diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md
index bc18bb6319..bf69826454 100644
--- a/windows/keep-secure/create-wip-policy-using-intune.md
+++ b/windows/keep-secure/create-wip-policy-using-intune.md
@@ -29,9 +29,13 @@ After you’ve set up Intune for your organization, you must create a WIP-specif
 
 2.  In the **App policy** screen, click **Add a policy**, and then fill out the fields:
     - **Name.** Type a name (required) for your new policy.
+
     - **Description.** Type an optional description.
+
     - **Platform.** Choose **Windows 10** as the supported platform for your policy.
 
+    - **Enrollment state.** Choose **With enrollment** as the enrollment state for your policy.
+
         ![Microsoft Azure Intune management console: Create your new policy in the Add a policy pane](images/wip-azure-portal-add-policy.png)
 
 3.  Click **Create**.
diff --git a/windows/keep-secure/images/wip-azure-portal-add-policy.png b/windows/keep-secure/images/wip-azure-portal-add-policy.png
index 5a685fbc44..59291bf62e 100644
Binary files a/windows/keep-secure/images/wip-azure-portal-add-policy.png and b/windows/keep-secure/images/wip-azure-portal-add-policy.png differ