> ## Documentation Index > Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt > Use this file to discover all available pages before exploring further. # Workspace Profiles > Configure a set of workspace settings once, then apply it to every workspace on the profile: access, modules, notifications, Gamebook approvers, and agents. A **Workspace Profile** is a reusable template of workspace settings. Configure it once, attach the workspaces it should manage, and apply it. ContraForce pushes the same configuration to every workspace on the profile. Without profiles, every configuration change is multiplied by the size of your fleet: 200 workspaces means 200 manual edits. With a profile, it is one edit and one apply. **Who is this for?** * MSP/MSSP partners managing more than a handful of customer workspaces * Organizational Admins who set access, notification, and module standards across the fleet Profiles tab in Workspace Center showing a profile card *** ## What Can You Do Here? Define one baseline for access, modules, notifications, Gamebooks, and agents. Push a change to every attached workspace without opening any of them. Every profile shows which workspaces are still on an older version. *** ## Prerequisites | Requirement | Description | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Service provider account** | Profiles are available to MSP/MSSP partner accounts that manage customer workspaces. | | **Organizational Admin** | Required to view, create, edit, and apply profiles. One apply reconfigures every attached workspace, so this is held at the Org Admin level. | | **Agent Center (optional)** | Only required if you want a profile to deploy or assign Security Delivery Agents. See [Deploying Agent Center](/guides/onboarding/agent-center-deployment). | *** ## What a Profile Covers A profile is made up of five sections. Configure only the ones you need. A section you leave empty is left alone on every workspace. | Section | What it sets | | ----------------- | ---------------------------------------------------------------------------------------------------------------------- | | **IAM** | Users and groups that should have access to the workspace, and the role each one gets | | **Modules** | Detection and response modules the workspace should have | | **Notifications** | Notification preferences and the recipients for incident, Gamebook, and agent run notifications | | **Gamebooks** | The Gamebook approvers responsible for authorizing manual response actions | | **Agent** | Security Delivery Agent policy, and optionally whether ContraForce should create an agent where the workspace has none | Notification recipients must be **your own people**: your team members, your groups, or any email address. A person who exists only inside one customer's tenant has no identity in the other workspaces on the profile, so their notifications would silently go nowhere. *** ## Creating a Profile From the left navigation, select **Workspaces**, then click the **Profiles** tab. Give the profile a **name**, an optional **description**, and optional **tags**. Tags make profiles easier to find as your library grows. Move through the **IAM**, **Modules**, **Notifications**, **Gamebooks**, and **Agent** tabs and set the values you want every workspace on this profile to have. There is one save bar for the whole profile. Everything you edited across the tabs publishes together as a single new version. You should see a confirmation such as "1 section saved. Profile is now v2." Editing the name, description, or tags does **not** create a new version. Only section changes do, because only section changes need to be pushed to workspaces. *** ## Attaching Workspaces Attaching declares which workspaces the profile manages. It does not configure anything on its own. Click the profile card on the **Profiles** tab. Select the workspaces this profile should manage and confirm. Newly attached workspaces carry the profile's label but not yet its configuration. That is correct. Applying is the next, separate step. Detaching a workspace stops the profile from managing it, but it does **not** remove configuration the profile already applied. Removing settings across a fleet is a deliberate action, not a side effect of detaching. *** ## Previewing and Applying Applying is what makes attached workspaces match the profile. Profile detail page showing the waiting to be applied banner and the Apply button ContraForce shows a preview before anything changes. The preview lists, workspace by workspace, exactly what will be added, updated, or removed. For example, "removes 2 approvers, adds 1". It also calls out any workspace where the profile's modules would change the workspace's plan and add a recurring charge. If the preview names workspaces that would be repriced, you must acknowledge that before those workspaces are configured. Nothing billable happens without your confirmation. The apply runs in the background. You can leave the page. Progress is recorded as each workspace finishes. Applying the same profile twice is safe. ContraForce brings each workspace towards the profile rather than duplicating what is already there, and settings a workspace admin added by hand are left untouched. *** ## Versions and Sync Status Every profile carries a version number, and every workspace records the version it last received. | What you see | What it means | | ----------------------------------- | -------------------------------------------------------------------------- | | **All in sync** | Every attached workspace is on the profile's current version | | **Waiting to be applied** | The profile has moved ahead of one or more workspaces. Click **Apply now** | | **N of M workspaces not yet on vX** | The exact count still waiting for the current version | A workspace shows as waiting whenever it was just attached, whenever you save a section change, or whenever an apply did not fully land on it. *** ## Tracking a Rollout The **Activity** tab on a profile records every apply as a numbered run, with the version that was pushed, who pushed it, and the result for each workspace. Profile Activity tab showing Run 1 applied to one workspace ### Run and workspace statuses | Status | Meaning | | --------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | **Queued** | The run has been accepted and is about to start | | **Running** | ContraForce is working through the workspaces | | **Applied** | Everything in the run landed successfully | | **Partially applied** | Most workspaces succeeded; the ones that did not are named on their own rows. This is a successful push with notes, not a failure | | **Skipped** | Nothing was attempted, with a stated reason you can act on | | **Failed** | The workspace could not be configured | | **Provisioning** | An agent deployment started by this run is still finishing. The result settles automatically once the deployment completes | A run tells you what changed as well as whether it worked. A run showing `+0 ~0 -0` with "Already matched. Nothing to change" means the workspace was already exactly as the profile describes. ### Retrying Use **Retry** on a run to pick up the workspaces that did not fully succeed, including skipped ones, which are often waiting on something you have since fixed. A retry is a new run, and it pushes the **same version the original run pushed**, not whatever you have edited since. Workspaces that already succeeded are never touched again. *** ## Agents in a Profile The **Agent** tab sets the Security Delivery Agent policy for every workspace on the profile, and can create the agent where a workspace does not have one yet. | Setting | What it does | | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | **Enabled** | Turns the agent section on for this profile | | **Triage policy** | The agent behavior every workspace on the profile should use | | **Model** (optional) | Preferred AI model. If it is not available in your Agent Center's region, ContraForce uses the default model and says so in the preview | | **Provisioning** | **Configure only** (default): a workspace with no agent is skipped. **Provision**: ContraForce creates the agent, then applies the policy | ### Before a profile can create agents Your environment must have committed an agent deployment model in **Agent Center**. Until it has, agent provisioning is skipped with a message telling you so. That choice is permanent, so ContraForce never makes it for you from a profile. | Deployment model | What you need | | --------------------- | ----------------------------------------------------------------------------------------------------------------------- | | **ContraForce Cloud** | ContraForce Cloud agents enabled for your environment, and an available pool agent | | **Your Cloud** | An Agent Center in a **Deployed** state, and Owner rights on its Azure subscription for the person applying the profile | Provisioning creates billable infrastructure. It happens only when the profile is set to **Provision** and the preview showed it. The preview names the action and the number of workspaces affected before anything is committed. Agent deployments take minutes. The run reports those workspaces as **Provisioning** and settles them automatically once the deployment finishes. A single apply deploys up to **50** agents; anything beyond that is skipped with a reason and picked up by your next apply. *** ## Troubleshooting | Message or symptom | Cause | What to do | | ---------------------------------------------------------------- | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | | Profiles tab not visible | Not a service provider account, or not an Organizational Admin | Confirm your role, or contact support to check availability for your environment | | "This workspace has no agent yet" | Profile provisioning is set to **Configure only** | Set provisioning to **Provision** and apply again, or deploy the agent from Agent Center | | "This environment has not chosen its agent deployment model yet" | No deployment model committed | Commit your agent deployment model in **Agent Center**, then apply again | | "Your Agent Center is not deployed yet" | Agent Center is missing or still deploying | Finish [Agent Center deployment](/guides/onboarding/agent-center-deployment), then retry the run | | Owner rights required | The person applying the profile is not an Owner on the Agent Center subscription | Have a subscription Owner run the apply, or grant Owner and retry | | "An agent deployment is already running for this workspace" | A deployment from an earlier action is still in flight | Wait for it to finish, then retry the run | | Workspace stays out of sync after a run | The run was partially applied, so the version was not recorded | Open the **Activity** tab, read the workspace's reason, resolve it, and retry | | Modules section skipped | Applying the modules would reprice the workspace | Apply again and acknowledge the charge when prompted | If a workspace keeps failing across multiple runs, contact [support@contraforce.com](mailto:support@contraforce.com) with the profile name, the run number, and the workspace name. *** ## Best Practices Most fleets need only a few profiles, for example one per detection stack or per service tier. Tags make them easy to find later. Everything you change across the tabs publishes as one version and one rollout. Six separate saves means six versions and six pushes. The preview is produced by the same engine that performs the apply, so what it shows is what will happen. Pay particular attention to removals and to any workspace flagged for repricing. Attaching is reversible and configures nothing, so you can stage a profile's reach and review it before anything fans out. Skips almost always point at a prerequisite: an undeployed Agent Center, a missing permission, or an unacknowledged charge. Resolving them once makes every future apply cleaner. *** ## Related Guides Onboard one customer with a profile, or import a whole batch from a CSV. Manage individual workspaces, health, and per-workspace settings. Set up agents and choose an adoption mode. Understand which role can do what across the platform. *** Questions about Workspace Profiles? Contact us at [support@contraforce.com](mailto:support@contraforce.com).