Question

You are a Microsoft 365 administrator using Attack simulation training in Microsoft Defender for Office 365. Your CISO wants you to run a credential-harvest simulation against the Finance department and ensure that any user who clicks the payload link is automatically assigned targeted training with a completion deadline. You create the simulation and select a credential-harvest payload. Which configuration must you set so that only users who fall for the simulation receive training?

Accepted Answer

In the simulation's training assignment settings, choose the training-content-based recommendation and set the assignment to 'Only users who took the simulation action' with a due date.

Answer

Create a separate Training campaign after the simulation completes and manually enroll every member of the Finance department.

Answer

Configure an alert policy that emails managers when a user clicks the link, then have managers assign training.

Answer

Enable the global Attack simulation training setting to assign training to all targeted users regardless of their action.