How do I resolve issue related restriction of access after the Microsoft form is flagged for phishing (collecting sensitive information)

Question

I was collecting responses from google form and was flagged for requesting sensitive data. I have included consent and informed them to what the form is going to be used for which is solely for the programmes purpose but was still flagged for phishing. I have also modified the questions but still have not gotten access back.
I have not collected any financially related codes/ details. What was requested are Names, Phone number, Email address and Business address which were for further communication in regards the programme.

Answer 1

Microsoft Forms uses automated anti-phishing checks to detect potential malicious collection of sensitive data and will temporarily block forms and users when suspicious patterns are found, even if the intent is legitimate.

To resolve the restriction and restore access, a global or security administrator in the tenant must review and unblock the form and/or the user account.

1. Ask a global or security admin to review blocked forms
   • Microsoft Forms automatically blocks forms that appear to collect sensitive data.
   • Global/security admins receive daily notifications in the Microsoft 365 admin center Message center titled Microsoft Forms Phishing Notification that list forms blocked for potential phishing.
   • From that notification, the admin selects the Forms admin review URL to open each blocked form.
2. Admin reviews and unblocks the form
   • In the admin review experience, the admin can choose:
     • Unblock if the form is not malicious. This restores the ability to collect responses.
     • Confirm phishing if the form is malicious, which permanently blocks it.
   • If the form owner has already removed the flagged keywords, the block may have been automatically lifted; in that case, the unblock/confirm options will no longer appear and no further action is required.
3. If the user account is restricted from sharing forms
   • When a user repeatedly attempts to collect personal or sensitive information, Microsoft Forms can block that user from distributing forms and collecting responses.
   • Message Center Privacy Readers (or global admins) see a Prevent/Fix: Microsoft Forms Detected Potential Phishing notification in the Message center listing blocked users.
   • From that notification, the admin follows the link to the blocked users list and selects Unblock in the Actions column for users who are determined not to have malicious intent.
   • It can take 30 minutes or more for restrictions to be removed after unblocking.
4. Use safer question design to avoid future flags
   • To reduce the chance of being flagged again, avoid asking for highly sensitive personal information such as passwords.
   • Ensure forms comply with organizational policies and Microsoft’s terms, and clearly explain the purpose of collecting contact details.

If there is no access to the Microsoft 365 admin center or no global/security admin available, the restriction cannot be lifted from within the form alone; an admin must perform the unblock.

---

References:

• Review and unblock forms or users detected and blocked for potential phishing
• Admin information
• Privacy and compliance