ContraForce Integration with Microsoft Sentinel
How Sentinel incidents and customer workspaces connect to governed service delivery.
Reviewed by ContraForce team
The ContraForce integration with Microsoft Sentinel applies governed investigation and response procedures to eligible Sentinel incidents across customer workspaces. Sentinel remains the SIEM and automation surface. ContraForce supplies the multi-tenant delivery workflow, agent execution, approvals, evidence, and service records.
Integration boundary
| System | Responsibility |
|---|---|
| Microsoft Sentinel | SIEM data, analytics, incidents, automation rules, and Logic Apps playbooks |
| ContraForce | Gamebook-governed investigation, response authority, cross-customer operations, ticketing, reporting, and tuning workflow |
| Human operator | Policy, approval, exception handling, customer communication, and accountability |
Microsoft describes Sentinel playbooks as workflows based on Azure Logic Apps. They can run automatically or on demand and interact with internal and external systems. See Automation in Microsoft Sentinel.
Delivery flow
- A Sentinel analytics rule or connected Microsoft signal produces an incident.
- ContraForce receives the incident from the configured customer workspace.
- A Security Delivery Agent follows the assigned Gamebook and gathers approved evidence.
- The agent records the verdict and selects actions permitted by the procedure.
- ContraForce can invoke supported native or external actions, subject to approval gates.
- The platform records the outcome and synchronizes the service workflow.
Deployment checklist
- Confirm the customer's Sentinel workspace and Defender portal onboarding state.
- Validate delegated access and the minimum required roles.
- Inventory analytics rules, automation rules, and Logic Apps playbooks.
- Identify the primary workspace for unified security operations.
- Map incident classes to Gamebooks and customer-specific approvals.
- Test the service ticket and evidence output.
- Revalidate the workflow after Microsoft portal or automation changes.
Portal transition
Microsoft states that Sentinel will no longer be supported in the Azure portal after March 31, 2027. Providers should test automation from the Defender portal and account for the documented differences in rule and playbook behavior.
Related pages
Continue the evaluation
Sources and review method
Product capabilities were reviewed against the page-specific primary sources below on 2026-11-05. Performance claims require the population and limitations stated in the linked methodology.
- Automation in Microsoft Sentinel (verified 2026-11-05)
- Manage Microsoft Sentinel workspaces at scale as an MSSP (verified 2026-11-05)
- ContraForce platform (verified 2026-11-05)
Related guides on Microsoft security operations
- ContraForce Integration with Microsoft Defender XDR, How incidents, evidence, approvals, and response actions move through the delivery loop.
- ContraForce Integration with ConnectWise PSA, How investigation results, response evidence, and ticket state synchronize with service delivery.
- Browse all integrations
- See how the ContraForce platform works
Ready to Transform Your Security Operations?
See how ContraForce runs the full delivery loop for service providers. Connect a supported tenant and validate the workflow in your own environment.
No credit card. Connect one workspace: scoped Entra ID application consent, no endpoint agents, no log forwarding.