Security Policy Errors

How to Unblock a Microsoft Form Flagged for Potential Phishing

Muhammad Talha Sep 29, 2026 868 views

Question details

The user needs to unblock a Microsoft Form that has been flagged and restricted by automated anti-phishing protection, which prevents its distribution and grading.

How to Unblock a Microsoft Form Flagged for Potential Phishing

Product: Microsoft Forms
Device & OS: not provided
Scenario: A user has distributed a form, such as a cybersecurity test, but finds it blocked by the system for suspected phishing after respondents have submitted or attempted to submit answers.
Observed behavior: Microsoft Forms blocks the distribution or grading of the form and displays an alert indicating a potential phishing attempt.

Before you start

Only a Microsoft 365 administrator with appropriate permissions can review and unblock a restricted form in Microsoft Defender XDR. If you are a standard user, you must contact your IT administrator.

Solution 1Recommended

Review and Unblock the Form via Microsoft Defender XDR

Microsoft 365 administrators can investigate the automated phishing alert and manually unblock the form if it is confirmed to be safe and legitimate.

Microsoft Forms uses automated anti-phishing protection to proactively detect malicious requests for personal information, passwords, or financial data. While using conceptual cybersecurity terms like 'virus' or 'Trojan' in a test is generally acceptable, prompts that ask for verification codes or simulated sign-ins will likely trigger the filter.

Log in to Microsoft Defender

As a Microsoft 365 administrator, log in to the Microsoft Defender XDR portal.

Navigate to Alerts

In the left navigation menu, go to 'Investigation and response', then expand 'Incidents and alerts' and click on 'Alerts'.

Locate the Blocked Form Alert

Find and open the specific alert indicating that a form was blocked due to a potential phishing attempt.

Review the Form

Select the review option within the alert to verify the form's content and ensure it does not maliciously request sensitive credentials.

Unblock the Form

If the form is legitimate, click the option to unblock it. Please note that it may take approximately 30 minutes for the restrictions to fully clear across the system.

Form Design Best Practices: To prevent future blocks, avoid requesting real credentials or sensitive personal information in your forms. Instead of manually asking for user names or emails, utilize the form's built-in name-recording option where appropriate.

Free Microsoft Office alternative

Create Secure Forms and Documents with WPS Office

If you are looking for a straightforward, flexible tool for creating documents, spreadsheets, presentations, and forms, WPS Office is an excellent free alternative to Microsoft Office. It offers a familiar interface, high format compatibility, and seamless migration.

1. Download WPS Office: Visit the official WPS website and download the installation package for your operating system.
2. Install the Application: Run the installer and follow the on-screen instructions to set up WPS Office on your device.
3. Start Creating: Launch WPS Office and select WPS Forms or any other document type to begin creating your content securely.

Create highly customizable questionnaires and tests with WPS Forms.Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight software that runs smoothly on Windows, Mac, and mobile devices.Free to use with a user-friendly interface that requires no steep learning curve.

microsoft office alternative - wps office

Frequently Asked Questions

Do cybersecurity terms like 'virus' or 'Trojan' cause a form to be flagged for phishing?

Generally, no. Using conceptual cybersecurity terms in a test or questionnaire will not trigger the filter. The anti-phishing protection is primarily triggered by requests for passwords, verification codes, financial data, or real credentials.

How long does it take for a Microsoft Form to be unblocked?

Once a Microsoft 365 administrator reviews the alert in Microsoft Defender XDR and selects the option to unblock the form, it typically takes about 30 minutes for the restrictions to clear and for the form to be usable again.

How can I avoid my forms being blocked for phishing in the future?

Avoid simulating sign-in flows or asking for sensitive personal data in your questions. If you need to know who is submitting the form, use the built-in name-recording option provided by Microsoft Forms rather than creating custom fields asking for names or email addresses.

Microsoft Office Security Issues