diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md
index dd36fe2c03..c1c2595db3 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md
@@ -91,6 +91,8 @@ The machine will automatically be onboarded to your tenant with the recommended
 
 The environment will reflect your test machine status through the evaluation - including risk score, exposure score, and alerts created through the simulation.
 
+![Image of test machines](images/eval-machines.png)
+
 ## Simulate attack scenarios
 Use the test machines to run attack simulations by connecting to them. 
 
diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/eval-machines.png b/windows/security/threat-protection/microsoft-defender-atp/images/eval-machines.png
new file mode 100644
index 0000000000..a4f8efb652
Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/eval-machines.png differ