> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace Environments

> Review the users, licenses, and endpoints ContraForce can see in a workspace, and confirm which response actions its connections actually support.

The **Environments** tab on a workspace's settings page shows what ContraForce can actually see inside that customer's tenant: which identities and licenses exist, which endpoints are onboarded, and which response actions the current connections support.

<Info>
  Environments is a read-only view. Nothing on this tab changes a customer's configuration, and no user or device data is stored by ContraForce. Every list is fetched live from the provider when you open the page.
</Info>

## When to use it

<CardGroup cols={2}>
  <Card title="Verify an onboarding" icon="circle-check">
    Confirm endpoints are onboarded and licenses are in place before declaring a workspace live
  </Card>

  <Card title="Explain a blocked action" icon="circle-question">
    See at a glance whether a response action is unavailable because of licensing or a missing module
  </Card>

  <Card title="Spot coverage gaps" icon="magnifying-glass">
    Find devices that could be onboarded to Defender but are not
  </Card>

  <Card title="Check seat usage" icon="key">
    See how many seats of each security license are assigned
  </Card>
</CardGroup>

## Opening the tab

<Steps>
  <Step title="Open the workspace">
    From the [Workspace Center](/guides/getting-started/workspace-manager), click a workspace card to open its settings page
  </Step>

  <Step title="Go to Environments">
    Select the **Environments** tab
  </Step>

  <Step title="Open an environment">
    Click any row to drill into that provider's detail view
  </Step>
</Steps>

The landing view lists every connected environment for the workspace.

| Column           | What it shows                                                                       |
| ---------------- | ----------------------------------------------------------------------------------- |
| **Environment**  | Microsoft, CrowdStrike, or SentinelOne                                              |
| **Connections**  | Which products that environment contributes                                         |
| **Status**       | **Connected** when the underlying module is configured, otherwise **Not connected** |
| **Last updated** | When inventory for that environment was last collected                              |

<Note>
  Only providers with a configured detection module appear. If a workspace shows **No environments connected**, no detection module has been set up for it yet.
</Note>

***

## Microsoft

The Microsoft environment is split into two cards.

### Microsoft Entra ID

Three counters summarise the directory:

| Counter            | Meaning                                           |
| ------------------ | ------------------------------------------------- |
| **Total users**    | Every user account in the tenant directory        |
| **Enabled users**  | Accounts that are not disabled                    |
| **Licensed users** | Accounts holding at least one license of any kind |

Below the counters are two tabs.

**Licenses** lists the tenant's security-relevant subscriptions with seat usage, for example *Microsoft 365 E5 — 7 of 7 assigned*. Assigned seat counts come from Microsoft's own tenant-wide totals, so they match what the Microsoft 365 admin center reports. The list is deliberately filtered to security-relevant SKUs; unrelated subscriptions are not shown.

**Users** lists directory accounts with their user principal name, enabled state, and whether they hold a license. Filter by **Licensed** or **State**, or search by name or user principal name.

<Tip>
  Search queries the complete directory, not just the rows on screen. Large tenants show a sample in the table with a note saying so, but searching still finds any matching user.
</Tip>

The card also reports **Product Detected** for Entra ID Protection, and lists the **Identity gamebook capabilities** available in this workspace: invalidate existing sessions, lockout user, reset MFA, reset user password, and unlock user.

### Microsoft Defender

Three counters summarise endpoint coverage:

| Counter              | Meaning                                                        |
| -------------------- | -------------------------------------------------------------- |
| **Total endpoints**  | Devices known to Defender                                      |
| **Onboarded**        | Devices reporting into Defender                                |
| **Can be onboarded** | Devices Defender has discovered but that are not yet reporting |

<Tip>
  **Can be onboarded** is the most useful number on this tab for finding coverage gaps. These are real devices Defender already knows about that are not yet protected.
</Tip>

The endpoint table lists each device with its operating system, health, onboarding state, and last seen time, and is searchable by name, OS, or status.

Underneath, the card shows **Defender products detected**, the state of **Native automations** (AIR, ZAP, and attack disruption), and the **Defender gamebook capabilities** available: isolate endpoint, release from isolation, scan endpoint, and quarantine file.

## CrowdStrike and SentinelOne

Each shows total, active, and contained endpoint counts, a searchable endpoint table with platform, agent version, status, and last seen, and the response gamebook capabilities its connection supports.

## Reading capability states

Every capability row carries a state.

| State             | Meaning                                                                    |
| ----------------- | -------------------------------------------------------------------------- |
| **Available**     | The action can be dispatched in this workspace today                       |
| **Not connected** | The gamebook module providing the action is not connected                  |
| **Not licensed**  | The tenant's licensing does not include the action                         |
| **Not observed**  | Applies to native automations: ContraForce has not seen this mechanism act |

<Warning>
  A capability marked **Not licensed** cannot be enabled from ContraForce. It requires a licensing change in the customer's Microsoft tenant.
</Warning>

## Refreshing

Each card has a **Refresh** button that re-collects inventory immediately, and a **Last collected** timestamp beneath it. Refresh requires the **Owner** or **Content Admin** workspace role; everyone who can open the workspace settings page can read the tab.

***

## Permissions and consent

Directory inventory reads through the **Microsoft Defender XDR** module's connection, so that module must be connected before the Entra ID card shows anything. If it is not, the card explains that instead of showing counters.

ContraForce reads the directory with two Microsoft Graph application permissions on the Defender XDR app registration:

| Permission              | Used for                              |
| ----------------------- | ------------------------------------- |
| `Organization.Read.All` | License subscriptions and seat counts |
| `User.Read.All`         | User counts and the directory listing |

Both are read-only. Neither allows ContraForce to modify users, licenses, or the tenant.

### Granting the directory permission

Tenants that connected Defender XDR before this permission was introduced need to reconsent the module once. Until they do, the Entra ID card shows a **Microsoft Defender consent required** notice in place of the counters.

<Steps>
  <Step title="Open the notice">
    Go to the workspace's **Environments** tab and open the **Microsoft** environment
  </Step>

  <Step title="Grant or share">
    In your own tenant, click **Grant consent** to be taken to the Microsoft consent screen.

    For a managed customer's tenant, click **Copy consent link** instead and send it to that tenant's administrator. A partner administrator cannot consent inside a customer's directory.
  </Step>

  <Step title="Approve in Microsoft">
    A Global Administrator or Privileged Role Administrator reviews and approves the permissions
  </Step>

  <Step title="Return to the tab">
    You are returned to the Environments tab and the counters populate
  </Step>
</Steps>

<Warning>
  Consent must be granted by a **Global Administrator** or **Privileged Role Administrator** in the tenant being consented. Other roles cannot approve application permissions.
</Warning>

<Note>
  Because these are application permissions, Microsoft shows the Defender XDR app registration's full permission set on the consent screen rather than only the new entry. Approving does not add anything beyond what the app registration declares. The same list is shown on the module's configuration page under **Microsoft Graph**.
</Note>

## Troubleshooting

<AccordionGroup>
  <Accordion title="The Entra ID card says to connect Microsoft Defender XDR">
    Directory inventory is read through the Defender XDR connection. Connect that module on the workspace's **Modules** tab, then return to Environments.
  </Accordion>

  <Accordion title="A consent notice appears even though the module is connected">
    The module was consented before the directory permission was added. Follow the consent steps above to reconsent it once.
  </Accordion>

  <Accordion title="The consent notice is still showing right after granting consent">
    Click **Refresh** on the Entra ID card. If it persists, confirm the approval completed in Microsoft and that it was granted in the correct tenant.
  </Accordion>

  <Accordion title="You do not have access to this environment">
    Your account has no role on this workspace. A workspace owner needs to grant you access. Refreshing the page will not change this.
  </Accordion>

  <Accordion title="The endpoint table shows a sample rather than every device">
    Large tenants are capped for page performance and show a note saying so. Use the search field, which queries the provider's complete inventory.
  </Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="Workspace Center" icon="grid-2" href="/guides/getting-started/workspace-manager">
    Manage workspaces, modules, and per-workspace settings
  </Card>

  <Card title="Defender capability matrix" icon="table" href="/guides/technical/microsoft-defender-capability-matrix">
    Which capabilities each Microsoft license tier unlocks
  </Card>

  <Card title="Enterprise applications" icon="shield-halved" href="/guides/technical/enterprise-applications">
    The app registrations ContraForce uses and what each one needs
  </Card>

  <Card title="Platform permissions and consent" icon="key" href="/guides/getting-started/platform-permissions-and-consent">
    How consent works across the platform
  </Card>
</CardGroup>