We don't sell/recommend Polycom, but we have quite a few customers coming to us from other VoIP carriers and they already have them. We have built a provisioning system that will use HTTP, and it works just fine, except we're not sure what the best way to secure it might be. The phones can do username/password, but then that means someone has to go put that into every single phone. From what we're able to find, there's no way for option 66 to assign this info permanently (meaning you can remove the option 66 settings after initial config). We don't think we can permanently leave option 66 in place because many customers have a mix of phones, and will need different settings for each type. Also we don't control their internal network, and forcing them to make a permanent change could be challenging. I'd love to hear how some of you in an ITSP/hosted environment are handling this.