catastrophic Microsoft forms breach

%3CLINGO-SUB%20id%3D%22lingo-sub-1400940%22%20slang%3D%22en-US%22%3Ecatastrophic%20Microsoft%20forms%20breach%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1400940%22%20slang%3D%22en-US%22%3E%3CP%3ENow%20today%20I%20just%20discovered%20something%20alarming%20with%20Forms.%26nbsp%3B%20An%20anonymous%20tip%20from%20one%20of%20my%20students%20stated%20that%20all%20the%20students%20could%20go%20to%20forms.microsoft.com%2C%20log%20in%20normally%20and%20they%20could%20see%20all%20the%20group%20quizzes%20I%20created!%26nbsp%3B%20Further%2C%20they%20could%20see%20the%20correct%20answers%2C%20they%20could%20edit%2C%20they%20could%20delete%20and%20they%26nbsp%3B%20could%20see%20all%20the%20grades%20of%20all%20the%20other%20students!%26nbsp%3B%20Unbelievable.%26nbsp%3B%20Now%20my%20whole%20grades%20are%20compromised.%20%26nbsp%3B%26nbsp%3BApparently%20if%20a%20quiz%20is%20created%20outside%20the%20group%20they%20cannot%20see%20it%2C%20but%20any%20regular%20member%20of%20a%20group%20(like%20a%20student)%20has%20full%20permissions%20for%20a%20group%20quiz.%26nbsp%3B%20I%20cannot%20believe%20this%20and%20now%20I%20have%20no%20idea%20what%20I%20am%20going%20to%20do.%26nbsp%3B%20My%20whole%20course%20is%20totally%20screwed%20up.%26nbsp%3B%20How%20could%20this%20happen%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1400940%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EForms%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1401374%22%20slang%3D%22en-US%22%3ERe%3A%20catastrophic%20Microsoft%20forms%20breach%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1401374%22%20slang%3D%22en-US%22%3E%3CP%3ENever%20ever%20put%20stuff%20in%20any%20of%20the%20Group%20resources%2C%20be%20it%20OneDrive%2C%20Team%2C%20Planner%2C%20Forms%2C%20etc.%20Those%20are%20all%20%22shared%22%20and%20every%20member%20of%20the%20group%20has%20%22equal%22%20access%20to%20them.%20It's%20a%20design%20decision%2C%20not%20something%20you%20can%20change.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1640188%22%20slang%3D%22en-US%22%3ERe%3A%20catastrophic%20Microsoft%20forms%20breach%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1640188%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F478377%22%20target%3D%22_blank%22%3E%40nmstough%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20is%20true%20that%20students%20are%20owners%20of%20any%20group%20form%20you%20created%3C%2FP%3E%3CP%3EThis%20is%20the%20result%20of%20creating%20a%20quiz%20in%20microsoft%20teams%20or%20directly%20creating%20a%20group%20quiz%3C%2FP%3E%3CP%3ETo%20avoid%20this%20you%20need%20to%20create%20the%20form%20in%20(My%20Forms)%20and%20simply%20share%20the%20link%20to%20respond%20with%20your%20students%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Now today I just discovered something alarming with Forms.  An anonymous tip from one of my students stated that all the students could go to forms.microsoft.com, log in normally and they could see all the group quizzes I created!  Further, they could see the correct answers, they could edit, they could delete and they  could see all the grades of all the other students!  Unbelievable.  Now my whole grades are compromised.   Apparently if a quiz is created outside the group they cannot see it, but any regular member of a group (like a student) has full permissions for a group quiz.  I cannot believe this and now I have no idea what I am going to do.  My whole course is totally screwed up.  How could this happen?

2 Replies

Never ever put stuff in any of the Group resources, be it OneDrive, Team, Planner, Forms, etc. Those are all "shared" and every member of the group has "equal" access to them. It's a design decision, not something you can change. 

@nmstough 

It is true that students are owners of any group form you created

This is the result of creating a quiz in microsoft teams or directly creating a group quiz

To avoid this you need to create the form in (My Forms) and simply share the link to respond with your students