Security Policy Errors

How to Change the Microsoft Attack Simulation Training Sender Address

Phi Hung Vo Sep 28, 2026 871 views

Question details

The user wants to change the sender email address for Microsoft Attack Simulation Training because the default domain causes employees to report the training emails as actual phishing attempts.

How to Change the Microsoft Attack Simulation Training Sender Address

Product: Microsoft 365
Device & OS: not provided
Scenario: An administrator is setting up phishing simulations and wants to use a custom or familiar domain to deliver the training emails.
Observed behavior: Training emails are sent from an unfamiliar attacksimulationtraining.com address, leading users to mistakenly report legitimate training exercises as malicious phishing attempts.

Before you start

Verify your Microsoft 365 administrator privileges and review your current attack simulation training campaign settings in the Microsoft 365 Defender portal before attempting to modify sender details.

Solution 1Recommended

Use Communication Workarounds for Simulation Senders

Since Microsoft does not currently allow administrators to change the training email sender to a customer-owned domain, you must use alternative communication methods to manage user expectations.

By design, Microsoft 365 uses the default attacksimulationtraining.com domain for its simulation training campaigns. This system limitation prevents custom domains from being used directly in the sender field to ensure isolation of simulation traffic.

Notify users in advance

Send a company-wide email or message before launching the training campaign. Inform users that they will receive automated training messages from the attacksimulationtraining.com domain so they do not falsely report it as a real phishing attack.

Customize the display name

While creating the simulation payload in the Microsoft 365 Defender portal, customize the 'From (Name)' field to reflect your organization's IT or Security department, which adds a layer of familiarity even if the domain cannot be changed.

Submit a feature request

Navigate to the Microsoft Feedback Portal online and submit a request or vote on existing requests to allow custom-owned domains for Attack Simulation Training sender addresses.

Use Communication Workarounds for Simulation Senders

System Limitation: Changing the sender email domain to a custom corporate domain is strictly not supported in Microsoft 365 Attack Simulation Training at this time.

Free Microsoft Office alternative

Try WPS Office for a Seamless and Free Alternative

While administrative features like Attack Simulation Training are specific to Microsoft 365 enterprise environments, if you are looking for a highly compatible, lightweight, and free office suite for everyday document creation, WPS Office is the perfect choice.

1. Visit the website: Go to the official WPS Office website using your web browser.
2. Download the software: Click the 'Free Download' button to download the installer for your operating system.
3. Install and launch: Run the downloaded installer, follow the on-screen instructions, and open WPS Office to start creating documents.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Lightweight software that runs smoothly on both older and newer devicesFree to use with a familiar, easy-to-navigate user interfaceDraft, edit, and share IT security policies and training notifications with ease

microsoft office alternative - wps office

Frequently Asked Questions

Why do Microsoft Attack Simulation emails come from attacksimulationtraining.com?

Microsoft uses this dedicated domain to isolate simulation traffic, ensure consistent delivery across tenants, and prevent customer domains from being mistakenly blacklisted by external email security gateways.

Can I customize the email payload in Microsoft Attack Simulation Training?

Yes. While you cannot change the sender domain, you can customize the email content, display name, and the phishing link URL within the Microsoft 365 Defender portal to accurately simulate different types of attacks.

Do I need to whitelist the attacksimulationtraining.com domain?

Generally, Microsoft 365 automatically excludes its own simulation URLs and domains from advanced filtering. However, it is recommended to verify your tenant's Advanced Delivery policies to ensure training emails bypass standard spam filters and reach the end users.

Microsoft Office Security Issues