Skip to main content

Learner Dashboard - How Employees Access Their Training

CanIPhish Support

Employees complete their assigned training on the Learner Dashboard, a separate site from the CanIPhish platform that administrators use. This article explains where employees sign in, how access tokens work, what to do when a token is lost, which emails employees receive, and how completions and certificates are recorded.

Note: Training is only assigned to employees whose email domain is verified. Make sure you've also configured allowlisting so that training emails reach employees' inboxes.

Contents

Where employees sign in

Employees sign in at https://learn.caniphish.com/Platform/Login. If you use white-labeling, the address is learn. followed by your white-labeled domain (for example, https://learn.phish.mybusiness.com/Platform/Login). Assignment and reminder emails include a link to the right address.

On the sign-in page, employees either:

  • enter Your Email and their Access Token, then click Log in, or
  • click Sign in with Single Sign-On, if your organization has set up learner single sign-on.

Once signed in, employees see their Assigned Training, with each module's estimated time, passing score and their personal best, and their Completed Training. Clicking a module's name opens it in a new tab. Employees can change the dashboard's language with the Language button.

Note: The Learner Dashboard and the CanIPhish platform have separate logins. Administrators sign in to the platform at https://caniphish.com/Auth/Login, and each has its own single sign-on settings.

Access tokens

  • Where to find it: The access token is in the employee's training assignment email (subject "You've been assigned training!"), under Login Details, together with their email address (username) and the login URL. Reminder emails repeat the same details.
  • When it's issued: An employee's token is created the first time they're assigned training. Until then, they have no token and no training to sign in to.
  • It stays the same: Later assignments reuse the employee's existing token.
  • Format: 12 characters, made up of capital letters and numbers.
  • Who can change it: Tokens are generated by the platform. Administrators can't view, set or change an employee's token, and employees can't choose their own. An employee who loses their token can request a new one (see below). If you want employees to sign in through your own identity provider instead, use learner single sign-on.

Lost access tokens

Employees can get a new token themselves:

  1. On the sign-in page, enter the email address the training was sent to in Your Email, exactly as it appears in the training email.
  2. Click Lost Access Token?.
  3. Open the email with the subject "CanIPhish Learner Dashboard Access Token" (with your brand name in place of CanIPhish if you use white-labeling). It contains a Temporary Access Token.
  4. Sign in with the temporary token within 30 minutes. It then becomes the employee's permanent access token and replaces the old one. Until the employee signs in with the new token, the old one keeps working.

If an employee requests a new token three times without signing in with one, further requests are blocked for 24 hours and the page shows "You have exceeded the maximum number of access token requests. Please try again after 24 hours."

What administrators can do: You can't see or reset an employee's token, but while they still have training to complete you can email their sign-in details to them again:

  1. Go to Phishing & Training > Reporting, open the Training Statistics tab and click the campaign's name.
  2. In the employee's row, click the ⋮ (actions) menu and select Send reminder.
  3. Click Yes, send the reminder email.

The reminder lists all of the employee's outstanding training and includes their access token (unless your organization only allows single sign-on). For the other actions in this menu, see Managing individual employees in a campaign.

Learner single sign-on (SSO)

With learner single sign-on, employees sign in to the Learner Dashboard through your identity provider (for example, Microsoft Entra ID, Google Workspace, Okta, OneLogin or JumpCloud) instead of with an access token. Learner SSO requires an Enterprise subscription.

  • Setting it up: Go to Configuration > Platform Settings and open Authentication Settings > Learner Single Sign-On. Step-by-step guides for each identity provider are listed in Single Sign-On Introduction. Learner SSO is separate from Platform Single Sign-On, which is for administrators.
  • Who it covers: Employees whose email domain is verified in your tenant.
  • Signing in: On the sign-in page, the employee clicks Sign in with Single Sign-On, enters their email address and clicks Sign in. They're then taken to your identity provider.
  • Keeping or removing access tokens: The Direct Login Access (Using Access Token) setting decides whether employees can still use a token:
    • Allowed: Employees can use either method. Training emails say they can sign in with single sign-on or an access token, and include the token.
    • Prohibited: Only single sign-on works. Training emails no longer include a token, and signing in with a token or using Lost Access Token? shows "Error - Direct log in not allowed. Please log in using single sign-on."

Training emails and allowlisting

Employees can receive these emails about their training:

  • You've been assigned training! Sent when training is assigned. It lists the assigned modules and their due date, and includes the employee's sign-in details and a link to the Learner Dashboard.
  • Training Assignment Reminder: Sent while training is outstanding. See Due dates and reminder emails.
  • You've completed an assigned training! Sent when the employee passes a module, with their certificate of completion attached.
  • CanIPhish Learner Dashboard Access Token: Sent when the employee clicks Lost Access Token?.

These emails come from CanIPhish Training <noreply@learn.caniphish.com>. If you use white-labeling, they come from noreply@ your white-labeled domain, with your brand name in place of CanIPhish.

Tip: Allowlist this sender as well as your phishing simulations, so that training emails don't end up in junk or spam folders. See Allowlisting - Introduction and Allowlisting - Quick Reference - IPs, Headers & URLs.

If your default email delivery provider is Microsoft 365 or Google Workspace Direct Email Injection, assignment, automatic reminder and completion emails are delivered through it. With any other default provider, including a third-party SMTP server, they're sent from CanIPhish's mail servers. Lost-token emails and reminders you send with Send reminder always come from CanIPhish's mail servers.

On paid plans, you can change the wording of the assignment, reminder, overdue reminder and completion emails under Configuration > Platform Settings > Notification Settings (not while Default Language (Notifications) is set to Dynamic Translation). The lost-token email can't be changed. If you customize the assignment or reminder emails, keep the {{.APIToken}} and {{.LearnWebsite}} placeholders so that employees still receive their access token and the sign-in link.

Due dates and reminder emails

  • Due date: Training is due 14 days after it's assigned, unless the campaign's Due within setting says otherwise.
  • How often reminders are sent: Employees with outstanding training are reminded every 3 days by default. To change this, go to Configuration > Platform Settings, open Notification Settings, enter a number of days from 0 to 30 in Training Assignment Reminder Frequency and click Save.
  • Turning reminders off: Set the frequency to 0. After you save, the field shows -1, which means reminders are off. Automatic reminders stop for all employees, but you can still use Send reminder for an individual employee.
  • How long reminders continue: For 60 days after the training is assigned, or until its due date if that's later (up to 120 days).
  • When they stop: As soon as the employee passes the module, or uses up their attempts if you've set a maximum number of attempts.
  • What they contain: Each reminder lists all of the employee's outstanding modules with their due dates, plus their sign-in details. Once any module is past its due date, the employee gets the overdue version of the reminder, which lists overdue and upcoming modules under separate headings.
  • Excluding employees: Employees you add to the Notification Suppression List (at the bottom of Notification Settings) for Training Reminders (Assignment & Overdue) don't receive automatic reminders.

Completions and certificates

  • On the Learner Dashboard: When an employee reaches the passing score, they see a "Congratulations! You passed" page, with a Start Next Training button if they have more training to do. The module moves to Completed Training, where the employee can click Download Certificate at any time.
  • By email: The employee is emailed "You've completed an assigned training!" with their certificate of completion attached as a PDF, unless you've added them to the Notification Suppression List for Training Assignment Completed.
  • In the platform: The employee's Status in the campaign's statistics changes to Complete. New activity can take up to 90 seconds to appear. To download the certificate, click the ⋮ (actions) menu in the employee's row and select Download certificate. For audit evidence across all campaigns, use Training Compliance Reports.
  • Name on the certificate: The employee's first and last name from your employee lists, or their email address if no name is recorded.
  • Certificate design: Choose one of six templates under Configuration > Platform Settings > Appearance Settings > Certificate of Completion. A new template applies to certificates generated from then on.

Note: If an employee uses up the maximum number of attempts without passing, the module moves to Completed Training as failed and no certificate is issued. See Training - Advanced Settings.

Frequently asked questions

  • An employee didn't receive their assignment email. What should I check? Open the campaign's statistics and check the employee's Status:
    • Error - Domain not verified: Verify the employee's email domain.
    • Error - Maximum Quota Hit: Your subscription's employee license limit was reached.
    • Error - Pending Assignment: The employee joined the campaign after it started and their training hasn't been assigned yet, so no email has been sent. It stays this way if their email domain isn't verified or your employee license limit has been reached.
    Once the cause is fixed, or if a Pending Assignment status doesn't clear, click the ⋮ (actions) menu in the employee's row and select Reassign training, then confirm with Yes, reassign the training!. If there's no error, ask the employee to check their junk or spam folder, make sure training emails are allowlisted, and use Send reminder to send their sign-in details again.
  • The sign-in page says "Error - Incorrect email address or access token." The employee must use the email address the training was sent to (shown in their training email) and their current token. If they've lost the token, they can use Lost Access Token?.
  • Lost Access Token? shows an error asking for a valid email address. This happens when no training has been assigned to the address entered. Check that the employee is using the exact address the training was sent to.
  • How can I see what employees see? Add your own email address (on a verified domain) to an employee list and include that list in a training campaign. You'll receive the same assignment email and can sign in to the Learner Dashboard.

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk