docs: clarify setup IDs and improve illustrated monitoring steps

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Hou Chi Chan

README.md

@@ -25,11 +25,8 @@ approved procedure is unavailable, **stop here** and follow the
 In Security Store, open **Private solutions** and select the subscription approved for your
 deployment. Review the phone-provider offers available to that subscription.
 
-![Cropped examples of phone-provider offer cards in Microsoft Security Store](docs/images/onboarding/security-store-providers.png)
-
-*These are cropped sample cards from Security Store, not recommendations or a complete provider
-list. Offers, preview labels, pricing, and access can change. A store listing does not mean the
-setup script supports that integration; check [guided provider support](docs/ONBOARDING.md#provider-credential-names).*
+See [sample offers and access guidance](docs/ONBOARDING.md#before-purchasing-or-deploying) in the
+detailed guide. A store listing does not mean the setup script supports that integration.
 
 Have these ready:
 
@@ -69,6 +66,13 @@ In the customer tenant's **Microsoft Entra admin center > App registrations > Ne
 *Some portal versions label the account type **Single tenant only**. Choose your own directory.
 The example above is an unsaved form, not an application you can reuse.*
 
+On the registered application's **Overview**, copy these two values privately:
+
+![App registration Overview with Application client ID and Directory tenant ID identified for setup and Object ID marked DO NOT USE](docs/images/onboarding/app-registration-overview.png)
+
+*Use **Application (client) ID** for `ApplicationId` and **Directory (tenant) ID** for `TenantId`.
+The **Object ID** is not either of these setup inputs. All ID values are hidden in this example.*
+
 Do not add a client secret, API permission, or app role yourself; setup handles the remaining
 configuration. See [application registration details](setup/docs/README.md#step-1---manually-create-the-application).
 
@@ -112,7 +116,7 @@ See [hosting plan details](setup/docs/README.md#service-plan-selection).
 The **Global/EU** prompt is a provider route label, not your Azure region or a data-residency guarantee.
 For the resource prefix, use 2-8 lowercase letters or digits, starting with a letter.
 
-![Actual setup choices for channel, provider route, provider, language, and hosting plan, with provider names hidden](docs/images/onboarding/setup-choices.png)
+![Cropped setup choices for provider route, provider, language, and hosting plan, with provider names hidden](docs/images/onboarding/setup-choices.png)
 
 *Choose the options approved for your deployment; do not copy the example selection numbers.
 The Global/EU choice is not the Azure region. The hosting-plan warning applies even when a

docs/MONITORING.md

@@ -92,6 +92,35 @@ necessary resource/workspace access; saving a Workbook does not grant its reader
 access to its data. Cross-workspace alert evaluation also needs access to each
 workspace under the rule's configured identity.
 
+### Run a first query and read the results
+
+1. In your workspace's **Logs**, close any welcome or Queries hub dialog. If the portal opens
+   in **Agent** mode, switch it off for this walkthrough, then choose **KQL mode**.
+2. Paste the query below. Replace `<function-role-name>` with the `AppRoleName` you verified
+   using the discovery query above. If a workspace contains multiple Application Insights
+   components with that same role name, also filter by your component's `_ResourceId`.
+3. Select **Run**, then read the **Results** grid. Adjust `ago(48h)` to include the time of
+   your authorized test; this query sets its own time range.
+
+```kusto
+AppRequests
+| where TimeGenerated >= ago(48h)
+| where AppRoleName == "<function-role-name>" and Name == "SendOtp"
+| summarize StoredRows = count() by ResultCode, Success
+| order by ResultCode asc
+```
+
+![Workspace Logs in KQL mode with a scoped request-status query, Run button, and one aggregate result row](images/onboarding/logs-query-results.png)
+
+*This real query returned 11 stored rows with result code 200 and `Success=true` in the example
+window. The role and workspace names are hidden. The query shows counts only: no phone numbers,
+message bodies, credentials, or raw trace messages. Your result counts will differ.*
+
+`StoredRows` counts stored telemetry records, not delivered messages or necessarily all requests.
+Sampling can change the count, and evaluation and live calls can both return HTTP 200. No rows
+means no matching records in the selected scope/time range; it is not proof that nothing failed.
+Use the scoped and sampling-aware queries below for ongoing monitoring.
+
 ## 2. Single-region Function queries
 
 ### Requests, failures, and latency

docs/ONBOARDING.md

@@ -20,6 +20,12 @@ channel, pricing, and access to the provider's **EPP integration**, not just its
 An offer purchase does not deploy Azure resources, enable a Microsoft tenant feature, or install
 a missing adapter.
 
+![Cropped examples of phone-provider offer cards in Microsoft Security Store](images/onboarding/security-store-providers.png)
+
+*These are sample cards, not recommendations or a complete provider list. Offers, preview
+labels, pricing, and access can change. A store listing does not mean the setup script supports
+that integration; check [guided provider support](#provider-credential-names).*
+
 Have your tenant administrator confirm the supported EPP onboarding/activation procedure with
 Microsoft and the provider **before incurring deployment costs**. This repository does not define
 tenant eligibility, licensing, preview enrollment, or a self-service activation entitlement.