How to Cancel or Remove Automatically Assigned Phishing Training
Question details
Administrators need to remove automatically assigned phishing simulation training to stop notification emails from bouncing for deleted users or failed deliveries.
- Product
- Microsoft Defender
- Device & OS
- not provided
- Scenario
- Attempting to cancel training assignments and stop notification emails after a phishing simulation has ended.
- Observed behavior
- Canceling the phishing simulation does not automatically unassign the training, resulting in continuous notification emails being sent to users who may no longer exist.
Ensure you are logged in with an administrator account that has the necessary permissions to manage training assignments in the Microsoft Defender portal.
Manually Unassign Training in Microsoft Defender
Remove the training assignments directly from the Defender portal to stop ongoing automated notification emails.
Phishing simulations and their corresponding training assignments are managed as separate entities. Simply canceling a simulation campaign will not automatically remove the pending training assignments for users.
Open your web browser and sign in to the Microsoft Defender portal using your administrator credentials.
Navigate to the specific training assignment associated with the phishing simulation you recently canceled.
Review the list of assigned users. You can filter the list to specifically identify users with failed email deliveries or those whose accounts have been deleted.
Select the specific users or the entire assignment group, and click the option to remove or unassign the training. This action will immediately stop the system from sending further notification emails.
Contact Support for Persistent Training Policies
Escalate the issue if platform limitations or organizational policies prevent you from manually unassigning the training.
Streamline Your Workflow with WPS Office
While managing complex security policies and enterprise environments like Microsoft 365 can be challenging, creating and sharing your internal policy documents shouldn't be. WPS Office offers a lightweight, straightforward, and highly compatible suite for all your documentation needs.
Frequently Asked Questions
Why are users still getting emails after I canceled the phishing simulation?
Phishing simulations and the resulting training assignments are processed as separate tasks. Canceling the simulation only stops the fake phishing emails from being sent, but any automated training triggered by that simulation must be unassigned manually.
Can I filter training assignments to only remove them for deleted users?
Yes, in the Microsoft Defender portal, you can filter the training assignment list by delivery status (such as failed deliveries) to specifically target and remove assignments for users whose accounts no longer exist.
What should I do if the option to remove the training is missing?
If you cannot see the option to unassign or remove the training, it is likely restricted by your organization's global training policies. You will need to consult your primary security administrator or contact Microsoft Support to modify these policies.
