Add consent screenshots to Microsoft Entra guide

Author: TomNaessens

en/guides/general/microsoft-entra/admin-consent-en.png

@@ -60,6 +60,10 @@ Dodona never calls the Microsoft Graph API. The permissions above exist only so
 That is the complete list. There is no background service, and nothing with which Dodona could query your directory.
 :::
 
+This is what a user sees when signing in to Dodona for the first time:
+
+![Screenshot of the Microsoft consent screen for the Dodona application, showing the verified publisher badge and the requested permissions "View your basic profile" and "Maintain access to data you have given it access to"](./user-consent-en.png =440x)
+
 ::: info Why the consent screen mentions "Maintain access to data you have given it access to"
 
 Microsoft's consent screen shows this line for every application, including ones that never ask for it. It corresponds to the `offline_access` scope, and Microsoft [documents](https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#the-offline_access-scope) that it "currently appears on all consent pages, even for flows that don't provide a refresh token".
@@ -89,6 +93,10 @@ From the application's `Permissions` page you can see exactly which permissions
 
 Granting admin consent on behalf of your organisation means your users are never prompted for consent themselves. You do this from the application's `Permissions` page under `Enterprise applications`, as described in [Grant tenant-wide admin consent to an application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent).
 
+This is what the admin consent screen looks like:
+
+![Screenshot of the Microsoft admin consent screen for the Dodona application, showing the verified publisher badge and the requested permission "View users' basic profile"](./admin-consent-en.png =440x)
+
 If the application isn't in your tenant yet, you can also start the consent flow directly. Open the following URL while signed in with an account that may consent on behalf of your organisation, and replace `{tenant}` with your tenant ID or one of your verified domain names:
 
 ```

en/guides/general/microsoft-entra/index.md

@@ -60,6 +60,12 @@ Dodona roept de Microsoft Graph API nooit aan. De machtigingen hierboven dienen
 Dat is de volledige lijst. Er is geen achtergrondproces, en niets waarmee Dodona je directory zou kunnen bevragen.
 :::
 
+Dit is wat een gebruiker te zien krijgt bij het aanmelden op Dodona:
+
+![Screenshot van het Microsoft-toestemmingsscherm voor de Dodona-applicatie, met het geverifieerde uitgeversbadge en de gevraagde machtigingen "View your basic profile" en "Maintain access to data you have given it access to"](./user-consent-nl.png =440x)
+
+Let op: Microsoft vertaalt wel de omkadering van dit scherm, maar niet de namen van de machtigingen zelf. Die blijven in het Engels staan, zoals je hierboven ziet. Dat is dus geen foutje van onze kant.
+
 ::: info Waarom het toestemmingsscherm "Maintain access to data you have given it access to" vermeldt
 
 Het toestemmingsscherm van Microsoft toont deze regel bij elke applicatie, ook bij applicaties die er nooit om vragen. Ze komt overeen met de `offline_access`-scope. Microsoft [documenteert](https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#the-offline_access-scope) zelf, in het Engels, dat die "currently appears on all consent pages, even for flows that don't provide a refresh token".
@@ -89,6 +95,10 @@ Op de pagina `Permissions` van de applicatie zie je precies welke machtigingen g
 
 Als je toestemming geeft namens je organisatie, krijgen je gebruikers zelf nooit een toestemmingsscherm te zien. Dat doe je vanaf de pagina `Permissions` van de applicatie onder `Enterprise applications`, zoals beschreven in [Grant tenant-wide admin consent to an application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent).
 
+Zo ziet het beheerderstoestemmingsscherm eruit:
+
+![Screenshot van het Microsoft-beheerderstoestemmingsscherm voor de Dodona-applicatie, met het geverifieerde uitgeversbadge en de gevraagde machtiging "View users' basic profile"](./admin-consent-nl.png =440x)
+
 Staat de applicatie nog niet in je tenant, dan kan je de toestemmingsflow ook rechtstreeks starten. Open de volgende URL terwijl je aangemeld bent met een account dat namens je organisatie toestemming mag geven, en vervang `{tenant}` door je tenant-ID of door een van je geverifieerde domeinnamen:
 
 ```

en/guides/general/microsoft-entra/user-consent-en.png

@@ -2229,3 +2229,35 @@ shots:
     hook: hooks/sm-announcement.mjs
     crop: { selector: '#active-announcement' }
     must_show: [announcement text, dismiss cross]
+
+  # ---------------- microsoft-entra (guides/general) ----------------
+  # Both shots below are Microsoft's own consent screens at
+  # login.microsoftonline.com, not Dodona pages, so the runner has no page to
+  # navigate to and can't capture them. They stay manual captures.
+  #
+  # To recapture: open the consent URL in the comment while signed in as a
+  # tenant admin, clip the `#lightbox` element at 2x, and white out the
+  # account email that sits above the heading. Do not click Accept.
+  #
+  # The Dutch pass needs an `Accept-Language: nl-BE` request header on that
+  # request; the `ui_locales` and `mkt` URL parameters are both ignored by
+  # this Microsoft flow.
+  - id: ME-1
+    page: guides/general/microsoft-entra
+    file: admin-consent
+    manual: true
+    # https://login.microsoftonline.com/{tenant}/adminconsent?client_id={client_id}
+    must_show:
+      - Dodona name, publisher and blue verified badge
+      - permission list showing only "View users' basic profile"
+      - no account email visible
+
+  - id: ME-2
+    page: guides/general/microsoft-entra
+    file: user-consent
+    manual: true
+    # https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id={client_id}&response_type=code&redirect_uri=https%3A%2F%2Fdodona.be%2Fusers%2Fauth%2Fmicrosoft%2Fcallback&response_mode=query&scope=openid%20email%20profile&prompt=consent
+    must_show:
+      - Dodona name, publisher and blue verified badge
+      - permission list showing "View your basic profile" and "Maintain access to data you have given it access to"
+      - no account email visible