Are forms and their collected data secured on my company Microsoft 365?

Question

Are forms and their collected data secured on my company Microsoft 365?

Elaine Shulman 0

I created a form on [Moderator note: Personally Identifiable Information removed]- the form and it's responses appear to live on a microsoft site. When I export the answers to Excel, then I can see that I am in my companies Microsoft 365 domain. Where is my form and it's collected data residing? Is it in my company 365 or Microsofts domain?

0 comments

2 answers

Your answer

Answer 1

Microsoft Forms data is stored by the Microsoft Forms service, not inside SharePoint or OneDrive by default just because the form was created from the Forms site.

For Microsoft Forms, the documented storage location is:

United States for most tenants
Europe for European-based tenants that started using Microsoft Forms after May 2017

So the form and its response data reside in Microsoft’s Microsoft 365 service infrastructure for Forms, under the organization’s tenant/service boundary, rather than as a normal file directly living in the company’s Microsoft 365 document domain.

That matches what is seen when exporting to Excel: the exported workbook can be handled within the company’s Microsoft 365 environment, but the underlying Forms service stores the form data in Microsoft Forms storage.

Related security/compliance points documented for Microsoft Forms:

Data is encrypted at rest and in transit.
Microsoft Forms meets GDPR compliance requirements.
Microsoft Forms meets FERPA and BAA protection standards.

References:

Answer 2

Hi Elaine,

Based on my research, the form and its responses are stored within the Microsoft Forms service as part of your organization's Microsoft 365 environment, rather than in a separate Microsoft-owned domain.

Although the form is accessed through a Microsoft-hosted website, the data is associated with your organization's Microsoft 365 tenant. The exact storage location depends on your tenant's geographic region and Microsoft's data residency policies.

For reference: Data storage for Microsoft Forms.

A few points that may help clarify:

The form owner is your work account within your company's Microsoft 365 tenant.
The form and responses are stored in the Microsoft Forms service, not on a publicly accessible Microsoft website just because the URL is hosted by Microsoft.
When you export responses to Excel, the workbook is typically saved within your organization's Microsoft 365 environment (such as OneDrive for Business or SharePoint), where your organization's normal permissions, retention policies, and compliance controls apply.
Microsoft acts as the cloud service provider hosting the data, while your organization remains the customer that owns and manages access to that data under its Microsoft 365 tenant.

I hope this information is helpful.