[endgame]

How do we know this is real? Most online form providers will host all forms on their own domain, so it could just be a great way to get some data harvesting going on the .microsoft gTLD.

[GaProgMan]

While it's not full on 100% proof, one of the Senior Dev Advocates posted about it on Bluesky

https://bsky.app/profile/cassidoo.co/post/3mpp2vh3oyk2b

[oliwarner]

I hate how Office 365 forms have no simple way to verify where your data is going.

Through companies and schools using them for essential functions, they've normalised posting sensitive data without checking.