Workspaces, members, and roles
How a SharePoint Forms365 workspace maps to your M365 tenant, who can author vs view, and how invitations work.
A workspace in SharePoint Forms365 corresponds to one Microsoft 365 tenant. The workspace is automatically provisioned the first time someone from your tenant signs in.
Roles
Two roles within a workspace:
| Property | Description |
|---|---|
Admin | Full control, manage members, manage forms, view billing, manage API tokens. The user who first creates the workspace is automatically Admin. |
Member | Can create and edit forms. Cannot manage other members, billing, or API tokens. |
How people join a workspace
Three paths:
- Bootstrap, the first user from a tenant becomes Admin of a fresh workspace
- Invitation, an Admin sends an invite link to an email address. The recipient signs in and is added.
- Open enrollment, if the workspace setting Allow anyone in our M365 tenant to join is enabled, every user from the same tenant joins as a Member on first sign-in.
What happens if a user has no path in
The auth flow's resolver returns 403 no_workspace_access and the
user is redirected to a friendly "no access" page with instructions. Common
causes:
- They're in a different M365 tenant from your workspace
- Open enrollment is off and they haven't been invited
- An admin recently disabled their membership
Permissions are per-workspace, not per-form
SharePoint Forms365 doesn't have per-form permissions yet. Anyone with workspace access can see (and authorised members can edit) every form. The actual data the forms collect is governed by SharePoint list permissions, those are unaffected.
For workspaces where this is a problem, the recommended pattern is multiple workspaces, one per division/team, with the same admin running both.