Onboarding 50 Workspaces in a Week — Without Hiring

A real playbook from a partner who took on a 50-customer book of business in five days, using the same team that previously managed twelve.

Related: What Are Security Delivery Agents? The Next Evolution Beyond SOAR | Automated Incident Response for Microsoft Defender XDR | Beyond Azure Lighthouse: What MSSPs Need for Sentinel at Scale | ContraForce vs Microsoft Security Copilot: What MSSPs Need to Know | The MSSP Platform Built for Microsoft Sentinel + Defender XDR

Onboarding 50 Workspaces in a Week — Without Hiring

One of our partners closed a deal last quarter that would have been impossible eighteen months ago. They took on the security book for an acquired MSP — fifty new customer workspaces, all on Microsoft 365, mostly Defender for Business with a handful on E5. They had to be operational in five days because the contractual transition window left no slack. They had twelve analysts. They didn’t hire anyone.

Here’s how they did it.

Day 1: Connect everything, configure nothing

The first day was pure plumbing. ContraForce connects to a Microsoft tenant via federated access — no agents to deploy, no log forwarders, no data movement. The team scripted the connection across all fifty workspaces and confirmed signal flow into ContraForce. By end of day, every customer workspace was visible in the control plane, even though no Gamebooks were running yet.

Day 2: Pick the four Gamebooks that cover 80% of the volume

Instead of trying to migrate all of their SOPs at once, they picked the four Gamebook templates that covered the highest-volume incident types: phishing triage, credential harvest, impossible travel, and unusual mailbox forwarding. ContraForce ships templates for these. They customized the approval gates and the customer ticket fields, and that was the entire Day 2 deliverable.

Day 3: Activate in shadow mode

The Gamebooks ran across all fifty workspaces in shadow mode for a full day. Agents triaged, investigated, and proposed actions, but did not execute response steps. Every proposed action was reviewed by an analyst. The shadow run surfaced two SOP gaps and one Gamebook customization issue, all of which were fixed before the next morning.

Day 4: Cut over

By Day 4, Gamebooks were executing autonomously across all fifty workspaces, with human-in-the-loop approval for any step that affected user accounts or device state. The analyst team’s job had shifted from doing the work to supervising the agents doing the work.

Day 5: Onboard the customer-facing rituals

The last day was about the customer experience — making sure ticket templates matched the new MSSP’s style, scheduling the first weekly review, and confirming reporting formats. The infrastructure was already running.

Throughput per analyst at the end of week one was roughly 4× their previous baseline. Cost per incident dropped 88% on the new book. The same team that previously ran twelve workspaces was now running sixty-two.

If you’re looking at an acquisition or a large new customer wave, this is the math that should matter. Onboarding speed is no longer constrained by hiring.