Lovable AI Apps Deploy to Microsoft Entra: Copilot Managed Runtime Governance and Licensing

Lovable, a natural-language application builder that says users have created more than 70 million projects on its platform, is partnering with Microsoft to bridge that gap between a quick prototype and an enterprise-governed deployment. Following Lovable's initial partnership announcement on September 28, 2026, and subsequent coverage by EdTech Innovation Hub, the integration lets creators package AI-built applications with Microsoft’s Copilot Managed Runtime software development kit (SDK) and publish them directly into an organization’s Microsoft Entra tenant. While data connectors for Microsoft 365 and Microsoft Fabric alongside Microsoft Entra ID app sign-in are already live across all Lovable plans, direct deployment through Copilot Managed Runtime is now rolling out in public preview.

For Windows administrators, Power Platform leads, and enterprise architects, the announcement is worth dissecting not just for what Lovable claims on the front end, but for how Microsoft’s underlying Copilot Managed Runtime actually governs, audits, and bills these applications behind the scenes.

How the Lovable and Microsoft Integration Works​

The premise of the partnership is straightforward: let non-developers or rapid-prototyping teams build software using written instructions in Lovable, while ensuring the finished product lands inside the corporate Microsoft boundary rather than living on an unmanaged third-party island.

According to Lovable’s announcement, the integration connects to an organization's Microsoft stack through three distinct pillars:

• Tenant Deployment via Copilot Managed Runtime: Once an application is built, the creator connects Copilot Managed Runtime and publishes it. Lovable packages the app using Microsoft’s Copilot Managed Runtime SDK and deploys it into the company’s Microsoft Entra tenant.
• Microsoft Entra ID Authentication: Employees open the published application using their existing work credentials. App creators can designate who is allowed to access the tool, while authentication is handled by Microsoft Entra ID.
• Direct Data Connectivity: Applications can read from and write changes back to Microsoft 365 services—specifically Outlook, Teams, Excel, SharePoint, OneDrive, Word, PowerPoint, and OneNote. For heavier analytics and line-of-business systems, apps can read lakehouses and warehouses in Microsoft Fabric, and both read and write data in Dataverse and SQL, bringing Microsoft Dynamics environments into reach.

Lan Roche, Head of Global Partnerships at Lovable, stated in the company's announcement that because the integration was built on Microsoft's Copilot Managed Runtime SDK, an application created with Lovable arrives in the tenant with the same sign-in, policies, and application inventory as other Microsoft apps. Lovable also notes that the generated output remains standard source code that engineering teams can inspect and modify.

Beyond the browser editor, Lovable says its Model Context Protocol (MCP) server is listed in Microsoft’s MCP Center, enabling teams to build, revise, and deploy Lovable applications from within AI workflows without opening the Lovable editor. The company also provides a Windows desktop application and is listed on the Microsoft Marketplace, where organizations that procure software through Microsoft can discuss private offers.

Summary: The Core Integration​

• What is live now: Microsoft 365 connectors, Microsoft Fabric access, and Microsoft Entra ID sign-in for built applications are available across all Lovable plans.
• What requires upper-tier plans: Signing into the Lovable workspace itself via Microsoft Entra ID requires a Lovable Business or Enterprise plan, which also bundle single sign-on (SSO), automated user provisioning (SCIM), security scanning, and audit logs.
• What is in preview: Packaging and deploying apps into a customer tenant via Microsoft’s Copilot Managed Runtime is rolling out in public preview.

Real-World Scenarios vs. Enterprise Reality​

To illustrate why teams are connecting AI-generated tools to live corporate data, Lovable points to several practical workflows in its announcement. In one illustrative scenario, a finance department builds an application that scans an Outlook inbox for supplier statements, cross-references those documents against enterprise resource planning (ERP) records, and flags unpaid invoices for accounts-payable staff logging in with their work accounts. Lovable also reports that teams are using OneDrive documents to track construction tasks and costs from mobile devices, converting aging Excel spreadsheets into interactive tools that write updates back to the source file, and generating reports on live Microsoft Fabric data without writing SQL queries.

Lovable states that its Microsoft 365 and Fabric connections operate without exporting or copying the underlying corporate data. From an architectural standpoint, however, seasoned administrators know that "no data is copied by the connector" is only half the compliance story. When an application has read-and-write permissions to SharePoint, Dataverse, or an SQL database, the business logic inside that application dictates what happens to the records. If an AI-generated tool has a flawed update loop, it can corrupt production rows just as efficiently via an authorized API call as a human with a bad macro.

That brings us to the real meat of this announcement for IT pros: what does Microsoft’s Copilot Managed Runtime actually enforce when an app arrives in your tenant?

Under the Hood: What Admins Get in Copilot Managed Runtime​

In Microsoft Learn’s prerelease documentation for Copilot Managed Runtime, Microsoft positions the runtime as a hosted environment for internal line-of-business applications that enforces organizational governance policies from the moment an app is created. Because Copilot Managed Runtime itself is currently a preview feature subject to supplemental terms and potential changes, administrators should understand the exact control surfaces Microsoft provides.

According to Microsoft Learn, Copilot Managed Runtime splits administrative oversight across two familiar portals:

1. Microsoft 365 admin center (MAC): Acts as the primary governance surface. Under Apps > All apps, Global Administrators and Power Platform Administrators get a centralized inventory of every Copilot Managed Runtime app in the tenant (with read-only visibility available to AI Administrators, AI Readers, and Global Readers). Created, updated, or deleted apps surface in this table within 15 minutes.
2. Power Platform admin center (PPAC): Handles environment-level security settings, environment groups, and Advanced Connector Policies (ACP). Crucially, Microsoft Learn specifies that the environment where Copilot Managed Runtime apps are deployed must be a Managed Environment.

Notice an important boundary here: Microsoft Learn notes that the All apps inventory in the Microsoft 365 admin center always displays Copilot Managed Runtime apps (alongside a separate tab for Integrated apps), whereas traditional Canvas, Model-Driven, Code, and Vibe apps remain governed separately in the Power Platform admin center.

There is one major auditing caveat that security teams should highlight in their runbooks. While Microsoft Purview logs structured and API-level events for app launches (LaunchPowerApp), deletions (DeletePowerApp), builds, and deployments in the PowerPlatformAdminActivity table, Microsoft Learn explicitly states that Git pushes and code changes are not audited in Purview. If your compliance posture requires line-by-line source-code change tracking, you will need to rely on repository-level controls—such as GitHub Enterprise Cloud branch policies and pull request reviews—or the audit logs within your third-party builder’s enterprise tier, rather than expecting Purview to track code commits.

Summary: Governance Capabilities and Limits​

• Automatic guardrails: Apps deployed to Copilot Managed Runtime inherit Microsoft Entra authentication, Conditional Access, DLP, Advanced Connector Policies, and per-app Content Security Policy headers.
• Group-level sharing: Administrators restrict how broadly makers can share runtime apps at the environment group level, not on an individual app-by-app basis.
• Purview blind spot: Microsoft Purview tracks when a runtime app is created, built, deployed, launched, or deleted, but does not log Git pushes or source-code modifications.

The Licensing and Copilot Credit Catch Nobody Mentions in the Brochure​

Here is the practical reality check that rarely makes it into partnership press releases: just because an employee can sign in with Microsoft Entra ID and receives a share link to a Copilot Managed Runtime application does not mean they are licensed to run it.

According to Microsoft Learn’s Copilot Managed Runtime licensing FAQ (preview), running an application hosted on Copilot Managed Runtime requires specific end-user entitlements, and runtime usage is billed separately from app-building costs:

1. What end users need to run an app: Every user who opens and runs a Copilot Managed Runtime app must have either a Power Apps Premium license or Copilot Credits allocated to them.
2. Standard Microsoft 365 and Copilot licenses don't cover runtime: Microsoft Learn explicitly states that Power Apps use rights bundled with standard Microsoft 365 or Dynamics 365 licenses do not grant access to apps hosted on Copilot Managed Runtime, regardless of which connectors the app uses. Furthermore, a standalone Microsoft 365 Copilot license is not required to run an app, nor does it substitute for Power Apps Premium or Copilot Credits.
3. How Copilot Credits are metered: If a user does not hold a Power Apps Premium license, runtime consumption is metered in API calls. Launching an app, reading or writing records through a connector, and publishing an app all count as API calls. Under Microsoft’s current preview terms, each API call consumes 0.1 Copilot Credits (specialized services like Work IQ APIs are billed separately at their own rates). Users with a Power Apps Premium license do not consume Copilot Credits for standard app runs, as their activity counts toward their daily Power Platform request limits.
4. The 20-operation / 5-minute cutoff: During the public preview, if an unlicensed user without sufficient Copilot Credits launches an app, they initially receive a warning and can test it briefly. However, Microsoft Learn notes that access is automatically blocked once the user completes 20 app operations or uses the app for five minutes, whichever happens first.

For administrators who want to let employees run these apps using pooled Copilot Credits rather than buying everyone a Power Apps Premium seat, you must first go into the Microsoft 365 admin center under Copilot > Cost management, enable usage-based billing for Copilot Credits, and create a spending policy for managed applications that covers the target users or groups.

Actionable Checklist for Tenant Administrators​

Before your department leads start connecting Lovable workspaces and publishing AI-generated tools into your company tenant, run through these administrative checks:

1. Verify App Creation Path Defaults: According to Microsoft Learn, Copilot Managed Runtime is automatically available to eligible commercial cloud tenants, and Copilot Studio app creation is turned on by default, whereas CLI app creation is off by default. Check your settings in the Microsoft 365 admin center under Apps > Overview > Set up app creation spaces.
2. Scope or Disable Preview Creation Paths if Needed: If your governance board wants to pause or restrict internal runtime app creation while you evaluate the preview, you can restrict creation to specific Microsoft Entra security groups or turn the Copilot Studio path off using the Microsoft Power Platform CLI:
   pac admin update-tenant-settings --setting-name powerPlatform.powerapps.enableManagedAppsMcsPreview --setting-value 'off'
   To scope access to specific security groups instead, pass a comma-separated list of Entra security group object IDs (GUIDs) to powerPlatform.powerapps.enabledGroupsManagedAppsMcsPreview.
3. Check External Artifact Controls: In Microsoft Learn’s source and deployment documentation, the External artifacts in managed apps setting—which governs whether developers can deploy prebuilt artifacts produced outside the Microsoft-managed build system—is disabled by default and can be configured per environment or environment group. Verify how your environment groups are configured before onboarding third-party build pipelines.
4. Set Up Environment Group Sharing Rules: Navigate to Settings > App settings in the Microsoft 365 admin center and configure the Copilot Managed Runtime sharing rule on your environment groups so early testers cannot inadvertently share a prototype with the entire directory.
5. Align Licensing Before Rollout: Decide early whether your target department users will be covered by Power Apps Premium licenses or a managed-application Copilot Credit spending policy in the Microsoft 365 admin center so their workflow doesn't halt five minutes into Monday morning.

Giving business teams a way to bring natural-language apps out of the shadows and into Microsoft Entra ID and the Microsoft 365 admin center is a welcome step forward for enterprise governance. Just make sure your DLP rules, environment group sharing limits, and Copilot Credit budgets are waiting for them when they arrive.