Can You Share Microsoft Forms with Specific External Users?

Not with a native named-external allow-list.

Microsoft Forms gives a work or school form owner three response audiences:

• Anyone can respond — people inside or outside the organisation can submit without signing in;
• Only people in my organization can respond — signed-in members of your tenant; or
• Specific people in my organization can respond — selected people or groups inside your tenant.

The third option sounds close, but Microsoft explicitly limits it to people and groups in your organisation. Adding an external email address to the invitation does not turn it into an authenticated external respondent.

That makes the correct solution a requirements decision, not a hidden Forms setting.

Choose the response model first

Requirement	Best starting point	What it proves
A public or low-risk external survey	Microsoft Forms with Anyone can respond	Possession of the link, not a verified identity
Selected employees or internal groups	Forms with Specific people in my organization can respond	Signed-in internal membership
Named partners must sign in	A Power Apps guest solution or another authenticated application	Identity and access defined by that application
A designed external portal with roles and Dataverse data	Power Pages	Authentication plus web-role, page and table permissions
Sensitive evidence upload or regulated case intake	A deliberately governed authenticated process	The controls required by the data and risk assessment

Do not start with “How do I force Forms to do this?” Start with “What evidence of identity and authorisation do we require before submission?”

Option 1: Use “Anyone can respond” for suitable external forms

If named authentication is not required, Forms is still useful.

1. Open the form.
2. Select Collect responses.
3. Choose Anyone can respond.
4. Copy the link or send an invitation.
5. Test it in a private browser window while signed out.

Microsoft's current Send a form and collect responses page says these responses do not require sign-in. Anyone who receives the link can potentially forward it to someone else.

That is not automatically a “massive security risk”. It is a bearer-link audience with specific limits. It can be reasonable for event interest, public feedback or a low-risk questionnaire. It is a poor fit when only five named suppliers may submit a bank detail, health document or privileged case response.

Reduce the risk honestly

• Collect only the data you need.
• Avoid asking for secrets, passwords or highly sensitive personal information.
• State who owns the form and why the data is collected.
• Set a start/end window when appropriate.
• Monitor unusual response volume and validate important answers through a separate trusted channel.
• Do not describe an email invitation as identity verification; the link may be forwarded.

An optional “enter your email address” question is self-asserted data. It does not prove the submitter owns that address.

Option 2: Restrict the form to internal people

For employees, use Only people in my organization can respond or Specific people in my organization can respond.

The specific-people option supports up to 100 individual names or group names, including up to 20 groups, according to Microsoft's current Forms limits. Those are internal people and groups—not arbitrary consumer or partner addresses.

For an internal audience you can choose to record names and limit submissions to one per person. Test with a normal user account as well as the owner; owners often have access that respondents do not.

Why inviting an Entra guest is not the native answer

Microsoft Entra B2B guest accounts are real, useful identities. But the Forms product label and documentation still say Specific people in my organization.

Tenant behaviour, licensing and Microsoft product changes can make edge cases appear to work, but an edge case is not a safe design contract for an important process. We do not recommend inviting guests and then promising customers that Forms provides a supported external allow-list unless Microsoft documents that exact path for the tenant and you have acceptance-tested it.

If authenticated guests are a hard requirement, use a surface whose documentation is built around guest access.

Option 3: Use Power Apps for a named external business process

Microsoft documents how to share a canvas app with Microsoft Entra B2B guest users.

This route is useful when selected partners, contractors or suppliers need to perform a repeatable business task rather than answer a lightweight survey.

It is not simply “rebuild the form in Power Apps”. Plan the complete boundary:

1. Enable and govern B2B external collaboration in the resource tenant.
2. Invite or provision the external identities.
3. Build and share the app with the intended guests.
4. Give them access to every required data source and dependent resource.
5. Check Power Apps and connector licensing for each user and workload.
6. Apply Conditional Access and lifecycle rules where required.
7. Test as an actual guest in a clean browser session.

Microsoft warns that access to the app does not automatically create access to its data connections. This is the same principle that makes “the link opened” a weak test.

Option 4: Use Power Pages for an external portal

Power Pages is designed for browser-based sites that can serve anonymous or authenticated external users and work with Dataverse.

Microsoft's Power Pages security model separates:

• site visibility;
• authenticated users;
• web roles;
• table permissions;
• page permissions; and
• additional site-security controls.

That is a better conceptual fit for a supplier portal, customer case intake or external application process. It also means more design and governance than a Forms link. A person signing in is only authentication; web roles and data permissions still determine what that person may see or change.

File uploads are an important boundary

Microsoft Support says a Forms File upload question is available only when the form is set to Only people in my organization can respond or Specific people in my organization can respond.

It therefore cannot be used with Anyone can respond for anonymous external respondents.

Do not work around that by asking people to email files while claiming the Forms process is complete. Decide where the file will live, who can download it, how malware and retention are handled, and how it is linked to the right case. For authenticated external uploads, use a solution designed and governed for that purpose.

Power Automate cannot add authentication after submission

A flow can process a Forms response. It can route, validate, notify, copy data or flag a suspicious answer.

But the trigger runs after Forms accepted the response. Checking an entered email address and deleting an unwanted response does not stop an unauthorised person from opening the form, reading its questions or submitting data. It is business-rule validation, not respondent authentication.

Use Power Automate for downstream processing only after the audience decision is sound.

Useful flow checks include:

• reject or quarantine incomplete business data;
• require a known reference number and validate it against a trusted source;
• send an acknowledgement without echoing sensitive answers;
• alert an owner to duplicate or unusual submissions; and
• record processing status and errors.

Do not tell users that such checks make an anonymous form “secure for named externals”.

Tenant administrators can disable external responses

Even when the owner selects Anyone can respond, tenant policy can affect whether external sharing is available.

Microsoft's Forms administrator settings let an authorised Microsoft 365 administrator control external collaboration and other Forms behaviour.

If the external option is missing or disabled:

1. confirm the owner uses an eligible work or school account;
2. remove any File upload question and re-check the audience options;
3. ask the administrator to review the Forms external-sharing policy; and
4. test the final link while signed out and from outside the tenant.

Do not ask an administrator to weaken a tenant-wide policy merely to rescue one form. The right outcome may be a different solution.

A practical acceptance test

Before publishing an external intake route, test these cases:

• intended external person on desktop;
• intended external person on mobile;
• signed-out/private browser;
• a forwarded link opened by an unintended person;
• expired or disabled external identity for authenticated solutions;
• duplicate submission;
• missing or false claimed email address;
• upload blocked, oversized or unsafe;
• downstream flow failure; and
• owner absent or account disabled.

Record what the solution actually proves. For Anyone can respond, it proves that someone with the link submitted the answers. It does not prove who they are.

The recommendation

Use Forms for external respondents when anonymous or bearer-link access is acceptable for the data and process.

Use an authenticated Power Apps, Power Pages or other governed application when the business requirement is “only these named external people may respond”. That requirement deserves an identity and authorisation design, not a clever post-submission filter.

For practical administration patterns across Forms, Teams and SharePoint, join the SharePoint & Teams Admins Space.

Frequently asked questions

Can Microsoft Forms restrict responses to specific external email addresses?

Not natively. Specific people in my organization can respond is limited to people and groups inside the organisation. External respondents use Anyone can respond, which does not require sign-in, or a different authenticated solution.

Will inviting someone as an Entra guest make them a specific Forms respondent?

Do not rely on that as the supported Forms design. Entra guests are valid identities, but Microsoft's Forms audience documentation still limits the specific-people option to the organisation. Use an explicitly guest-aware application when named external authentication is required.

Can Power Automate block an unauthorised external respondent?

No. A Forms response flow starts after submission. It can validate, flag or delete data, but it does not authenticate the person before Forms displays and accepts the form.

Can external respondents upload files to Microsoft Forms?

Not through an Anyone can respond form. Microsoft says File upload questions are available only with the two organisation-restricted response audiences.

Is Power Apps or Power Pages better for named external users?

Power Apps guest access suits authenticated partners participating in a business process across app data sources. Power Pages suits a designed external website/portal using Dataverse and web roles. Licensing, permissions, identity and lifecycle requirements should decide—not the desire to reproduce a Forms screen exactly.