Attack Simulation False Positive

Question

Hello,

We are testing out the Attack Simulations and noticed that when forwarded, two of our team members were assigned the training.

Is there a way to make it so that if the simulation is forwarded, they are not marked as compromised/having viewed the attachment?

Answer 1

Hello Heaven Clacken,

Thank you for reaching out to the Microsoft community. 

Based on the information you provided, I have consulted with a member of my team about your situation, and I would like to share some more specific directions with you. 

Microsoft's back-end support team should collect some more advanced log information from Office 365 Global Admin personnel through a remote session to diagnose the current scenario. If needed, a front-line technical support engineer can also have a specific support team investigate some specific situations further. 

Due to the limited permissions and access resources of our forum moderators, we are unable to collect certain types of log information in public forums for this reason and for the privacy of our users' data.

After diagnosing the situation, our technical support team can provide possible information from their point of view. 

If there are any known issues, the Technical Support Engineer can provide this information from their back-end resources. 

For the standard procedure information provided above, in your organization, Office 365 Global Admins may need to contact the Office 365 support team on the backend through an open service request so that they can diagnose this particular scenario with some more technical resources,  

For this standard procedure, the following is the official documentation that Global Admins refer to: Get support - Microsoft 365 admin | Microsoft Learn (Online option). 

Note: If you are an end-user person, you may need to contact the Office 365 Global Administrator in your business organization to contact a Technical Support Engineer for further processing. 

Important: If any of your organization's Office 365 Business/Business/Education subscriptions are from a federated partner or reseller and the global admin can't open a service request on their end, they may need to contact the reseller's support provider so they can help the global admin open the service request on their end. After that, the Office 365 support team will participate in the service request that was created. 

Thank you very much for your valuable time in your cooperation. 

Sincerely

Feroz Mahmud | Microsoft Community Moderator