Security Policy Errors

How to Understand Actions in Microsoft Attack Simulation Reports

WPS Content Manager Oct 8, 2026 869 views

Question details

The user wants to know how user behavior and actions are tracked and calculated within Microsoft Attack Simulation reports, specifically regarding overlapping actions.

How to Understand Actions in Microsoft Attack Simulation Reports

Product: Microsoft Defender for Office 365
Device & OS: not provided
Scenario: Reviewing security simulation results to assess how employees interact with simulated phishing emails.
Observed behavior: The reports display multiple actions like reading, clicking, and reporting, creating confusion over whether every single action is counted or if only the latest state is used for metrics.

Before you start

Ensure you have the appropriate Security Administrator permissions in the Microsoft 365 Defender portal to access and view detailed Attack Simulation training reports.

Solution 1Recommended

Reviewing Simulation Reports and Metric Definitions

Access the detailed simulation report to view metrics that prioritize the latest action or current state, preventing duplicate counts for overlapping behaviors.

When running an attack simulation, users often perform multiple actions, such as reading a message, deleting it, and then subsequently reporting it.

To avoid inflating statistics—for instance, counting a user in both the 'deleted' and 'reported' categories—the simulation report typically relies on the latest action or the final state to determine the metric.

Reviewing the exact metric definitions within the report will clarify how overlapping actions are resolved.

Access Attack Simulation Training

Log in to the Microsoft 365 Defender portal. On the left navigation pane, go to 'Email & collaboration' and click on 'Attack simulation training'.

Select Your Simulation

Navigate to the 'Simulations' tab or the 'Overview' tab to find a list of your recent and past simulations. Click on the specific simulation you want to analyze.

Analyze the Action Metrics

Open the detailed report for the selected simulation. Review the user behavior statistics, keeping in mind that overlapping actions (like clicking a link and submitting credentials) are categorized based on their latest logical state to provide an accurate assessment.

Reviewing Simulation Reports and Metric Definitions

Metric Interpretation: If every action were counted completely independently, a single user could skew multiple categories. Relying on the final state ensures a clearer, more actionable overview of your organization's security awareness.

Free Microsoft Office alternative

Enhance Your Daily Productivity with WPS Office

While you manage your organization's advanced security policies in Microsoft 365, you can equip your team with a lightweight, cost-effective office suite for their daily document needs. WPS Office provides excellent compatibility with Microsoft formats without the heavy subscription costs.

1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
2. Install and Sign In: Run the installation file, launch the application, and sign in with your email to unlock all standard features.
3. Open Office Files: Drag and drop any existing Microsoft Office documents directly into WPS Office for seamless editing and saving.

Highly compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight software that runs smoothly on most devices without lagging.Familiar user interface allowing for seamless team migration.Free basic version available to reduce overall software licensing costs.

microsoft office alternative - wps office

Frequently Asked Questions

Why do users who both deleted and reported a message only show up in one metric?

To prevent duplicate counts and confusing statistics, the Attack Simulation report typically uses the final state or latest action. If a user deletes and then reports a message, the system prioritizes the 'reported' action to reflect the final outcome accurately.

What user actions are commonly tracked in these simulation reports?

The reports track a variety of interactions including reading the email, clicking on simulated malicious links, submitting credentials to fake landing pages, deleting the message, reporting the message, and completing any assigned follow-up training.

Where can I find the detailed report for a specific simulation?

You can find these reports in the Microsoft 365 Defender portal under 'Email & collaboration' > 'Attack simulation training'. From there, select the specific simulation from the 'Overview' or 'Simulations' tab.

Microsoft Office Security Issues