Study guide
13.1 Managing Attack Simulations & Training
Microsoft 365 Administrator Expert MS-102
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide
2 Tenant Setup, Domains & Org Settings
2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile
3 Service Health, Network & Software Updates
3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates
4 Adoption, Usage & Microsoft 365 Backup
4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup
5 Users, Contacts, Groups & Shared Mailboxes
5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes
6 Licensing & Bulk User Management
6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell
7 Roles, Admin Units & Privileged Identity Management
7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM
8 Identity Synchronization with Entra Connect
8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization
9 Authentication, SSPR & Password Protection
9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues
10 Identity Protection, Conditional Access & MFA
10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access
11 Defender XDR Posture, Incidents & Threat Intelligence
11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence
12 Defender for Office 365: Policies, Alerts & Investigation
12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats
13 Attack Simulation & Restricted Entities
13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users
14 Defender for Endpoint
14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard
15 Defender for Cloud Apps
15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery
16 Purview Information Protection & Data Lifecycle
16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer
17 Purview Data Loss Prevention
17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports
18 Final Review & Exam Strategy
18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps
13.1 Managing Attack Simulations & Training
Key Takeaways Explain This Topic AI
Attack simulation training requires Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5; it is not available with Plan 1 or Exchange Online Protection alone
Payload categories include credential harvest, malware attachment, link in attachment, link to malware, drive-by URL, OAuth consent grant, and text-only smishing attempts
Simulation automations run payloads on a recurring schedule without admin intervention, while one-time simulations are manual launches against a selected audience
Training modules are assigned automatically based on user behavior — users who click or enter credentials receive targeted modules while those who do not click can still receive awareness training
The key operational metrics are click rate, compromise rate, training completion rate, and repeat-offender tracking across campaigns
Last updated: August 2026
What Attack Simulation Training Is
Attack simulation training is a capability in Microsoft Defender for Office 365 Plan 2 (included with Microsoft 365 E5, or available as an add-on to Plan 1) that lets administrators run realistic, safe phishing and social-engineering simulations against their own users and assign training based on the results. It is educational by design — no real payload is delivered, no credentials are captured, and no malware executes. The goal is to measure user susceptibility and drive behavior change through repeated, context-aware training.
Licensing note: Attack simulation training is not available with Exchange Online Protection (EOP) alone or Defender for Office 365 Plan 1. Verify Plan 2 (or E5) is assigned to every user you target; users without the license are skipped.
Where It Lives in the Portal
In the Microsoft Defender portal ( https://security.microsoft.com ), attack simulation training lives under Email & collaboration → Attack simulation training . From there you reach three core areas: Simulations (launch and track individual campaigns), Simulation automations (schedule recurring payload sequences), and the Payloads library (browse and choose social-engineering templates). An Automations tab also exposes payload automations you can enable with one click.
Payload Categories
When you create a simulation, you choose a payload — the template that defines the lure and the technique. Microsoft maintains a curated library and your tenant can also create custom payloads. The supported technique categories are:
- Technique What the user sees What is measured
- Credential harvest A fake sign-in page asking for username/password Credentials entered on the fake login page
- Malware attachment An email with a malicious-looking attachment Attachment opened or downloaded
- Link in attachment An attachment containing a link to a phishing site Link clicked from the attachment
- Link to malware A link in the email body pointing to a malware download Link clicked
- Drive-by URL A link to a compromised-looking site that silently “infects” Link clicked
- OAuth consent grant A prompt asking the user to grant app permissions Consent granted
- Text-only (smishing) A short SMS-style message with a link Link clicked
Each payload includes a landing page (what the user sees after clicking) and, for credential-harvest payloads, a login page (the fake sign-in form). You can use Microsoft's default landing pages, clone and customize them, or build your own. Landing pages should include a “this was a simulation” banner and a link to the assigned training.
Targeting and Scheduling
A simulation targets an audience — one or more mail-enabled groups, or a manually selected set of users. Best practice is to start with a small pilot group and expand. You can exclude service accounts and shared mailboxes.
Scheduling has two modes:
One-time (manual): You configure everything and launch now or at a fixed date/time. Use this for controlled, point-in-time tests.
Automated (recurring): You configure a simulation automation that selects payloads from a category and runs them on a schedule — for example, “run one random credential-harvest payload every Tuesday at 9 AM against all staff for 6 months.” Automations eliminate admin overhead and produce trend data over time.
Training Assignment
This is the part that turns a test into a program. When you configure a simulation, you choose a training assignment strategy:
Microsoft training catalog: Select specific modules from Microsoft's built-in library (videos, interactive modules, micro-learning).
No training: Run the simulation purely to measure baseline susceptibility.
Assign training based on user behavior: The recommended approach. Users who clicked the link, opened the attachment, or entered credentials are assigned targeted modules relevant to the technique they fell for. Users who did not interact can still be assigned a short awareness module or no training, depending on your policy.
Training completion is tracked and surfaced in the simulation report. You can set a due date and send reminders.
Simulation Automations (Playbooks)
Microsoft ships pre-built payload automations (sometimes called playbooks) — ready-made recurring sequences grouped by technique. For example, a “Credential Harvest” automation rotates through several credential-harvest payloads on a schedule you define. Enabling a payload automation is a one-click action: pick the audience, the cadence (weekly/bi-weekly/monthly), and the technique category, and Defender handles the rest. This is the lowest-effort way to keep a continuous training program running.
Reports and Metrics
After a simulation completes, the report focuses on four metrics that matter for MS-102:
Click rate — percentage of targeted users who clicked the link or opened the attachment.
Compromise rate — percentage who completed the compromising action (entered credentials, granted OAuth consent, downloaded “malware”). Compromise rate is always ≤ click rate.
Training completion rate — percentage of assigned users who finished their modules by the due date.
Repeat offenders — users who fell for multiple simulations across campaigns. The Users tab ranks targeted users by number of compromises and lets you filter to repeat offenders for focused follow-up.
The Overview tab shows trends across all simulations: how click and compromise rates move over time, and how your tenant compares to the industry benchmark Microsoft publishes.
Simulation vs. AIR — Do Not Confuse
A common MS-102 trap is conflating attack simulation training with Automated Investigation and Response (AIR) . They are different features with different purposes:
- Attack simulation training AIR
- Purpose Educate users, measure susceptibility Investigate and remediate real detections
- Trigger Admin-initiated, scheduled Real threat detection (phish, malware, anomalies)
- Action taken Shows landing page, assigns training Plays an investigation playbook, remediates entities
- Real payload? No Yes — responds to actual threats
Both live in the Defender portal, but AIR runs automatically against real alerts while simulation training is a planned, safe exercise.
Best Practices
Pair every simulation with required training. A simulation without training only measures — it does not improve.
Use automations for continuity. One-off tests are fine for baselines, but behavior change comes from regular, spaced exposure.
Start gentle and escalate. Begin with obvious lures, then introduce harder-to-detect payloads as users improve.
Track repeat offenders and escalate to managers or additional MFA requirements when warranted.
Exclude service accounts, shared mailboxes, and executives' delegates unless those are explicitly in scope.