In short: Attack Simulation Training licensing requires Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, either included in a suite or bought as an add-on. Microsoft 365 E3 customers get only a trial subset: the Credential Harvest payload plus two training experiences. Defender for Office 365 Plan 1, included in Business Premium, does not include it.
Which licences include Attack Simulation Training
| Licence | Attack Simulation Training |
|---|---|
| Microsoft 365 E5 | Included (contains Defender for Office 365 Plan 2) |
| Microsoft Defender for Office 365 Plan 2 (add-on) | Included |
| Microsoft 365 E3 | Trial subset only (see below) |
| Microsoft Defender for Office 365 Plan 1 (for example within Microsoft 365 Business Premium) | Not included |
| Exchange Online Protection only | Not included |
Microsoft describes Attack Simulation Training as a feature of Defender for Office 365 Plan 2, whether bought as an add-on or included in a subscription such as Microsoft 365 E5. The full parent page explains what Attack Simulation Training does.
What the Microsoft 365 E3 trial gives you
E3 organisations see Attack Simulation Training in the Defender portal, but only a small part of it works. Microsoft limits the E3 trial offering to:
- The Credential Harvest payload
- The 'ISA Phishing' and 'Mass Market Phishing' training experiences
No other capabilities are included: no other techniques, no simulation or payload automations, and no wider training library. The trial is enough to run a basic credential phishing test and see how the portal works, but not to run a year-round programme.
If you want to try the full feature set first, Microsoft also offers a 90-day Defender for Office 365 trial through the trials hub in the Defender portal, subject to Microsoft's eligibility terms.
Licensing the users you target
Microsoft's licensing terms for Defender for Office 365 set out which users need to be licensed. In practice, plan to license every user you intend to include in simulations and training, and check the current Defender for Office 365 service description before you buy, because Microsoft updates its terms.
Microsoft also notes that reports stay empty if no active user has an E5 licence assigned, and that audit logging must be switched on for events to be recorded. Both are worth checking if you are mixing licence types across your organisation.
UK availability and data
Attack Simulation Training is available in the UK: Microsoft lists Great Britain (GBR) among the countries where the service is offered. Simulation and training data is stored with your other Microsoft 365 customer data, in line with Microsoft 365 data location commitments.
Mailboxes hosted on-premises can be included in simulations, but with reduced reporting: read, forwarded, deleted and reported events are not available for them.
Is Plan 2 worth it just for Attack Simulation Training?
Plan 2 is more than a training tool. It also adds investigation and response features to email security, such as threat hunting and automated investigation, so the decision is usually about your overall Microsoft 365 security rather than training alone.
If you only need awareness training, a dedicated platform or the add-on from your existing email security vendor may be a better fit. We compare those fairly in alternatives to Microsoft Attack Simulation Training and in our platforms compared table.
Choosing a licensing route
There are three common routes, and the right one depends on what else you need from Microsoft:
| Route | Makes sense when | Things to weigh up |
|---|---|---|
| Move to Microsoft 365 E5 | You also want E5's wider security, compliance and analytics features | A bigger change to your agreement than training alone justifies |
| Add Defender for Office 365 Plan 2 | You want Plan 2 email security features and Attack Simulation Training without a suite change | License the users you plan to include |
| Use another platform | You only need awareness training, or you use another email security vendor | Another console, but often more automation and extras |
Our security awareness training cost guide explains what drives the cost of each route, without guesswork about list prices. If budget is tight, the free security awareness training page covers what the NCSC offers at no cost, and where it stops.
How we help
We review your current Microsoft licences, tell you whether you already own Attack Simulation Training, and model the options: Plan 2 add-ons, a move to E5, or an alternative platform. For Microsoft licence changes, see our Microsoft licensing service. Pricing depends on your agreement and user numbers, so ask us for a quote.
Contact us for a licence review.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Do I need Microsoft 365 E5 for Attack Simulation Training?
You need either Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2. Plan 2 can be added as an add-on licence if you do not want to move to E5.
Does Microsoft 365 Business Premium include Attack Simulation Training?
No. Business Premium includes Defender for Office 365 Plan 1, which does not include Attack Simulation Training. You would need Defender for Office 365 Plan 2 licences.
What can E3 customers do in Attack Simulation Training?
E3 customers get a trial subset: the Credential Harvest payload and the 'ISA Phishing' and 'Mass Market Phishing' training experiences. No other capabilities are part of the E3 trial.
Can we trial the full version of Attack Simulation Training?
Microsoft offers a 90-day Defender for Office 365 trial through the trials hub in the Defender portal, subject to its eligibility terms. It lets you try Plan 2 features, including Attack Simulation Training.