Would your colleague click a fake email from "IT support" and type in their password? With Attack simulation training in Microsoft Defender for Office 365 you test that safely: you send a realistic phishing email, see who clicks or enters credentials and give those people a short training straight away. This article covers what you need, how to set up a simulation and how to use the results without naming and shaming anyone.
Licence and roles
Attack simulation training is part of Microsoft Defender for Office 365 Plan 2. It's included in Microsoft 365 E5 and available as an add-on. Plan 1 or Business Premium alone doesn't give you the feature. To try it first, start a Defender for Office 365 trial from the Defender portal.
You don't need to be a Global Administrator. These Microsoft Entra roles are enough:
- Attack Simulation Administrator: creates and manages simulations, training campaigns and automations.
- Attack Payload Author: only creates payloads (emails) that an admin launches later.
- Security Administrator has full access. Security Reader and Security Operator can only view.
Launch a simulation
- Go to security.microsoft.com > Email & collaboration > Attack simulation training.
- Open the Simulations tab and select Launch a simulation.
- Choose a technique (see below) and give the simulation a clear name.
- Choose a payload: a ready-made email from the library or your own, ideally in your users' language and tailored to your organization.
- Choose the target users. Start with a test group, such as the IT team, before including everyone. You can also exclude users.
- Choose the training users get if they fall for it, and its due date.
- Pick a landing page (what people see after clicking) and the end user notifications.
- Schedule the launch and end date, review the summary and select Submit.
The techniques
- Credential Harvest: a link to a fake sign-in page. The most common and recognizable test.
- Malware Attachment: an attachment users have to open.
- Link in Attachment: an attachment containing a link to a fake sign-in page.
- Link to Malware: a link to a file on a well-known file-sharing site.
- Drive-by URL: a link to a website that could silently run code.
- OAuth Consent Grant: a fake app asking for permission to your data.
- How-to Guide: not a test, but an email teaching users how to report phishing.
Read the results
Each simulation shows who received the email, opened it, clicked the link, entered credentials or reported it as phishing. Track reporting in particular: that's the behaviour you want to see. The predicted compromise rate compares your result with what Microsoft expected for that payload, and the training view shows who completed their assigned course.
Automate it
With simulation automations you schedule a series of simulations with varying techniques and payloads, for example one a month. With training campaigns you assign training without a simulation, which is handy for new hires or a yearly refresher.
Common problems
- Clicks nobody made: a third-party email filter, Outlook add-in or antivirus product opens links automatically. A click a few seconds after delivery is the giveaway. Microsoft recommends excluding the simulation URLs and domains in those tools. Allowing by IP address doesn't work.
- Reports don't count: in the Defender portal, check Settings > Email & collaboration > User reported settings and make sure the built-in Report button in Outlook is enabled.
- Reports still missing: an Exchange mail flow rule can block messages to Microsoft's reporting addresses. Review your rules.
Tips
- Tell management and HR you run simulations, and communicate the goal up front: learning, not punishing.
- Make reporting easy. How that works is in report spam and phishing in Outlook.
- Repeat simulations a few times a year, with different techniques and difficulty levels.
- Tie the results into your broader approach, such as the security measures for remote work.
FAQ
Do users know it's a test?
Only after they click or once it ends, through the landing page and notifications you choose.
Can I stop a simulation?
Yes, you can cancel a scheduled or running simulation. Users who already entered credentials still count as compromised in the report.
Is there PowerShell support?
There are no PowerShell cmdlets for Attack simulation training. You work in the Defender portal.
Nederlandstalige versie: Een phishingsimulatie uitvoeren in Microsoft Defender