diff --git a/application/single_app/config.py b/application/single_app/config.py
index 03f34724..8e668c0c 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -88,7 +88,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.236.007"
+VERSION = "0.236.011"
 
 
 SECRET_KEY = os.getenv('SECRET_KEY', 'dev-secret-key-change-in-production')
diff --git a/application/single_app/functions_activity_logging.py b/application/single_app/functions_activity_logging.py
index 9870eca9..89b52f44 100644
--- a/application/single_app/functions_activity_logging.py
+++ b/application/single_app/functions_activity_logging.py
@@ -1215,3 +1215,75 @@ def has_user_accepted_agreement_today(
         )
         debug_print(f"⚠️  Error checking user agreement acceptance: {str(e)}")
         return False
+
+
+def log_retention_policy_force_push(
+    admin_user_id: str,
+    admin_email: str,
+    scopes: list,
+    results: dict,
+    total_updated: int
+) -> None:
+    """
+    Log retention policy force push action to activity_logs container.
+    
+    This creates a permanent audit record when an admin forces organization
+    default retention policies to be applied to all workspaces.
+    
+    Args:
+        admin_user_id (str): User ID of the admin performing the force push
+        admin_email (str): Email of the admin performing the force push
+        scopes (list): List of workspace types affected (e.g., ['personal', 'group', 'public'])
+        results (dict): Breakdown of updates per workspace type
+        total_updated (int): Total number of workspaces/users updated
+    """
+    
+    try:
+        # Create force push activity record
+        force_push_activity = {
+            'id': str(uuid.uuid4()),
+            'user_id': admin_user_id,  # Partition key
+            'activity_type': 'retention_policy_force_push',
+            'timestamp': datetime.utcnow().isoformat(),
+            'created_at': datetime.utcnow().isoformat(),
+            'admin': {
+                'user_id': admin_user_id,
+                'email': admin_email
+            },
+            'force_push_details': {
+                'scopes': scopes,
+                'results': results,
+                'total_updated': total_updated,
+                'executed_at': datetime.utcnow().isoformat()
+            },
+            'workspace_type': 'admin',
+            'workspace_context': {
+                'action': 'retention_policy_force_push'
+            }
+        }
+        
+        # Save to activity_logs container for permanent audit trail
+        cosmos_activity_logs_container.create_item(body=force_push_activity)
+        
+        # Also log to Application Insights for monitoring
+        log_event(
+            message=f"Retention policy force push executed by {admin_email} for scopes: {', '.join(scopes)}. Total updated: {total_updated}",
+            extra=force_push_activity,
+            level=logging.INFO
+        )
+        
+        debug_print(f"✅ Retention policy force push logged: {scopes} by {admin_email}, updated {total_updated}")
+        
+    except Exception as e:
+        # Log error but don't break the force push flow
+        log_event(
+            message=f"Error logging retention policy force push: {str(e)}",
+            extra={
+                'admin_user_id': admin_user_id,
+                'scopes': scopes,
+                'total_updated': total_updated,
+                'error': str(e)
+            },
+            level=logging.ERROR
+        )
+        debug_print(f"⚠️  Warning: Failed to log retention policy force push: {str(e)}")
diff --git a/application/single_app/functions_retention_policy.py b/application/single_app/functions_retention_policy.py
index 6c59ef64..6ce6dee0 100644
--- a/application/single_app/functions_retention_policy.py
+++ b/application/single_app/functions_retention_policy.py
@@ -82,6 +82,47 @@ def get_all_public_workspaces():
         return []
 
 
+def resolve_retention_value(value, workspace_type, retention_type, settings=None):
+    """
+    Resolve a retention value, handling 'default' by looking up organization defaults.
+    
+    Args:
+        value: The retention value ('none', 'default', or a number/string of days)
+        workspace_type: 'personal', 'group', or 'public'
+        retention_type: 'conversation' or 'document'
+        settings: Optional pre-loaded settings dict (to avoid repeated lookups)
+        
+    Returns:
+        str or int: 'none' if no deletion, or the number of days as int
+    """
+    if value is None or value == 'default' or value == '':
+        # Look up the organization default
+        if settings is None:
+            settings = get_settings()
+        
+        setting_key = f'default_retention_{retention_type}_{workspace_type}'
+        default_value = settings.get(setting_key, 'none')
+        
+        # If the org default is also 'none', return 'none'
+        if default_value == 'none' or default_value is None:
+            return 'none'
+        
+        # Return the org default as the effective value
+        try:
+            return int(default_value)
+        except (ValueError, TypeError):
+            return 'none'
+    
+    # User/workspace has their own explicit value
+    if value == 'none':
+        return 'none'
+    
+    try:
+        return int(value)
+    except (ValueError, TypeError):
+        return 'none'
+
+
 def execute_retention_policy(workspace_scopes=None, manual_execution=False):
     """
     Execute retention policy for specified workspace scopes.
@@ -185,6 +226,9 @@ def process_personal_retention():
         # Get all user settings
         all_users = get_all_user_settings()
         
+        # Pre-load settings once for efficiency
+        settings = get_settings()
+        
         for user in all_users:
             user_id = user.get('id')
             if not user_id:
@@ -194,10 +238,15 @@ def process_personal_retention():
             user_settings = user.get('settings', {})
             retention_settings = user_settings.get('retention_policy', {})
             
-            conversation_retention_days = retention_settings.get('conversation_retention_days', 'none')
-            document_retention_days = retention_settings.get('document_retention_days', 'none')
+            # Get raw values (may be 'default', 'none', or a number)
+            raw_conversation_days = retention_settings.get('conversation_retention_days')
+            raw_document_days = retention_settings.get('document_retention_days')
             
-            # Skip if both are set to "none"
+            # Resolve to effective values (handles 'default' -> org default lookup)
+            conversation_retention_days = resolve_retention_value(raw_conversation_days, 'personal', 'conversation', settings)
+            document_retention_days = resolve_retention_value(raw_document_days, 'personal', 'document', settings)
+            
+            # Skip if both resolve to "none"
             if conversation_retention_days == 'none' and document_retention_days == 'none':
                 continue
             
@@ -273,6 +322,9 @@ def process_group_retention():
         # Get all groups
         all_groups = get_all_groups()
         
+        # Pre-load settings once for efficiency
+        settings = get_settings()
+        
         for group in all_groups:
             group_id = group.get('id')
             if not group_id:
@@ -281,10 +333,15 @@ def process_group_retention():
             # Get group's retention settings
             retention_settings = group.get('retention_policy', {})
             
-            conversation_retention_days = retention_settings.get('conversation_retention_days', 'none')
-            document_retention_days = retention_settings.get('document_retention_days', 'none')
+            # Get raw values (may be 'default', 'none', or a number)
+            raw_conversation_days = retention_settings.get('conversation_retention_days')
+            raw_document_days = retention_settings.get('document_retention_days')
+            
+            # Resolve to effective values (handles 'default' -> org default lookup)
+            conversation_retention_days = resolve_retention_value(raw_conversation_days, 'group', 'conversation', settings)
+            document_retention_days = resolve_retention_value(raw_document_days, 'group', 'document', settings)
             
-            # Skip if both are set to "none"
+            # Skip if both resolve to "none"
             if conversation_retention_days == 'none' and document_retention_days == 'none':
                 continue
             
@@ -359,6 +416,9 @@ def process_public_retention():
         # Get all public workspaces
         all_workspaces = get_all_public_workspaces()
         
+        # Pre-load settings once for efficiency
+        settings = get_settings()
+        
         for workspace in all_workspaces:
             workspace_id = workspace.get('id')
             if not workspace_id:
@@ -367,10 +427,15 @@ def process_public_retention():
             # Get workspace's retention settings
             retention_settings = workspace.get('retention_policy', {})
             
-            conversation_retention_days = retention_settings.get('conversation_retention_days', 'none')
-            document_retention_days = retention_settings.get('document_retention_days', 'none')
+            # Get raw values (may be 'default', 'none', or a number)
+            raw_conversation_days = retention_settings.get('conversation_retention_days')
+            raw_document_days = retention_settings.get('document_retention_days')
+            
+            # Resolve to effective values (handles 'default' -> org default lookup)
+            conversation_retention_days = resolve_retention_value(raw_conversation_days, 'public', 'conversation', settings)
+            document_retention_days = resolve_retention_value(raw_document_days, 'public', 'document', settings)
             
-            # Skip if both are set to "none"
+            # Skip if both resolve to "none"
             if conversation_retention_days == 'none' and document_retention_days == 'none':
                 continue
             
diff --git a/application/single_app/functions_settings.py b/application/single_app/functions_settings.py
index a0575f54..cbf10b4f 100644
--- a/application/single_app/functions_settings.py
+++ b/application/single_app/functions_settings.py
@@ -276,6 +276,15 @@ def get_settings(use_cosmos=False):
         'retention_conversation_max_days': 3650,  # ~10 years
         'retention_document_min_days': 1,
         'retention_document_max_days': 3650,  # ~10 years
+        # Default retention policies for each workspace type
+        # 'none' means no automatic deletion (users can still set their own)
+        # Numeric values (e.g., 30, 60, 90, 180, 365, 730) represent days
+        'default_retention_conversation_personal': 'none',
+        'default_retention_document_personal': 'none',
+        'default_retention_conversation_group': 'none',
+        'default_retention_document_group': 'none',
+        'default_retention_conversation_public': 'none',
+        'default_retention_document_public': 'none',
     }
 
     try:
diff --git a/application/single_app/requirements.txt b/application/single_app/requirements.txt
index 187b4a98..8aefdb06 100644
--- a/application/single_app/requirements.txt
+++ b/application/single_app/requirements.txt
@@ -4,7 +4,7 @@ azure-monitor-query==1.4.1
 Flask==2.2.5
 Flask-WTF==1.2.1
 gunicorn
-Werkzeug==3.1.4
+Werkzeug==3.1.5
 requests==2.32.4
 openai==1.67
 docx2txt==0.8
@@ -49,7 +49,7 @@ azure-monitor-opentelemetry==1.6.13
 psycopg2-binary==2.9.10
 cython
 pyyaml==6.0.2
-aiohttp==3.12.15
+aiohttp==3.13.3
 html2text==2025.4.15
 matplotlib==3.10.7
 azure-cognitiveservices-speech==1.47.0
\ No newline at end of file
diff --git a/application/single_app/route_backend_retention_policy.py b/application/single_app/route_backend_retention_policy.py
index 70d5cc76..60935f60 100644
--- a/application/single_app/route_backend_retention_policy.py
+++ b/application/single_app/route_backend_retention_policy.py
@@ -3,7 +3,8 @@
 from config import *
 from functions_authentication import *
 from functions_settings import *
-from functions_retention_policy import execute_retention_policy
+from functions_retention_policy import execute_retention_policy, get_all_user_settings, get_all_groups, get_all_public_workspaces
+from functions_activity_logging import log_retention_policy_force_push
 from swagger_wrapper import swagger_route, get_auth_security
 from functions_debug import debug_print
 
@@ -106,6 +107,75 @@ def update_retention_policy_settings():
             }), 500
     
     
+    @app.route('/api/retention-policy/defaults/<workspace_type>', methods=['GET'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    def get_retention_policy_defaults(workspace_type):
+        """
+        Get organization default retention policy settings for a specific workspace type.
+        
+        Args:
+            workspace_type: One of 'personal', 'group', or 'public'
+            
+        Returns:
+            JSON with default_conversation_days and default_document_days for the workspace type
+        """
+        try:
+            # Validate workspace type
+            if workspace_type not in ['personal', 'group', 'public']:
+                return jsonify({
+                    'success': False,
+                    'error': f'Invalid workspace type: {workspace_type}'
+                }), 400
+            
+            settings = get_settings()
+            
+            # Get the default values for the specified workspace type
+            default_conversation = settings.get(f'default_retention_conversation_{workspace_type}', 'none')
+            default_document = settings.get(f'default_retention_document_{workspace_type}', 'none')
+            
+            # Get human-readable labels for the values
+            def get_retention_label(value):
+                if value == 'none' or value is None:
+                    return 'No automatic deletion'
+                try:
+                    days = int(value)
+                    if days == 1:
+                        return '1 day'
+                    elif days == 21:
+                        return '21 days (3 weeks)'
+                    elif days == 90:
+                        return '90 days (3 months)'
+                    elif days == 180:
+                        return '180 days (6 months)'
+                    elif days == 365:
+                        return '365 days (1 year)'
+                    elif days == 730:
+                        return '730 days (2 years)'
+                    else:
+                        return f'{days} days'
+                except (ValueError, TypeError):
+                    return 'No automatic deletion'
+            
+            return jsonify({
+                'success': True,
+                'workspace_type': workspace_type,
+                'default_conversation_days': default_conversation,
+                'default_document_days': default_document,
+                'default_conversation_label': get_retention_label(default_conversation),
+                'default_document_label': get_retention_label(default_document)
+            })
+            
+        except Exception as e:
+            debug_print(f"Error fetching retention policy defaults: {e}")
+            log_event(f"Fetching retention policy defaults failed: {e}", level=logging.ERROR)
+            return jsonify({
+                'success': False,
+                'error': 'Failed to fetch retention policy defaults'
+            }), 500
+    
+    
     @app.route('/api/admin/retention-policy/execute', methods=['POST'])
     @swagger_route(security=get_auth_security())
     @login_required
@@ -155,6 +225,165 @@ def manual_execute_retention_policy():
             }), 500
     
     
+    @app.route('/api/admin/retention-policy/force-push', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @admin_required
+    def force_push_retention_defaults():
+        """
+        Force push organization default retention policies to all users/groups/workspaces.
+        This resets all custom retention policies to use the organization default ('default' value).
+        
+        Body:
+            scopes (list): List of workspace types to push defaults to: 'personal', 'group', 'public'
+        """
+        try:
+            data = request.get_json()
+            scopes = data.get('scopes', [])
+            
+            if not scopes:
+                return jsonify({
+                    'success': False,
+                    'error': 'No workspace scopes provided'
+                }), 400
+            
+            # Validate scopes
+            valid_scopes = ['personal', 'group', 'public']
+            invalid_scopes = [s for s in scopes if s not in valid_scopes]
+            if invalid_scopes:
+                return jsonify({
+                    'success': False,
+                    'error': f'Invalid workspace scopes: {", ".join(invalid_scopes)}'
+                }), 400
+            
+            details = {}
+            total_updated = 0
+            
+            # Force push to personal workspaces (user settings)
+            if 'personal' in scopes:
+                debug_print("Force pushing retention defaults to personal workspaces...")
+                all_users = get_all_user_settings()
+                personal_count = 0
+                
+                for user in all_users:
+                    user_id = user.get('id')
+                    if not user_id:
+                        continue
+                    
+                    try:
+                        # Update user's retention policy to use 'default'
+                        user_settings = user.get('settings', {})
+                        user_settings['retention_policy'] = {
+                            'conversation_retention_days': 'default',
+                            'document_retention_days': 'default'
+                        }
+                        user['settings'] = user_settings
+                        
+                        cosmos_user_settings_container.upsert_item(user)
+                        personal_count += 1
+                    except Exception as e:
+                        debug_print(f"Error updating user {user_id}: {e}")
+                        log_event(f"Error updating user {user_id} during force push: {e}", level=logging.ERROR)
+                        continue
+                
+                details['personal'] = personal_count
+                total_updated += personal_count
+                debug_print(f"Updated {personal_count} personal workspaces")
+            
+            # Force push to group workspaces
+            if 'group' in scopes:
+                debug_print("Force pushing retention defaults to group workspaces...")
+                from functions_group import cosmos_groups_container
+                all_groups = get_all_groups()
+                group_count = 0
+                
+                for group in all_groups:
+                    group_id = group.get('id')
+                    if not group_id:
+                        continue
+                    
+                    try:
+                        # Update group's retention policy to use 'default'
+                        group['retention_policy'] = {
+                            'conversation_retention_days': 'default',
+                            'document_retention_days': 'default'
+                        }
+                        
+                        cosmos_groups_container.upsert_item(group)
+                        group_count += 1
+                    except Exception as e:
+                        debug_print(f"Error updating group {group_id}: {e}")
+                        log_event(f"Error updating group {group_id} during force push: {e}", level=logging.ERROR)
+                        continue
+                
+                details['group'] = group_count
+                total_updated += group_count
+                debug_print(f"Updated {group_count} group workspaces")
+            
+            # Force push to public workspaces
+            if 'public' in scopes:
+                debug_print("Force pushing retention defaults to public workspaces...")
+                from functions_public_workspaces import cosmos_public_workspaces_container
+                all_workspaces = get_all_public_workspaces()
+                public_count = 0
+                
+                for workspace in all_workspaces:
+                    workspace_id = workspace.get('id')
+                    if not workspace_id:
+                        continue
+                    
+                    try:
+                        # Update workspace's retention policy to use 'default'
+                        workspace['retention_policy'] = {
+                            'conversation_retention_days': 'default',
+                            'document_retention_days': 'default'
+                        }
+                        
+                        cosmos_public_workspaces_container.upsert_item(workspace)
+                        public_count += 1
+                    except Exception as e:
+                        debug_print(f"Error updating public workspace {workspace_id}: {e}")
+                        log_event(f"Error updating public workspace {workspace_id} during force push: {e}", level=logging.ERROR)
+                        continue
+                
+                details['public'] = public_count
+                total_updated += public_count
+                debug_print(f"Updated {public_count} public workspaces")
+            
+            # Log to activity logs for audit trail
+            admin_user_id = session.get('user', {}).get('oid', 'unknown')
+            admin_email = session.get('user', {}).get('preferred_username', session.get('user', {}).get('email', 'unknown'))
+            log_retention_policy_force_push(
+                admin_user_id=admin_user_id,
+                admin_email=admin_email,
+                scopes=scopes,
+                results=details,
+                total_updated=total_updated
+            )
+            
+            log_event("retention_policy_force_push", {
+                "scopes": scopes,
+                "updated_count": total_updated,
+                "details": details
+            })
+            
+            return jsonify({
+                'success': True,
+                'message': f'Defaults pushed to {total_updated} items',
+                'updated_count': total_updated,
+                'scopes': scopes,
+                'details': details
+            })
+            
+        except Exception as e:
+            debug_print(f"Error force pushing retention defaults: {e}")
+            log_event(f"Force push retention defaults failed: {e}", level=logging.ERROR)
+            return jsonify({
+                'success': False,
+                'error': f'Failed to push retention defaults'
+            }), 500
+    
+    
     @app.route('/api/retention-policy/user', methods=['POST'])
     @swagger_route(security=get_auth_security())
     @login_required
diff --git a/application/single_app/route_frontend_admin_settings.py b/application/single_app/route_frontend_admin_settings.py
index 66c6a45a..411805cc 100644
--- a/application/single_app/route_frontend_admin_settings.py
+++ b/application/single_app/route_frontend_admin_settings.py
@@ -537,6 +537,14 @@ def admin_settings():
             enable_retention_policy_public = form_data.get('enable_retention_policy_public') == 'on'
             retention_policy_execution_hour = int(form_data.get('retention_policy_execution_hour', 2))
             
+            # Default retention policy values for each workspace type
+            default_retention_conversation_personal = form_data.get('default_retention_conversation_personal', 'none')
+            default_retention_document_personal = form_data.get('default_retention_document_personal', 'none')
+            default_retention_conversation_group = form_data.get('default_retention_conversation_group', 'none')
+            default_retention_document_group = form_data.get('default_retention_document_group', 'none')
+            default_retention_conversation_public = form_data.get('default_retention_conversation_public', 'none')
+            default_retention_document_public = form_data.get('default_retention_document_public', 'none')
+            
             # Validate execution hour (0-23)
             if retention_policy_execution_hour < 0 or retention_policy_execution_hour > 23:
                 retention_policy_execution_hour = 2  # Default to 2 AM
@@ -696,6 +704,12 @@ def is_valid_url(url):
                 'enable_retention_policy_public': enable_retention_policy_public,
                 'retention_policy_execution_hour': retention_policy_execution_hour,
                 'retention_policy_next_run': retention_policy_next_run,
+                'default_retention_conversation_personal': default_retention_conversation_personal,
+                'default_retention_document_personal': default_retention_document_personal,
+                'default_retention_conversation_group': default_retention_conversation_group,
+                'default_retention_document_group': default_retention_document_group,
+                'default_retention_conversation_public': default_retention_conversation_public,
+                'default_retention_document_public': default_retention_document_public,
 
                 # User Agreement
                 'enable_user_agreement': enable_user_agreement,
diff --git a/application/single_app/static/js/workspace-manager.js b/application/single_app/static/js/workspace-manager.js
index d109351f..7b540af7 100644
--- a/application/single_app/static/js/workspace-manager.js
+++ b/application/single_app/static/js/workspace-manager.js
@@ -411,6 +411,9 @@ window.WorkspaceManager = {
             // Load workspace members for ownership transfer dropdown
             await WorkspaceManager.loadWorkspaceMembersForTransfer(workspaceId);
             
+            // Load retention settings if enabled
+            await WorkspaceManager.loadRetentionSettings(workspace);
+            
             // Store current workspace ID for saving changes
             document.getElementById('publicWorkspaceManagementModal').setAttribute('data-workspace-id', workspaceId);
             
@@ -485,6 +488,54 @@ window.WorkspaceManager = {
         }
     },
 
+    // Load retention settings for public workspace
+    loadRetentionSettings: async function(workspace) {
+        const convSelect = document.getElementById('publicConversationRetention');
+        const docSelect = document.getElementById('publicDocumentRetention');
+        
+        // Check if retention policy elements exist (feature might be disabled)
+        if (!convSelect || !docSelect) {
+            return;
+        }
+        
+        try {
+            // Fetch organization defaults for public workspace retention
+            const orgDefaultsResp = await fetch('/api/retention-policy/defaults/public');
+            const orgData = await orgDefaultsResp.json();
+            
+            if (orgData.success) {
+                const convDefaultOption = convSelect.querySelector('option[value="default"]');
+                const docDefaultOption = docSelect.querySelector('option[value="default"]');
+                
+                if (convDefaultOption) {
+                    convDefaultOption.textContent = `Using organization default (${orgData.default_conversation_label})`;
+                }
+                if (docDefaultOption) {
+                    docDefaultOption.textContent = `Using organization default (${orgData.default_document_label})`;
+                }
+            }
+        } catch (error) {
+            console.error('Error loading public retention defaults:', error);
+        }
+        
+        // Set current values from workspace
+        if (workspace.retention_policy) {
+            let convRetention = workspace.retention_policy.conversation_retention_days;
+            let docRetention = workspace.retention_policy.document_retention_days;
+            
+            // If undefined, use 'default'
+            if (convRetention === undefined) convRetention = 'default';
+            if (docRetention === undefined) docRetention = 'default';
+            
+            convSelect.value = convRetention;
+            docSelect.value = docRetention;
+        } else {
+            // Set to organization default if no retention policy set
+            convSelect.value = 'default';
+            docSelect.value = 'default';
+        }
+    },
+
     // Save workspace changes
     saveWorkspaceChanges: async function() {
         const workspaceId = document.getElementById('publicWorkspaceManagementModal').getAttribute('data-workspace-id');
@@ -556,6 +607,26 @@ window.WorkspaceManager = {
                 }
             }
             
+            // Save retention policy settings if enabled
+            const convRetentionSelect = document.getElementById('publicConversationRetention');
+            const docRetentionSelect = document.getElementById('publicDocumentRetention');
+            
+            if (convRetentionSelect && docRetentionSelect) {
+                const retentionResponse = await fetch(`/api/retention-policy/public/${workspaceId}`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        conversation_retention_days: convRetentionSelect.value,
+                        document_retention_days: docRetentionSelect.value
+                    })
+                });
+                
+                if (!retentionResponse.ok) {
+                    console.error('Failed to save retention policy');
+                    // Don't throw - allow other changes to succeed
+                }
+            }
+            
             showToast('Workspace updated successfully!', 'success');
             
             // Close modal and refresh table
diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html
index e153568d..6410b4ef 100644
--- a/application/single_app/templates/admin_settings.html
+++ b/application/single_app/templates/admin_settings.html
@@ -2289,6 +2289,142 @@ <h5>
                         </div>
                     </div>
                     
+                    <!-- Default Retention Policy Settings -->
+                    <div class="card bg-light p-3 mb-3">
+                        <h6 class="mb-3"><i class="bi bi-sliders me-2"></i>Default Retention Policies</h6>
+                        <p class="text-muted small mb-3">Set organization-wide default retention periods for each workspace type. Users can override these defaults with their own preferences. Setting a default here means new users/workspaces will start with this retention period.</p>
+                        
+                        <!-- Personal Workspace Defaults -->
+                        <div class="row g-3 mb-3" id="retention_defaults_personal" style="{% if not settings.enable_retention_policy_personal %}display: none;{% endif %}">
+                            <div class="col-12">
+                                <label class="form-label fw-bold"><i class="bi bi-person me-1"></i>Personal Workspace Defaults</label>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_conversation_personal" class="form-label">Conversation Retention</label>
+                                <select class="form-select" id="default_retention_conversation_personal" name="default_retention_conversation_personal">
+                                    <option value="none" {% if settings.default_retention_conversation_personal == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_conversation_personal == '1' or settings.default_retention_conversation_personal == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="5" {% if settings.default_retention_conversation_personal == '5' or settings.default_retention_conversation_personal == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="10" {% if settings.default_retention_conversation_personal == '10' or settings.default_retention_conversation_personal == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="21" {% if settings.default_retention_conversation_personal == '21' or settings.default_retention_conversation_personal == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_conversation_personal == '30' or settings.default_retention_conversation_personal == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_conversation_personal == '60' or settings.default_retention_conversation_personal == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_conversation_personal == '90' or settings.default_retention_conversation_personal == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_conversation_personal == '180' or settings.default_retention_conversation_personal == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_conversation_personal == '365' or settings.default_retention_conversation_personal == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_conversation_personal == '730' or settings.default_retention_conversation_personal == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_document_personal" class="form-label">Document Retention</label>
+                                <select class="form-select" id="default_retention_document_personal" name="default_retention_document_personal">
+                                    <option value="none" {% if settings.default_retention_document_personal == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_document_personal == '1' or settings.default_retention_document_personal == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="5" {% if settings.default_retention_document_personal == '5' or settings.default_retention_document_personal == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="10" {% if settings.default_retention_document_personal == '10' or settings.default_retention_document_personal == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="21" {% if settings.default_retention_document_personal == '21' or settings.default_retention_document_personal == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_document_personal == '30' or settings.default_retention_document_personal == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_document_personal == '60' or settings.default_retention_document_personal == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_document_personal == '90' or settings.default_retention_document_personal == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_document_personal == '180' or settings.default_retention_document_personal == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_document_personal == '365' or settings.default_retention_document_personal == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_document_personal == '730' or settings.default_retention_document_personal == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                        </div>
+                        
+                        <!-- Group Workspace Defaults -->
+                        <div class="row g-3 mb-3" id="retention_defaults_group" style="{% if not settings.enable_retention_policy_group %}display: none;{% endif %}">
+                            <div class="col-12">
+                                <label class="form-label fw-bold"><i class="bi bi-people me-1"></i>Group Workspace Defaults</label>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_conversation_group" class="form-label">Conversation Retention</label>
+                                <select class="form-select" id="default_retention_conversation_group" name="default_retention_conversation_group">
+                                    <option value="none" {% if settings.default_retention_conversation_group == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_conversation_group == '1' or settings.default_retention_conversation_group == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="5" {% if settings.default_retention_conversation_group == '5' or settings.default_retention_conversation_group == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="10" {% if settings.default_retention_conversation_group == '10' or settings.default_retention_conversation_group == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="21" {% if settings.default_retention_conversation_group == '21' or settings.default_retention_conversation_group == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_conversation_group == '30' or settings.default_retention_conversation_group == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_conversation_group == '60' or settings.default_retention_conversation_group == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_conversation_group == '90' or settings.default_retention_conversation_group == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_conversation_group == '180' or settings.default_retention_conversation_group == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_conversation_group == '365' or settings.default_retention_conversation_group == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_conversation_group == '730' or settings.default_retention_conversation_group == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_document_group" class="form-label">Document Retention</label>
+                                <select class="form-select" id="default_retention_document_group" name="default_retention_document_group">
+                                    <option value="none" {% if settings.default_retention_document_group == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_document_group == '1' or settings.default_retention_document_group == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="5" {% if settings.default_retention_document_group == '5' or settings.default_retention_document_group == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="10" {% if settings.default_retention_document_group == '10' or settings.default_retention_document_group == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="21" {% if settings.default_retention_document_group == '21' or settings.default_retention_document_group == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_document_group == '30' or settings.default_retention_document_group == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_document_group == '60' or settings.default_retention_document_group == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_document_group == '90' or settings.default_retention_document_group == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_document_group == '180' or settings.default_retention_document_group == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_document_group == '365' or settings.default_retention_document_group == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_document_group == '730' or settings.default_retention_document_group == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                        </div>
+                        
+                        <!-- Public Workspace Defaults -->
+                        <div class="row g-3" id="retention_defaults_public" style="{% if not settings.enable_retention_policy_public %}display: none;{% endif %}">
+                            <div class="col-12">
+                                <label class="form-label fw-bold"><i class="bi bi-globe me-1"></i>Public Workspace Defaults</label>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_conversation_public" class="form-label">Conversation Retention</label>
+                                <select class="form-select" id="default_retention_conversation_public" name="default_retention_conversation_public">
+                                    <option value="none" {% if settings.default_retention_conversation_public == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_conversation_public == '1' or settings.default_retention_conversation_public == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="5" {% if settings.default_retention_conversation_public == '5' or settings.default_retention_conversation_public == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="10" {% if settings.default_retention_conversation_public == '10' or settings.default_retention_conversation_public == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="21" {% if settings.default_retention_conversation_public == '21' or settings.default_retention_conversation_public == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_conversation_public == '30' or settings.default_retention_conversation_public == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_conversation_public == '60' or settings.default_retention_conversation_public == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_conversation_public == '90' or settings.default_retention_conversation_public == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_conversation_public == '180' or settings.default_retention_conversation_public == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_conversation_public == '365' or settings.default_retention_conversation_public == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_conversation_public == '730' or settings.default_retention_conversation_public == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_document_public" class="form-label">Document Retention</label>
+                                <select class="form-select" id="default_retention_document_public" name="default_retention_document_public">
+                                    <option value="none" {% if settings.default_retention_document_public == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_document_public == '1' or settings.default_retention_document_public == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="5" {% if settings.default_retention_document_public == '5' or settings.default_retention_document_public == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="10" {% if settings.default_retention_document_public == '10' or settings.default_retention_document_public == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="21" {% if settings.default_retention_document_public == '21' or settings.default_retention_document_public == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_document_public == '30' or settings.default_retention_document_public == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_document_public == '60' or settings.default_retention_document_public == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_document_public == '90' or settings.default_retention_document_public == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_document_public == '180' or settings.default_retention_document_public == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_document_public == '365' or settings.default_retention_document_public == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_document_public == '730' or settings.default_retention_document_public == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                        </div>
+                        
+                        <!-- Force Push Button -->
+                        <div class="row g-3 mt-3">
+                            <div class="col-12">
+                                <div class="alert alert-warning mb-2">
+                                    <i class="bi bi-exclamation-triangle me-2"></i>
+                                    <strong>Force Push:</strong> Override all user/group/workspace custom retention policies with the organization defaults above. Users will then use the organization default until they set their own preference.
+                                </div>
+                                <button type="button" class="btn btn-warning" onclick="showForcePushModal()">
+                                    <i class="bi bi-arrow-repeat me-2"></i>Force Push Defaults to All
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                    
                     <!-- Scheduled execution time -->
                     <div class="mb-3">
                         <label for="retention_policy_execution_hour" class="form-label">Scheduled Execution Time (Hour of Day)</label>
@@ -3562,6 +3698,71 @@ <h6>Execution Results:</h6>
             </div>
         </div>
 
+        <!-- Force Push Retention Policy Modal -->
+        <div class="modal fade" id="forcePushRetentionModal" tabindex="-1" aria-labelledby="forcePushRetentionModalLabel" aria-hidden="true">
+            <div class="modal-dialog">
+                <div class="modal-content">
+                    <div class="modal-header bg-warning">
+                        <h5 class="modal-title" id="forcePushRetentionModalLabel">
+                            <i class="bi bi-exclamation-triangle me-2"></i>Force Push Retention Defaults
+                        </h5>
+                        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                    </div>
+                    <div class="modal-body">
+                        <p>Select which workspace types to force push the organization defaults to. This will reset all custom retention policies to use the organization default.</p>
+                        
+                        <div class="alert alert-info mb-3">
+                            <i class="bi bi-info-circle me-2"></i>
+                            <strong>Note:</strong> This action will first save any changes you've made to the default retention settings above, then push those defaults to all selected workspaces.
+                        </div>
+                        
+                        <div class="mb-3">
+                            <label class="form-label fw-bold">Select Workspace Types:</label>
+                            <div class="form-check">
+                                <input class="form-check-input" type="checkbox" id="force_push_personal" value="personal">
+                                <label class="form-check-label" for="force_push_personal">
+                                    Personal Workspaces (all users)
+                                </label>
+                            </div>
+                            <div class="form-check">
+                                <input class="form-check-input" type="checkbox" id="force_push_group" value="group">
+                                <label class="form-check-label" for="force_push_group">
+                                    Group Workspaces
+                                </label>
+                            </div>
+                            <div class="form-check">
+                                <input class="form-check-input" type="checkbox" id="force_push_public" value="public">
+                                <label class="form-check-label" for="force_push_public">
+                                    Public Workspaces
+                                </label>
+                            </div>
+                        </div>
+                        
+                        <div class="alert alert-danger">
+                            <i class="bi bi-exclamation-circle me-2"></i>
+                            <strong>Warning:</strong> This will override any custom retention policies users have set. They will need to reconfigure if they want different settings.
+                        </div>
+                        
+                        <div id="force-push-status" class="mt-3" style="display: none;">
+                            <div class="alert alert-info">
+                                <div class="spinner-border spinner-border-sm me-2" role="status"></div>
+                                <span id="force-push-status-text">Processing...</span>
+                            </div>
+                        </div>
+                        
+                        <div id="force-push-results" class="mt-3" style="display: none;"></div>
+                    </div>
+                    <div class="modal-footer">
+                        <button type="button" class="btn btn-secondary" id="force-push-cancel-btn" data-bs-dismiss="modal">Cancel</button>
+                        <button type="button" class="btn btn-warning" id="force-push-btn" onclick="executeForcePush()">
+                            <i class="bi bi-arrow-repeat me-1"></i>Force Push
+                        </button>
+                        <button type="button" class="btn btn-primary" id="force-push-close-btn" data-bs-dismiss="modal" style="display: none;">Close</button>
+                    </div>
+                </div>
+            </div>
+        </div>
+
         <!-- Video Indexer Info Modal -->
         {% include '_video_indexer_info.html' %}
 
@@ -4046,6 +4247,177 @@ <h5 class="modal-title" id="userAgreementPreviewModalLabel">
     });
 
     // Retention Policy Functions
+    
+    // Toggle retention default sections visibility based on enable checkboxes
+    function toggleRetentionDefaultsVisibility() {
+        const personalEnabled = document.getElementById('enable_retention_policy_personal').checked;
+        const groupEnabled = document.getElementById('enable_retention_policy_group').checked;
+        const publicEnabled = document.getElementById('enable_retention_policy_public').checked;
+        
+        const personalDefaults = document.getElementById('retention_defaults_personal');
+        const groupDefaults = document.getElementById('retention_defaults_group');
+        const publicDefaults = document.getElementById('retention_defaults_public');
+        
+        if (personalDefaults) {
+            personalDefaults.style.display = personalEnabled ? '' : 'none';
+        }
+        if (groupDefaults) {
+            groupDefaults.style.display = groupEnabled ? '' : 'none';
+        }
+        if (publicDefaults) {
+            publicDefaults.style.display = publicEnabled ? '' : 'none';
+        }
+    }
+    
+    // Attach event listeners to retention policy enable checkboxes
+    document.getElementById('enable_retention_policy_personal')?.addEventListener('change', toggleRetentionDefaultsVisibility);
+    document.getElementById('enable_retention_policy_group')?.addEventListener('change', toggleRetentionDefaultsVisibility);
+    document.getElementById('enable_retention_policy_public')?.addEventListener('change', toggleRetentionDefaultsVisibility);
+    
+    // Force Push Modal Functions
+    function showForcePushModal() {
+        const modal = new bootstrap.Modal(document.getElementById('forcePushRetentionModal'));
+        
+        // Reset modal state
+        document.getElementById('force-push-status').style.display = 'none';
+        document.getElementById('force-push-results').style.display = 'none';
+        document.getElementById('force_push_personal').checked = false;
+        document.getElementById('force_push_group').checked = false;
+        document.getElementById('force_push_public').checked = false;
+        document.getElementById('force-push-btn').disabled = false;
+        
+        // Reset button visibility
+        document.getElementById('force-push-cancel-btn').style.display = '';
+        document.getElementById('force-push-btn').style.display = '';
+        document.getElementById('force-push-close-btn').style.display = 'none';
+        
+        modal.show();
+    }
+    
+    function executeForcePush() {
+        const personal = document.getElementById('force_push_personal').checked;
+        const group = document.getElementById('force_push_group').checked;
+        const publicWs = document.getElementById('force_push_public').checked;
+        
+        const scopes = [];
+        if (personal) scopes.push('personal');
+        if (group) scopes.push('group');
+        if (publicWs) scopes.push('public');
+        
+        if (scopes.length === 0) {
+            alert('Please select at least one workspace type.');
+            return;
+        }
+        
+        // Confirm before executing
+        if (!confirm(`Are you sure you want to force push defaults to ${scopes.join(', ')} workspaces? This will save the current settings and override all custom retention policies.`)) {
+            return;
+        }
+        
+        // Show processing status
+        document.getElementById('force-push-status').style.display = 'block';
+        document.getElementById('force-push-status-text').textContent = 'Saving settings first...';
+        document.getElementById('force-push-results').style.display = 'none';
+        document.getElementById('force-push-btn').disabled = true;
+        
+        // First, save the admin settings form via AJAX
+        const form = document.getElementById('admin-settings-form');
+        const formData = new FormData(form);
+        
+        fetch(window.location.pathname, {
+            method: 'POST',
+            body: formData
+        })
+        .then(response => {
+            if (!response.ok) {
+                throw new Error('Failed to save settings');
+            }
+            // Settings saved, now execute force push
+            document.getElementById('force-push-status-text').textContent = 'Pushing defaults to workspaces...';
+            
+            return fetch('/api/admin/retention-policy/force-push', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({ scopes: scopes })
+            });
+        })
+        .then(response => response.json())
+        .then(data => {
+            document.getElementById('force-push-status').style.display = 'none';
+            document.getElementById('force-push-results').style.display = 'block';
+            
+            if (data.success) {
+                let resultHtml = `
+                    <div class="alert alert-success">
+                        <i class="bi bi-check-circle me-2"></i>
+                        <strong>Success!</strong> Settings saved and defaults pushed successfully.
+                    </div>
+                    <div class="card">
+                        <div class="card-body">
+                            <h6>Summary:</h6>
+                            <ul class="mb-0">`;
+                
+                if (data.details) {
+                    if (data.details.personal !== undefined) {
+                        resultHtml += `<li>Personal workspaces updated: <strong>${data.details.personal}</strong></li>`;
+                    }
+                    if (data.details.group !== undefined) {
+                        resultHtml += `<li>Group workspaces updated: <strong>${data.details.group}</strong></li>`;
+                    }
+                    if (data.details.public !== undefined) {
+                        resultHtml += `<li>Public workspaces updated: <strong>${data.details.public}</strong></li>`;
+                    }
+                }
+                
+                resultHtml += `<li>Total items updated: <strong>${data.updated_count || 0}</strong></li>
+                            </ul>
+                        </div>
+                    </div>`;
+                
+                document.getElementById('force-push-results').innerHTML = resultHtml;
+                
+                // Reset the form dirty state since we just saved
+                if (typeof resetFormDirtyState === 'function') {
+                    resetFormDirtyState();
+                }
+                // Disable the save button since we just saved
+                const saveBtn = document.getElementById('floating-save-btn');
+                if (saveBtn) {
+                    saveBtn.disabled = true;
+                    saveBtn.classList.remove('btn-primary');
+                    saveBtn.classList.add('btn-secondary');
+                }
+            } else {
+                document.getElementById('force-push-results').innerHTML = `
+                    <div class="alert alert-danger">
+                        <i class="bi bi-x-circle me-2"></i>
+                        <strong>Error:</strong> ${data.error || 'Failed to push defaults'}
+                    </div>`;
+            }
+            
+            // Hide Cancel and Force Push buttons, show Close button
+            document.getElementById('force-push-cancel-btn').style.display = 'none';
+            document.getElementById('force-push-btn').style.display = 'none';
+            document.getElementById('force-push-close-btn').style.display = '';
+        })
+        .catch(error => {
+            document.getElementById('force-push-status').style.display = 'none';
+            document.getElementById('force-push-results').style.display = 'block';
+            document.getElementById('force-push-results').innerHTML = `
+                <div class="alert alert-danger">
+                    <i class="bi bi-x-circle me-2"></i>
+                    <strong>Error:</strong> ${error.message}
+                </div>`;
+            
+            // Hide Cancel and Force Push buttons, show Close button
+            document.getElementById('force-push-cancel-btn').style.display = 'none';
+            document.getElementById('force-push-btn').style.display = 'none';
+            document.getElementById('force-push-close-btn').style.display = '';
+        });
+    }
+    
     function showManualExecutionModal() {
         const modal = new bootstrap.Modal(document.getElementById('manualExecutionModal'));
         
diff --git a/application/single_app/templates/control_center.html b/application/single_app/templates/control_center.html
index 6e954d67..a261cc82 100644
--- a/application/single_app/templates/control_center.html
+++ b/application/single_app/templates/control_center.html
@@ -1661,13 +1661,18 @@ <h6 class="fw-bold"><i class="bi bi-hourglass-split me-2"></i>Retention Policy</
                                 <div class="card-body">
                                     <div class="alert alert-info small">
                                         <i class="bi bi-info-circle me-1"></i>
-                                        Configure automatic deletion of aged conversations and documents. Set to "No automatic deletion" to keep items indefinitely.
+                                        Configure automatic deletion of aged conversations and documents. You can use the organization default or set a custom retention period.
                                     </div>
                                     <div class="row">
                                         <div class="col-md-6 mb-3">
                                             <label class="form-label">Conversation Retention</label>
                                             <select class="form-select" id="groupConversationRetention">
+                                                <option value="default">Using organization default</option>
                                                 <option value="none">No automatic deletion</option>
+                                                <option value="1">1 day</option>
+                                                <option value="5">5 days</option>
+                                                <option value="10">10 days</option>
+                                                <option value="21">21 days (3 weeks)</option>
                                                 <option value="30">30 days</option>
                                                 <option value="60">60 days</option>
                                                 <option value="90">90 days (3 months)</option>
@@ -1679,7 +1684,12 @@ <h6 class="fw-bold"><i class="bi bi-hourglass-split me-2"></i>Retention Policy</
                                         <div class="col-md-6 mb-3">
                                             <label class="form-label">Document Retention</label>
                                             <select class="form-select" id="groupDocumentRetention">
+                                                <option value="default">Using organization default</option>
                                                 <option value="none">No automatic deletion</option>
+                                                <option value="1">1 day</option>
+                                                <option value="5">5 days</option>
+                                                <option value="10">10 days</option>
+                                                <option value="21">21 days (3 weeks)</option>
                                                 <option value="30">30 days</option>
                                                 <option value="60">60 days</option>
                                                 <option value="90">90 days (3 months)</option>
@@ -2259,6 +2269,59 @@ <h6 class="fw-bold">Member Management</h6>
                         </div>
                     </div>
 
+                    <!-- Retention Policy -->
+                    {% if app_settings.enable_retention_policy_public %}
+                    <div class="row mb-4">
+                        <div class="col-12">
+                            <h6 class="fw-bold"><i class="bi bi-hourglass-split me-2"></i>Retention Policy</h6>
+                            <div class="card">
+                                <div class="card-body">
+                                    <div class="alert alert-info small">
+                                        <i class="bi bi-info-circle me-1"></i>
+                                        Configure automatic deletion of aged conversations and documents. You can use the organization default or set a custom retention period.
+                                    </div>
+                                    <div class="row">
+                                        <div class="col-md-6 mb-3">
+                                            <label class="form-label">Conversation Retention</label>
+                                            <select class="form-select" id="publicConversationRetention">
+                                                <option value="default">Using organization default</option>
+                                                <option value="none">No automatic deletion</option>
+                                                <option value="1">1 day</option>
+                                                <option value="5">5 days</option>
+                                                <option value="10">10 days</option>
+                                                <option value="21">21 days (3 weeks)</option>
+                                                <option value="30">30 days</option>
+                                                <option value="60">60 days</option>
+                                                <option value="90">90 days (3 months)</option>
+                                                <option value="180">180 days (6 months)</option>
+                                                <option value="365">365 days (1 year)</option>
+                                                <option value="730">730 days (2 years)</option>
+                                            </select>
+                                        </div>
+                                        <div class="col-md-6 mb-3">
+                                            <label class="form-label">Document Retention</label>
+                                            <select class="form-select" id="publicDocumentRetention">
+                                                <option value="default">Using organization default</option>
+                                                <option value="none">No automatic deletion</option>
+                                                <option value="1">1 day</option>
+                                                <option value="5">5 days</option>
+                                                <option value="10">10 days</option>
+                                                <option value="21">21 days (3 weeks)</option>
+                                                <option value="30">30 days</option>
+                                                <option value="60">60 days</option>
+                                                <option value="90">90 days (3 months)</option>
+                                                <option value="180">180 days (6 months)</option>
+                                                <option value="365">365 days (1 year)</option>
+                                                <option value="730">730 days (2 years)</option>
+                                            </select>
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                    {% endif %}
+
                     <!-- Dangerous Actions -->
                     <div class="row mb-4">
                         <div class="col-12">
@@ -3186,22 +3249,43 @@ <h5 class="modal-title">
             await GroupManager.loadGroupMembersForTransfer(groupId);
             
             // Load retention settings if enabled
-            if (group.retention_policy) {
-                const convSelect = document.getElementById('groupConversationRetention');
-                const docSelect = document.getElementById('groupDocumentRetention');
+            const convSelect = document.getElementById('groupConversationRetention');
+            const docSelect = document.getElementById('groupDocumentRetention');
+            
+            // Fetch organization defaults for group retention
+            try {
+                const orgDefaultsResp = await fetch('/api/retention-policy/defaults/group');
+                const orgData = await orgDefaultsResp.json();
                 
-                if (convSelect) {
-                    convSelect.value = group.retention_policy.conversation_retention_days || 'none';
-                }
-                if (docSelect) {
-                    docSelect.value = group.retention_policy.document_retention_days || 'none';
+                if (orgData.success) {
+                    const convDefaultOption = convSelect?.querySelector('option[value="default"]');
+                    const docDefaultOption = docSelect?.querySelector('option[value="default"]');
+                    
+                    if (convDefaultOption) {
+                        convDefaultOption.textContent = `Using organization default (${orgData.default_conversation_label})`;
+                    }
+                    if (docDefaultOption) {
+                        docDefaultOption.textContent = `Using organization default (${orgData.default_document_label})`;
+                    }
                 }
+            } catch (error) {
+                console.error('Error loading group retention defaults:', error);
+            }
+            
+            if (group.retention_policy) {
+                let convRetention = group.retention_policy.conversation_retention_days;
+                let docRetention = group.retention_policy.document_retention_days;
+                
+                // If undefined, use 'default'
+                if (convRetention === undefined) convRetention = 'default';
+                if (docRetention === undefined) docRetention = 'default';
+                
+                if (convSelect) convSelect.value = convRetention;
+                if (docSelect) docSelect.value = docRetention;
             } else {
-                // Set defaults if no retention policy
-                const convSelect = document.getElementById('groupConversationRetention');
-                const docSelect = document.getElementById('groupDocumentRetention');
-                if (convSelect) convSelect.value = 'none';
-                if (docSelect) docSelect.value = 'none';
+                // Set to organization default if no retention policy set
+                if (convSelect) convSelect.value = 'default';
+                if (docSelect) docSelect.value = 'default';
             }
             
             // Store current group ID for saving changes
diff --git a/application/single_app/templates/profile.html b/application/single_app/templates/profile.html
index d444cf3b..e5a62887 100644
--- a/application/single_app/templates/profile.html
+++ b/application/single_app/templates/profile.html
@@ -308,7 +308,7 @@ <h5 class="mb-3"><i class="bi bi-hourglass-split me-2"></i>Retention Policy Sett
         
         <div class="alert alert-info">
             <i class="bi bi-info-circle me-2"></i>
-            <strong>Default:</strong> Set to "No automatic deletion" means items are never automatically deleted. Choose a retention period to enable automatic cleanup.
+            <strong>Default:</strong> You can use the organization default or set your own retention period. Choose "No automatic deletion" to keep items indefinitely.
         </div>
         
         <form id="retention-settings-form">
@@ -316,6 +316,7 @@ <h5 class="mb-3"><i class="bi bi-hourglass-split me-2"></i>Retention Policy Sett
                 <div class="col-md-6">
                     <label for="conversation_retention_days" class="form-label">Conversation Retention</label>
                     <select class="form-select" id="conversation_retention_days" name="conversation_retention_days">
+                        <option value="default">Using organization default</option>
                         <option value="none">No automatic deletion</option>
                         <option value="1">1 day</option>
                         <option value="5">5 days</option>
@@ -334,6 +335,7 @@ <h5 class="mb-3"><i class="bi bi-hourglass-split me-2"></i>Retention Policy Sett
                 <div class="col-md-6">
                     <label for="document_retention_days" class="form-label">Document Retention</label>
                     <select class="form-select" id="document_retention_days" name="document_retention_days">
+                        <option value="default">Using organization default</option>
                         <option value="none">No automatic deletion</option>
                         <option value="1">1 day</option>
                         <option value="5">5 days</option>
@@ -1055,24 +1057,52 @@ <h5 class="modal-title" id="exportActivityModalLabel">
     return date.toLocaleDateString();
 }
 
-function loadRetentionSettings() {
-    fetch('/api/user/settings')
-        .then(response => response.json())
-        .then(data => {
-            const retentionPolicy = data.settings?.retention_policy || {};
-            
-            const convRetention = retentionPolicy.conversation_retention_days || 'none';
-            const docRetention = retentionPolicy.document_retention_days || 'none';
-            
-            const convSelect = document.getElementById('conversation_retention_days');
-            const docSelect = document.getElementById('document_retention_days');
+async function loadRetentionSettings() {
+    try {
+        // Fetch both user settings and organization defaults in parallel
+        const [userSettingsResp, orgDefaultsResp] = await Promise.all([
+            fetch('/api/user/settings'),
+            fetch('/api/retention-policy/defaults/personal')
+        ]);
+        
+        const userData = await userSettingsResp.json();
+        const orgData = await orgDefaultsResp.json();
+        
+        const retentionPolicy = userData.settings?.retention_policy || {};
+        
+        // Get user's current settings (default to 'default' if not set, for backwards compatibility treat 'none' as user choice)
+        let convRetention = retentionPolicy.conversation_retention_days;
+        let docRetention = retentionPolicy.document_retention_days;
+        
+        // If user has no setting at all (undefined), use 'default'
+        if (convRetention === undefined) {
+            convRetention = 'default';
+        }
+        if (docRetention === undefined) {
+            docRetention = 'default';
+        }
+        
+        const convSelect = document.getElementById('conversation_retention_days');
+        const docSelect = document.getElementById('document_retention_days');
+        
+        // Update the "Using organization default" option text with the actual default value
+        if (orgData.success) {
+            const convDefaultOption = convSelect?.querySelector('option[value="default"]');
+            const docDefaultOption = docSelect?.querySelector('option[value="default"]');
             
-            if (convSelect) convSelect.value = convRetention;
-            if (docSelect) docSelect.value = docRetention;
-        })
-        .catch(error => {
-            console.error('Error loading retention settings:', error);
-        });
+            if (convDefaultOption) {
+                convDefaultOption.textContent = `Using organization default (${orgData.default_conversation_label})`;
+            }
+            if (docDefaultOption) {
+                docDefaultOption.textContent = `Using organization default (${orgData.default_document_label})`;
+            }
+        }
+        
+        if (convSelect) convSelect.value = convRetention;
+        if (docSelect) docSelect.value = docRetention;
+    } catch (error) {
+        console.error('Error loading retention settings:', error);
+    }
 }
 
 function saveRetentionSettings() {
diff --git a/docs/explanation/features/v0.236.011/CONTROL_CENTER_APPLICATION_ROLES.md b/docs/explanation/features/v0.236.011/CONTROL_CENTER_APPLICATION_ROLES.md
new file mode 100644
index 00000000..29ffc1fc
--- /dev/null
+++ b/docs/explanation/features/v0.236.011/CONTROL_CENTER_APPLICATION_ROLES.md
@@ -0,0 +1,154 @@
+# Control Center Application Roles
+
+## Overview
+
+Added two new application roles for finer-grained access control to the Control Center, enabling organizations to delegate administrative functions while maintaining security boundaries.
+
+**Version Implemented:** 0.236.011
+
+## New Roles
+
+### Control Center Admin
+
+| Property | Value |
+|----------|-------|
+| **Role Name** | Control Center Admin |
+| **Description** | Full administrative access to Control Center functionality |
+| **Access Level** | Full read/write access to all Control Center features |
+
+**Permissions:**
+- View all Control Center dashboards and metrics
+- Manage user access and permissions
+- Execute administrative operations (take ownership, transfer, delete)
+- Approve/reject workflow requests
+- Configure Control Center settings
+
+### Control Center Dashboard Reader
+
+| Property | Value |
+|----------|-------|
+| **Role Name** | Control Center Dashboard Reader |
+| **Description** | Read-only access to Control Center dashboards |
+| **Access Level** | View-only access to dashboards and metrics |
+
+**Permissions:**
+- View Control Center dashboard
+- View activity trends and metrics
+- View user statistics
+- View group and workspace information
+- **Cannot** perform administrative actions
+- **Cannot** modify settings or configurations
+
+## Use Cases
+
+### Scenario 1: IT Operations Team
+- **Need**: Monitor system health and usage without admin capabilities
+- **Solution**: Assign "Control Center Dashboard Reader" role
+- **Benefit**: Visibility into metrics without risk of accidental changes
+
+### Scenario 2: Delegated Administration
+- **Need**: Department leads manage their users' access
+- **Solution**: Assign "Control Center Admin" role to specific individuals
+- **Benefit**: Distributed administration without full application admin access
+
+### Scenario 3: Compliance Auditors
+- **Need**: Review activity logs and usage patterns
+- **Solution**: Assign "Control Center Dashboard Reader" role
+- **Benefit**: Audit capability without modification access
+
+## Configuration
+
+### Adding Roles to Entra ID Enterprise Application
+
+1. Navigate to Azure Portal → Entra ID → Enterprise Applications
+2. Find your SimpleChat application registration
+3. Go to **App roles** 
+4. Add the new roles from `appRegistrationRoles.json`
+
+### Role Assignment
+
+```json
+{
+  "roles": [
+    {
+      "allowedMemberTypes": ["User"],
+      "description": "Full administrative access to Control Center",
+      "displayName": "Control Center Admin",
+      "isEnabled": true,
+      "value": "ControlCenterAdmin"
+    },
+    {
+      "allowedMemberTypes": ["User"],
+      "description": "Read-only access to Control Center dashboards",
+      "displayName": "Control Center Dashboard Reader",
+      "isEnabled": true,
+      "value": "ControlCenterDashboardReader"
+    }
+  ]
+}
+```
+
+### Assigning Roles to Users
+
+1. Navigate to Enterprise Application → Users and groups
+2. Click **Add user/group**
+3. Select user(s) to assign
+4. Select the appropriate role
+5. Click **Assign**
+
+## Role Hierarchy
+
+```
+┌─────────────────────────────────────┐
+│              Admin                   │  ← Full application admin
+│  (All permissions)                   │
+└─────────────────┬───────────────────┘
+                  │
+┌─────────────────▼───────────────────┐
+│       Control Center Admin           │  ← Control Center admin only
+│  (Full CC access, no app settings)   │
+└─────────────────┬───────────────────┘
+                  │
+┌─────────────────▼───────────────────┐
+│  Control Center Dashboard Reader     │  ← View-only access
+│  (Read-only dashboard access)        │
+└─────────────────────────────────────┘
+```
+
+## Integration with Existing Roles
+
+| Existing Role | Control Center Access |
+|---------------|----------------------|
+| Admin | Full access (includes all CC permissions) |
+| User | No Control Center access by default |
+| Owner | Group-level access only |
+| DocumentManager | No Control Center access |
+
+| New Role | Control Center Access |
+|----------|----------------------|
+| ControlCenterAdmin | Full CC admin access |
+| ControlCenterDashboardReader | Read-only CC dashboard access |
+
+## Security Considerations
+
+1. **Principle of Least Privilege**: Assign Dashboard Reader by default, escalate to Admin only when needed
+2. **Audit Trail**: All Control Center actions are logged regardless of role
+3. **Role Separation**: Dashboard Reader cannot perform any destructive operations
+4. **Admin Oversight**: Full Admin role retains visibility into all role assignments
+
+## Files Modified
+
+- `appRegistrationRoles.json` - Added new role definitions
+
+## Related Features
+
+- [Control Center](../v0.235.001/control_center.md) - Main Control Center functionality
+- [Approval Workflow System](../v0.235.001/APPROVAL_WORKFLOW_SYSTEM.md) - Protected operations requiring approval
+- [Enhanced User Management](../v0.235.001/ENHANCED_USER_MANAGEMENT.md) - User metrics and management
+
+## Migration Notes
+
+Existing deployments should:
+1. Update the Entra ID app registration with new roles
+2. Assign appropriate roles to users who need Control Center access
+3. Review existing Admin role assignments for potential role refinement
diff --git a/docs/explanation/features/v0.236.011/PRIVATE_NETWORKING_SUPPORT.md b/docs/explanation/features/v0.236.011/PRIVATE_NETWORKING_SUPPORT.md
new file mode 100644
index 00000000..de2ae92f
--- /dev/null
+++ b/docs/explanation/features/v0.236.011/PRIVATE_NETWORKING_SUPPORT.md
@@ -0,0 +1,179 @@
+# Private Networking Support
+
+## Overview
+
+Comprehensive private networking support for SimpleChat deployments via Azure Developer CLI (AZD) and Bicep infrastructure-as-code. This feature enables secure, isolated deployments with private endpoints, virtual networks, and private DNS zones.
+
+**Version Implemented:** 0.236.011
+
+## Key Features
+
+- **Private Endpoint Support**: All Azure PaaS services can be configured with private endpoints
+- **Virtual Network Integration**: Full VNet integration for App Service and dependent resources
+- **Private DNS Zones**: Automated DNS zone configuration for private endpoint resolution
+- **AZD Integration**: Seamless deployment via `azd up` with private networking enabled
+- **Bicep Automation**: Infrastructure-as-code templates for reproducible deployments
+- **Post-Deployment Security**: Automatic disabling of public network access when private networking is enabled
+
+## Architecture
+
+### Network Topology
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                        Virtual Network                           │
+│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐  │
+│  │   App Service   │  │  Private DNS    │  │   Private       │  │
+│  │   Subnet        │  │  Zones          │  │   Endpoints     │  │
+│  │                 │  │                 │  │   Subnet        │  │
+│  │  ┌───────────┐  │  │  - Cosmos DB    │  │                 │  │
+│  │  │SimpleChat │  │  │  - OpenAI       │  │  ┌───────────┐  │  │
+│  │  │  App      │──────│  - AI Search   │──────│ Cosmos DB │  │  │
+│  │  └───────────┘  │  │  - Storage      │  │  └───────────┘  │  │
+│  │                 │  │  - Key Vault    │  │                 │  │
+│  └─────────────────┘  └─────────────────┘  │  ┌───────────┐  │  │
+│                                             │  │ Azure     │  │  │
+│                                             │  │ OpenAI    │  │  │
+│                                             │  └───────────┘  │  │
+│                                             │                 │  │
+│                                             │  ┌───────────┐  │  │
+│                                             │  │ AI Search │  │  │
+│                                             │  └───────────┘  │  │
+│                                             └─────────────────┘  │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+### Supported Private Endpoints
+
+| Service | Private DNS Zone |
+|---------|-----------------|
+| Azure Cosmos DB | `privatelink.documents.azure.com` |
+| Azure OpenAI | `privatelink.openai.azure.com` |
+| Azure AI Search | `privatelink.search.windows.net` |
+| Azure Blob Storage | `privatelink.blob.core.windows.net` |
+| Azure Key Vault | `privatelink.vaultcore.azure.net` |
+| Azure Document Intelligence | `privatelink.cognitiveservices.azure.com` |
+
+## Deployment
+
+### Prerequisites
+
+1. **Azure Subscription** with appropriate permissions
+2. **Azure Developer CLI (AZD)** installed
+3. **Azure CLI** installed and authenticated
+4. **Permissions**: Contributor or higher on the subscription/resource group
+
+### AZD Deployment
+
+```bash
+# Clone the repository
+git clone https://github.com/microsoft/simplechat.git
+cd simplechat/deployers
+
+# Initialize AZD (first time)
+azd init
+
+# Enable private networking
+azd env set ENABLE_PRIVATE_NETWORKING true
+
+# Deploy with private networking
+azd up
+```
+
+### Bicep Deployment
+
+```bash
+# Deploy with private networking parameter
+az deployment sub create \
+  --location eastus \
+  --template-file main.bicep \
+  --parameters enablePrivateNetworking=true
+```
+
+## Configuration Options
+
+### Environment Variables
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `ENABLE_PRIVATE_NETWORKING` | Enable private endpoints for all services | `false` |
+| `VNET_ADDRESS_SPACE` | Virtual network address space | `10.0.0.0/16` |
+| `APP_SUBNET_PREFIX` | App Service subnet prefix | `10.0.1.0/24` |
+| `PRIVATE_ENDPOINT_SUBNET_PREFIX` | Private endpoints subnet prefix | `10.0.2.0/24` |
+
+## Deployment Hooks
+
+### Post-Provision Hook
+- Creates private DNS zones
+- Configures private endpoints
+- Sets up VNet integration
+
+### Pre-Deploy Hook
+- Validates network configuration
+- Ensures DNS resolution is working
+
+### Post-Up Hook
+- **NEW**: Automatically disables public network access for resources when private networking is enabled
+- Validates connectivity through private endpoints
+- Outputs connection validation results
+
+## Azure Government Considerations
+
+### Regional Availability
+- Private endpoints available in all USGov regions
+- Some services may have regional restrictions
+
+### Model Configuration
+- Azure OpenAI models may differ in government regions
+- Configure model overrides as needed
+
+### Service Limitations
+- Some preview features may not be available
+- Check Azure Government documentation for current status
+
+## Error Handling
+
+The deployment scripts include:
+- **Stepwise logging**: Detailed output for each deployment phase
+- **Explicit error handling**: Failures caught early with clear messages
+- **Troubleshooting guidance**: Helpful error messages for common issues
+
+## Post-Deployment Validation
+
+After deployment, validate:
+
+1. **DNS Resolution**: Private DNS zones resolve correctly
+2. **Network Connectivity**: App Service can reach all services via private endpoints
+3. **AI Model Connections**: Test chat functionality
+4. **Search Integration**: Verify AI Search connectivity
+5. **Document Processing**: Test Document Intelligence
+
+## Security Benefits
+
+1. **No Public Exposure**: Services not accessible from public internet
+2. **Network Isolation**: All traffic stays within Azure backbone
+3. **Reduced Attack Surface**: Minimized exposure to external threats
+4. **Compliance**: Meets enterprise security requirements
+5. **Data Protection**: Data never traverses public networks
+
+## Known Issues and Workarounds
+
+1. **DNS Propagation Delay**: Allow 5-10 minutes for DNS changes to propagate
+2. **VNet Peering**: Additional configuration needed if peering with existing VNets
+3. **On-Premises Connectivity**: Requires ExpressRoute or VPN Gateway for hybrid scenarios
+
+## Files Modified
+
+### Deployment Files
+- `deployers/azure.yaml` - Enhanced hooks with logging and error handling
+- `deployers/bicep/*.bicep` - Private networking Bicep templates
+
+### Documentation
+- `deployers/bicep/README.md` - Enhanced prerequisites and USGov guidance
+- `OneClickDeploy.md` - Corrected deployment button links
+
+## Related Documentation
+
+- [Azure Private Endpoints Documentation](https://docs.microsoft.com/azure/private-link/private-endpoint-overview)
+- [App Service VNet Integration](https://docs.microsoft.com/azure/app-service/web-sites-integrate-with-vnet)
+- [Private DNS Zones](https://docs.microsoft.com/azure/dns/private-dns-overview)
diff --git a/docs/explanation/features/v0.236.011/RETENTION_POLICY_DEFAULTS.md b/docs/explanation/features/v0.236.011/RETENTION_POLICY_DEFAULTS.md
new file mode 100644
index 00000000..e3fe426d
--- /dev/null
+++ b/docs/explanation/features/v0.236.011/RETENTION_POLICY_DEFAULTS.md
@@ -0,0 +1,208 @@
+# RETENTION_POLICY_DEFAULTS.md
+
+**Feature**: Admin-Configurable Default Retention Policies  
+**Version**: 0.236.011  
+**Implemented in**: 0.236.011
+
+## Overview and Purpose
+
+The Retention Policy Defaults feature allows administrators to configure organization-wide default retention periods for conversations and documents across all workspace types (personal, group, and public). Users can choose to use the organization default or set their own custom retention period. Administrators also have the ability to force push defaults to override all custom policies.
+
+## Key Features
+
+- **Organization Defaults**: Set default retention periods for conversations and documents per workspace type
+- **User Choice**: Users see "Using organization default (X days)" option and can override with custom settings
+- **Conditional Display**: Default settings only appear for enabled workspace types
+- **Force Push**: Administrators can push organization defaults to all workspaces, overriding custom settings
+- **Activity Logging**: Force push actions are logged for audit purposes
+- **Settings Auto-Save**: Force push automatically saves pending settings changes before executing
+
+## Technical Specifications
+
+### Architecture Overview
+
+The feature integrates with the existing retention policy system and adds:
+
+1. **Backend Settings** - 6 new settings fields for default retention values
+2. **Admin UI** - Dropdown selectors in Admin Settings for each workspace type
+3. **API Endpoints** - New endpoints for fetching defaults and force pushing
+4. **User UI Integration** - Updated profile, control center, and workspace manager
+5. **Execution Logic** - Resolution of 'default' values at policy execution time
+
+### New Settings Fields
+
+Added to `functions_settings.py`:
+
+| Setting | Default Value | Description |
+|---------|---------------|-------------|
+| `default_retention_conversation_personal` | `'none'` | Default conversation retention for personal workspaces |
+| `default_retention_document_personal` | `'none'` | Default document retention for personal workspaces |
+| `default_retention_conversation_group` | `'none'` | Default conversation retention for group workspaces |
+| `default_retention_document_group` | `'none'` | Default document retention for group workspaces |
+| `default_retention_conversation_public` | `'none'` | Default conversation retention for public workspaces |
+| `default_retention_document_public` | `'none'` | Default document retention for public workspaces |
+
+**Note**: Value `'none'` means no automatic deletion. Numeric values represent days.
+
+### API Endpoints
+
+#### Get Retention Defaults
+
+**Endpoint**: `GET /api/retention-policy/defaults/<workspace_type>`
+
+**Parameters**:
+- `workspace_type`: One of `personal`, `group`, or `public`
+
+**Response**:
+```json
+{
+  "success": true,
+  "workspace_type": "personal",
+  "defaults": {
+    "conversation_retention_days": "none",
+    "document_retention_days": "30"
+  }
+}
+```
+
+**Authentication**: Requires user authentication (`@login_required`)
+
+#### Force Push Retention Defaults
+
+**Endpoint**: `POST /api/admin/retention-policy/force-push`
+
+**Request Body**:
+```json
+{
+  "scopes": ["personal", "group", "public"]
+}
+```
+
+**Response**:
+```json
+{
+  "success": true,
+  "message": "Defaults pushed to 150 items",
+  "updated_count": 150,
+  "scopes": ["personal", "group"],
+  "details": {
+    "personal": 100,
+    "group": 50
+  }
+}
+```
+
+**Authentication**: Requires admin authentication (`@admin_required`)
+
+### File Structure
+
+**Backend Files**:
+- `functions_settings.py` - New default retention settings fields
+- `route_frontend_admin_settings.py` - Handling for saving new settings
+- `route_backend_retention_policy.py` - New API endpoints
+- `functions_retention_policy.py` - `resolve_retention_value()` helper function
+- `functions_activity_logging.py` - `log_retention_policy_force_push()` function
+
+**Frontend Files**:
+- `templates/admin_settings.html` - Default Retention Policies section, Force Push modal
+- `templates/profile.html` - Updated retention dropdowns with org default option
+- `templates/control_center.html` - Updated group and public workspace retention UI
+- `static/js/workspace-manager.js` - Public workspace retention settings
+
+## Usage Instructions
+
+### Configuring Organization Defaults (Admin)
+
+1. Navigate to **Admin Settings** > **Content** tab
+2. Scroll to the **Retention Policy** section
+3. For each enabled workspace type, you'll see:
+   - **Default Conversation Retention Days**: How long conversations are kept
+   - **Default Document Retention Days**: How long documents are kept
+4. Select the desired defaults from the dropdown (1 day to 10 years, or "Don't delete")
+5. Click **Save All Settings**
+
+### Force Pushing Defaults (Admin)
+
+1. In the **Default Retention Policies** section, click **Force Push Defaults to All**
+2. In the modal, select which workspace types to update
+3. Review the warning about overriding custom policies
+4. Click **Force Push** to confirm
+5. The system will:
+   - First save any pending settings changes
+   - Then push defaults to all selected workspaces
+   - Display a summary of updated items
+6. Click **Close** when complete
+
+### User Experience
+
+Users see updated retention options in their workspace settings:
+
+- **Using organization default (X days)** - Uses the admin-configured default
+- **Don't delete** - Keep items indefinitely
+- **Custom values** - 1 day to 10 years
+
+When "Using organization default" is selected:
+- The actual default value is shown (e.g., "30 days")
+- If the admin changes the default, the user's policy automatically follows
+- Users can override by selecting a specific value
+
+## Activity Logging
+
+Force push actions are logged to the `activity_logs` container with:
+
+- **Activity Type**: `retention_policy_force_push`
+- **Admin Info**: User ID and email of admin who executed
+- **Scopes**: Which workspace types were affected
+- **Results**: Breakdown of updates per workspace type
+- **Total Updated**: Number of workspaces/users updated
+- **Timestamp**: When the action occurred
+
+## UI/UX Details
+
+### Admin Settings Modal Flow
+
+1. **Initial State**: Shows Cancel and Force Push buttons
+2. **Processing**: 
+   - Status shows "Saving settings first..."
+   - Then "Pushing defaults to workspaces..."
+3. **Completed**: 
+   - Cancel and Force Push buttons hide
+   - Only Close button visible
+   - Results summary displayed
+
+### Conditional Visibility
+
+Default retention dropdowns only appear when the corresponding workspace type is enabled:
+- Personal workspace defaults shown only when `enable_retention_policy_personal` is checked
+- Group workspace defaults shown only when `enable_retention_policy_group` is checked
+- Public workspace defaults shown only when `enable_retention_policy_public` is checked
+
+## Testing and Validation
+
+### Test Coverage
+
+The feature can be validated by:
+1. Setting organization defaults in Admin Settings
+2. Verifying the defaults appear in user-facing dropdowns
+3. Testing the Force Push functionality
+4. Checking activity logs for audit records
+5. Verifying retention policy execution respects 'default' values
+
+### Performance Considerations
+
+- Force push iterates through all users/groups/workspaces
+- Large deployments may take several seconds to complete
+- Progress indicator shown during execution
+- Non-blocking - admin can continue using the application
+
+## Known Limitations
+
+- Force push is an all-or-nothing operation per workspace type
+- No option to selectively target specific users/groups
+- Requires page refresh to see updated defaults in user UI after admin changes
+
+## Related Documentation
+
+- Retention Policy system documentation
+- Admin Settings configuration guide
+- Activity Logging reference
diff --git a/docs/explanation/features/v0.236.007/USER_AGREEMENT.md b/docs/explanation/features/v0.236.011/USER_AGREEMENT.md
similarity index 99%
rename from docs/explanation/features/v0.236.007/USER_AGREEMENT.md
rename to docs/explanation/features/v0.236.011/USER_AGREEMENT.md
index 71d42396..e87589d7 100644
--- a/docs/explanation/features/v0.236.007/USER_AGREEMENT.md
+++ b/docs/explanation/features/v0.236.011/USER_AGREEMENT.md
@@ -4,7 +4,7 @@
 
 The User Agreement feature allows administrators to configure a global agreement that users must accept before uploading files to workspaces. This provides organizations with a mechanism to ensure users acknowledge terms, policies, or guidelines before contributing documents to the system.
 
-**Version Implemented:** 0.236.007
+**Version Implemented:** 0.236.011
 
 ## Key Features
 
diff --git a/docs/explanation/fixes/v0.235.022/RETENTION_POLICY_DOCUMENT_DELETION_FIX.md b/docs/explanation/fixes/v0.235.022/RETENTION_POLICY_DOCUMENT_DELETION_FIX.md
new file mode 100644
index 00000000..e010a0ef
--- /dev/null
+++ b/docs/explanation/fixes/v0.235.022/RETENTION_POLICY_DOCUMENT_DELETION_FIX.md
@@ -0,0 +1,149 @@
+# Retention Policy Document Deletion Fix
+
+**Version Implemented:** 0.235.022
+
+## Problem Statement
+
+The retention policy execution was failing when attempting to delete aged documents, while conversation deletion worked correctly. The error manifested as:
+
+```
+[DEBUG] [INFO]: Error querying aged documents for personal (partition_value=1d6312bd-3eaa-4586-8b74-e90eee126f78): (BadRequest) One of the input values is invalid.
+```
+
+This prevented the automated cleanup of old documents based on user-configured retention policies.
+
+## Root Cause Analysis
+
+Investigation revealed **four distinct issues** causing the document deletion to fail:
+
+### Issue 1: Wrong Field Name
+Documents use `last_updated` as the timestamp field, but the retention policy was querying for `last_activity_at` (which is used by conversations).
+
+**Document schema:**
+```json
+{
+  "upload_date": "2025-11-20T15:17:57Z",
+  "last_updated": "2025-11-20T15:54:22Z"
+}
+```
+
+**Incorrect query:**
+```sql
+WHERE c.last_activity_at < @cutoff_date
+```
+
+### Issue 2: Date Format Mismatch
+Documents store timestamps in `YYYY-MM-DDTHH:MM:SSZ` format, but the query was using Python's `.isoformat()` which produces `+00:00` suffix with microseconds.
+
+- **Document format:** `2026-01-08T21:49:15Z`
+- **Query format:** `2026-01-15T15:49:09.828460+00:00`
+
+Cosmos DB string comparison failed due to format differences.
+
+### Issue 3: Duplicate Column in SELECT
+The query included both `c.{partition_field}` and `c.user_id` in the SELECT clause. When `partition_field='user_id'`, this created a duplicate column causing query errors.
+
+**Problematic query:**
+```sql
+SELECT c.id, c.file_name, c.title, c.last_updated, c.user_id, c.user_id
+```
+
+### Issue 4: Incorrect Activity Logging Parameter
+The `log_conversation_deletion()` function was called with `deletion_reason='retention_policy'`, but this parameter doesn't exist in the function signature. It should use `additional_context` instead.
+
+## Solution Implementation
+
+### File Modified: `functions_retention_policy.py`
+
+#### Fix 1: Correct Field Name
+Changed document queries to use `last_updated` instead of `last_activity_at`:
+
+```python
+# Query for aged documents
+# Documents use 'last_updated' field (not 'last_activity_at' like conversations)
+query = f"""
+    SELECT c.id, c.file_name, c.title, c.last_updated, c.user_id
+    FROM c
+    WHERE c.{partition_field} = @partition_value
+    AND c.last_updated < @cutoff_date
+"""
+```
+
+#### Fix 2: Correct Date Format
+Changed from `.isoformat()` to `.strftime()` to match document timestamp format:
+
+```python
+# Documents use format like '2026-01-08T21:49:15Z' so we match that format
+cutoff_date = datetime.now(timezone.utc) - timedelta(days=retention_days)
+cutoff_iso = cutoff_date.strftime('%Y-%m-%dT%H:%M:%SZ')
+```
+
+#### Fix 3: Remove Duplicate Column
+Simplified SELECT to avoid duplicate columns:
+
+```python
+SELECT c.id, c.file_name, c.title, c.last_updated, c.user_id
+```
+
+#### Fix 4: Correct Activity Logging Parameter
+Changed from invalid parameter to proper `additional_context`:
+
+```python
+# Before (incorrect)
+log_conversation_deletion(
+    ...
+    deletion_reason='retention_policy'
+)
+
+# After (correct)
+log_conversation_deletion(
+    ...
+    additional_context={'deletion_reason': 'retention_policy'}
+)
+```
+
+### Additional Improvements
+
+#### Enhanced Debug Logging
+Added comprehensive debug logging to aid future troubleshooting:
+
+```python
+debug_print(f"Processing retention for user {user_id}: conversations={conversation_retention_days} days, documents={document_retention_days} days")
+debug_print(f"Querying aged documents: workspace_type={workspace_type}, partition_field={partition_field}, partition_value={partition_value}, cutoff_date={cutoff_iso}, retention_days={retention_days}")
+debug_print(f"Found {len(aged_documents)} aged documents for {workspace_type} workspace")
+```
+
+## Testing & Validation
+
+After the fix, retention policy execution completed successfully:
+
+```
+[DEBUG] [INFO]: Querying aged documents: workspace_type=personal, partition_field=user_id, partition_value=1d6312bd-3eaa-4586-8b74-e90eee126f78, cutoff_date=2026-01-15T15:58:09Z, retention_days=1
+[DEBUG] [INFO]: Found 1 aged documents for personal workspace
+[DEBUG] [INFO]: [DELETE DOCUMENT] Starting deletion for document: 36a030b2-57b2-426b-8aa9-6f49eed5f8a6
+[DEBUG] [INFO]: Logged document deletion transaction: 36a030b2-57b2-426b-8aa9-6f49eed5f8a6
+Successfully deleted blob at 1d6312bd-3eaa-4586-8b74-e90eee126f78/test.pdf
+[DEBUG] [INFO]: Deleted document 36a030b2-57b2-426b-8aa9-6f49eed5f8a6 (test.pdf) due to retention policy
+[DEBUG] [INFO]: Notification created: 5a92235d-d408-4449-9c72-0951ed198688 [personal] [system_announcement]
+[DEBUG] [INFO]: Retention policy execution completed: {'success': True, ... 'documents': 1, 'users_affected': 1 ...}
+```
+
+## Files Changed
+
+| File | Changes |
+|------|---------|
+| `functions_retention_policy.py` | Fixed field name, date format, duplicate columns, activity logging |
+| `config.py` | Version bump to 0.235.022 |
+
+## Impact
+
+- **Retention Policy:** Now correctly deletes aged documents based on user settings
+- **Activity Logging:** Document deletions are properly logged with deletion reason
+- **User Notifications:** Users receive notifications when documents are deleted by retention policy
+- **Blob Storage:** Associated blob files are correctly removed
+
+## Related Components
+
+- Conversation retention (uses `last_activity_at` - unchanged)
+- Group workspace retention (shares same document deletion logic)
+- Public workspace retention (shares same document deletion logic)
diff --git a/docs/explanation/fixes/v0.236.011/SOVEREIGN_CLOUD_COGNITIVE_SERVICES_SCOPE_FIX.md b/docs/explanation/fixes/v0.236.011/SOVEREIGN_CLOUD_COGNITIVE_SERVICES_SCOPE_FIX.md
new file mode 100644
index 00000000..f76993ba
--- /dev/null
+++ b/docs/explanation/fixes/v0.236.011/SOVEREIGN_CLOUD_COGNITIVE_SERVICES_SCOPE_FIX.md
@@ -0,0 +1,94 @@
+# Sovereign Cloud Cognitive Services Scope Fix
+
+## Overview
+
+Fixed hardcoded commercial Azure cognitive services scope references in chat streaming and Smart HTTP Plugin that prevented proper authentication in Azure Government (MAG) and custom cloud environments.
+
+**Version Implemented:** 0.236.011
+
+**Related Issue:** [#616](https://github.com/microsoft/simplechat/issues/616#issue-3835164022)
+
+## Problem
+
+The `chat_stream_api` and `smart_http_plugin` contained hardcoded references to commercial Azure cognitive services scope URLs. This caused authentication failures when running SimpleChat in:
+- Azure Government (MAG) environments
+- Custom/sovereign cloud deployments
+
+### Error Symptoms
+
+Users in MAG environments encountered authentication errors when:
+- Using chat with streaming enabled
+- Making Smart HTTP Plugin calls
+
+The error occurred because the code attempted to authenticate against commercial Azure endpoints instead of the appropriate government or custom cloud endpoints.
+
+## Root Cause
+
+The authentication scope was hardcoded as the commercial cognitive services URL rather than using the configurable value from `config.py`. This meant:
+- Commercial: `https://cognitiveservices.azure.com/.default`
+- Government: Should be `https://cognitiveservices.azure.us/.default`
+- Custom: Should use environment-specific scope
+
+## Solution
+
+Replaced all hardcoded cognitive services scope references with the configurable variable from `config.py`:
+- `AZURE_OPENAI_TOKEN_SCOPE` environment variable
+- Dynamically resolved based on cloud environment
+
+### Files Modified
+
+1. **chat_stream_api** (streaming chat implementation)
+   - Replaced hardcoded scope with `config.AZURE_OPENAI_TOKEN_SCOPE`
+
+2. **smart_http_plugin** (Smart HTTP Plugin)
+   - Replaced hardcoded scope with configurable variable
+
+## Cloud Environment Support
+
+| Cloud Environment | Cognitive Services Scope |
+|-------------------|-------------------------|
+| Commercial | `https://cognitiveservices.azure.com/.default` |
+| Government (MAG) | `https://cognitiveservices.azure.us/.default` |
+| China | `https://cognitiveservices.azure.cn/.default` |
+| Custom | Configurable via environment variable |
+
+## Testing
+
+### Azure Government Validation
+
+1. Deploy SimpleChat to Azure Government environment
+2. Configure appropriate Azure OpenAI resources
+3. Enable streaming in chat settings
+4. Send a chat message with streaming enabled
+5. Verify response streams correctly without authentication errors
+
+### Commercial Cloud Validation
+
+1. Verify existing commercial deployments continue to function
+2. Test streaming chat functionality
+3. Test Smart HTTP Plugin calls
+
+## Impact
+
+- **Azure Government**: Full streaming and plugin functionality now works correctly
+- **Custom Clouds**: Deployments can configure appropriate scope for their environment
+- **Commercial**: No change to existing behavior
+
+## Configuration
+
+The cognitive services scope is configured via:
+
+```python
+# config.py
+AZURE_OPENAI_TOKEN_SCOPE = os.getenv('AZURE_OPENAI_TOKEN_SCOPE', 'https://cognitiveservices.azure.com/.default')
+```
+
+For Azure Government, set:
+```
+AZURE_OPENAI_TOKEN_SCOPE=https://cognitiveservices.azure.us/.default
+```
+
+## Related
+
+- Sovereign Cloud Managed Identity Authentication Fix (v0.229.001)
+- Azure Government Support documentation
diff --git a/docs/explanation/fixes/v0.236.011/USER_SEARCH_TOAST_INLINE_MESSAGES_FIX.md b/docs/explanation/fixes/v0.236.011/USER_SEARCH_TOAST_INLINE_MESSAGES_FIX.md
new file mode 100644
index 00000000..f93a7871
--- /dev/null
+++ b/docs/explanation/fixes/v0.236.011/USER_SEARCH_TOAST_INLINE_MESSAGES_FIX.md
@@ -0,0 +1,68 @@
+# User Search Toast and Inline Messages Fix
+
+## Overview
+
+Updated the `searchUsers()` function to use inline and toast messages instead of browser alert pop-ups, improving user experience and aligning with modern UI patterns.
+
+**Version Implemented:** 0.236.011
+
+**Related PR:** [#608](https://github.com/microsoft/simplechat/pull/608#discussion_r2701900020)
+
+## Problem
+
+The user search functionality in group management used browser `alert()` pop-ups for all feedback messages (empty search, no users found, errors). This created a disruptive user experience and was inconsistent with the toast notification patterns used elsewhere in the application.
+
+## Solution
+
+Refactored the `searchUsers()` function to display feedback using:
+- **Inline messages**: Primary feedback shown directly in the search results area
+- **Toast notifications**: Used only for errors, in addition to inline messaging
+
+## User Experience
+
+### Empty Search Query
+When users click search without entering a query:
+- Inline message displayed in the search results area
+- No disruptive alert pop-up
+
+### No Users Found
+When the search returns no results:
+- Informative inline message in the results area
+- Clear indication that no matching users exist
+
+### Users Found
+When one or more users are found:
+- Results displayed in the search results area
+- Success feedback integrated naturally into the flow
+
+### Error Handling
+When an error occurs:
+- Inline error message displayed
+- Toast notification also shown for visibility
+- Consistent with application error handling patterns
+
+## Technical Details
+
+### Files Modified
+- Group management JavaScript (search user functionality)
+
+### Changes
+- Replaced `alert()` calls with inline message rendering
+- Added toast notification for error cases only
+- Maintained consistent styling with existing UI patterns
+
+## Benefits
+
+1. **Non-disruptive UX**: Users can continue working without dismissing pop-ups
+2. **Contextual feedback**: Messages appear where users are looking (in the search area)
+3. **Consistency**: Aligns with toast notification patterns used elsewhere
+4. **Accessibility**: Better screen reader support with inline messages
+5. **Modern UI**: Follows contemporary web application design patterns
+
+## Testing
+
+1. Open group management → Add Members
+2. Click Search without entering a query → Verify inline "empty search" message
+3. Search for a non-existent user → Verify inline "no users found" message
+4. Search for an existing user → Verify results display correctly
+5. Simulate network error → Verify both inline message and toast appear
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index 9a58e7ef..6ea69868 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -1,10 +1,32 @@
 <!-- BEGIN release_notes.md BLOCK -->
 # Feature Release
 
-### **(v0.236.007)**
+### **(v0.236.011)**
 
 #### New Features
 
+*   **Retention Policy Defaults**
+    *   Admin-configurable organization-wide default retention policies for conversations and documents across all workspace types.
+    *   **Organization Defaults**: Set default retention periods (1 day to 10 years, or "Don't delete") separately for personal, group, and public workspaces.
+    *   **User Choice**: Users see "Using organization default (X days)" option and can override with custom settings or revert to org default.
+    *   **Conditional Display**: Default retention settings only appear in Admin Settings when the corresponding workspace type is enabled.
+    *   **Force Push Feature**: Administrators can push organization defaults to all workspaces, overriding any custom retention policies users have set.
+    *   **Settings Auto-Save**: Force push automatically saves pending settings changes before executing to ensure current values are pushed.
+    *   **Activity Logging**: Force push actions are logged to `activity_logs` container for audit purposes with admin info, affected scopes, and results summary.
+    *   **API Endpoints**: New `/api/retention-policy/defaults/<workspace_type>` (GET) and `/api/admin/retention-policy/force-push` (POST) endpoints.
+    *   **Files Modified**: `functions_settings.py`, `admin_settings.html`, `route_frontend_admin_settings.py`, `route_backend_retention_policy.py`, `functions_retention_policy.py`, `functions_activity_logging.py`, `profile.html`, `control_center.html`, `workspace-manager.js`.
+    *   (Ref: Default retention settings, Force Push modal, activity logging, retention policy execution)
+
+*   **Private Networking Support**
+    *   Comprehensive private networking support for SimpleChat deployments via Azure Developer CLI (AZD) and Bicep infrastructure-as-code.
+    *   **Network Isolation**: Private endpoints for all Azure PaaS services (Cosmos DB, Azure OpenAI, AI Search, Storage, Key Vault, Document Intelligence).
+    *   **VNet Integration**: Full virtual network integration for App Service and dependent resources with automated Private DNS zone configuration.
+    *   **AZD Integration**: Seamless deployment via `azd up` with `ENABLE_PRIVATE_NETWORKING=true` environment variable.
+    *   **Post-Deployment Security**: New `postup` hook automatically disables public network access when private networking is enabled.
+    *   **Enhanced Deployment Hooks**: Refactored all deployment hooks in `azure.yaml` with stepwise logging, explicit error handling, and clearer output for troubleshooting.
+    *   **Documentation Updates**: Expanded Bicep README with prerequisites, Azure Government (USGov) considerations, and post-deployment validation steps.
+    *   (Ref: `deployers/azure.yaml`, `deployers/bicep/`, private endpoint configuration, VNet integration)
+
 *   **User Agreement for File Uploads**
     *   Global admin-configurable agreement that users must accept before uploading files to workspaces.
     *   **Configuration Options**: Enable/disable toggle, workspace type selection (Personal, Group, Public, Chat), Markdown-formatted agreement text (200-word limit), optional daily acceptance mode.
@@ -14,6 +36,24 @@
     *   **Files Added**: `user-agreement.js` (frontend module), `route_backend_user_agreement.py` (API endpoints).
     *   **Files Modified**: `admin_settings.html`, `route_frontend_admin_settings.py`, `base.html`, `_sidebar_nav.html`, `functions_activity_logging.py`, `workspace-documents.js`, `group_workspaces.html`, `public_workspace.js`, `chat-input-actions.js`.
     *   (Ref: User Agreement modal, file upload workflows, activity logging, admin configuration)
+    
+#### Bug Fixes
+
+*   **Sovereign Cloud Cognitive Services Scope Fix**
+    *   Fixed hardcoded commercial Azure cognitive services scope references that prevented authentication in Azure Government (MAG) and custom cloud environments.
+    *   **Root Cause**: `chat_stream_api` and `smart_http_plugin` used hardcoded commercial cognitive services scope URL instead of configurable value from `config.py`.
+    *   **Solution**: Replaced hardcoded scope with `AZURE_OPENAI_TOKEN_SCOPE` environment variable, dynamically resolved based on cloud environment.
+    *   **Impact**: Streaming chat and Smart HTTP Plugin now work correctly in Azure Government, China, and custom cloud deployments.
+    *   **Related Issue**: [#616](https://github.com/microsoft/simplechat/issues/616)
+    *   (Ref: `chat_stream_api`, `smart_http_plugin`, sovereign cloud authentication, MAG support)
+
+*   **User Search Toast and Inline Messages Fix**
+    *   Updated `searchUsers()` function to use inline and toast messages instead of browser alert pop-ups.
+    *   **Improvement**: Search feedback (empty search, no users found, errors) now displays as inline messages in the search results area.
+    *   **Error Handling**: Errors display both inline message and toast notification for visibility.
+    *   **Benefits**: Non-disruptive UX, contextual feedback, consistency with application patterns.
+    *   **Related PR**: [#608](https://github.com/microsoft/simplechat/pull/608#discussion_r2701900020)
+    *   (Ref: group management, user search, toast notifications, UX improvement)
 
 ### **(v0.235.025)**
 
@@ -79,6 +119,14 @@
     *   **Dashboard**: Real-time statistics, key alerts, activity insights.
     *   (Ref: `route_frontend_control_center.py`, `route_backend_control_center.py`, `control_center.html`)
 
+*   **Control Center Application Roles**
+    *   Added two new application roles for finer-grained Control Center access control.
+    *   **Control Center Admin**: Full administrative access to Control Center functionality including user management, administrative operations, and workflow approvals.
+    *   **Control Center Dashboard Reader**: Read-only access to Control Center dashboards and metrics for monitoring and auditing purposes.
+    *   **Use Cases**: IT operations monitoring, delegated administration, compliance auditing with appropriate access levels.
+    *   **Files Modified**: `appRegistrationRoles.json` (new role definitions).
+    *   (Ref: Entra ID app roles, role-based access control, Control Center permissions)
+
 *   **Message Threading System**
     *   Linked-list threading system establishing proper message relationships throughout conversations.
     *   **Thread Fields**: `thread_id` (unique identifier), `previous_thread_id` (links to previous message), `active_thread` (thread active status), `thread_attempt` (retry tracking).