Who is this for?
- Internal security teams deploying ContraForce for your own organization
- MSP/MSSP partners setting up your parent tenant before onboarding customers
What You’ll Accomplish
By the end of this guide, you’ll have:Connected Microsoft Environment
ContraForce linked to your Microsoft 365 and Azure environment
Active Workspace
Your organization’s workspace configured and receiving incidents
Team Access
Your team members added with appropriate roles
Response Capabilities
Gamebook actions authorized and ready to use
Prerequisites
Required Access
| Requirement | Details |
|---|---|
| Microsoft 365 License | Business Premium, E3, or E5 with Defender capabilities |
| Global Administrator | Or Security Administrator role in Microsoft Entra ID |
| Azure Subscription Owner | Required only for XDR + SIEM module |
| ContraForce Account | Provided by ContraForce during contract setup |
For XDR + SIEM Module (Optional)
| Requirement | Details |
|---|---|
| Microsoft Sentinel | Active Sentinel workspace in your Azure subscription |
| Subscription Owner | To deploy Azure Lighthouse and Apollo resources |
| Resource Group Access | Ability to create resource groups in the subscription |
Step 1: Sign In to ContraForce
1
Navigate to ContraForce's Onboarding Workflow
2
Sign In with Microsoft
Click Sign in with Microsoft and use your organization credentials
3
Complete MFA
Complete any multi-factor authentication prompts
4
Accept Initial Permissions
Accept the basic sign-in permissions for the ContraForce Portal
First-time sign-in uses delegated permissions. Full platform access requires completing the onboarding wizard in the next steps.
Step 2: Create Your Organization Workspace
Your organization workspace is where your own security data lives—separate from any customer workspaces you may create later.1
Navigate to Workspaces
Click Workspaces in the left navigation
2
Create New Workspace
Click Create Workspace
3
Enter Workspace Details
- Name: Your organization name (e.g., “Acme Security Operations”)
- Description: Optional description
- Type: Select “Internal” for your own organization
4
Save Workspace
Click Create to provision the workspace
Step 3: Launch Onboarding Wizard
1
Open Workspace Settings
Click the gear icon on your new workspace
2
Go to Modules
Select the Modules tab
3
Start Onboarding
Click Configure or Start Onboarding Wizard
Step 4: Consent Core Enterprise Applications
The first consent step authorizes ContraForce to access your Microsoft environment.1
Click Consent for ContraForce API
Click the Consent button next to ContraForce API
2
Sign In as Global Admin
Sign in with your Global Administrator credentials
3
Review Permissions
Review the requested permissions:
- Read security events
- Read user profiles
- Read directory data
4
Accept on Behalf of Organization
Check Consent on behalf of your organization and click Accept
5
Repeat for ContraForce Portal
Complete the same consent flow for the ContraForce Portal application
Core Applications
| Application | Purpose |
|---|---|
| ContraForce API | Platform backend access to your security data |
| ContraForce Portal | User authentication and portal access |
Step 5: Select Your Module
Choose the module that matches your environment:- XDR Module
- XDR + SIEM Module
Choose XDR If:
- You have Microsoft 365 with Defender but no Sentinel
- You want the fastest deployment (~15 minutes)
- You don’t need custom detection rules or log search
What You Get:
- Defender XDR incident ingestion
- Entity enrichment (users, devices, IPs, files, emails)
- Gamebook response actions
- Endpoint visibility
Click “XDR” to continue
Step 6: Consent Module Applications
Based on your module selection, consent the required enterprise applications.Microsoft Defender Applications
| Application | Purpose | Required For |
|---|---|---|
| ContraForce for MDE | Read endpoint and incident data | All deployments |
| ContraForce Gamebooks for MDE | Execute endpoint response actions | Gamebook actions |
| ContraForce Gamebooks for Identity | Disable users, reset passwords | Identity response |
| ContraForce Gamebooks for Email | Quarantine/release emails | Email response |
Microsoft Sentinel Applications (SIEM Module Only)
| Application | Purpose |
|---|---|
| ContraForce Sentinel Hunting | Query Log Analytics for threat hunting |
1
Consent Each Application
Click Consent next to each application
2
Authenticate as Admin
Sign in with Global Admin credentials for each consent
3
Accept Permissions
Review and accept the requested permissions
4
Verify Green Checkmarks
Ensure all applications show a green checkmark indicating successful consent
Step 7: Deploy Azure Resources (Microsoft Sentinel Module Only)
Skip this step if you selected the XDR-only module.
1
Select Azure Subscription
Choose the subscription containing your Sentinel workspace
2
Select Sentinel Workspace
Choose your Microsoft Sentinel workspace from the dropdown
3
Deploy Apollo Infrastructure
Click Deploy to create the incident streaming infrastructure
4
Wait for Deployment
Deployment takes 2-5 minutes. Do not close the browser.
What Gets Deployed
| Resource | Purpose |
|---|---|
| Azure Lighthouse | Cross-tenant management delegation |
| Apollo Resource Group | Incident notification infrastructure |
| Logic App | Streams incidents to ContraForce |
| Role Assignments | Grants ContraForce access to Sentinel |
Azure Resources Reference
Complete list of deployed resources
Step 8: Authorize Gamebook Service Principals
Gamebooks require additional authorization to execute response actions in your environment.1
Navigate to Gamebook Authorization
In the onboarding wizard, proceed to the Gamebook authorization step
2
Click Authorize
Click Authorize for each Gamebook service principal
3
Consent as Admin
Complete the admin consent flow for each authorization
Gamebook Capabilities by Authorization
| Service Principal | Enables |
|---|---|
| MDE Gamebooks | Isolate device, run AV scan, collect investigation package |
| Identity Gamebooks | Disable user, reset password, revoke sessions |
| Email Gamebooks | Soft delete email, release from quarantine |
Step 9: Add Your Team
Now add your team members so they can access the platform.For Internal Security Teams
1
Go to Settings → User Management
Navigate to organization-level user management
2
Add Users
Click Add User and enter team member email addresses
3
Assign Organization Role
- Organization Admin for platform administrators
- Organization Member for analysts and engineers
4
Assign to Workspace
Go to your workspace settings → Users & Groups → Add each user with a workspace role
For Partners (Setting Up Parent Tenant)
1
Create Organization Groups
Go to Settings → User Management → Groups → Create groups like:
- SOC Tier 1
- SOC Tier 2
- SOC Managers
2
Add Team to Groups
Add your analysts and engineers to the appropriate groups
3
Assign Groups to Workspace
Go to your workspace → Settings → Users & Groups → Add your groups with roles
Recommended Roles
| Team Member | Workspace Role |
|---|---|
| Security Director / Manager | Admin |
| Senior Analyst | Incident Responder |
| Analyst | Incident Analyst |
| Security Engineer | Data Source Admin |
Roles & Permissions Reference
Complete role capabilities and permissions
Step 10: Verify Your Deployment
Confirm everything is working correctly.Verification Checklist
- Workspace shows “Active” status
- All enterprise applications show green checkmarks
- Module shows “Configured” status
- Team members can sign in and see the workspace
- Incidents are appearing on the Command Page (may take 5-15 minutes)
Test Gamebook Actions
1
Open an Incident
Click on any incident from the Command Page
2
Select an Entity
Click on a user, device, or IP entity
3
View Available Actions
Confirm Gamebook actions are available in the actions menu
Configure Notifications (SIEM Module)
If you deployed the SIEM module, configure email notifications:1
Go to Workspace Settings
Open your workspace → Settings → Notifications
2
Configure Severity Filters
Select which severity levels should trigger notifications
3
Save Settings
Click Save to apply notification preferences
Distribution Group Setup
To send notifications to a team inbox:- Contact [email protected]
- Provide the distribution group email address
- ContraForce Engineering will configure the routing
Notifications Configuration
Complete notification setup guide
Next Steps
- Internal Teams
- Partners
Troubleshooting
| Issue | Cause | Solution |
|---|---|---|
| Consent popup blocked | Browser popup blocker | Allow popups for portal.contraforce.com |
| Consent fails | Not Global Admin | Use Global Admin credentials |
| Azure deployment fails | Insufficient permissions | Verify Subscription Owner access |
| No incidents appearing | No active incidents in source | Check Defender/Sentinel for existing incidents |
| Team member can’t see workspace | No workspace role | Assign user to workspace with a role |
| Gamebook actions unavailable | Service principal not authorized | Complete Gamebook authorization step |
Getting Help
Contact Support
Email [email protected] for assistance
Request Onboarding Support
Schedule a call for hands-on help with your first deployment
Questions about platform onboarding? Contact us at [email protected].