This is the Trace Id: c7a732a6010f02ff969470977ada2548
Skip to main content
MSRC

Secure research starts with responsible testing.

Microsoft Defender Bounty Program

Partner with Microsoft to strengthen our products and services by identifying and reporting security vulnerabilities that could impact our customers. 
 

IMPORTANT: The Microsoft Bounty Program is subject to these terms and those outlined in the Microsoft Bounty Terms and Conditions, Microsoft Bounty Legal Safe Harbor, Rules of Engagement, Coordinated Vulnerability Disclosure (CVD), Bounty Program Guidelines, and the Microsoft Bounty Program page.

 

PROGRAM DESCRIPTION

Defender is a Microsoft brand that includes a variety of products and services that are aimed at protecting the Microsoft customer experience. The Microsoft Defender Bounty Program invites eligible researchers to identify vulnerabilities in Defender products and services and share them with our team. The Defender program will begin with a limited scope, focusing on Microsoft Defender for Endpoint APIs and will expand to include other products in the Defender brand over time. Qualified submissions are eligible for bounty awards from $1,250 to $20,000 USD. This includes third-party and open-source components included in the service. Please note that qualifying reports must demonstrate a qualifying security impact on the specified service.

 

ELIGIBLE SUBMISSIONS

The goal of the Microsoft Bug Bounty program is to uncover significant technical vulnerabilities that have a direct and demonstrable impact on the security of our customers.

In addition to the eligibility requirements listed on the Bounty Program Guidelines page, vulnerability submissions must meet the following criteria to be eligible for bounty awards: 

  • Such vulnerability must be Critical or Important severity. For an example of how Microsoft classifies vulnerability severity levels, please see Microsoft Vulnerability Severity Classification for Windows1.
  • The vulnerability must be reproducible on the latest, fully patched version of the product or service.

1The classification of vulnerability severity levels varies by product. Products under the Defender Bounty Program may be classified differently than those listed on the Microsoft Vulnerability Severity Classification for Windows.

 

We request researchers include the following information to help us quickly assess their submission:

  • Submit through the MSRC Researcher Portal.
  • Indicate in the vulnerability submission which high impact scenario (if any) your report qualifies for.
  • Describe the attack vector for the vulnerability.

Microsoft may accept or reject any submission at our sole discretion that we determine does not meet the above criteria.   

 

SCOPE

Vulnerabilities submitted in the following Product(s) are eligible under this bounty program:

  • Microsoft Defender for Endpoint (MDE) - Public APIs
  • Microsoft Defender for Identity (MDI)
  • Microsoft Defender for Office 365 (MDO) - SafeLinks
  • Microsoft Defender for Cloud Apps (MDA), limited to the list below:

 

GETTING STARTED

Please follow the guidance below to create a test account for security testing and probing. Additionally, please follow the Research Rules of Engagement to avoid harm to customer data, privacy, and service availability. If in doubt, please contact bounty@microsoft.com.

In all cases, where possible, please include the string “MSOBB” in your account name and/or tenant name to identify it as being used for security research. 

Here are some useful links for getting started. While this getting-started material is broad, please ensure that you’re focusing your research on only the public Microsoft Defender for Endpoint APIs.

 

BOUNTY AWARDS 

Bounty awards range from $1,250 to $20,000 USD. Higher awards are possible, at Microsoft’s sole discretion, based on the severity and impact of the vulnerability and the quality of the submission.  If a single submission is eligible for multiple awards, the submission will be awarded the single highest qualifying award.

Researchers who provide submissions that do not qualify for bounty awards may still be eligible for public acknowledgement if their submission leads to a vulnerability fix; they may also earn points in our Researcher Recognition Program to receive swag and secure a place on the Microsoft Most Valuable Researcher list. 

 

General Awards

Security ImpactReport QualitySeverity (all amounts in USD)
CriticalImportantModerateLow
Remote Code ExecutionHigh
Medium
Low		$20,000
$15,000
$10,000		$15,000
$10,000
$6,000		$0$0
Elevation of PrivilegeHigh
Medium
Low		$12,000
$8,000
$4,000		$6,000
$4,000
$2,000		$0$0
Information DisclosureHigh
Medium
Low		$12,000
$8,000
$4,000		$6,000
$4,000
$2,000		$0$0
SpoofingHigh
Medium
Low		$8,000
$5,000
$2,500		$4,000
$2,500
$1,250		$0$0
TamperingHigh
Medium
Low		$8,000
$5,000
$2,500		$4,000
$2,500
$1,250		$0$0
Denial of ServiceHigh/LowOut-of-Scope---

Sample high- and low-quality reports are available here.

 

OUT-OF-SCOPE SUBMISSIONS AND VULNERABILITIES  

MMicrosoft is happy to receive and review every submission on a case-by-case basis, but some submission and vulnerability types may not qualify for bounty award.

If your submission is evaluated as out-of-scope for this individual bounty program, it may still qualify for an award under the Standard Award Policy.

Here are some of the common low-severity or out-of-scope issues that typically do not earn bounty awards:

  • Publicly disclosed vulnerabilities that have already been reported to Microsoft or are already known to the wider security community
  • Vulnerability patterns or categories for which Microsoft is actively investigating broad mitigations 
  • Out-of-scope vulnerability types, including:
    • Vulnerabilities requiring physical access to hardware components
    • URL Redirects (unless combined with another vulnerability to produce a more severe vulnerability)
    • Cookie replay vulnerabilities 
    • Sub-Domain Takeovers 
    • Denial-of-Service (DoS) attacks
    • Low-impact CSRF bugs (such as logoff) 
    • Server-side information disclosure such as IPs, server names, and most stack traces 
  • Vulnerabilities that are addressed via product documentation updates, without a change to product code or function
  • Training, documentation, samples, and community forum sites related to Defender Bounty Program products and services are not in scope for bounty awards
  • Vulnerabilities based on user configuration or action, for example: 
    • Vulnerabilities requiring extensive or unlikely user actions 
    • Vulnerabilities in user-created content or applications 
    • Security misconfiguration of a service by a user, such as the enabling of HTTP access on a storage account to allow for man-in-the-middle (MiTM) attacks 
    • Missing HTTP Security Headers (such as X-FRAME-OPTIONS) or cookie security flags (such as “httponly”) 
  • Vulnerabilities used to enumerate or confirm the existence of users or tenants 
  • Vulnerabilities based on third parties that do not demonstrate a qualifying security impact on the specified service, for example: 
    • Vulnerabilities in third-party software provided by Azure, such as gallery images
    • Vulnerabilities in a web application that only affect unsupported browsers and plugins
  • Any vulnerabilities in the Defender portal 
  • Any vulnerabilities in the sensor for Microsoft Defender for Identity (MDI), except for the telemetry channel
  • Scenarios involving links/ URLs by using Microsoft 365 Copilot or Microsoft Copilot for Security
  • MDA on-prem agents (log collector, SIEM agent)
  • Defender for Cloud Apps Access and Session controls
  • Vulnerabilities that are limited to impacting the local machine

Microsoft reserves the right to reject any submission that we determine, at our sole discretion, falls into any of these categories of vulnerabilities even if otherwise eligible for a bounty.  

  

ADDITIONAL INFORMATION 

For additional information, please see our FAQ.  

  

REVISION HISTORY  

  • November 21, 2023: Program launched.  
  • August 28, 2024: Added Microsoft Defender for Identity (MDI) to scope with out-of-scope exclusion for reverse engineering or testing sensors. 
  • December 13, 2024: Added Microsoft Defender for Office 365 (MDO), SafeLinks to scope.
  • February 12, 2025: Added Microsoft Defender for Cloud Apps (MDA) to scope with specified domains and API. Added out-of-scope specifications for this product.
  • May 13, 2025: Updated Research Rules of Engagement section.
  • December 11, 2025: Updated hyperlinks and standardized language.