Connect to a tenant

Enter the client tenant's app registration details and sign in with Microsoft. Nothing is stored — you enter these each time. You can connect several tenants and switch between them.

Sign in

Each client tenant needs a single-tenant app registration with a Web redirect https://asm.prodivi.lt/auth/callback, a client secret, and delegated AttackSimulation.ReadWrite.All User.Read.All Group.Read.All + admin consent.

Build a staggered campaign

Targets are split into batches, each becoming its own Defender simulation with a different launch time. Every user lands in exactly one batch.

1. Campaign & payload

Required for credential-harvest payloads. If Defender rejects with "LoginPage should not be null", select one here.

2. Targets

0 selected
Click "Load users" to pull people from the signed-in tenant.
0 groups · 0 users
Optional: load Entra ID groups. Ticking a group adds its members (nested groups included) to the targets. You can combine groups with individual users above.
Handy for VIPs, admins, or anyone already tested. Overrides selections above.

3. Batching & timing

Adds randomness so batches don't fire on an exact clockwork schedule.
Scatter launches at random across the "spread over" window below instead of the fixed interval (still inside work hours / weekdays if set). Interval & jitter are ignored for placement.
Max 14 (Defender's scheduling limit).
Batches that fall outside the window roll forward to the next in-window slot. Uses your local (LT) time. Uncheck to send around the clock.
Advanced: notification & training settings (JSON)
Defaults to "no training / Microsoft default notifications". Edit only if Graph rejects a create call and you need to adjust the schema.

Campaign dashboard

Aggregated results across all batches of a campaign, live from Defender.

Insights

Cross-campaign analytics: how behavior trends over time, who keeps falling for it, and which teams are most at risk.

Scans every simulation in the tenant & joins with the user directory — can take a moment on large tenants.

Wave campaigns

Full campaigns saved to disk. Each wave sends only the batches inside Defender's 14-day window; the rest wait until you reopen the app later. Nothing needs to run in between.

Build a plan on the Build tab, then "Save as wave campaign" to see it here.

Manage simulations

Cancel, exclude, or delete simulations. Cancel works while a simulation is scheduled or running; exclude removes a cancelled one from reporting; delete removes it entirely.

0 selected

Global report

One full, all-time PDF covering every campaign in this tenant — how many unique people clicked, were compromised, reported, resistance-score distribution, at-risk people, department breakdowns, and more. Saved to the global-reports container in storage.

Scans every simulation in the tenant — may take a moment on large tenants.

Portal clients

Who can sign in to the client portal (clientasm.prodivi.lt). Each client gets a private sign-in link and sees only their own tenant.

Add a client

First create the read-only app registration in the client's tenant (redirect https://clientasm.prodivi.lt/auth/callback, delegated AttackSimulation.Read.All User.Read.All Group.Read.All + admin consent, Assignment required = Yes), then paste its details here.
Saving restarts the portal (~30 s); signed-in clients will need to sign in again.

Clients

Health

Live status of the connection to the active tenant, Microsoft Graph, and report storage.

Setup guide

One-time app registration in Microsoft Entra ID (Azure AD). ~5 minutes.

1. Create the app registration

  1. Go to entra.microsoft.com → Identity → Applications → App registrations → New registration.
  2. Name it e.g. Attack Simulation Manager.
  3. Supported account types: Accounts in any organizational directory (multi-tenant) if you'll manage several tenants, otherwise single tenant.
  4. Skip the redirect URI for now → Register.

2. Add the Web redirect + a client secret (per client tenant)

  1. Create the app registration as single-tenant (Accounts in this organizational directory only) inside the client's tenant.
  2. Open Authentication → Add a platform → Web → redirect URI https://asm.prodivi.lt/auth/callback → Configure.
  3. Open Certificates & secrets → New client secret → copy the Value.

3. Add Graph permissions

  1. Open API permissions → Add a permission → Microsoft Graph → Delegated permissions.
  2. Add: AttackSimulation.ReadWrite.All User.Read.All Group.Read.All
  3. Click Grant admin consent for your tenant. (In each extra tenant, an admin consents on first sign-in.)

4. Add the client in the app

  1. On the app's Overview, copy the Application (client) ID.
  2. On the Connect screen → + Add a client tenant → enter Label, Tenant (domain/GUID), Application ID and the Client secret → Save client.
  3. Then click Sign in next to that client. Repeat for each client tenant.