Attack simulation training in Defender for Office 365

Attack simulation training runs harmless phishing simulations and assigns training based on how users react. It needs Microsoft 365 E5 or Defender for Office 365 Plan 2 (E3 gets a limited trial), and is at Email & collaboration > Attack simulation training.

Permissions. Global Administrator, Security Administrator or Attack Simulation Administrator (create and manage everything); Attack Payload Author (create payloads only, no reports); Security Operator and Security Reader (view only). Defender XDR Unified RBAC is not supported, there are no PowerShell cmdlets, and Attack Simulation Administrator cannot be added through Email & collaboration permissions role groups.

Techniques (mostly from MITRE ATT&CK): Credential Harvest, Malware Attachment, Link in Attachment, Link to Malware, Drive-by URL, OAuth Consent Grant, and How-to Guide. Credential Harvest, Link to Malware, Drive-by URL and OAuth Consent Grant can use links or QR codes.

Simulation wizard steps: technique, name, payload and login page, target users, exclusions, training, landing page, end-user notifications, launch details, review. Targeting can use all users, specific users and groups, imported CSV, or filters by user tags, city, country, department, title and suggested groups (such as users not targeted in three months, and repeat offenders); several categories combine with AND. Launch details allow immediate or scheduled start, an end date (default and minimum two days, maximum 30 days) and region aware time zone delivery.

Training campaigns assign training modules (over 70 built in, or a custom URL) without a simulation. The wizard covers name, target and excluded users, modules, notifications (assignment and reminder, weekly or twice a week) and schedule. The training threshold stops the same module being reassigned during a window of 90 days by default (0 removes it); statuses include Training Previously Assigned, Overdue and Not Completed. If you clear Send training with an end date, no reminders are sent. Reports show click rate, compromised rate and predicted compromise rate.

Messages reported using a non-Microsoft reporting tool are not captured in attack simulation reports. Attack simulation training works with on-premises mailboxes with reduced reporting.

Common trap: Attack Payload Author lets an admin run simulations and read reports - it permits only creating payloads; running simulations needs Attack Simulation Administrator or Security Administrator.

Get the whole book

This note is one section of Ultra Transcenders AB-650: Administering Microsoft 365 and AI Services, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

About the book · AB-650 terms in the glossary · All AB-650 study notes