Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
[This article is prerelease documentation and is subject to change.]
A Copilot Managed Runtime app is private to its owners until you share it. You can share an app in two fully revocable ways: directly with specific users or groups, or through a People in your organization share link that any member of your organization can redeem. You manage both sharing methods from the ms CLI.
Run the sharing commands from the directory that contains your app. Each command acts on that app automatically.
When a user has access, they can find and launch the app from the app portal at https://managedapps.cloud.microsoft/. For the end-user experience, see What are Copilot Managed Runtime apps (preview).
Access levels
When you share an app, choose one of two access levels:
| Access | What it grants |
|---|---|
| Play (default) | Run the app. This access level is right for end users. |
| Edit | Modify the app's source. This access level is for collaborators who develop the app with you. |
The two levels are independent, and granting or revoking one doesn't affect the other.
Grant access to users or groups
Use ms app share with a comma-separated list of email addresses or Microsoft Entra object IDs:
ms app share <principals> [--access play | edit]
For example, to let two coworkers run the app:
ms app share alok@contoso.com,maria@contoso.com
To grant edit access to a collaborator:
ms app share dev-team@contoso.com --access edit
The CLI automatically looks up email addresses. It reports any entry it can't resolve as a warning, and the command proceeds with the entries that it does resolve. If none resolve, the command fails.
Revoke access
Use ms app unshare to remove access:
ms app unshare <principals> [--access play | edit]
unshare only changes the access level you specify. For example, revoking edit leaves a user's play access intact:
ms app unshare dev-team@contoso.com --access edit
Removing a principal who has no access at the requested level is a no-op, and it doesn't fail.
Share an app with a link
A share link is a People in your organization link you can hand out instead of adding recipients one by one. Like a People in your organization link in SharePoint and OneDrive, it's a transferable, revocable key that only members of your organization can use. The first time a member opens the link, they sign in if they aren't already, and they're granted access to run the app. Guests and other people outside your organization can't use the link. Share links are revocable, so you can cut off access later without tracking down individual users.
Create a link
Use ms app share link create to generate a People in your organization share link for the current app:
ms app share link create
The command returns a short link ID, the share URL, and the access it grants. Distribute the URL to your recipients.
List existing links
Use ms app share link list to view all active share links for the current app:
ms app share link list
Revoke a link
Use ms app share link revoke to remove the access of everyone who redeemed a link, and then delete the link:
ms app share link revoke --link-id <id>
--link-id <id>: The link ID returned when you created the link. Required.--force: Skips the confirmation prompt.
Tip
Use direct sharing for a known set of users, and a share link when you want to broadcast an app, for example by posting it to a team channel, while retaining the ability to revoke access for everyone at once.