Microsoft Teams: Collect information with List Form in Workflows

🚨 The Signal: Microsoft Teams Workflows now allows automation triggered by SharePoint list form submissions. This enables data collection and automated actions within Teams, backed by SharePoint's data governance capabilities, but introduces new data flow and access considerations.

The Impact

Teams workflow creators can now build forms, increasing potential for unmanaged data collection and exposure if not properly governed.

• Workflow Creators: Can inadvertently expose sensitive data if forms are not designed with security in mind.
• Data Owners: New data sources (SharePoint lists) require review for classification and retention policies.
• Compliance Teams: Need to assess if new form data collection aligns with regulatory requirements.
• Security Teams: Must monitor for unauthorized data exfiltration via automated workflows.

The Action

1. Review existing Microsoft Teams workflow policies for creation permissions and data handling.
2. Educate workflow creators on secure form design and data classification best practices.
3. Audit SharePoint site permissions where these forms' backing lists will reside.
4. Implement data loss prevention (DLP) policies for SharePoint lists used in Teams workflows.
5. Monitor Microsoft 365 audit logs for unusual activity related to new workflow creations and data access.

Domain: Teams · Impact: medium · Workload: Teams