diff --git a/conf/defaults.ini b/conf/defaults.ini
index a0a74f3e58f..f50c425c201 100644
--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -23,11 +23,10 @@ temp_data_lifetime = 24h
 logs = data/log
 
 # Directory where grafana will automatically scan and look for plugins
-plugins = ../asserts-app-plugin
-
+plugins = data/plugins
 
 # folder that contains provisioning config files that grafana will apply on startup and while running.
-provisioning = ../asserts-app-plugin/provisioning
+provisioning = conf/provisioning
 
 # Directories that are permitted to contain local repositories.
 # This is a list. Each entry is delimited by a pipe (|). No leading or trailing spaces are supported.
@@ -70,7 +69,7 @@ router_logging = false
 static_root_path = public
 
 # enable gzip
-enable_gzip = true
+enable_gzip = false
 
 # https certs & key file
 cert_file =
@@ -114,7 +113,7 @@ network = "tcp"
 address = "127.0.0.1:10000"
 use_tls = false
 cert_file =
-key_file =
+cert_key =
 # this will log the request and response for each unary gRPC call
 enable_logging = false
 
@@ -215,6 +214,16 @@ instrument_queries = false
 # This is useful when databases have auto-generated primary keys enabled.
 delete_auto_gen_ids = false
 
+# Set to true to skip dashboard UID migrations on startup.
+# Improves startup performance for instances with large numbers of annotations who do not plan to downgrade Grafana.
+skip_dashboard_uid_migration_on_startup = false
+
+# Set to true to skip all database migrations on startup. Should be used in conjunction with "ensure_default_org_and_user".
+skip_migrations = false
+
+# Set to false to skip ensuring the default organization and user on startup.
+ensure_default_org_and_user = true
+
 #################################### Cache server #############################
 [remote_cache]
 # Either "redis", "memcached" or "database" default is "database"
@@ -341,6 +350,10 @@ application_insights_connection_string =
 # Optional. Specifies an Application Insights endpoint URL where the endpoint string is wrapped in backticks ``.
 application_insights_endpoint_url =
 
+# Optional, defaults to true. Configure automatic route tracking for single page applications in Application Insights.
+# See https://learn.microsoft.com/en-us/azure/azure-monitor/app/application-insights-faq#is-there-a-way-to-see-fewer-events-per-transaction-when-i-use-the-application-insights-javascript-sdk
+application_insights_auto_route_tracking = true
+
 # Controls if the UI contains any links to user feedback forms
 feedback_links_enabled = true
 
@@ -395,10 +408,10 @@ disable_ip_address_login_protection = true
 cookie_secure = false
 
 # set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled"
-cookie_samesite = disabled
+cookie_samesite = lax
 
 # set to true if you want to allow browsers to render Grafana in a <frame>, <iframe>, <embed> or <object>. default is false.
-allow_embedding = true
+allow_embedding = false
 
 # Set to true if you want to enable http strict transport security (HSTS) response header.
 # HSTS tells browsers that the site should only be accessed using HTTPS.
@@ -444,7 +457,6 @@ content_security_policy_report_only_template = """script-src 'self' 'unsafe-eval
 csrf_always_check = false
 
 # Comma-separated list of plugins ids that will be loaded inside the frontend sandbox
-# Currently behind the feature flag pluginsFrontendSandbox
 enable_frontend_sandbox_for_plugins =
 
 # Comma-separated list of paths for POST/PUT URL in actions. Empty will allow anything that is not on the same origin
@@ -569,10 +581,6 @@ external_manage_info =
 # Viewers can edit/inspect dashboard settings in the browser. But not save the dashboard.
 viewers_can_edit = false
 
-# Deprecated: Assign your editors to admins.
-# Editors can administrate dashboard, folders and teams they create
-editors_can_admin = false
-
 # The duration in time a user invitation remains valid before expiring. This setting should be expressed as a duration. Examples: 6h (hours), 2d (days), 1w (week). Default is 24h (24 hours). The minimum supported duration is 15m (15 minutes).
 user_invite_max_lifetime_duration = 24h
 
@@ -676,7 +684,7 @@ id_response_header_namespaces = user api-key service-account
 
 # Enables the use of managed service accounts for plugin authentication
 # This feature currently **only supports single-organization deployments**
-managed_service_accounts_enabled = true
+managed_service_accounts_enabled = false
 
 #################################### Passwordless Auth ###########################
 [auth.passwordless]
@@ -1886,7 +1894,6 @@ renderer_token = -
 # Concurrent render request limit affects when the /render HTTP endpoint is used. Rendering many images at the same time can overload the server,
 # which this setting can help protect against by only allowing a certain amount of concurrent requests.
 concurrent_render_request_limit = 30
-
 # Determines the lifetime of the render key used by the image renderer to access and render Grafana.
 # This setting should be expressed as a duration. Examples: 10s (seconds), 5m (minutes), 2h (hours).
 # Default is 5m. This should be more than enough for most deployments.
@@ -1908,7 +1915,7 @@ disable_sanitize_html = false
 enable_alpha = false
 app_tls_skip_verify_insecure = false
 # Enter a comma-separated list of plugin identifiers to identify plugins to load even if they are unsigned. Plugins with modified signatures are never loaded.
-allow_loading_unsigned_plugins = grafana-asserts-app,grafana-pyroscope-app,grafana-lokiexplore-app,grafana-assistant-app
+allow_loading_unsigned_plugins =
 # Enable or disable installing / uninstalling / updating plugins directly from within Grafana.
 plugin_admin_enabled = true
 plugin_admin_external_manage_enabled = false
@@ -1928,15 +1935,18 @@ disable_plugins =
 forward_host_env_vars =
 # Comma separated list of plugin ids to install as part of the startup process.
 # These will be installed, by default, asynchronously (in the background) while starting Grafana.
-preinstall = 
+preinstall =
 # Comma separated list of plugin ids to install before the startup process
 # These will be installed before starting Grafana. Useful when used with provisioning.
-; preinstall_sync = grafana-assistant-app 
+preinstall_sync =
 # Disables preinstall feature. It has the same effect as setting preinstall to an empty list.
 preinstall_disabled = false
 # Update strategy for plugins.
 # Available options: "latest", "minor"
 update_strategy = minor
+# Enable automatic updates for preinstalled plugins on startup.
+# When enabled, preinstalled plugins without a pinned version will be updated to the latest version.
+preinstall_auto_update = true
 
 #################################### Grafana Live ##########################################
 [live]
@@ -1949,6 +1959,10 @@ max_connections = 100
 # The limit can be disabled by setting it to -1.
 message_size_limit = 8388608
 
+# client_queue_max_size is the maximum size in bytes of the client queue
+# for Live connections. Defaults to 4MB.
+client_queue_max_size = 4194304
+
 # allowed_origins is a comma-separated list of origins that can establish connection with Grafana Live.
 # If not set then origin will be matched over root_url. Supports wildcard symbol "*".
 allowed_origins =
@@ -2041,25 +2055,6 @@ grpc_port =
 license_path =
 
 [feature_toggles]
-dockedMegaMenu = true
-accessControlOnCall = true
-idForwarding = true
-externalServiceAccounts = true
-assertsOnboarding = true
-assertsOnboardingV2 = true
-relabelRulesUi = true
-workbenchAi = true
-externalEntityRings = true
-# appO11yInAsserts = true
-extensionSidebar = true
-grafanaAssistantLoop = true
-dashboardNewLayouts = true
-dashboardScene = true
-dashboardSceneForViewers = true
-kubernetesDashboards = true
-kubernetesDashboardsAPI = true
-workbenchAiAssistant = true
-
 # there are currently two ways to enable feature toggles in the `grafana.ini`.
 # you can either pass an array of feature you want to enable to the `enable` field or
 # configure each toggle by setting the name of the toggle to true/false. Toggles set to true/false
@@ -2224,6 +2219,14 @@ resource_storage_type = "db"
 # Current key provider used for envelope encryption
 encryption_provider = secret_key.v1
 
+# These flags are required in on-prem installations for GitSync to work
+#
+# Whether to create the MT secrets management database
+run_secrets_db_migrations = true
+# Whether to run the data key id migration. Requires that RunSecretsDBMigrations is also true.
+run_data_key_migration = true
+
+
 [secrets_manager.encryption.secret_key.v1]
 # Used to encrypt data keys
 secret_key = SW2YcwTIb9zpOOhoPsMm
@@ -2262,4 +2265,4 @@ allow_image_rendering = true
 # The minimum sync interval that can be set for a repository. This is how often the controller
 # will check if there has been any changes to the repository not propagated by a webhook.
 # The minimum value is 10 seconds.
-min_sync_interval = 10s
+min_sync_interval = 10s
\ No newline at end of file