Nudges and Interventions share exactly the same catalog of triggers, grouped by content type. This article lists every option available in the selector, in the same order shown on the platform.
What is a trigger?
A trigger is the event that activates the sending of a Nudge or an Intervention. When creating a rule:
- Select the content type you want to act on (Interactive Module, Video, Phishing, etc.).
- Choose one or more triggers within that content type.
- Configure the action that will run when the selected event occurs.
The trigger catalog is identical for Nudges and for Interventions. The difference between the two features is not in the available triggers, but in the type of action configured from them.
Full trigger catalog
Interactive Modules
- When a user receives an assigned Interactive Module
- When a user starts an Interactive Module
- When a user completes an Interactive Module
Videos
- When a user receives an assigned Video
- When a user starts a Video
- When a user completes a Video
- When a user answers a Video's quiz correctly
- When a user answers a Video's quiz incorrectly
Video Games
- When a user receives an assigned Video Game
- When a user starts a Video Game
- When a user completes a Video Game
- When a user joins an existing Video Game room
- When a user creates a Video Game room
- When a user gets the best score at the end of a Video Game campaign
- When a user ranks among the top three scores at the end of a Video Game campaign
Newsletters
- When a user receives an assigned Newsletter
- When a user opens a Newsletter
- When a user answers a Newsletter correctly
- When a user answers a Newsletter incorrectly
Phishing
- When a user receives a Phishing simulation email
- When a user opens a Phishing simulation email
- When a user clicks a Phishing simulation link
- When a user enters data on a Phishing simulation site
- When a user reports a Phishing simulation email
- When a user reports an email that is not a Phishing simulation
Smishing
- When a user receives an assigned Smishing
- When a Smishing is delivered to the user's device
- When a user clicks the Smishing simulation link
- When a user enters data in the Smishing simulation
- When a Teachable Moment is sent by email after Smishing
- When a user opens the Smishing Teachable Moment
- When a user answers the Smishing Teachable Moment correctly
- When a user answers the Smishing Teachable Moment incorrectly
Ransomware
- When a user receives a Ransomware simulation
- When a user opens a Ransomware simulation email
- When a user downloads the Ransomware simulation file
- When a user opens the Ransomware downloaded from the link
- When a user opens the Ransomware downloaded from the attachment
- When possible encryption is detected in the user's folder
- When a Teachable Moment is sent by email after Ransomware
- When a user opens the Ransomware Teachable Moment
- When a user answers the Ransomware Teachable Moment correctly
- When a user answers the Ransomware Teachable Moment incorrectly
- When a user reports a Ransomware simulation
Microsoft 365 Defender
- A user's click on a potentially malicious URL was detected
- A mail forwarding or redirect rule was created
- A user was elevated to Exchange administrator
- Messages containing malware were removed after delivery
- Messages containing malicious URLs were removed after delivery
- Messages containing phishing URLs were removed after delivery
- Messages from a campaign were removed after delivery
- Messages were removed after delivery
- An email was reported as junk
- An email was reported as malware or phishing
- An email was reported as not junk
- The email sending limit was exceeded
- An Exact Data Match upload failure occurred
- A form was blocked for potential phishing attempt
- A form was flagged and confirmed as phishing
- A message with malware was delivered because ZAP was disabled
- Messages containing malicious entity were not removed after delivery
- A phishing message was delivered due to an Exchange transport rule
- A phishing message was delivered due to the allowed IP address policy
- A phishing message was delivered because ZAP was disabled
- Potential Nation-State Activity was detected
- A Reply-all storm was detected
- An Exact Data Match was successfully uploaded
- Suspicious email forwarding activity was detected
- Suspicious email sending patterns were detected
- A Teams message was reported as a security risk
- Release of a quarantined message was requested
- The user was restricted from sending email
- The user was restricted from sharing forms and collecting responses
Triggers from Microsoft 365 Defender require the integration with that platform to be configured. Without an active integration, these events are not generated.
Exams
- When a user receives an assigned Exam
- When a user starts an Exam
- When a user passes an Exam
- When a user fails an Exam
Surveys
- When a user receives an assigned Survey
- When a user starts a Survey
- When a user completes a Survey
Best practices
Define the goal of the communication first (reinforcing a good practice, warning about a risk, congratulating an achievement), and then choose the trigger that best represents it, rather than starting from the trigger.
Combine triggers from different moments of a campaign's lifecycle (assignment, start, completion) when you want to accompany a user through the whole process, not only at the end.
Check that the corresponding integration is active before configuring Microsoft 365 Defender triggers, since without it the rule will never run.
Avoid overlapping several rules with very similar triggers on the same content type, as this can generate duplicate notifications to the user.