add clarifying screenshots

Author: richard-dennehy

docs/reference/elasticsearch-plugins/authentication-plugins.md

@@ -7,7 +7,7 @@ mapped_pages:
 
 Authentication plugins extend the functionality provided by the built-in [authentication realms](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/authentication-realms)
 
-# Core authentication plugins
+## Core authentication plugins
 
 [Microsoft Graph Authz](/reference/elasticsearch-plugins/ms-graph-authz.md)
 :   The Microsoft Graph Authz plugin uses [Microsoft Graph](https://learn.microsoft.com/en-us/graph/api/user-list-memberof) to look up group membership information from Microsoft Entra ID

docs/reference/elasticsearch-plugins/images/ms-graph-authz/01-create-enterprise-application.png

@@ -13,17 +13,35 @@ To make API calls to Microsoft Graph, Elasticsearch requires Azure credentials w
 2) Click "Enterprise applications" and then "New application" to register a new application.
 3) Click "Create your own application", provide a name, and select the "Integrate any other application you don’t find in the gallery" option.
 
+:::{image} ./images/ms-graph-authz/01-create-enterprise-application.png
+:alt: "create your own application" page
+:::
+
 ## Configure the custom Application
 
 1) In the [Azure portal](https://portal.azure.com), go to Microsoft Entra ID.
 2) Under “App registrations”, then the “All applications” tab, find the application created in the previous section.
+
+    :::{image} ./images/ms-graph-authz/02-find-app-registration.png
+    :alt: find your app registration
+    :::
 3) Take note of the Application (client) ID and Tenant ID shown here - these will be needed to configure Elasticsearch later.
+
+    :::{image} ./images/ms-graph-authz/03-get-application-id.png
+    :alt: get your application ID
+    :::
 4) Under Manage > Certificates & secrets
    - Create a new client secret
    - Take note of the Value - this is needed later, and is only shown once
+     :::{image} ./images/ms-graph-authz/04-create-client-secret.png
+     :alt: get your client secret
+     :::
 5) Under Manage > API permissions
    - Go to “Add a permission”
    - Choose “Microsoft Graph”
    - Choose “Application permissions”
    - Select “Directory.ReadWrite.All, Group.ReadWrite.All, User.Read.All”
    - Note that an Azure Admin will need to approve these permissions before the credentials can be used
+     :::{image} ./images/ms-graph-authz/05-configure-api-permissions.png
+     :alt: configure api permissions
+     :::

docs/reference/elasticsearch-plugins/images/ms-graph-authz/02-find-app-registration.png

@@ -20,16 +20,16 @@ Once the plugin is installed, the following configuration settings are available
 :   The client secret value for the Application you registered in the previous section. This is a sensitive setting, and must be configured in the Elasticsearch keystore. This setting is required.
 
 `xpack.security.authc.realms.microsoft_graph.*.access_token_host`
-:   A Microsoft login URL. This is optional, and defaults to `https://login.microsoftonline.com`.
+:   A Microsoft login URL. Defaults to `https://login.microsoftonline.com`.
 
 `xpack.security.authc.realms.microsoft_graph.*.graph_host`
-:   The Microsoft Graph base address. This is optional, and defaults to `https://graph.microsoft.com/v1.0`.
+:   The Microsoft Graph base address. Defaults to `https://graph.microsoft.com/v1.0`.
 
 `xpack.security.authc.realms.microsoft_graph.*.http_request_timeout`
-:   The timeout for individual Graph HTTP requests. This setting is optional, and defaults to `10s`.
+:   The timeout for individual Graph HTTP requests. Defaults to `10s`.
 
 `xpack.security.authc.realms.microsoft_graph.*.execution_timeout`
-:   The overall timeout for authorization requests to this plugin. This setting is optional, and defaults to `30s`.
+:   The overall timeout for authorization requests to this plugin. Defaults to `30s`.
 
 Create a Microsoft Graph realm, following the above settings, then configure an existing realm to delegate to it using `authorization_realms`.
 

docs/reference/elasticsearch-plugins/images/ms-graph-authz/03-get-application-id.png

@@ -19,7 +19,7 @@ sudo bin/elasticsearch-plugin install microsoft-graph-authz
 
 The plugin must be installed on every node in the cluster, and each node must be restarted after installation.
 
-You can download this plugin for [offline install](/reference/elasticsearch-plugins/plugin-management-custom-url.md) from [https://artifacts.elastic.co/downloads/elasticsearch-plugins/ms-graph-authz/microsoft-graph-authz-{{version}}.zip](https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-{{version}}.zip). To verify the `.zip` file, use the [SHA hash](https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-{{version}}.zip.sha512) or [ASC key](https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-{{version}}.zip.asc).
+You can download this plugin for [offline install](/reference/elasticsearch-plugins/plugin-management-custom-url.md) from [https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-{{version}}.zip](https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-{{version}}.zip). To verify the `.zip` file, use the [SHA hash](https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-{{version}}.zip.sha512) or [ASC key](https://artifacts.elastic.co/downloads/elasticsearch-plugins/microsoft-graph-authz/microsoft-graph-authz-{{version}}.zip.asc).
 
 
 ## Removal [ms-graph-authz-remove]

docs/reference/elasticsearch-plugins/images/ms-graph-authz/04-create-client-secret.png

@@ -106,7 +106,7 @@ Use the `elasticsearch-plugin` command line tool to install, list, and remove pl
 
 Run the following command to get usage instructions:
 
-``` 
+```
 sudo bin/elasticsearch-plugin -h
 ```
 
@@ -116,7 +116,7 @@ If Elasticsearch was installed using the deb or rpm package then run `/usr/share
 
 For detailed instructions on installing, managing, and configuring plugins, see the following:
 
-* [Intalling Plugings](./installation.md)
+* [Installing Plugins](./installation.md)
 * [Custom URL or file system](./plugin-management-custom-url.md)
 * [Installing multiple plugins](./installing-multiple-plugins.md)
 * [Mandatory plugins](./mandatory-plugins.md)