A Tenant payload is the appropriate configuration because it enables administrators to create and customize simulated phishing messages specifically for their organization. Microsoft Defender for Office 365 Plan 2 provides Attack simulation training, including the Credential Harvest technique, to assess how users respond to realistic phishing attempts.
When creating a tenant payload, administrators can customize the simulated email content, select a phishing URL, insert phishing links into the message body, and incorporate organization-specific language, branding, and contextual information. These capabilities satisfy the requirement for a custom phishing link and company-based terminology.
Option A is incorrect because a tenant landing page controls the destination experience after a user interacts with a simulated phishing link. It does not configure the phishing email itself.
Option B is incorrect because custom end-user notifications provide simulation-related communications, such as training or reinforcement messages, rather than defining the simulated attack payload.
Option D is incorrect because Global payloads are Microsoft-provided templates. Although useful for standardized simulations, they are not the appropriate mechanism for creating an organization-specific phishing message.
Creating a Tenant payload therefore fulfills both customization requirements.
Microsoft References:
https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-payloads
