{
  "id": "CB-M365-TENANT-016",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-016",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-016.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-016.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-016",
    "title": "Enable internal phishing protection in Microsoft Forms",
    "finding": {
      "title": "Microsoft Forms does not scan forms for phishing",
      "description": "A compromised or malicious internal account can publish a form that collects passwords or personal data under the organization's trusted domain."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "microsoft-365",
      "forms",
      "phishing",
      "credential-harvesting"
    ],
    "setting": {
      "location": "Microsoft 365 admin center > Settings > Org settings > Services > Microsoft Forms > Add internal phishing protection",
      "default_value": "Checked",
      "recommended_value": "Checked"
    },
    "description": "The Microsoft Forms option **Add internal phishing protection** is checked\n(`isInOrgFormsPhishingScanEnabled` = `true`). Forms are scanned for questions that ask for\npasswords or other sensitive information; suspicious forms and their creators are blocked and\nreported to administrators.\n",
    "rationale": "Forms hosted on forms.office.com carry Microsoft branding and look legitimate. Attackers use\nthem, from compromised internal accounts, to harvest credentials from colleagues. The scan stops\nthe most common credential-collection forms before they spread.\n",
    "impact": "A legitimate form that asks for credentials may be blocked; administrators review and unblock it\nin the Forms admin experience.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a\n   Global Reader.\n2. Browse to **Settings** > **Org settings** > **Services** > **Microsoft Forms**, section\n   **Phishing protection**.\n3. Read-only alternative with Microsoft Graph (beta, scope `OrgSettings-Forms.Read.All`):\n   `GET https://graph.microsoft.com/beta/admin/forms` and read\n   `settings.isInOrgFormsPhishingScanEnabled`.\n4. Fail if **Add internal phishing protection** is cleared (`false`).\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft 365 admin center as at least a Global Administrator.\n2. Browse to **Settings** > **Org settings** > **Services** > **Microsoft Forms**.\n3. Check **Add internal phishing protection** and **Save**.\n4. Equivalent with Microsoft Graph (beta, scope `OrgSettings-Forms.ReadWrite.All`):\n   `PATCH https://graph.microsoft.com/beta/admin/forms` with\n   `{\"settings\": {\"isInOrgFormsPhishingScanEnabled\": true}}`.\n",
      "rollback": "Clear the option.\n"
    },
    "references": [
      {
        "title": "formsSettings resource type",
        "url": "https://learn.microsoft.com/graph/api/resources/formssettings?view=graph-rest-beta",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Review and unblock forms or users detected and blocked for potential phishing",
        "url": "https://learn.microsoft.com/microsoft-forms/review-unblock-forms-users-detected-blocked-potential-phishing",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566.002"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}