Microsoft Assigned Training Question

Attack simulation training in Microsoft Defender for Office 365 does not currently support editing individual users’ simulation outcomes (for example, changing a user from Compromised to Not compromised or explicitly flagging them as a false positive) or auto-completing their assigned training directly from the simulation report.

Key points from the available behavior and reporting model:

• A user is marked Compromised based on specific actions tied to the simulation technique (for example, clicking the payload link or entering credentials), as defined in the reporting appendix.
• Forwarding, replying, or deleting the message are tracked as Other actions signals, but there is no documented mechanism to override the resulting Compromised status once it has been recorded.
• Training assignment is rule-based at simulation design time (for example, assign to All users, Clicked payload, or Compromised) and not per-user editable after the fact.

Operationally, the only supported options are:

1. Use the simulation reports to identify these users and treat them as exceptions in internal metrics (for example, adjust reporting in exported data).
2. If training is not desired for those users, handle that outside the product (for example, communicate that they can ignore the training, or track them as having “passed” in internal records).

There is no supported way in the documented features to:

• Mark a specific user’s compromise as a false positive inside Attack simulation training, or
• Programmatically or administratively auto-complete their assigned training from the Defender portal.

References:

• Reports for Attack simulation training
• Simulate a phishing attack with Attack simulation training
• Attack simulation training deployment considerations and FAQ