docs: refresh architecture diagram and clarify onboarding prerequisites

README.md

@@ -25,9 +25,17 @@ The single-region request flow is:
 2. App Service Authentication (Easy Auth) validates the caller before the Function runs.
 3. The Function decrypts the request using a key stored in Azure Key Vault.
 4. The selected provider adapter authenticates to the phone provider and submits the SMS or voice message.
-5. The Function returns a success response after provider acceptance. Confirming delivery to the
+5. For a live request, the Function returns a success response after provider acceptance. Confirming delivery to the
    recipient is a separate validation step.
 
+The diagram's delivery path describes **live requests**. An authorized, valid encrypted
+**evaluation request (`mode: 2`)** returns the matching nonce without submitting a message to the
+provider. Background credential refresh can still run independently. Authentication failures may
+return **401 or 403**; neither is a successful evaluation.
+
+**East US in the diagram is illustrative, not a required or guaranteed deployment location.**
+Choose a region with available Linux Premium EP1 capacity and sufficient quota in your subscription.
+
 Application Insights provides operational telemetry. Provider API keys stay in Key Vault; supported
 OAuth integrations use managed identity. This guide covers only the single-region topology shown
 above. Multi-region deployment, failover, and resiliency guidance are deferred.
@@ -44,15 +52,17 @@ Use a **dedicated nonproduction tenant and subscription** for your first deploym
 | Azure permissions | An Azure user account permitted to deploy at subscription scope, register required resource providers, and create scoped role assignments. |
 | Microsoft Entra permissions | A Privileged Role Administrator for the application and Microsoft Graph configuration. Setup uses the allowed-tenants preview and requires Microsoft Graph beta access. |
 | Policy activation | An Authentication Policy Administrator to activate the endpoint after validation. Deployment alone does not activate it. |
-| Region and hosting | A region supporting Linux Premium EP1. Deployed resources incur Azure charges; review the hosting plan before approval. |
+| Region and hosting | A region supporting Linux Premium EP1 with sufficient EP1 quota for your subscription. Resource-provider registration does not grant quota. Deployed resources incur Azure charges; review the hosting plan before approval. |
 | C# only | The .NET 8 SDK and NuGet access. Setup builds and publishes the selected .NET package automatically. |
 
 Setup can install missing Microsoft Graph PowerShell modules and the Azure CLI Bicep component
 after confirmation. Azure CLI itself must already be installed. JavaScript and Python do not
 require a local build toolchain for this guided deployment; Python dependencies are built in Azure.
 
 Review the complete [setup prerequisites](setup/docs/README.md#prerequisites-for-step-2) before
-deploying.
+deploying. If Azure reports `SubscriptionIsOverQuotaForSku`, follow the
+[regional quota troubleshooting steps](setup/docs/Troubleshooting.md#deployment-fails-with-subscriptionisoverquotaforsku)
+before retrying.
 
 ## Onboard your endpoint
 

setup/docs/README.md

@@ -6,6 +6,11 @@ PowerShell script to deploy the endpoint, and activate policy manually after val
 The customer does not clone this repository or download Bicep/support scripts separately.
 `Setup-Epp.ps1` retrieves those files and the selected provider's JSON from GitHub.
 
+This guide deploys **one Function endpoint in one Azure region**. It does not provision Azure
+Front Door or a second region. A successful single-region deployment or encrypted evaluation
+does not establish cross-region failover or recovery; Front Door onboarding is deferred until
+that validation is complete.
+
 ## Availability
 
 Choose **SMS or voice**, a **Global or EU tenant scope**, **Telesign or Soprano**, and an
@@ -71,7 +76,11 @@ disclosed outbound managed-identity federated credential.
   principal or the endpoint app.
 - Microsoft Graph **beta** access for the Entra `signInAudienceRestrictions` allowed-tenants preview.
   The selected provider tenant is allowed in addition to the app's home tenant, which Entra always allows.
-- **Linux Premium EP1** available in the chosen region. Setup registers missing required Azure
+- **Linux Premium EP1** available in the chosen region, with sufficient subscription quota for the
+  deployment. Regional service availability and resource-provider registration do not guarantee
+  EP1 quota. If deployment reports `SubscriptionIsOverQuotaForSku`, resolve the
+  [regional quota issue](Troubleshooting.md#deployment-fails-with-subscriptionisoverquotaforsku)
+  before retrying. Setup registers missing required Azure
   resource providers automatically after the single approval. The Azure account needs the
   providers' subscription-scoped `/register/action` permission (included in Contributor/Owner).
 - **.NET selection only:** install the .NET 8 SDK and allow NuGet access. Setup runs `dotnet publish`

setup/docs/Troubleshooting.md

@@ -1,5 +1,30 @@
 # Troubleshooting Step 2
 
+## Deployment fails with SubscriptionIsOverQuotaForSku
+
+This is a subscription quota check, not an authentication failure or a missing resource-provider
+registration. A region can support Linux Premium EP1 while your subscription has an **EP1 VMs**
+limit of zero there. Quotas are regional: an allowance in one region does not establish an
+allowance in another.
+
+1. Confirm the tenant, subscription, region, and SKU in the deployment plan and Azure error.
+2. In the Azure portal, open **Quotas**, select **App Service**, and filter to the intended
+   subscription and region. Review **EP1 VMs**, its current usage, and the requested deployment's
+   requirements. This is an App Service quota, not a general-purpose Compute VM quota.
+3. Request an increase sufficient for the deployment and any planned scaling. Requesting an
+   increase does not mean it is approved; verify the effective limit after approval.
+4. If the quota is not adjustable in the portal or the request is rejected, create an Azure
+   support request under **Service and subscription limits (quotas)** for
+   **Function or Web App (Windows and Linux)**. Include the region, Linux deployment type, EP1
+   SKU, current limit, requested limit, and the error's tracking ID.
+5. Alternatively, choose another region only after checking its quota, service availability,
+   and your residency and provider requirements. Review the updated deployment plan before approval.
+
+See the [Azure quotas overview](https://learn.microsoft.com/azure/quotas/quotas-overview) for the
+quota-management and support options. Setup does not request or guarantee a quota increase.
+Do not change the hosting SKU, disable Easy Auth, or change provider credentials to bypass this
+error. After resolving quota, rerun setup and complete the normal deployed validation checks.
+
 ## appservice list-locations rejects EP1
 
 `EP1` is an Azure Functions Elastic Premium plan SKU, but older Azure CLI versions do not accept