PROGRAM DESCRIPTION

Microsoft continues to invest heavily in the security and privacy of both our consumer (Microsoft Account) and enterprise (Azure Active Directory) identity solutions. We have focused on the creation, implementation, and improvement of identity-related specifications that foster strong authentication, secure sign-on, sessions, API security, and other critical infrastructure tasks, as part of the community of standards experts within official standards bodies such as IETF, W3C, or the OpenID Foundation.

The Microsoft Identity Bounty Program invites researchers across the globe to identify vulnerabilities in identity products and services and share them with our team. Qualified submissions are eligible for bounty rewards from $750 to $100,000 USD.

In conjunction with our collaboration with the OpenID standards community, our bounty includes certified implementations of select OpenID standards. 

This bounty program is subject to these terms and those outlined in the Microsoft Bounty Terms and Conditions and our bounty Safe Harbor policy.  
 

ELIGIBLE SUBMISSIONS

The goal of the bug bounty program is to uncover significant vulnerabilities that have a direct and demonstrable impact on the security of Microsoft’s customers. Vulnerability submissions must meet the following criteria to be eligible for bounty award: 

  • Identify a previously unreported critical or important vulnerability that results in an in-scope security impact and meets any of the below criteria:
    • Reproduces in the latest, publicly available version of in-scope Microsoft Identity services 
    • Results in the taking over of a Microsoft Account or Azure Active Directory Account.
    • Is listed in OpenID standards or with a OpenID-compliant protocol and  is implemented in our certified products, services, or libraries.
  • Includes all the following information:
    • A description of the issue and concise reproducibility steps that are easily understood.
    • The impact of the vulnerability
    • Attack vector if not obvious

IN-SCOPE DOMAINS AND STANDARDS:

  • login.windows.net
  • login.microsoftonline.com
  • login.live.com
  • account.live.com
  • signup.live.com
  • account.windowsazure.com
  • account.activedirectory.windowsazure.com
  • credential.activedirectory.windowsazure.com
  • passwordreset.microsoftonline.com
  • Microsoft Authenticator (iOS and Android applications)*
  • Microsoft Authenticator Broker (iOS and Android applications)*
  • Microsoft Authenticator Lite (iOS and Android applications)* 
  • graph.microsoft.com APIs that originate in and impact the Identity Authentication workflow, listed under the Directory Management, Governance, and Identity and Sign In tabs in the Working with Azure Active Directory Resources in Microsoft Graph V1.0 page.
  • Azure Active Directory B2C (awarded under the B2C Awards table)

* For mobile applications: research must reproduce on the latest version of the application and mobile operating system.

Standards Scope:

Microsoft products and services Certified Implementations listed here.

  • OpenID Foundation - The OpenID Connect Family
  • OpenID Connect Core
  • OpenID Connect Discovery
  • OpenID Connect Session
  • OAuth 2.0 Multiple Response Types
  • OAuth 2.0 Form Post Response Types

Please note: Submissions for standards, protocols, or implementation bounties must be submitted with a fully ratified identity standard in scope of this bounty and have discovered a security vulnerability with the standard or protocol implemented in our certified products, services, or libraries.

Standards professionals with contributions or affiliations to identity standards working groups are not eligible to receive standards-related bounties.

BOUNTY AWARDS

Bounty awards range from $750 up to $100,000. Higher awards are possible, at Microsoft’s sole discretion, based on entry impact, severity, and quality.

 

GENERAL AWARDS
Security Impact
Report Quality
Severity
Critical
Important

Moderate

Low
Elevation of Privilege
(Involving Multi-factor Authentication Bypass)

High

Medium

Low

$100,000

$75,000

$45,000

$50,000

$25,000

$10,000

$0

$0
Elevation of Privilege
(e.g Authentication Bypass or authentication flaw)

High

Medium

Low

$40,000

$20,000

$8,000

$20,000

$10,000

$2,500

$0

$0

Spoofing

(e.g Cross-Site

Scripting (XSS) or  Cross-Site Request Forgery CSRF))
High
Medium
Low
$20,000
$10,000
$6,000
$10,000
$5,000
$1,500

$0

$0

Information Disclosure

(e.g. Sensitive Data

Exposure)
High
Medium
Low
$12,000
$6,000
$4,500
$7,500
$3,000
$1,500

$0

$0

Standards Design

Vulnerabilities

(Some limitations apply, see Out of Scope section below)
High
Medium
Low
$100,000
$60,000
$25,000
$30,000
$20,000
$2,500

$0

$0

Standards-based

implementation

vulnerabilities

(Some limitations apply, see Out of Scope section below)
High
Medium
Low
$75,000
$50,000
$20,000
$25,000
$10,000
$2,500

$0

$0
B2C AWARDS
 

Security Impact

Report Quality

Severity

Critical

Important

Moderate

Low

Elevation of Privilege

(Involving Multi-factor Authentication Bypass)

High

Medium

Low

$50,000 

$37,500 

$22,500 

$25,000 

$12,500 

$5,000 

$0

$0

Elevation of Privilege 

(e.g Authentication Bypass or authentication flaw) 

High 

Medium 

Low 

$20,000 

$10,000 

$4,000 

$10,000 

$5,000 

$1,250 

$0

$0

Spoofing 

(e.g Cross-Site Scripting (XSS) or  Cross-Site Request Forgery (CSRF)) 

High 

Medium 

Low 

$10,000 

$5,000 

$3,000 

$5,000 

$2,500 

$750 

$0

$0

Information Disclosure 

(e.g. Sensitive Data Exposure) 

High 

Medium 

Low 

$6,000 

$3,000 

$2,250 

$3,750 

$1,500 

$750 

$0

$0

Standards Design Vulnerabilities 

(Some limitations apply, see Out of Scope section below) 

High 

Medium 

Low 

$50,000 

$30,000 

$12,500 

$15,000 

$10,000 

$1,250 

$0

$0

Standards-based implementation  vulnerabilities 

(Some limitations apply, see Out of Scope section below) 

High 

Medium 

Low 

$37,500 

$25,000 

$10,000 

$12,500 

$5,000 

$1,250 

$0

$0

A high-quality report provides the information necessary for an engineer to quickly reproduce, understand, and fix the issue. This typically includes a concise write up or video containing any required background information, a description of the bug, and an attached proof of concept (PoC). Sample high- and low-quality reports are available here.  

We won’t reduce report quality ratings for issues that are difficult to reproduce or understand due to their complexity.

 

GETTING STARTED

You must create test accounts and test tenants for security testing and probing.

In all cases, where possible, include the string “MSOBB” in your account name and/or tenant name in order to identify it as being in use for the bug bounty program.

 

OUT OF SCOPE SUBMISSIONS AND VULNERABILITIES

  • Publicly-disclosed vulnerabilities which have already been reported to Microsoft or are already known to the wider security community 
  • Issues without clearly identified security impact (such as clickjacking on a static website), missing security headers, or descriptive error messages
  • Out of scope vulnerability types, including:
    • Server-side information disclosure such as IPs, server names and most stack traces 
    • Low impact CSRF bugs (such as logoff) 
    • Denial of Service issues
    • Sub-Domain Takeovers 
    • Cookie replay vulnerabilities 
    • URL Redirects (unless combined with another vulnerability to produce a more severe vulnerability) 
    • Password, email and account policies, such as email id verification, reset link expiration, password complexity
    • Vulnerabilities in a web application that only affect unsupported browsers and plugins
  • Vulnerabilities that are addressed via product documentation updates, without change to product code or function.
  • Vulnerabilities based on user configuration, user action, or physical access, for example: 
    • Vulnerabilities requiring extensive or unlikely user actions 
    • Vulnerabilities in user-created content or applications. 
    • Security misconfiguration of a service by a user, such as the enabling of HTTP access on a storage account to allow for man-in-the-middle (MiTM) attacks 
    • Submissions that require manipulation of data, network access, or physical attack against Microsoft offices or data centers and/or social engineering of our service desk, employees or contractors
    • Two-factor authentication bypass that requires physical access to a logged-in device
    • Local access to user data when operating a rooted mobile device
    • Missing HTTP Security Headers (such as X-FRAME-OPTIONS) or cookie security flags (such as “httponly”) 
    • Vulnerabilities used to enumerate or confirm the existence of users or tenants
  • Vulnerabilities based on third parties, for example: 
    • Vulnerabilities in third party software provided by Azure such as gallery images and ISV applications
    • Vulnerabilities in platform technologies that are not unique to the online services in question (for example, Apache or IIS vulnerabilities) 
    • Vulnerabilities in third party sites redirected to during authentication 
    • Vulnerabilities in the operating system code not owned by Microsoft 
    • Vulnerabilities in the 3rd party integration code with the Microsoft Identity platform and brokers 
  • Reports from automated tools or scans
  • Training, documentation, samples, and community forum sites related to Identity products and services are not in scope for bounty awards unless otherwise listed in "In-Scope Domains and Endpoints"
  • Vulnerabilities in other Microsoft Products:
    • These submissions may be eligible for a bounty through another Bounty program. Please see our full list of Bounty Programs for other bounty eligible Microsoft products and services.
    • Issues resulting from misconfiguration or implementation of Authenticator libraries and brokers within other products will be awarded under the bounty programs for the products ingesting the applications.   
  • Limitation on Standards-based vulnerabilities
    • Any of the following criteria would exclude a standards based vulnerability from qualifying for bounty:
      • Standards with a status of draft, candidate release, or implementation draft. Issues with candidate, implementation, or draft standards should be reported directly to the standards body in question as part of the normal standards creation process.
      • In specifications not explicitly listed.
      • In non-certified implementations of Microsoft products and services.

IDENTITY RESEARCH RULES OF ENGAGEMENT

The Identity Bounty program’s scope is limited to technical vulnerabilities in Identity-related products and services listed in the scope section.  If you discover customer data while conducting your research, or are unclear if it is safe to proceed, please stop and contact us at bounty@microsoft.com. The following are not permitted:  

  • Gaining access to any data that is not wholly your own.   
    • For example, you are allowed and encouraged to create a small number of test accounts and/or trial tenants for the purpose of demonstrating and proving cross-account or cross-tenant data access. However, it is prohibited to use one of these accounts to access the data that is not your own.   
  • Moving beyond “proof of concept” repro steps for server-side execution issues  
    • For example, proving that you have sysadmin access with SQLi is acceptable, running xp_cmdshell is not.   
  • Any kind of Denial of Service testing.  
  • Performing automated testing of services that generates significant amounts of traffic.   
  • Attempting phishing or other social engineering attacks against others, including our employees. The scope of this program is limited to technical vulnerabilities in the specified Microsoft Online Services.   
  • Using our services in a way that violates the terms for that service.   

Even with these prohibitions, Microsoft reserves the right to respond to any actions on its networks that appear to be malicious.   

 

ADDITIONAL INFORMATION 

For additional information, please see our FAQ.  

  • If we receive multiple bug reports for the same issue from different parties, the bounty will be granted to the first submission. 
  • If a duplicate report provides us new information that was previously unknown to Microsoft, we may award a differential to the duplicate submission.  
  • If a submission is potentially eligible for multiple bounty programs, you will receive the single highest payout award from a single bounty program 
  • Microsoft reserves the right to reject any submission at our sole discretion that we determine does not meet these criteria. 

 

Thank you for participating in the Microsoft Bug Bounty Program! 

 

REVISION HISTORY

  • December 6, 2018: Revision history section added.
  • October 23, 2019: Revised reward model to include security impact, severity, and report quality. Revised bounty brief language to align with our other cloud programs.
  • January 16, 2020: Added link to Research Project Grant
  • February 24, 2022: Added clarification that vulnerabilities addressed via product documentation updates are out of scope.
  • June 09, 2023: Added Identity Graph APIs to in scope. Added B2C to scope with a product-specific awards table.
  • September 1, 2023: Added signup.live.com to in scope.
  • March 19, 2024: Added Authenticator Lite and Authenticator Broker apps to scope (iOS and Android)