diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md
index 254521244c..a520ed0b5c 100644
--- a/windows/security/threat-protection/TOC.md
+++ b/windows/security/threat-protection/TOC.md
@@ -18,11 +18,14 @@
#### [Deployment phases](microsoft-defender-atp/deployment-phases.md)
#### [Phase 1: Plan](microsoft-defender-atp/prepare-deployment.md)
-##### [Validate licensing and complete setup](microsoft-defender-atp/licensing.md)
+#### [Validate licensing and complete setup](microsoft-defender-atp/licensing.md)
+##### [Evaluate capabilities](microsoft-defender-atp/evaluation-lab.md)
+##### [Security compass](microsoft-defender-atp/security-compass.md)
-#### [Phase 2: Pilot/Evaluate the capabilities](microsoft-defender-atp/evaluation-lab.md)
+#### [Phase 2: Onboard](microsoft-defender-atp/production-deployment.md)
-#### [Phase 3: Deploy](microsoft-defender-atp/production-deployment.md)
+
+#### [Phase 3: Configure](microsoft-defender-atp/configure.md)
### [Configuration guide]()
#### [Configure and manage capabilities]()
@@ -309,9 +312,9 @@
-#### [Custom detections]()
-##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md)
-##### [Create and manage custom detections rules](microsoft-defender-atp/custom-detection-rules.md)
+##### [Custom detections]()
+###### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md)
+###### [Create and manage custom detections rules](microsoft-defender-atp/custom-detection-rules.md)
#### [Security administration]()
@@ -374,7 +377,7 @@
#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md)
#### [Next-generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
-##### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoftntivirus.md)
+##### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md)
#### [Endpoint detection and response]()
#####[Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure.md b/windows/security/threat-protection/microsoft-defender-atp/configure.md
new file mode 100644
index 0000000000..513ce6e9d5
--- /dev/null
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure.md
@@ -0,0 +1,19 @@
+---
+title: Configure capabilities
+description:
+keywords:
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: medium
+manager: dansimp
+audience: ITPro
+ms.collection: M365-security-compliance
+ms.topic: article
+---
+
+# Configure capabilities
diff --git a/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md b/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md
index 83fc92fa01..c65eb44f0a 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/deployment-phases.md
@@ -18,4 +18,47 @@ ms.topic: article
# Deployment phases
+There are three phases in deploying Microsoft Defender ATP:
+
+
+
+
+ ![]() Plan + |
+
+
+ ![]() Onboard + |
+
+
+ ![]() Configure + |