diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md
index 4cfb2a5ce5..7cb35259d5 100644
--- a/windows/security/threat-protection/TOC.md
+++ b/windows/security/threat-protection/TOC.md
@@ -19,7 +19,8 @@
### [Deployment phases](microsoft-defender-atp/deployment-phases.md)
### [Phase 1: Prepare](microsoft-defender-atp/prepare-deployment.md)
### [Phase 2: Set up](microsoft-defender-atp/production-deployment.md)
-### [Phase 3: Onboard](microsoft-defender-atp/onboarding.md)
+### [Phase 3: Onboard]()
+#### [Onboarding overview](microsoft-defender-atp/onboarding.md)
#### [Deployment rings](microsoft-defender-atp/deployment-rings.md)
#### [Onboarding using Microsoft Endpoint Configuration Manager](microsoft-defender-atp/onboarding-endpoint-configuration-manager.md)
#### [Onboarding using Microsoft Endpoint Manager](microsoft-defender-atp/onboarding-endpoint-manager.md)
diff --git a/windows/security/threat-protection/microsoft-defender-atp/deployment-rings.md b/windows/security/threat-protection/microsoft-defender-atp/deployment-rings.md
index b9a48bb7c4..8ad96f8300 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/deployment-rings.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/deployment-rings.md
@@ -1,6 +1,6 @@
---
title: Deploy Microsoft Defender ATP in rings
-description: Learn how deploy Microsoft Defender ATP in rings
+description: Learn how to deploy Microsoft Defender ATP in rings
keywords: deploy, rings, evaluate, pilot, insider fast, insider slow, setup, onboard, phase, deployment, deploying, adoption, configuring
search.product: eADQiWindows 10XVcnh
ms.prod: w10
@@ -50,16 +50,20 @@ Table 1 provides an example of the deployment rings you might use.
|**Deployment ring**|**Description**|
|:-----|:-----|
Evaluate | Ring 1: Identify 50 systems for pilot testing
-Pilot | Ring 2: 50-100 systems
-Full deployment | Ring 3: Roll out service to the rest of environment in larger increments.
+Pilot | Ring 2: Identify the next 50-100 endpoints in production environment
+Full deployment | Ring 3: Roll out service to the rest of environment in larger increments
-### Evaluate
-Identify a small number of test machines in your environment to onboard to the service. Ideally, these machines would be less than 50 endpoints.
-#### Exit criteria
+### Exit criteria
+An example set of exit criteria for these rings can include:
- Devices show up in the device inventory list
- Alerts appear in dashboard
+- [Run a detection test](run-detection-test.md)
+- [Run a simulated attack on a device](attack-simulations.md)
+
+### Evaluate
+Identify a small number of test machines in your environment to onboard to the service. Ideally, these machines would be fewer than 50 endpoints.
### Pilot
@@ -76,10 +80,6 @@ The following table shows the supported endpoints and the corresponding tool you
| **Android** | [Microsoft Endpoint Manager](android-intune.md) |
-#### Exit criteria
-- Devices show up in the device inventory list
-- [Run a detection test](run-detection-test.md)
-- [Run a simulated attack on a device](attack-simulations.md)
### Full deployment
@@ -92,16 +92,15 @@ Use the following material to select the appropriate Microsoft Defender ATP arch
|:-----|:-----|
|[](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf)
[PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.pdf) \| [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-deployment-strategy.vsdx) | The architectural material helps you plan your deployment for the following architectures: