diff --git a/src/ALZ/Private/Deploy-Accelerator-Helpers/AcceleratorInputSchema.json b/src/ALZ/Private/Deploy-Accelerator-Helpers/AcceleratorInputSchema.json
index 1e19faf..806ef6a 100644
--- a/src/ALZ/Private/Deploy-Accelerator-Helpers/AcceleratorInputSchema.json
+++ b/src/ALZ/Private/Deploy-Accelerator-Helpers/AcceleratorInputSchema.json
@@ -28,6 +28,12 @@
           "type": "object",
           "required": true,
           "properties": {
+            "management": {
+              "description": "The subscription ID for the Management subscription where logging, monitoring, and automation resources will be deployed",
+              "type": "guid",
+              "required": true,
+              "source": "subscription"
+            },
             "connectivity": {
               "description": "The subscription ID for the Connectivity subscription where networking resources like hubs, firewalls, and DNS will be deployed",
               "type": "guid",
@@ -40,12 +46,6 @@
               "required": false,
               "source": "subscription"
             },
-            "management": {
-              "description": "The subscription ID for the Management subscription where logging, monitoring, and automation resources will be deployed",
-              "type": "guid",
-              "required": true,
-              "source": "subscription"
-            },
             "security": {
               "description": "The subscription ID for the Security subscription where security monitoring and governance resources will be deployed",
               "type": "guid",
diff --git a/src/ALZ/Private/Deploy-Accelerator-Helpers/Get-AzureContext.ps1 b/src/ALZ/Private/Deploy-Accelerator-Helpers/Get-AzureContext.ps1
index 41a208a..5b010df 100644
--- a/src/ALZ/Private/Deploy-Accelerator-Helpers/Get-AzureContext.ps1
+++ b/src/ALZ/Private/Deploy-Accelerator-Helpers/Get-AzureContext.ps1
@@ -45,6 +45,14 @@ function Get-AzureContext {
         if ($cacheAge.TotalHours -lt $cacheExpirationHours) {
             try {
                 $cachedContext = Get-Content -Path $cacheFilePath -Raw -Force | ConvertFrom-Json -AsHashtable
+                $currentSubscriptionId = az account show --query "id" -o tsv 2>$null
+                if ($LASTEXITCODE -eq 0 -and $currentSubscriptionId) {
+                    $cachedContext.CurrentSubscriptionId = $currentSubscriptionId.Trim()
+                }
+                $currentTenantId = az account show --query "tenantId" -o tsv 2>$null
+                if ($LASTEXITCODE -eq 0 -and $currentTenantId) {
+                    $cachedContext.CurrentTenantId = $currentTenantId.Trim()
+                }
                 Write-ToConsoleLog "Using cached Azure context (cached $([math]::Round($cacheAge.TotalMinutes)) minutes ago). Use -clearCache to refresh."
                 Write-ToConsoleLog "Found $($cachedContext.ManagementGroups.Count) management groups, $($cachedContext.Subscriptions.Count) subscriptions, and $($cachedContext.Regions.Count) regions"
                 return $cachedContext
@@ -55,17 +63,22 @@ function Get-AzureContext {
     }
 
     $azureContext = @{
-        ManagementGroups = @()
-        Subscriptions    = @()
-        Regions          = @()
+        ManagementGroups      = @()
+        Subscriptions         = @()
+        Regions               = @()
+        CurrentSubscriptionId = $null
+        CurrentTenantId       = $null
     }
 
     Write-ToConsoleLog "Querying Azure for management groups, subscriptions, and regions... (this can take up to 30 seconds)"
 
     try {
         # Get the current tenant ID
-        $tenantResult = az account show --query "tenantId" -o tsv 2>$null
-        $currentTenantId = if ($LASTEXITCODE -eq 0 -and $tenantResult) { $tenantResult.Trim() } else { $null }
+        $accountResult = az account show --query "{tenantId:tenantId, subscriptionId:id}" -o json 2>$null
+        $account = if ($LASTEXITCODE -eq 0 -and $accountResult) { $accountResult | ConvertFrom-Json } else { $null }
+        $currentTenantId = $account.tenantId
+        $azureContext.CurrentSubscriptionId = $account.subscriptionId
+        $azureContext.CurrentTenantId = $currentTenantId
 
         # Get management groups
         $mgResult = az account management-group list --query "[].{id:name, displayName:displayName}" -o json 2>$null
diff --git a/src/ALZ/Private/Deploy-Accelerator-Helpers/Request-ALZConfigurationValue.ps1 b/src/ALZ/Private/Deploy-Accelerator-Helpers/Request-ALZConfigurationValue.ps1
index 17cb8b9..e1273a3 100644
--- a/src/ALZ/Private/Deploy-Accelerator-Helpers/Request-ALZConfigurationValue.ps1
+++ b/src/ALZ/Private/Deploy-Accelerator-Helpers/Request-ALZConfigurationValue.ps1
@@ -37,6 +37,9 @@ function Request-ALZConfigurationValue {
         [Parameter(Mandatory = $false)]
         [switch] $AzureContextClearCache,
 
+        [Parameter(Mandatory = $false)]
+        [int] $ScenarioNumber = 0,
+
         [Parameter(Mandatory = $false)]
         [switch] $SensitiveOnly
     )
@@ -69,6 +72,10 @@ function Request-ALZConfigurationValue {
         $isRequired = Get-SchemaProperty -SchemaInfo $SchemaInfo -PropertyName "required" -Default $false
         $source = Get-SchemaProperty -SchemaInfo $SchemaInfo -PropertyName "source"
 
+        if ($Key -in @("management", "connectivity", "identity", "security")) {
+            $description = $description -replace "\b$([regex]::Escape($Key))(?=\s+subscription\b)", "$([char]27)[33m`$&$([char]27)[0m"
+        }
+
         # For sensitive inputs, check if value is set via environment variable
         $envVarValue = $null
         if ($isSensitive) {
@@ -101,6 +108,7 @@ function Request-ALZConfigurationValue {
 
         # Determine effective default (don't use placeholders as defaults)
         $effectiveDefault = if ($isPlaceholder) { "" } elseif ($isArray -and $hasPlaceholderItems) { @() } else { $CurrentValue }
+        $hasEffectiveDefault = $null -ne $effectiveDefault -and -not [string]::IsNullOrWhiteSpace($effectiveDefault)
 
         # Build base parameters for Read-MenuSelection
         $menuParams = @{
@@ -109,7 +117,7 @@ function Request-ALZConfigurationValue {
             Options           = @()
             DefaultValue      = $effectiveDefault
             AllowManualEntry  = $true
-            ManualEntryPrompt = "Enter value (press enter to accept default)"
+            ManualEntryPrompt = if ($hasEffectiveDefault) { "Enter value (press enter to accept default)" } else { "Enter value" }
             Type              = $schemaType
             IsRequired        = $isRequired
             RequiredMessage   = "This field is required. Please enter a value."
@@ -127,7 +135,42 @@ function Request-ALZConfigurationValue {
             $menuParams.ManualEntryPrompt = "Enter subscription ID"
             $menuParams.RequiredMessage = "This field is required. Please select a subscription."
             $menuParams.EmptyMessage = "No subscriptions found in Azure context."
-            if (-not $isRequired) {
+            $menuParams.DefaultOptionMarker = ""
+            if ($Key -eq "bootstrap_subscription_id" -and -not [string]::IsNullOrWhiteSpace($AzureContext.CurrentSubscriptionId)) {
+                $menuParams.DefaultValue = $AzureContext.CurrentSubscriptionId
+                $menuParams.DefaultOptionMarker = "current"
+            } elseif ($Key -in @("management", "connectivity", "identity", "security") -and [string]::IsNullOrWhiteSpace($effectiveDefault)) {
+                $subscriptionsWithNames = @($AzureContext.Subscriptions | ForEach-Object {
+                        $subscriptionName = if ($_.PSObject.Properties.Name -contains "name") {
+                            $_.name
+                        } else {
+                            $_.label -replace '\s+\([^)]+\)$', ''
+                        }
+                        [PSCustomObject]@{
+                            Name  = $subscriptionName
+                            Value = $_.value
+                        }
+                    })
+                # Prefer a friendly name match for workload-style keys like "management" or
+                # "connectivity" so the user is not forced to choose manually when the answer is obvious.
+                $exactMatches = @($subscriptionsWithNames | Where-Object { $_.Name -ieq $Key })
+                $wordMatchPattern = "(?<!\w)$([regex]::Escape($Key))(?!\w)"
+                $wordMatches = @($subscriptionsWithNames | Where-Object { $_.Name -match $wordMatchPattern })
+                if ($exactMatches.Count -eq 1) {
+                    $menuParams.DefaultValue = $exactMatches[0].Value
+                    $menuParams.DefaultOptionMarker = "matched"
+                } elseif ($wordMatches.Count -eq 1) {
+                    $menuParams.DefaultValue = $wordMatches[0].Value
+                    $menuParams.DefaultOptionMarker = "matched"
+                }
+                # Optional values can legitimately be skipped, so a no-match result falls back to
+                # manual entry instead of forcing a selection before the user decides to leave it blank.
+                if (-not $isRequired -and [string]::IsNullOrWhiteSpace($menuParams.DefaultValue)) {
+                    $menuParams.ManualEntryLabel = "Enter manually or don't supply"
+                    $menuParams.DefaultToManualEntry = $true
+                    $menuParams.DefaultValue = ""
+                }
+            } elseif (-not $isRequired -and [string]::IsNullOrWhiteSpace($effectiveDefault)) {
                 $menuParams.ManualEntryLabel = "Enter manually or don't supply"
                 $menuParams.DefaultToManualEntry = $true
                 $menuParams.DefaultValue = ""
@@ -138,12 +181,22 @@ function Request-ALZConfigurationValue {
             $menuParams.ManualEntryPrompt = "Enter management group ID"
             $menuParams.RequiredMessage = "This field is required. Please select a management group."
             $menuParams.EmptyMessage = "No management groups found in Azure context."
+            if ($Key -eq "root_parent_management_group_id" -and [string]::IsNullOrWhiteSpace($effectiveDefault) -and -not [string]::IsNullOrWhiteSpace($AzureContext.CurrentTenantId)) {
+                $menuParams.DefaultValue = $AzureContext.CurrentTenantId
+            }
         } elseif ($source -eq "azureRegion") {
             $menuParams.OptionsTitle = "Available regions (AZ = Availability Zone support):"
             $menuParams.Options = $AzureContext.Regions
             $menuParams.ManualEntryPrompt = "Enter region name (e.g., uksouth, eastus)"
             $menuParams.RequiredMessage = "This field is required. Please select a region."
             $menuParams.EmptyMessage = "No regions found in Azure context."
+            $azureDefaultRegion = [System.Environment]::GetEnvironmentVariable("AZURE_DEFAULTS_REGION")
+            if ([string]::IsNullOrWhiteSpace($effectiveDefault) -and -not [string]::IsNullOrWhiteSpace($azureDefaultRegion)) {
+                $regionOption = $AzureContext.Regions | Where-Object { $_.value -ieq $azureDefaultRegion } | Select-Object -First 1
+                if ($null -ne $regionOption) {
+                    $menuParams.DefaultValue = $regionOption.value
+                }
+            }
         } elseif ($schemaType -eq "boolean") {
             $menuParams.ManualEntryPrompt = "Enter value (true/false) (press enter to accept default)"
             $menuParams.DefaultValue = $effectiveDefault.ToString().ToLower()
@@ -265,6 +318,12 @@ function Request-ALZConfigurationValue {
                         $subCurrentValue = $currentValue[$subKey]
                         $subSchemaInfo = $nestedSchema.$subKey
 
+                        # For management-only scenario, only management is required
+                        if ($key -eq "subscription_ids" -and $ScenarioNumber -eq 5 -and $subKey -ne "management") {
+                            $subSchemaInfo = $subSchemaInfo.PSObject.Copy()
+                            $subSchemaInfo | Add-Member -MemberType NoteProperty -Name "required" -Value $false -Force
+                        }
+
                         $result = Read-InputValue -Key $subKey -CurrentValue $subCurrentValue -SchemaInfo $subSchemaInfo -DefaultDescription "$key - $subKey" -AzureContext $AzureContext
                         $subNewValue = $result.Value
 
@@ -407,10 +466,24 @@ function Request-ALZConfigurationValue {
                 # Walk original file lines, merge comments with serialized values
                 $originalLines = $inputsYamlContent -split "`n"
                 $resultLines = @()
+                $pendingSubKeys = @()
+                $currentParentKey = $null
 
                 foreach ($originalLine in $originalLines) {
                     $trimmedLine = $originalLine.TrimStart()
 
+                    # Flush pending sub-keys before any non-indented-data line
+                    if ($pendingSubKeys.Count -gt 0 -and -not ($originalLine -match '^\s+([\w_][\w_\-]*):')) {
+                        $parentSchemaInfo = Get-InputSchemaInfo -Key $currentParentKey -BootstrapSchema $bootstrapSchema -VcsSchema $vcsSchema
+                        $schemaOrder = @(($parentSchemaInfo.properties.PSObject.Properties.Name))
+                        foreach ($orderedKey in $schemaOrder) {
+                            $match = $pendingSubKeys | Where-Object { $_.KeyName -eq $orderedKey } | Select-Object -First 1
+                            if ($match) { $resultLines += $match.Line }
+                        }
+                        $pendingSubKeys = @()
+                        $currentParentKey = $null
+                    }
+
                     # Preserve blank lines, comment-only lines, and YAML document markers
                     if ([string]::IsNullOrWhiteSpace($originalLine) -or $trimmedLine.StartsWith('#') -or $trimmedLine -eq '---') {
                         $resultLines += $originalLine
@@ -423,6 +496,35 @@ function Request-ALZConfigurationValue {
                         $keyName = $Matches[2]
                         $lookupKey = "${indent}${keyName}"
 
+                        # Track parent key for nested values
+                        if ($indent -eq "") {
+                            $currentParentKey = if ($inputsConfig.Contains($keyName) -and $inputsConfig[$keyName] -is [System.Collections.IDictionary]) { $keyName } else { $null }
+                        }
+
+                        # Buffer nested keys for schema-order output
+                        if ($indent.Length -gt 0 -and $null -ne $currentParentKey) {
+                            $hashtableValue = $null
+                            foreach ($pKey in $inputsConfig.Keys) {
+                                if ($inputsConfig[$pKey] -is [System.Collections.IDictionary] -and $inputsConfig[$pKey].Contains($keyName)) {
+                                    $hashtableValue = $inputsConfig[$pKey][$keyName]
+                                    break
+                                }
+                            }
+
+                            # Comment out subscription_ids sub-keys with empty values
+                            if ($currentParentKey -eq "subscription_ids" -and $hashtableValue -is [string] -and [string]::IsNullOrEmpty($hashtableValue)) {
+                                $pendingSubKeys += @{ KeyName = $keyName; Line = "${indent}# ${keyName}: `"`"" }
+                            } else {
+                                $formattedValue = Format-YamlInlineValue -Value $hashtableValue
+                                $inlineComment = $null
+                                if ($originalLine -match '\S\s{2,}(#.*)$') { $inlineComment = $Matches[1] }
+                                $newLine = "${indent}${keyName}: $formattedValue"
+                                if ($inlineComment) { $newLine = "$newLine  $inlineComment" }
+                                $pendingSubKeys += @{ KeyName = $keyName; Line = $newLine }
+                            }
+                            continue
+                        }
+
                         # Extract inline comment from the original line
                         $inlineComment = $null
                         if ($originalLine -match '\S\s{2,}(#.*)$') {
@@ -436,14 +538,6 @@ function Request-ALZConfigurationValue {
                             $hashtableValue = $null
                             if ($indent -eq "" -and $inputsConfig.Contains($keyName)) {
                                 $hashtableValue = $inputsConfig[$keyName]
-                            } elseif ($indent.Length -gt 0) {
-                                # Nested value - find the parent key
-                                foreach ($parentKey in $inputsConfig.Keys) {
-                                    if ($inputsConfig[$parentKey] -is [System.Collections.IDictionary] -and $inputsConfig[$parentKey].Contains($keyName)) {
-                                        $hashtableValue = $inputsConfig[$parentKey][$keyName]
-                                        break
-                                    }
-                                }
                             }
 
                             # Use the formatted value for the line
@@ -466,6 +560,16 @@ function Request-ALZConfigurationValue {
                     }
                 }
 
+                # Flush any trailing pending sub-keys
+                if ($currentParentKey -and $pendingSubKeys.Count -gt 0) {
+                    $parentSchemaInfo = Get-InputSchemaInfo -Key $currentParentKey -BootstrapSchema $bootstrapSchema -VcsSchema $vcsSchema
+                    $schemaOrder = @(($parentSchemaInfo.properties.PSObject.Properties.Name))
+                    foreach ($orderedKey in $schemaOrder) {
+                        $match = $pendingSubKeys | Where-Object { $_.KeyName -eq $orderedKey } | Select-Object -First 1
+                        if ($match) { $resultLines += $match.Line }
+                    }
+                }
+
                 ($resultLines -join "`n") | Set-Content -Path $inputsYamlPath -Force -NoNewline
                 Write-ToConsoleLog "Updated inputs.yaml" -IsSuccess
 
diff --git a/src/ALZ/Private/Deploy-Accelerator-Helpers/Request-AcceleratorConfigurationInput.ps1 b/src/ALZ/Private/Deploy-Accelerator-Helpers/Request-AcceleratorConfigurationInput.ps1
index 9ec52c7..175b531 100644
--- a/src/ALZ/Private/Deploy-Accelerator-Helpers/Request-AcceleratorConfigurationInput.ps1
+++ b/src/ALZ/Private/Deploy-Accelerator-Helpers/Request-AcceleratorConfigurationInput.ps1
@@ -212,7 +212,8 @@ function Request-AcceleratorConfigurationInput {
                 -IacType $selectedIacType `
                 -VersionControl $selectedVersionControl `
                 -AzureContextOutputDirectory $outputFolderPath `
-                -AzureContextClearCache:$ClearCache.IsPresent
+                -AzureContextClearCache:$ClearCache.IsPresent `
+                -ScenarioNumber $selectedScenarioNumber
         } else {
             Write-ToConsoleLog "Checking for sensitive inputs that need to be provided..." -IsWarning
 
@@ -222,6 +223,7 @@ function Request-AcceleratorConfigurationInput {
                 -VersionControl $selectedVersionControl `
                 -AzureContextOutputDirectory $outputFolderPath `
                 -AzureContextClearCache:$ClearCache.IsPresent `
+                -ScenarioNumber $selectedScenarioNumber `
                 -SensitiveOnly
         }
 
@@ -246,8 +248,18 @@ function Request-AcceleratorConfigurationInput {
                 -ManualEntryPrompt "Enter '[y]es' to open or '[n]o' to continue without opening"
 
             if ($openInVsCodeResponse) {
-                Write-ToConsoleLog "Opening config folder in $vsCodeName..." -IsSuccess
-                & $vsCodeCommand $configFolderPath
+                $configFilesToOpen = @(
+                    Join-Path $configFolderPath "inputs.yaml"
+                )
+                if ($selectedIacType -eq "terraform") {
+                    $configFilesToOpen += Join-Path $configFolderPath "platform-landing-zone.tfvars"
+                } elseif ($selectedIacType -eq "bicep") {
+                    $configFilesToOpen += Join-Path $configFolderPath "platform-landing-zone.yaml"
+                }
+                $configFilesToOpen = @($configFilesToOpen | Where-Object { Test-Path -Path $_ })
+
+                Write-ToConsoleLog "Opening config folder and configuration files in $vsCodeName..." -IsSuccess
+                & $vsCodeCommand --reuse-window $configFolderPath $configFilesToOpen
             }
         }
 
diff --git a/src/ALZ/Private/Shared/Read-MenuSelection.ps1 b/src/ALZ/Private/Shared/Read-MenuSelection.ps1
index 106bb9f..79fca77 100644
--- a/src/ALZ/Private/Shared/Read-MenuSelection.ps1
+++ b/src/ALZ/Private/Shared/Read-MenuSelection.ps1
@@ -18,6 +18,8 @@ function Read-MenuSelection {
     The zero-based index of the default option (default: 0).
     .PARAMETER DefaultValue
     Alternative to DefaultIndex - specify the default value directly. If both are provided, DefaultValue takes precedence.
+    .PARAMETER DefaultOptionMarker
+    Text appended to the default option. Set to an empty string to omit the marker.
     .PARAMETER AllowManualEntry
     When set, adds an option [0] to allow manual entry.
     .PARAMETER ManualEntryPrompt
@@ -70,6 +72,9 @@ function Read-MenuSelection {
         [Parameter(Mandatory = $false)]
         $DefaultValue = $null,
 
+        [Parameter(Mandatory = $false)]
+        [string] $DefaultOptionMarker = "current",
+
         [Parameter(Mandatory = $false)]
         [switch] $AllowManualEntry,
 
@@ -212,7 +217,8 @@ function Read-MenuSelection {
         }
     }
 
-    # Helper function to get the value from an option (handles both simple values and label/value objects)
+    # Object options render a friendly label to the user while returning the underlying value,
+    # which keeps the prompt readable without changing the saved configuration data.
     function Get-OptionValue {
         param($Option)
         if ($Option -is [hashtable] -and $Option.ContainsKey('value')) {
@@ -237,7 +243,8 @@ function Read-MenuSelection {
     # Determine if we have options to display
     $hasOptions = $null -ne $Options -and $Options.Count -gt 0
 
-    # If DefaultValue is provided and we have options, find its index
+    # DefaultValue takes precedence over DefaultIndex because an existing configuration value
+    # should remain stable even when the option ordering changes or the user re-runs the prompt.
     if ($null -ne $DefaultValue -and $hasOptions) {
         for ($i = 0; $i -lt $Options.Count; $i++) {
             if ((Get-OptionValue -Option $Options[$i]) -eq $DefaultValue) {
@@ -262,7 +269,7 @@ function Read-MenuSelection {
     # Display default value and required status
     if ($null -ne $DefaultValue -and -not [string]::IsNullOrWhiteSpace($DefaultValue)) {
         $displayDefault = if ($IsSensitive.IsPresent) { Get-MaskedValue -Value $DefaultValue } else { $DefaultValue }
-        Write-ToConsoleLog "Default: $displayDefault" -Color Cyan -IsSelection
+        Write-ToConsoleLog "Default: $displayDefault" -Color Green -IsSelection
     }
     if ($IsRequired.IsPresent) {
         Write-ToConsoleLog "Required: Yes" -Color Yellow -IsSelection
@@ -326,7 +333,7 @@ function Read-MenuSelection {
         $label = Get-OptionLabel -Option $option
         $value = Get-OptionValue -Option $option
         $isCurrent = ($null -ne $DefaultValue -and $value -eq $DefaultValue) -or ($null -eq $DefaultValue -and $i -eq $DefaultIndex)
-        $currentMarker = if ($isCurrent) { " (current)" } else { "" }
+        $currentMarker = if ($isCurrent -and -not [string]::IsNullOrWhiteSpace($DefaultOptionMarker)) { " ($DefaultOptionMarker)" } else { "" }
 
         if ($isCurrent) {
             Write-ToConsoleLog "[$($i + 1)] $label$currentMarker" -IsSelection -Color Green -IndentLevel 1
@@ -337,7 +344,7 @@ function Read-MenuSelection {
 
     # Show manual entry option if allowed
     if ($AllowManualEntry.IsPresent) {
-        $manualEntryMarker = if ($DefaultToManualEntry.IsPresent) { " (current)" } else { "" }
+        $manualEntryMarker = if ($DefaultToManualEntry.IsPresent -and -not [string]::IsNullOrWhiteSpace($DefaultOptionMarker)) { " ($DefaultOptionMarker)" } else { "" }
         if ($DefaultToManualEntry.IsPresent) {
             Write-ToConsoleLog "[0] $ManualEntryLabel$manualEntryMarker" -IsSelection -Color Green -IndentLevel 1
         } else {