Require email verification for share links

You can require respondents to verify their email address before opening a specific Anyone link. Each link has its own settings. Email verification is available on Pro, Premium, and Enterprise plans. On Free, links open without verification, even if it was previously configured. Saved settings take effect again after upgrading.

1. Open your form’s Share dialog and select Anyone links.
2. Select the link you want to protect, or create a new link.
3. Expand Customize this link and select Email verification.
4. Turn on Require email verification.
5. Optionally enter Allowed email domains, separated by commas. Leave this field blank to allow any email address. For example, example.com, company.org allows addresses at either domain. Subdomains must be listed separately.
6. Choose whether to Show form preview before verification. This is on by default and makes the published form definition available and shows it behind the sign-in screen. Turn it off if the form’s content should also stay private until verification. Responses and connected data are never included in the preview.
7. Select Save verification settings.

Respondents can receive a six-digit email code or select Continue with Microsoft. Email codes expire after 10 minutes. If Microsoft cannot verify the account’s email address, the respondent can use an email code instead.

Verification is remembered for 30 days on the same browser for the same form, including when selecting Submit another response. Respondents may need to verify again after signing out, changing browsers, or clearing browser data. Repeated responses do not extend the expiry, and changes to allowed domains also apply to remembered identities. A verified email is recorded as the response’s creator email.

The verified email appears in the account menu above the form. Select Use a different email or Sign out to end the remembered sign-in and return to verification. Unfinished answers are kept so the respondent can continue after verifying again. Responses already submitted retain their original creator email.

Verification protects opening the interactive form, data sources, uploads, and submission through that link. When preview is enabled, the published form definition, including hidden fields, configured defaults, and expressions, is available before verification. The preview displays the form read-only, without evaluating expressions, loading connected data, or submitting responses. Other Anyone links retain their own settings and domain restrictions. Information already downloaded before protection was enabled cannot be recalled.