diff --git a/windows/deployment/images/sa-mfa1.png b/windows/deployment/images/sa-mfa1.png
index 20003af99a..045e5a7794 100644
Binary files a/windows/deployment/images/sa-mfa1.png and b/windows/deployment/images/sa-mfa1.png differ
diff --git a/windows/deployment/images/sa-mfa2.png b/windows/deployment/images/sa-mfa2.png
index b63ed033e8..1964a7b263 100644
Binary files a/windows/deployment/images/sa-mfa2.png and b/windows/deployment/images/sa-mfa2.png differ
diff --git a/windows/deployment/images/sa-mfa3.png b/windows/deployment/images/sa-mfa3.png
new file mode 100644
index 0000000000..8987eac97b
Binary files /dev/null and b/windows/deployment/images/sa-mfa3.png differ
diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md
index 23c432a5ac..6f0fb97d57 100644
--- a/windows/deployment/windows-10-subscription-activation.md
+++ b/windows/deployment/windows-10-subscription-activation.md
@@ -102,7 +102,8 @@ If the device is running Windows 10, version 1803 or later:
2. When the user signs in to a Hybrid Azure AD joined device with MFA enabled, a toast notification will indicate that there is a problem. See the example below. Clicking the toast triggers a request for authentication details and takes the user through the subscription activation process.
-
+
+
### Windows 10 Education requirements