This is the Trace Id: 4e8120c9376b67c92c626c21d130009d
Skip to main content
MSRC

Microsoft Bug Bounty Program

Microsoft strongly believes close partnerships with the global security researcher community make customers more secure. Security researchers play an integral role in the ecosystem by discovering vulnerabilities missed in the software development process and sharing them under Coordinated Vulnerability Disclosure (CVD). Each year we partner together to better protect billions of customers worldwide.

If you are a security researcher that has found a vulnerability in a Microsoft product, service, or device we want to hear from you. If your vulnerability report affects a product or service that is within scope of one of our bounty programs below, you may receive a bounty award according to the program descriptions. Even if it is not covered under an existing bounty program, we will publicly acknowledge your contributions when we fix the vulnerability. All vulnerability submissions are counted in our Researcher Recognition Program and Researcher Leaderboard, even if they do not qualify for bounty award. 

Click here to submit a security vulnerability

The Microsoft Bug Bounty Programs are subject to the legal terms and conditions outlined here, and our bounty Safe Harbor policy.  

Let the hunt begin! 

Each bug bounty program has its own scope, eligibility criteria, award range, and submission guidelines to help researchers pursue impactful research without causing unintended harm, though they generally share the same high level requirements:

Research
Vulnerabilities
data, privacy, service availability
vul disclosure

Cloud Programs

Program Name Eligible entries Bounty Range
Microsoft Azure

Vulnerability reports on Microsoft Azure cloud services 

Up to $60,000 USD

Microsoft Identity

Vulnerability reports on Identity services, including Microsoft Account, Azure Active Directory, or select OpenID standards.

Up to $100,000 USD

Xbox

Vulnerability reports on the Xbox Live network and services

Up to $20,000 USD

M365

Vulnerability reports on applicable Microsoft cloud services, including Office 365

Up to $20,000 USD

Microsoft Azure DevOps Services

Vulnerability reports on applicable Microsoft Azure DevOps Services

Up to $20,000 USD

Microsoft Dynamics 365 and Power Platform

Vulnerability reports on applicable Microsoft Dynamics 365 and Power Platform applications

Up to $20,000 USD

Microsoft .NET

Vulnerability reports on .NET Core and ASP.NET Core RTM and future builds (see link for program details)

Up to $15,000 USD

Microsoft AI

Vulnerability reports on the Copilot AI experiences

Up to $15,000 USD

Microsoft Defender

Vulnerability reports on Microsoft Defender for Endpoint APIs

Up to $20,000 USD

Platform Programs

Program Name Eligible Entries Bounty Range
Microsoft Hyper-V

Critical remote code execution, information disclosure and denial of services vulnerabilities in Hyper-V

Up to $250,000 USD

Microsoft Windows Insider Preview

Critical and important vulnerabilities in Windows Insider Preview

Up to $100,000 USD

Microsoft Applications and On-Premises Servers

Critical and important vulnerabilities in Microsoft Applications and On-Premises Servers

Up to $30,000 USD

Windows Defender Application Guard

Critical vulnerabilities in Windows Defender Application Guard

Up to $30,000 USD

Microsoft Edge (Chromium-based)

Critical, important, and moderate vulnerabilities in Microsoft Edge (Chromium-based) Dev, Beta, and Stable channels

Up to $30,000 USD

Microsoft 365 Insider

Vulnerabilities on Microsoft 365 Insider

Up to $15,000 USD

Defense & Grant Programs

Program Name Eligible Entries Bounty Range
Mitigation Bypass and Bounty for Defense

Novel exploitation techniques against protections built into the latest version of the Windows operating system. Additionally, defensive ideas that accompany a Mitigation Bypass submission.

Up to $100,000 USD (plus up to an additional $100,000)

Grant: Microsoft Identity

This project grant awards up to $75,000 USD for approved research proposals that improve the security of the Microsoft Identity solutions in new ways for both Consumers (Microsoft Account) and Enterprise (Azure Active Directory).

Up to $75,000 USD

SIKE Cryptographic Challenge

This challenge awards up to $50,000 USD for solutions that break the SIKE algorithm for two sets of toy parameters.

Up to $50,000 USD

Additional resources for security researchers

Out of Bounty Scope

Some submission types are generally not eligible for Microsoft bounty awards. Please refer to our bounty programs for additional information on eligible submission, vulnerability, or attack methods.

Tool output
Social engineering