AttackSimulation.Read.All
— application permission, granted to the app registration with admin consent.
Licence: Microsoft Defender for Office 365 Plan 2 (or Microsoft 365 E5) for Attack Simulation Training.
Endpoints:
GET /v1.0/reports/security/getAttackSimulationSimulationUserCoverage · GET /v1.0/reports/security/getAttackSimulationRepeatOffenders · GET /v1.0/reports/security/getAttackSimulationTrainingUserCoverage
The coverage reports only list users who were part of at least one simulation; people never targeted do not appear.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Phishing Simulation Results
Who clicks, who gives away credentials, who does it again - and who never finished the training they were assigned. Repeat offenders are the people most likely to fall for the real thing and are listed first.
No user has been part of an attack simulation yet.