Finding the owner of a Microsoft Form based on the Form Id (contd.) (or: creating an Authenticated HTTP connection from Power Automate to a Form)

After my previous findings (getting the owner of a Microsoft Form from its Id) the same colleague wondered if there was a way of programmatically getting the owner Id from the Form. This would mean connecting to the Url in an authenticated way of course, using an account that has access to the Form. Assuming that’s the case though, how would one do it?

It has to be an HTTP call. Authenticated. What first comes to mind is the “HTTP with Azure AD” connector from a previous post.

How do I find any of these?

I tried visiting a Form with SAML Tracer turned on. When I open Forms (and I am signed in already to Azure AD so the authentication happens behind the scenes) I see some action like this:

The client_id is c9a559d2-7aab-4f13-a6ed-e7e9c52aec87. Pop that into Azure AD, and yes it’s Microsoft Forms.

So…. let’s fill that connector like this?

I made an educated guess on the Base Resource Url since that is the base Url of all Forms. Similar to what I did with the Key Vault or Logic App previously.

Click Sign in, login with the account you want to connect with, and let’s pop in the Url to make a request.

I know from before that the Url I need to visit is https://forms.office.com/handlers/ResponsePageStartup.ashx?id=<formId>. This is the direct Url to the page I found in the previous post.

If I put that into Firefox I get the same JSON data I found in the Network view.

So let’s add that to the Connector.

Run the Flow, and voila!

Now let’s add a Parse JSON, with the following schema (which I generated by copying the above output and putting into the sample of the Parse JSON connector).

Save, and run the flow. And here’s the output:

Tada!

ps. Later I converted this to an HTTP Request trigger.

And the Response is the Owner Id.

So now I can do the following, for instance:

And the output is the id.

Update: Turns out the account accessing the form doesn’t need access to the form. If I try with a form that the account definitely cannot open, it can still find the Owner. That’s because the https://forms.office.com/handlers/ResponsePageStartup.ashx?Id=<FormId> link works even for forms it doesn’t have access to. Interesting…