diff --git a/docs/embedded/build/sharepoint-embedded-mcp-server.md b/docs/embedded/build/sharepoint-embedded-mcp-server.md
index 0924bfdbd..25c91ac85 100644
--- a/docs/embedded/build/sharepoint-embedded-mcp-server.md
+++ b/docs/embedded/build/sharepoint-embedded-mcp-server.md
@@ -31,15 +31,18 @@ Instead of clicking through portals and stitching together Microsoft Graph and A
 >
 > If you don't already have a tenant, you can get your own with the [Microsoft 365 Developer Program](https://developer.microsoft.com/microsoft-365/dev-program), [Microsoft Customer Digital Experience](https://cdx.transform.microsoft.com/), or a free trial of a [Microsoft 365 E3 license](https://www.microsoft.com/microsoft-365/enterprise/microsoft365-plans-and-pricing).
 
-## What you can do with it
+## Available tools
 
-The server exposes tools that an AI client can call on your behalf, grouped by task:
+The server exposes tools that an AI client can call on your behalf.
 
-- **Provisioning and status**: Check your signed-in identity and provisioning readiness, create the owning Microsoft Entra ID application, and create, register, list, update, or delete [container types](../plan/container-types-containers.md) and containers. A single `project_provision` tool can run the whole sequence—app → container type → billing → registration → container—in one call.
-- **Billing**: Pick an Azure subscription and resource group, register the `Microsoft.Syntex` resource provider, link a container type to [standard billing](../administration/billing/billing.md), and inspect billing classification or trial expiry.
-- **Scaffold, run, and deploy**: Generate a runnable reference application (a React single-page app with Azure Functions, or a C# web app), write its runtime configuration from your provisioning state, seed sample content, run it locally, and deploy it to Azure.
-- **Content operations (opt-in)**: After a separate, explicit consent, upload files, create folders, search, preview, manage sharing and permissions, and archive or restore containers.
-- **Documentation**: Search and fetch official SharePoint Embedded and Microsoft Graph documentation, grounded through the [Microsoft Learn MCP server](/training/support/mcp).
+| Category | What the tools do | Representative tools |
+|---|---|---|
+| Provisioning and status | Check your signed-in identity and provisioning readiness. Create and manage owning applications, [container types](../plan/container-types-containers.md), container type registrations, and containers. | `status_get`, `project_app_create`, `project_provision`, `container_type_create`, `container_type_register`, `container_create` |
+| Billing | Select an Azure subscription and resource group, connect a container type to [standard billing](../plan/choose-billing-model.md), and inspect billing classification or trial expiry. | `azure_subscriptions_list`, `azure_resource_groups_list`, `billing_setup`, `billing_check` |
+| Scaffold, run, and deploy | Generate a reference application, write its configuration, seed sample content, run it locally, and deploy it to Azure. | `project_scaffold`, `project_hydrate_config`, `project_seed_sample_data`, `project_run_local`, `project_deploy` |
+| Content operations (opt-in) | After explicit consent, seed sample content, upload files, create folders, search, preview, and manage sharing. | `content_access_grant`, `project_seed_sample_data`, `content_file_upload`, `content_search`, `content_sharing_manage` |
+| Container permissions and lifecycle | Manage container permissions and archive, restore, or delete containers. | `container_permissions_manage`, `container_archive_restore`, `container_delete` |
+| Documentation | Search and fetch official SharePoint Embedded and Microsoft Graph documentation through the [Microsoft Learn MCP server](/training/support/mcp). | `docs_search`, `docs_fetch` |
 
 For the complete, versioned list of tools, CLI flags, and environment variables, see the [server README](https://github.com/microsoft/SharePoint-Embedded-MCP-Server#available-tools).
 
@@ -91,6 +94,20 @@ Add the server to `%APPDATA%\Claude\claude_desktop_config.json` (Windows) or `~/
 
 Any client that supports MCP servers over the stdio transport can run the server with the same `npx -y @microsoft/spe-mcp start` command. See your client's documentation for where to register MCP servers.
 
+## Configuration
+
+The server accepts operational configuration through CLI flags or equivalent environment variables. When you set both for the same option, the CLI flag wins.
+
+| CLI flag | Environment variable | Description |
+|---|---|---|
+| `--client-id` | `SPE_CLIENT_ID` | Microsoft Entra ID application (client) ID of the owning application. Omit it to use bootstrap mode. |
+| `--tenant-id` | `SPE_TENANT_ID` | Microsoft Entra ID tenant ID. The server discovers it from the Azure CLI when you omit it. |
+| `--read-only` | `SPE_READ_ONLY` | Advertise and allow only read, list, get, and search tools. Reject mutating calls. |
+| `--tools` | `SPE_TOOLS` | Restrict tools to a profile (`readOnly`, `docsOnly`, `provisioning`, `content`, or `admin`) or a comma-separated list of tool names. |
+| `--data-dir` | `SPE_DATA_DIR` | Path for the token cache and provisioning state. Use a unique absolute path or `~/` path for each server instance. Sharing this directory can overwrite cached authentication and provisioning state. Don't use a path relative to the current directory. The default is `~/.spe-mcp`. |
+
+Set flags in the `args` array or variables in the `env` object of your client's MCP configuration. Run `npx -y @microsoft/spe-mcp start --help` or see the [server configuration reference](https://github.com/microsoft/SharePoint-Embedded-MCP-Server#configuration) for the complete, versioned option list.
+
 ## Choose how the server authenticates
 
 The server supports two running modes.
@@ -119,6 +136,15 @@ The server supports two running modes.
     }
     ```
 
+> [!IMPORTANT]
+> Configure redirect URIs on the applicable app registration:
+>
+> - **Owning app registration for the MCP server**: Under **Mobile and desktop applications**, add `http://localhost` for interactive sign-in.
+> - **Owning app registration for the React single-page application (SPA)**: Under **Single-page application**, add the local app URL shown by `project_run_local` and the deployed URL returned by `project_deploy`. In pre-provisioned-app mode, add these redirect URIs manually if the server can't update the app registration.
+> - **Separate C# web app registration**: The C# scaffold provisions this registration with a web redirect URI. Don't add the C# app's redirect URI to the owning app registration.
+>
+> Manage redirect URIs under **App registrations** > **Authentication** in the [Microsoft Entra admin center](https://entra.microsoft.com/).
+
 In bootstrap mode, the first SharePoint Embedded call opens a browser for a one-time consent and caches the token, so no separate terminal step is needed. For the full authentication waterfall, token storage details, and headless/automation guidance, see the [server README](https://github.com/microsoft/SharePoint-Embedded-MCP-Server#authentication).
 
 ## Try it
@@ -138,6 +164,8 @@ The server includes controls to limit which tools are exposed and callable—use
 - **Read-only mode**: Advertise and allow only read, list, get, and search tools, and reject any mutating call. Set the `--read-only` flag or the `SPE_READ_ONLY` environment variable.
 - **Tool profiles**: Restrict the exposed tools to a profile (`readOnly`, `docsOnly`, `provisioning`, `content`, or `admin`) or a comma-separated list of tool names, using the `--tools` flag or the `SPE_TOOLS` environment variable.
 
+See [Configuration](#configuration) for the other operational options.
+
 The **content operations** tools are also gated behind a separate, explicit consent, so an AI client can't read or change files in your containers until you opt in. For the full security model, see [security controls](https://github.com/microsoft/SharePoint-Embedded-MCP-Server/blob/main/docs/SECURITY-CONTROLS.md) in the server repository.
 
 ## Related content