Security awareness training fails for one boring reason: somebody sets it up, it runs once, and eighteen months later nobody has done anything. usecure’s Auto Enrol exists precisely to stop that, and it is the part worth spending your time on. Getting the users in is the easy half.
Getting the users in
Three routes. If you run Microsoft 365, use the sync and stop reading this section.
Microsoft 365 or Google Workspace sync
- Start the sync setup. In platform settings, go to the Microsoft 365 section and choose Sign in with Microsoft. For Google it is Sign in with Google in the equivalent section.
- Choose the permission model. Application permissions is the recommended one, because the sync then runs as a background service rather than depending on one person’s account. Delegated permissions is the alternative.
- Work through the wizard. There are more steps than you expect, around a dozen, and they matter. The email mapping defaults to user principal name only, which is right for most tenants.
- Test before you activate. Run the test sync and look at what comes back. This is where you catch shared mailboxes and service accounts being pulled in as people.
- Let it run. Once active, new starters are imported automatically, usually within 24 hours.
A straight tenant sync will happily import shared mailboxes, meeting rooms, service accounts and the mailbox belonging to somebody who left in 2019. Every one of them counts as a user who never completes any training, and they will sit there dragging your completion figures down forever. Clean the list on the first run.
By hand, or by spreadsheet
On the Users tab you can add one person at a time, entering their name, email address, language and group, with an optional manager. For a batch, use the import option and upload a CSV. Download usecure’s template first and fill that in rather than building your own file, because the column headings have to match.
There is a User ID option for people who genuinely have no email address, which is occasionally useful in businesses with shop floor or warehouse staff.
The Gap Analysis
When you first switch Auto Enrol on, everybody is sent a Gap Analysis questionnaire. It takes ten to fifteen minutes and it is multiple choice. It has to be done before courses start flowing, because the answers set the order in which each person receives their training.
This is the one thing you should tell people is coming, because it is a fifteen minute questionnaire landing unannounced and it will be ignored otherwise. A two line email from someone senior saying it is happening and roughly why will double your completion rate.
Setting up Auto Enrol
- Open the setting. In platform settings, click Auto Enrol under the uLearn tab.
- Choose the cadence. Set how many weeks between send outs, plus the weekday and time. usecure’s recommended default is every 4 weeks, and that is a sensible place to start.
- Exclude what you need to. The Course Deny List keeps specific courses out of the rotation. Exclude from auto-enroll, on an individual user’s record, keeps a person out entirely.
- Set a minimum pass score. You can set one for all Auto Enrol courses. Anyone who fails is re-enrolled automatically, which is the behaviour you want.
- Kick it off. There is an option to subscribe people immediately rather than waiting for the next scheduled send.
How the courses progress
There are three difficulty tiers, beginner, intermediate and advanced, with twelve courses in each. Everybody works through a whole tier before anyone moves up. The Gap Analysis decides the order of courses within a tier, not which tier somebody starts in.
Compliance courses and any custom courses you have built do not go out through Auto Enrol. Those have to be assigned deliberately, which is easy to forget if you have promised a client that their compliance training is automated.
Tuesday or Wednesday mid-morning beats Friday afternoon and beats Monday at nine, when everybody is digging out of their inbox. It sounds trivial. It moves completion rates more than the content does.
Keeping it alive
- Course reminder emails have their own frequency setting, and they are the difference between 40 per cent completion and 85 per cent.
- Look at completion once a month, not once a year. Ten minutes.
- Give managers their team’s figures rather than sending everything to one person in IT. Training completion is a management problem wearing a technology costume.
- When somebody leaves, take them out. Otherwise they stay on the report forever as permanently overdue.
Common questions
- Do people need a password?
- No. Access is by link rather than by password, which removes the commonest excuse for not doing it. There is a separate guide on what your people actually see.
- Somebody says they never got the email.
- Check they are in the platform and not excluded, then check your own filtering. usecure’s sending domains sometimes need allow-listing.
- Can I report on this for our cyber insurance or an audit?
- Yes, and it is one of the better reasons to run it properly. Ask us and we will set up a scheduled report.
- Can you just run the whole thing for us?
- Yes. That is what most clients do, and it is included in the way we normally set usecure up.
If you need a hand
Call the service desk on 03333 22 11 00 or email support@easylifeit.com.
Take this guide with you
A clean branded copy you can print or save as a PDF, with our service desk details on every page.
Steps checked against usecure’s help centre, How to add users, Setting up Microsoft 365 synchronisation and Automatically send out courses with Auto Enrol, September 2026. The advice on cadence, exclusions and who should see the reports is our own.
