Free guide

A free visitor sign in with a QR code and Microsoft Forms, and where it stops

If the paper book has to go and there is no budget to replace it, you can build a working digital sign in this afternoon from things your business already pays for. We sell the thing you would buy instead, so read this knowing that. It is still the guide we would want if we were you: how to build it properly, and an honest list of where it runs out.

Go to the eight steps Or read where it stops first

Every statement about Microsoft’s and Apple’s products was checked against their own documentation in September 2026, linked at the bottom. We have no connection with either.

How to build it

Eight steps, about an hour

You need a Microsoft 365 work account, a printer, and somewhere at reception to put a sign. Steps one to four give you a working sign in. The rest are what make it worth keeping.

Step 1
Make the form, and keep it short
In Microsoft Forms, with your work account, create a form with four questions: full name, company, who they are here to see, and a required choice that reads “I have read the site rules above and know where the fire assembly point is”. Add a vehicle registration only if you have a yard and need it. Put your site rules and the privacy line below in the form’s description, so they are read before the first question.
Step 2
Let visitors answer without an account
Under Collect responses, choose “Anyone can respond”. Microsoft’s documentation says these responses do not require someone to sign in. It also means Forms does not know who the person is, which is why the name is a question rather than something recorded for you.
Step 3
Print the QR code
In the same panel, select the QR icon and download it. Forms gives you an image file. Put it on a sign at reception, at eye level, with the words “Visitors: scan to sign in” and the plain link underneath for anybody whose camera will not read it.
Step 4
Open the results in Excel
On the Responses tab, “Open results in Excel” creates a workbook in your OneDrive for work with a live connection to the form, so new visitors appear in it. Microsoft documents the first five columns as an ID, the start and completion times, and the name and email of the respondent; for an anonymous visitor the completion time is your time in, and the name is whatever they typed.
Step 5
Tell the host, if you want to
Power Automate has a Microsoft Forms connector with a trigger called “When a new response is submitted” and an action called “Get response details”. Follow those with the Teams action “Post message in a chat or channel”, or an email, and the host hears about the arrival. Both connectors are listed as standard rather than premium, and the Forms one works with organisational accounts only.
Step 6
Decide how people sign out
Make the first question “Are you arriving or leaving?”, or put a second code by the exit. This is the step that decides whether the whole thing works, and it is the one a form cannot enforce.
Step 7
Give people without a phone a way in
A driver in gloves or a visitor with no signal cannot scan anything. A tablet on the desk with the form open covers them. On an iPad, Apple’s Guided Access holds the device on one app so it cannot wander off to somebody’s email.
Step 8
Write down when it gets deleted
Nothing in this setup deletes a visitor’s record when its time is up. The bulk tool Forms documents is “Delete all responses”, so the workable pattern is one form per quarter: when the retention period for that quarter has passed, delete its responses and its workbook, and put the date in somebody’s calendar. It is crude, and it is better than a spreadsheet that remembers everybody for ever.

For step one

A privacy line to paste into the form

[Company name] records your name, company, host and the time you arrive and leave, for the security of this site and the safety of the people on it, in our legitimate interests. Records are kept for [retention period] and then deleted. Ask reception for our full privacy notice. By submitting this form you confirm you have read the site rules above and know where the fire assembly point is.

The three bracketed fields are yours to fill in, because they are the three facts a privacy line has to carry and the three we cannot know. We are not data protection lawyers and this is not legal advice.

Visitor records and UK GDPR, in full The same line on a printable sheet

Being straight with you

Six places it stops being enough

None of these is a fault in Microsoft Forms. A form is a form. They are the difference between a record and a system, which is the thing we sell, so weigh them accordingly.

Nobody signs out

Signing in gets you through the door. Signing out gets you nothing, so people do not. The sheet then says twelve people are on site when four are, which is an irritation on a normal day and a search of a building on a bad one.

The roll call is a spreadsheet on a phone

When the alarm goes, somebody has to open OneDrive on their phone, find the workbook, sign in, and work out who arrived today and has not left. It can be done. It is not what you want to be doing at an assembly point in the rain.

It is a record anybody can edit

Rows in a workbook can be changed or removed by anyone with access to the file, and responses can be deleted from the form. That is fine for knowing who is in the building. It is weaker when an auditor or an insurer asks how you know the record is complete.

The link works from anywhere

“Anyone can respond” means anyone with the link, including whoever photographed the sign last month. Expect the occasional junk row, and do not treat an entry as proof that somebody was actually at your door.

There is no badge and no approval

Nothing tells the shop floor that the stranger walking across it was signed in, and nothing stops a visitor going through before their host knows they have arrived.

Somebody has to own it

The form, the workbook, the flow and the quarterly deletion all belong to whoever built them. When that person moves on, this is the kind of system that quietly stops being looked after.

If you outgrow it

What a kiosk does with the same idea

The same sign in, on an iPad in a locked stand, with the parts a form cannot do: a sign out button that people actually press because it is on the screen in front of them, a live list of who is on site that a marshal opens on any phone, retention that deletes on its own, an export an auditor can open, and somebody whose job it is to keep it running.

It costs £150 a month plus VAT, which is a great deal more than nothing. If the form is doing the job, keep the form.

Watch it work, in under two minutes Every price, in public Or stay on paper, properly: the free templates

Sources

Check any of this yourself

Microsoft Support, send a form and collect responsesThe QR code download, and the “Anyone can respond” setting with no sign in required.
Microsoft Support, check and share your form results“Open results in Excel”, where the workbook is stored, what the first columns hold, and “Delete all responses”.
Microsoft Learn, Microsoft Forms connectorThe trigger and the action named in step five, the connector class, and the organisational accounts limitation.
Microsoft Learn, Microsoft Teams connectorThe “Post message in a chat or channel” action.
Apple Support, use Guided Access on iPhone or iPadHolding an iPad on a single app, for the tablet on the desk.

Checked September 2026. Microsoft, Microsoft 365, Microsoft Forms, Excel, Teams and Power Automate are trademarks of Microsoft, and Guided Access and iPad of Apple. Neither has endorsed or had any part in this page. Software changes; if a step no longer matches what you see, email [email protected] and it will be corrected.

Before you ask

The questions people ask about doing this for free

Can visitors fill in a Microsoft Form without a Microsoft account?

Yes, if the form is set to “Anyone can respond”. Microsoft’s documentation says responses under that setting do not require someone to sign in. The consequence is that Forms cannot record who they are for you, so their name has to be one of your questions.

Can Microsoft Forms send a Teams message when a visitor arrives?

Not on its own, but Power Automate can. The Microsoft Forms connector has a trigger called “When a new response is submitted” and an action called “Get response details”, and the Teams connector has “Post message in a chat or channel”. Microsoft lists both connectors as standard. The Forms connector only works with organisational accounts.

Is a QR code and a form GDPR compliant?

The tool does not decide that. What decides it is the same four things as for a paper book: you collect only what you need, you tell people why at the point they give it, you keep it secure, and you delete it when you said you would. A form does the first three well if you set it up carefully. The fourth is entirely manual, and it is the one that gets forgotten.

Can it do a fire roll call?

Only in the sense that the information is in a spreadsheet somewhere. It depends on people having signed out, on somebody being able to open and read the workbook on a phone outside, and on that person being on site that day. If the roll call is the reason you are looking at this, it is the part a form does least well.

Should we put health or induction questions in the form?

Site rules and an acknowledgement, yes. Health questions, think first: answers about illness are special category data under UK GDPR, and a general purpose spreadsheet in somebody’s OneDrive is a poor home for them. If you are a food site and need the health declaration, the printable questionnaire on this site is a safer free option than a form.

Does this work with Google Forms?

Probably, in outline. This guide sticks to Microsoft because every step in it was checked against the vendor’s own documentation, and Microsoft’s is the documentation we checked. We would rather say nothing about Google’s product than guess.

When is this enough, and when is it not?

It is enough for an office or a small site with a handful of visitors a week, a receptionist who notices who has left, and nobody outside the business asking for evidence. It stops being enough when a customer, an assessor or an insurer wants to see the record, when contractors and drivers come through more than one door, or when the fire roll call is something you need to be able to rely on.

Also asked of sites like yours

The other things somebody may ask you to evidence

Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.

When you are ready

If the form has stopped being enough

Fifteen minutes on the phone. Tell us what you built, who has started asking you to prove things, and how many doors people come through. We will tell you straight whether a kiosk is worth your time yet.

Book a 15 minute call

If the form is still doing the job, keep using it. We will say so on the call.

Would rather email? [email protected]