Who is this for?
- Customer security or IT admins finishing the workspace their MSP/MSSP started for them
- Global Administrators in the customer’s Microsoft Entra tenant who need to grant ContraForce access
Prerequisites
| Requirement | Why |
|---|---|
| Microsoft Entra Global Administrator | Required to grant ContraForce consent. Microsoft Graph app-only permissions can only be granted by a Global Administrator |
| Invite email from your service provider | The link in this email is your onboarding entry point |
Pop-ups allowed for portal.contraforce.com | The Microsoft consent prompts open in a popup window |
| Azure Subscription Owner | Only if you’ll deploy the Microsoft Sentinel module, which deploys supporting Azure infrastructure |
How onboarding works
Your service provider has already created your workspace and pre-selected the Detection and Response modules you need. Your job is to sign in, grant ContraForce access to your tenant, and grant Consent for each module on the Modules tab. There’s no completion screen to wait for. Your workspace is onboarded when its status light turns green on its card in the Workspace Center. Your service provider receives a real-time notification the moment your workspace goes live.Step 1: Grant ContraForce Access to Your Tenant
When you click the link in your invite email, you’ll be redirected to Microsoft to sign in. The first time anyone from your organization signs in, a Global Administrator must approve the core ContraForce app. ContraForce requests two core consents — ContraForce API and ContraForce Portal — as two separate Microsoft consent prompts. Accept both.Click the invite link
Open the email from your service provider and click the onboarding link. You’ll be taken to portal.contraforce.com.
Sign in as a Global Administrator
You’ll be redirected to Microsoft. Sign in with your Global Admin credentials.
Review and accept the ContraForce API consent
Microsoft displays a consent screen listing the permissions ContraForce needs to read security data from your tenant. Check Consent on behalf of your organization and click Accept.
Step 2: Consent to Your Modules
After the core consents are granted, open your workspace and go to the Modules tab. The modules your service provider pre-selected are already listed for you — you just grant Consent for each one.Open your workspace
From the Workspace Center, open the workspace your service provider created for you.
Go to the Modules tab
Each pre-selected detection and response module appears here with a Consent action.
Microsoft Sentinel customers: Consenting to the Sentinel module automatically deploys the supporting Azure infrastructure in your subscription, including the Azure Lighthouse delegation, the Apollo resource group, and the Sentinel-side automation. You don’t need to run a separate Azure deployment step. To deploy Sentinel, you must be an Azure Subscription Owner. Allow a few minutes for resources to appear.
Step 3: Confirm Your Workspace Is Live
There’s no completion screen. Your workspace is onboarded when its status light turns green on its card in the Workspace Center.| Status light | What it means |
|---|---|
| Blue | Pre-onboarded — your service provider created the workspace and invited you |
| Amber | A module or agent is still missing — finish consenting to your modules |
| Green | Onboarded and live — incidents will begin to flow in |
Adding Users (After Onboarding)
Adding users is not part of onboarding. Once your workspace is live, add teammates from Settings → User Management using the Invite people to the organization dialog. Manage groups from Settings → Group Management.Troubleshooting: Sign-in Failed
If you click your invite link and see a Sign In Failed page, it’s almost always because:- You aren’t a Global Administrator and ContraForce hasn’t been pre-approved for your tenant yet
- A previous sign-in attempt got into a bad state
What to do
If you're a Global Admin, click Try Again
Sign in. Microsoft will show the consent screen. Accept both core consents, and you’ll proceed into your workspace.
Next Steps
Defender for Endpoint Module
Deploy and consent to the Defender for Endpoint module
Command Dashboard
Your home base for incident triage across your environment
Incident Management
How to triage, investigate, and respond to incidents
What Are Gamebooks?
Automated response workflows you can run from any incident
Need help? Contact us at support@contraforce.com.