SOLVED

Office 365 Attack Simulator is not working

%3CLINGO-SUB%20id%3D%22lingo-sub-1935177%22%20slang%3D%22en-US%22%3EOffice%20365%20Attack%20Simulator%20is%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1935177%22%20slang%3D%22en-US%22%3E%3CP%3EI've%20been%20a%20fan%20of%20this%20great%20little%20tool%20for%20over%20a%20year%20and%20it%20stopped%20working%20from%20a%20few%20days%20ago.%20I%20use%20its%26nbsp%3BSpear%20Phishing%20(Credentials%20Harvest)%20attacks.%20And%20since%20Monday%2C%20I%20can't%20seem%20to%20launch%20a%20new%20attack.%20I'm%20a%20Global%20Admin%20and%20I%20tried%20this%20with%20Chrome%2C%20Edge%2C%20IE%20and%20Firefox%20but%20no%20luck.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1935177%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EMicrosoft%20365%20Compliance%20Center%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1935345%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Attack%20Simulator%20is%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1935345%22%20slang%3D%22en-US%22%3E%3CP%3EOpen%20a%20support%20case.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1963251%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Attack%20Simulator%20is%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1963251%22%20slang%3D%22en-US%22%3EWhat%20happens%20when%20you%20try%20to%20launch%20the%20attack%3F%20Do%20you%20get%20an%20error%20message%20or%20does%20the%20GUI%20simply%20doesn't%20respond%3F%3CBR%20%2F%3EAre%20your%20licenses%20still%20active%20and%20do%20you%20have%20the%20correct%20licenses%20assigned%3F%3CBR%20%2F%3EYou%20will%20need%20a%20license%20which%20contains%20at%20least%20the%20Microsoft%20Defender%20for%20Office%20365%20Plan%202%20license%20option.%3CBR%20%2F%3EPlease%20let%20us%20what%20steps%20you%20are%20taking%20to%20launch%20the%20attack.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1969528%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Attack%20Simulator%20is%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1969528%22%20slang%3D%22en-US%22%3EI%20have%20E5%20license%20and%20I%20used%20to%20work%20with%20this%20tool.%20Nothing%20changed%20in%20my%20subscription%20and%20I'm%20a%20global%20admin.%20No%20error%20messages%20pop%20up.%20The%20attack%20simply%20doesn't%20execute.%20No%20emails%20sent.%20Microsoft%20acknowledged%20this%20and%20they're%20working%20to%20fix%20it.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1975150%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Attack%20Simulator%20is%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1975150%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20isurudiv%2C%3CBR%20%2F%3EGood%20to%20hear%20that%20Microsoft%20is%20taking%20care%20of%20it%2C%20hopefully%20it%20will%20be%20resolved%20soon.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1977731%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Attack%20Simulator%20is%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1977731%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F789795%22%20target%3D%22_blank%22%3E%40isurudiv%3C%2FA%3E%26nbsp%3B%3CBR%20%2F%3EThis%20might%20be%20a%20little%20off%20topic%2C%20but%20I%20would%20recommend%20you%20to%20try%20the%20new%20attack%20simulation%20training%20feature%20instead%20of%20the%20old%20attack%20simulator%20tool%20found%20in%20the%20Security%20%26amp%3B%20Compliance%20center.%3CBR%20%2F%3E%3CBR%20%2F%3EThe%20new%20feature%20enables%20you%20to%20use%20a%20whole%20different%20kind%20of%20payloads%2C%20and%20also%20is%20able%20to%20give%20the%20end-user%20access%20to%20trainings.%3CBR%20%2F%3EYou%20can%20find%20this%20new%20attack%20simulation%20training%20in%20the%20M365%20Security%20Center%3A%3CBR%20%2F%3E1%3A%20Go%20to%20%3CA%20href%3D%22https%3A%2F%2Fsecurity.microsoft.com%2F%26nbsp%3B%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsecurity.microsoft.com%2F%26nbsp%3B%3C%2FA%3E%3CBR%20%2F%3E2%3A%20Click%20on%20the%26nbsp%3B%3CSPAN%3EAttack%20simulation%20training%3C%2FSPAN%3E%3C%2FP%3E%3CDIV%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%3CP%3EPlease%20be%20aware%20that%20this%20is%20in%20preview%2C%20but%20all%20functions%20that%20i've%20tried%20have%20been%20working%20just%20fine.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1979227%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Attack%20Simulator%20is%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1979227%22%20slang%3D%22en-US%22%3EGood%20to%20bring%20that%20up%20Pontus!%3CBR%20%2F%3ENot%20to%20promote%20in%20any%20way%20but%20I%20expect%20to%20have%20a%20new%20blog%20about%20Attack%20Simulation%20Training%20written%20by%20myself%20to%20be%20added%20to%20practical365.com%20this%20week.%3CBR%20%2F%3EAs%20you%20said%20the%20Simulation%20Training%20has%20a%20lot%20of%20extras%20including%20some%20really%20good%20reporting%20capabilities%20and%20some%20nice%20security%20awareness%20training%20you%20can%20offer%20to%20your%20users.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1981132%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Attack%20Simulator%20is%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1981132%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F399562%22%20target%3D%22_blank%22%3E%40BemmelenPatrick%3C%2FA%3E%26nbsp%3BAwsome%2C%20looking%20forward%20to%20see%20it!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1985788%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20Attack%20Simulator%20is%20not%20working%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1985788%22%20slang%3D%22en-US%22%3EHello%20Pontus%2C%20happy%20to%20announce%20that%20the%20blog%20has%20just%20been%20posted%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fpractical365.com%2Fsecurity%2Fhow-to-train-your-users-against-threats-with-attack-simulation-training%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fpractical365.com%2Fsecurity%2Fhow-to-train-your-users-against-threats-with-attack-simulation-training%3C%2FA%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I've been a fan of this great little tool for over a year and it stopped working from a few days ago. I use its Spear Phishing (Credentials Harvest) attacks. And since Monday, I can't seem to launch a new attack. I'm a Global Admin and I tried this with Chrome, Edge, IE and Firefox but no luck. 

14 Replies

Open a support case.

What happens when you try to launch the attack? Do you get an error message or does the GUI simply doesn't respond?
Are your licenses still active and do you have the correct licenses assigned?
You will need a license which contains at least the Microsoft Defender for Office 365 Plan 2 license option.
Please let us what steps you are taking to launch the attack.
I have E5 license and I used to work with this tool. Nothing changed in my subscription and I'm a global admin. No error messages pop up. The attack simply doesn't execute. No emails sent. Microsoft acknowledged this and they're working to fix it.

Hi isurudiv,
Good to hear that Microsoft is taking care of it, hopefully it will be resolved soon.

best response confirmed by isurudiv (Occasional Contributor)
Solution

@isurudiv 
This might be a little off topic, but I would recommend you to try the new attack simulation training feature instead of the old attack simulator tool found in the Security & Compliance center.

The new feature enables you to use a whole different kind of payloads, and also is able to give the end-user access to trainings.
You can find this new attack simulation training in the M365 Security Center:
1: Go to https://security.microsoft.com/ 
2: Click on the Attack simulation training

 

Please be aware that this is in preview, but all functions that i've tried have been working just fine.

Good to bring that up Pontus!
Not to promote in any way but I expect to have a new blog about Attack Simulation Training written by myself to be added to practical365.com this week.
As you said the Simulation Training has a lot of extras including some really good reporting capabilities and some nice security awareness training you can offer to your users.

@BemmelenPatrick Awsome, looking forward to see it!

It's resolved now. And Microsoft has a brand new Attack Simulator in https://security.microsoft.com
Thanks, and I've discovered this recently. It's improved a lot and the new tool is pretty handy.

@Pontus Själander How do you actually launch a new attack from the https://security.microsoft.com/ Attack Simulator Training?  If you go into the link to learn more about it, it says to go to https://protection.office.com/attacksimulator which is the old version being retired next week?

@Pontus Själander I think it's a permissions issue - what role do I need to create new simulation in the new https://security.microsoft.com/attacksimulator please?  Thank you

Hi Sarah,

I would advice you to take a look at this article, there are a couple of roles available for the Attack Simulation that might fit your needs:
https://docs.microsoft.com/nl-nl/microsoft-365/security/office-365-security/permissions-in-the-secur...