diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 000000000..c4047f8e8 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,33 @@ +# Keep ACR build context small and prevent local secrets/artifacts from being uploaded. +** + +!application/ +!application/single_app/ +!application/single_app/** +!docker-customization/ +!docker-customization/** + +.git/ +.github/ +.vscode/ +.azure/ +artifacts/ +deployers/ +docs/ +functional_tests/ +ui_tests/ +scripts/ + +**/.env +**/.env.* +**/.venv/ +**/venv/ +**/__pycache__/ +**/.pytest_cache/ +**/*.pyc +**/*.pyo +**/*.pyd + +application/single_app/flask_session/ +application/single_app/uploaded_openapi_files/ +application/single_app/instance/ \ No newline at end of file diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 000000000..826697e96 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,77 @@ + + +## Summary + + + +- +- + +## Linked issue + + + +Refs # + +## Release Notes & Latest Features + + + +- [ ] New Feature +- [ ] Bug Fix +- [ ] UI Enhancement +- [ ] Breaking Change +- [ ] Internal only + +Is this visible to end users? + +- [ ] Yes +- [ ] No + +Is this admin-facing (Admin Settings, governance, deployment, config)? + +- [ ] Yes +- [ ] No + +Should this become a Latest Feature card? + +- [ ] Yes +- [ ] No +- [ ] Already added + +Screenshot needed for the card? + +- [ ] Yes +- [ ] No +- [ ] Attached + +## Version bump + + + +- [ ] `application/single_app/config.py` `VERSION` third segment bumped, or not needed because this is docs-only +- [ ] `deployers/version.txt` bumped, or not needed because `deployers/` was not changed + +## Testing / validation + + + +- +- + +## Documentation + + + +- [ ] Release notes updated, or not needed +- [ ] Feature documentation updated, or not needed +- [ ] Fix documentation updated, or not needed + +## Security checklist + + + +- [ ] New Flask routes include `@swagger_route(security=get_auth_security())` +- [ ] Settings sent to non-admin frontends use `sanitize_settings_for_user()` +- [ ] Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS +- [ ] No secrets, keys, connection strings, or local-only artifacts are included diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..2c48305b7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + groups: + github-actions: + patterns: ["*"] + schedule: + interval: "weekly" + cooldown: + default-days: 7 diff --git a/.github/instructions/docs_coverage.instructions.md b/.github/instructions/docs_coverage.instructions.md new file mode 100644 index 000000000..fdc594965 --- /dev/null +++ b/.github/instructions/docs_coverage.instructions.md @@ -0,0 +1,104 @@ +--- +applyTo: '**' +--- + +# Documentation Coverage + +## Why this exists + +The documentation site is kept in sync with the application by a generated +inventory plus tests. Before this was in place, coverage decayed silently: the +app had 111 capability toggles, 18 admin settings tabs, 27 action plugins, and +47 chat controls while the docs described roughly a dozen capabilities and had +no per-tab, per-action, or per-control reference at all. + +## The rule + +When a change adds or renames any of the following, the same change must update +the documentation: + +| You added or renamed | Document it in | +|---|---| +| An `enable_*` settings key | The relevant `docs/admin/.md` settings table, and claim the key in `docs/_data/features.yml` | +| An admin settings tab | A new `docs/admin/.md` page | +| A Semantic Kernel action plugin | A new `docs/reference/actions/.md` page | +| A chat UI control | `docs/reference/chat-controls.md` | +| A user-facing app page or major surface | A guide under `docs/guides/` | + +## Regenerating the inventory + +The application surface inventory is generated, not hand-written: + +```powershell +python .\scripts\build_docs_inventory.py +``` + +This writes `docs/_data/app_surface.yml`. Commit the regenerated file with your +change. The inventory deliberately does not record the application version, so +it only changes when the application surface actually changes. + +## Verifying + +```powershell +python .\functional_tests\test_docs_app_surface_coverage.py +python .\functional_tests\test_docs_site_quality.py +``` + +The coverage test fails when any inventory item is undocumented, and when the +committed inventory is stale relative to the application. + +## Internal-only flags + +A settings key that has no admin-facing UI and is purely an internal rollout, +telemetry, or tuning switch may be exempted. Add it to `CAPABILITY_EXEMPTIONS` +in `functional_tests/test_docs_app_surface_coverage.py` **with a written +justification**. Exemptions are themselves checked for staleness, so a flag that +is later removed from the application will fail the test until the exemption is +deleted. + +Do not use an exemption to avoid writing documentation for a user-facing +capability. + +## Screenshots and videos + +Documentation pages declare media slots that render a visible placeholder card +until the asset exists. To add a screenshot, save the file at the exact path the +placeholder names, for example `docs/images/admin/general-tab.png`. No YAML or +code change is required. + +Videos are never committed to the repository. Upload the recording to YouTube or +Microsoft Stream, save a poster frame under `docs/images/video-posters/`, and add +the watch URL to the slot in `docs/_data/media.yml`. + +Outstanding media is listed at `/contributing/media-status/`. Missing media does +not fail the build, so it never blocks a change, but it stays visible. + +## Writing quality + +Documentation pages must explain **what a capability does and why someone would +use it**, not restate control names. + +Do not write: + +- "Turns X on or off" or "Sets X" as a description. +- The same boilerplate paragraph across multiple sections or pages. +- Procedures that only describe using a form, such as "Open the page, change the + fields, save". +- Prerequisites that would apply to any page. + +Never invent a setting, default, field, or behavior. A shorter accurate page is +better than a longer speculative one. + +## Page structure + +Write plain markdown with real `##` and `###` headings. The site generates its +"On this page" table of contents and heading anchors from rendered `h2`/`h3` +elements, so pages authored as HTML card markup get neither. Do not add +`
`, `
`, or card/badge markup to documentation pages. + +## Browser assets + +The documentation site loads no third-party assets. Everything is vendored under +`docs/assets/vendor/` and pinned by version. Do not add a CDN ` @@ -1112,4 +853,4 @@ {% if not app_settings.show_logo and app_settings.hide_app_title %} {% endif %} - \ No newline at end of file + diff --git a/application/single_app/templates/_sidebar_short_nav.html b/application/single_app/templates/_sidebar_short_nav.html index 2860ec865..450f28f52 100644 --- a/application/single_app/templates/_sidebar_short_nav.html +++ b/application/single_app/templates/_sidebar_short_nav.html @@ -4,6 +4,8 @@ {% set sidebar_menu_state_raw = user_settings.get('settings', {}).get('sidebarMenuState', {}) %} {% set sidebar_menu_state = sidebar_menu_state_raw if sidebar_menu_state_raw is mapping else {} %} {% set sidebar_settings = settings if settings is defined else app_settings %} +{% set latest_features_nav_is_hidden = latest_features_nav_hidden | default(false) %} +{% set public_workspace_labels = app_settings.public_workspace_labels %}
+
+
Restore policy and surfaces
+
+
+ + +
Create-only is non-destructive and recommended for first restore attempts.
- -
-
-
-

If you run the native Python App Service deployment instead of the container deployment, set the App Service Startup command to the following:

- 
python -m gunicorn -c gunicorn.conf.py app:app
-

Use container deployments when possible if you want the runtime defaults and startup behavior handled by the shipped image.

-
- - Startup Guidance - - - Runtime Notes - -
-
- -
-
-
- - -
-
-
-
- Guided Tutorials -
-

New guided walkthroughs help users learn the live chat and personal workspace interfaces without leaving the app.

-
- -
-
-
-

Admins can use these walkthroughs to accelerate onboarding for new users and reduce orientation time across the primary product surfaces.

-
    -
  • Guided Chat Tutorial covers the active chat experience, message actions, search flows, citations, thoughts, and export-related actions.
    • -
  • Personal Workspace Guided Tutorial walks through uploads, search, filters, list and grid views, prompts, agents, actions, and tags.
    • -
-
- - -
-
-
-
- -
-
-
-
- Background Chat Completion -
-

Personal chats can continue finishing after a user leaves the chat page, and completed responses surface as notifications with unread indicators.

-
- -
-
-
-

This makes long-running responses more reliable for users who navigate into other areas of the app before generation finishes.

-
    -
  • Completion notifications deep-link back into the finished conversation.
    • -
  • Unread markers remain visible until the response is actually opened.
    • -
  • Personal, workspace, and navigation flows now behave more consistently while chat completion continues in the background.
    • -
-
- - -
-
-
-
- -
-
-
-
- Multi-Endpoint GPT Selection -
-

Admins can expose multiple GPT choices across Azure OpenAI and Azure AI Foundry, set a saved default fallback model, and now review agent rebinding in a modal before applying changes.

-
- -
-
-
-

This is the high-value admin control for teams that want broader GPT choice without locking every workflow to a single deployment.

-
    -
  • Configure multiple model endpoints and choose which GPT deployments are available to users.
    • -
  • Set a default fallback model so summarization, agent requests, and other background flows still resolve a usable GPT when an explicit selection is missing.
    • -
  • Use the admin-only Agent Default Model Review modal to inspect inherited agents, search and filter large agent sets, and explicitly choose which review rows should be overridden to the saved default.
    • -
- - -
- - - -
-
-
-
- -
-
-
-
- Tabular Data Analysis -
-

Enhanced citations now unlock a more consistent tabular analysis experience for normal chat and workspace-backed files, not just dedicated agent scenarios.

-
- -
-
-
-

This is the highest-impact settings area to mirror here because it combines storage-backed citations, tabular previews, and consistent behavior across workspace and chat uploads.

-
    -
  • Tabular files can be analyzed with the same core approach whether they come from chat uploads or any workspace container.
    • -
  • Enhanced citations provide the blob-backed dependency for richer tabular processing and citation transparency.
    • -
  • Admins can right-size tabular preview limits based on the memory profile of their runtime.
    • -
- -
- - -
- -
-
-
All filetypes
-
- - -
- -
- -
- - -
-
- -
- -
- - -
-
-
- -
-
Tabular Preview Limits
-
- - - - Mirror of the Citations setting. Larger values support bigger previews but increase runtime memory pressure. - -
-
-
- -
- -
-
-
-
- -
-
-
-
- Citation Improvements -
-

Conversation history citation replay and citation amplification keep more grounded evidence available across follow-up turns without making the chat history unwieldy.

-
- -
-
-
-

These improvements make follow-up questions more reliable because the system can reuse prior grounded evidence instead of relying only on the assistant's last prose response.

-
    -
  • Conversation history citations carry forward prior citation summaries so later prompts can reuse earlier grounded results.
    • -
  • Citation amplification keeps richer supporting payloads available for inspection and export while keeping prompt history compact.
    • -
  • This is especially useful for larger or tabular outputs where users often ask multiple follow-up questions against the same evidence chain.
    • -
- -
- - -
-
-
-
- -
-
-
-
- Document Revisioning and Management -
-

Uploading a document with the same name now creates a new revision instead of overwriting the previous file, while older versions remain available for traceability and later analysis.

-
- -
-
-
-

This improves both document management and citation integrity for long-lived conversations that span multiple document updates.

-
    -
  • Same-name uploads create a revision family with an incremented current version instead of destroying prior history.
    • -
  • Previous versions are retained for analysis or comparison, while workspace and search views focus on the current revision by default.
    • -
  • Older conversations can still resolve citations against the correct historical document version.
    • -
  • Updated revisions inherit document classifications and tags so admins do not have to reapply metadata after every refresh.
    • -
-
- - -
-
-
-
- -
-
-
-
- Conversation Summaries and Export -
-

Conversation export now includes persistent summaries, PDF output, and easier per-message reuse and sharing actions.

-
- -
-
-
-
    -
  • Conversation details now surface a summary card with generate and regenerate actions.
    • -
  • Export supports PDF alongside existing export options.
    • -
  • Per-message actions support Markdown export, Word export, open in email, and use as prompt.
    • -
-
-
- -
-
-
- - -
-
-
-
-
-
- -
-
-
-
- Agent and Action Operations -
-

Recent updates improve manageability for agents and actions with richer views, easier SQL connectivity checks, and better operational tracking.

-
- -
-
-
-
    -
  • List and grid view toggles give admins and users a better way to browse agents and actions.
    • -
  • SQL actions now include an inline Test Connection button before save.
    • -
  • User tracking and activity logging improve auditability for agent and action changes.
    • -
-
- - -
-
-
-
- -
-
-
-
- AI Transparency -
-

Processing Thoughts provide a clearer view into model activity, duration, and execution flow while responses are being generated.

-
- -
-
-
-

Admins can enable this once and let users see more of the model pipeline, including sending, generating, and responded states with clearer timing information.

- -
- - -
-
- -
-
-
-
- -
-
-
-
- Fact Memory -
-

Users can now save Instructions and Facts on their profile so the assistant can apply durable preferences every time and recall relevant personal context only when needed.

-
- -
-
-
-

Fact Memory gives users a compact profile experience for managing two distinct memory types: always-on Instructions and relevance-based Facts.

-
    -
  • Instructions act like stable user preferences and are applied on every prompt unless the current message overrides them.
    • -
  • Facts are recalled only when relevant and now appear as dedicated thought and citation entries in chat.
    • -
  • The profile page includes a compact add flow plus a popup manager for search, paging, edit, retag, and delete actions.
    • -
  • Admins can choose whether this announcement is visible on the user-facing Latest Features page from General > User-Facing Latest Features.
    • -
- -
- - - -
-
-
-
- -
-
-
-
- Redis and Key Vault -
-

Redis configuration now supports using a Key Vault secret name instead of storing the access key directly in settings.

-
- -
-
-
-

This is useful for teams standardizing on Key Vault-backed secret storage while still using Redis for cache and session scenarios.

-
    -
  • Use Redis authentication type Key Vault when you want the stored value to represent a secret name instead of a raw Redis key.
    • -
  • This works best when Key Vault is already configured for the app.
    • -
- -
- - -
- -
-
-
Redis Cache Settings
-
- - -
-
- - -
-
- -
- - -
-
- When using Key Vault, store the secret name here instead of the raw Redis key. -
-
-
-
-
- -
-
-
-
- -
-
-
-
- Send Feedback to the SimpleChat Team -
-

Admins now have a dedicated Send Feedback tab for bug reports and feature requests that opens a prefilled email draft and writes an audit record to the activity log.

-
- -
-
-
-

Use the Send Feedback tab when you want to report a bug or suggest a feature directly from Admin Settings without leaving the page.

-
    -
  • Opens a prefilled email draft addressed to simplechat@microsoft.com.
    • -
  • Logs the action to the activity log so admins can audit when feedback emails were prepared.
    • -
  • Keeps the workflow simple by using text-only email content with no confusing pseudo-attachment step.
    • -
- - Open Send Feedback - -
-
-
- -
-
-
-
- Support Menu -
-

Support can now expose user-facing Latest Features and Send Feedback workflows directly in everyday navigation.

-
- -
-
-
- -
    -
  • Admins can enable or disable the Support menu and rename it for user navigation.
    • -
  • Send Feedback now routes users to an internal recipient email address defined by admins.
    • -
  • The user-facing Latest Features page can be curated feature-by-feature so teams only share the items they want visible.
    • -
  • The General tab now includes a dedicated User-Facing Latest Features checklist so admins can quickly confirm which announcements will be visible to end users.
    • -
- - Open General Settings - -
- - -
-
-
-
- - {% for release_group in support_latest_feature_release_groups_preview %} - {% if release_group.id == 'previous_release' %} -
-
-
-
- {{ release_group.label }} -
-

{{ release_group.description }}

-
- -
-
-
- -
- {% for feature in release_group.features %} -
-
-
-
-
-
{{ feature.title }}
-

{{ feature.summary }}

-
- - {% if settings.support_latest_features_visibility.get(feature.id, true) %}Shared with Users{% else %}Hidden from Users{% endif %} - -
-

{{ feature.details }}

- {% if feature.guidance %} -
    - {% for tip in feature.guidance %} -
  • {{ tip }}
    • - {% endfor %} -
- {% endif %} - {% if feature.images %} -
- {% for image in feature.images %} - - {% endfor %} -
- {% endif %} - {% if feature.actions %} -
- {% for action in feature.actions %} - - {{ action.label }} - - {% endfor %} -
- {% endif %} -
-
-
- {% endfor %} -
-

Visibility still comes from General > User-Facing Latest Features, so admins can keep previous release content available without promoting every item forever.

-
-
-
- {% endif %} - {% endfor %} - {% endif %} - - -
-

- Enable trusted deployment-time custom pages and manage metadata for simple static pages served from the application custom_pages folders. -

- -
-
-
- Custom Pages -
- -
-
- - - - -
-

When disabled, /custom routes return Not Found before loading custom metadata, files, or Python extensions.

- -
-
- - - This name appears when custom pages are grouped into a menu. -
- -
- - - When disabled, 1-2 custom pages show as top-level nav items and 3+ pages show as a menu. -
- -
-
-
Static Page Metadata
-

Create metadata contracts for simple pages that use files from custom_pages/html, css, js, assets, and json.

-
-
- - -
-
- -
- - - - - - - - - - - - - - - - - - -
SlugTitleTypeAccessRolesStatusNavActions
Loading custom pages...
-
-
-
-
- - -
- -

- Configure all AI model settings including GPT for text generation, embeddings for semantic search, and image generation capabilities. -

- -
-
- Model Endpoints -
-

- Manage multiple AI model endpoints (Azure OpenAI and Azure AI Foundry). When enabled, model selection in chat is driven by these endpoints. -

- - {% if not settings.enable_multi_model_endpoints %} -
- - -
- {% endif %} - - {% if settings.enable_semantic_kernel %} -
-
-
-
Agent Default Model Review
-

- Review local agents in a modal, bulk-bind inherited agents to the saved default model endpoint, and explicitly override selected agent model choices when you need to manage cost or move to newer models. -

-
-
- -
-
-
- {% if settings.enable_multi_model_endpoints %} - Save your AI model settings before reviewing or migrating agents. - {% else %} - Enable multi-endpoint model management to review and rebind agents to a saved default model. - {% endif %} -
- -
- -
-
- Ready: 0 - Needs Default: 0 - Manual Review: 0 - Already Migrated: 0 -
-
-
- Open the review modal to search, filter, and selectively rebind agents to the saved default model. -
-
- - - {% else %} - - {% endif %} - -
- - -
- Used for tasks such as conversation summarization, fallback, and other operations when an agent is selected. -
-
- - - - -
-
-
Global Endpoints
-
- - -
-
-
- - - - - - - - - - - - - -
NameProviderSelected ModelsStatusActions
-
-
- {% if not settings.enable_multi_model_endpoints %} - - {% endif %} -
- - -
-
- Processing Thoughts -
-

When enabled, real-time processing steps are shown to users during chat responses and persisted for later review.

-
- - - -
-
- - -
-
- Embeddings Configuration -
-

- Configure your embeddings settings. These are used for semantic search, knowledge-base lookups, etc. -

- - -
- - - -
- -
-
-
- - -
-
- - -
-
- - -
-
- - -
-
- -
- - -
-
-
-
- -
- Save pending changes to settings before clicking Fetch Embedding Models
- - - - - - - - -
- -
-
-
- - -
-
-
-
-
- -
-
- - -
-
- - -
-
- - -
-
- -
- - -
-
-
- - -
-
- - -
-
- Image Generation Configuration -
-

- Configure image generation settings. Enable/disable, set endpoints, and choose a model. -

- - -
- - - -
-
- -
- - - -
- -
-
-
- - -
-
- - -
-
- - -
-
- - -
-
- -
- - -
-
-
-
- -
- - Save pending changes to settings before clicking Fetch Image Generation Models
- - - - - - - - -
- -
-
-
- - -
-
-
-
-
- -
-
- - -
-
- - -
-
- - -
-
- -
- - -
-
-
-
- - -
-
- - - - {% include '_multiendpoint_modal.html' %} - - - -
- - -
-

- Configure Control Center access and permissions for administrators. -

- -
-
-
-
- -
-
-

- Automatic Data Refresh -

-

Run the Control Center metrics refresh on a daily UTC schedule

-
-
-
- -
- - - -
- -
-
- - -
-
- -
- {% if settings.control_center_auto_refresh_next_run %} - {{ settings.control_center_auto_refresh_next_run }} - {% else %} - Will be calculated when saved - {% endif %} -
-
-
-
- - -
-
-
-
- -
-
-

- Control Center Access -

-

Manage who can access Control Center features and administrative tools

-
-
- -
- -
- - About Control Center: The Control Center is a powerful administrative dashboard that provides user management, group oversight, public workspace control, and detailed activity monitoring. Use role-based access controls below to delegate administrative responsibilities. -
- - -
-
- - -
-

- Required app role value: ControlCenterAdmin. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only users assigned this role can access the Control Center and all management features. Regular Admins will lose access. -

-
- - User Management - - - Group Management - - - Public Workspaces - - - Activity Logs - -
-
- - -
-
- - -
-

- Dashboard-only app role value: ControlCenterDashboardReader. Assign this role to users or groups in the Enterprise App before enabling dashboard-only access. Users assigned ControlCenterAdmin can also access the dashboard when Control Center app-role enforcement is enabled. -

-
- - Dashboard Statistics - - - Activity Trends - - - Usage Metrics - -
-
- -
- - Important: Configure these roles in your identity provider (Entra ID). When role requirements are enabled, standard Admins without the specific roles will be denied access to Control Center features. -
- - -
-
- Best Practices -
-
    -
  • ControlCenterAdmin: Grant to IT administrators who need full control over users, groups, and workspaces
    • -
  • ControlCenterDashboardReader: Grant to managers, compliance officers, or stakeholders who need visibility into platform usage without administrative powers
    • -
  • Separation of Duties: Enable role requirements if you need to restrict Control Center access from general application admins
    • -
  • Audit Trail: All Control Center actions are logged in Activity Logs for compliance and security auditing
    • -
-
-
-
- -
-
-
-

Data Management

-

Configure best-effort backups, restore preparation, and migration job orchestration.

-
- -
- - - -
- -
-
-
- -
-
-

Backup

-

Configure when backups run, where artifacts are stored, and how backup files are encrypted.

-
-
- -
-
-
-
Schedule
-

Full backups run on the selected cadence; partial backups run daily only.

-
-
-
- - -
-
-
- - -
-
- - -
Default is 03:00 UTC.
-
-
- - -
-
-
-
-
- - -
-
-
-
- - -
-
-
-
- -
-
-
- -
-
-
- - -
Core application records required for meaningful restore and migration.
-
-
-
-
- - -
Search index schemas and retrievable indexed documents.
-
-
-
-
- - -
Original source files used by Enhanced Citations.
-
-
-
-
-
-
-
- -
-
-
-
Storage
-

Store backup artifacts in Azure Blob Storage.

-
- -
-
- - Use a dedicated backup storage account. Data Management will reject storage that matches the Enhanced Citations connection string or Blob endpoint. -
-
-
- - -
-
- - -
-
- - -
-
-
-
- - -
No connection string saved yet.
-
-
- - -
-
-
- -
-
-
-
Encryption
-

Generate a 256-bit backup encryption key.

-
- -
-
- - -
-
-
Key storage
-
Not configured
-
Key reference
-
Not configured
-
-
- -
-
Key Vault is strongly recommended
-
Generated backup encryption keys are stored in the Data Management settings document when Key Vault is not enabled.
- Open Key Vault settings -
-
-
- -
-
-
-
Backup Operations
-

Queue immediate full or partial backup jobs using the settings above.

-
-
- - -
-
-

Jobs use Cosmos-backed leases so scaled-out App Service workers do not run the same backup twice.

-
-
- -
-
-
- -
-
-

Migration

-

Use migration when moving SimpleChat data into another SimpleChat environment, rehearsing a cutover, or preparing a controlled environment transfer.

-
-
-

- Migration targets a separate Cosmos account that will host the standard SimpleChat database and container layout. The database name is fixed to SimpleChat so exported metadata, container mappings, and future apply jobs use the same app contract in every environment. -

- -
-
-
-
Target Cosmos Database
-

Fill out the target Cosmos account connection that migration jobs will validate and write to.

-
- -
-
- For managed identity, assign this App Service identity Cosmos DB Data Contributor on the target account and allow network access from this application environment. -
-
-
- - -
-
- - -
-
- - -
Always SimpleChat.
-
-
-
- - -
-
- -
-
-
-
Target Search
-

Migration copies selected indexed documents into matching SimpleChat AI Search indexes on the target search service.

-
- -
-
-
- - -
-
- - -
-
- - -
-
-
- -
-
-
-
Target Enhanced Citation Storage
-

Required only when migrating source document blobs for Enhanced Citations.

-
- -
-
-
- - -
-
- - -
-
- - -
-
-
- -
-
-
-
Migration Workflow
-

Choose users, groups, and public workspaces to migrate, then choose whether to include each scope's documents, AI Search entries, and source blobs.

-
- -
-
-
-
-
Users
- -
- - -
-
Available
-
-
Selected
-
-
- - -
-
-
-
-
-
Groups
- -
- - -
-
Available
-
-
Selected
-
-
- - -
-
-
-
-
-
Public Workspaces
- -
- - -
-
Available
-
-
Selected
-
-
- - -
-
-
-
-
-
-
- - -
-
-
-
- - -
-
-
-
-

Choose migration targets to see the summary.

-
-
- - -
-
-
- -
-
-
-

Backup Inventory

-

Track completed full and partial backups created by Data Management jobs.

-
- -
-
-
- -
-
- -
-
- -
-
-
- - - - - - - - - - - - - - - - - -
BackupCompletedContentsStorageProtectionWarningsActions
Backup inventory has not loaded yet.
-
-
- -
-
-

Job History

- -
-
- - - - - - - - - - - - - - - - -
CreatedOperationStatusProgressMessageActions
Job history has not loaded yet.
-
-
- - -
- -
-

- Configure Redis cache to improve enterprise scale and performance by caching session data. Enabling Redis allows you to horizontally scale your application across multiple instances without losing session data. -

-
-
- Redis Cache -
-

- Enable Redis Cache to store session data in a distributed cache. This is recommended for production and multi-instance deployments. -

-
- - - -
-
-
- -

(example: simple-chat.redis.cache.windows.net)

- -
-
- - -
-
- -
- - -
-
- Enter the full Key Vault secret name. - Enable Key Vault for Agent and Action Secrets - must be enabled and configured. -
-
- -
-
-
- -
-
-
-
- Cosmos DB Throughput -
-

- Monitor RU utilization and automatically adjust shared database or dedicated container throughput. -

-
- -
- -
- - - - - - -
- -
- - Automation checks Cosmos throughput on the Metrics Window cadence while enabled and saves the last observed database or container view. SimpleChat can scale throughput up or down at 10,000 RU/s or lower. Above 10,000 RU/s, SimpleChat monitors utilization only; use the Azure portal for capacity changes, which can take 4 to 6 hours. Native Cosmos autoscale conversion is separate from SimpleChat scale-up and scale-down automation. -
- - - -
- - - -
- -
-
-
- - -
-
- - -
-
- - -
-
- - -
-
- -
-
Metrics Window
-
-
- -
- - min -
-
-
-
- -
-
Scale Up Policy
-
-
-
- - -
-
-
- -
- - % -
-
-
- -
- - RU/s -
-
-
- -
- - min -
-
-
- - -
SimpleChat-managed scaling stops at 10,000 RU/s. Use the Azure portal above this limit.
-
-
-
- - -
-
-
-
- -
-
Scale Down Policy
-
-
-
- - -
-
-
- -
- - % -
-
-
- -
- - RU/s -
-
-
- -
- - min -
-
-
- - -
-
-
- - -
-
-
-
- - - -
-
- - - -
-
- - - -
-
- Use this when container throughput should follow one standard automation policy instead of per-container overrides. Global policy also applies the Cosmos autoscale conversion setting above to current and future dedicated-throughput containers. -
-
-
- -
- -
-
-
-
Mode
-
Not loaded
-
-
-
-
-
Current RU/s
-
Not loaded
-
-
-
-
-
RU Utilization
-
Not loaded
-
-
-
-
-
Last Checked
-
Not loaded
-
-
-
- -
-
- -
- - - - -
-
-
-
- -
-
- -
- - - - - - - - - - - - - - - - - -
- - Mode - - - - - - - - - - Actions
Refresh to load Cosmos metrics.
-
-
- - - - - - -
-
-
- Front Door -
- -
-

Configure Front Door URL for authentication and redirect flows.

- -
- - - -
- -
- - - - The base URL of your Front Door or load balancer. The system will automatically generate: -
    -
  • Home redirect: https://your-frontdoor.azurefd.net
    • -
  • OAuth2 redirect: https://your-frontdoor.azurefd.net/getAToken
    • -
- -
-
-
- - -
-
-
-
-
- - -
-

- Configure file synchronization for personal, group, and public workspaces. -

- -
-
-
- File Sync -
- -
-

- Enable File Sync globally, set conservative run limits, and choose whether workspace managers or SimpleChat admins manage sync sources. -

- - - - {% if not settings.file_sync_redis_ready %} - - {% elif settings.requested_enable_file_sync and not settings.file_sync_effective_enabled %} - - {% endif %} - -
- - - -
- -
-
-
- - -
-
- - -
-
- - -
-
- - -
-
- -
-
- - -
-
-
- - -
-
-
- - {% set file_sync_visible_source_types = settings.file_sync_visible_source_types|default(['smb', 'azure_files']) %} -
-
Visible Source Types
-

- Choose which source types appear in the Add Source workflow. OneDrive, SharePoint, and Google Workspace connectors are coming soon while validation continues. -

-
-
-
- - -
Available now.
-
-
-
-
- - -
Available now.
-
-
-
-
- - -
Coming Soon.
-
-
-
-
- - -
Coming Soon.
-
-
-
-
- - -
Coming Soon.
-
-
-
-
- - - -
-
-
-
Personal Workspace Sync
-
- - -
-
- - -
-
- - -
-
Required app role value: PersonalFileSyncUser. Assign this role to users or groups in the Enterprise App before enabling the requirement for personal sync.
-
-
- -
- - -
-
-
- - -
-
No user selected.
-
-
-
- -
-
-
Group Workspace Sync
-
- - -
-
- - -
-
- - -
-
- - No groups assigned. -
- -
-
- -
- - -
-
-
- - -
-
No group selected.
-
-
-
- -
-
-
Public Workspace Sync
-
- - -
-
- - -
-
- - -
-
- - No public workspaces assigned. -
- -
-
- -
- - -
-
-
- - -
-
No public workspace selected.
-
-
-
-
- -
- SMB source credentials are stored in Azure Key Vault when Key Vault secret storage is enabled; otherwise they use the app's existing encrypted settings path. -
-
-
- - - - - - - - -
- -
-

- Configure workspace settings like personal/group access, multimedia support, metadata, and document classification. -

- - -
-
- Personal Workspaces -
-

- Turn this on to allow access and management of your personal workspace. -

-
- - - -
-
- -
-
- Workflow -
-

- Control personal and group workflow authoring and execution for users. -

-
- - - -
-
- - - -
-

- Required app role value: WorkflowUser. Assign this role to users or groups in the Enterprise App before enabling the requirement. -

- -
- - -
- Maximum automatic tool or action calls an agent can make during one workflow run. Default is 60; increase for large document sets. -
- -
- -
- -
- - - -
-
- - - -
-
- - No groups assigned. -
- -

- Group workflow authoring is available to group Owners and Admins by default. Enable the owner-only setting below to limit group agent, action, and workflow management to Owners. -

-
- -
-
- File Downloads -
-

- Control when users can download original workspace document files from personal, group, and public workspaces. -

-
- - - -
-
-
- - - -
-
- - - -
-
- - No groups assigned. -
- -
-
- - - -
-
- - - -
-
- - No public workspaces assigned. -
- -
- - - - - - - - -
-
- Group Workspaces -
-

- Turn this on to allow access and management of group workspaces, as well as group collaboration features. -

-
- - - -
- - -
-
- - -
- - - -
-

- When enabled, no users will be able to create new groups, regardless of app role assignment. This global setting overrides the Require CreateGroups App Role setting below. -

- -
- - - -
-

- Required app role value: CreateGroups. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create groups while group workspaces and group creation are enabled. -

- -
- - -
- - - -
-

- If enabled, only the group Owner can create, edit, and delete group agents, group actions, and group workflows. Admins and other roles will only be able to view them. -

-
- -
- -
-
- Public Workspaces -
-

- Turn this on to enable public workspaces that are visible to everyone in the organization. -

-
- - - -
- -
-
-
- - - -
-

- Required app role value: CreatePublicWorkspaces. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create public workspaces while public workspaces are enabled. -

-
- -
- -
-
- File Sharing -
-

- Turn this on to enable file sharing capabilities between users and workspaces. -

-
- - - -
-
- -
-
- Chat File Uploads -
-

- Control whether users can upload files directly into chat conversations. -

-
- - - -
-
- - - -
-

- Required app role value: ChatFileUploadUser. Assign this role to users or groups in the Enterprise App before enabling the requirement. Existing chat attachments remain visible; this only controls new uploads. -

-
- -
-
- Metadata Extraction -
-

- Enable this to automatically parse and store file metadata for advanced indexing and search. -

-
- - - -
- -
- - - -
- Uses Global Endpoints when multi-endpoint model management is enabled; otherwise uses the legacy GPT/APIM deployment settings. -
-
-
- - -
-
- Multi-Modal Vision Analysis -
-

- Enable AI-powered vision analysis for images uploaded to chat or workspace. When enabled alongside Document Intelligence OCR, images will receive both text extraction (OCR) and semantic understanding (vision AI). -

- -
- How it works: -
    -
  • Document Intelligence: Extracts text from images (OCR)
    • -
  • Vision Model: Provides semantic analysis, object detection, and contextual understanding
    • -
  • Both analyses are combined and available in citations when Enhanced Citations is enabled
    • -
-
- -
- - - -
- -
- - -
Select a GPT model with vision capabilities (e.g., gpt-4o, gpt-4-vision, gpt-5, gpt-5-nano, etc.). Only vision-capable models are shown.
- - -
-
-
- - - -
-
- Document Classification -
-

- Enable this feature to allow users to classify documents uploaded to their workspaces using predefined categories. -

-
- - - -
- - -
-
Classification Categories
-

Define the labels and corresponding colors for document classification.

- - - - - - - - - - - -
LabelColorActions
- - - -
-
- - -
-
- Retention Policy -
-

Automatically delete aged conversations and documents based on configurable retention periods. Users, group owners, and public workspace admins can set their own retention policies.

- - - - -
-
-
- - - -
-
-
-
- - - -
-
-
-
- - - -
-
-
- - -
-
Default Retention Policies
-

Set organization-wide default retention periods for each workspace type. Users can override these defaults with their own preferences. Setting a default here means new users/workspaces will start with this retention period.

- - -
-
- -
-
- - -
-
- - -
-
- - -
-
- -
-
- - -
-
- - -
-
- - -
-
- -
-
- - -
-
- - -
-
- - -
-
-
- - Force Push: Override all user/group/workspace custom retention policies with the organization defaults above. Users will then use the organization default until they set their own preference. -
- -
-
-
- - -
- - - Retention policy will run once daily at this hour (UTC timezone). -
- - -
-
- -
- {% if settings.retention_policy_last_run %} - {{ settings.retention_policy_last_run }} - {% else %} - Never run - {% endif %} -
-
-
- -
- {% if settings.retention_policy_next_run %} - {{ settings.retention_policy_next_run }} - {% else %} - Not scheduled - {% endif %} -
-
-
- - -
- - - Trigger retention policy execution immediately for selected workspace types, bypassing the scheduled time. - -
- - -
- - -
-
- Workspace Scope Lock -
-

- Control whether users can unlock workspace scope in chat conversations. When scope is locked, conversations are restricted to the workspaces that produced search results, preventing accidental cross-contamination with other data sources. -

-
- - - -
-
- - -
-
- User Agreement -
-

- Configure a user agreement that users must accept before uploading files. - Supports Markdown formatting. -

- - -
- - - -
- - -
-
- - -
- -

Select where the user agreement should be shown (at least one required):

-
-
-
- - -
-
- - -
-
-
-
- - -
-
- - -
-
-
- -
- - -
- - -
- 0 / 200 words - -
-
- - -
- - - -
- - -
- -
-
-
-
- - -
- -

- Configure standard and enhanced citations features for your and group workspaces. -

- - -
-
- Standard Citations -
-

- Standard citations is always enabled for both Your Workspace and Group Workspace. -

-

- Users can see text content of the source/citation for documents. -

-
- - -
-
- Enhanced Citations -
-

- Enable Enhanced Citation to store files in a Storage Account, - and show direct references (Preview feature, files are saved to storage, presentation - layer will be available in a future release). -

- - -
- - - -
- - - -
-
- - -
- -

- Configure content safety, archiving, and user feedback settings. If Content Safety is enabled, user - messages will be sent to the safety endpoint for analysis. If User Feedback is enabled, users will see - thumbs up/down to provide feedback on AI responses. -

-
-
- Content Safety -
-

Enable content safety to filter out inappropriate content.

-
- - - -
- - -
- - -
- - - -
- - -
-
- - -
-
- - -
-
- -
- - -
-
-
- - -
-
- - -
-
- -
- - -
-
-
- - -
-
-
- - -
-
- User Feedback -
-

Enable user feedback (thumbs up/down) for AI responses.

-
- - - -
-
- - -
-
- Permissions -
-

Control which users can access specific administrative views related to safety and feedback.

- - -
- - - -
-

- Required app role value: SafetyViolationAdmin. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general Admin app role can access the Safety Violations admin page. -

- - -
- - - -
-

- Required app role value: FeedbackAdmin. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general Admin app role can access the User Feedback admin page. Requires Enable User Feedback to be active. -

-
- - - -
-
- Conversation Archiving -
-

When enabled, conversation deletions will be archived instead of permanently deleted.

-
- - - -
-
- -
- - -
- -

- Configure Azure AI Search, Document Intelligence, and multimedia support settings. -

- -
-
-
Web Search (Azure AI Foundry Agent)
- -
-

Enable web search by routing queries through an Azure AI Foundry agent configured by admins.

-
- - -
- - - -
- -
-
-
URL Access
- Shared Policy -
-

Control direct URL content fetching for pasted chat links, workflow prompts, and Deep Research source review.

-
- - -
-
- - -
Required app role value: UrlAccessUser. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use URL Access in chat or enable it for workflows.
-
- -
-
- URL Access uses the same server-side URL protections as Deep Research: non-HTTP(S) URLs, credentialed URLs, literal IP targets, localhost, metadata hosts, unsafe redirects, unsupported content types, and oversized pages are blocked before fetch. -
-
-
- - -
Hard limit: 100 direct URLs per chat message.
-
-
- - -
Hard limit: 500 direct URLs per workflow prompt.
-
-
-
- -
-
-
- - -
- - -
-
-
-
Leave blank to allow any public domain that passes safety checks. Deep Research uses this same allow list.
-
-
-
- - -
- - -
-
-
-
Blocked domains apply to URL Access and Deep Research source-page review.
-
-
- -
-
-
-
URL Policy Test
-
Check a URL against the current allowed and blocked domain rules before saving.
-
- -
-
-
- -
-
-
Deep Research
-
- Optional - -
-
-

Plan bounded web searches, inspect source pages, and keep an internal research ledger for evidence coverage. Direct pasted URLs use the shared URL Access controls above.

-
- - -
- -
-
- Server-side protections always block non-HTTP(S) URLs, literal IP URL targets, localhost, metadata hosts, credentialed URLs, excessive redirects, unsupported content types, oversized pages, and requests beyond the configured page budget. DNS hostnames that resolve to private/internal addresses require the internal-host opt-in below. -
- -
- - -
Required app role value: DeepResearchUser. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use Deep Research.
-
- -
- - -
Allows DNS hostnames that resolve to private/internal addresses. Literal IP URL targets, localhost, metadata hosts, link-local addresses, and reserved addresses remain blocked.
-
- -
-
- - - -
Deep Research runs only when the user selects it for the message.
-
-
- - -
Hard limit: 10 pages.
-
-
- - -
Limits initial search-result and direct URL pages so budget remains for child pages.
-
-
- - -
Direct URLs beyond this cap are recorded as omitted in the ledger.
-
-
- - -
Includes the original current-message query.
-
-
- - -
Hard limit: 30 seconds.
-
-
- - -
Every redirect target is revalidated.
-
-
- - -
Hard limit: 5 MB.
-
-
- - -
Depth 2 follows selected links from seed and child pages.
-
-
- -
-
- {% set js_runtime = source_review_runtime_capabilities or {} %} -
- - -
-
Deep Research follows only scored, policy-approved links within the page and depth budgets.
-
-
-
- - -
-
The selected chat model can propose bounded current-message-only query variants before page review.
-
-
-
- - -
-
Creates a Markdown chat artifact with search queries, reviewed sources, skipped URLs, and coverage.
-
-
-
- - -
-
When source pages expose candidate links, the selected chat model can rank those candidates before the server fetches them.
-
-
-
- - -
-
Requires verified Playwright browser runtime support on the app host.
-
- {{ js_runtime.message or 'Runtime support has not been checked yet.' }} -
- {% if not js_runtime.js_rendering_available %} -
Install/enable the Playwright Chromium runtime, then reload Admin Settings to enable this option.
- {% endif %} - {% if js_runtime.sandbox_disabled %} -
Chromium sandbox is disabled by environment configuration.
- {% endif %} -
-
- - -
When JavaScript rendering is enabled, Deep Research can click visible Load More controls until this cap is reached.
-
-
-
- - -
-
-
-
- - -
-
-
-
-
- - - - - - - - -
-
Azure AI Search
-

- Configure Azure AI Search settings. -

-
- - - -
- -
- -
-
- - -
-
- - -
-
- -
- - -
-
-
- - -
-
- - -
-
- -
- - -
-
-
- - - -
-
-
- - -
-
Document Intelligence
-

- Configure Azure Document Intelligence settings. -

-
-
- - -
- -
- Enhanced captures more document detail for PDFs and images, including tables, page structure, and checked or unchecked marks. It adds latency and has a 6X increase for every 1000 pages when selected. -
-
- - -
- Auto samples this many first PDF pages with Enhanced extraction. If it detects tables or selection marks, the full PDF uses Enhanced; otherwise it finishes with Standard. Images use Enhanced in Auto mode. -
-
-
-
Standard: fastest and lowest-cost path for plain text PDFs and images.
-
Enhanced: best for tables, section structure, page layout, forms, and checkbox states. Expect more latency and a 6X increase for every 1000 pages.
-
Auto: samples the first pages, then uses Enhanced only when the sample shows tables or selection marks.
-
-
- -
- - - -
- -
- -
-
- - -
-
- - -
-
- -
- - -
-
-
- - -
-
- - -
-
- -
- - -
-
-
- - - -
-
-
- -
-
-
Chunk Sizes
- Cap: {{ chunk_size_cap }} -
-

Custom chunk sizes apply to new uploads only. Existing documents keep their current chunks.

-
- Heads up: Overrides are capped at {{ chunk_size_cap }} (2x embedding context window, fallback 16,384). -
-
- - -
- -
- - - {% set chunk_settings = chunk_size_settings or {} %} - {% set chunk_defaults = chunk_size_defaults or {} %} -
-
- - -
-
- - -
-
- - -
-
- - -
-
- - -
-
- - -
Minimum enforced at 50% of target on merge.
-
-
- - -
-
- - -
-
- - -
-
- - -
-
- - -
- -
- - -
Applies to new audio transcripts.
-
-
- - -
Pages per chunk after extraction.
-
-
- - -
Slides per chunk after extraction.
-
-
-
-
- - -
-
-
-
- -
-
-

- AI Video Intelligence -

-

Extract insights and make video content searchable and interactive

-
-
- -
- -
- - Make Video Content Fully Searchable: Upload videos to your workspace and automatically extract transcripts, identify speakers, detect topics, and generate searchable timestamps. Your AI can then answer questions about video content, cite specific moments, and provide deep insights. -
- - -
-
- - -
-

- Upload video files (MP4, AVI, MOV, etc.) to workspaces where Azure Video Indexer automatically processes them. - Extract spoken content, identify speakers, detect faces, recognize brands, and generate searchable metadata—perfect for meetings, presentations, training videos, and recorded content. -

-
- - Full-Text Search - - - Speaker ID - - - Timestamped Citations - - - Multi-Language - -
-
- - {% set public_video_indexer_endpoint = "https://api.videoindexer.ai" %} - {% set government_video_indexer_endpoint = "https://api.videoindexer.ai.azure.us" %} - {% set configured_video_indexer_endpoint = settings.video_indexer_endpoint or default_video_indexer_endpoint %} - {% if configured_video_indexer_endpoint == government_video_indexer_endpoint %} - {% set video_indexer_cloud = "usgovernment" %} - {% elif configured_video_indexer_endpoint == public_video_indexer_endpoint %} - {% set video_indexer_cloud = "public" %} - {% else %} - {% set video_indexer_cloud = "custom" %} - {% endif %} - {% if azure_environment == "usgovernment" %} - {% set azure_environment_label = "Azure Government" %} - {% elif azure_environment == "custom" %} - {% set azure_environment_label = "Custom Cloud" %} - {% else %} - {% set azure_environment_label = "Azure Public / Commercial" %} - {% endif %} - - -
-
- Azure Video Indexer Configuration -
-

Connect to your Azure Video Indexer resource for advanced video processing and content extraction.

- -
- Identity overview: -
    -
  • Video Indexer can use its own managed identity to reach the linked Storage account during account creation.
    • -
  • SimpleChat authenticates to Video Indexer with the App Service system-assigned managed identity.
    • -
  • The App Service managed identity must have Contributor on the Video Indexer resource.
    • -
  • See Azure Video Indexer documentation for setup details
    • -
-
- -
- - -
Choose the endpoint family that matches your deployed cloud. Use Custom only when you need a non-standard Video Indexer endpoint.
-
- -
- Current App Service environment: {{ azure_environment_label }}. This selector saves the Video Indexer API endpoint. If you are switching between Azure Public, Azure Government, or a custom cloud, update AZURE_ENVIRONMENT in your App Service configuration as well. -
- -
- The selected Video Indexer cloud does not match this app's current AZURE_ENVIRONMENT. Update the App Service configuration if you are moving to a different cloud. -
- - - -
- - -
Only required when using a custom cloud or non-standard Video Indexer endpoint.
-
- -
- - -
Saved endpoint value used for Video Indexer API calls.
-
- -
- - -
The Azure resource group containing your Video Indexer account
-
- -
- - -
Your Azure subscription ID
-
- -
- - -
The name of your Video Indexer account resource
-
- -
- - -
Azure region where your Video Indexer account is deployed (e.g., eastus, westus2, northeurope)
-
- -
- - -
Found in the Video Indexer account Overview page in Azure Portal
-
- -
- - -
Default for {{ azure_environment_label }}: {{ default_video_indexer_arm_api_version }}
-
- -
- - +
+ + +
+
+ + +
+
+
-
- - -
-
-
-
- -
-
-

- AI Voice Conversations -

-

Transform your AI experience with natural voice interactions

-
-
- +
+ + +
+ Required phrase: RESTORE WITH OVERWRITE
- -
- - One Speech resource, three features: Audio file uploads, Voice Input, and Voice Responses all use the same Azure Speech Service section below. Configure the Speech resource once, then turn on whichever speech features you need. +
+
+
+
+
+
Preflight review
+

Run review to validate the manifest, target access, and restore policy.

+ +
+
+
No restore review has run yet.
+
+
+
+ + +
+ +
+ + +
+ + + - -
-
- - -
-

- Upload audio files (MP3, WAV, M4A, etc.) to workspaces where they're automatically transcribed and indexed. - The AI can then search, analyze, and answer questions about audio content—perfect for meetings, interviews, lectures, and podcasts. -

-
+ - -
-
- - +