Others

How to Remove Attack Simulation Training Assignments in Microsoft 365

Elise Williams Oct 1, 2026 869 views

Question details

The administrator needs to remove phishing simulation training assignments for specific users while the campaign is still active.

How to Remove Attack Simulation Training Assignments in Microsoft 365

Product: Microsoft 365 Defender
Device & OS: not provided
Scenario: Managing user training requirements after a simulated phishing campaign.
Observed behavior: Users who clicked the phishing link were automatically assigned training, and the admin is seeking a way to exempt or remove selected users from this active assignment.

Before you start

Ensure you have global administrator or security administrator privileges in the Microsoft 365 Defender portal before attempting to modify campaign or training settings.

Solution 1Recommended

Manage Training Assignments via Defender Portal and Microsoft Q&A

Currently, removing individual users from an active simulation training campaign requires advanced administrative handling. Microsoft recommends seeking specialized support for this exact scenario.

In Microsoft 365 Defender, Attack Simulation Training automatically assigns educational modules to users who interact with a simulated phishing payload. Because these assignments are tightly integrated into the active campaign's reporting metrics, removing individual users mid-simulation is not supported through standard UI toggles.

To address this, administrators must consult specialized Microsoft Defender resources.

Check the Microsoft 365 Defender portal

Log in to the Microsoft 365 Defender portal, navigate to 'Email & collaboration' in the left menu, and select 'Attack simulation training' to view your active campaigns.

Review active campaign settings

Click on your active simulation to review the participant list and assigned trainings. Verify if your current licensing and portal version offers an exemption option for the specific users.

Seek advanced support on Microsoft Learn Q&A

Since modifying individual active assignments is outside the scope of standard community support, visit the Microsoft 365 Q&A section on Microsoft Learn. Post your specific tenant scenario there to get specialized guidance from Microsoft Defender experts.

Manage Training Assignments via Defender Portal and Microsoft Q&A

Scope of Support: Standard community support does not cover advanced Defender configurations. Microsoft Learn Q&A is the official channel for Attack Simulation Training queries and administrative procedures.

Free Microsoft Office alternative

Discover WPS Office for Your Daily Productivity Needs

While advanced enterprise security features like Attack Simulation Training are managed exclusively through Microsoft 365 admin portals, you might be looking for a lighter, cost-effective solution for your everyday document, spreadsheet, and presentation tasks. WPS Office is a free, highly compatible alternative to Microsoft Office.

1. Download the installer: Visit the official WPS Office website and click the Free Download button.
2. Install the software: Run the downloaded installer and follow the quick on-screen instructions to set up the suite.
3. Open existing Office files: Launch WPS Office and directly open your Microsoft Office files; they will load with formatting intact.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Lightweight installation with a familiar, easy-to-navigate user interface.Completely free for standard daily office tasks without expensive subscriptions.Built-in PDF editing and seamless cloud collaboration features.

microsoft office alternative - wps office

Frequently Asked Questions

Can I manually mark an Attack Simulation Training as complete for a user?

In standard Microsoft 365 Defender setups, administrators cannot manually mark a training module as complete. The user must successfully finish the assigned interactive module for their status to update in the campaign reports.

Why did users get assigned training automatically?

When setting up the phishing simulation campaign, the administrator likely enabled the automated training payload. This option automatically assigns specific educational modules to users who fall for the simulated attack, such as clicking a malicious link or entering credentials.

How do I access Attack Simulation Training reports?

Go to the Microsoft 365 Defender portal, navigate to Email & collaboration, select Attack simulation training, and click on the 'Reports' tab. Here you can view detailed campaign metrics, user click rates, and training completion statuses.

Is it possible to exclude certain users from future simulations?

Yes. During the creation of a new attack simulation campaign, you can specify targeted user groups and intentionally exclude specific users or entire departments from receiving the phishing test emails.

Office Quick Solutions