Accred Aware
Checked November 2, 2026 by Accred Consulting
Accred Aware is an app for MSPs whose clients use Microsoft Defender for Office 365 Attack simulation training.
Free preview in Hub
Accred Aware is included in Hub at no charge during the preview, for every Accred organization. Owners, Admins, and Members can open it; Viewers cannot. An Owner or Admin connects each client tenant through the client’s admin consent to Aware’s own Microsoft Entra app. Sample clients work too, so anyone can try Aware without a tenant. Each client tenant needs Microsoft Defender for Office 365 Plan 2, which is included in Microsoft 365 E5.
What Aware shows
- Every client tenant side by side, with click, compromise, and report rates for the last 90 days against the 90 days before.
- Repeat offenders: people caught by two or more simulations in the last 12 months.
- Simulation coverage and training coverage: who has been sent a simulation, and who has been assigned training.
- Training completion for each client.
- Trends over 12 months, as a chart or a table. Aware keeps the monthly figures itself, so the history is there when you need it.
- Results by department.
- A CSV export on every table, links to each client’s Microsoft Defender portal, and an audit log of what people did in Aware.
Each Accred organization can connect up to 100 client tenants. Aware reads each client again on a schedule, and Refresh on any page reads it now.
Launch Microsoft’s simulations from Aware
Owners and Admins can launch Microsoft’s own simulations for a client from Aware: choose one of Microsoft’s payloads, who receives it (all users, the client’s repeat offenders, or people you list), Microsoft’s training, and a start time, then launch it, schedule it, or save it as a draft. Aware asks Microsoft Defender to run it, shows its status, and lets you cancel it.
- Pick the technique and one of Microsoft’s own payloads.
- Choose who receives it: all users, the client’s repeat offenders from Aware, or people you list.
- Assign Microsoft’s training, or none.
- Start it now, schedule it, or save it as a draft that sends nothing.
- Follow its status from Microsoft under Launched from Aware, and cancel it there. The audit log records each launch with the number of recipients, not their addresses.
Launching needs the optional AttackSimulation.ReadWrite.All permission in the client’s admin consent. Reports work without it. A client that consented before that permission existed shows that it hasn’t allowed launching yet, with Reconnect client; its reports keep working.
With sample clients, nothing reaches Microsoft and nothing is sent: Aware follows a sample launch on its own clock.
A monthly summary for each client
For each client, Aware writes the month’s results in plain English, ready to send to the client. Copy it, print it, or export its figures as CSV.
Repeat offenders are not named in the summary unless you turn names on for that summary.
What Microsoft Defender does
Microsoft Defender runs every simulation: it sends the email, hosts the login and landing pages, sends the notifications, and assigns the training. Aware sends no email itself, builds no payloads, hosts no pages, and captures no credentials.
Aware does not replace Microsoft Defender. The simulations, payloads, pages, and training are Microsoft’s; Aware launches Microsoft’s simulations and reports on them across your client tenants.
What each client tenant needs
Each client tenant needs Microsoft Defender for Office 365 Plan 2, which is included in Microsoft 365 E5. Without it, Microsoft has no attack simulation data for Aware to read, so Aware shows a clear “not available” state with the requirement instead of an error.
Launching needs the optional AttackSimulation.ReadWrite.All permission in the client’s admin consent. Reports work without it.
Removing a client from Aware deletes everything Aware stored for it.
Why Aware, when Defender has reports
Microsoft’s own Attack simulation training reports, and its tools to launch simulations, come with Defender for Office 365 Plan 2 at no extra cost, and they work well for one tenant. Aware is the multi-tenant layer for MSPs: one view across every client instead of one Defender portal per tenant, trends that Aware keeps, a client-ready monthly summary, CSV export, and Microsoft’s simulations launched for any client from the same place, all inside Accred Hub.
If you look after a single tenant, Defender’s own portal may be all you need.
Pricing
| Term | Price |
|---|---|
| Today | Included in Hub at no charge during the preview |
| Planned, monthly | $0.50 per user per month |
| Planned, billed annually | $0.40 per user per month ($4.80 per user per year) |
| Minimum | None |
| Who counts as a user | A person targeted by at least one simulation in a connected client tenant in the last 12 months |
| Before the first charge | Accred emails your organization’s Owners and publishes the price on the Pricing page at least 30 days ahead |
The planned price applies only once Hub billing for Aware opens. Until then Aware costs nothing, and Hub is free.
Questions
Is Accred Aware available?
Yes, as a free preview in Accred Hub. An Owner or Admin connects each client tenant through the client’s admin consent to Aware’s own Microsoft Entra app. Sample clients work too, so anyone can try Aware without a tenant.
Does Accred Aware send phishing emails?
No. Microsoft Defender runs every simulation: it sends the email, hosts the login and landing pages, sends the notifications, and assigns the training. Aware sends no email itself, builds no payloads, hosts no pages, and captures no credentials. When an Owner or Admin launches a simulation from Aware, Aware asks Microsoft Defender to run it.
Can I launch simulations from Accred Aware?
Yes. Owners and Admins can launch Microsoft’s own simulations for a client from Aware: choose one of Microsoft’s payloads, who receives it (all users, the client’s repeat offenders, or people you list), Microsoft’s training, and a start time, then launch it, schedule it, or save it as a draft. Aware asks Microsoft Defender to run it, shows its status, and lets you cancel it. Launching needs the optional AttackSimulation.ReadWrite.All permission in the client’s admin consent. Reports work without it.
What does each client tenant need?
Each client tenant needs Microsoft Defender for Office 365 Plan 2, which is included in Microsoft 365 E5. Without it, Aware shows that attack simulation data is not available, and why.
How much does Accred Aware cost?
Accred Aware is included in Hub at no charge during the preview, for every Accred organization. When Hub billing for Aware opens, the planned price is $0.50 per user per month, or $0.40 billed annually ($4.80 per user per year), with no minimum. A user is a person targeted by at least one simulation in a connected client tenant in the last 12 months. Before Aware is charged for, Accred emails your organization's Owners and publishes the price on the Pricing page at least 30 days before the first charge.
Does Accred Aware replace Microsoft Defender’s reports?
No. Defender’s own reports are free with Plan 2 and good for one tenant. Aware puts every client in one view, keeps 12 months of trends, and writes a monthly summary for each client. The data and the training stay Microsoft’s.
Sources
- Get started using Attack simulation training · Microsoft Learn
- Reports for Attack simulation training · Microsoft Learn
- Simulate a phishing attack with Attack simulation training · Microsoft Learn
Create your organization, then open Aware.
Aware is free during its preview, and Hub is free. When Hub billing for Aware opens, the planned price is $0.50 per user per month, or $0.40 billed annually, and Accred gives your Owners 30 days’ notice first.