This is the Trace Id: 99cc00ff9ca0cd0198bbed391768b9bd
Skip to main content
MSRC

Microsoft Bug Bounty Program

Microsoft strongly believes close partnerships with the global security researcher community make customers more secure. Security researchers play an integral role in the ecosystem by discovering vulnerabilities missed in the software development process and sharing them under Coordinated Vulnerability Disclosure (CVD). Each year we partner together to better protect billions of customers worldwide.

If you are a security researcher that has found a vulnerability in a Microsoft product, service, or device we want to hear from you. If your vulnerability report affects a product or service that is within scope of one of our bounty programs below, you may receive a bounty award according to the program descriptions. Even if it is not covered under an existing bounty program, we will publicly acknowledge your contributions when we fix the vulnerability. All vulnerability submissions are counted in our Researcher Recognition Program and Researcher Leaderboard, even if they do not qualify for bounty award. 

Click here to submit a security vulnerability

The Microsoft Bug Bounty Programs are subject to the legal terms and conditions outlined here, and our bounty Safe Harbor policy.  

Let the hunt begin! 

Each bug bounty program has its own scope, eligibility criteria, award range, and submission guidelines to help researchers pursue impactful research without causing unintended harm, though they generally share the same high level requirements:

Research
Vulnerabilities
data, privacy, service availability
vul disclosure

 

Is this your first time reporting to the MSRC? Want to learn more about our case process? Visit our MSRC Researcher Resource Center to watch the Researcher Onboarding Video to learn about the Rules of Engagement, case process, available rewards through the Bounty Program, recognition points and leaderboards, and our disclosure process.

 

Zero Day Quest

 

As announced in the MSRC Blog, Securing AI and cloud with the Microsoft Zero Day Quest, the Microsoft Zero Day Quest invites security researchers to discover and report high-impact vulnerabilities in Microsoft AI and Cloud Bounty Programs: Microsoft AzureMicrosoft IdentityM365, and Microsoft Dynamics 365 and Power Platform. To learn more, visit the Zero Day Quest page!

Cloud Programs

Program Name Eligible entries Bounty Range
Microsoft Azure
Vulnerability reports on Microsoft Azure cloud services 
Up to $80,000 USD
Microsoft Identity
Vulnerability reports on Identity services, including Microsoft Account, Azure Active Directory, or select OpenID standards.
Up to $150,000 USD
Xbox
Vulnerability reports on the Xbox Live network and services
Up to $20,000 USD
M365
Vulnerability reports on applicable Microsoft cloud services, including Office 365
Up to $27,000 USD
Microsoft Azure DevOps Services
Vulnerability reports on applicable Microsoft Azure DevOps Services
Up to $20,000 USD
Microsoft Dynamics 365 and Power Platform
Vulnerability reports on applicable Microsoft Dynamics 365 and Power Platform applications
Up to $30,000 USD
Microsoft .NET
Vulnerability reports on .NET Core and ASP.NET Core RTM and future builds (see link for program details)
Up to $15,000 USD
Microsoft AI
Vulnerability reports on the Copilot AI experiences
Up to $30,000 USD
Microsoft Defender
Vulnerability reports on Microsoft Defender for Endpoint APIs
Up to $20,000 USD

Platform Programs

Program Name Eligible Entries Bounty Range
Microsoft Hyper-V
Critical remote code execution, information disclosure and denial of services vulnerabilities in Hyper-V
Up to $250,000 USD
Microsoft Windows Insider Preview
Critical and important vulnerabilities in Windows Insider Preview
Up to $100,000 USD
Microsoft Applications and On-Premises Servers
Critical and important vulnerabilities in Microsoft Applications and On-Premises Servers
Up to $30,000 USD
Windows Defender Application Guard
Critical vulnerabilities in Windows Defender Application Guard
Up to $30,000 USD
Microsoft Edge (Chromium-based)
Critical, important, and moderate vulnerabilities in Microsoft Edge (Chromium-based) Dev, Beta, and Stable channels
Up to $30,000 USD
Microsoft 365 Insider
Vulnerabilities on Microsoft 365 Insider
Up to $15,000 USD

Defense & Grant Programs & Challenges

Program Name Eligible Entries Bounty Range
Mitigation Bypass and Bounty for Defense
Novel exploitation techniques against protections built into the latest version of the Windows operating system. Additionally, defensive ideas that accompany a Mitigation Bypass submission.
Up to $100,000 USD (plus up to an additional $100,000)
Grant: Microsoft Identity
This project grant awards up to $75,000 USD for approved research proposals that improve the security of the Microsoft Identity solutions in new ways for both Consumers (Microsoft Account) and Enterprise (Azure Active Directory).
Up to $75,000 USD
SIKE Cryptographic Challenge
This challenge awards up to $50,000 USD for solutions that break the SIKE algorithm for two sets of toy parameters.
Up to $50,000 USD
LLMail-Inject
This challenge has a $10,000 USD award pool for the top teams participating in the new challenge focused on evaluating state-of-the-art prompt injection defenses in a realistic simulated LLM-integrated email client.
Up to $10,000 USD award pool

Additional resources for security researchers

Out of Bounty Scope

Some submission types are generally not eligible for Microsoft bounty awards. Please refer to our bounty programs for additional information on eligible submission, vulnerability, or attack methods.

Tool output
Social engineering