@SarahTurner , If you had voted or commented on the top 20 suggestions at the Forms uservoice, MS sent an email with a link to a Form asking which ones you wanted to be kept informed of. That Form has since been closed, though:
I use this method. It will search the CASB for events where someone has edited a form. If someone can edit a form, that implies that person is the owner or has co-ownership of the form.
CloudAppEvents
| where Application == "Office 365"
| where TimeGenerated >ago(90d)
| project TimeGenerated, ActionType, RawEventData
| where ActionType == "EditForm"
| evaluate bag_unpack(RawEventData, columnsConflict='replace_source')
// | where FormId == "nnn"
| where SourceApp == "ms-formweb"
| project TimeGenerated, UserId, FormName, FormId
This query results in something like this. A list of Forms that have been edited, and i can see who edited them.
Few years forward and seemingly there's still no way for 'admin' to find forms of other users.
Following an excellent suggestion by @AndrewX, I've updated it so it works with current M365 Defender schema and doesn't filter by 'EditForm' to catch people successfully opening it too.
1. Take your form link. It will look like this:
https://forms.office.com/Pages/DesignPageV2.aspx?origin=NeoPortalPage&subpage=design&id=??????????-????????-?????????????????????????????????????????????????????????????&analysis=falseAnd make note of the long string after &id=. This is your <form id>
2. Go to: https://security.microsoft.com/v2/advanced-hunting
And do the query:
CloudAppEvents
| where Application == "Microsoft 365"
| where Timestamp >ago(90d)
| project Timestamp, ActionType, RawEventData
| evaluate bag_unpack(RawEventData, columnsConflict='replace_source')
| where FormId == "<insert your form id from URL>"
| where SourceApp == "ms-formweb"
| project Timestamp, UserId, FormName, FormId, ActionType, ResultStatus
You can see who opened or edited the form:
