Skip to main content
A focused verification runbook to run after a customer admin finishes onboarding their workspace. Use it to confirm every part of the deployment is healthy before declaring the workspace go-live.
Who is this for?Service-provider operations and onboarding leads verifying a freshly onboarded customer workspace.
For the steps that come before this point (pre-onboarding the customer, the customer’s own onboarding journey), see:

Part 1: MSP Platform Onboarding

Pre-onboard the customer workspace

Part 2: Customer Workspace Onboarding

What the customer admin sees on their side

​
Core Verification

Run these checks first. Any failure here blocks go-live.
  • The customer workspace shows Active status (not Pending customer setup) in your Workspace Center
  • You received the Customer onboarding complete real-time notification in the portal
  • Open the customer’s workspace and confirm every pre-selected module shows Connected
  • Navigate to the Command Dashboard filtered to the customer workspace and verify incidents appear (allow 5 to 15 minutes for initial sync)
  • On the workspace’s Environments tab, confirm endpoints are onboarded and licenses are in place (Workspace Environments)
  • Open an incident and confirm the Workbench loads with entity context and timeline
  • Verify Gamebook response actions appear on incident entities (do not execute on production entities)
Don’t test response actions on production entities. Gamebook actions like “Isolate Device” or “Disable User” execute immediately. Use a test account or device if you want to verify functionality.

​
Sentinel-Specific Verification

Skip this section if the customer is on Defender-only.
  • Sentinel incidents are syncing alongside Defender for Endpoint incidents
  • Azure Lighthouse delegation completed successfully in the customer’s subscription
  • Supporting Azure infrastructure deployed by Sentinel consent shows Active
  • Open the workspace’s Content Management System (flask icon on the Microsoft Sentinel module) and confirm its analytics rules load
  • Log search is functional
Sentinel Azure infrastructure is provisioned in the background after the customer grants Sentinel consent. If verification fails, allow 5 to 10 extra minutes for the deployment to complete before retrying.

​
If Something Fails

For sign-in failures encountered by the customer admin, point them to the Customer onboarding sign-in failed troubleshooting.

​
After Verification Passes

Two follow-ups close out the onboarding.

​
Assign your team to the workspace

Use organization-level groups rather than individual users so future onboardings are consistent.

User & Group Management

Detailed user and group setup, including organization-level groups

​
Configure notifications (Sentinel only)

Notifications Configuration

Severity filters, distribution group setup, and test notification verification

​
Go-Live Communication

  • Notify the customer that ContraForce is live on their environment
  • Share relevant documentation links with the customer team
  • Confirm the customer knows how to reach your delivery team
  • Document any customer-specific configuration notes or permission exceptions
  • Schedule a follow-up check-in within 7 days to review initial incident volume and rule tuning

Workspace Environments

Review a workspace’s endpoints and licenses and which response actions each connection supports

Onboarding Workspaces

What service providers and customer admins each need, and how to confirm go-live

SLA Tracking

Set incident SLA targets per workspace and track first response and MTTR

Workspace Center

Manage workspace settings, modules, and access
Need help? Contact us at support@contraforce.com.
Last modified on October 8, 2026