Accred Aware

• Every client tenant side by side, with click, compromise, and report rates for the last 90 days against the 90 days before.
• Repeat offenders: people caught by two or more simulations in the last 12 months.
• Simulation coverage and training coverage: who has been sent a simulation, and who has been assigned training.
• Training completion for each client.
• Trends over 12 months, as a chart or a table. Aware keeps the monthly figures itself, so the history is there when you need it.
• Results by department.
• A CSV export on every table, links to each client’s Microsoft Defender portal, and an audit log of what people did in Aware.

Each Accred organization can connect up to 100 client tenants. Aware reads each client again on a schedule, and Refresh on any page reads it now.

Owners and Admins can launch Microsoft’s own simulations for a client from Aware: choose one of Microsoft’s payloads, who receives it (all users, the client’s repeat offenders, or people you list), Microsoft’s training, and a start time, then launch it, schedule it, or save it as a draft. Aware asks Microsoft Defender to run it, shows its status, and lets you cancel it.

• Pick the technique and one of Microsoft’s own payloads.
• Choose who receives it: all users, the client’s repeat offenders from Aware, or people you list.
• Assign Microsoft’s training, or none.
• Start it now, schedule it, or save it as a draft that sends nothing.
• Follow its status from Microsoft under Launched from Aware, and cancel it there. The audit log records each launch with the number of recipients, not their addresses.

Launching needs the optional AttackSimulation.ReadWrite.All permission in the client’s admin consent. Reports work without it. A client that consented before that permission existed shows that it hasn’t allowed launching yet, with Reconnect client; its reports keep working.

With sample clients, nothing reaches Microsoft and nothing is sent: Aware follows a sample launch on its own clock.

For each client, Aware writes the month’s results in plain English, ready to send to the client. Copy it, print it, or export its figures as CSV.

Repeat offenders are not named in the summary unless you turn names on for that summary.

Microsoft Defender runs every simulation: it sends the email, hosts the login and landing pages, sends the notifications, and assigns the training. Aware sends no email itself, builds no payloads, hosts no pages, and captures no credentials.

Aware does not replace Microsoft Defender. The simulations, payloads, pages, and training are Microsoft’s; Aware launches Microsoft’s simulations and reports on them across your client tenants.

Each client tenant needs Microsoft Defender for Office 365 Plan 2, which is included in Microsoft 365 E5. Without it, Microsoft has no attack simulation data for Aware to read, so Aware shows a clear “not available” state with the requirement instead of an error.

Launching needs the optional AttackSimulation.ReadWrite.All permission in the client’s admin consent. Reports work without it.

Removing a client from Aware deletes everything Aware stored for it.

Microsoft’s own Attack simulation training reports, and its tools to launch simulations, come with Defender for Office 365 Plan 2 at no extra cost, and they work well for one tenant. Aware is the multi-tenant layer for MSPs: one view across every client instead of one Defender portal per tenant, trends that Aware keeps, a client-ready monthly summary, CSV export, and Microsoft’s simulations launched for any client from the same place, all inside Accred Hub.

If you look after a single tenant, Defender’s own portal may be all you need.