Security Policy Errors

How to Remove Users from Microsoft Defender Attack Simulation Training

Khadija Khan Oct 10, 2026 869 views

Question details

The user wants to know if it is possible to remove specific employees from a training campaign in Microsoft Defender Attack Simulation Training after the assignment has been created.

Product: Microsoft Defender
Device & OS: not provided
Scenario: Managing and adjusting assigned security training campaigns in a testing or evaluation environment.
Observed behavior: The Microsoft Defender portal does not provide an explicit option to remove individual employees from a training campaign once the assignment is created.

Before you start

Ensure you have the necessary administrator or security operator permissions in the Microsoft Defender portal before reviewing or modifying active campaigns and training assignments.

Solution 1Recommended

Review Campaign Controls and Submit Feature Feedback

Since Microsoft Defender currently lacks a direct feature to remove individual users after an assignment is created, administrators must use careful pre-assignment planning and provide feedback for future updates.

Currently, Microsoft Defender does not offer built-in functionality to remove individual users from an Attack Simulation Training campaign once it has been assigned. This known limitation can impact test groups and evaluation setups, requiring administrators to plan assignments meticulously.

Log in to the Microsoft Defender Portal

Navigate to the Microsoft Defender portal with your administrator credentials and go to the Attack simulation training section.

Review Active Campaigns

Check your active campaigns and training assignments to verify the current target audience and understand the scope of the assignment.

Submit Feedback to Microsoft

Because individual removal is unavailable, document this requirement for your testing environment and submit direct feedback to the Microsoft product team via the portal's feedback tool.

Adjust Future Assignments

For future campaigns, carefully confirm the assignment lists prior to launch. Use dynamic groups or specific test distribution lists to prevent unintended enterprise-wide assignments.

Future Updates: Raising this concern with Microsoft support or via the feedback hub increases the likelihood of this management feature being added in a future update.

Free Microsoft Office alternative

Looking for a Secure and Lightweight Office Alternative? Try WPS Office

While managing enterprise security policies like Attack Simulation Training requires dedicated Microsoft tools, everyday document management shouldn't be complicated. WPS Office is a free, highly compatible alternative to Microsoft Office, offering robust tools for Word, Excel, and PowerPoint files without the heavy enterprise overhead.

1. Visit the Official Website: Go to the official WPS Office website to access the latest secure version.
2. Download the Installer: Click the 'Free Download' button to download the installer for your specific operating system.
3. Install and Launch: Follow the simple on-screen instructions to install WPS Office and instantly open your Microsoft Office documents.

Seamlessly compatible with Microsoft Word, Excel, and PowerPoint formats.Free, lightweight, and easy to deploy across various operating systems.Familiar user interface that requires zero learning curve for seamless migration.Built-in PDF editing and secure document sharing capabilities.

microsoft office alternative - wps office

Frequently Asked Questions

Can I cancel an entire Attack Simulation Training campaign?

Yes, while you cannot remove individual users, administrators can usually stop or cancel an active training campaign entirely from the Microsoft Defender portal under the Attack simulation training settings.

How can I prevent assigning training to the wrong employees?

It is highly recommended to use carefully managed distribution lists or Azure AD groups for your campaigns. Always test campaigns with a dedicated small group before rolling them out company-wide.

Are there alternative ways to exempt a user from security training?

If a user was assigned in error and cannot be unassigned, internal policies can dictate that the user simply ignores the training prompt until the deadline passes, though this will affect the campaign's overall completion metrics.

Microsoft Office Security Issues