How to turn on phishing protection in Microsoft Forms

What this check looks at

Checks that Microsoft Forms scans forms made in the organisation for questions that ask for passwords and other personal information.

Microsoft Forms can scan forms created inside the organisation for questions that ask for passwords and similar secrets, and stop those forms collecting responses. This internal phishing protection is one switch in the Microsoft 365 admin centre, under the Microsoft Forms settings, and it can be turned off.

The check fails when internal phishing protection is off in Microsoft Forms, and passes when it is on.

Once an attacker controls one mailbox, a form on the company’s own Microsoft 365 is a very convincing tool: the link points to forms.office.com, the form carries the company’s name, and it arrives from a colleague. A form titled "Mailbox upgrade – confirm your password" collects credentials from staff who would never trust an outside website.

Why it matters

A form on the company’s own Microsoft 365 is trusted by everyone who receives it. Attackers with one compromised account use Forms to collect colleagues’ passwords; the built-in scan blocks those forms.

Internal phishing spreads fast in small organisations where everyone knows everyone. One compromised account sends a form to the whole company; a handful of people fill it in, and the attacker now holds several accounts, perhaps including someone in finance or IT, without sending any further outside email for filters to catch.

The protection costs nothing and does not affect ordinary forms such as surveys, sign-up sheets or quizzes. Without it, the organisation relies on every member of staff noticing that a form from a colleague should never ask for a password.

The CIS Microsoft 365 Foundations Benchmark (1.3.5) asks for internal phishing protection in Forms to be turned on. The rule maps to NIST CSF 2.0 PR.PS-01.

How to fix it

Where: Microsoft 365 admin centre → Settings → Org settings → Microsoft Forms

Before you start

• Nothing to prepare. Forms already shared keep working unless Microsoft finds them asking for passwords.

Step by step

1. 1Open the Microsoft Forms settings. In the Microsoft 365 admin centre, go to Settings > Org settings > Services and select Microsoft Forms.
2. 2Turn on internal phishing protection. Under Phishing protection, tick Add internal phishing protection and select Save. Forms already shared keep working unless they are found to be asking for passwords.
3. 3Remind staff how to report a suspicious form. Tell staff that a form asking for a password is never genuine, and that they can report one with the Report abuse link at the bottom of any form, as well as telling IT.
4. 4Confirm. Reopen Microsoft Forms in Org settings and check Add internal phishing protection is ticked. Re-run the assessment to confirm the finding passes.

What users will notice

Forms made inside the organisation that ask for passwords or similar are blocked and reviewed. Ordinary forms are unaffected.

How to confirm it worked

Microsoft 365 admin centre, Org settings, Microsoft Forms: "Add internal phishing protection" is ticked.

Frameworks and controls

This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Administrator settings for Microsoft Forms (Microsoft Support)

Related checks

• How to set up user risk and sign-in risk policies
• How to set up anti-phishing impersonation protection
• Entra password protection for on-premises Active Directory
• Impersonation protection in the preset security policies

The full Microsoft 365 security checklist, worst first