ContraForce Integration with Microsoft Defender XDR

How incidents, evidence, approvals, and response actions move through the delivery loop.

Reviewed by ContraForce team

The ContraForce integration with Microsoft Defender XDR turns Defender incidents into governed security-delivery work. Defender remains the detection and response control. ContraForce applies the provider's Gamebook, gathers supported evidence, records a verdict, routes approvals, executes permitted actions, and synchronizes the service record.

Integration boundary

Delivery flow

1. Defender XDR creates or updates an incident.
2. ContraForce receives the eligible incident through the configured tenant connection.
3. A Security Delivery Agent follows the assigned Gamebook and queries approved evidence.
4. The agent records observations and reaches an auditable verdict.
5. Low-risk actions may run automatically; controlled actions stop for approval.
6. The final outcome and evidence synchronize to the configured service workflow.

Multitenant access

Microsoft's multitenant management model respects permissions granted by each managed tenant. Providers should grant only the roles and actions required for the agreed service. See Microsoft Defender multitenant management requirements.

Controls to validate

• Tenant connection and delegated relationship
• Read permissions for incidents, alerts, identities, devices, and relevant evidence
• Write permissions for incident state and comments
• Separate permission for containment or remediation actions
• Customer-specific approval gates
• Ticket board, priority, and closure mapping
• Failure behavior when an API, credential, or evidence source is unavailable

Proof-of-value test

Use an approved benign incident or simulation. Verify that the incident is acquired, the correct Gamebook runs, evidence remains tenant-scoped, the response authority is enforced, the ticket receives the expected record, and every action is attributable.

Related pages

• Microsoft Defender XDR for MSPs
• Automated incident response for Microsoft Defender XDR
• Defender portal multitenant management