diff --git a/app.py b/app.py
index 6a5b814..ee3f538 100644
--- a/app.py
+++ b/app.py
@@ -565,6 +565,11 @@ async def update_settings(request: Request):
         value = form.get(key, "")
         database.set_setting(key, value)
 
+    # Auth Tenant immer gleich Tenant ID setzen
+    tenant_id = form.get("azure_tenant_id", "")
+    if tenant_id:
+        database.set_setting("azure_auth_tenant", tenant_id)
+
     # Admin password
     new_pw = form.get("admin_password", "")
     if new_pw:
diff --git a/templates/settings.html b/templates/settings.html
index 85e0e40..c24add9 100644
--- a/templates/settings.html
+++ b/templates/settings.html
@@ -17,33 +17,31 @@
         <div class="col-lg-6">
             <div class="card">
                 <div class="card-header">
-                    <h6 class="mb-0"><i class="bi bi-microsoft"></i> Azure AD / Microsoft Graph</h6>
+                    <h6 class="mb-0"><i class="bi bi-microsoft"></i> Microsoft Entra ID (Azure AD)</h6>
                 </div>
                 <div class="card-body">
                     <div class="mb-3">
-                        <label class="form-label">Client ID</label>
+                        <label class="form-label">Anwendungs-ID (Client)</label>
                         <input type="text" name="azure_client_id" class="form-control font-monospace"
-                               value="{{ settings.azure_client_id }}">
+                               value="{{ settings.azure_client_id }}"
+                               placeholder="z.B. b19325df-9905-4e93-8419-30639376277d">
+                        <small class="text-muted">Azure Portal > App-Registrierungen > Uebersicht > Anwendungs-ID (Client)</small>
                     </div>
                     <div class="mb-3">
-                        <label class="form-label">Client Secret</label>
-                        <input type="password" name="azure_client_secret" class="form-control font-monospace"
-                               value="{{ settings.azure_client_secret }}">
-                    </div>
-                    <div class="mb-3">
-                        <label class="form-label">Tenant ID</label>
+                        <label class="form-label">Verzeichnis-ID (Mandant)</label>
                         <input type="text" name="azure_tenant_id" class="form-control font-monospace"
-                               value="{{ settings.azure_tenant_id }}">
+                               value="{{ settings.azure_tenant_id }}"
+                               placeholder="z.B. 6a0349fc-7bb3-4868-a711-27a0d1c58c83">
+                        <input type="hidden" name="azure_auth_tenant" value="{{ settings.azure_tenant_id }}">
+                        <input type="hidden" name="azure_client_secret" value="{{ settings.azure_client_secret }}">
+                        <small class="text-muted">Azure Portal > App-Registrierungen > Uebersicht > Verzeichnis-ID (Mandant)</small>
                     </div>
                     <div class="mb-3">
-                        <label class="form-label">Auth Tenant</label>
-                        <input type="text" name="azure_auth_tenant" class="form-control"
-                               value="{{ settings.azure_auth_tenant }}">
-                    </div>
-                    <div class="mb-3">
-                        <label class="form-label">Graph Scopes</label>
+                        <label class="form-label">Graph API Berechtigungen</label>
                         <input type="text" name="azure_scopes" class="form-control"
-                               value="{{ settings.azure_scopes }}">
+                               value="{{ settings.azure_scopes }}"
+                               placeholder="User.Read User.Read.All Presence.Read Presence.Read.All">
+                        <small class="text-muted">Standard: User.Read User.Read.All Presence.Read Presence.Read.All</small>
                     </div>
                     <div class="border rounded p-3 bg-light">
                         {% if authenticated %}