Security Policy Errors

Fix Microsoft Attack Simulation Training Not Enrolling New Users

Guest Writer Oct 8, 2026 870 views

Question details

New users added to a security group are not automatically receiving access to an existing Microsoft Attack Simulation Training assignment.

How to Automatically Enroll New Users in Microsoft Attack Simulation Training

Product: Microsoft Defender for Office 365
Device & OS: not provided
Scenario: Onboarding new employees and attempting to automatically assign them to active security training campaigns.
Observed behavior: Newly added members of a security group are not automatically enrolled in the active training assignment, requiring administrators to manually create separate assignments.

Before you start

Ensure you have administrative privileges for both Microsoft Entra ID (to manage groups) and Microsoft Defender for Office 365 (to configure attack simulation campaigns).

Solution 1Recommended

Configure Dynamic Security Groups in Microsoft Entra ID

Create a dynamic security group that automatically updates its membership based on defined user attributes, and ensure the simulation campaign is configured to support dynamic updates.

If you assign training to a static group, new users added later may not be swept into ongoing, active campaigns. Using a dynamic security group ensures that when a new user profile meets your specific criteria (like department, role, or hire date), they are automatically added to the group.

Access Microsoft Entra ID

Log into the Microsoft Entra admin center, navigate to 'Identity', and select 'Groups' followed by 'All groups'.

Create a Dynamic Group

Click 'New group'. Under 'Membership type', select 'Dynamic User'. Enter the group name and description.

Configure Dynamic Queries

Click 'Add dynamic query' and set up rules based on user attributes (for example, targeting new hires or specific departments), then save the group.

Assign to Simulation Campaign

Go to the Microsoft Defender portal, navigate to 'Email & collaboration' > 'Attack simulation training', and assign your newly created dynamic group to your active training campaign.

Configure Dynamic Security Groups in Microsoft Entra ID

Automated Campaigns for Continuous Onboarding: For continuous onboarding, consider setting up a recurring 'Simulation automation' in Defender so that newly enrolled group members receive their training payloads and assignments on an automated schedule.

Free Microsoft Office alternative

Looking for a Reliable and Free Alternative to Microsoft Office?

While Microsoft 365 provides advanced administrative tools like Attack Simulation Training, everyday document creation doesn't have to be complicated or expensive. WPS Office is a lightweight, highly compatible alternative for Word, Excel, and PowerPoint files that requires no complex subscription.

1. Download WPS Office: Visit the official WPS website and download the free installer for your operating system.
2. Install the Suite: Run the setup file and follow the quick installation prompts to deploy WPS Office on your device.
3. Open Your Documents: Launch WPS Office and directly open your existing Microsoft Office files with perfect formatting retention.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Lightweight installation and lightning-fast performance.Familiar user interface ensuring seamless migration for teams.Built-in PDF editing and conversion tools available for free.

microsoft office alternative - wps office

Frequently Asked Questions

Why aren't my new employees receiving the attack simulation training emails?

If employees are added to a standard security group after a training campaign has already launched, the campaign may not retroactively target them. Utilizing automated recurring campaigns alongside dynamic groups typically resolves this.

Can I use standard security groups for automated training enrollment?

Standard security groups require manual updates to membership. For automatic enrollment during employee onboarding, setting up a 'Dynamic User' group in Microsoft Entra ID is required.

Does Microsoft Attack Simulation Training support continuous onboarding workflows?

Yes, administrators can configure 'Simulation automations' in the Microsoft Defender portal. This creates recurring campaigns that periodically check dynamic groups and send training links to newly added members.

Microsoft Office Security Issues