Collaborating on Microsoft Forms, Safely

Microsoft Forms is designed to be a lightweight survey tool, and therefore most of the work in Forms will be done by a single person. There will be times though where we need to collaborate on the creation of a Form or Quiz, and there are two ways in which we can do this, either by using collaboration links or associating the form with an O365 Group.

Collaboration Links

When we create forms using Microsoft Forms, the interactions are all created by generating links. These links could be simply for someone to fill the form in, others could be to duplicate. The final link we can create is to allow other users with the link to come in and collaborate on this form with us.

Collaboration links don't the levels of security we have come to expect from other areas of O365, therefore anyone who has the link and can authenticate against the tenancy could get access to the form. This could apply to anyone who has an organisation account, or even a Microsoft account that can log into the tenancy, and could then potentially edit the form or view the results.

For basic Forms this may be ok, but if a little more security is required around the form, then we should consider other options. This is where Group forms comes in.

Group Forms

Group Forms were only released in the summer of 2019 and, just like other parts of Forms, haven't really been well publicised. Effectively it means that I can associate a Form with an O365 Group (read that as a Team) and only allow people who have edit rights in the group to modify it. For me this is a great way of collaborating without having to rely on the transmission of links.

When you're on the Forms home page, you will see "Group forms" to the right of the top navigation. This will allow you to see the group forms that you have recently worked on, and also it will allow you to create forms directly within an O365 group.

If I have already got a form created which only I can access, then I can change this to be a group form. To do this, I need to click on the ellipsis (...) in the top right corner of the form when I have "My forms" being displayed. This will bring up a small menu over the form tile with the option to copy, delete or move the form.

From this menu, it's not quite obvious, but to move the form means that it will move from being "My form" to being a "Group form". Clicking Move will reveal a blade on the right hand side of the screen which is how you select the group you want to associate the form with. So now when I look at the forms associated with my O365 group, I can see my form listed there.

Now that the form has been associated with a group, any other members of the group can then access it to collaborate or review the results without having to use a link.

One of the additional benefits that you also get from your group form is that you can surface the edit/creation element of the form through a Teams tab. But ultimately, this removes the need to generate a collaboration link for people to work on the form, which means that I can start to control the security of it so much more.

Finally...

Microsoft Forms is a tool which is part of O365 to allow the creation of surveys and quizzes. When I create a form in the normal way, it is associated with me as a user. Therefore, if I wish to invite others to collaborate on that form with me, then I need to generate a collaboration link.

Collaboration links can be changed so that they are either accessible by people internal to the organisation, or anyone with a Microsoft account. The biggest issue is that anyone who gets hold of the collaboration link can potentially access the form to edit it, or more importantly access it to see the responses. This is because there is no access control list available in the process of generating the link.

Instead of generating a collaboration link, the form could be converted to a Group form, or created as part of an O365 Group in the first place, and so you then have the ability to use the access list of the group to control who can edit the form. As well as being able to control who can access the form in this way, there are also more integrations with regards to Teams where I may wish to surface the form creation screen as a tab.

As always, I hope you found this blog useful, and please do send me feedback.