Microsoft Zero Day Quest Research Challenge

As announced in the MSRC blog, Microsoft Zero Day Quest invites security researchers to discover and report high-impact vulnerabilities in Microsoft Azure, Microsoft Copilot, Microsoft Dynamics 365 and Power Platform, Microsoft Identity, and M365 Bounty Programs. Zero Day Quest provides new opportunities for the security community to work hand in hand with Microsoft engineers and security researchers to share, learn, and build community as we work to keep everyone safe.

This challenge has two distinct opportunities:

• A Research Challenge (open to everyone)
• A Live Hacking Event (invite only)

Full details about the Zero Day Quest Live Hacking Event can be found here.

The Research Challenge is open to everyone and runs from 12:00 AM Pacific Time, August 4, 2025, through 11:59 PM Pacific Time, October 4, 2025.

The Research Challenge will be subject to the terms of our bounty program, as outlined in the Microsoft Bounty Terms and Conditions and our bounty Safe Harbor policy, the applicable bounty program, and additional terms and conditions for the Research Challenge outlined below.

Bounty programs in scope:

• Microsoft Azure
• Microsoft Copilot
• Microsoft Dynamics 365 and Power Platform
• Microsoft Identity
• M365

First-time researchers are encouraged to review the MSRC Researcher Resource Center, as well as the definitions below surrounding eligible submissions, in-scope, and out-of-scope vulnerabilities before getting started. This information can be found in the respective bug bounty programs listed above.

Visit the MSRC Researcher Portal and follow the instructions to submit your reports.

Microsoft is not responsible for excess, lost, late, or incomplete submissions. If disputed, submissions will be deemed submitted by the “authorized account holder” of the email address used to enter. The “authorized account holder” is the natural person assigned to an email address by an internet or online service provider, or other organization responsible for assigning email addresses.

To maintain the security and integrity of our services, all participants in Microsoft's bounty programs must strictly adhere to the Microsoft Security Testing Rules of Engagement (ROE). These guidelines are crafted to enable security researchers to assess the security of Microsoft Online Assets effectively while ensuring that other customers and infrastructure remain unaffected. For comprehensive details about these rules, please consult the Microsoft ROE website.

If you accidentally access unauthorized data, stop immediately. Notify MSRC with the details, delete the data, and acknowledge this in any bug bounty report. Do not share the accessed information.

Engaging in the disruption, compromise, access, storage, or damage of data or property without explicit written consent from the owner, or adversely affecting Microsoft services for other users, is strictly prohibited and will result in disqualification. Specific prohibited activities include but are not limited to:

• Accessing customer or Microsoft data and testing customer systems without explicit permission: Any interaction with data or systems that you do not own or have explicit permission to access is prohibited. This includes accessing customer data, Microsoft data, or testing systems that belong to customers.
  • Examples: Extracting training data, model architectures, model weights, training code, customer documents, metadata, names, configuration files, system logs, or any other unauthorized data.
• Using credentials or other secrets that are not your own. This includes any credentials or secrets that you do not own, regardless of how they are obtained, including those that were leaked publicly.
• Interacting with storage accounts that are not part of your subscription or that you do not own.
• Performing denial-of-service testing.
• Executing network-intensive fuzzing or automated testing that generates excessive traffic.
• Conducting phishing or social engineering attacks targeting Microsoft employees or using Microsoft services to perform phishing or other social engineering attacks against others.

Please see the specific bounty program for additional details. Even with these restrictions in place, Microsoft retains the authority to respond to any actions conducted on its networks that are deemed malicious in nature.

Researchers who submit eligible submissions will receive bounty awards in the amounts specified in the terms of the relevant bounty program. Once submitted, your submission will be reviewed by the Microsoft Security Response Center to determine if they are eligible for a bounty award, based on the judgment criteria specified in the relevant bounty program.

Bounty awards will be awarded in accordance with the Microsoft Bounty Terms and Conditions.

Bounty multipliers for the categories below will be applied to valid issues that align with the existing Azure, Copilot, Dynamics 365 and Power Platform, Identity, or M365 Bounty Programs. These bonuses are effective only for the duration of the Research Challenge.

*If you submit a valid issue that is eligible for both multipliers, the High Impact Scenario multiplier will apply.

NOTE: Please refer to specific bounty program terms for eligible in-scope vulnerabilities and award amounts. These multipliers are valid only for the Research Challenge. Bounty awards will be awarded in accordance with the Microsoft Bounty Terms and Conditions.