diff --git a/.gitignore b/.gitignore
index 27d92e8..68c3e29 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 venv-docs
 _build
 .vscode
+.env
diff --git a/developer/roc.rst b/developer/roc.rst
index a3b2f9b..45ae27b 100644
--- a/developer/roc.rst
+++ b/developer/roc.rst
@@ -83,6 +83,8 @@
    kubectl wait pod -n micro-onos --for=condition=Ready -l type=config --timeout=300s
 
 
+.. _posting-the-mega-patch:
+
 Posting the mega-patch
 ----------------------
 
diff --git a/operations/images/aether-roc-gui-basket-view-new-range.png b/operations/images/aether-roc-gui-basket-view-new-range.png
new file mode 100644
index 0000000..98884f7
--- /dev/null
+++ b/operations/images/aether-roc-gui-basket-view-new-range.png
Binary files differ
diff --git a/operations/images/aether-roc-gui-devicegroup-add.png b/operations/images/aether-roc-gui-devicegroup-add.png
new file mode 100644
index 0000000..2ac66be
--- /dev/null
+++ b/operations/images/aether-roc-gui-devicegroup-add.png
Binary files differ
diff --git a/operations/images/aether-roc-gui-devicegroup-edit.png b/operations/images/aether-roc-gui-devicegroup-edit.png
new file mode 100644
index 0000000..f9ca841
--- /dev/null
+++ b/operations/images/aether-roc-gui-devicegroup-edit.png
Binary files differ
diff --git a/operations/images/aether-roc-gui-devicegroups-list.png b/operations/images/aether-roc-gui-devicegroups-list.png
new file mode 100644
index 0000000..1abf3a0
--- /dev/null
+++ b/operations/images/aether-roc-gui-devicegroups-list.png
Binary files differ
diff --git a/operations/images/aether-roc-gui-sites-list.png b/operations/images/aether-roc-gui-sites-list.png
new file mode 100644
index 0000000..a51cf2f
--- /dev/null
+++ b/operations/images/aether-roc-gui-sites-list.png
Binary files differ
diff --git a/operations/images/aether-roc-gui-vcs-edit.png b/operations/images/aether-roc-gui-vcs-edit.png
new file mode 100644
index 0000000..dda9994
--- /dev/null
+++ b/operations/images/aether-roc-gui-vcs-edit.png
Binary files differ
diff --git a/operations/images/aether-roc-gui-vcs-list.png b/operations/images/aether-roc-gui-vcs-list.png
new file mode 100644
index 0000000..db1361f
--- /dev/null
+++ b/operations/images/aether-roc-gui-vcs-list.png
Binary files differ
diff --git a/operations/subscriber.rst b/operations/subscriber.rst
index edd05f9..63fb195 100644
--- a/operations/subscriber.rst
+++ b/operations/subscriber.rst
@@ -8,6 +8,11 @@
 Subscriber management includes workflows associated with provisioning new subscribers, removing
 existing subscribers, and associating subscribers with virtual connectivity services.
 
+.. note::
+    This section refers to a fully installed ROC GUI, properly secured and with Enterprises, Connectivity Services
+    and Sites already configured by a ROC Administrator. The examples shown below are taken from an example
+    configuration shipped with the ROC - the "MEGA Patch" (see :ref:`posting-the-mega-patch`)
+
 Provisioning a new UE
 ---------------------
 
@@ -54,28 +59,91 @@
 Configure Connectivity Service for a new UE
 -------------------------------------------
 
-To receive connectivity service, a UE must be added to a DeviceGroup. An enterprise is typically
-organized into one or more sites, each site which may contain one or more DeviceGroups. Navigate
-to the site you where the device will be deployed, find the appropriate device group, and add
+To receive connectivity service, a UE must be added to a DeviceGroup. An Enterprise is typically
+organized into one or more Sites, each Site which may contain one or more DeviceGroups. Navigate
+to the appropriate DeviceGroup which is associated with the Site you wish to deploy on, and add
 the UE's IMSI to the DeviceGroup.
 
-TODO: Describe GUI process and add Picture
+The Site details can be seen by navigating to the Site list view.
 
-Note: For 4G service, a UE may participate in at most one DeviceGroup, and that DeviceGroup may
-participate in at most one VCS. For 5G service, a UE can participate in many DeviceGroups, and each
-DeviceGroup may participate in many VCSes.
+.. image:: images/aether-roc-gui-sites-list.png
+    :width: 755
+    :alt: Sites List View in Aether ROC GUI showing site details
+
+In the ROC GUI, navigate to the Device Groups list view, to see the list of
+Device Groups and their association to Sites.
+
+    |DEVICEGROUP-LIST|
+
+In the DeviceGroup *New York POS* example above an Imsi Range **store** of **70-73** will mean the set of Imsi
+IDs (when the *format* specifier of the *starbucks-newyork* Site are applied to
+its *MCC*, *MNC* and *Enterprise*) of
+
+* 021032002000070 (021-032-002-000070)
+* 021032002000071
+* 021032002000072
+* 021032002000073
+
+.. note::
+    For 4G service, a UE may participate in at most one DeviceGroup, and that DeviceGroup may
+    participate in at most one VCS. For 5G service, a UE can participate in many DeviceGroups, and each
+    DeviceGroup may participate in many VCSes.
+
+Editing
+*******
+Edit the DeviceGroup by clicking on the Edit icon, and in the Edit page,
+adjust an existing range or create a new range (by clicking on the `+` icon).
+
+    |DEVICEGROUP-EDIT|
+
+The following restrictions apply
+
+#. The Imsi ID specified in "from" or "to" is relative to *MCC*, *MNC* and *Enterprise* of the Site.
+#. The maximum value of an Imsi ID is defined by the number of **S** characters in the `format` specifier of the Site.
+#. Imsi Ranges are contiguous ranges of Imsi IDs. To accommodate non contiguous Imsi IDs, add extra Ranges.
+#. Imsi Ranges can have a maximum span of 100 between "from" and "to" Imsi IDs. Break bigger spans in to many ranges.
+#. Imsi ranges within a DeviceGroup cannot not overlap.
+
+When the entries on the DeviceGroup edit page are valid the **Update** will become available
+
+* Click this to add the changes to the **Basket** of configuration changes
+* Observe that the **Basket** icon (2nd icon from top right) displays the number of changes
+
+.. note::
+    The changes are not committed to **aether-config** until the **Basket** is committed.
+    This allows several changes to be gathered together in one transaction and checked before committing.
+
+Committing
+**********
+To commit the changes
+
+#. click on the **Basket** icon (2nd icon from top right) to see the Basket view
+#. inspect the changes to be committed (optional)
+#. click **commit** to perform the commit
+#. observe the response that's temporarily displayed that shows the success or failure of the commit
+
+.. image:: images/aether-roc-gui-basket-view-new-range.png
+    :width: 635
+    :alt: Basket View with some changes ready to be committed
 
 Remove Connectivity Service from an existing UE
 -----------------------------------------------
 
-Using the ROC GUI, navigate to the Device Group that contains the UE,
+Using the ROC GUI, navigate to the DeviceGroup that contains the UE,
 then remove that UE's IMSI from the list. If you are removing a single UE, and the
 DeviceGroup is configured with a range specifier that includes several IMSIs,
 then it might be necessary to split that range into multiple ranges.
 
-TODO: Describe GUI process and add Picture
+* If the UE to be removed has an Imsi ID in the middle of an existing Imsi Range:
+    click the *trash can* icon next to that *Imsi Range* and
+    use the *+* icon to add new Ranges for the remaining Imsi IDs.
+* Alternatively if the UE to be removed has an Imsi ID at the start or end of an existing Imsi Range:
+    then adjust the *from* or *to* value accordingly.
 
-Note: The UE may continue to have connectivity until its next detach/attach cycle.
+    |DEVICEGROUP-EDIT|
+
+.. note::
+    The UE may continue to have connectivity until its next detach/attach cycle.
 
 Create a new DeviceGroup
 ------------------------
@@ -84,15 +152,35 @@
 a default DeviceGroup, but additional DeviceGroups may be created. For example, placing all IP
 Cameras in an my-site-ip-cameras DeviceGroup would allow you to group IP Cameras together.
 
-TODO: Describe GUI process and add Picture
+To add a DeviceGroup, navigate to the list of DeviceGroups and click `Add` in the upper right.
+(This may be greyed out if you do not have appropriate permissions).
+
+* Specify a unique **id** for the DeviceGroup
+    40 characters max and only alphanumeric and `-`, `_` and `.` allowed
+* Choose a *Site* from the list of preconfigured list
+    It will not be possible to add Imsi Ranges until the Site is chosen
+* Imsi Ranges can be added at this stage or later
+
+.. image:: images/aether-roc-gui-devicegroup-add.png
+    :width: 490
+    :alt: Adding a new Device Group requires an *id* and choosing a Site
 
 Delete a DeviceGroup
 --------------------
 
-IF a DeviceGroup is no longer needed, it can be deleted. Deleting a DeviceGroup will not cause
+If a DeviceGroup is no longer needed, it can be deleted. Deleting a DeviceGroup will not cause
 the UEs participating in the group to automatically be moved elsewhere.
 
-TODO: Describe GUI process and add Picture
+.. note::
+    If a Device Group is being used by an existing VCS, then it cannot be removed.
+    Delete the VCS first, and then the DeviceGroup.
+
+A DeviceGroup can be deleted from the DeviceGroup list view, by clicking the *trash can* icon
+next to it. The deletion is added to the **Basket** directly. Navigate to the *Basket View*
+to commit the change.
+
+    |DEVICEGROUP-LIST|
+
 
 Add a DeviceGroup to a Virtual Connectivity Service (VCS)
 ---------------------------------------------------------
@@ -100,10 +188,35 @@
 In order to participate in the connectivity service, a DeviceGroup must be associated with
 a Virtual Connectivity Service (VCS).
 
-TODO: Describe GUI process and add Picture
+Navigate to the *VCS* list view to see the list of VCS's and their associations to DeviceGroups.
+
+.. image:: images/aether-roc-gui-vcs-list.png
+    :width: 920
+    :alt: VCS List View in Aether ROC GUI showing DeviceGroup association
+
+To edit a *VCS* click on the *edit* button next to it in this list.
+
+This brings up the VCS edit page where (among many other things) zero, one or many
+DeviceGroups can be associated with it.
+
+* Click the *trash can* symbol to remove a DeviceGroup from the VCS
+* Click the *+* icon to add a DeviceGroup
+* Click the *Allow* slider to Allow or Disallow the DeviceGroup
+    This is a way of disabling or reenabling the DeviceGroup within a VCS without having to remove it
+
+.. image:: images/aether-roc-gui-vcs-edit.png
+    :width: 562
+    :alt: VCS Edit View in Aether ROC GUI showing DeviceGroup association editing
 
 Remove a DeviceGroup from a Virtual Connectivity Service (VCS)
 --------------------------------------------------------------
 
-TODO: Describe GUI process and add Picture
+The procedure is covered in the above section.
 
+.. |DEVICEGROUP-LIST| image:: images/aether-roc-gui-devicegroups-list.png
+    :width: 755
+    :alt: Device Groups List View in Aether ROC GUI showing Site association and Imsi Range of all DeviceGroups
+
+.. |DEVICEGROUP-EDIT| image:: images/aether-roc-gui-devicegroup-edit.png
+    :width: 755
+    :alt: Device Groups Edit View in Aether ROC GUI showing Imsi Range