Others

Can Microsoft Attack Simulation Training Email Admins on Phishing Clicks?

John Wilson Oct 13, 2026 868 views

Question details

The user wants to know if it is possible to configure automated email notifications to an administrator whenever a user clicks a link during a simulated phishing campaign.

Can Microsoft Attack Simulation Training Email Admins on Phishing Clicks?

Product: Microsoft Defender for Office 365
Device & OS: not provided
Scenario: Monitoring user interaction and response times during an active internal phishing simulation.
Observed behavior: The system does not natively send an immediate email alert to administrators upon individual user link clicks, requiring admins to check reports manually.

Before you start

Ensure you have global administrator or security administrator permissions in Microsoft 365 Defender to access campaign data and advanced hunting tools.

Solution 1Recommended

Use Built-In Simulation Reports

Since real-time email notifications for individual clicks are not natively provided, the most direct method is to monitor the built-in campaign reports in Microsoft Defender.

Microsoft Attack Simulation Training consolidates click data into a centralized reporting dashboard rather than spamming administrator inboxes with individual click notifications. This ensures large-scale simulations are easy to analyze.

Access Microsoft 365 Defender

Log in to the Microsoft 365 Defender portal and navigate to 'Email & Collaboration' in the left-hand menu, then select 'Attack simulation training'.

Open the Simulations tab

Click on the 'Simulations' tab to view a list of all active and completed phishing campaigns in your organization.

Review Campaign Insights

Select the specific simulation you wish to monitor. The detailed report will show you exactly which users clicked the payload, compromised their credentials, or reported the email.

Reporting Delay: Click telemetry typically appears in the dashboard within a few minutes, providing near real-time visibility without the need for individual emails.

Solution 2

Automate Alerts with Advanced Hunting and Power Automate

For organizations requiring automated notifications, you can use Defender's Advanced Hunting queries integrated with Power Automate to trigger custom admin emails.

Solution 3

Consider Third-Party Phishing Simulation Platforms

If granular, real-time email notifications to administrators are a strict organizational requirement, an alternative phishing platform may be necessary.

Free Microsoft Office alternative

Boost Your Productivity with WPS Office

While Microsoft Defender handles complex enterprise security and attack simulations, you might also be looking for a lightweight, cost-effective solution for everyday document management. WPS Office provides a robust suite for word processing, spreadsheets, and presentations without the heavy subscription costs.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight installation that runs smoothly on older devices.Built-in PDF editing tools for secure document management.Familiar, tabbed user interface for a seamless transition.

Frequently Asked Questions

Can I set up an alert policy in Microsoft 365 specifically for simulation clicks?

Microsoft 365 alert policies are generally designed for real security threats, such as malware detection or unusual volume alerts, rather than internal simulation training clicks. To track simulation clicks, you must rely on the Attack Simulation reports or use Advanced Hunting integrations.

Does Attack Simulation Training notify the user when they click a phishing link?

Yes, administrators can configure the simulation payload to display a custom landing page or an immediate educational training reminder to the user right after they click the simulated phishing link.

How long does it take for simulation clicks to appear in the Defender reports?

User interactions with simulated phishing links typically populate in the Microsoft 365 Defender reporting dashboard within a few minutes, providing near real-time tracking for administrators.

Office Quick Solutions