Enable internal phishing protection in Microsoft Forms

Description

The Microsoft Forms option Add internal phishing protection is checked (isInOrgFormsPhishingScanEnabled = true). Forms are scanned for questions that ask for passwords or other sensitive information; suspicious forms and their creators are blocked and reported to administrators.

Rationale

Forms hosted on forms.office.com carry Microsoft branding and look legitimate. Attackers use them, from compromised internal accounts, to harvest credentials from colleagues. The scan stops the most common credential-collection forms before they spread.

Impact

A legitimate form that asks for credentials may be blocked; administrators review and unblock it in the Forms admin experience.

Setting

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader.
2. Browse to Settings > Org settings > Services > Microsoft Forms, section Phishing protection.
3. Read-only alternative with Microsoft Graph (beta, scope OrgSettings-Forms.Read.All): GET https://graph.microsoft.com/beta/admin/forms and read settings.isInOrgFormsPhishingScanEnabled.
4. Fail if Add internal phishing protection is cleared (false).

Remediation

1. Sign in to the Microsoft 365 admin center as at least a Global Administrator.
2. Browse to Settings > Org settings > Services > Microsoft Forms.
3. Check Add internal phishing protection and Save.
4. Equivalent with Microsoft Graph (beta, scope OrgSettings-Forms.ReadWrite.All): PATCH https://graph.microsoft.com/beta/admin/forms with {"settings": {"isInOrgFormsPhishingScanEnabled": true}}.

Rollback

Clear the option.

References

• formsSettings resource type Microsoft, vendor-doc, accessed 2026-10-24
• Review and unblock forms or users detected and blocked for potential phishing Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle