Microsoft Launches Identity Bounty program That Rewards Up to $100,000

Microsoft launches Identity Bounty program that offers bug bounty hunters up to $100,000. For security researchers who discover a security vulnerability in the Identity services would payout between $500 to $100,000.

A Bug bounty program is also known as vulnerability rewards program (VRP) is the one where security researchers can disclose vulnerabilities and can receive recognition and compensation for reporting bugs. Bug bounty program is suitable for organizations of all sizes; it is a part of the organization’s penetration testing plan.

Microsoft said we have invested heavily in the security and privacy of both our consumer and enterprise identity solutions. For security researchers who find the vulnerability in the Identity services can report to Microsoft privately.

“Submissions for standards protocol or implementation bounties need to be with a fully ratified identity standard in the scope of this bounty and have discovered a security vulnerability with the protocol implemented in our certified products, services, or libraries.”

Scope Domains

login.windows.net
login.microsoftonline.com
login.live.com
account.live.com
account.windowsazure.com
account.activedirectory.windowsazure.com
credential.activedirectory.windowsazure.com
portal.office.com
passwordreset.microsoftonline.com
Microsoft Authenticator (iOS and Android applications)*

Eligible Submission – Identity Bounty program

• Identify an original and previously unreported critical or important vulnerability that reproduces in our Microsoft Identity services that are listed within scope.
• Identify an original and previously unreported vulnerability that results in the taking over of a Microsoft Account or Azure Active Directory Account.
• Identify an original and previously unreported vulnerability in listed OpenID standards or with the protocol implemented in our certified products, services, or libraries.
• Submit against any version of Microsoft Authenticator application, but bounty awards will only be paid if the bug reproduces against the latest, publicly available version.
• Include a description of the issue and concise reproducibility steps that are easily understood. (This allows submissions to be processed as quickly as possible and supports the highest payment for the type of vulnerability being reported.)
• Include the impact of the vulnerability.
• Include an attack vector if not obvious.

A high-quality report background information, a description of the bug, and a proof of concept would receive bounty Up to $100,000, Baseline Quality Submissions would receive bounty Up to $50,000 and for Incomplete Submissions, bounty starts from $500.

Also Read

Intel Expands Bug Bounty Program Rewards To $250,000 for Meltdown and Spectre Like Vulnerabilities

Bug Bounty Researchers Make More than 2.7 Times Salary of an Average Software Engineer

Facebook Launches Data Abuse Bounty Program With rewards Up to $40,000