Phishing Detection in Microsoft Forms

[TobiasAT]

Hello,

I have a question about the recent announcement for phishing detection in Microsoft Forms. I understand the detection for new Forms. Maybe someone from Microsoft can also explain some details for existing Forms? Do you analyse published Forms from the past too, or just new Forms? And if yes, what will happen with these type of Forms? The same like if you detect a phishing Form in the design phase?

Thanks
Tobias

[#2]

@TobiasAT According to the announcement in the Message Center, the detection is performed at design time.  In my testing, it appears that as long as you do not try to edit a previously created Form, it will not be audited for phishing.  Below is the specific language from the message center:

This new feature will be applied to all public forms (when forms setting is “Anyone with the link can respond”) created within your tenant. The automatic detection will be running at Forms design time and if any suspicious phishing contents (i.e. what’s your password?) are detected, the form will be automatically blocked for sharing and response collection. This would not be a permanent block as the form can be unblocked if the form designer removes the suspicious phishing question.

[#3]

@Jeremy Miller Thanks for your answer, and sorry for the late reply. I can confirm that. A few days after I posted the question I opened an Office 365 support case with the same question. The support confirmed, as long as an author does not modify the questions of an existing form nothing happens. 

[#4]

@Jeremy Miller We are facing an issue on the MS Forms (pertaining to this new detection). One of my operating staff accidentally click on the changes to the questions (instead of viewing the answers) and after I amend and correct the questions back to original questions. The Form is being flagged as potential phishing. 
Had went into Go to the Message center and look for the notification, "Prevent/Fix: Microsoft Forms Detected Potential Phishing". There are no messages under this detected potential phishing. I am the administrator of the organisation but I am unable to have any options to either Delete/ Unblock/ Confirm Phishing. 

Hence would like to seek your advise on what should we do to unblock this form under the new Phishing detection. Is there a way to opt-out to the new "Detection Potential Phishing"?

[#5]

@Jeremy3611 We are experiencing this same issue with a form. I do not see any message in our message center regarding the form to unblock it. Did you ever get yours fixed?

[#6]

@kevinduvallI just started seeing this happen today on a form that has been in production for months without issue.  Did you ever get resolution to your issue?

[#7]

@GlennGomba Not yet. I'm going to let Microsoft support know about the issue. It has to be on their end at this point. Let me know if you figure anything out. I'll do the same

[#8]

@GlennGomba we had a form do this as well today.  Out of no where.  It did not get a message in the Message Center.  

Also, does anyone know if there is a way to see who has approved or denied a Phishing form?  I could test and show the messages before all the changes, now, I haven't been able to push a message into the Message Center.  Bad part is I can't pinpoint what specifically is broken to help a ticket if it was placed in.

[#9]

@Rebecca Goodman We had the same thing happen with a couple of forms but about 10 minutes ago they are no longer flagged.

[#10]

@jacobusn Had read that if there are changes/amendments to the existing forms, this new detection policy will kick in to flag this MS Form as "Detected as Phishing"
Hence only hope that Microsoft can create an alert to the Administrator and allow Administrator of the Organisation to determine it is Phishing Treat or not. But still allow the MS Form to proceed ahead first for 3 days (in case over the weekend).

[#11]

@Jeremy3611 Microsoft support gave me a link where you can review the form and unblock.
https://forms.office.com/Pages/AdminPhishingReviewPage.aspx?id=

Paste the ID or your form after the "="
The technician said you'll need Office 365 admin credentials for this to work.

[#12]

@jacobusn sigh, why do they always make it so difficult?! I am the SharePoint and Power Platform Manager in a company of 65,000 staff but do not have Office 365 Admin credentials and so I have to go to someone else if required to make use of this solution.

Rob
Los Gallardos
Microsoft Power Automate Community Super User

[#13]

The phishing detection needs to recognise natural language a little better. I'm creating a form for managers to notify us in advance when their staff leave. One of the questions asks what devices (phone/laptop) they will be returning and I want to put a note to remind them to bring any passwords/access codes with them - I'm not asking them to enter the passwords on the form - but as soon as I type 'password' the phishing notification comes up.