Security Policy Errors

Why Attack Simulation Assigns Training to Uncompromised Users in Microsoft 365

Olivia Miller Oct 21, 2026 868 views

Question details

Users who did not interact with simulated phishing emails are unexpectedly being assigned training in Microsoft Defender for Office 365.

Why Attack Simulation Assigns Training to Uncompromised Users

Product: Microsoft Defender for Office 365
Device & OS: not provided
Scenario: Administrators are reviewing Attack Simulation Training campaign outcomes and noticing training assigned to non-compromised recipients.
Observed behavior: The training campaign automatically assigns mandatory training to users who did not click links, open attachments, or submit credentials during the simulated attack.

Before you start

Ensure you have global administrator or security administrator privileges in the Microsoft Defender portal to review campaign settings, payload actions, and user audit logs.

Solution 1Recommended

Review Campaign Settings and User Activity Logs

Investigate payload actions and audit details to determine exactly why the system classified the specific users as compromised.

Unexpected training assignments often stem from automated link interaction, recipient processing configurations, or reporting mechanisms rather than actual user interaction.

Access Attack Simulation Training

Log in to the Microsoft Defender portal and navigate to 'Email & collaboration' followed by 'Attack simulation training'.

Select the Campaign

Click on the specific campaign that assigned the unexpected training and open the 'Users' tab.

Review Payload Actions

Check the detailed action logs to see if a link was clicked, an attachment was opened, or if credentials were submitted. Sometimes, automated email scanners or third-party plugins trigger these links.

Verify Training Assignment Rules

Review the campaign's configuration to ensure training is set to target only compromised users and not all users targeted by the simulation.

Review Campaign Settings and User Activity Logs

Automated Clicks: Third-party email filtering tools or automated security scanners can sometimes pre-fetch or scan simulated phishing links, which Microsoft Defender might falsely register as a user click.

Solution 2

Escalate to Microsoft Support

If campaign settings are correct and logs do not explain the behavior, escalate the issue for further investigation.

Free Microsoft Office alternative

Try WPS Office for a Streamlined Document Experience

While managing complex Microsoft 365 security policies and attack simulations can be challenging, your daily document creation shouldn't be. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office for all your word processing, spreadsheet, and presentation needs.

1. Visit the WPS Office Website: Go to the official WPS Office website to access the latest version.
2. Download the Installer: Click the 'Free Download' button to download the setup file for your operating system.
3. Install and Start Creating: Run the installer, follow the simple on-screen instructions, and launch WPS Office to open your existing Microsoft Office files.

Completely free to use with an intuitive, user-friendly interfaceFully compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Lightweight installation that doesn't slow down your systemSeamless migration of your existing documents without formatting loss

microsoft office alternative - wps office

Frequently Asked Questions

Can automated email scanners trigger a false compromise in Attack Simulation?

Yes. Sometimes third-party email filtering, antivirus software, or security scanning tools interact with the simulated phishing links to check for threats, causing Microsoft Defender to incorrectly log the interaction as a user click.

Where can I see what action triggered the training assignment for a user?

You can view this in the Microsoft Defender portal. Go to 'Email & collaboration' > 'Attack simulation training', select your specific campaign, navigate to the 'Users' tab, and review the data in the 'Action' column.

How do I remove a training assignment for a user who was falsely flagged?

Currently, administrators may need to manually exempt the user via the training campaign settings or simply instruct the affected user to ignore the notification if it has been verified as a false positive.

Microsoft Office Security Issues