Test your employee's with a fake Phishing Attack using Microsoft Office 365

The single most effective cyber security training your business can do isn't a poster, a slide deck or a 45-minute video. It's a realistic fake phishing email, sent to your team without warning, followed by a "you fell for this, here's why" landing page when they click.

Microsoft 365 includes the tooling to do this for free with Microsoft Defender for Office 365 (Plan 2) or Microsoft 365 E5. It's called Attack Simulation Training and most UK businesses with the right licence aren't using it. This guide walks through exactly how to set up your first phishing simulation, what to send, and how to run the programme so you actually reduce risk instead of just ticking a compliance box.

Why fake phishing actually works

A real phishing attack is the most common way UK businesses get breached, the National Cyber Security Centre's annual cyber breaches survey puts phishing as the cause of the majority of incidents reported by SMEs. Awareness courses don't move the needle much. People nod along, then click anyway when an email looks urgent enough.

A simulated phishing email is different because the lesson lands at the moment of failure. People remember the embarrassment. They click slower next time. Repeat the exercise quarterly and click rates fall from 30%+ on a first run to under 5% within a year, we've seen exactly that pattern across our own Birmingham clients.

What you need before you start

Before you can send a simulation, check you have:

1. The right Microsoft 365 licence. You need Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5. Plan 1 doesn't include Attack Simulation Training. If you're on Business Premium, you're not covered, you'd need to add Defender Plan 2 separately or look at a third-party tool like KnowBe4.
2. Global Administrator, Security Administrator or Attack Simulation Administrator role in your tenant.
3. Permission from the business. Phishing your colleagues without telling the leadership team is a fast way to start an awkward conversation. Tell HR and the directors what you're doing and why, and confirm the click-throughs won't go on anyone's record as a disciplinary issue.

How to launch your first simulation (step by step)

1. Go to security.microsoft.com.
2. In the left nav, click Email & collaboration → Attack simulation training.
3. Click Launch a simulation.

Step 1: Select a technique

Microsoft offers five techniques. For a first run, pick Credential Harvest, it's the most common real-world tactic. Recipients click a link and are taken to a fake Microsoft 365 login page; if they enter their credentials (which Microsoft never actually receives), they fail.

Step 2: Name the simulation

Use something clear like "Q1 2026, Credential Harvest, Finance Team". This shows up in your reporting.

Step 3: Choose a payload

Pick from Microsoft's library or write your own. The library has hundreds of templates by industry, sophistication and theme. Good first-run picks for a UK business:

• "Document shared with you", looks like a SharePoint share notification.
• "Suspicious sign-in detected", looks like a Microsoft security alert.
• "Urgent invoice payment", looks like an accounts query (works alarmingly well on finance teams).

Write your own only after you've run a couple of off-the-shelf ones. Bad payloads are obvious to recipients and the lesson is wasted.

Step 4: Pick the target users

For your first simulation, pick a small, friendly group, maybe the leadership team or your IT team, to test the workflow. After that, target a department, then the whole company.

You can exclude users (handy for the receptionist who's already overwhelmed, or anyone on long-term leave).

Step 5: Assign training

This is the bit most companies skip and it's the entire point. Configure training assignment so anyone who clicks gets automatically enrolled in a 5–10 minute follow-up training module on phishing recognition. Microsoft's built-in training is decent and tracks completion.

Set a deadline (two weeks is reasonable). Anyone who doesn't complete it gets a reminder, and a manager-level escalation if they ignore the reminder.

Step 6: Configure the landing page

When someone clicks the phishing link, they get redirected to a landing page. The default Microsoft page is fine but a custom one is better. Include:

• A clear, kind explanation of what just happened.
• The specific red flags in the email they should have spotted.
• A link to the training module.
• A reminder of how to report a real phishing email in Outlook (the "Report Message" button or Report Phishing add-in).

Don't make it embarrassing. Aim for "your colleague is teaching you, not your school teacher".

Step 7: Schedule & launch

Pick a delivery window. Spread it over a few hours so people aren't all clicking at once and warning each other. Launch.

What "good" looks like on a first run

Be ready for these numbers. They're normal:

• Click rate: 25–35% on a first-time run for a typical UK SME with no prior training.
• Credential entry rate: 8–15% of those clicks (i.e. people who not only clicked but typed in their password).
• Report rate: under 10%. People who recognise it as phishing usually just delete it instead of reporting.

The point isn't to feel bad. The point is the baseline. Run the same kind of simulation 3 months later and the click rate should drop to 15%. Six months in, single digits.

What to do after the first run

1. Email the whole company within 48 hours explaining what just happened, what the click rate was (anonymised), and why you did it. Transparency builds trust. Hiding it breeds resentment.
2. Brief department managers with their team's stats so they can have a quiet word with high-clickers.
3. Schedule the next one, quarterly cadence is the sweet spot.
4. Add reporting suspicious email to onboarding for all new hires.

Things to avoid (the easy mistakes)

• Don't impersonate real people inside the company. Faking the CEO's email address to test people is technically possible but it crosses a line. Use generic external senders.
• Don't impersonate genuine, urgent national events, pension changes, HMRC penalties, NHS appointments. Yes, real attackers do, but you're trying to teach, not traumatise.
• Don't run a simulation during your busiest period, tax year-end, Black Friday, year-end reporting. People are stressed and the clicks won't reflect normal behaviour.
• Don't punish clickers individually. Statistically, even smart, security-conscious people click eventually. The right response is more training, not naming and shaming.
• Don't run one simulation and call the project done. Phishing simulation only works as an ongoing programme.

Beyond simulations: the wider phishing defence

Simulations train people. They don't replace the technical layers that catch most attacks before anyone sees them. A proper anti-phishing stack also includes:

• MFA on every account, see our MFA setup guide. MFA stops most credential theft attacks dead.
• Microsoft Defender for Office 365 Safe Links and Safe Attachments, automatically detonates dodgy URLs and files.
• Anti-spoofing rules in Exchange so emails impersonating your domain are caught.
• DMARC, SPF and DKIM properly configured so other companies can't be impersonated using your domain.
• Conditional Access policies to block sign-ins from impossible locations.
• A reporting workflow so when someone does spot a real phishing email, IT sees it within minutes, not days.

These are all part of the cyber security work we do for managed clients, and the bit most businesses get badly wrong if they're trying to DIY.

What about businesses without Defender Plan 2?

If your licence doesn't include Attack Simulation Training, you have two choices:

1. Upgrade. Defender for Office 365 Plan 2 is around £4 per user per month and includes a lot more than simulations.
2. Use a dedicated platform, KnowBe4, Hoxhunt, Proofpoint Security Awareness Training. All have UK delivery, and most are licensed per user per month with similar functionality.

For most Birmingham SMEs we work with, the Defender Plan 2 upgrade pays for itself the first time it stops a credential phishing attempt, see our piece on the 10 benefits of IT security for a business for the broader value case.

Quick checklist for your first phishing simulation

• Confirm Defender Plan 2 / E5 licence
• Tell directors and HR what you're planning
• Pick a small test group first
• Use an off-the-shelf credential-harvest payload
• Assign automatic follow-up training to anyone who clicks
• Schedule it outside busy periods
• Plan the all-company "this happened, here's why" email before you launch
• Diarise the next one for 90 days later

If you'd like a hand running phishing simulations for your team, payload selection, scheduling, post-simulation training, ongoing reporting, that's something we do as part of standard managed cyber security and our cyber security consultancy work for clients across Birmingham and the West Midlands. Get in touch for a free baseline assessment.

Staff also need the basics covered, including how to recall an email in Outlook when a message goes out to the wrong recipient.