update docs

Author: Philipinho

docs/introduction.md

@@ -36,7 +36,7 @@ Docmost has support for Spaces. You can create Spaces for different teams, proje
   - ZIP archive import
   - Notion import
   - Confluence import (Enterprise)
-  - DOCX import (Enterprise)
+  - PDF & DOCX import (Enterprise)
 - **Print to PDF**: Generate PDF versions of pages using the browser print dialog.
 - **@ Mentions**: Mention team members and link to pages directly in the editor.
 - **Markdown Shortcuts**: Type Markdown syntax directly in the editor and it converts to rich text automatically.
@@ -54,8 +54,9 @@ Docmost has support for Spaces. You can create Spaces for different teams, proje
 ## Enterprise Edition Features
 - **SSO** (SAML 2.0 / OIDC) — Integrate Microsoft Entra ID, Okta, OneLogin, and more.
 - **LDAP** — Authenticate users against your LDAP directory.
+- **SCIM provisioning** — Automate user and group provisioning, updates, and deactivation through your identity provider.
 - **MFA** (TOTP) — Multi-factor authentication with authenticator apps.
-- **AI** — AI-powered writing assistance (Ask AI) and AI-powered search (AI Answers). Use cloud models or local LLMs.
+- **AI** — AI Chat, AI-powered writing assistance (Ask AI), AI-powered search (AI Answers), and MCP. Use cloud models or local LLMs.
 - **API** — REST API with personal API keys and admin key management.
 - **Full-text search in attachments** — Search content inside PDF and DOCX file attachments.
 - **Resolve comments** — Mark comment threads as resolved.
@@ -64,6 +65,8 @@ Docmost has support for Spaces. You can create Spaces for different teams, proje
 - **DOCX importer** — Import Microsoft Word documents.
 - **PDF importer** — Import PDF files into pages.
 - **Templates** — Create and reuse page templates across your workspace.
+- **Page-level Permissions** — Control access with granular view and edit permissions on individual pages and spaces.
+- **Page Verification & Approval Workflow** — Review, verify, and approve content to ensure documentation stays accurate and up to date.
 - **Priority support** — Direct email support.
 - You can generate a free trial license key at [https://customers.docmost.com](https://customers.docmost.com).
 - [<a href="mailto:sales@docmost.com?subject=Docmost Enterprise Edition.">Purchase enterprise edition</a>].

docs/self-hosting/configuration/index.md

@@ -29,7 +29,7 @@ MAIL_FROM_NAME=Docmost
 ```
 
 ## File Storage
-Docmost supports both local storage and S3-compatible storage drivers. The default driver is `local storage`.
+Docmost supports local storage, S3-compatible storage, and Azure Blob Storage drivers. The default driver is `local storage`.
 ```shell
 STORAGE_DRIVER=local
 ```
@@ -49,6 +49,16 @@ AWS_S3_FORCE_PATH_STYLE=
 
 Being S3-compatible means Docmost can work with AWS S3, Backblaze, Wasabi, DigitalOcean Spaces, Minio, and other S3-compatible providers.
 
+### Using Azure Blob Storage
+If you wish to use Azure Blob Storage, you have to add the below environment variables:
+
+```shell
+STORAGE_DRIVER=azure
+AZURE_STORAGE_ACCOUNT_NAME=
+AZURE_STORAGE_ACCOUNT_KEY=
+AZURE_STORAGE_CONTAINER=
+```
+
 
 ### File upload size limit
 The maximum file size that can be uploaded on the editor.
@@ -129,6 +139,26 @@ TYPESENSE_URL=http://localhost:8108
 TYPESENSE_LOCALE=en
 ```
 
+## Iframe embedding
+Docmost blocks other origins from embedding your instance in an `<iframe>` by default.
+
+**Public shared pages (`/share/...`) are exempt and can always be embedded from any origin**, regardless of the settings below.
+
+### Allow embedding from any origin
+
+```shell
+IFRAME_EMBED_ALLOWED=true
+```
+
+When `IFRAME_EMBED_ALLOWED=true` and no allowlist is provided, Docmost emits no framing header, so any origin can embed it.
+
+### Allow embedding from specific origins
+
+```shell
+IFRAME_EMBED_ALLOWED=true
+IFRAME_ALLOWED_ORIGINS=https://intranet.example.com,https://portal.example.com
+```
+
 ## Telemetry
 We anonymously collect the active version, user count, page count, space and workspace count.
 To disable telemetry:

docs/self-hosting/environment-variables.md

@@ -47,6 +47,15 @@ To configure your application, set the following environment variables. These va
 | `AWS_S3_ENDPOINT`          |         | The endpoint URL for your S3 service (optional). |
 | `AWS_S3_FORCE_PATH_STYLE`  | `true`  | Force the request to use path-style addressing (optional). |
 
+### Using Azure Blob Storage
+
+| Variable                       | Example | Description                                                |
+| ------------------------------ | ------- | ---------------------------------------------------------- |
+| `STORAGE_DRIVER`               | `azure` | The storage driver to use for file storage.                |
+| `AZURE_STORAGE_ACCOUNT_NAME`   |         | Your Azure Storage account name.                           |
+| `AZURE_STORAGE_ACCOUNT_KEY`    |         | Your Azure Storage account key.                            |
+| `AZURE_STORAGE_CONTAINER`      |         | The name of your blob container.                           |
+
 
 ### Storage file upload limits
 
@@ -109,6 +118,21 @@ The default Draw.io embed url is `https://embed.diagrams.net`.
 | `TYPESENSE_API_KEY` | `your_api_key_here`       | Your Typesense API key with read/write permissions. Required when `SEARCH_DRIVER=typesense`. (Enterprise)                                                                                       |
 | `TYPESENSE_LOCALE`  | `en`                      | The locale for text analysis and search. Default is `en`. Examples: `en`, `es`, `fr`, `de`, `ja`, `zh`, `ko`, etc. See [Typesense supported languages](https://typesense.org/docs/latest/api/search.html#supported-languages) for full list. (Enterprise) |
 
+## Security
+
+### Iframe embedding
+
+By default, Docmost blocks other origins from embedding your instance in an `<iframe>`. This protects users against clickjacking attacks where a malicious site loads Docmost in a hidden frame and tricks signed-in users into clicking destructive actions. Out of the box, Docmost responds with `X-Frame-Options: SAMEORIGIN`, so only pages served from your own Docmost origin can iframe Docmost content.
+
+Public shared pages (`/share/...`) are exempt from this restriction and can always be embedded from any origin. Shares are public, read-only content with no authenticated actions, so they have no clickjacking surface.
+
+If you legitimately need to embed the rest of Docmost (the app itself) inside another tool, for example an intranet portal or LMS, use the variables below.
+
+| Variable                 | Example                                                   | Description                                                                                                                                                                                                                                                                                                  |
+|--------------------------|-----------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `IFRAME_EMBED_ALLOWED`   | `false`                                                   | Master switch for external iframe embedding. Defaults to `false`, which emits `X-Frame-Options: SAMEORIGIN`. Set to `true` to permit external embedding.                                                                                                                                                     |
+| `IFRAME_ALLOWED_ORIGINS` | `https://intranet.example.com,https://portal.example.com` | Optional comma-separated allowlist. Only consulted when `IFRAME_EMBED_ALLOWED=true`. When provided, Docmost emits `Content-Security-Policy: frame-ancestors 'self' <origins>` instead of `X-Frame-Options`. When empty, embedding is allowed from any origin. |
+
 ## Telemetry
 We anonymously collect the active version, user count, page count, space and workspace count.
 

docs/self-hosting/installation/index.md

@@ -121,7 +121,7 @@ Replace `STRONG_DB_PASSWORD` in the `POSTGRES_PASSWORD` environment variable wit
 Update the `DATABASE_URL` default `STRONG_DB_PASSWORD` value with your chosen Postgres password.
 
 To configure Emails or File storage driver, see the [Configuration](/self-hosting/configuration) doc.  
-The default File storage driver is `local storage`. You don't have to do anything unless you wish to use S3 storage.
+The default File storage driver is `local storage`. You don't have to do anything unless you wish to use [S3](/self-hosting/configuration#using-s3-compatible-storage) or [Azure Blob Storage](/self-hosting/configuration#using-azure-blob-storage).
 
 ### Start the Services