Duplicate images are analyzed once.
-
-
-
-
-
-
-
-
-
Standard, Enhanced, and Auto
-
-
-
-
Standard always uses Azure Document Intelligence Read. It is the fastest and lowest-cost path for mostly text-based PDFs and images, and it is what runs when Enhanced extraction is turned off.
-
Enhanced is for documents where structure matters: tables, page layout, headings, forms, checked or unchecked boxes, and figures.
-
-
In Azure commercial clouds, Enhanced uses Azure AI Content Understanding, which additionally generates natural-language descriptions of figures, charts, and diagrams.
-
In Azure Government and custom clouds, Content Understanding is unavailable, so Enhanced automatically uses Document Intelligence Layout instead. Tables and checkbox states still work; figure descriptions do not.
-
If Content Understanding is enabled but unreachable, the document falls back to Document Intelligence Layout and the reason is recorded on the document.
-
-
Auto lets the platform decide per document. It samples the configured number of first PDF pages with Document Intelligence Layout, which is the cheaper detector. If those pages contain tables, selection marks, or figures, the full document is extracted with Enhanced; otherwise it is extracted with Standard. Images always use Enhanced in Auto mode because they are single-page inputs that benefit from figure and spatial analysis.
-
Cost: Enhanced adds latency and cost on every document. Content Understanding also invokes a language model per document, so it is more expensive than Document Intelligence Layout. Auto is usually the best value.
-
-
-
-
-
-
-
-
-
-
-
Set Up Azure AI Content Understanding
-
-
-
-
Content Understanding is part of Microsoft Foundry. Follow these steps, then paste the endpoint and key below.
-
1. Create a Microsoft Foundry resource
-
- In the Azure portal, create a Microsoft Foundry resource in one of the supported regions:
- East US, East US 2, West US, West US 3, South Central US, North Europe, West Europe, Sweden Central,
- UK South, Australia East, Japan East, or Southeast Asia. You need Contributor or higher on the subscription
- or resource group.
-
-
- Content Understanding is not offered in Azure Government or other sovereign clouds. In those clouds
- SimpleChat automatically uses Document Intelligence Layout for Enhanced extraction.
-
-
2. Deploy the models Content Understanding needs
-
- Analyzers that describe figures require a completion model and an embedding model to be deployed and set
- as resource defaults. In the
- Content Understanding settings page,
- add your Foundry resource and leave
- Enable autodeployment for required models if no defaults are available checked. Without this step,
- analysis requests fail with a missing model deployment error.
-
-
3. Copy the endpoint and key
-
- In the Azure portal, open the Foundry resource and go to
- Resource Management → Keys and Endpoint. The endpoint looks like
- https://your-resource.services.ai.azure.com. Paste it into
- Content Understanding Endpoint, and paste either key into
- Content Understanding Key.
-
-
4. Or use managed identity instead of a key
-
- Set Authentication Type to Managed Identity and assign this application's identity the
- Cognitive Services User role on the Foundry resource. That role assignment is required even
- for resource owners.
-
-
5. Test the connection
-
- Use Test Content Understanding Connection to confirm the endpoint, credentials, and analyzer
- are reachable before saving.
- See the
- Content Understanding quickstart
- for more detail.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Chunk Sizes
- Cap: {{ chunk_size_cap }}
-
-
Custom chunk sizes apply to new uploads only. Existing documents keep their current chunks.
-
- Heads up: Overrides are capped at {{ chunk_size_cap }} (2x embedding context window, fallback 16,384).
-
-
-
-
-
-
-
-
- Chunk sizes above the cap will be reduced automatically.
-
-
- {% set chunk_settings = chunk_size_settings or {} %}
- {% set chunk_defaults = chunk_size_defaults or {} %}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Minimum enforced at 50% of target on merge.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Applies to new audio transcripts.
-
-
-
-
-
Pages per chunk after extraction.
-
-
-
-
-
Slides per chunk after extraction.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- AI Video Intelligence
-
-
Extract insights and make video content searchable and interactive
-
-
-
-
-
-
-
- Make Video Content Fully Searchable: Upload videos to your workspace and automatically extract transcripts, identify speakers, detect topics, and generate searchable timestamps. Your AI can then answer questions about video content, cite specific moments, and provide deep insights.
-
-
-
-
-
-
-
-
-
- Upload video files (MP4, AVI, MOV, etc.) to workspaces where Azure Video Indexer automatically processes them.
- Extract spoken content, identify speakers, detect faces, recognize brands, and generate searchable metadata—perfect for meetings, presentations, training videos, and recorded content.
-
Choose the endpoint family that matches your deployed cloud. Use Custom only when you need a non-standard Video Indexer endpoint.
-
+
+
+
+
+
+
-
- Current App Service environment: {{ azure_environment_label }}. This selector saves the Video Indexer API endpoint. If you are switching between Azure Public, Azure Government, or a custom cloud, update AZURE_ENVIRONMENT in your App Service configuration as well.
-
+
+
+
-
- The selected Video Indexer cloud does not match this app's current AZURE_ENVIRONMENT. Update the App Service configuration if you are moving to a different cloud.
-
+
+
+
-
-
-
-
-
-
Only required when using a custom cloud or non-standard Video Indexer endpoint.
-
+
+
+
-
-
-
-
Saved endpoint value used for Video Indexer API calls.
-
+
+
+
-
-
-
-
The Azure resource group containing your Video Indexer account
-
+
+
+
-
-
-
-
Your Azure subscription ID
-
+
+
+
+
+
+
+
+
+
+
+
+ {% endif %}
-
-
-
-
The name of your Video Indexer account resource
-
+
+ {% include "admin/_panes/security.html" %}
-
-
-
-
Azure region where your Video Indexer account is deployed (e.g., eastus, westus2, northeurope)
-
-
-
-
-
Found in the Video Indexer account Overview page in Azure Portal
-
+ {% include "admin/_panes/agents.html" %}
-
-
-
-
Default for {{ azure_environment_label }}: {{ default_video_indexer_arm_api_version }}
-
-
-
-
-
-
-
+
+ {% include "admin/_panes/governance.html" %}
-
-
-
-
-
-
-
-
-
- AI Voice Conversations
-
-
Transform your AI experience with natural voice interactions
-
-
-
-
+
+ {% include "admin/_panes/logging.html" %}
-
-
-
-
-
-
-
- Let users opt in to a bundled sound when an AI response finishes outside their active view.
- These local cues do not require Azure Speech Service.
-
-
+ {% include "admin/_panes/general.html" %}
-
-
- One Speech resource, three features: Audio file uploads, Voice Input, and Voice Responses all use the same Azure Speech Service section below. Configure the Speech resource once, then turn on whichever speech features you need.
-
+ {% include "admin/_panes/custom-pages.html" %}
-
-
- {% set audio_runtime = audio_runtime_capabilities or {} %}
- {% set audio_supported_extensions = audio_runtime.supported_extensions or [] %}
- {% set audio_direct_extensions = audio_runtime.direct_transcription_extensions or [] %}
-
-
-
-
-
- Upload audio files (MP3, WAV, M4A, etc.) to workspaces where they're automatically transcribed and indexed.
- The AI can then search, analyze, and answer questions about audio content—perfect for meetings, interviews, lectures, and podcasts.
-
-
-
- {{ audio_runtime.message or 'Audio runtime support has not been checked yet.' }}
-
- Without FFmpeg, source-file fallback is best for: {{ audio_direct_extensions|join(', ') }}. Container builds can include FFmpeg for broader codec support.
-
- {% endif %}
-
-
-
-
-
-
-
-
-
- Talk to your AI instead of typing. Record voice messages up to 90 seconds directly in the chat interface.
- Azure Speech Service instantly transcribes your speech with high accuracy, supporting multiple languages and accents.
-
- Hear AI responses read aloud in natural, human-like voices powered by Azure's advanced neural Text-to-Speech.
- Each message includes a speaker button—click to listen while multitasking, commuting, or whenever reading isn't convenient.
-
+
+ {% include "admin/_panes/control-center-config.html" %}
-
-
-
- Azure Speech Service Configuration
-
-
Configure the shared Azure Speech resource used by audio transcription, voice input, and text-to-speech.
+ {% include "admin/_panes/data-management.html" %}
-
- Shared configuration: These settings apply to all enabled speech features. If you use managed identity and also enable Voice Responses, fill in the Speech Resource ID field so the Speech SDK can authenticate synthesis requests.
-
+ {% include "admin/_panes/scale.html" %}
-
-
-
-
Use the resource-specific custom-domain endpoint when selecting Managed Identity.
-
-
-
-
-
Required for speech recognition locale defaults and for text-to-speech when using Managed Identity.
-
+ {% include "admin/_panes/workspace-identities.html" %}
-
-
- Resource ID builder: If the full ARM resource ID is hard to find in the portal, enter the subscription ID, resource group, and Speech resource name below. Simple Chat can build the resource ID for you.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
If you use a custom-domain Speech endpoint, this is usually the first part of that hostname.
-
-
-
-
-
+ {% include "admin/_panes/file-sync.html" %}
-
Provide Subscription ID, Resource Group, and Speech Resource Name to auto-build the ARM resource ID.
+ {% include "admin/_panes/workspaces.html" %}
-
-
-
Required for Voice Responses when using Managed Identity. You can paste the full value manually, or let the fields above build it for you.
-
-
-
-
-
+ {% include "admin/_panes/citation.html" %}
-
-
-
-
-
-
-
-
-
-
-
Required only when Authentication Type is set to Key.
-
-
- Managed identity roles: Start with Cognitive Services Speech User. If fast transcription or other write-style speech operations still return authorization errors, add Cognitive Services Speech Contributor. Managed identity also requires a custom-domain endpoint.
-
+ {% include "admin/_panes/safety.html" %}
-
-
-
-
- Enhanced Citations
-
- will dramatically improve the citation experience for video and audio files.
-
-
-
-
-
-
- Prepare a prefilled email draft for bug reports or feature requests. This utility is separate from saved settings and records each submission intent in the activity log before opening your local email client.
-
-
- Email workflow: This opens a text-only email draft in your local mail client. If you need to share screenshots or files, add them manually after the draft opens.
-
+ {% include "admin/_panes/search-extract.html" %}
-
-
-
-
- Report a Bug
-
-
Something isn’t working as expected.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+ {% include "admin/_panes/send-feedback.html" %}
-
-
-
- Request a Feature
-
-
Suggest an improvement or new capability.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+ {# Latest Features stays last so it never opens by default #}
+ {% include "admin/_panes/latest-features.html" %}