diff --git a/Workload-Identity-Federation-for-SCIM-Provisioning.md b/Workload-Identity-Federation-for-SCIM-Provisioning.md
index e8ee5d73..9e3e21df 100644
--- a/Workload-Identity-Federation-for-SCIM-Provisioning.md
+++ b/Workload-Identity-Federation-for-SCIM-Provisioning.md
@@ -1,6 +1,6 @@
 # Workload Identity Federation: A New Authentication Method for SCIM Provisioning
 
-**Date:** 9th June 2026
+**Date:** 25th June 2026
 
 ---
 
@@ -62,6 +62,8 @@ This is a fundamental shift from the traditional model where admins had to:
 
 The administrator must perform **3 steps** to set up the integration for their app. The administrator must have at least the **Application Administrator** role on the customer's tenant.
 
+![Workload Identity Federation configuration flow](media/workload-identity-federation/wif-configuration-flow.png)
+
 ### Step 1: Configure ISV App and Workload Identity in Entra Portal
 
 In the Entra App Gallery, the administrator:
@@ -70,6 +72,16 @@ In the Entra App Gallery, the administrator:
 2. On the Connectivity Page, picks **"Workload Identity Federation"** as the auth method
 3. Clicks **"Select Workload Identity"** — customers can register a new Workload Identity App or reuse an existing one they have already used to set up with the ISV
 
+The Connectivity page exposes **Workload Identity Federation** as an authentication method alongside the existing authentication options.
+
+![Select Workload Identity Federation as the provisioning authentication method](media/workload-identity-federation/select-workload-identity-federation-auth-method.jpg)
+
+After selecting **Workload Identity Federation**, the administrator chooses **Select Workload Identity**. From there, they can either register a new workload identity app or select an existing workload identity that has already been configured with the ISV.
+
+| Register a new workload identity | Select an existing workload identity |
+|---|---|
+| ![Register a new workload identity in Entra](media/workload-identity-federation/register-new-workload-identity.jpg) | ![Select an existing workload identity in Entra](media/workload-identity-federation/select-existing-workload-identity.jpg) |
+
 After the access app is configured, the UX displays the following values to be **copied to the ISV Portal**:
 
 | Value | Format |
@@ -79,6 +91,8 @@ After the access app is configured, the UX displays the following values to be *
 | **Subject (sub)** | `<Sync Fabric Workload Identity 1P app object ID>` |
 | **Audience (aud)** | `api://{WorkloadIdentity_appid}/.default` |
 
+![Copy WIF claims and JWKS URL from Entra to the ISV portal](media/workload-identity-federation/copy-wif-claims-to-isv.png)
+
 ### Step 2: Set up SCIM Client with JWKS in ISV Portal
 
 In the ISV portal, the administrator sets up a client for the ISV's SCIM endpoint. As part of setting up the auth integration, the administrator copies the values from Step 1 (issuer, JWKS URL, subject, audience) into the ISV portal.
@@ -99,6 +113,8 @@ Back in the Entra App Gallery:
 2. Click **"Test Connection"** — this invokes the backend to perform all the token exchange steps and validate the integration
 3. **Save** the configuration — the app is now ready to configure provisioning
 
+![Complete Workload Identity Federation connectivity settings in Entra](media/workload-identity-federation/complete-entra-connectivity-settings.png)
+
 ---
 
 ## How the JWT Bearer Assertion Flow Works
@@ -402,4 +418,4 @@ If the JWKS endpoint is temporarily unavailable:
 | Microsoft Identity Platform OIDC Metadata | `https://login.microsoftonline.com/{tenantId}/v2.0/.well-known/openid-configuration`|
 ---
 
-*Last updated: June 9, 2026*
+*Last updated: June 25, 2026*
diff --git a/media/workload-identity-federation/complete-entra-connectivity-settings.png b/media/workload-identity-federation/complete-entra-connectivity-settings.png
new file mode 100644
index 00000000..d3b91427
Binary files /dev/null and b/media/workload-identity-federation/complete-entra-connectivity-settings.png differ
diff --git a/media/workload-identity-federation/copy-wif-claims-to-isv.png b/media/workload-identity-federation/copy-wif-claims-to-isv.png
new file mode 100644
index 00000000..8ef83d72
Binary files /dev/null and b/media/workload-identity-federation/copy-wif-claims-to-isv.png differ
diff --git a/media/workload-identity-federation/register-new-workload-identity.jpg b/media/workload-identity-federation/register-new-workload-identity.jpg
new file mode 100644
index 00000000..b1178cff
Binary files /dev/null and b/media/workload-identity-federation/register-new-workload-identity.jpg differ
diff --git a/media/workload-identity-federation/select-existing-workload-identity.jpg b/media/workload-identity-federation/select-existing-workload-identity.jpg
new file mode 100644
index 00000000..16eb0d11
Binary files /dev/null and b/media/workload-identity-federation/select-existing-workload-identity.jpg differ
diff --git a/media/workload-identity-federation/select-workload-identity-federation-auth-method.jpg b/media/workload-identity-federation/select-workload-identity-federation-auth-method.jpg
new file mode 100644
index 00000000..8bc5c0b9
Binary files /dev/null and b/media/workload-identity-federation/select-workload-identity-federation-auth-method.jpg differ
diff --git a/media/workload-identity-federation/wif-configuration-flow.png b/media/workload-identity-federation/wif-configuration-flow.png
new file mode 100644
index 00000000..17f80a9e
Binary files /dev/null and b/media/workload-identity-federation/wif-configuration-flow.png differ