diff --git a/i18n/default_de.json b/i18n/default_de.json
index 7285aed..a46f2d1 100644
--- a/i18n/default_de.json
+++ b/i18n/default_de.json
@@ -61,6 +61,43 @@
   "Problems logging in": "Probleme beim Login",
   "We could not continue with these login details": "Mit diesen Login-Daten konnte nicht fortgefahren werden",
   "Cached": "Cache",
+  "App identity": "App-Identität",
+  "Configured": "Konfiguriert",
+  "Not configured": "Nicht konfiguriert",
+  "Theme policy": "Theme-Richtlinie",
+  "Brand color": "Markenfarbe",
+  "User override enabled": "Benutzer-Override aktiviert",
+  "User override disabled": "Benutzer-Override deaktiviert",
+  "Token lifetime policy": "Token-Laufzeit-Richtlinie",
+  "Token operations": "Token-Aktionen",
+  "CORS allowlist": "CORS-Allowlist",
+  "Shared Microsoft credentials": "Geteilte Microsoft-Zugangsdaten",
+  "Authority endpoint": "Authority-Endpunkt",
+  "SMTP connection": "SMTP-Verbindung",
+  "SMTP credentials": "SMTP-Zugangsdaten",
+  "Sender identity": "Absenderidentität",
+  "%d defaults configured": "%d Standards konfiguriert",
+  "%d events enabled": "%d Ereignisse aktiviert",
+  "%d origins configured": "%d Origins konfiguriert",
+  "days": "Tage",
+  "Leave empty to use the runtime default title.": "Leer lassen, um den Laufzeit-Standardtitel zu verwenden.",
+  "Leave empty to keep the currently stored password.": "Leer lassen, um das aktuell gespeicherte Passwort beizubehalten.",
+  "Leave empty to keep the currently stored client secret.": "Leer lassen, um das aktuell gespeicherte Client-Secret beizubehalten.",
+  "This setting controls the application name shown across the UI.": "Diese Einstellung steuert den in der gesamten UI angezeigten Anwendungsnamen.",
+  "This setting controls the default language for users without a personal preference.": "Diese Einstellung steuert die Standardsprache für Benutzer ohne persönliche Präferenz.",
+  "These defaults prefill tenant, department and role when new users are created.": "Diese Standards füllen Mandant, Abteilung und Rolle bei neu erstellten Benutzern vor.",
+  "This setting controls the global default theme and whether users may choose their own theme.": "Diese Einstellung steuert das globale Standard-Theme und ob Benutzer ihr eigenes Theme wählen dürfen.",
+  "This setting controls the primary UI accent color for the default app theme.": "Diese Einstellung steuert die primäre UI-Akzentfarbe des Standard-App-Themes.",
+  "Telemetry helps detect recurring UI issues and failed requests in production.": "Telemetry hilft, wiederkehrende UI-Probleme und fehlgeschlagene Requests in Produktion zu erkennen.",
+  "Limit which event types are collected to match your privacy and operations requirements.": "Begrenze die erfassten Ereignistypen passend zu Datenschutz- und Betriebsanforderungen.",
+  "These settings define how the application connects to your SMTP server.": "Diese Einstellungen definieren, wie sich die Anwendung mit deinem SMTP-Server verbindet.",
+  "Provide authentication data used by the SMTP transport.": "Lege die Authentifizierungsdaten für den SMTP-Transport fest.",
+  "This identity appears in outgoing emails sent by the platform.": "Diese Identität erscheint in ausgehenden E-Mails der Plattform.",
+  "These limits define default and maximum lifetimes for newly issued API tokens.": "Diese Grenzwerte definieren Standard- und Maximallaufzeit für neu ausgestellte API-Tokens.",
+  "Define which origins may call your API from browsers. Use one origin per line.": "Definiere, welche Origins deine API aus Browsern aufrufen dürfen. Eine Origin pro Zeile.",
+  "This action revokes all active API tokens immediately across all users.": "Diese Aktion widerruft sofort alle aktiven API-Tokens über alle Benutzer hinweg.",
+  "The authority URL defines the Microsoft identity tenant endpoint used for sign-in.": "Die Authority-URL definiert den Microsoft-Identity-Tenant-Endpunkt für die Anmeldung.",
+  "This will expire all remember-me tokens immediately and force users to sign in again.": "Dadurch werden alle Remember-me-Tokens sofort abgelaufen und Benutzer müssen sich erneut anmelden.",
   "Global settings are stored in the database. config/settings.php is only a runtime cache for selected app settings.": "Globale Einstellungen werden in der Datenbank gespeichert. config/settings.php ist nur ein Laufzeit-Cache für ausgewählte App-Einstellungen.",
   "Too many login attempts. Please wait and try again.": "Zu viele Login-Versuche. Bitte warte kurz und versuche es erneut.",
   "No login method is available for this tenant": "Für diesen Mandanten ist keine Login-Methode verfügbar",
diff --git a/i18n/default_en.json b/i18n/default_en.json
index 1a0a11c..ec30762 100644
--- a/i18n/default_en.json
+++ b/i18n/default_en.json
@@ -63,6 +63,43 @@
   "Too many login attempts. Please wait and try again.": "Too many login attempts. Please wait and try again.",
   "No login method is available for this tenant": "No login method is available for this tenant",
   "Cached": "Cached",
+  "App identity": "App identity",
+  "Configured": "Configured",
+  "Not configured": "Not configured",
+  "Theme policy": "Theme policy",
+  "Brand color": "Brand color",
+  "User override enabled": "User override enabled",
+  "User override disabled": "User override disabled",
+  "Token lifetime policy": "Token lifetime policy",
+  "Token operations": "Token operations",
+  "CORS allowlist": "CORS allowlist",
+  "Shared Microsoft credentials": "Shared Microsoft credentials",
+  "Authority endpoint": "Authority endpoint",
+  "SMTP connection": "SMTP connection",
+  "SMTP credentials": "SMTP credentials",
+  "Sender identity": "Sender identity",
+  "%d defaults configured": "%d defaults configured",
+  "%d events enabled": "%d events enabled",
+  "%d origins configured": "%d origins configured",
+  "days": "days",
+  "Leave empty to use the runtime default title.": "Leave empty to use the runtime default title.",
+  "Leave empty to keep the currently stored password.": "Leave empty to keep the currently stored password.",
+  "Leave empty to keep the currently stored client secret.": "Leave empty to keep the currently stored client secret.",
+  "This setting controls the application name shown across the UI.": "This setting controls the application name shown across the UI.",
+  "This setting controls the default language for users without a personal preference.": "This setting controls the default language for users without a personal preference.",
+  "These defaults prefill tenant, department and role when new users are created.": "These defaults prefill tenant, department and role when new users are created.",
+  "This setting controls the global default theme and whether users may choose their own theme.": "This setting controls the global default theme and whether users may choose their own theme.",
+  "This setting controls the primary UI accent color for the default app theme.": "This setting controls the primary UI accent color for the default app theme.",
+  "Telemetry helps detect recurring UI issues and failed requests in production.": "Telemetry helps detect recurring UI issues and failed requests in production.",
+  "Limit which event types are collected to match your privacy and operations requirements.": "Limit which event types are collected to match your privacy and operations requirements.",
+  "These settings define how the application connects to your SMTP server.": "These settings define how the application connects to your SMTP server.",
+  "Provide authentication data used by the SMTP transport.": "Provide authentication data used by the SMTP transport.",
+  "This identity appears in outgoing emails sent by the platform.": "This identity appears in outgoing emails sent by the platform.",
+  "These limits define default and maximum lifetimes for newly issued API tokens.": "These limits define default and maximum lifetimes for newly issued API tokens.",
+  "Define which origins may call your API from browsers. Use one origin per line.": "Define which origins may call your API from browsers. Use one origin per line.",
+  "This action revokes all active API tokens immediately across all users.": "This action revokes all active API tokens immediately across all users.",
+  "The authority URL defines the Microsoft identity tenant endpoint used for sign-in.": "The authority URL defines the Microsoft identity tenant endpoint used for sign-in.",
+  "This will expire all remember-me tokens immediately and force users to sign in again.": "This will expire all remember-me tokens immediately and force users to sign in again.",
   "Global settings are stored in the database. config/settings.php is only a runtime cache for selected app settings.": "Global settings are stored in the database. config/settings.php is only a runtime cache for selected app settings.",
   "Create your account": "Create your account",
   "First name": "First name",
diff --git a/pages/admin/settings/index(default).phtml b/pages/admin/settings/index(default).phtml
index 1adff84..a05bc9d 100644
--- a/pages/admin/settings/index(default).phtml
+++ b/pages/admin/settings/index(default).phtml
@@ -129,7 +129,6 @@ $disabledAttr = $isReadOnly ? 'disabled' : '';
           <button type="button" data-tab="master-data" data-tab-default><?php e(t('Master data')); ?></button>
           <button type="button" data-tab="appearance"><?php e(t('Appearance')); ?></button>
           <button type="button" data-tab="security"><?php e(t('Security')); ?></button>
-          <button type="button" data-tab="telemetry"><?php e(t('Telemetry')); ?></button>
           <button type="button" data-tab="email"><?php e(t('Email')); ?></button>
           <button type="button" data-tab="api"><?php e(t('API')); ?></button>
           <button type="button" data-tab="integrations"><?php e(t('Microsoft SSO')); ?></button>
@@ -139,153 +138,192 @@ $disabledAttr = $isReadOnly ? 'disabled' : '';
         </div>
 
         <div data-tab-panel="master-data">
-          <label class="app-field">
-            <span><?php e(t('App title')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
-            <input type="text" name="app_title" value="<?php e($appTitle); ?>" placeholder="<?php e(appTitle()); ?>" <?php e($readonlyAttr); ?>>
-            <small><?php e(t($appTitleDesc)); ?></small>
-          </label>
-          <hr>
-          <details name="internationalization" data-details-key="internationalization">
-            <summary><?php e(t('Internationalization')); ?></summary>
-            <hr>
-            <label class="app-field">
-              <span><?php e(t('Default language')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
-              <select name="app_locale" <?php e($disabledAttr); ?>>
-                <option value=""><?php e(t('None')); ?></option>
-                <?php foreach ($locales as $locale): ?>
-                  <?php
-                  $label = strtoupper($locale);
-                  if ($locale === 'de') {
-                    $label = t('German');
-                  } elseif ($locale === 'en') {
-                    $label = t('English');
-                  }
-                  ?>
-                  <option value="<?php e($locale); ?>" <?php e($appLocale === $locale ? 'selected' : ''); ?>>
-                    <?php e($label); ?>
-                  </option>
-                <?php endforeach; ?>
-              </select>
-              <small><?php e(t($appLocaleDesc)); ?></small>
-            </label>
-          </details>
-          <hr>
-          <details name="user-creation" data-details-key="user-creation">
-            <summary><?php e(t('User creation rules')); ?></summary>
-            <hr>
-            <div class="grid">
+          <details class="app-details-card" name="settings-master-app-identity" data-details-key="settings-master-app-identity" open>
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('App identity')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e($appTitle !== '' ? t('Configured') : t('Default')); ?></span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('This setting controls the application name shown across the UI.')); ?></small>
+              </blockquote>
               <label class="app-field">
-                <span>
-                  <?php e(t('Default tenant')); ?>
-                </span>
-                <select name="default_tenant_id" <?php e($disabledAttr); ?>>
-                  <option value="">
-                    <?php e(t('None')); ?>
-                  </option>
-                  <?php foreach ($tenants ?? [] as $tenant): ?>
-                    <?php $tenantId = (int) ($tenant['id'] ?? 0); ?>
-                    <?php if ($tenantId > 0): ?>
-                      <option value="<?php e((string) $tenantId); ?>" <?php e($tenantId === $defaultTenantId ? 'selected' : ''); ?>>
-                        <?php e($tenant['description'] ?? ''); ?>
-                      </option>
-                    <?php endif; ?>
-                  <?php endforeach; ?>
-                </select>
-                <small>
-                  <?php e(t($defaultTenantDesc)); ?>
-                </small>
-              </label>
-              <label class="app-field">
-                <span>
-                  <?php e(t('Default department')); ?>
-                </span>
-                <select name="default_department_id" <?php e($disabledAttr); ?>>
-                  <option value="">
-                    <?php e(t('None')); ?>
-                  </option>
-                  <?php foreach ($departments ?? [] as $department): ?>
-                    <?php $departmentId = (int) ($department['id'] ?? 0); ?>
-                    <?php if ($departmentId > 0): ?>
-                      <option value="<?php e((string) $departmentId); ?>" <?php e($departmentId === $defaultDepartmentId ? 'selected' : ''); ?>>
-                        <?php e($department['description'] ?? ''); ?>
-                      </option>
-                    <?php endif; ?>
-                  <?php endforeach; ?>
-                </select>
-                <small>
-                  <?php e(t($defaultDepartmentDesc)); ?>
-                </small>
+                <span><?php e(t('App title')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
+                <input type="text" name="app_title" value="<?php e($appTitle); ?>" placeholder="<?php e(appTitle()); ?>" <?php e($readonlyAttr); ?>>
+                <small><?php e(t($appTitleDesc)); ?></small>
+                <small class="muted"><?php e(t('Leave empty to use the runtime default title.')); ?></small>
               </label>
             </div>
-            <label class="app-field">
-              <span><?php e(t('Default role')); ?></span>
-              <select name="default_role_id" <?php e($disabledAttr); ?>>
-                <option value=""><?php e(t('None')); ?></option>
-                <?php foreach ($roles ?? [] as $role): ?>
-                  <?php $roleId = (int) ($role['id'] ?? 0); ?>
-                  <?php if ($roleId > 0): ?>
-                    <option value="<?php e((string) $roleId); ?>" <?php e($roleId === $defaultRoleId ? 'selected' : ''); ?>>
-                      <?php e($role['description'] ?? ''); ?>
+          </details>
+
+          <details class="app-details-card" name="internationalization" data-details-key="internationalization">
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('Internationalization')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e($appLocale !== '' ? strtoupper($appLocale) : t('Default')); ?></span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('This setting controls the default language for users without a personal preference.')); ?></small>
+              </blockquote>
+              <label class="app-field">
+                <span><?php e(t('Default language')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
+                <select name="app_locale" <?php e($disabledAttr); ?>>
+                  <option value=""><?php e(t('None')); ?></option>
+                  <?php foreach ($locales as $locale): ?>
+                    <?php
+                    $label = strtoupper($locale);
+                    if ($locale === 'de') {
+                      $label = t('German');
+                    } elseif ($locale === 'en') {
+                      $label = t('English');
+                    }
+                    ?>
+                    <option value="<?php e($locale); ?>" <?php e($appLocale === $locale ? 'selected' : ''); ?>>
+                      <?php e($label); ?>
                     </option>
-                  <?php endif; ?>
-                <?php endforeach; ?>
-              </select>
-              <small><?php e(t($defaultRoleDesc)); ?></small>
-            </label>
+                  <?php endforeach; ?>
+                </select>
+                <small><?php e(t($appLocaleDesc)); ?></small>
+              </label>
+            </div>
+          </details>
+
+          <?php $configuredDefaultsCount = (int) ($defaultTenantId > 0) + (int) ($defaultDepartmentId > 0) + (int) ($defaultRoleId > 0); ?>
+          <details class="app-details-card" name="user-creation" data-details-key="user-creation">
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('User creation rules')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e(sprintf(t('%d defaults configured'), $configuredDefaultsCount)); ?></span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('These defaults prefill tenant, department and role when new users are created.')); ?></small>
+              </blockquote>
+              <div class="grid">
+                <label class="app-field">
+                  <span><?php e(t('Default tenant')); ?></span>
+                  <select name="default_tenant_id" <?php e($disabledAttr); ?>>
+                    <option value=""><?php e(t('None')); ?></option>
+                    <?php foreach ($tenants ?? [] as $tenant): ?>
+                      <?php $tenantId = (int) ($tenant['id'] ?? 0); ?>
+                      <?php if ($tenantId > 0): ?>
+                        <option value="<?php e((string) $tenantId); ?>" <?php e($tenantId === $defaultTenantId ? 'selected' : ''); ?>>
+                          <?php e($tenant['description'] ?? ''); ?>
+                        </option>
+                      <?php endif; ?>
+                    <?php endforeach; ?>
+                  </select>
+                  <small><?php e(t($defaultTenantDesc)); ?></small>
+                </label>
+                <label class="app-field">
+                  <span><?php e(t('Default department')); ?></span>
+                  <select name="default_department_id" <?php e($disabledAttr); ?>>
+                    <option value=""><?php e(t('None')); ?></option>
+                    <?php foreach ($departments ?? [] as $department): ?>
+                      <?php $departmentId = (int) ($department['id'] ?? 0); ?>
+                      <?php if ($departmentId > 0): ?>
+                        <option value="<?php e((string) $departmentId); ?>" <?php e($departmentId === $defaultDepartmentId ? 'selected' : ''); ?>>
+                          <?php e($department['description'] ?? ''); ?>
+                        </option>
+                      <?php endif; ?>
+                    <?php endforeach; ?>
+                  </select>
+                  <small><?php e(t($defaultDepartmentDesc)); ?></small>
+                </label>
+              </div>
+              <label class="app-field">
+                <span><?php e(t('Default role')); ?></span>
+                <select name="default_role_id" <?php e($disabledAttr); ?>>
+                  <option value=""><?php e(t('None')); ?></option>
+                  <?php foreach ($roles ?? [] as $role): ?>
+                    <?php $roleId = (int) ($role['id'] ?? 0); ?>
+                    <?php if ($roleId > 0): ?>
+                      <option value="<?php e((string) $roleId); ?>" <?php e($roleId === $defaultRoleId ? 'selected' : ''); ?>>
+                        <?php e($role['description'] ?? ''); ?>
+                      </option>
+                    <?php endif; ?>
+                  <?php endforeach; ?>
+                </select>
+                <small><?php e(t($defaultRoleDesc)); ?></small>
+              </label>
+            </div>
           </details>
         </div>
 
         <div data-tab-panel="appearance">
-          <blockquote data-variant="info">
-            <?php e(t('Tenants can override color and theme behavior in their appearance settings.')); ?>
-          </blockquote>
-          <hr>
-          <div class="grid">
-            <fieldset>
-              <legend><small><?php e(t('Default theme')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></small></legend>
-              <select name="app_theme" <?php e($disabledAttr); ?>>
-                <option value=""><?php e(t('None')); ?></option>
-                <?php foreach ($themes as $key => $label): ?>
-                  <option value="<?php e($key); ?>" <?php e($appTheme === $key ? 'selected' : ''); ?>>
-                    <?php e(t($label)); ?>
-                  </option>
-                <?php endforeach; ?>
-              </select>
-              <small><?php e(t($appThemeDesc)); ?></small>
-            </fieldset>
-            <fieldset>
-              <legend><small><?php e(t('Primary color')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></small></legend>
+          <details class="app-details-card" name="settings-appearance-theme" data-details-key="settings-appearance-theme" open>
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('Theme policy')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e($appTheme !== '' ? t($themes[$appTheme] ?? $appTheme) : t('Default')); ?></span>
+                <span class="badge" data-variant="neutral"><?php e($appThemeUser ? t('User override enabled') : t('User override disabled')); ?></span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('This setting controls the global default theme and whether users may choose their own theme.')); ?></small>
+              </blockquote>
               <label class="app-field">
-                <input type="color" name="app_primary_color"
-                  value="<?php e($appPrimaryColor !== '' ? $appPrimaryColor : '#2fa4a4'); ?>" <?php e($disabledAttr); ?>>
-                <div>
-                  <div>
-                    <?php e(t('Choose color')); ?>
-                  </div>
-                </div>
+                <span><?php e(t('Default theme')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
+                <select name="app_theme" <?php e($disabledAttr); ?>>
+                  <option value=""><?php e(t('None')); ?></option>
+                  <?php foreach ($themes as $key => $label): ?>
+                    <option value="<?php e($key); ?>" <?php e($appTheme === $key ? 'selected' : ''); ?>>
+                      <?php e(t($label)); ?>
+                    </option>
+                  <?php endforeach; ?>
+                </select>
+                <small><?php e(t($appThemeDesc)); ?></small>
               </label>
-              <small class="muted"><?php e(t($appPrimaryColorDesc)); ?></small>
-            </fieldset>
-          </div>
+              <fieldset>
+                <legend><small><?php e(t($appThemeUserDesc)); ?></small></legend>
+                <label class="app-field">
+                  <input type="checkbox" name="app_theme_user" value="1" <?php e($appThemeUser ? 'checked' : ''); ?> <?php e($disabledAttr); ?>>
+                  <span><?php e(t('Allow user theme')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
+                </label>
+              </fieldset>
+              <small class="muted"><?php e(t('Tenants can override color and theme behavior in their appearance settings.')); ?></small>
+            </div>
+          </details>
 
-          <fieldset>
-            <legend>
-              <small>
-                <?php e(t($appThemeUserDesc)); ?>
-              </small>
-            </legend>
-            <label class="app-field">
-              <input type="checkbox" name="app_theme_user" value="1" <?php e($appThemeUser ? 'checked' : ''); ?> <?php e($disabledAttr); ?>>
-              <span><?php e(t('Allow user theme')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
-            </label>
-          </fieldset>
+          <details class="app-details-card" name="settings-appearance-branding" data-details-key="settings-appearance-branding">
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('Brand color')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e($appPrimaryColor !== '' ? strtoupper($appPrimaryColor) : t('Default')); ?></span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('This setting controls the primary UI accent color for the default app theme.')); ?></small>
+              </blockquote>
+              <fieldset>
+                <legend><small><?php e(t('Primary color')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></small></legend>
+                <label class="app-field">
+                  <input type="color" name="app_primary_color"
+                    value="<?php e($appPrimaryColor !== '' ? $appPrimaryColor : '#2fa4a4'); ?>" <?php e($disabledAttr); ?>>
+                  <div>
+                    <div><?php e(t('Choose color')); ?></div>
+                  </div>
+                </label>
+                <small class="muted"><?php e(t($appPrimaryColorDesc)); ?></small>
+              </fieldset>
+            </div>
+          </details>
         </div>
 
         <div data-tab-panel="security">
           <details class="app-details-card" name="settings-security-registration" data-details-key="settings-security-registration">
             <summary>
-              <?php e(t('Allow registration')); ?>:
-              <?php e($appRegistration ? t('Enabled') : t('Disabled')); ?>
+              <span class="app-details-card-summary-title"><?php e(t('Allow registration')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e($appRegistration ? t('Enabled') : t('Disabled')); ?></span>
+              </span>
             </summary>
             <div class="app-details-card-container">
               <blockquote data-variant="info">
@@ -308,8 +346,11 @@ $disabledAttr = $isReadOnly ? 'disabled' : '';
 
           <details class="app-details-card" name="settings-security-session" data-details-key="settings-security-session" open>
             <summary>
-              <?php e(t('Session policy')); ?>:
-              <?php e((string) $sessionIdleTimeoutMinutes); ?> / <?php e((string) $sessionAbsoluteTimeoutHours); ?>
+              <span class="app-details-card-summary-title"><?php e(t('Session policy')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e((string) $sessionIdleTimeoutMinutes); ?></span>
+                <span class="badge" data-variant="neutral"><?php e((string) $sessionAbsoluteTimeoutHours); ?></span>
+              </span>
             </summary>
             <div class="app-details-card-container">
 
@@ -340,8 +381,11 @@ $disabledAttr = $isReadOnly ? 'disabled' : '';
           </details>
           <details class="app-details-card" name="settings-security-user-lifecycle" data-details-key="settings-security-user-lifecycle">
             <summary>
-              <?php e(t('User lifecycle policy')); ?>:
-              <?php e((string) $userInactivityDeactivateDays); ?> / <?php e((string) $userInactivityDeleteDays); ?>
+              <span class="app-details-card-summary-title"><?php e(t('User lifecycle policy')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e((string) $userInactivityDeactivateDays); ?></span>
+                <span class="badge" data-variant="neutral"><?php e((string) $userInactivityDeleteDays); ?></span>
+              </span>
             </summary>
             <div class="app-details-card-container">
               <blockquote data-variant="info">
@@ -378,8 +422,10 @@ $disabledAttr = $isReadOnly ? 'disabled' : '';
           </details>
           <details class="app-details-card" name="settings-security-system-audit" data-details-key="settings-security-system-audit">
             <summary>
-              <?php e(t('System audit')); ?>:
-              <?php e($systemAuditEnabled ? t('Enabled') : t('Disabled')); ?>
+              <span class="app-details-card-summary-title"><?php e(t('System audit')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e($systemAuditEnabled ? t('Enabled') : t('Disabled')); ?></span>
+              </span>
             </summary>
             <div class="app-details-card-container">
               <blockquote data-variant="info">
@@ -404,61 +450,70 @@ $disabledAttr = $isReadOnly ? 'disabled' : '';
               </label>
             </div>
           </details>
-        </div>
 
-        <div data-tab-panel="telemetry">
-          <blockquote data-variant="info">
-            <?php e(t('Telemetry helps us find UI problems faster.')); ?>
-          </blockquote>
-          <fieldset>
-            <legend>
-              <small>
-                <?php e(t('Frontend telemetry')); ?>
-              </small>
-            </legend>
-            <label class="app-field">
-              <input
-                type="checkbox"
-                name="frontend_telemetry_enabled"
-                value="1"
-                data-telemetry-enabled-toggle
-                <?php e($frontendTelemetryEnabled ? 'checked' : ''); ?>
-                <?php e($disabledAttr); ?>>
-              <span><?php e(t('Enable frontend telemetry')); ?></span>
-            </label>
-          </fieldset>
-          <fieldset data-telemetry-sampling-fieldset <?php e($frontendTelemetryEnabled ? '' : 'hidden'); ?>>
-            <legend>
-              <small>
-                <?php e(t('Sampling rate')); ?>
-              </small>
-            </legend>
-            <label class="app-field" data-telemetry-sampling-row>
-              <span><?php e(t('Sampling rate')); ?></span>
-              <select name="frontend_telemetry_sample_rate" data-telemetry-sampling-select <?php e($disabledAttr); ?>>
-                <option value="0.1" <?php e($frontendTelemetrySampleRate === '0.1' ? 'selected' : ''); ?>>10%</option>
-                <option value="0.2" <?php e($frontendTelemetrySampleRate === '0.2' ? 'selected' : ''); ?>>20%</option>
-                <option value="0.5" <?php e($frontendTelemetrySampleRate === '0.5' ? 'selected' : ''); ?>>50%</option>
-                <option value="1" <?php e($frontendTelemetrySampleRate === '1' ? 'selected' : ''); ?>>100%</option>
-              </select>
-              <small><?php e(t('The percentage of users who will have telemetry enabled.')); ?></small>
-            </label>
-          </fieldset>
-          <hr>
-          <details name="telemetry-advanced" data-details-key="telemetry-advanced">
-            <summary><?php e(t('Advanced telemetry options')); ?></summary>
-            <hr>
-            <fieldset>
-              <legend><small><?php e(t('Allowed telemetry events')); ?></small></legend>
-              <label class="app-field">
-                <input type="checkbox" name="frontend_telemetry_allowed_events[]" value="warn_once" <?php e(in_array('warn_once', $frontendTelemetryAllowedEvents, true) ? 'checked' : ''); ?> <?php e($disabledAttr); ?>>
-                <span><?php e(t('warnOnce warnings')); ?></span>
-              </label>
-              <label class="app-field">
-                <input type="checkbox" name="frontend_telemetry_allowed_events[]" value="ajax_error" <?php e(in_array('ajax_error', $frontendTelemetryAllowedEvents, true) ? 'checked' : ''); ?> <?php e($disabledAttr); ?>>
-                <span><?php e(t('AJAX errors')); ?></span>
-              </label>
-            </fieldset>
+          <details class="app-details-card" name="settings-telemetry-core" data-details-key="settings-telemetry-core" open>
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('Frontend telemetry')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e($frontendTelemetryEnabled ? t('Enabled') : t('Disabled')); ?></span>
+                <span class="badge" data-variant="neutral"><?php e($frontendTelemetrySampleRate); ?></span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('Telemetry helps detect recurring UI issues and failed requests in production.')); ?></small>
+              </blockquote>
+              <fieldset>
+                <legend><small><?php e(t('Frontend telemetry')); ?></small></legend>
+                <label class="app-field">
+                  <input
+                    type="checkbox"
+                    name="frontend_telemetry_enabled"
+                    value="1"
+                    data-telemetry-enabled-toggle
+                    <?php e($frontendTelemetryEnabled ? 'checked' : ''); ?>
+                    <?php e($disabledAttr); ?>>
+                  <span><?php e(t('Enable frontend telemetry')); ?></span>
+                </label>
+              </fieldset>
+              <fieldset data-telemetry-sampling-fieldset <?php e($frontendTelemetryEnabled ? '' : 'hidden'); ?>>
+                <legend><small><?php e(t('Sampling rate')); ?></small></legend>
+                <label class="app-field" data-telemetry-sampling-row>
+                  <span><?php e(t('Sampling rate')); ?></span>
+                  <select name="frontend_telemetry_sample_rate" data-telemetry-sampling-select <?php e($disabledAttr); ?>>
+                    <option value="0.1" <?php e($frontendTelemetrySampleRate === '0.1' ? 'selected' : ''); ?>>10%</option>
+                    <option value="0.2" <?php e($frontendTelemetrySampleRate === '0.2' ? 'selected' : ''); ?>>20%</option>
+                    <option value="0.5" <?php e($frontendTelemetrySampleRate === '0.5' ? 'selected' : ''); ?>>50%</option>
+                    <option value="1" <?php e($frontendTelemetrySampleRate === '1' ? 'selected' : ''); ?>>100%</option>
+                  </select>
+                  <small><?php e(t('The percentage of users who will have telemetry enabled.')); ?></small>
+                </label>
+              </fieldset>
+            </div>
+          </details>
+          <details class="app-details-card" name="telemetry-advanced" data-details-key="telemetry-advanced">
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('Advanced telemetry options')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e(sprintf(t('%d events enabled'), count($frontendTelemetryAllowedEvents))); ?></span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('Limit which event types are collected to match your privacy and operations requirements.')); ?></small>
+              </blockquote>
+              <fieldset>
+                <legend><small><?php e(t('Allowed telemetry events')); ?></small></legend>
+                <label class="app-field">
+                  <input type="checkbox" name="frontend_telemetry_allowed_events[]" value="warn_once" <?php e(in_array('warn_once', $frontendTelemetryAllowedEvents, true) ? 'checked' : ''); ?> <?php e($disabledAttr); ?>>
+                  <span><?php e(t('warnOnce warnings')); ?></span>
+                </label>
+                <label class="app-field">
+                  <input type="checkbox" name="frontend_telemetry_allowed_events[]" value="ajax_error" <?php e(in_array('ajax_error', $frontendTelemetryAllowedEvents, true) ? 'checked' : ''); ?> <?php e($disabledAttr); ?>>
+                  <span><?php e(t('AJAX errors')); ?></span>
+                </label>
+              </fieldset>
+            </div>
           </details>
         </div>
 
@@ -511,83 +566,149 @@ $disabledAttr = $isReadOnly ? 'disabled' : '';
         </div>
 
         <div data-tab-panel="api">
-          <p class="muted"><?php e(t('API tokens and default lifetimes are managed here.')); ?></p>
-          <div class="grid">
-            <label class="app-field">
-              <span><?php e(t('API token default lifetime (days)')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
-              <input type="number" name="api_token_default_ttl_days" value="<?php e((string) $apiTokenDefaultTtlDays); ?>"
-                min="1" max="3650" step="1" <?php e($readonlyAttr); ?>>
-              <small><?php e(t($apiTokenDefaultTtlDaysDesc)); ?></small>
-            </label>
-            <label class="app-field">
-              <span><?php e(t('API token maximum lifetime (days)')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
-              <input type="number" name="api_token_max_ttl_days" value="<?php e((string) $apiTokenMaxTtlDays); ?>"
-                min="1" max="3650" step="1" <?php e($readonlyAttr); ?>>
-              <small><?php e(t($apiTokenMaxTtlDaysDesc)); ?></small>
-            </label>
-          </div>
-          <label class="app-field">
-            <span><?php e(t('Allowed CORS origins')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
-            <textarea name="api_cors_allowed_origins" rows="4" placeholder="https://app.example.com&#10;https://admin.example.com" <?php e($readonlyAttr); ?>><?php e($apiCorsAllowedOrigins); ?></textarea>
-            <small><?php e(t($apiCorsAllowedOriginsDesc)); ?></small>
-          </label>
-          <small class="muted"><?php e(t('One origin per line, e.g. https://app.example.com')); ?></small>
+          <details class="app-details-card" name="settings-api-token-policy" data-details-key="settings-api-token-policy" open>
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('Token lifetime policy')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral">
+                  <?php e((string) $apiTokenDefaultTtlDays); ?> / <?php e((string) $apiTokenMaxTtlDays); ?> <?php e(t('days')); ?>
+                </span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('These limits define default and maximum lifetimes for newly issued API tokens.')); ?></small>
+              </blockquote>
+              <div class="grid">
+                <label class="app-field">
+                  <span><?php e(t('API token default lifetime (days)')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
+                  <input type="number" name="api_token_default_ttl_days" value="<?php e((string) $apiTokenDefaultTtlDays); ?>"
+                    min="1" max="3650" step="1" <?php e($readonlyAttr); ?>>
+                  <small><?php e(t($apiTokenDefaultTtlDaysDesc)); ?></small>
+                </label>
+                <label class="app-field">
+                  <span><?php e(t('API token maximum lifetime (days)')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
+                  <input type="number" name="api_token_max_ttl_days" value="<?php e((string) $apiTokenMaxTtlDays); ?>"
+                    min="1" max="3650" step="1" <?php e($readonlyAttr); ?>>
+                  <small><?php e(t($apiTokenMaxTtlDaysDesc)); ?></small>
+                </label>
+              </div>
+            </div>
+          </details>
+
+          <?php $apiCorsOriginsCount = count(array_values(array_filter(array_map('trim', preg_split('/\R+/', $apiCorsAllowedOrigins) ?: [])))); ?>
+          <details class="app-details-card" name="settings-api-cors" data-details-key="settings-api-cors">
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('CORS allowlist')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e(sprintf(t('%d origins configured'), $apiCorsOriginsCount)); ?></span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('Define which origins may call your API from browsers. Use one origin per line.')); ?></small>
+              </blockquote>
+              <label class="app-field">
+                <span><?php e(t('Allowed CORS origins')); ?> <span class="badge" data-variant="info"><?php e(t('Cached')); ?></span></span>
+                <textarea name="api_cors_allowed_origins" rows="4" placeholder="https://app.example.com&#10;https://admin.example.com" <?php e($readonlyAttr); ?>><?php e($apiCorsAllowedOrigins); ?></textarea>
+                <small><?php e(t($apiCorsAllowedOriginsDesc)); ?></small>
+              </label>
+              <small class="muted"><?php e(t('One origin per line, e.g. https://app.example.com')); ?></small>
+            </div>
+          </details>
+
           <?php if ($canUpdateSettings): ?>
-            <fieldset>
-              <legend><small><?php e(t('API tokens')); ?></small></legend>
-              <p class="muted"><?php e(t('All API tokens will be revoked immediately.')); ?></p>
-              <p class="muted"><?php e(sprintf(t('%d active API tokens'), $activeApiTokens)); ?></p>
-              <button type="submit" class="danger" formnovalidate
-                formaction="admin/settings/revoke-api-tokens"
-                formmethod="post"
-                data-detail-confirm-message="<?php e(t('Revoke all API tokens?')); ?>"
-                data-detail-action-kind="danger">
-                <?php e(t('Revoke all API tokens')); ?>
-              </button>
-            </fieldset>
+            <details class="app-details-card" name="settings-api-tokens" data-details-key="settings-api-tokens">
+              <summary>
+                <span class="app-details-card-summary-title"><?php e(t('Token operations')); ?></span>
+                <span class="app-details-card-summary-meta">
+                  <span class="badge" data-variant="neutral"><?php e(sprintf(t('%d active API tokens'), $activeApiTokens)); ?></span>
+                </span>
+              </summary>
+              <div class="app-details-card-container">
+                <blockquote data-variant="warning">
+                  <small><?php e(t('This action revokes all active API tokens immediately across all users.')); ?></small>
+                </blockquote>
+                <button type="submit" class="danger" formnovalidate
+                  formaction="admin/settings/revoke-api-tokens"
+                  formmethod="post"
+                  data-detail-confirm-message="<?php e(t('Revoke all API tokens?')); ?>"
+                  data-detail-action-kind="danger">
+                  <?php e(t('Revoke all API tokens')); ?>
+                </button>
+              </div>
+            </details>
           <?php endif; ?>
         </div>
 
         <div data-tab-panel="integrations">
-          <blockquote data-variant="info">
-            <?php e(t('Shared Microsoft app credentials are used by tenants that enable "Use shared app credentials".')); ?>
-          </blockquote>
-          <label class="app-field">
-            <span><?php e(t('Shared client ID')); ?></span>
-            <input type="text" name="microsoft_shared_client_id" value="<?php e($microsoftSharedClientId); ?>" <?php e($readonlyAttr); ?>>
-            <small><?php e(t($microsoftSharedClientIdDesc)); ?></small>
-          </label>
-          <label class="app-field">
-            <span><?php e(t('Shared client secret')); ?></span>
-            <input type="password" name="microsoft_shared_client_secret" value="" autocomplete="new-password" <?php e($readonlyAttr); ?>>
-            <small><?php e(t($microsoftSharedClientSecretDesc)); ?></small>
-          </label>
-          <label class="app-field">
-            <span><?php e(t('Authority URL')); ?></span>
-            <input type="url" name="microsoft_authority" value="<?php e($microsoftAuthority); ?>" placeholder="https://login.microsoftonline.com/common/v2.0" <?php e($readonlyAttr); ?>>
-            <small><?php e(t($microsoftAuthorityDesc)); ?></small>
-          </label>
+          <details class="app-details-card" name="settings-integrations-microsoft-auth" data-details-key="settings-integrations-microsoft-auth" open>
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('Shared Microsoft credentials')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e($microsoftSharedClientId !== '' ? t('Configured') : t('Not configured')); ?></span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('Shared Microsoft app credentials are used by tenants that enable "Use shared app credentials".')); ?></small>
+              </blockquote>
+              <label class="app-field">
+                <span><?php e(t('Shared client ID')); ?></span>
+                <input type="text" name="microsoft_shared_client_id" value="<?php e($microsoftSharedClientId); ?>" <?php e($readonlyAttr); ?>>
+                <small><?php e(t($microsoftSharedClientIdDesc)); ?></small>
+              </label>
+              <label class="app-field">
+                <span><?php e(t('Shared client secret')); ?></span>
+                <input type="password" name="microsoft_shared_client_secret" value="" autocomplete="new-password" <?php e($readonlyAttr); ?>>
+                <small><?php e(t($microsoftSharedClientSecretDesc)); ?></small>
+                <small class="muted"><?php e(t('Leave empty to keep the currently stored client secret.')); ?></small>
+              </label>
+            </div>
+          </details>
+
+          <details class="app-details-card" name="settings-integrations-microsoft-authority" data-details-key="settings-integrations-microsoft-authority">
+            <summary>
+              <span class="app-details-card-summary-title"><?php e(t('Authority endpoint')); ?></span>
+              <span class="app-details-card-summary-meta">
+                <span class="badge" data-variant="neutral"><?php e($microsoftAuthority !== '' ? t('Configured') : t('Not configured')); ?></span>
+              </span>
+            </summary>
+            <div class="app-details-card-container">
+              <blockquote data-variant="info">
+                <small><?php e(t('The authority URL defines the Microsoft identity tenant endpoint used for sign-in.')); ?></small>
+              </blockquote>
+              <label class="app-field">
+                <span><?php e(t('Authority URL')); ?></span>
+                <input type="url" name="microsoft_authority" value="<?php e($microsoftAuthority); ?>" placeholder="https://login.microsoftonline.com/common/v2.0" <?php e($readonlyAttr); ?>>
+                <small><?php e(t($microsoftAuthorityDesc)); ?></small>
+              </label>
+            </div>
+          </details>
         </div>
 
         <?php if ($canUpdateSettings): ?>
           <div data-tab-panel="danger">
-            <fieldset>
-              <legend><small><?php e(t('Login tokens')); ?></small></legend>
-              <p class="muted">
-                <?php e(t('This will mark all remember-me tokens as expired. Users will need to sign in again.')); ?>
-              </p>
-              <p class="muted">
-                <?php e(sprintf(t('%d active login tokens'), $activeLoginTokens)); ?>
-              </p>
-              <form method="post" action="admin/settings/expire-remember-tokens"
-                data-detail-confirm-message="<?php e(t('Expire all login tokens?')); ?>"
-                data-detail-action-kind="danger">
-                <button type="submit" class="danger">
+            <details class="app-details-card" name="settings-danger-login-tokens" data-details-key="settings-danger-login-tokens" open>
+              <summary>
+                <span class="app-details-card-summary-title"><?php e(t('Login tokens')); ?></span>
+                <span class="app-details-card-summary-meta">
+                  <span class="badge" data-variant="neutral"><?php e(sprintf(t('%d active login tokens'), $activeLoginTokens)); ?></span>
+                </span>
+              </summary>
+              <div class="app-details-card-container">
+                <blockquote data-variant="warning">
+                  <small><?php e(t('This will expire all remember-me tokens immediately and force users to sign in again.')); ?></small>
+                </blockquote>
+                <button type="submit" class="danger" formnovalidate
+                  formaction="admin/settings/expire-remember-tokens"
+                  formmethod="post"
+                  data-detail-confirm-message="<?php e(t('Expire all login tokens?')); ?>"
+                  data-detail-action-kind="danger">
                   <?php e(t('Expire all login tokens')); ?>
                 </button>
-                <?php Session::getCsrfInput(); ?>
-              </form>
-            </fieldset>
+              </div>
+            </details>
           </div>
         <?php endif; ?>
       </div>
diff --git a/web/css/components/app-details-card.css b/web/css/components/app-details-card.css
index 46b8cc2..75c7b5f 100644
--- a/web/css/components/app-details-card.css
+++ b/web/css/components/app-details-card.css
@@ -15,12 +15,32 @@
     line-height: 1.25;
     text-transform: none;
     background: var(--app-card-sectioning-background-color);
+    display: flex;
+    align-items: center;
+    gap: calc(var(--app-spacing) * 0.5);
   }
 
   details.app-details-card > summary::after {
     margin-inline-start: calc(var(--app-spacing) * 0.5);
   }
 
+  details.app-details-card > summary .app-details-card-summary-title {
+    min-width: 0;
+    overflow-wrap: anywhere;
+  }
+
+  details.app-details-card > summary .app-details-card-summary-meta {
+    margin-inline-start: auto;
+    display: inline-flex;
+    align-items: center;
+    flex-wrap: wrap;
+    gap: calc(var(--app-spacing) * 0.35);
+  }
+
+  details.app-details-card > summary .app-details-card-summary-meta .badge {
+    white-space: nowrap;
+  }
+
   details.app-details-card[open] > summary {
     margin-bottom: var(--app-spacing);
     border-bottom: 1px solid
diff --git a/web/js/components/app-settings-telemetry.js b/web/js/components/app-settings-telemetry.js
index 839a389..1bc1ba5 100644
--- a/web/js/components/app-settings-telemetry.js
+++ b/web/js/components/app-settings-telemetry.js
@@ -1,13 +1,8 @@
 const initTelemetrySettings = () => {
-  const panel = document.querySelector('[data-tab-panel="telemetry"]');
-  if (!panel) {
-    return;
-  }
-
-  const toggle = panel.querySelector('[data-telemetry-enabled-toggle]');
-  const samplingFieldset = panel.querySelector('[data-telemetry-sampling-fieldset]');
-  const samplingRow = panel.querySelector('[data-telemetry-sampling-row]');
-  const samplingSelect = panel.querySelector('[data-telemetry-sampling-select]');
+  const toggle = document.querySelector('[data-telemetry-enabled-toggle]');
+  const samplingFieldset = document.querySelector('[data-telemetry-sampling-fieldset]');
+  const samplingRow = document.querySelector('[data-telemetry-sampling-row]');
+  const samplingSelect = document.querySelector('[data-telemetry-sampling-select]');
 
   if (!toggle || !samplingFieldset) {
     return;