> ## Documentation Index
> Fetch the complete documentation index at: https://docs.encoreos.io/llms.txt
> Use this file to discover all available pages before exploring further.

# May 30, 2026: dual-pane sidebar, guided Entra setup, role-based licensing

> A dual-pane sidebar with a persistent core rail and collapsible contextual panel, plus a four-step guided Entra ID provisioning wizard, role-to-license SKU mapping, and a programmatic admin consent status check.

## New features

**Dual-pane sidebar: core rail and contextual panel (PF)**
Encore OS replaces the single four-mode sidebar with a persistent **core rail** plus a **contextual panel**. The 56px rail is always visible on the left and lists the cores you have access to, plus Dashboard, Inbox, Settings, theme toggle, and your avatar. The 256px panel to its right shows the active core's nav (sub-modules render as inline accordions) or a Platform Home panel when no core is active. Toggle the panel open and closed with **⌘B** (Ctrl+B on Windows); the rail stays put. Hovering a rail icon shows a flyout peek of that core's nav without leaving your current page.

* **Per-module color.** The active core's icon, ring, and panel header pick up that module's color token, so it's clear at a glance which core you're in.
* **Workspaces moved to the panel header.** The workspace switcher is now the panel-header dropdown — the old `in-workspace` full-sidebar swap is retired. Pick a workspace and the panel re-composes; the rail stays put. See [Workspaces](/pf/workspaces).
* **Slimmer top bar.** The desktop header drops the module switcher and user menu (both now live on the rail) and keeps breadcrumbs, global search, and notifications.
* **Deep-link parity.** Routing to `/workspace/:id` opens directly into the right workspace on first paint — no more brief flash of the global sidebar.

No action is required. Your existing routes, permissions, and workspaces work unchanged; only the chrome around them has moved.

**Guided Entra ID provisioning wizard (PF)**
A new **Guided setup** action in the header of **Settings → Integrations → Entra ID** opens a four-step wizard for connecting Microsoft Entra to Office 365 provisioning. The wizard captures your tenant ID and primary domain, opens a tenant-wide admin consent URL and polls until consent is recorded, runs a Microsoft Graph reachability test, then activates provisioning. Because Encore uses a single shared Azure application that each tenant consents to, there is no client secret to paste or rotate. The flat settings card remains available for reconfiguration. See [Entra ID](/pf/entra-id).

**Role-based license assignment (PF)**
Org admins can now map PF-30 system roles to Microsoft 365 license SKU IDs from a new **Role license mappings** card on the Entra **General** tab. When `entra-provision-user` creates a new mailbox, it resolves the employee's highest-priority active role and assigns the mapped SKU; unmapped roles fall back to the org default. Lookup failures degrade to the default so provisioning is never blocked. Use this to give clinicians, administrators, and house staff different Microsoft 365 plans. See [Entra ID](/pf/entra-id#map-roles-to-license-skus).

**Admin consent status check (PF)**
A new **Admin Consent Status** card on the Entra **General** tab shows a deterministic diff of granted versus required Microsoft Graph permissions. Select **Check permissions** to inspect every scope with a required or optional badge, and **Grant consent** to open a fresh tenant-wide consent URL when something is missing. Use it to debug provisioning failures or to confirm consent after a Graph permission catalog change. See [Entra ID](/pf/entra-id#verify-admin-consent).