Merge pull request #188540 from msmimart/mm-workbook-screens

[EXID] Cross-tenant access workbook: Add screenshots and more description

Author: LJSpiller

articles/active-directory/reports-monitoring/media/workbook-cross-tenant-access-activity/cross-tenant-workbook-step-1.png

@@ -12,7 +12,7 @@ ms.service: active-directory
 ms.topic: reference
 ms.workload: identity
 ms.subservice: report-monitor
-ms.date: 02/04/2022
+ms.date: 02/14/2022
 ms.author: mimart
 
 ms.collection: M365-identity-device-management
@@ -45,7 +45,23 @@ This workbook has four sections:
 
 - Individual users for inbound and outbound collaboration by tenant ID
 
-![Screenshot showing list of external tenants with sign-in data](./media/workbook-cross-tenant-access-activity/external-tenants-list.png)
+The total number of external tenants that have had cross-tenant access activity with your tenant is shown at the top of the workbook. 
+
+Under **Step 1**, the external tenant list shows all the tenants that have had inbound or outbound activity with your tenant. When you select an external tenant in the table, the remaining sections update with information about outbound and inbound activity for that tenant.
+
+[ ![Screenshot showing list of external tenants with sign-in data.](./media/workbook-cross-tenant-access-activity/cross-tenant-workbook-step-1.png) ](./media/workbook-cross-tenant-access-activity/cross-tenant-workbook-step-1.png#lightbox)
+
+The table under **Step 2** summarizes all outbound and inbound sign-in activity for the selected tenant, including the number of successful sign-ins and the resons for failed sign-ins. You can select **Outbound activity** or **Inbound activity** to update the remaining sections of the workbook with the type of activity you want to view.
+
+![Screenshot showing activity for the selected tenant.](./media/workbook-cross-tenant-access-activity/cross-tenant-workbook-step-2.png)
+
+Under **Step 3**, the table lists the applications that are being accessed across tenants. If you selected **Outbound activity** in the previous section, the table shows the applications in external tenants that are being accessed by your users. If you selected **Inbound activity**, you'll see the list of your applications that are being accessed by external users. You can select a row to find out which users are accessing that application.
+
+![Screenshot showing application activity for the selected tenant.](./media/workbook-cross-tenant-access-activity/cross-tenant-workbook-step-3.png)
+
+The table in **Step 4** displays the list of users who are accessing the application you selected.
+
+![Screenshot showing users accessing an app.](./media/workbook-cross-tenant-access-activity/cross-tenant-workbook-step-4.png)
 
 ## Filters