The biggest multiplier lands on cross-tenant bugs
Microsoft rewrote the award structure on its Dynamics 365 and Power Platform bounty page on September 14, and the page's own revision history names the cross tenant High Impact Scenario as the thing that changed. Awards run from $1,250 up to $60,000, with higher amounts at Microsoft's discretion. The largest multiplier on the schedule, plus 100%, goes to critical-severity cross-tenant vulnerabilities. Find a way out of one tenant and into another, and Microsoft pays double.
The other High Impact Scenarios fill in the picture. Important-severity cross-tenant findings carry plus 50%. Power Platform escalation of privileges in Dataverse carries plus 20%, and so does a Dataverse Plugin Sandbox escape. The AI Bounty Award category runs on its own numbers, paying up to $30,000 for critical severity and up to $20,000 for important severity.
A bounty schedule sets prices, and prices say which bugs a vendor most wants reported before somebody less friendly finds them. Read the published award page that way and it becomes a public statement about what Microsoft considers most dangerous inside its own platform. For an admin or an architect, that is more useful than any security marketing page.
Tenant isolation is the assumption everything else rests on
Every control a Power Platform admin configures sits on top of one assumption that nobody writes down. Your environment belongs to your tenant, and nothing running in a stranger's tenant can reach it. Security roles, business units, column-level security and data loss prevention policies all describe who inside your own organization can see what. None of them say anything about the customer running on the same infrastructure.
That assumption holds because the platform enforces it, not because of anything you set up. So a cross-tenant flaw fails differently from an ordinary permission bug. A misconfigured security role exposes records to the wrong colleague, and you can find that in a report and fix it in an afternoon. A cross-tenant break exposes them to somebody who never signed your contract and never appeared in your audit log, and there is no compensating control on your side, because the boundary was never yours to configure.
Paying double for those findings tells the market where Microsoft thinks the worst outcome lives. The isolation boundary is the one part of a shared platform deal that no customer gets to renegotiate in a contract.
Dataverse gets named twice in its own right
Two of the High Impact Scenarios point straight at Dataverse. One is escalation of privileges in Dataverse. The other is escape from the Dataverse Plugin Sandbox. Both sit at plus 20%, well below the cross-tenant multipliers, and both appear on a page that could have stopped at the platform level and left it there.
The sandbox exists so that custom code registered against a table runs with limits on what it can reach. Plugins are where a developer's code and Microsoft's runtime meet, and a lot of business logic in the average Dataverse estate lives in exactly that spot. Anyone who has inherited an environment also knows the plugin registration list is where the least documented code accumulates. A working definition of Dataverse starts with that boundary and what it promises.
Escalation of privileges is the other half of the same story. Security roles decide who reads, writes and deletes, and an escalation bug means a principal with narrow permissions ends up holding broad ones. That costs more in environments where wide roles were handed out to keep a project moving, which covers plenty of production tenants.
A funded bounty programme is a good sign
None of this means the platform is unsafe. A vendor that publishes a specific price list and keeps revising it is in better shape than one that pays nothing and hears about findings from a breach notification. The September change moved the cross-tenant scenario up, which reads as Microsoft raising the reward for the research it wants most.
The in-scope list covers Power Apps, Power Automate, Microsoft Copilot Studio, Power Pages, AI Builder and Dataverse. Agent-building surfaces sit on the same page as everything else rather than in a category of their own, which is a sensible place for them. Governance that keeps makers building has to cover that surface now too.
On-premises Dynamics is still on the list
The scope also carries on-premises Dynamics CRM, GP, NAV and SL. That is a quiet piece of information about the installed base. Microsoft does not pay bounties on software nobody runs, and finance teams are still running GP and NAV on servers that somebody in the building has to patch.
If one of those sits in a corner of your estate, its presence on a 2026 bounty page is a reminder that researchers are still looking at it. That corner tends to hold the oldest integrations and the widest service accounts. Ordering a patch bulletin when everything on it says critical is harder there, and usually more overdue.
What to check in your own environment this week
Start with plugin registration in each production environment. List every registered plugin and custom workflow activity, record which ones run in sandbox isolation, and put a named owner against each one. Anything nobody can explain, and anything registered by a developer who left two projects ago, goes on a review list this week.
Then pull the security roles that grant broad Dataverse privileges and look at who holds them. Application users and service principals matter most, because they rarely show up in a joiners and leavers review and they often carry System Administrator because that was the quickest route to a working integration. A principal with narrow privileges is a smaller prize for anyone who finds an escalation bug. Getting the environment count right makes both checks shorter, because it limits how many places you have to look.
Microsoft has now put a number on its own worst case and then doubled it. The cheapest answer on your side is being able to name, without opening a ticket, every piece of custom code running against your Dataverse tables and every account that could already do anything it likes with them.
