Improve guided setup defaults and explain EPP

README.md

@@ -1,6 +1,7 @@
 # External Phone Provider Azure Function Sample
 
-Connect Microsoft Entra ID to a phone provider for SMS and voice one-time passwords.
+This **External Phone Provider (EPP)** sample connects Microsoft Entra ID to a phone provider
+for SMS and voice one-time passwords.
 Guided setup deploys **one regional endpoint** using JavaScript by default, with C# and Python options.
 
 > [!IMPORTANT]

docs/GETTING-STARTED.md

@@ -4,7 +4,8 @@
 
 [Documentation](README.md) | [Setup reference](../setup/docs/README.md) | [Troubleshooting](../setup/docs/Troubleshooting.md)
 
-Deploy one regional endpoint for Microsoft Entra ID SMS and voice requests.
+**External Phone Provider (EPP)** connects Microsoft Entra ID to your phone provider for SMS
+and voice one-time passwords. This guide deploys one regional endpoint for that integration.
 
 | Step | Task |
 | --- | --- |
@@ -53,8 +54,10 @@ Assign an **onboarding owner** and review [production readiness](../TECHNICAL.md
 
 You can create the dedicated application during guided setup or register it manually.
 
-**Create during setup:** in Step 3, choose **Create a new application**, enter its display name,
-and choose a provider by name from the alphabetized list (**Soprano, Telesign**).
+**Create during setup:** in Step 3, press Enter to choose **Create a new application**, then Enter to use
+**EPP Application** or enter your own display name, and choose a provider by name from the
+alphabetized list (**Soprano, Telesign**). Blank provider-name input prompts again instead of
+canceling or selecting a default.
 Setup creates the registration only after you approve the final deployment plan.
 Canceling before approval creates no application. The signed-in user must be allowed to register
 applications in the customer tenant.
@@ -114,27 +117,33 @@ JavaScript is used by default, without a language prompt. To deploy another lang
 `.\Setup-Epp.ps1 -Language csharp` or `.\Setup-Epp.ps1 -Language python`.
 
 Select the tenant and subscription, then select an existing application, enter its **client ID**,
-or choose **Create a new application** and enter its display name. Setup detects the tenant's
-replication scope and selects the corresponding provider route; it does not ask you to choose EU or
-Global. Select the Azure region, then complete the remaining settings:
+or choose **Create a new application** and accept **EPP Application** or enter your own display name.
+Enter accepts the displayed menu default rather than canceling: the current CLI tenant/subscription
+when eligible (otherwise the first eligible option), and **Create a new application** for the app.
+Use **0** or **Cancel** where offered to stop.
+Setup detects the tenant's replication scope and selects the corresponding provider route;
+it does not ask you to choose EU or Global. Select the Azure region, then complete the remaining settings:
 
 - **Azure region:** EU tenants receive recommendations within the EU Data Boundary (EU/EFTA).
+  Enter selects the first displayed region.
   Other tenants retain the existing Azure-recommended shortlist. All-region and manual selection,
   including `-Location`, remain available; EU tenants receive a warning for an out-of-boundary or
   unverifiable choice. Recommendations are not a data-residency or GDPR compliance guarantee.
 - **Provider:** enter or confirm the provider by name. New applications show all guided providers
   in alphabetical order, with no default selection. Setup downloads the language's matching
   stable release asset, verifies `SHA256SUMS.txt`, and builds when required.
-- **Hosting:** FC1 can scale to zero and cold-start. EP1 has paid warm capacity. Review
+- **Hosting:** Enter defaults to FC1, which can scale to zero and cold-start. EP1 has paid warm capacity. Review
   [plan details](../setup/docs/README.md#service-plan-selection) and the [cost estimate](COST-CALCULATOR.md).
 - **Resource prefix:** press Enter to use `epp`, or enter 2-8 lowercase letters/digits, starting
   with a letter. When rerunning an existing deployment, use its original prefix.
 
 Complete required sign-in, MFA, or administrator consent. Resolve preflight errors before approval.
 
 For existing encryption credentials, follow
-[certificate selection](../setup/docs/README.md#encryption-certificate-selection). Coordinate
-changes across every endpoint sharing the application.
+[certificate selection](../setup/docs/README.md#encryption-certificate-selection).
+**Enter defaults to replacing all registered encryption credentials with one new certificate.**
+Select **Reuse** explicitly to keep a certificate. Coordinate changes across every endpoint
+sharing the application; no cleanup or creation occurs before final deployment approval.
 
 **Review the deployment plan before typing `Yes` or `Y`.** Check accounts, region, provider URLs,
 runtime, plan, resource names, permissions, certificate key IDs, and vault access.

docs/ONBOARDING.md

@@ -46,13 +46,13 @@ renewal.
 | --- | --- | --- |
 | Customer tenant ID | Microsoft Entra admin center > Overview | `-TenantId` |
 | Azure subscription ID | Azure portal > Subscriptions | `-SubscriptionId` |
-| Endpoint application | Existing dedicated app's client ID from Microsoft Entra admin center, or a new display name | `-ApplicationId`, or choose **Create a new application** interactively |
+| Endpoint application | Existing dedicated app's client ID, or Enter to create a new app (default name `EPP Application`) | `-ApplicationId`, or the interactive **Create a new application** default |
 | Azure region | Available Linux FC1/EP1 region that meets quota and organization requirements | `-Location` |
 | Provider | Approved Security Store integration | `-Provider telesign` or `soprano` |
 | Provider route | Detected from the tenant's replication scope; EU for EU tenants, Global otherwise | Optional `-EndpointRegion eu` or `global` must match the detected route |
-| Language and plan | JavaScript by default; C# or Python by parameter, with FC1 or EP1 | `-Language csharp` or `python`, `-ServicePlan` |
+| Language and plan | JavaScript by default; C# or Python by parameter; Enter defaults to FC1 hosting | `-Language csharp` or `python`, `-ServicePlan` |
 | Resource prefix | Interactive default `epp`, or a unique 2-8 character lowercase label that starts with a letter | `-ResourcePrefix` (required unattended) |
-| Encryption certificate | Existing registered key or approved replacement | `-CertificateAction` and certificate options |
+| Encryption certificate | Enter defaults to replacing registered encryption credentials; explicitly choose Reuse to keep one | `-CertificateAction` and certificate options; final approval is still required |
 | Output and source versions | Private output folder and reviewed source/release versions | Optional output and version options |
 
 Use the application **client ID**, not its Object ID. The customer tenant ID and provider tenant ID

setup/Setup-Epp.ps1

@@ -8,11 +8,15 @@
     Microsoft Graph operations reuse the Azure CLI user session through az ad and az rest.
     Interactive setup can select cached tenants, subscriptions, applications, and Azure regions,
     or create a dedicated app registration after final deployment approval.
+    Press Enter to accept a displayed default; use 0 or Cancel where offered to cancel.
+    Provider selection has no default. Deployment approval still defaults to No.
     The endpoint supports SMS and voice, selected by each request.
     Policy activation remains manual.
     No Azure resources or app registrations are changed until you approve the complete plan.
 .PARAMETER ApplicationId
     Existing application client ID. Omit interactively to select, enter, or plan a new application.
+    Enter at the application picker or manual client-ID prompt defaults to creating a new application.
+    Press Enter at the new application name prompt to use EPP Application.
     New applications use an alphabetized provider list and are created only after deployment approval.
     Required for unattended setup.
 .PARAMETER SourceRepository
@@ -21,7 +25,7 @@
     Optional stable epp-packages release tag. By default, setup uses the latest stable CI package release.
 .PARAMETER ServicePlan
     FC1 for Flex Consumption with a free usage grant, or EP1 for Premium with a warm instance.
-    Prompts when omitted; required for unattended setup.
+    Prompts with FC1 as the interactive default when omitted; required for unattended setup.
 .PARAMETER Language
     JavaScript by default, without a prompt. Use csharp or python to select another language.
     The legacy dotnet value remains supported for C#.
@@ -39,7 +43,9 @@
     saved whether or not this switch is supplied.
 .PARAMETER CertificateAction
     Create when no encryption certificate is registered, Reuse a selected certificate, or Replace
-    all registered encryption certificates. Existing certificates require an explicit choice.
+    all registered encryption certificates. Interactive selection defaults to Replace when
+    encryption certificates exist; changes still require final deployment approval.
+    An explicit choice is required for existing certificates in unattended mode.
 .PARAMETER EncryptionKeyId
     App-registration key ID to keep when reusing a certificate. Required for unattended reuse.
 .PARAMETER KeyVaultCertificateId