diff --git a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
index ff8fdcc39b..737135cbd7 100644
--- a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md
@@ -106,10 +106,15 @@ To offboard the server, you can use either of the following methods:
 
 2. Select the Windows Defender ATP workspace, and click **Remove**.
 
+    ![Image of Microsoft Monitoring Agen Properties](images/atp-mma.png)
+
 #### Run a PowerShell command to remove the configuration
 
-1. Obtain your workspace ID. For more information, see [Obtain workspace ID and key](https://docs.microsoft.com/azure/log-analytics/log-analytics-agent-windows#obtain-workspace-id-and-key). 
-2. Open an elevated command-line prompt (as an Admin) and run the following command. Use the workspace ID you obtained and replacing `WorkspaceID`:
+1. Obtain your workspace ID by going to **Endpoint management** > **Servers**:
+    
+    ![Image of server onboarding](images/atp-server-onboarding-workspaceid.png)
+
+2. Open an elevated PowerShell and run the following command. Use the workspace ID you obtained and replacing `WorkspaceID`:
 
     ```
     # Load agent scripting object
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-mma.png b/windows/security/threat-protection/windows-defender-atp/images/atp-mma.png
new file mode 100644
index 0000000000..37219b5b0b
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-mma.png differ
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-server-onboarding-workspaceid.png b/windows/security/threat-protection/windows-defender-atp/images/atp-server-onboarding-workspaceid.png
new file mode 100644
index 0000000000..ef0a1a23bc
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-server-onboarding-workspaceid.png differ