Forum Discussion
Scheduling attack simulations
I'm starting to use the Defender attack simulation feature. I have approx. 3000 users to target.
Leadership don't want to send 3000 tests every month rather divide the people up across 12 months sending smaller monthly batches.
The issue of not being enough tests for each individual is there a way to automate the sending of these to even batches of people across 12 months rather than having to set these up manually?
3 Replies
hi lfk73
Yes, Microsoft Defender for Office 365’s Attack Simulation Training (AST) doesn't currently support fully automated monthly batch scheduling out-of-the-box across randomized or evenly distributed user groups. However, there are workarounds you can implement to achieve your goal of sending smaller simulation batches across 12 months, without manually creating each campaign every time.
a.Create 12 Azure AD Groups (One per Month)
Create groups like:
- Phishing-Sim-Group-Jan………Phishing-Sim-Group-Dec
Each group should contain ~250 users (3000/12).
You can:
- Manually assign users in a spreadsheet
- Or use PowerShell or Azure AD dynamic group rules if you have attributes (like employee ID, join date, etc.)
b.Create 12 Simulations Now (One for Each Group)
In Defender → Attack simulation training:
- Create 12 simulations
- Target each month’s group
- Schedule each one to start on the 1st (or desired date) of that month
- Pick different templates and payloads to keep it varied
Alternatively, you can automate using power automate. hope this helps
Thanks, I was pretty sure this was the case. I am toying with doing it somewhat dynamically using power automate. I'll post if I get it working.
perfect.
