Phishing Simulation Results

The question it answers: Who clicks or gives away credentials in phishing simulations, who does it again, and who has overdue training?

Who clicks, who gives away credentials, who does it again - and who never finished the training they were assigned. Repeat offenders are the people most likely to fall for the real thing and are listed first.

Note

The coverage reports only list users who were part of at least one simulation; people never targeted do not appear.

At a glance

Where in the app	Tenant › Phishing Simulations
Workload	Security
Kind	Table
Data	Built from the tenant data IntensiveReports keeps in memory and refreshes in the background, so it opens at once.
Licence	Microsoft Defender for Office 365 Plan 2 (or Microsoft 365 E5) for Attack Simulation Training.
Report id (API and MCP)	tenant.security.phishing-simulations

Columns

Column	Key	Type
User	DisplayName	Link
E-mail	Email	Text
Repeat offences	RepeatOffences	Status
Simulations	SimulationCount	Text
Clicked	ClickCount	Text
Compromised	CompromisedCount	Text
Trainings done / assigned	TrainingsCompleted	Text
Overdue	TrainingsOverdue	Text
Latest simulation	LatestSimulation	Date

Filters

Filter	Key (API)	On when the page opens
Only users who clicked, were compromised or have overdue training	at-risk	Yes

What it needs

Licence: Microsoft Defender for Office 365 Plan 2 (or Microsoft 365 E5) for Attack Simulation Training.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AttackSimulation.Read.All	Microsoft Graph	Read attack simulation data of an organization

Data sources it reads

• GET /v1.0/reports/security/getAttackSimulationSimulationUserCoverage
• GET /v1.0/reports/security/getAttackSimulationRepeatOffenders
• GET /v1.0/reports/security/getAttackSimulationTrainingUserCoverage

Through the API and MCP

GET /ir-api/v1/reports/tenant.security.phishing-simulations?size=100
GET /ir-api/v1/reports/tenant.security.phishing-simulations?filter=at-risk

An AI assistant reads it with the MCP tool get_report and the id tenant.security.phishing-simulations. The client needs the Read grant for Security. See Using the API.