Security Policy Errors

How Microsoft Attack Simulation Training Identifies Repeat Offenders

Bushra Parveen Oct 8, 2026 868 views

Question details

Understanding how Microsoft Attack Simulation Training classifies a user as a repeat offender based on consecutive simulation failures.

How Attack Simulation Training Identifies Repeat Offenders

Product: Microsoft Attack Simulation Training
Device & OS: not provided
Scenario: Administrators tracking user compliance and vulnerability through simulated phishing and security attacks.
Observed behavior: Users are identified as repeat offenders only if they fail a configured number of consecutive simulations; passing a simulation resets the count.

Before you start

Verify that you have administrative access to the Microsoft 365 Defender portal and that Attack Simulation Training is configured for your tenant.

Solution 1Recommended

Understanding and Configuring the Repeat Offender Threshold

How to interpret the repeat offender metric and adjust the consecutive failure threshold in Microsoft Defender.

In Microsoft Attack Simulation Training, a repeat offender is defined as a user who is compromised by a configured number of consecutive simulations. By default, this threshold is set to two consecutive failures.

Review the consecutive sequence

Understand that the failures must be consecutive. For example, if a user experiences a fail, pass, and then another fail, they are not classified as a repeat offender because the pass resets the consecutive-failure sequence.

Access Attack simulation training

Navigate to the Microsoft 365 Defender portal, go to Email & Collaboration, and open Attack simulation training.

Modify the threshold

Administrators can change the consecutive simulation threshold in the settings to better align with the organization's specific security policies and tolerance levels.

Understanding and Configuring the Repeat Offender Threshold

Educational Focus: The purpose of identifying repeat offenders should always be improvement and targeted education rather than punishment.

Solution 2

Responding to Repeat Offenders

Recommended administrative actions when a user is flagged as a repeat offender to improve overall organizational security.

Free Microsoft Office alternative

A Secure and Lightweight Alternative to Microsoft Office

While managing enterprise security policies requires robust administrative tools like Microsoft Defender, handling your daily document workflows shouldn't be complex or expensive. WPS Office provides a free, highly compatible, and user-friendly alternative to Microsoft Office for all your productivity needs.

1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
2. Install the application: Run the installer and follow the on-screen prompts to set up WPS Office on your device.
3. Open your files securely: Launch WPS Office to securely open, edit, and save your existing Microsoft Office documents without formatting issues.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsEnterprise-grade document security and local file encryption featuresLightweight application that requires fewer system resourcesFree to use with a familiar UI for a seamless migration

microsoft office alternative - wps office

Frequently Asked Questions

Does a fail-pass-fail sequence make a user a repeat offender?

No. By default, the failures must be consecutive. Passing a simulation resets the consecutive-failure sequence, so a fail-pass-fail sequence would not trigger the repeat offender status.

Can administrators change the number of failures required to flag a repeat offender?

Yes, administrators have the flexibility to adjust the consecutive simulation threshold within the Attack Simulation Training settings to match their organization's specific security protocols.

What should I do if a user consistently fails phishing simulations?

You should assign additional security awareness training, hold a discussion with the user to understand knowledge gaps, and consider applying stronger security controls (like stricter conditional access) if failures persist.

Microsoft Office Security Issues