Security Policy Errors

How to Delay Microsoft 365 Defender Attack Simulation Training Notifications

Muhammad Talha Oct 21, 2026 868 views

Question details

The user wants to know if it is possible to delay the training assignment email sent automatically after a user clicks on an attack simulation phishing link.

How to Delay Microsoft 365 Defender Attack Simulation Training Notifications

Product: Microsoft 365 Defender
Device & OS: not provided
Scenario: Administrators running phishing simulations want to observe if users proceed to enter credentials after clicking the initial link, without tipping them off with an immediate training notification email.
Observed behavior: Currently, the training assignment notification is triggered and sent immediately when a user clicks the phishing link, which alerts the user and prevents them from continuing to interact with the simulated payload.

Before you start

Ensure you have Microsoft 365 Global Administrator or Security Administrator permissions to view and edit Attack Simulation training policies in the Microsoft 365 Defender portal.

Solution 1Recommended

Review Simulation Notification Options and Contact Support

Microsoft 365 Defender does not currently offer a native setting to delay the initial training assignment email. Administrators should review the available custom notification settings and submit a formal feature request.

By default, Microsoft 365 Defender attack simulation scheduling options trigger the training assignment notification immediately upon user interaction with the payload.

Because this immediate alert can skew simulation results (as users realize it's a test and stop interacting), many administrators require a delay feature. Until Microsoft introduces a native delay toggle, you must rely on customizing the message content or escalating the request to Microsoft Support.

Access Attack Simulation Training

Log into the Microsoft 365 Defender portal using your administrator credentials, and navigate to 'Email & collaboration' > 'Attack simulation training' in the left-hand menu.

Review Payload and Notification Settings

Click to create a new simulation or edit an existing one. Proceed through the setup wizard to the 'End user notifications' tab to view all available delivery preferences.

Select Custom Notifications

Choose 'Customized end user notifications'. While you cannot change the immediate delivery timing, you can modify the email content, sender, and subject to make the notification appear less disruptive or align better with your organization's testing strategy.

Submit a Feature Request

Because the delayed delivery scheduling option is missing from the interface, it is highly recommended to use the feedback hub within the portal or contact Microsoft Support directly to request the ability to delay training notifications by a specific number of days.

Review Simulation Notification Options and Contact Support

Current Limitation: The immediate delivery of training notifications is a known limitation within Microsoft 365 Defender's current architecture for Attack Simulation Training.

Free Microsoft Office alternative

Switch to WPS Office for a Lightweight Productivity Experience

While Microsoft 365 Defender handles complex enterprise security policies and threat simulations, you might be looking for a simpler, cost-effective solution for your daily document productivity. WPS Office is a highly compatible, standalone office suite that provides seamless offline productivity without the overhead of enterprise configurations.

1. Download WPS Office: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install the Software: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
3. Open Existing Documents: Double-click your Microsoft Word, Excel, or PowerPoint files to open and edit them seamlessly within WPS Office.

Fully compatible with Microsoft Office formats, ensuring seamless handling of DOCX, XLSX, and PPTX files.Lightweight design ensures fast installation and smooth operation even on older devices.Familiar user interface requires no additional learning curve, making migration effortless.Free access to powerful Writer, Spreadsheet, and Presentation tools for all your daily tasks.

microsoft office alternative - wps office

Frequently Asked Questions

Can I delay the training assignment email by 3 days in Microsoft 365 Defender?

Currently, Microsoft 365 Defender does not provide a built-in scheduling option to delay the initial training assignment email by a specific number of days. The notification is automatically dispatched upon user interaction.

Why does the immediate training notification cause issues for simulations?

When the training email is sent instantly, it alerts the user that they just clicked a simulated phishing link. This tips them off and often prevents them from continuing to the credential harvesting page, which can skew the simulation metrics your security team is trying to collect.

Can I customize the content of the end-user training notification instead of delaying it?

Yes. While you cannot change the delivery delay, you can navigate to the 'End user notifications' tab during the simulation creation process to fully customize the sender, subject, and body text of the training assignment email.

How can I request Microsoft to add the notification delay feature?

You can submit feedback directly through the Microsoft 365 Defender portal by clicking the 'Feedback' button, or by opening a support ticket with Microsoft detailing your use case for delayed attack simulation training notifications.

Microsoft Office Security Issues