A phishing simulation sends your own staff a safe, fake phishing email, records who clicks, and turns the moment into a short lesson. Microsoft’s version is called Attack simulation training, and it is easy to assume it comes with Microsoft 365. In reality, it comes with part of Microsoft 365. However, Attack simulation training needs a Microsoft 365 E5 licence or the Defender for Office 365 Plan 2 add-on. Microsoft 365 Business Premium, the plan Microsoft aims at small and medium businesses, includes Plan 1. Plan 1 filters and blocks phishing. Testing your people is a Plan 2 feature.
That distinction is worth knowing before an insurer’s questionnaire asks whether you run simulations. It is also worth knowing before you pay for something a second time. Here is which plans include it, what the tool does, the two routes if your plan leaves it out, and how to run a first campaign without turning your staff against the whole idea.
Which Microsoft plans include a phishing simulation
Microsoft’s own comparison puts Attack simulation training in the Plan 2 column, alongside the threat explorer and automated investigation tools. Plan 1 covers Safe Links, Safe Attachments and the anti-phishing policies that filter bad mail before it arrives. Where your subscription sits decides what you have.
| Subscription | Defender for Office 365 | Phishing simulation |
| Business Basic or Standard | None included | No |
| Business Premium | Plan 1 | No |
| Microsoft 365 E3 | Plan 1 (since July 2026) | A trial subset only |
| Microsoft 365 E5 | Plan 2 | Yes, in full |
| A plan with mailboxes plus the Plan 2 add-on | Plan 2 | Yes, in full |
The E3 trial is narrower than it sounds. According to Microsoft’s getting-started page, E3 customers can run a credential-harvest simulation and assign two of the training experiences, and no more. This is enough to see how the tool works. However, it will not carry a programme.
If you are unsure which plan you are on, the Microsoft 365 admin centre shows it under billing. In some cases, a licence check may turn up a mix: a few E3 seats bought years ago, the rest on Business Premium. In that case, the trial subset is available to the few. Nothing is available to everyone else.
What Attack simulation training does
Once licensed, the tool lets an administrator choose a technique, pick a payload, select the staff to test and set a schedule. Microsoft’s current techniques, each modelled on real attack patterns, cover:
- credential harvesting
- a malicious attachment
- a link inside an attachment
- a link to malware
- a drive-by URL
- an OAuth consent request
Set those against the phishing styles arriving in UK inboxes this year: AI-written emails and supplier impersonation can be modelled with these techniques. However, voice and text scams cannot and need a different tool. The simulation should look like what your staff will see on a Tuesday afternoon.
Anyone who clicks can be sent to a short training page that explains the tells they missed, and the administrator chooses which training, if any, follows. The tool can also run training campaigns on their own, without a test first, which is a kinder way to start with a team that has never seen one. Among the figures it reports, two matter: how many people clicked, and how many reported the message, provided they report through Microsoft’s own button, since reports made through a separate tool do not show up. The second number is the one to watch over time. A team that reports fast protects the colleague who clicked.
Two routes if you are on Business Premium
Add Defender for Office 365 Plan 2. The add-on is licensed per user, so covering the business means buying it for every mailbox. In return you get the simulation tool plus the investigation features. It suits a business that wants everything inside the Microsoft admin centre, has someone comfortable configuring it, and is paying for Business Premium seats across the board. Microsoft offers a 90-day trial of Plan 2, which is a sensible way to see the tool before any seats are bought. Additionally, your provider can quote the per-user cost on your agreement.
Use a separate awareness-training platform. Several security awareness training vendors sell phishing simulation with a library of ready-made campaigns and built-in training videos, and they work alongside Microsoft 365 without changing your licence. These platforms suit a business that wants a programme run for it, with a scheduled campaign and a report, and does not need the investigation tooling that comes with Plan 2. A managed platform moves the running of campaigns to the vendor. However, it does not remove the need for somebody in the business to read the report and act on it. Whether it costs less than the add-on depends on headcount, the price on your agreement and how much of your own time the Microsoft tool would take. Therefore, compare both quotes against the same number of people.
Either route works. The mistake is assuming the simulation is already there because the word Defender appears on your invoice.
Running a first campaign without poisoning the well
Do simulations work? Run as a trap, scored by name and reported to managers, they teach staff one thing: never click anything from IT, and never admit to clicking. Run as training, with the report rate as the measure, they give you the one number that shows whether people are changing what they do with a suspicious email, which no policy document can. The difference is in how the first campaign is run. Three habits keep it on the right side.
- Tell people it is coming. Say that simulated phishing is now part of how the business works, that nobody is in trouble for clicking, and that reporting a suspicious email is the behaviour you want. Then run the first one a few weeks later.
- Report the team’s numbers. The figures that matter are the click rate and the report rate across the business, campaign after campaign. A single person’s result belongs in a quiet conversation and a training assignment, and nowhere near their manager’s inbox.
- Treat a click as a training moment. Assign the module, move on, and test again next month with a different technique. Over the second and third campaigns, the report rate is the number you want to see climbing.
The Cyber Essentials requirements cover five technical controls and do not ask whether you test your staff. Insurers and larger customers sometimes do, so if the question appears on a renewal form, the honest answer for a Business Premium firm with no add-on is ‘not yet’. Now you know why.
The one line to find on your invoice
Before any decision, look for the words ‘Defender for Office 365’ on your Microsoft invoice or in the admin centre under billing. No plan named means Plan 1 at best, inside Business Premium. However, Plan 2 named means you already own the tool and the only question is who runs it. From there the decision is between the add-on and a separate platform, and it turns on who will read the reports every month. Licence checks like this are part of The Unite Group’s managed IT services, and they cost nothing compared with an add-on bought for a tool that was already there.