Forum Discussion
Is there a way to find out who owns a Form?
We have a URL to a Microsoft Form but we aren't sure who created it. Since the Form still works the form must belong to a group or an individual that is still with the company. Is there a way to find...
Few years forward and seemingly there's still no way for 'admin' to find forms of other users.
Following an excellent suggestion by AndrewX, I've updated it so it works with current M365 Defender schema and doesn't filter by 'EditForm' to catch people successfully opening it too.
1. Take your form link. It will look like this:
https://forms.office.com/Pages/DesignPageV2.aspx?origin=NeoPortalPage&subpage=design&id=??????????-????????-?????????????????????????????????????????????????????????????&analysis=falseAnd make note of the long string after &id=. This is your <form id>
2. Go to: https://security.microsoft.com/v2/advanced-hunting
And do the query:
CloudAppEvents
| where Application == "Microsoft 365"
| where Timestamp >ago(90d)
| project Timestamp, ActionType, RawEventData
| evaluate bag_unpack(RawEventData, columnsConflict='replace_source')
| where FormId == "<insert your form id from URL>"
| where SourceApp == "ms-formweb"
| project Timestamp, UserId, FormName, FormId, ActionType, ResultStatus
You can see who opened or edited the form:
This is a life saver! Is there a default limit as to how far back the advanced hunting queries go? I was hoping to go back further than 90 days, but I am not seeing anything earlier than mid October for us. Perhaps its customizable for the tenant but I am fairly sure we leave everything at default for log retention.
- You may also use this method. Works a charm, but it's not easy for the average person to do:
https://itspartlycloudy.com/2022/01/20/who-created-this-microsoft-form/- Almost perfect, thank you very much!
