Global settings in Attack simulation training

In Attack simulation training in Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2, the Settings tab contains settings that affect all simulations:

• Repeat offender threshold: A repeat offender is someone who gives up their credentials in multiple consecutive simulations. How many simulations in a row constitute a repeat offender is determined by the repeat offender threshold. Information about repeat offenders appears in the following locations:

  • The Repeat offenders card on the Overview tab and the Repeat offenders tab in the Attack simulation report.
  • When you select users in target users for simulations, target users for simulation automations, and target users for training campaigns, you can find and filter repeat offenders.

• Training threshold: In Training campaigns, the training threshold specifies a time period in days to prevent users from having the same training modules assigned to them. Specifically, a training module isn't reassigned to users who completed the module during the training threshold, nor is a training module assigned to users who haven't completed modules assigned during the training threshold. For more information, see Set the training threshold time period.

• View exclude simulations from reporting: After a simulation has completed, you can exclude the results of the simulation from reporting. For instructions, see Exclude completed simulations from reporting. You can use the View all link in the Simulations excluded from reporting section to see excluded simulations on the Simulations tab.

To get to the Settings tab, do the following steps:

1. Open the Microsoft Defender portal at https://security.microsoft.com.
2. Go to Email & collaboration > Attack simulation training.
3. Select the Settings tab.

To go directly to the Settings tab, use https://security.microsoft.com/attacksimulator?viewid=setting.

For getting started information about Attack simulation training, see Get started using Attack simulation training.

Configure the repeat offender threshold

To configure the repeat offender threshold, use the box in the Repeat offender threshold section on the Settings tab. The default value is 2.

Configure the training threshold

To configure the training threshold, use the box in the Training threshold section on the Settings tab. The default value is 90 days.

The training threshold starts from the time that modules are assigned to users.

We recommend that this value is greater than the number of days users have to complete a training module.

To remove the training threshold and always assign training, regardless of whether a user has already completed or been assigned a training, set value to 0.

View simulations excluded from reporting

To view completed simulations that have been excluded from reporting on the Settings tab, select the View all link in the Simulations excluded from reporting section. This link takes you to the Simulations tab at https://security.microsoft.com/attacksimulator?viewid=simulations where Show excluded simulations is automatically toggled on .

On the Simulations tab, both excluded and included completed simulations are shown on the Simulations tab together. You can tell the difference by the Status values (Excluded vs. Completed).

If you go directly to the Simulations tab and manually toggle Show excluded simulations on , only excluded simulations are shown.

To exclude completed simulations from reporting, see Exclude completed simulations from reporting.