Fix Microsoft Defender Attack Simulation Custom Training Not Assigned
Question details
Users are experiencing an issue where custom training modules fail to assign to the target audience after an attack simulation is run.
- Product
- Microsoft 365 Defender
- Device & OS
- not provided
- Scenario
- Running an attack simulation campaign and expecting specific custom training modules to be assigned to users who trigger compromise conditions.
- Observed behavior
- Custom training modules are not being assigned to the audience after the simulation, even when compromise conditions and audience targeting are correctly configured.
Ensure you have the necessary administrator permissions (such as Security Administrator) in the Microsoft 365 portal and verify that the simulation campaign has fully completed its execution cycle.
Contact Microsoft Support for Defender Services
Since this issue often stems from backend service incidents or platform limitations affecting custom assignments, reaching out to Microsoft Support is the most direct way to resolve it.
Microsoft 365 Defender relies on complex cloud-syncing mechanisms to map simulated compromises to training modules. When custom configurations fail to trigger without any error messages, it typically indicates a backend synchronization issue or an undocumented configuration limitation that requires an engineer to investigate the tenant logs.
Log in to the Microsoft 365 Admin Center using your global administrator or security administrator credentials.
Click on the 'Support' or 'Help & support' icon located in the bottom right corner of the screen or on the left-hand navigation pane.
Type 'Attack Simulation Custom Training Not Assigned' in the search bar, review the suggested self-help articles, and click 'Contact Support' to open a ticket. Provide the exact campaign name and affected custom modules.
Review Simulation Audience and Exclusion Settings
Double-check your campaign settings to rule out configuration overlaps or logical errors that might prevent training assignments.
Looking for a reliable and lightweight Office alternative?
While Microsoft 365 offers advanced enterprise security features like Defender, standard document processing tasks don't always require expensive enterprise subscriptions. WPS Office provides a free, highly compatible, and secure suite for your team's everyday productivity.
Frequently Asked Questions
Why are default training modules assigned instead of my custom ones?
This usually happens if the custom training module is missing required metadata or if the simulation payload is mapped to a default learning path in the Microsoft 365 Defender portal, overriding your custom selection.
How long does it take for training to be assigned after an attack simulation?
Typically, training is assigned shortly after a user triggers a compromise condition (e.g., clicking a phishing link or submitting credentials). If it takes longer than 24 hours, there may be a service sync issue.
Can I manually assign the custom training if the simulation fails to do so automatically?
Yes, administrators can manually assign training campaigns from the 'Training campaigns' tab in the Attack simulation training dashboard by selecting the specific module and targeting the desired users directly.
