diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md
index 4f786e812a..ad42b1bcd9 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md
@@ -32,8 +32,7 @@ Each onboarded machine adds an additional endpoint detection and response (EDR)
The **Onboarding** card provides a high-level overview of your onboarding rate by comparing the number of Windows 10 machines that have actually onboarded to Microsoft Defender ATP against the total number of Intune-managed Windows 10 machines.
-
-
+
*Card showing onboarded machines compared to the total number of Intune-managed Windows 10 machine*
>[!NOTE]
@@ -46,30 +45,28 @@ Microsoft Defender ATP provides several convenient options for [onboarding Windo
From the **Onboarding** card, select **Onboard more machines** to create and assign a profile on Intune. The link takes you to a similar overview of your onboarding state.
->[!TIP]
+>[!TIP]
>Alternatively, you can navigate to the Microsoft Defender ATP onboarding compliance page in the [Microsoft Azure portal](https://portal.azure.com/) from **All services > Intune > Device compliance > Microsoft Defender ATP**.
From the overview, create a configuration profile specifically for the deployment of the Microsoft Defender ATP sensor and assign that profile to the machines you want to onboard.
1. Select **Create a device configuration profile to configure ATP sensor**.
- 
-
+ 
*Microsoft Defender ATP device compliance page on Intune device management*
2. Specify a name for the profile, specify desired configuration options for sample sharing and reporting frequency, and select **Create** to save the new profile.
- 
-
+ 
*Configuration profile creation*
3. After creating the profile, assign it to all your machines. You can review profiles and their deployment status anytime by accessing **Device configuration > Profiles** on Intune.
- 
-
+ 
*Assigning the new agent profile to all machines*
-To learn more about Intune profiles, [read Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-profile-assign).
+>[!TIP]
+>To learn more about Intune profiles, read [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/en-us/intune/device-profile-assign).
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md
index 1a5b3b066a..e229fa9da5 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md
@@ -50,8 +50,7 @@ By default, only users who have been assigned the Global Administrator or the In
The **Security baseline** card on [machine configuration management](configure-machines.md) provides an overview of compliance across Windows 10 machines that have been assigned the Microsoft Defender ATP security baseline.
-
-
+
*Card showing compliance to the Microsoft Defender ATP security baseline*
Each machine is given one of the following status types:
@@ -80,29 +79,26 @@ Machine configuration management monitors baseline compliance only of Windows 10
2. Create a new profile.
- 
-
+ 
*Microsoft Defender ATP security baseline overview on Intune*
3. During profile creation, you can review and adjust specific settings on the baseline.
- 
-
+ 
*Security baseline options during profile creation on Intune*
-4. After creating the new profile, you will be shown a list of profiles for the security baseline. Select the new profile from the list of profiles.
+4. Assign the profile to the appropriate machine group.
- 
+ 
+ *Assigning the security baseline profile on Intune*
- *Security baseline profiles on Intune*
+5. Save the profile and deploy it to the assigned machine group.
-5. To deploy the security baseline, assign the profile to all your machines and save the profile.
+ 
+ *Saving and deploying the security baseline profile on Intune*
- 
-
- *Assigning the security baseline on Intune*
-
-To learn more about Intune security baselines and assigning them, [read Create a Windows 10 security baseline in Intune](https://docs.microsoft.com/intune/security-baselines).
+>[!TIP]
+>To learn more about Intune security baselines and assigning them, read [Create a Windows 10 security baseline in Intune](https://docs.microsoft.com/intune/security-baselines).
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md
index 5817a443a8..565bbebfa5 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md
@@ -32,8 +32,7 @@ With properly configured machines, you can boost overall resilience against thre
- Meet or exceed the Microsoft Defender ATP security baseline configuration
- Have strategic attack surface mitigations in place
-
-
+
*Machine configuration management page*
You can track configuration status at an organizational level and quickly take action in response to poor onboarding coverage, compliance issues, and poorly optimized attack surface mitigations through direct, deep links to device management pages on Microsoft Intune and Microsoft 365 security center.
@@ -56,7 +55,7 @@ Before you can ensure your machines are configured properly, enroll them to Intu
>[!NOTE]
>During preview, you might encounter a few known limitations:
>- You might experience discrepancies in aggregated data displayed on the machine configuration management page and those displayed on overview screens in Intune.
->- The count of onboarded machines tracked by security configuration management might not include machines onboarded using Security Center Configuration Manager, the onboarding script, or other onboarding methods that don’t use Intune profiles. To include these machines, create a corresponding Intune configuration profile for Microsoft Defender ATP onboarding and assign that profile to these machines.
+>- The count of onboarded machines tracked by machine configuration management might not include machines onboarded using Security Center Configuration Manager, the onboarding script, or other onboarding methods that don’t use Intune profiles. To include these machines, create a corresponding Intune configuration profile for Microsoft Defender ATP onboarding and assign that profile to these machines.
>- The Microsoft Defender ATP security baseline currently doesn’t cover settings for all Microsoft Defender ATP security controls, including settings for exploit protection and Application Guard.
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_card.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_card.png
index 884a34b446..84ba0fcb3d 100644
Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_card.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_card.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile1.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile1.png
index 9183ef9451..f8147866f5 100644
Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile1.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile1.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile2.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile2.png
index 00d4a79fad..a6b401f564 100644
Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile2.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile2.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile3.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile3.png
index 6518b9251d..8f88c5899e 100644
Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile3.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile3.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile4.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile4.png
index 71254fef84..2955624a72 100644
Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile4.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile4.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_main.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_main.png
index 861695e55e..551526ae72 100644
Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_main.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_main.png differ
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_card.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_card.png
index 5de7282a6e..331ad032a6 100644
Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_card.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_card.png differ