Unable to cancel or remove training assigned through Defender Attack Simulation

Attack simulation training still does not support directly unassigning or cancelling training that was assigned as part of a completed simulation while retaining that simulation’s statistics.

However, the following supported behaviors and controls can be used to stop or prevent further reminders and to manage future assignments:

1. Cancel the simulation (if still In progress or Scheduled)
   • On the Simulations tab (https://security.microsoft.com/attacksimulator?viewid=simulations), select the simulation with Status = In progress or Scheduled and choose Cancel simulation.
   • Effects when cancelling:
     • For Scheduled simulations: 100% cancellation; no training assignment messages or notifications are sent and the campaign is fully ended.
     • For In progress simulations:
       • Simulation delivery continues to target users.
       • If cancellation occurs after training assignment, training assignments remain due, but subsequent training reminders are canceled.
       • If cancellation occurs before training assignment, trainings are not assigned and no training assignment notifications are sent.
   • The simulation’s Status becomes Canceled, and the simulation and its data remain available; it is not deleted.
2. Cancel Training campaigns (if training was assigned via a Training campaign)
   • On the Training tab (https://security.microsoft.com/attacksimulator?viewid=trainingcampaign), select Training campaigns with Status = In progress or Scheduled and choose Cancel.
   • After cancellation, the Status becomes Canceled. This stops the campaign from continuing, while leaving it listed for reference.
3. Control future reassignments via Training threshold
   • On the Settings tab (https://security.microsoft.com/attacksimulator?viewid=setting), configure the training threshold (default 90 days).
   • During the threshold period, the same training module is not reassigned to users who:
     • Completed the module during the threshold, or
     • Had the module assigned during the threshold but did not complete it.
   • This prevents repeated reassignments of the same module to the same users in new campaigns.
4. Reporting and outstanding training list behavior
   • Training-related events (for example, Training completed or In progress) continue to be reflected in simulation reporting up to the training due date, even after the simulation ends.
   • Users who have not completed assigned training will continue to appear in reports with statuses such as Not Started, In Progress, Overdue, or Not Completed. These statuses are part of the reporting model and are not removed without completion or reassignment logic (for example, via training threshold and future campaigns).
5. Stopping reminder emails in the current supported model
   • For simulations still In progress, cancelling the simulation stops subsequent training reminders while preserving the simulation’s data.
   • For Training campaigns still In progress or Scheduled, cancelling the Training campaign stops further campaign-driven notifications.

There is no documented feature in the provided materials that allows retroactively removing already-assigned training from users or clearing them from the outstanding training list while keeping the simulation and its statistics intact. The supported options focus on cancelling active simulations or Training campaigns (to stop future reminders) and using the training threshold to control future reassignments.

References:

• Simulate a phishing attack with Attack simulation training
• Attack simulation training deployment considerations and FAQ
• Training campaigns in Attack simulation training