Why is Microsoft Forms not suitable for collecting attachments from anonymous users?

Microsoft Forms allows file uploads only when the respondent is authenticated with a Microsoft account. In public mode, for users with no account in the tenant, the feature is not available. For any document collection aimed at external users — public calls, applications, citizen forms — you have to evaluate alternative solutions.

How do you verify an anonymous user's identity without requiring a Microsoft account?

Verification through an OTP (one-time password) sent to the applicant's email is the most balanced solution between accessibility and reliability. It requires no account creation, adds no friction to the user experience and guarantees each application is tied to a real, active email address.

How do you guarantee confidentiality of documents attached by anonymous users?

Through Azure Information Protection, every uploaded document is labelled with a confidentiality tag that controls access. Only the evaluation committee, identified through security groups on SharePoint, can open the documents. The label follows the file even if it is downloaded or moved outside SharePoint.

What happens to the collected data at the end of the call?

Retention policies define how long data is kept and the actions at expiry. The 12-month policy applied in this project ensures data is kept for the time needed for evaluation and appeals, then handled for deletion in line with the GDPR. Management is automatic and requires no manual intervention from staff.

Is this model reusable for future calls or different foundations?

Yes. The architecture — Azure Static Web App, OTP, SharePoint, Information Protection — is modular. Later calls require reconfiguring the form, the validation rules and the confidentiality labels, not rebuilding the infrastructure. For bodies with recurring calls, the incremental cost of each new collection is far lower than the first build.

Azure Static Web App for a GDPR-Compliant Public Form

Collecting applications with attachments from anonymous users — without being able to require Microsoft authentication — while staying GDPR-compliant is a problem no off-the-shelf tool solves on its own. For a non-profit foundation’s public call aimed at citizens across roughly 100 municipalities in northern Italy, we solved it with an Azure Static Web App, OTP verification and Azure Information Protection: the collection closed on time.

Applicants had to submit their application, enter personal data and attach documentation on their household’s economic situation. The data had to flow into SharePoint for the evaluation committee, with confidentiality guarantees and GDPR compliance, by a fixed deadline. The requirement looked simple — a public form with attachments — but the complexity emerged in the details, as often happens when digitising forms and attachments aimed at external users.

The problem: collecting attachments from anonymous users without friction

The call was open to the general public: people outside the foundation’s tenant, with no Microsoft account. The experience had to be accessible and unfragmented, because the audience included people in economic hardship. And the DPO had precise requirements: Information Protection on the documents, a 12-month retention policy, access limited to the committee. No off-the-shelf tool met the whole set of requirements. Finding the right solution meant evaluating and discarding two alternatives.

The solution: three hypotheses, one choice

Hypothesis 1 — Microsoft Forms. It integrates natively with SharePoint and needs no development. But in unauthenticated mode Forms cannot collect attachments: files can only be uploaded with a Microsoft account. For a call aimed at citizens, a blocking limitation. Discarded.

Hypothesis 2 — Forms for data + a tenant invite for attachments. Collect the data with public Forms, then invite the user as a guest in the tenant to upload attachments in a second phase. Technically it worked, but it produced a fragmented experience: fill in a form, wait for an email, accept the invite, log into a second environment. For a foundation addressing people already in difficulty, unacceptable. Discarded.

Azure Static Web App with OTP verification, data and attachment collection in a single session and saving to SharePoint with Azure Information Protection

Hypothesis 3 (adopted) — Azure Static Web App with a custom form. The final solution meant leaving the off-the-shelf tools and building something tailored. We developed an Azure Static Web App with a custom form that handles the whole experience in a single session:

Email verification via OTP. Before filling in the form, the applicant enters their email and receives a one-time code. Each application is tied to a verified address, with no account creation and no Microsoft credentials. The access barrier stays low; data validity stays high — an external-identity principle close to that of an Azure B2C/B2B architecture.
Data and attachments in a single session. The form collects the personal data and allows the upload of attachments — income documents, economic certifications — with no interruptions and no redirects.
Saving to SharePoint with Azure Information Protection. Data and files are saved to SharePoint Online in the foundation’s tenant. Documents are labelled with a confidentiality tag: access is limited to the committee, and the label follows the document even outside SharePoint.
12-month retention policy. At the DPO’s request, data is kept and then automatically deleted in line with personal-data-protection regulations.

The results

The call was published across roughly 100 municipalities in northern Italy and the collection closed on time. Applicants submitted their applications with a smooth experience, in a single session, with no technical friction. The committee found data and attachments organised and accessible on SharePoint. The DPO obtained the required compliance guarantees: Information Protection on the documents, GDPR-compliant retention, access limited to authorised staff only. The foundation could focus on selecting beneficiaries, not on managing the collection.

Who this approach is for

The model suits foundations, public bodies, associations and non-profits that must collect applications with attachments from anonymous users, without being able to impose Microsoft authentication. It is especially relevant when the DPO’s requirements are strict — document confidentiality, automatic retention, limited access — and when simplicity of the user experience is a functional requirement, not an option. The same logic as a custom web application tailored to the client, applied to the public collection of sensitive data.

If you run a public call or collection with confidentiality and GDPR requirements, we can help you build the right system. Contact us for an assessment →