Microsoft Forms: Setup, Policies, and Admin Configuration Guide 2026
Why This Is Happening
I've worked with dozens of Microsoft 365 tenants where the story goes exactly the same way: someone in HR or marketing discovers Microsoft Forms, starts building surveys and quizzes, and then , halfway through a rollout , the IT team realizes nobody ever touched the admin settings. Now external respondents can't submit answers, users are complaining the Forms tile is missing from their app launcher, and someone from legal is asking uncomfortable questions about where form response data actually lives.
Microsoft Forms admin configuration sits inside the Microsoft 365 admin center, not inside Forms itself. That's the first thing that trips people up. You won't find these organization-wide controls by logging into forms.office.com as an admin. They live in admin.microsoft.com, buried under Settings > Org settings > Services > Microsoft Forms. If you've never been there, you've been running Forms on Microsoft's defaults, which may or may not match your organization's security and compliance requirements.
The second source of confusion is licensing. Microsoft Forms is available to Office 365 Education customers, Microsoft 365 Apps for business subscribers, and people with a personal Microsoft account (Hotmail, Live, or Outlook.com). But the admin controls, the ones that let you manage external sharing, enforce phishing detection, and toggle the service on or off, are exclusively available to Office 365 Education and Microsoft 365 Apps for business tenants. Personal account holders don't get admin controls at all. I've seen IT administrators spend an hour looking for settings that simply don't exist in their subscription tier.
Then there's the issue of role requirements. Only an Office apps administrator with the application administrator role can access these settings. If you're logged in as a standard global reader or even a Teams administrator, the Forms pane in Org settings may appear grayed out or inaccessible. That's not a bug, it's by design.
Finally, there's the external sharing problem specifically. By default, Microsoft turns on all four external sharing options. That means your users can send form links to people outside the organization, collaborate with external editors, share forms as templates externally, and share summary results with outside parties, all without your knowledge. For schools, healthcare organizations, or any company with strict data governance, those defaults can create real exposure.
The good news is that every single one of these issues has a clean fix inside the admin center, and none of it requires PowerShell or a support ticket. I'll walk you through the entire Microsoft Forms admin configuration process, from first login to enterprise-grade policy settings, right now. Browse all Microsoft fix guides →
The Quick Fix, Try This First
If your organization's Forms are broken, users can't share externally, the Forms tile is missing, or you need to quickly lock down phishing protection, here's the fastest path to the right settings panel.
Open a browser and go directly to https://admin.microsoft.com. Sign in with your work or school account, not a personal Microsoft account. Once you're in, look at the left-side navigation pane. If you see Settings in the menu, click it. If you don't see it immediately, click Show all at the bottom of the left pane to expand the full navigation tree. Settings will appear after that.
From Settings, click Org settings. On the page that loads, you'll land on the Services tab by default. Scroll down the services list, it's alphabetical, and click Microsoft Forms. A right-side panel will slide open. That panel is your entire Microsoft Forms admin configuration console.
Inside that panel you'll see four main control areas:
- External sharing, four checkboxes controlling what your users can share with people outside the organization
- Record names of people in your org, one checkbox controlling whether respondent names are captured by default
- Phishing protection, one checkbox enabling automatic scans of internal forms
- Allow YouTube and Bing, one checkbox controlling whether users can embed Bing images or YouTube videos in their forms
Make your changes, then hit Save changes at the bottom of the panel. That's it. Changes typically propagate within a few minutes, though Microsoft notes it can occasionally take a few hours for certain settings, particularly the PowerPoint integration option, to fully take effect across all users.
If you're specifically trying to turn off Forms for one individual user rather than the whole org, you won't do that from this panel. That's handled through license assignment, which I cover in Step 4 below.
This step sounds obvious, but it's where most failed attempts start. You need to be signed in to https://admin.microsoft.com with a work or school account that has the Office apps administrator role with application administrator permissions. A personal Microsoft account, even one that owns a Microsoft 365 subscription, does not give you access to organizational admin settings for Microsoft Forms.
Once you're signed in, verify you're in the right place by checking the top-right corner of the admin center. Your account name should show the domain of your organization (e.g., yourname@yourcompany.com), not a gmail.com, outlook.com, or hotmail.com address.
Next, confirm your role. Click your account avatar in the top-right, then select View account. Alternatively, go to Users > Active users, find yourself in the list, and check the Roles column. You need to see either Office apps admin or Application admin listed. If you only see something like User or Message center reader, you won't be able to save changes to Forms settings, you'll get an access denied error when you try.
Now navigate to the Forms settings. In the left navigation pane, click Settings. If Settings isn't visible, click Show all to expand the full menu. Then click Org settings. On the Org settings page, the Services tab should be selected by default. Scroll the services list and click Microsoft Forms.
If you see the Microsoft Forms pane open on the right side of the screen with the four setting categories visible, you're in the right place and have the right permissions. You should see checkboxes, not grayed-out placeholders.
External sharing in Microsoft Forms controls exactly what your users can do with people outside your organization's tenant. By default, all four options are checked, meaning everything is allowed. Depending on your organization's data governance posture, you may want to restrict some or all of these.
In the Microsoft Forms admin panel, under External sharing, you'll find four checkboxes:
- Send a link to the form and collect responses, allows users to share forms with external respondents via a link
- Collaborate on the form with people outside your organization, allows external users to co-edit form questions, change themes, and modify structure
- Share the form as a template so people outside your organization can duplicate it, allows external users to copy the form structure for their own use
- Share a summary of form results with people outside your organization, allows users to send a results summary link to external viewers
Here's something important that Microsoft specifically calls out: if you want your users to be able to create a poll directly inside Outlook, the first option, Send a link to the form and collect responses, must remain checked. If you uncheck that one and users start complaining that the Outlook poll feature is broken, that's why.
For most enterprise environments, I'd recommend unchecking option 2 (external collaboration on form editing) at minimum. Letting external parties edit your internal survey questions is a significant governance risk that most organizations don't intend to allow. Uncheck whichever options don't match your policy, then click Save changes.
After saving, ask a test user to try sharing a form externally. The restriction takes effect almost immediately, usually within 5 minutes, so you don't need to wait long to verify.
Two settings that often get overlooked during initial Microsoft Forms setup are name recording and phishing protection. Both are on by default, but understanding what they actually do, and deciding whether the defaults fit your situation, is part of a responsible admin configuration.
Record names by default is found under the Record names of people in your org section. When this is checked, every form response submitted by someone inside your organization automatically captures and stores that person's name alongside their answers. For most internal surveys, HR assessments, and feedback forms, this is exactly what you want. But for anonymous pulse surveys or sensitive feedback scenarios, like asking employees to rate their manager, you'll want to uncheck this so responses stay anonymous by default.
Note the key word "default" here. Individual form creators can still override this setting per form. What you're controlling at the admin level is the default behavior that applies when a new form is created. Existing forms won't be retroactively changed.
Internal phishing protection is under the Phishing protection section. When checked, Microsoft automatically scans forms created within your organization for signals that a form might be used for credential harvesting or other phishing activity, for example, a form asking users to enter their Microsoft 365 passwords. This is a genuine security control, not a theoretical one. Phishing via Forms is a known attack vector because Forms has a legitimate Microsoft domain, which gives it an air of trustworthiness.
I strongly recommend leaving internal phishing protection checked unless you have a specific operational reason to disable it. If a legitimate internal form gets flagged incorrectly, you can review and unblock it through the admin center under the Review and unblock forms or users section, no need to disable the entire protection layer.
After adjusting either setting, click Save changes.
There are two separate scenarios here and they use different mechanisms. Know which one you need before you start.
Scenario A: Turn Forms off (or back on) for one individual user. This is done through license management, not the Forms settings panel. Go to admin.microsoft.com > Users > Active users. Find the user in question and click their name to open their profile. Go to the Licenses and apps tab. Expand the license assigned to the user (e.g., Microsoft 365 Business Premium). Scroll through the list of apps within that license and find Microsoft Forms. Uncheck it to disable Forms for that person. Click Save changes.
When Forms is turned off for a user this way, the Forms tile disappears from their Microsoft 365 app launcher and homepage. They can't access forms.office.com with that account. Importantly, this does not delete their existing forms, those remain, they just can't use the service until the license is re-enabled.
Scenario B: Turn Forms off for your entire organization. Microsoft's official guidance directs you to the same license management path, applied at the organization level rather than per-user. You'd use the Licenses section of the admin center to modify the default license template for your subscription, disabling the Forms service app globally. Be careful here, this affects every licensed user at once.
A useful approach for staged rollouts or testing: disable Forms organization-wide, then selectively re-enable it for specific users or groups by editing their individual license assignments. This gives you precise control during pilot phases before a broader rollout.
Two lesser-known Microsoft Forms admin configuration options control how Forms integrates with the rest of the Microsoft 365 ecosystem: the PowerPoint add-in integration and Bing/YouTube media embedding.
Enabling Forms in PowerPoint requires a slightly different path in the admin center, not the same Forms panel you've been using. Here's the exact route:
- Go to https://admin.microsoft.com
- Click Settings > Org settings (note: the official docs show this as Settings > Settings in some versions of the admin center, if you see both, use Org settings)
- On the Services tab, click User owned apps and services
- Check the option labeled Let users access the Office store
- Click Save changes
This allows users to insert a Form directly into a PowerPoint presentation via the Office Add-ins store. Microsoft explicitly notes this change can take a few hours to propagate, so if users report the Forms add-in still isn't showing in PowerPoint an hour after you save, that's expected. Give it up to a full business day before troubleshooting further.
Bing and YouTube embedding is controlled back in the main Microsoft Forms panel. Under Allow YouTube and Bing, the Include Bing search, YouTube videos checkbox is checked by default. When enabled, form creators can search Bing for images and embed those images in questions or themes, and they can add YouTube videos directly into forms. If your organization has policies against embedding external media, or if you operate in a restricted network environment that blocks YouTube, uncheck this option.
After unchecking, form creators will no longer see the Bing image search or YouTube embed options when building forms. Existing forms with already-embedded images or videos are not retroactively stripped, the restriction applies to new additions only.
Advanced Troubleshooting
Once you've got the basics locked in, there are several less obvious Microsoft Forms admin configuration issues that come up in larger or more complex environments. Here's what I've seen and how to handle each one.
Azure Active Directory Conditional Access
If your organization uses Azure AD (now Microsoft Entra ID) conditional access policies, Microsoft Forms must be explicitly included in your Cloud apps assignments if you want those policies to apply to it. Go to Microsoft Entra admin center > Protection > Conditional Access > Policies, open the relevant policy, and under Cloud apps or actions, confirm that Microsoft Forms is listed.
Here's the critical detail Microsoft calls out in their official guidance: even after you've correctly configured conditional access for Forms, users may still get blocked if SharePoint Online and Exchange Online haven't also been granted access via that same conditional access policy. Forms has backend dependencies on both services. If your policy grants Forms access but blocks SharePoint Online, users will hit authentication errors that look completely unrelated to SharePoint. Add all three services to your policy's allowed cloud apps.
Forms Getting Flagged by Phishing Protection
With internal phishing protection enabled, Microsoft automatically reviews forms that match certain risk patterns. If a legitimate internal form gets incorrectly flagged, your users will see a blocked form page, you can manually review and unblock it. Go to admin.microsoft.com > Settings > Org settings > Services > Microsoft Forms, then look for the Review and unblock forms or users option. This surface shows you flagged forms and lets you restore access without disabling the protection globally.
Forms Tile Missing for Specific Users
If a user reports the Forms tile is gone from their app launcher but Forms is enabled organization-wide, check two things in order. First, check their individual license at Users > Active users > [User] > Licenses and apps to confirm the Microsoft Forms service app is checked within their license. Second, check whether the user's account type is eligible, Forms is not available to all license types, and guest accounts have limited access.
Forms Not Available After License Changes
License changes in Microsoft 365 sometimes take time to fully propagate to the user's session. If you've just re-enabled Forms for a user but they still can't access it, have them sign out of all Microsoft 365 sessions, clear their browser cache, and sign back in. In most cases, this forces a fresh token that picks up the updated license state immediately rather than waiting for the natural refresh cycle.
Data Residency for Regulated Industries
Microsoft Forms stores data on servers in the United States and Europe. All data defaults to US storage, except for European-based tenants that started using Forms after May 2017, their data lives in European databases. If your organization has strict data residency requirements, verify your tenant's geographic classification in the Microsoft 365 admin center under Settings > Org settings > Organization profile > Data location. This is particularly relevant for healthcare and financial services organizations operating under GDPR or local data sovereignty laws.
Prevention & Best Practices
Getting Microsoft Forms admin configuration right once is good. Building a process that keeps it right as your organization grows and changes is better. Here's how to stay ahead of problems.
Document your current settings before making any changes. Before you touch anything in the Microsoft Forms admin panel, take a screenshot of the current state of all four setting sections. This takes 30 seconds and saves enormous frustration if you need to roll back or explain to stakeholders what changed. Store it in a shared IT documentation location, not just on your local machine.
Review Forms settings when onboarding new user groups. When your organization adds a new department, acquires a company, or changes Microsoft 365 subscription tiers, the Forms settings that worked for your previous setup may not be appropriate anymore. Build a Forms settings review into your IT onboarding checklist for any major organizational change.
Audit which users have Forms enabled regularly. Microsoft 365 license assignments drift over time, especially in organizations where IT tickets are handled by multiple team members. Run a periodic audit, monthly or quarterly, to verify that Forms is enabled for the users who need it and disabled for those who don't. You can export a license report from the Microsoft 365 admin center under Reports > Usage to get a current picture.
Test the Outlook poll dependency explicitly. If your organization uses the Outlook poll feature, where users insert a quick poll directly into an email, test it after any external sharing settings change. The connection between the "Send a link and collect responses" external sharing option and Outlook polling is non-obvious, and it's an easy setting to accidentally break during a general tightening of external sharing permissions.
Brief form creators on what admin settings control. When employees know that name recording is on by default and that external sharing is allowed unless IT has restricted it, they make better decisions about what to put in forms. A 10-minute internal communication to active Forms users about your organization's configuration prevents accidental data exposure more reliably than any technical control alone.
- Enable internal phishing protection immediately, it's checked by default but verify it hasn't been accidentally disabled during a previous admin session
- Uncheck external collaboration editing rights unless your workflows genuinely require external co-editors on internal forms
- Review the "Record names by default" setting before any anonymous employee feedback campaign, a default name capture will kill participation rates
- Add Microsoft Forms to your Azure AD conditional access Cloud apps assignment alongside SharePoint Online and Exchange Online to avoid cascading auth failures
Frequently Asked Questions
What is Microsoft Forms and who can use it?
Microsoft Forms is a tool for building surveys, quizzes, polls, registrations, and questionnaires that respondents can fill out on any web browser or mobile device. It's available to Office 365 Education customers, Microsoft 365 Apps for business customers, and people with a personal Microsoft account like Hotmail, Live, or Outlook.com. The key distinction for IT admins is that organization-level admin controls, external sharing, phishing protection, license management, are only available in Office 365 Education and Microsoft 365 Apps for business tenants, not in personal accounts.
Where does Microsoft Forms store my organization's data?
Microsoft Forms stores data on servers in two geographic regions: the United States and Europe. By default, all form response data is stored in the United States. The exception is European-based tenants that began using Microsoft Forms after May 2017, those organizations have their data stored in European databases instead. If your organization has data residency requirements, check your tenant's geographic classification in the Microsoft 365 admin center under Settings > Org settings > Organization profile > Data location to confirm where your specific tenant's data lives.
Is Microsoft Forms GDPR compliant?
Yes. Microsoft Forms met GDPR compliance requirements as of May 2018. Microsoft's official documentation points to the Microsoft 365 Data Subject Requests for GDPR resource for detailed information on how to handle data subject access requests, erasure requests, and portability requests when using Forms. If you're operating under GDPR and using Microsoft Forms to collect data from EU residents, you should still review your own use of the tool, particularly around what data you're collecting, how long you're retaining it, and whether your privacy notices accurately describe your Forms-based data collection activities.
Does Microsoft Forms meet FERPA and BAA requirements?
Yes, Microsoft Forms meets both FERPA (Family Educational Rights and Privacy Act) and BAA (Business Associate Agreement) protection standards according to Microsoft's official documentation. This makes it eligible for use in educational institutions that handle student education records and in healthcare organizations that require a BAA with their cloud service providers. That said, meeting the standard is one part of compliance, your organization's specific configuration, data handling practices, and internal policies also factor into your overall compliance posture. I'd recommend reviewing these requirements with your compliance or legal team before using Forms for any sensitive data collection in a regulated environment.
Why is the Forms tile missing from a user's Microsoft 365 app launcher?
There are two likely causes. First, the Microsoft Forms service app may have been disabled within that user's specific license assignment, go to admin.microsoft.com > Users > Active users, open the user's profile, click Licenses and apps, expand their license, and verify that Microsoft Forms is checked. Second, if Forms was disabled at the organization level, the tile disappears for all users. Check the license settings at both levels. If the license looks correct, have the user sign out completely from all Microsoft 365 sessions, clear their browser cache, and sign back in, this forces the app launcher to refresh with the current license state.
How do I allow users to insert a Microsoft Form into a PowerPoint presentation?
This setting isn't in the main Microsoft Forms admin panel, it's controlled through the User owned apps and services setting. In the Microsoft 365 admin center, go to Settings > Org settings (or Settings > Settings depending on your admin center version), click the Services tab, and open User owned apps and services. Check the option labeled "Let users access the Office store." Click Save changes. Note that Microsoft explicitly warns this can take a few hours to take effect, so if users still don't see the Forms option in PowerPoint after saving, wait a few hours and test again before assuming something went wrong.