Forum Discussion
Is there a way to find out who owns a Form?
We have a URL to a Microsoft Form but we aren't sure who created it. Since the Form still works the form must belong to a group or an individual that is still with the company. Is there a way to find...
I use this method. It will search the CASB for events where someone has edited a form. If someone can edit a form, that implies that person is the owner or has co-ownership of the form.
CloudAppEvents
| where Application == "Office 365"
| where TimeGenerated >ago(90d)
| project TimeGenerated, ActionType, RawEventData
| where ActionType == "EditForm"
| evaluate bag_unpack(RawEventData, columnsConflict='replace_source')
// | where FormId == "nnn"
| where SourceApp == "ms-formweb"
| project TimeGenerated, UserId, FormName, FormId
This query results in something like this. A list of Forms that have been edited, and i can see who edited them.
- How exactly do you run this query?
