Following this guide, users can allow public (non-university) users to upload data along with completing a Microsoft Form. Normally this functionality is not allowed in forms Forms with “Anyone” visibility; file uploads are restricted to members of the university.
| Info |
|---|
When a form Form is set to “Anyone” visibility, you cannot also use the File Upload field on the formForm. This is a security precaution. Consequently, users must sign into Microsoft 365 with a UConn account in order to upload files into your formForm. If “Anyone” was able to upload files into your Form, that this would be present a clear vector for attack and is therefore not within the built-in functionality of Forms. |
| Note |
|---|
This guide will help you circumvent this security precaution and therefore must be followed at your own risk. After completing this guide, any actor or computer on the planet will be able to place files into your OneDrive/SharePoint folder. There will be security precautions listed below. Please read and follow this guide carefully. |
...
If you have an existing Form, open it now by visiting forms.office.com.
If you have not yet created a Form, please do so now.There is more than one way to share this link in the Form because Forms does not allow you to enter a simple read-only line of text.
Create a “Choice” questions and supply only one choice, which is the URL of the Request Files.
The text you enter in this field will become hyperlinked so that users can click on it.
Create a new Section.
Creating a new Section will require users filling out the Form to click Next at the bottom of the Form. They will be presented with a second page that can hold questions.
Name the Section “File Upload” for example, and then paste the link in the Subtitle.
Explore other options if these two don’t appear as you would like.
Ask your uploaders to be specific with the naming of their files to help you associate the file with their form Form submission.
Note: Your changes to the Form are saved automatically when you make them.
Share the Form with others when you are finished.
| Tip |
|---|
The data uploaded into the folder you have created will not be linked to the Form. Be sure to check the folder frequently in order to associate the data with specific responses on the Form. |
Why can I publicly “Request Files” using OneDrive/SharePoint and not have a public file upload option in Forms?
This guide works on the assumption that Request Files is intrinsically more secure than Forms due to the share link. Forms have very short links that allow people to share them and type them in easily; Forms are meant to be posted and shared freely. Request Files on the other hand, is computer-to-computer transaction, therefore users are less likely to need to manually type in the share link; it should have been sent to them. This allows the Request Files link to be very long and complicated.
A computer set up to scan the internet and guess the URL for Forms will have a relatively easy time compared to one trying to guess the link for Request Files. The Request Files link is very long and full of gibberish and therefore very, very hard for a computer to guess or “stumble upon” and then dump a malicious payload.
...