Azure Resources Deployed

This article documents all Azure resources that ContraForce provisions during the onboarding process. Use this reference to understand what’s deployed in your environment, verify deployments, and plan for offboarding if needed.

The resources deployed depend on your module selection (XDR vs XDR + SIEM) and whether you enable AI Agents. Not all resources apply to every deployment.

Deployment Overview

ContraForce deploys resources across several Azure components:

Enterprise Applications

Service principals in Microsoft Entra ID for API access and authentication

Azure Lighthouse

Cross-tenant delegation for MSSP management scenarios

Apollo Infrastructure

Real-time incident notification system for Sentinel

Agent Infrastructure

AI agent hosting environment (optional)

Resources by Module

Resource Category	Defender Module	XDR + SIEM Module	With AI Agents
Core Enterprise Applications	✓	✓	✓
Defender Enterprise Applications	✓	✓	✓
Azure Lighthouse	—	✓	✓
Apollo Resource Group	—	✓	✓
Sentinel Resource Deployments	—	✓	✓
Agent Center Resource Group	—	—	✓
Per-Agent Resource Groups	—	—	✓

Phase 1: Initial Onboarding

The first phase provisions core enterprise applications required for all ContraForce deployments.

Enterprise Applications

These applications are provisioned and consented during initial setup:

Application	Application ID	Purpose
ContraForce API	`24d97bc0-8f2b-45d5-8e0b-7fe286732ef2`	Core platform API access
ContraForce Portal	`8b7cb435-9526-47ee-b79a-34433f0daad2`	User authentication and portal access

These two applications are required for all ContraForce deployments, regardless of module selection. They are consented when you first sign in at portal.contraforce.com, as separate ContraForce API and ContraForce Portal Microsoft consent prompts granted by a Global Administrator.

Permissions Granted

Application	Permission Type	Permissions
ContraForce API	Application	SecurityEvents.Read.All, User.Read.All
ContraForce Portal	Delegated	User.Read, openid, profile

Consent model. ContraForce enterprise applications are consented with application (app-only) Microsoft Graph permissions. Admin consent for Microsoft Graph application permissions must be granted by a Global Administrator — Cloud Application Administrator and Application Administrator cannot grant it. Global Administrator is required for the one-time consent only and is not retained; activate it just-in-time with Privileged Identity Management (PIM) and deactivate afterward.Because actions run as the application (no signed-in user required), operator control is enforced through Gamebook approval gates — only Workspace Owners can approve high-impact actions — and a complete audit trail in the Gamebooks History page.

Phase 2: Module-Specific Applications

Additional enterprise applications are consented based on your module selection and enabled features.

Microsoft Defender for Endpoint Applications

Application	Application ID	Purpose
ContraForce for MDE	`6efccc6a-f0d3-49e5-92d0-17d4afa9ba52`	Defender for Endpoint data access
ContraForce Gamebooks for MDE	`ad7b0e79-3c37-4408-bf8f-eb89522cc920`	Endpoint response actions

Identity Applications

Application	Application ID	Purpose
ContraForce Gamebooks for Identity	`36b0d51c-4c0f-4810-9cc4-bfbd40c7dd4a`	User response actions (disable, reset password)

Microsoft Sentinel Applications

Application	Application ID	Purpose
ContraForce Sentinel Hunting	`6bf1c74d-7ade-4671-a507-166936f89a1f`	Log Analytics queries for threat hunting

Email Applications

Application	Application ID	Purpose
ContraForce Gamebooks for Email	`44dbf6fe-45e3-48a3-bac3-f8d4cf1dba6d`	Email response actions (soft delete)

Phase 3: Microsoft Sentinel Core Components

For XDR + SIEM deployments, additional Azure resources establish the connection between your Sentinel environment and ContraForce.

This phase only applies to XDR + SIEM module deployments. XDR-only deployments skip this phase.

Azure Lighthouse Delegation

Azure Lighthouse enables cross-tenant management without credential sharing.

Resource	Type	Description
ContraForceLighthouseDeployment	ARM Template	Assigns Sentinel resource group to ContraForce tenant

What Lighthouse Enables

Cross-tenant visibility into your Sentinel workspace
Incident management without logging into your tenant
Centralized management for MSSPs

Azure Lighthouse delegates Azure resource access only (Sentinel Contributor + Reader on the Sentinel resource group). It does not delegate identity, mailbox, or endpoint response. Those capabilities are provided by the consented ContraForce enterprise applications in each tenant — through per-tenant application consent, or GDAP for CSP relationships. Azure Lighthouse is distinct from Microsoft 365 Lighthouse and from GDAP.

Azure Lighthouse is the Microsoft-recommended approach for MSSP scenarios. It provides secure delegated access without sharing credentials or creating guest accounts.

Role Assignments

Principal	Role	Scope
ContraForce API	Sentinel Contributor	Sentinel Resource Group
ContraForce API	Reader	Sentinel Resource Group

Resource Provider Registrations

The following resource providers are registered in your subscription:

Resource Provider	Purpose
Microsoft.Network	Network resources for Apollo deployment
Microsoft.Storage	Storage accounts for Apollo deployment

Phase 4: Apollo Resource Group

Apollo enables real-time Sentinel incident notifications. A dedicated resource group is created with supporting infrastructure.

Resource Group Details

Property	Value
Name	`rg-contraforce-apollo`
Purpose	Real-time incident notification infrastructure
Location	Same region as your Sentinel workspace

Resources Deployed

Compute Resources

Resource	Type	Purpose
Function App	Microsoft.Web/sites	Processes incident events
App Service Plan	Microsoft.Web/serverfarms	Hosts the Function App

Monitoring Resources

Resource	Type	Purpose
Log Analytics Workspace	Microsoft.OperationalInsights/workspaces	Apollo diagnostics and logging
Application Insights	Microsoft.Insights/components	Function App monitoring

Storage Resources

Resource	Type	Purpose
Storage Account	Microsoft.Storage/storageAccounts	Function App storage

Security Resources

Resource	Type	Purpose
Apollo Role Definition	Microsoft.Authorization/roleDefinitions	Custom role for Apollo access
Role Assignment	Microsoft.Authorization/roleAssignments	Apollo RG to Lighthouse delegation

Apollo Architecture

Phase 5: Sentinel Resource Group Deployments

Resources are also deployed directly into your existing Sentinel resource group to enable incident streaming.

Resources in Sentinel Resource Group

Resource	Type	Name
API Connection	Microsoft.Web/connections	`microsoftsentinel-Publish-Incident-To-Apollo`
Logic App	Microsoft.Logic/workflows	`Publish-Incident-To-Apollo`
Automation Rule	Microsoft.SecurityInsights/automationRules	`Run-Playbook-Publish-Incident-To-Apollo`

How Incident Streaming Works

Incident Created

A new incident is created in Microsoft Sentinel

Automation Rule Triggers

The Run-Playbook-Publish-Incident-To-Apollo automation rule detects the new incident

Logic App Executes

The Publish-Incident-To-Apollo Logic App is triggered

Incident Sent

The Logic App sends incident data to the Apollo Function App

ContraForce Updated

The incident appears in the ContraForce Command Page in near real-time

Phase 6: Agent Center Resource Group (Optional)

If you deploy ContraForce AI Agents, a dedicated resource group hosts the core agent infrastructure.

AI Agents are an optional feature. Most deployments do not include agent infrastructure. Skip this section if you haven’t enabled AI Agents.

Resource Group Details

Property	Value
Name	`rg-cf-agent-center`
Purpose	Core infrastructure for ContraForce AI agents
Location	Configured during agent deployment

Resources Deployed

AI Resources

Resource	Type	Purpose
AI Foundry	Microsoft.MachineLearningServices/workspaces	AI model management
CosmosDB	Microsoft.DocumentDB/databaseAccounts	Agent data storage

Compute Resources

Resource	Type	Purpose
Container Apps Environment	Microsoft.App/managedEnvironments	Agent runtime environment
Container App (Infrastructure)	Microsoft.App/containerApps	Infrastructure management
Log Analytics Workspace	Microsoft.OperationalInsights/workspaces	Container Apps logging

Network Resources

Resource	Type	Purpose
Virtual Network (VNET)	Microsoft.Network/virtualNetworks	Network isolation
Azure Subnet	Subnet	Container Apps subnet
Private Endpoint Subnet	Subnet	Private endpoints
Cosmos DNS Zone	Microsoft.Network/privateDnsZones	CosmosDB DNS resolution
Key Vault DNS Zone	Microsoft.Network/privateDnsZones	Key Vault DNS resolution
CosmosDB Private Endpoint	Microsoft.Network/privateEndpoints	Secure CosmosDB access
Key Vault Private Endpoint	Microsoft.Network/privateEndpoints	Secure Key Vault access

Security Resources

Resource	Type	Purpose
Key Vaults	Microsoft.KeyVault/vaults	Secret management
Managed Identity	Microsoft.ManagedIdentity/userAssignedIdentities	Container App authentication

Storage Resources

Resource	Type	Purpose
Storage Account	Microsoft.Storage/storageAccounts	Infrastructure management storage

Phase 7: Per-Agent Resource Groups (Optional)

A dedicated resource group is created for each AI agent deployed per workspace.

Resource Group Naming

Property	Pattern
Name Format	`rg-cf-agent-{agent-id}`
Example	`rg-cf-agent-abc123`

Resources Per Agent

Resource	Type	Purpose
AI Foundry Project	Microsoft.MachineLearningServices/workspaces/projects	Agent-specific AI project
OpenAI Model Deployment	Microsoft.CognitiveServices/accounts/deployments	LLM for agent reasoning
Container App	Microsoft.App/containerApps	Agent application runtime

Each workspace can have multiple agents, each with its own resource group. Monitor your Azure costs if you deploy many agents across many workspaces.

Complete Resource Summary

By Deployment Type

XDR Only
XDR + SIEM
With AI Agents

Enterprise Applications:

ContraForce API
ContraForce Portal
ContraForce for MDE
ContraForce Gamebooks for MDE
ContraForce Gamebooks for Identity
ContraForce Gamebooks for Email

Azure Resources: None

Enterprise Applications:

All XDR applications
ContraForce Sentinel Hunting

Azure Resources:

Azure Lighthouse delegation
Role assignments (Sentinel Contributor, Reader)
Apollo Resource Group (rg-contraforce-apollo)
Sentinel Logic App and API Connection
Sentinel Automation Rule

Enterprise Applications:

All XDR + SIEM applications

Azure Resources:

All XDR + SIEM resources
Agent Center Resource Group (rg-cf-agent-center)
Per-Agent Resource Groups (rg-cf-agent-*)

Enterprise Application Quick Reference

Application	App ID	Required For
ContraForce API	`24d97bc0-8f2b-45d5-8e0b-7fe286732ef2`	All deployments
ContraForce Portal	`8b7cb435-9526-47ee-b79a-34433f0daad2`	All deployments
ContraForce for MDE	`6efccc6a-f0d3-49e5-92d0-17d4afa9ba52`	Endpoint visibility
ContraForce Gamebooks for MDE	`ad7b0e79-3c37-4408-bf8f-eb89522cc920`	Endpoint response
ContraForce Gamebooks for Identity	`36b0d51c-4c0f-4810-9cc4-bfbd40c7dd4a`	User response
ContraForce Sentinel Hunting	`6bf1c74d-7ade-4671-a507-166936f89a1f`	Threat hunting
ContraForce Gamebooks for Email	`44dbf6fe-45e3-48a3-bac3-f8d4cf1dba6d`	Email response

Verifying Deployed Resources

Check Enterprise Applications

Open Entra ID

Navigate to entra.microsoft.com

Go to Enterprise Applications

Click Identity > Applications > Enterprise applications

Search for ContraForce

Search for “ContraForce” to see all provisioned applications

Verify Status

Each application should show “Enabled” status

Check Azure Resources

Open Azure Portal

Navigate to portal.azure.com

Search Resource Groups

Search for “contraforce” or “cf-agent” in resource groups

Verify Resources

Open each resource group and confirm expected resources exist

Check Role Assignments

Navigate to Sentinel Resource Group

Find your Sentinel resource group in Azure Portal

Open Access Control

Click Access control (IAM)

View Role Assignments

Click Role assignments tab

Find ContraForce

Search for “ContraForce” to verify assignments

Cost Considerations

Included Resources

Most ContraForce resources have minimal Azure cost impact:

Resource Type	Typical Cost
Enterprise Applications	Free
Azure Lighthouse	Free
Role Assignments	Free
Logic App (Consumption)	~$0.01-1/month
Function App (Consumption)	~$1-5/month

Potentially Significant Costs

AI Agent deployments can incur significant Azure costs depending on usage:

AI Foundry / OpenAI: Pay-per-token pricing
Container Apps: Compute costs based on usage
CosmosDB: Storage and throughput costs Monitor your Azure spending if you enable AI Agents.

Troubleshooting

Common Issues

Issue	Possible Cause	Solution
Missing enterprise apps	Consent incomplete	Re-run consent flow in workspace settings
Apollo resource group missing	Deployment failed	Check deployment history in Azure; contact support
Logic App not running	Disabled or failed	Enable the Logic App in Azure Portal
No incidents syncing	Automation rule disabled	Enable the automation rule in Sentinel
Role assignment missing	Manual removal	Re-run onboarding or manually add assignments

Viewing Deployment History

Open Subscription

Navigate to your Azure subscription

Go to Deployments

Click Deployments in the left navigation

Find ContraForce Deployments

Search for “ContraForce” or “Apollo”

Review Status

Check deployment status and error messages

Sentinel Onboarding

Complete SIEM module deployment guide

XDR Onboarding

Defender module deployment guide

Enterprise Applications

Service principal details and permissions

Questions about deployed resources? Contact us at support@contraforce.com.

​Deployment Overview

Enterprise Applications

Azure Lighthouse

Apollo Infrastructure

Agent Infrastructure

​Resources by Module

​Phase 1: Initial Onboarding

​Enterprise Applications

​Permissions Granted

​Phase 2: Module-Specific Applications

​Microsoft Defender for Endpoint Applications

​Identity Applications

​Microsoft Sentinel Applications

​Email Applications

​Phase 3: Microsoft Sentinel Core Components

​Azure Lighthouse Delegation

​What Lighthouse Enables

​Role Assignments

​Resource Provider Registrations

​Phase 4: Apollo Resource Group

​Resource Group Details

​Resources Deployed

​Apollo Architecture

​Phase 5: Sentinel Resource Group Deployments

​Resources in Sentinel Resource Group

​How Incident Streaming Works

​Phase 6: Agent Center Resource Group (Optional)

​Resource Group Details

​Resources Deployed

​Phase 7: Per-Agent Resource Groups (Optional)

​Resource Group Naming

​Resources Per Agent

​Complete Resource Summary

​By Deployment Type

​Enterprise Application Quick Reference

​Verifying Deployed Resources

​Check Enterprise Applications

​Check Azure Resources

​Check Role Assignments

​Cost Considerations

​Included Resources

​Potentially Significant Costs

​Troubleshooting

​Common Issues

​Viewing Deployment History

​Related Guides

Sentinel Onboarding

XDR Onboarding

Enterprise Applications

Deployment Overview

Resources by Module

Phase 1: Initial Onboarding

Enterprise Applications

Permissions Granted

Phase 2: Module-Specific Applications

Microsoft Defender for Endpoint Applications

Identity Applications

Microsoft Sentinel Applications

Email Applications

Phase 3: Microsoft Sentinel Core Components

Azure Lighthouse Delegation

What Lighthouse Enables

Role Assignments

Resource Provider Registrations

Phase 4: Apollo Resource Group

Resource Group Details

Resources Deployed

Apollo Architecture

Phase 5: Sentinel Resource Group Deployments

Resources in Sentinel Resource Group

How Incident Streaming Works

Phase 6: Agent Center Resource Group (Optional)

Resource Group Details

Resources Deployed

Phase 7: Per-Agent Resource Groups (Optional)

Resource Group Naming

Resources Per Agent

Complete Resource Summary

By Deployment Type

Enterprise Application Quick Reference

Verifying Deployed Resources

Check Enterprise Applications

Check Azure Resources

Check Role Assignments

Cost Considerations

Included Resources

Potentially Significant Costs

Troubleshooting

Common Issues

Viewing Deployment History

Related Guides