SecOps - 41036 - Attack Simulation Training is configured and a baseline simulation has been run in the last 12 months

[Sandeep Jha (sandeepjha000)]

Spec-41036

Issue-1056

[Copilot]

Pull request overview

Adds a new SecOps assessment (41036) to evaluate whether Microsoft Defender for Office 365 Attack Simulation Training is configured and has a completed baseline simulation within the last 12 months, using Microsoft Graph (beta) data and producing a markdown results table.

Changes:

• Introduces Test-Assessment-41036 to query attack simulations and simulation automations, evaluate pass/fail/investigate outcomes, and render report details.
• Adds a remediation markdown page for test 41036.
• Extends default Graph scopes to include AttackSimulation.Read.All.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/powershell/tests/Test-Assessment.41036.ps1	New assessment test logic + report generation for Attack Simulation Training baseline activity
src/powershell/tests/Test-Assessment.41036.md	New remediation guidance and results placeholder for test 41036
src/powershell/public/Get-ZtGraphScope.ps1	Adds required Graph permission scope for Attack Simulation Training API access

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.