Microsoft Azure Bounty Program

 *50% increase in High Impact Scenarios and eligible security impacts for Zero Day Quest event. 

N/A: vulnerabilities resulting in the listed security impact do not qualify for this severity category. 

Sample high- and low-quality reports are available here. 

IN SCOPE VULNERABILITIES

The following are examples of vulnerabilities that may lead to one or more of the above security impacts:  

• Cross site scripting (XSS)  
• Cross site request forgery (CSRF)  
• Cross-tenant data tampering or access  
• Insecure direct object references  
• Insecure deserialization  
• Injection vulnerabilities  
• Server-side code execution  
• Significant security misconfiguration (when not caused by user)  
• Using components with known vulnerabilities 
  • Requires full proof of concept (PoC) of exploitability. For example, simply identifying an out-of-date library would not qualify for an award.

AZURE RESEARCH RULES OF ENGAGEMENT

The Azure Bounty program’s scope is limited to technical vulnerabilities in Azure-related products and services. If you discover customer data while conducting your research, or are unclear if it is safe to proceed, please stop and contact us at [email protected]. The following are not permitted: 

• Gaining access to any data that is not wholly your own.  
  • For example, you are allowed and encouraged to create a small number of test accounts and/or trial tenants for the purpose of demonstrating and proving cross-account or cross-tenant data access. However, it is prohibited to use one of these accounts to access the data that is not your own.  
• Moving beyond “proof of concept” repro steps for server-side execution issues 
  • For example, proving that you have sysadmin access with SQLi is acceptable, running xp_cmdshell is not).  
• Any kind of Denial of Service testing. 
• Performing automated testing of services that generates significant amounts of traffic.  
• Attempting phishing or other social engineering attacks against others, including our employees. The scope of this program is limited to technical vulnerabilities in the specified Microsoft Online Services.  
• Using our services in a way that violates the terms for that service.  

Even with these prohibitions, Microsoft reserves the right to respond to any actions on its networks that appear to be malicious.  

OUT OF SCOPE SUBMISSIONS AND VULNERABILITIES

Microsoft is happy to receive and review every submission on a case-by-case basis, but some submission and vulnerability types may not qualify for bounty reward. Here are some of the common low-severity or out of scope issues that typically do not earn bounty rewards:  

• Publicly-disclosed vulnerabilities which have already been reported to Microsoft or are already known to the wider security community
• Vulnerability patterns or categories for which Microsoft is actively investigating broad mitigations. As of March 2022, for example, these include, without limitation
  • Vulnerabilities that rely on VSCode extensions
  • Vulnerabilities that rely on Swagger API
  • Dependency Confusion issues
  • Vulnerabilities that rely on Akamai ARL misconfiguration
  • Vulnerabilities found in Azure Defender for IoT
  • Vulnerabilities found in Azure Site Recovery
• Out of scope vulnerability types, including:
  • Vulnerabilities requiring physical access to hardware components
  • URL Redirects (unless combined with another vulnerability to produce a more severe vulnerability)
  • Cookie replay vulnerabilities 
  • Sub-Domain Takeovers 
  • Denial of Service issues
  • Low impact CSRF bugs (such as logoff) 
  • Server-side information disclosure such as IPs, server names and most stack traces 
• Vulnerabilities that are addressed via product documentation updates, without change to product code or function.
• Vulnerabilities requiring preconditions such as running malware, access to local network or devices, or man-in-the-middle attacks.
• Vulnerabilities based on user configuration or action, for example: 
  • Vulnerabilities requiring extensive or unlikely user actions 
  • Vulnerabilities in user-created content or applications. 
  • Security misconfiguration of a service by a user, such as the enabling of HTTP access on a storage account to allow for man-in-the-middle (MiTM) attacks 
  • Missing HTTP Security Headers (such as X-FRAME-OPTIONS) or cookie security flags (such as “httponly”) 
  • Vulnerabilities used to enumerate or confirm the existence of users or tenants 
• Vulnerabilities based on third parties, for example: 
  • Vulnerabilities in third party software provided by Azure such as gallery images and ISV applications 
  • Vulnerabilities in platform technologies that are not unique to the online services in question (for example, Apache or IIS vulnerabilities) 
• Vulnerabilities in a web application that only affect unsupported browsers and plugins
• Training, documentation, samples, and community forum sites related to Azure products and services are not in scope for bounty awards unless otherwise listed in "In-Scope Domains and Endpoints," for example:
  • azure.microsoft.com/en-us/services
  • docs.microsoft.com/en-us/azure
  • docs.microsoft.com/en-us/azure/*
  • docs.microsoft.com/en-us/cli/azure/*
  • github.com/Azure-Samples/
  • github.com/microsoft/iot-samples
  • azure.microsoft.com/en-us/resources/samples
  • feedback.azure.com/forums/*
• Vulnerabilities found in Microsoft Partner portals, including partner.microsoft.com or aipartner.microsoft.com.
• Vulnerabilities found in Azure RTOS.
• Vulnerabilities found in Azure App Center.
• Vulnerabilities found in SQL.
• Vulnerabilities found in OMI or open-source components, libraries, or repositories.
• Vulnerabilities in Azure products that only impact the Windows local machine and not the cloud Azure services are not eligible for Azure bounty.
• Vulnerabilities on Windows client components hosted in Azure Virtual Machine are not eligible for Azure bounty.

We reserve the right to reject any submission that we determine, in our sole discretion, falls into any of these categories of vulnerabilities even if otherwise eligible for a bounty. 

ADDITIONAL INFORMATION

For additional information, please see our FAQ. 

• If we receive multiple bug reports for the same issue from different parties, the bounty will be granted to the first submission.
• If a duplicate report provides us new information that was previously unknown to Microsoft, we may award a differential to the duplicate submission. 
• If a submission is potentially eligible for multiple bounty programs, you will receive the single highest payout award from a single bounty program
• Microsoft reserves the right to reject any submission at our sole discretion that we determine does not meet these criteria.

REVISION HISTORY

• September 2014: Program launched.  
• August 2015: Program scope updated and bounty program name changed from Online Services to Cloud bounty program.  
• July 17, 2018: identity related vulnerabilities moved into the Microsoft Identity Bounty Program.
• January 17, 2019: Updated award ranges based on impact, severity, and report quality. Added in-scope summary.  
• June 17, 2019: Azure bounty program separated from the Online Services Bounty Program Training, documentation, sample, and community sites moved out of scope. Updated pentesting guidance. 
• January 21, 2020: Removed all listed endpoints. Services listed under https://azure.microsoft.com/en-us/services are in scope for bounty rewards under this program or related Microsoft Bounty programs. 
• May 5, 2020: Moved Azure Security Lab content to a stand-alone program page. Standardized bounty program language. 
• August 24, 2020: Added to out of scope – vulnerabilities that rely on VSCode extensions. 
• August 27, 2020: Added guidance to Additional Information section.  
• January 28, 2021: Added to out of scope – vulnerabilities that rely on Swagger API.  
• April 20, 2021: Added to out of scope – confusion dependency issues. 
• August 26, 2021: Added to out of scope – vulnerabilities that rely on Akamai ARL misconfiguration. 
• September 14, 2021: Added to out of scope – vulnerabilities in Microsoft Partner portals, including partner.microsoft.com or aipartner.microsoft.com.  
• October 6, 2021: Added to out of scope – vulnerabilities found in Azure Defender for IoT.
• October 18, 2021: Added High Impact Scenarios Awards.
• December 20, 2021: Added dependency confusion clarification to both In Scope and Out of Scope sections.
• February 24, 2022: Added clarification that vulnerabilities addressed via product documentation updates are out of scope.
• March 14, 2022: Added to out of scope - dependency confusion issues.
• April 28, 2022: Added to out of scope - vulnerabilities found in Azure Site Recovery. 
• August 22, 2022: Added to out of scope – vulnerabilities found in Azure RTOS GUIX Studio.
• November 18, 2022:  Added clarification that vulnerabilities found in Azure RTOS GUIX Studio and Library are out of scope.
• April 5, 2023: Removed Azure Synapse from High Impact Scenarios.
• August 16, 2023: Added to out of scope – vulnerabilities found in Azure RTOS.
• August 25, 2023: Added to out of scope – vulnerabilities found in Azure App Center.
• December 19, 2023: Added to out of scope – vulnerabilities found in SQL.
• December 20, 2023: Confirmed out of scope - vulnerabilities in OMI or open-source components.
• August 5, 2024: Clarified open-source out of scope exclusion.
• August 29, 2024: Clarified out of scope for vulnerabilities requiring preconditions such as running malware, access to local network or devices, or man-in-the-middle attacks.
• October 1, 2024: Added out of scope for vulnerabilities in Azure products that only impact the Windows local machine and vulnerabliites in Windows client components hosted in Azure Virtual Machine. 
• November 19, 2024: Added temporary Zero Day Quest Award Multipliers for eligible security impacts and high impact scenarios.