diff --git a/windows/threat-protection/windows-defender-atp/images/atp-final-onboard-endpoints-warning-before-atp-access.png b/windows/threat-protection/windows-defender-atp/images/atp-final-onboard-endpoints-warning-before-atp-access.png
new file mode 100644
index 0000000000..bf39e4b81e
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-final-onboard-endpoints-warning-before-atp-access.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-run-detection-test.png b/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-run-detection-test.png
new file mode 100644
index 0000000000..9e3b12cbbd
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints-run-detection-test.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints.png b/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints.png
index 2251cfdbf2..36d21b5ebe 100644
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints.png and b/windows/threat-protection/windows-defender-atp/images/atp-onboard-endpoints.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-setup-incomplete.png b/windows/threat-protection/windows-defender-atp/images/atp-setup-incomplete.png
new file mode 100644
index 0000000000..554c69e2a6
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-setup-incomplete.png differ
diff --git a/windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
index d373ae3e24..8c3712c93b 100644
--- a/windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md
@@ -114,6 +114,12 @@ When accessing the [Windows Defender ATP portal](https://SecurityCenter.Windows.
 
 	![Image of Windows Defender ATP cloud instance](images\atp-windows-cloud-instance-creation.png)
 
+	![Image of Onboard endpoints and run detection test](images\atp-onboard-endpoints-run-detection-test.png)
+
+	![Image of setup imcomplete](images\atp-setup-incomplete.png)
+
+	![Image of final endpoint setup before WDATP access](images\atp-final-onboard-endpoints-warning-before-atp-access.png)
+
 10. You are almost done. You will now get the option to onboard endpoints in your organization by downloading a configuration policy package to onboard Windows10 machines to the service. This function is always accessible as long there is a valid license for Windows Defender ATP in place.
 
 	![Image of onboard endpoints](images\atp-onboard-endpoints-WDATP-portal.png)