Microsoft Defender: Temporary restoration and final removal of aged simulation content in Attack Simulation Training

Microsoft Defender for Office 365 will temporarily restore aged simulation content for 2 months starting May 7, 2025, allowing users to review and retain important data. After July 7, 2025, content older than 18 months will be permanently removed. No action is needed to prepare, but users should update or duplicate necessary content.

Coming soon for Microsoft Defender for Office 365 | Attack Simulation Training: We want to inform you about an update regarding your simulation content stored in the Attack Simulation Training experience. As part of our ongoing commitment to data integrity and compliance, Attack Simulation Training enforces an 18-month retention policy for simulation and training data, based on its last modified date. This data includes customer created content like tenant payloads, tenant landing pages, tenant notifications, tenant login pages.

More details are available here:

• Microsoft Defender for Office 365 data retention - Microsoft Defender for Office 365 | Microsoft Learn
• The section about attack simulation FAQs (data retention) in Attack simulation training deployment considerations and FAQ - Microsoft Defender for Office 365 | Microsoft Learn

Recently, we identified and resolved a gap that unintentionally allowed content older than 18 months to be retained beyond the documented limit. With the gap now fixed, content that exceeded the 18-month retention window began to be purged, as per documented policy. However, we recognize that this sudden change may have caused confusion or disruption, and we apologize for the inconvenience.

We are temporarily restoring the affected content (tenant payloads, tenant landing pages, tenant notifications, tenant login pages) for a limited 2-month period. During this period, you will be able to review, validate, and duplicate any content you wish to retain beyond the retention window. After the 2-month period, we will remove the restored content in line with our retention period policy, if the last modified date of the content is older than 18 months from the current date. There should be no impact to the content if the last modified date is earlier than 18 months from the current date. We recommend you review and update your content promptly to ensure you preserve anything important for your simulations or records.

[When this will happen:]

We plan to restore content by May 7, 2025, and it will be available till 60 days from this date (until July 7, 2025).

[How this will affect your organization:]

The data restoration and removal will take place by default, with no action needed from you to prepare. 

You can find content like tenant payloads, tenant notifications, tenant landing pages, and tenant login pages in Defender at Email & collaboration > Attack simulation training > Content library:

[What you need to do to prepare:]

You should review, validate and update any content you wish to retain beyond the retention window. After the 60-day period from the restoration date, content like tenant landing pages/ tenant login pages/ tenant notifications/tenant payloads will be removed if the last modified date is earlier than 18 months from the current date. As an example, if you are accessing the tool on September 9, 2025, then content whose last modified date is earlier than March 9, 2024, will not be visible. You can update or duplicate the content to bring it within the 18-month window.

NOTE: This update does not change or impact the simulation metadata, automation data, payload automation data, or user activity in simulation/training campaigns. We will continue to remove data older than 18 months from these experiences, in line with our documentation.