MS Defender User Coverage Report - discrepancies between webview and csv report

The discrepancy is caused by the fact that the web view and the exported CSV are not showing or aggregating the data in the same way, even though they are based on the same underlying simulation events.

From the available information about Attack simulation training reporting:

1. The web Attack simulation report views (including User coverage and related cards) show summarized, UI‑filtered metrics for a given time range, simulation set, and filters applied in the portal. These views typically present high‑level counts such as “Simulated users” vs. “Non‑simulated users” and summary compromise/click rates for the selected simulations.
2. When exporting to CSV, the report includes more detailed, per‑event and per‑user fields than are visible in the web grid, and these are not always aggregated in the same way as the web chart. The documentation explicitly notes that:
   • “When you export information from the reports, the CSV file contains more information than what's shown in the report, even if you have all column shown.”
   • The CSV includes many event‑level columns (for example, Compromised, AttachmentOpened_TimeStamp, AttachmentLinkClicked_TimeStamp, etc.), which can result in multiple rows per user across multiple simulations.
3. Because the CSV is more granular, counting “Count of Compromised” or “Count of Clicked” directly from the CSV without mirroring the portal’s aggregation logic can inflate numbers:
   • The web view typically counts users or simulations according to the report’s definition (for example, users who met the compromise condition within the selected simulations and filters).
   • The CSV may contain multiple records per user across simulations and events, so a simple count of rows or events can be much higher than the summarized “user‑level” counts shown in the UI.
4. Filters and scope also matter:
   • In the web view, the Filter control on the report (for example, by simulation type, status, or training status) directly limits which simulations and users are included in the summary counts.
   • If the same filters (time range, simulation set, simulation type, status) are not applied consistently when analyzing the CSV, the exported data can include additional simulations or events, leading to higher “Count of Compromised” or “Count of Clicked” than what is visible in the current UI view.
5. Reporting behavior is also tied to how events are captured:
   • Attack simulation training relies on audit logging and captures multiple user interaction signals (Compromise, Report, Read, Delete, Reply, Forward, Attachment opened, etc.).
   • These signals are recorded per event and per user and then summarized into the portal views. The CSV exposes those raw signals; the portal shows the aggregated result.

To reconcile the numbers:

1. Ensure the same scope as the web view
   • Match the simulation set, date range, and any filters used in the portal (simulation type, status, training status) when querying or pivoting the CSV.
2. Aggregate at user level
   • In the CSV, group by user (and, if needed, by simulation) and then count distinct users who were compromised or clicked, instead of counting raw rows or events.
3. Use the built‑in reports as the authoritative view
   • The documentation recommends using the built‑in Attack simulation training reports for user activity, as they apply the correct aggregation and filtering logic for simulation messages.

If, after matching filters and aggregation, the discrepancy persists, the next step is to open a support case so that the exact simulation set, tenant configuration, and export can be reviewed, as the public documentation does not expose further internal aggregation rules.

References:

• Reports for Attack simulation training
• Attack simulation training deployment considerations and FAQ