SharePoint forms can face the public. External Forms in Ultimate Forms publish any form you design to people outside your organization, on your website or behind an email link, with no login and no SharePoint account anywhere in sight. Submissions land directly in your lists, where your alerts, actions, and views already know what to do with them. The capability requires the Microsoft 365 version of Ultimate Forms, and many organizations that own it have never switched it on. Here are ten reasons to change that.
The forms that never belonged inside
Think about who fills your forms. Employees, yes. But also customers with support requests, candidates with resumes, vendors with invoices, event guests, survey respondents, clients confirming appointments. Half the forms a business runs are for people who will never have an account in your tenant.
The usual answers are all compromises. A generic form service collects the data somewhere else, and someone re-enters it. A shared mailbox collects unstructured email, and someone re-types it. A web developer builds a custom page, and every future change goes through them. External Forms remove the compromise: the same Form Designer form, published outward, feeding the same list. Typical uses write themselves: contact us, support requests, job applications, purchase and materials requests, event registrations.
1. Setup takes minutes
In Form Designer, click External Form on the command bar. Turn on Allow access for anonymous external users, then Allow Hosted Forms, and a URL appears. Post the link on your site or send it by email, and the form is live to the world:
No infrastructure, no publishing pipeline, no IT ticket. The distance between an internal form and a public one is two toggles.
2. CAPTCHA keeps the bots out
Anything public attracts automation. Within days of going live, an unprotected form starts collecting bot traffic: spam links in the comments column, fake signups, scripted submissions probing for weaknesses. Each one fires your notifications, pollutes your views, and trains your team to distrust the list, which is how a good intake quietly dies. A form that accepts garbage costs more attention than it saves.
External Forms integrate with Google CAPTCHA, so submissions come from humans:
The protection is a configuration setting on the form, not something your web team builds: enable it, and the challenge appears to visitors automatically. Turn it on for any form exposed on the open web; a link shared privately by email can reasonably skip it. The cost to a legitimate user is one checkbox; the cost to a bot farm is the whole endeavor.
3. Forms embed in your own website
A hosted URL works, but a form living inside your site looks like it belongs there. Copy the provided snippet into your page, and the form renders in place:
The quiet benefit is who owns the changes afterward. The form is edited in SharePoint, so adding a column or a rule next quarter is a Form Designer task, not a web development request. The website carries the frame; SharePoint carries the form.
4. Submissions travel encrypted, straight to SharePoint
When a user submits, the data goes directly from the form into your SharePoint site, encrypted in transit. There is no intermediate collection service holding copies of your customers' information, which simplifies every security and privacy conversation: the data lives where the rest of your data lives, governed the way the rest of it is governed.
5. Branding without programming
Colors, images, and layout are configured visually, so the public form matches the public site:
To an outside user, the form simply looks like your organization. Nothing about it says SharePoint, and no stylesheet work was involved. Shared styles keep the look consistent when the second and third public forms arrive.
6. File collection is drag and drop
Many public scenarios come with files: the resume, the photo of the damaged product, the signed agreement. Show the attachments area on the form and users drag their files onto it:
No additional setup, and the files arrive attached to the submission record, not loose in a mailbox waiting to be matched to the right request.
7. Confirmation closes the loop
A public submitter has one anxiety: did it go through. Answer it twice. A redirect URL sends the user to a thank-you page the moment they submit. And an email confirmation reaches them a minute later: include an email column on the form, and configure an alert on it exactly as you would any other notification rule. The same mechanism that acknowledges the submitter also notifies your team that work arrived.
8. Not just intake: approvals and updates from outside
New-form submission is the common case, but External Forms also serve edit forms, and that unlocks a different pattern: sending an outside person a link to one specific record.
The vendor confirms the delivery date on the order. The client approves the quote. The interviewee confirms the proposed time slot. In each case, an email carries a link to the record's edit form, the outside party makes their change, and the process moves, with no account created and no PDF emailed back and forth. Authorization and scheduling confirmations run themselves this way.
9. One form, many languages
Public audiences are multilingual, and the form can be too. Add translations to the form, and a URL attribute selects the language: append &lang=es to the same form URL and the Spanish version renders. An English form can simply carry a link at the top offering Español, pointing at itself with the suffix. Fully multilingual forms cover the mechanics in depth.
10. Use it as much as you want
Ultimate Forms licensing counts your SharePoint users, not your public submitters. A thousand anonymous submissions cost the same as ten, and the tenth public form is as free as the first. Once the first form is live, repeating the pattern for the next scenario takes minutes, which is why organizations that start with one contact form tend to end up with a catalog of them.
The questions IT will ask, answered early
Opening anything to the public earns scrutiny, so arrive at that conversation prepared. Exposure is per form: only forms you explicitly publish are reachable, and each one shows exactly the columns you placed on it, nothing else about the list or site. Anonymous users submit through the form; they cannot browse data, open views, or see other submissions. Turning a form off is the same two toggles in reverse, which makes a time-boxed form, an event registration, a seasonal intake, trivially easy to retire.
It helps to design public forms with the same discipline: collect only what the process needs, validate at entry so bad data never lands, and let actions route submissions immediately so the public list is a doorway rather than an archive. A narrow, validated, fast-moving intake is easy to defend in any security review, and it is also simply the better form.
Where to start
Pick the form whose current channel hurts most, usually the shared mailbox that collects requests as free-text email. Rebuild it as a designed form, switch on external access, and put the link where the emails used to go. The submissions arrive structured, validated, acknowledged, and already inside the lists your automation watches.
The documentation covers the full configuration detail, and the External Public SharePoint Forms overview is the companion piece on how the capability fits the larger platform. The ten reasons compress to one sentence: the people outside your tenant generate half your data, and External Forms let them enter it themselves, correctly, at the source.
Frequently asked questions
Add your comment
