> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace Onboarding Verification Checklist

> Verify a newly onboarded customer workspace before go-live: check module connections, incident sync, Gamebook actions, and Microsoft Sentinel setup.

A focused verification runbook to run **after a customer admin finishes onboarding their workspace**. Use it to confirm every part of the deployment is healthy before declaring the workspace go-live.

<Info>
  **Who is this for?**

  Service-provider operations and onboarding leads verifying a freshly onboarded customer workspace.
</Info>

For the steps that come before this point (pre-onboarding the customer, the customer's own onboarding journey), see:

<CardGroup cols={2}>
  <Card title="Part 1: MSP Platform Onboarding" icon="building-shield" href="/guides/onboarding/platform-onboarding">
    Pre-onboard the customer workspace
  </Card>

  <Card title="Part 2: Customer Workspace Onboarding" icon="user-check" href="/guides/onboarding/customer-workspace-onboarding">
    What the customer admin sees on their side
  </Card>
</CardGroup>

***

## Core Verification

Run these checks first. Any failure here blocks go-live.

* The customer workspace shows **Active** status (not **Pending customer setup**) in your Workspace Center
* You received the **Customer onboarding complete** real-time notification in the portal
* Open the customer's workspace and confirm every pre-selected module shows **Connected**
* Navigate to the **Command Dashboard** filtered to the customer workspace and verify incidents appear (allow 5 to 15 minutes for initial sync)
* On the workspace's **Environments** tab, confirm endpoints are onboarded and licenses are in place ([Workspace Environments](/guides/getting-started/workspace-environments))
* Open an incident and confirm the **Workbench** loads with entity context and timeline
* Verify Gamebook response actions appear on incident entities (do not execute on production entities)

<Warning>
  **Don't test response actions on production entities.** Gamebook actions like "Isolate Device" or "Disable User" execute immediately. Use a test account or device if you want to verify functionality.
</Warning>

***

## Sentinel-Specific Verification

Skip this section if the customer is on Defender-only.

* Sentinel incidents are syncing alongside Defender for Endpoint incidents
* Azure Lighthouse delegation completed successfully in the customer's subscription
* Supporting Azure infrastructure deployed by Sentinel consent shows **Active**
* Open the workspace's **Content Management System** (flask icon on the Microsoft Sentinel module) and confirm its analytics rules load
* Log search is functional

<Note>
  Sentinel Azure infrastructure is provisioned in the background after the customer grants Sentinel consent. If verification fails, allow 5 to 10 extra minutes for the deployment to complete before retrying.
</Note>

***

## If Something Fails

| Symptom | Likely cause | Where to look |
| - | - | - |
| Workspace stuck in **Pending customer setup** | Customer hasn't finished consenting their modules | Resend the invite or contact the POC |
| Module shows **Not Connected** in the customer's view | Consent skipped or denied | Customer clicks **Consent** on the module from their workspace's **Modules** tab ([Step 2: Consent to Your Modules](/guides/onboarding/customer-workspace-onboarding#step-2-consent-to-your-modules)) |
| No incidents appearing after 30 minutes | No active incidents in source system | Check Defender, Sentinel, or CrowdStrike console for existing incidents |
| Sentinel infrastructure didn't deploy | Insufficient Azure permissions | Verify customer admin has Subscription Owner |
| Gamebook actions unavailable on entities | Response module not connected | Customer reconnects the response module from their Modules tab |

For sign-in failures encountered by the customer admin, point them to the [Customer onboarding sign-in failed troubleshooting](/guides/onboarding/customer-workspace-onboarding#troubleshooting-sign-in-failed).

***

## After Verification Passes

Two follow-ups close out the onboarding.

### Assign your team to the workspace

Use organization-level groups rather than individual users so future onboardings are consistent.

| Role | Best for |
| - | - |
| Owner | Team leads, workspace owners |
| Incident Responder | SOC analysts who need response capabilities |
| Incident Analyst | Junior analysts who work incidents and request approval to run Gamebooks |
| Workspace Reader | Stakeholders who need read-only access |
| Content Admin | Detection engineers (Sentinel only) |

<Card title="User & Group Management" icon="users" href="/guides/general-support/user-group-management">
  Detailed user and group setup, including organization-level groups
</Card>

### Configure notifications (Sentinel only)

<Card title="Notifications Configuration" icon="bell" href="/guides/technical/notifications-configuration">
  Severity filters, distribution group setup, and test notification verification
</Card>

***

## Go-Live Communication

* Notify the customer that ContraForce is live on their environment
* Share relevant documentation links with the customer team
* Confirm the customer knows how to reach your delivery team
* Document any customer-specific configuration notes or permission exceptions
* Schedule a follow-up check-in within 7 days to review initial incident volume and rule tuning

***

## Related Guides

<CardGroup cols={2}>
  <Card title="Workspace Environments" icon="server" href="/guides/getting-started/workspace-environments">
    Review a workspace's endpoints and licenses and which response actions each connection supports
  </Card>

  <Card title="Onboarding Workspaces" icon="rocket" href="/onboarding-customer-workspaces">
    What service providers and customer admins each need, and how to confirm go-live
  </Card>

  <Card title="SLA Tracking" icon="stopwatch" href="/guides/getting-started/sla-tracking">
    Set incident SLA targets per workspace and track first response and MTTR
  </Card>

  <Card title="Workspace Center" icon="building" href="/guides/getting-started/workspace-manager">
    Manage workspace settings, modules, and access
  </Card>
</CardGroup>

***

<Note>
  **Need help?** Contact us at [support@contraforce.com](mailto:support@contraforce.com).
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.