Security Policy Errors

How to Use QR Codes in Microsoft Attack Simulation Training

John Wilson Oct 12, 2026 869 views

Question details

The user needs to know how to incorporate printed QR codes into an authorized workplace phishing simulation to track employee link visits and credential submissions.

How to Use QR Codes in Microsoft Attack Simulation Training

Product: Microsoft Attack Simulation Training
Device & OS: not provided
Scenario: Setting up a physical security awareness training exercise using printed materials that contain QR codes.
Observed behavior: The user aims to generate a simulation URL and convert it into a scannable QR code to measure employee interactions safely.

Before you start

Ensure you have explicit organizational authorization and have reviewed all applicable company policies and local laws before launching any workplace phishing simulation.

Solution 1Recommended

Set Up a Credential Harvest Simulation with QR Codes

Use Microsoft Attack Simulation Training to create a Credential Harvest exercise, generate a tracking URL, and convert it to a QR code for printed distribution.

This method allows administrators to track which users scanned the QR code and opened the link, as well as whether they submitted credentials. Use this strictly for security awareness and training purposes.

Create a Credential Harvest Simulation

Log in to the Microsoft 365 Defender portal, navigate to Attack Simulation Training under Email & Collaboration, and select the option to create a new Credential Harvest simulation.

Generate the Simulation URL

Follow the simulation setup wizard to customize your payload and landing page, then copy the unique simulation URL generated for your target users.

Convert the URL to a QR Code

Paste the copied simulation URL into a secure, standard QR code generator tool to create a scannable QR image.

Distribute Printed Materials

Embed the generated QR code into your posters, flyers, or physical materials and distribute them around the authorized workplace areas.

Track User Interactions

Monitor the Attack Simulation Training reports in Microsoft 365 Defender to track link clicks and submitted credentials resulting from the QR code scans.

Set Up a Credential Harvest Simulation with QR Codes

Authorization Required: Always ensure you have written authorization from your organization's leadership or security team before distributing simulated phishing materials.

Free Microsoft Office alternative

Design Security Training Materials with WPS Office

While Microsoft handles the active threat simulation, you can easily draft, print, and distribute your security awareness posters containing the QR codes using WPS Office. It is a free, lightweight, and highly compatible alternative to Microsoft Office.

1. Open a Document: Launch WPS Writer or WPS Presentation to start drafting your security awareness flyer.
2. Insert the QR Code: Go to the Insert tab and add the QR code image you generated for the Microsoft simulation.
3. Export and Print: Format your poster, then export it as a high-quality PDF using the built-in PDF tool for professional printing.

Easily design printable flyers and posters for QR code distributionFully compatible with Microsoft Word (.docx) and PowerPoint (.pptx) formatsLightweight application that runs smoothly on most operating systemsBuilt-in PDF tools for secure document sharing and high-quality printing

microsoft office alternative - wps office

Frequently Asked Questions

Can I track who scanned the QR code even if they do not enter credentials?

Yes, setting up a Credential Harvest simulation in Microsoft Attack Simulation Training can track both initial link clicks (when the user scans and opens the URL) and actual credential submissions.

Is it legal to use QR codes for workplace phishing simulations?

Yes, provided you have explicit organizational authorization and comply with your company's internal security policies, as well as applicable local laws.

Can I use standard QR code generators for the simulation URL?

Yes, you can use any standard QR code generator to convert the Microsoft Attack Simulation URL into an image. Ensure the underlying URL is pasted exactly as generated.

What is the main goal of a printed QR code simulation?

The primary goal is security awareness training. It helps educate employees about the risks of scanning unknown QR codes (often called 'quishing') found in the physical workplace.

Microsoft Office Security Issues