Employees and groups

The Employees and Groups tabs let you organize your workforce, target the right populations in phishing campaigns, and track individual exposure over time.

Employees

Employees are the people who receive your phishing simulations. They are imported automatically from your identity provider (Google Workspace or Microsoft 365).

Employee statuses

Each employee has a status that reflects how they are synced with your directory:

Status	What it means	Receives phishing emails?
Active	Synced with your directory and eligible for phishing campaigns.	Yes
Deactivated	Manually deactivated in Stoïk Protect.	No
Inactive	Still exists in your directory but disabled on the provider side (suspended or archived in Google Workspace, or accountEnabled = false in Microsoft Entra).	No
Unsynchronized	No longer returned by the sync, typically because the account was deleted, removed from the group/OU scoping the sync, or the tenant was disconnected.	No

Inactive and Unsynchronized employees are automatically excluded from new phishing campaigns. You don't need to do anything to stop emails from being sent to them.

Deactivate an employee

Deactivating an employee removes them from future phishing campaigns while keeping their historical data.

1

Go to Overview > Team > Employees

2

Select one or several employees

3

Click the Actions button (top right) and select Disable employee

The employee keeps their past results for analysis but will no longer receive phishing emails.

Change an employee's language

By default, Stoïk Protect uses the language provided by the mailbox provider (Google, Microsoft). You can override it per employee to match their usual communication language.

1

Go to Overview > Team > Employees

2

Select one or several employees

3

Click the Actions button (top right) and select Change employee language

4

Choose the language and confirm

Future phishing emails for this employee will use the selected language.

What happens when an employee leaves the company?

You don't need to remove employees from Stoïk Protect manually. In fact, you can't delete them from the interface. This is intentional:

• Historical data is preserved. Past campaigns, click events, and phishing trends remain accurate even after someone leaves.

• The status reflects reality. You can always trace a change back to an action in your own directory.

To offboard an employee, simply disable, suspend, or delete their account in Google Workspace or Microsoft 365 (or remove them from the group/OU used by the sync). On the next sync, their status will automatically update to Inactive or Unsynchronized, and they'll stop receiving phishing simulations.

View employee phishing results

See Understanding phishing results and performance.

Groups

Groups let you target specific populations in phishing campaigns, such as new joiners, finance teams, or executives.

There are two types of groups:

• Manual groups: created directly in Stoïk Protect.

• Synced groups: automatically imported from your Google Workspace or Microsoft 365 directory, identified by a lightning icon.

Create a manual group

1

Go to Overview > Team > Groups

2

Click Create a group

3

Enter a group name and select the employees to include

4

Click Save

Manual groups can then be selected as an audience when launching phishing campaigns.

Synced groups from your directory

If your organization uses Google Workspace or Microsoft 365, Stoïk Protect can automatically import your existing groups (departments, teams, distribution lists, etc.) into the Simulations module.

How it works

• Groups and their members are imported during each employee synchronization.

• Nested groups are flattened into a single group on the Stoïk Protect side.

• Changes made in your directory (members added or removed) are reflected on the next sync.

• Synced groups can be used as an audience in phishing campaigns, just like manual groups.

Synced groups are read-only. To rename a group or change its members, update it directly in your Google Admin Console or Microsoft Entra ID.

Permissions required

Group sync requires additional permissions beyond those needed for employee sync:

Google Workspace

Groups Read and Group Members Read. Existing tenants must re-authorize the app to grant these permissions.

Microsoft 365

Group.Read.All and GroupMember.Read.All. Tenants authorized before this feature shipped must accept the updated permissions.

If the required permissions are missing, the tenant will show a Restricted status with a prompt to update permissions (see Restricted tenants). Once accepted, group sync starts automatically.