Attack Simulation Training: Remove Assigned Training From Users

Question

Hello, We have launched a simulated phishing campaign using Attack Simulation Training in the Microsoft portal. Some users have been assigned the training after clicking a link within the e-mail (which is how we configured it). Is it possible to remove the training assignment for individual users at this stage of the simulation? Many thanks!

Shaun

Answer 1

Hi @PARR Shaun ,

If you have attachment scanning or Data Loss Prevention (DLP) processing, it's possible that DLP is opening the attachment on send to check it and that is getting it flagged. You could try removing the DLP compliance policy (if applicable) to see if you face the same issue. If you want to exclude certain paths from DLP monitoring, DLP alerts, and DLP policy enforcement on your devices, you can also turn off those configuration settings by setting up file path exclusions. https://learn.microsoft.com/en-us/purview/dlp-configure-endpoint-settings

If you just want to remove the training emails though, you can remove or modify the end user notifications, or you can add exclusions to the training simulations themselves.

Otherwise I would recommend creating a support ticket to look into this and query additional logs from your tenant, since it will be harder to diagnose this without testing within the tenant itself.