In short: To set up Attack Simulation Training, confirm you have E5 or Defender for Office 365 Plan 2 and audit logging is on, assign least-privilege roles, exclude simulation URLs from third-party filters, then launch a simulation: choose a technique, payload, targets, training, landing page and notifications. Afterwards, add simulation automations, training campaigns and regular report reviews.
Before you start: four checks
- Licensing: confirm the users you will target have Microsoft 365 E5 or Defender for Office 365 Plan 2. E3 only gives a trial subset; see Attack Simulation Training licensing.
- Audit logging: it is on by default, but if someone has turned it off, reports stay empty and training assignments are blocked.
- Roles: give the people running simulations the Attack Simulation Administrator role, and anyone who only writes payloads the Attack Payload Author role. Avoid using Global Administrator for day-to-day work.
- Communication: agree with leadership and HR that simulations will run, how results will be used and that the approach is supportive, not punitive. See security culture.
Prepare mail flow and browsers
Simulations arrive through Microsoft's own mail flow, but other tools can still interfere. Before your first campaign:
- Third-party filters: if mail passes through a non-Microsoft gateway, or you use endpoint, proxy or browser security tools that inspect links, exclude the Attack Simulation Training URLs and domains (and any domains you use in custom payloads). Otherwise those tools can block messages or create false clicks.
- Browsers: Google Safe Browsing can flag some simulation URLs in Chrome. Test the URLs you plan to use and allow them through Chrome Enterprise policy if needed.
- Reporting: if staff report suspicious email to a custom reporting mailbox, configure that mailbox as Microsoft describes so reported simulations are not detonated and mis-scored. Check no mail flow rules block reports to Microsoft.
- Security operations mailbox: if you have one, add it to the advanced delivery policy so it receives messages unfiltered.
Microsoft does not send simulations from a fixed list of IP addresses, so exclusions are based on URLs and domains.
Launch your first simulation
In the Defender portal, open Email & collaboration > Attack simulation training, go to Simulations and choose Launch a simulation. The wizard then walks through these pages:
- Select technique: start simple, usually Credential Harvest.
- Name simulation: use a clear naming scheme, such as month, audience and technique.
- Select payload and login page: pick a built-in payload, or copy one and adapt it to UK context. Use Send a test to check it in your own inbox.
- Target users: use Microsoft Entra groups rather than long lists; they are easier to maintain. Shared mailboxes and guests are not supported.
- Exclude users: leave out anyone who should not receive a test, such as people on leave.
- Assign training: let Microsoft assign training based on previous results, or choose modules yourself, and set a due date.
- Select landing page: choose what users see after opening the payload; a short explanation of the warning signs works best.
- Select end-user notifications: training assignment, reminders and a positive reinforcement message for people who report.
- Launch details: set start and end dates. Region aware delivery sends at the same local time in each user's mailbox time zone.
- Review simulation: check every section, then submit.
Go beyond single simulations
Once your baseline is done, use the features that make the programme run itself:
- Simulation automations: combine several techniques and payloads in one automation and randomise delivery, so colleagues do not all receive the same email at once.
- Payload automations: harvest harmless copies of real phishing detected in your tenant and use them as payloads.
- Training campaigns: assign training without a simulation, for example a monthly module for everyone or an induction for new starters.
- QR code simulations: add QR code payloads and the built-in QR training modules; see QR code phishing awareness.
- Global settings: review the repeat offender threshold (two consecutive compromises by default) and the training threshold, which stops the same training being reassigned within 90 days by default.
Read the reports
Report data starts to appear a few minutes after users begin interacting with a simulation and builds up over the following days, so do not judge a campaign in its first hour.
- Simulation reports show delivery, reads, reports, clicks, credential entry and training completion per user
- Overview widgets show your trend after each completed campaign
- Predicted compromise rate helps you separate a hard payload from a genuine weakness
- Export or use the Microsoft Graph API to feed board packs and insurer evidence
Focus on report rate and time to report, not just clicks. Our guide to measuring security awareness training effectiveness suggests a simple board template.
Common set-up mistakes
- Clicks recorded seconds after delivery: usually a link-scanning tool, not a person. Add exclusions.
- Reported simulations scored as failures: the reporting mailbox is not configured to skip detonation.
- Empty reports: audit logging is off, or no active user has an E5 licence.
- Every test is the same difficulty: vary payloads and use the predicted compromise rate.
- Tests with no follow-up: always assign short training and celebrate reporting.
If you would rather not run it yourself, we can set up and operate Attack Simulation Training for you as managed security awareness training. Contact us for help with set-up or a health check of an existing configuration.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What role do I need to run Attack Simulation Training?
The Attack Simulation Administrator role can create and manage all aspects of simulations. The Attack Payload Author role can only create payloads. Security Administrator also works, but follow least privilege.
Can I manage Attack Simulation Training with PowerShell?
No. There are no PowerShell cmdlets for Attack Simulation Training. You manage it in the Defender portal, and read and write scenarios are supported through the Microsoft Graph API.
Why do users show clicks they did not make?
Other security tools that inspect links, such as email gateways, endpoint software or automated playbooks, can open simulation links and generate click events. Exclude the simulation URLs and domains in those tools.
Can I send a test simulation to myself first?
Yes. On the Review simulation page of the wizard, Send a test delivers a sample simulation message to the signed-in admin so you can check it before launching.
How long is Attack Simulation Training data kept?
Microsoft keeps simulation and user activity data for 18 months unless an admin deletes the simulation first.