Skip to content

Commit 6d91aeb

Browse files
authored
Update simulation data recording details
We are making following changes and have communicated to admins via MC1166864 (internal reference: https://lynx.office.net/messagecenter/MC1166864) User interaction signals (such as compromise, report, read, delete, reply, forward, out-of-office, attachment opened) will be captured consistently until the simulation concludes. Training-related events (such as training completed or in progress) will continue to be reflected in simulation reporting even after the simulation ends, up to the training due date. The doc update is reflect the update about user interaction signals being captured consistently after December 2025. Note that rollout varies by environment. General Availability (Worldwide): Rollout begins mid-November 2025 and completes by late November 2025. General Availability (GCC, GCC High, DoD): Rollout begins late November 2025 and completes by mid-December 2025.
1 parent 7c683d2 commit 6d91aeb

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

defender-office-365/attack-simulation-training-faq.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,8 @@ If you own the sender domain, the undelivered simulation report is returned in a
165165
## Reporting issues
166166

167167
> [!TIP]
168-
> Simulation data recording starts a few minutes after the simulation is launched and after users begin interacting with the simulation messages. There's no fixed start time. Events are still captured after the simulation ends.
168+
> Simulation data recording starts a few minutes after the simulation is launched and after users begin interacting with the simulation messages. There's no fixed start time. Events are still captured after the simulation ends.(Note that post December 2025, as described in admin notification MC1166864 - User interaction signals (such as compromise, report, read, delete, reply, forward, out-of-office, attachment opened) will be captured consistently until the simulation concludes. Training-related events (such as training completed or in progress) will continue to be reflected in simulation reporting even after the simulation ends, up to the training due date)
169+
169170

170171
### Differences in user activity data from Attack simulation training reports and other reports
171172

0 commit comments

Comments
 (0)