Security Policy Errors

How to Automatically Add New Users to Attack Simulation Training

Emma Brown Oct 10, 2026 869 views

Question details

The organization wants to automatically include new employees in existing Attack Simulation Training automations without having to manually update the target list.

How to Automatically Add New Users to Attack Simulation Training

Product: Microsoft 365 Defender
Device & OS: not provided
Scenario: Automating the onboarding process for new employees so they are automatically included in scheduled security training and simulations.
Observed behavior: New employees are not being automatically included in the Attack Simulation Training automation that was configured for specific users and groups.

Before you start

Ensure you have the necessary administrative privileges in both Microsoft Entra ID (to manage group memberships) and the Microsoft Defender portal (to manage simulation payloads).

Solution 1Recommended

Use Microsoft Entra ID Groups for Automatic Targeting

Assign your simulation automations to specific Microsoft Entra ID groups instead of individual users to ensure new employees are automatically captured.

By configuring your Attack Simulation Training to target a dynamic or well-maintained Microsoft Entra ID group, any new user added to that group will automatically be included in future simulation runs.

There is currently no separate automatic onboarding trigger directly inside the simulation module; it relies entirely on the directory group membership.

Manage Entra ID Groups

Log in to the Microsoft Entra admin center. Navigate to 'Groups' and ensure you have an active group (preferably a Dynamic User group) that automatically captures all new employees based on their profile attributes.

Configure Simulation Targets

Open the Microsoft Defender portal and navigate to 'Email & collaboration' > 'Attack simulation training'. Select the 'Automations' tab.

Update Target Audience

Edit your existing simulation automation. In the 'Target payload' or 'Target users' section, select 'Include specific users and groups' and add the Microsoft Entra ID group you verified in step 1, removing any individually named users.

Use Microsoft Entra ID Groups for Automatic Targeting

Syncing Time: Membership changes in Microsoft Entra ID may take some time to sync. Ensure new employees are added to the group well before the scheduled simulation launch time.

Solution 2

Consult Microsoft Support for Enterprise Limitations

If standard Entra ID group syncing does not meet your organizational onboarding requirements, verify current enterprise capabilities via Microsoft Q&A.

Free Microsoft Office alternative

Try WPS Office for Your Daily Productivity Needs

While managing enterprise security policies like Attack Simulation Training requires Microsoft 365 admin tools, WPS Office provides a lightweight, highly compatible, and free alternative for your daily document creation and editing.

1. Download the Installer: Visit the official WPS Office website and download the correct version for your operating system.
2. Install the Software: Run the installer and follow the on-screen prompts to complete the setup process.
3. Open Your Documents: Launch WPS Office and open your existing .docx, .xlsx, or .pptx files seamlessly.

Highly compatible with Microsoft Office formats (Word, Excel, PowerPoint).Lightweight software that consumes minimal system resources compared to traditional enterprise suites.Familiar user interface ensuring a seamless migration for new employees and staff.Free to use for everyday document security and management tasks.

microsoft office alternative - wps office

Frequently Asked Questions

Can I use dynamic groups for Attack Simulation Training?

Yes, using dynamic Microsoft Entra ID groups is highly recommended. You can set rules based on user attributes (like department or hire date) so new users are automatically added to the group, which the simulation then targets.

Why aren't my newly added users receiving the simulation emails?

If users were recently added to the target group, there might be a synchronization delay between Microsoft Entra ID and the Microsoft Defender portal. Additionally, if the automation has already generated its target list for a specific run, new users will be included in the next scheduled cycle.

Is there a way to manually push a user into an active simulation?

Once a simulation campaign has officially launched, the target list is typically locked. You will need to either wait for the next automated run or launch a manual catch-up campaign targeting just the new employees.

Microsoft Office Security Issues