Copilot Managed Runtime overview and key concepts for admins (preview)

[This article is prerelease documentation and is subject to change.]

Copilot Managed Runtime helps teams build internal line-of-business apps that automatically comply with your organization's IT governance policies. Every app is governed from the moment you create it - no extra setup required. Each app appears in the Microsoft 365 admin center, where admins can track usage, monitor health, and manage its lifecycle.

Important

  • This is a preview feature.
  • These features are subject to supplemental terms of use, and are available before an official release so that customers can get early access and provide feedback.

Copilot Managed Runtime brings three audiences together around the same governed app:

  • Users discover and run apps from a web portal.
  • Makers and developers build apps using tools and languages they already know.
  • Administrators govern apps across the tenant.

To learn how people create apps across Cowork, Copilot Studio, and the CLI, see What is Copilot Managed Runtime (preview).

Key features

  • Microsoft Entra authentication and authorization out of the box
  • Access to 1,500+ connectors, callable directly from JavaScript and TypeScript
  • A native Git inner loop with a repository for source control and collaboration
  • Automatic adherence to your IT policies, including sharing limits, conditional access, advanced connector policies, and data loss prevention (DLP)
  • Centralized inventory, usage analytics, and operational health in the Microsoft 365 admin center

Common scenarios

Copilot Managed Runtime fits scenarios where teams need flexibility while staying within enterprise governance boundaries:

  • Personal productivity apps. Tools an individual builds and uses in their own developer environment.
  • Team productivity apps. Shared apps that small teams use to automate workflows and collaborate.
  • Organizational apps. Broader solutions that IT or development teams deploy across the tenant with admin-controlled distribution.

Key concepts

To work more effectively with Copilot Managed Runtime, it's important to understand the following key concepts:

Term Description
Copilot Managed Runtime SDK The developer libraries and tooling used to build apps with Copilot Managed Runtime. Provides built-in Microsoft Entra authentication, connectivity to more than 1,500 data sources, and enforcement hooks for governance policies.
Personal developer environment A dedicated, isolated sandbox provisioned for each developer, separate from production, so they can build and test safely.
Governance policies Rules that control how apps built with Copilot Managed Runtime are deployed, who can access them, what data they connect to, and how their lifecycle is managed. The app creation process enforces these policies automatically.
App inventory A centralized, real-time view in the Microsoft 365 admin center of all apps built with Copilot Managed Runtime across the tenant, including usage, health, and compliance state.
Distribution controls Admin-managed settings that determine who can discover and use each app built with Copilot Managed Runtime across the tenant.

Enable Copilot Managed Runtime for your tenant

Configure Copilot Managed Runtime enablement separately for each app creation method.

Note

Creating apps with Copilot Managed Runtime by using the Cowork skill is governed by your tenant's Frontier onboarding rather than the tenant switch. After your tenant is onboarded to Frontier, app creators who have access to Cowork can build apps.

Defaults by app creation path

Creation path Public preview Frontier public preview
Cowork Not available. Admins are guided to sign up for Frontier. On by default through Frontier program.
CLI Off by default. Admins can enable using environment settings and the environment group rule. Off by default. Admins can enable using environment settings and the environment group rule. See Copilot Managed Runtime SDK overview (preview).
Copilot Studio On by default. Admins can manage it in the Microsoft 365 admin center. On by default. Admins can manage it in the Microsoft 365 admin center. See Create an app in Microsoft Copilot Studio (preview).

Permissions

Role What they can do
Global Administrator Manage the CLI and Copilot Studio app creation paths.
Power Platform Administrator Manage the CLI and Copilot Studio app creation paths.
Global Reader, AI Administrator, AI Reader View only. Guided to contact an administrator to enable features.

Enabling the Cowork app builder skill requires onboarding the tenant to the Microsoft Copilot Frontier Program. Power Platform administrators can't enable Frontier; they're guided to contact an administrator with the required permissions. See Get started with the Microsoft Copilot Frontier Program.

Where the settings live

The app creation path controls are in the Microsoft 365 admin center, under Apps > Overview > Set up app creation spaces. You can also enable and configure creation paths through PowerShell or the API.

The Power Platform tenant setting for the Copilot Studio app creation preview is powerPlatform.powerApps.enableManagedAppsMcsPreview. The setting uses string values rather than Boolean values. The following PowerShell example applies the public-preview default value, DefaultOn:

$tenantSettings = Get-TenantSettings
$tenantSettings.powerPlatform.powerApps.enableManagedAppsMcsPreview = "DefaultOn"
Set-TenantSettings -RequestBody $tenantSettings

Scope access to Copilot Studio app creation with security groups

By default, all eligible users can use an enabled Copilot Studio app creation path. To limit access to specific users, configure an allow list through PowerShell or the API:

  • Allowed (no group configured): open to all eligible users.
  • Scoped (group configured): only the specified users in the security group can use Copilot Studio to create apps.

Control source and deployment options

Administrators can configure these independent controls for an individual environment or an environment group:

  • Allow public GitHub repository controls whether Copilot Managed Runtime can connect to public GitHub repositories.
  • External artifacts in Copilot Managed Runtime controls whether developers can deploy prebuilt artifacts produced outside the Microsoft-managed build system.

Both settings are disabled by default. See Configure source and deployment controls.

Govern apps

Apps built with Copilot Managed Runtime are governed from the moment they're created, with no extra setup required. The governance model is built around three principles: apps are safe by default, admins can govern at scale, and the platform balances controls with developer productivity.

Safe by default

Every app built with Copilot Managed Runtime has governance built in from the moment it's created. Developers and admins don't need to add governance as a configuration step afterward:

  • Built-in authentication. Every app uses Microsoft Entra ID—no extra identity configuration needed.
  • Automatic policy enforcement. Conditional access, data loss prevention (DLP), advanced connector policies, sharing limits, and data source restrictions apply to every app by default.
  • Isolated developer environments. Each developer works in a personal, Microsoft-managed sandbox that inherits these policies automatically.

Govern at scale

As the number of apps in a tenant grows, a centralized governance layer keeps them manageable:

  • Centralized inventory. Every app appears in the Microsoft 365 admin center, so admins know what exists and who owns it—no manual registration.
  • Usage analytics and health. Built-in adoption metrics and health alerting help admins track use and resolve issues before they affect users.
  • Lifecycle management. Admins manage the full app lifecycle from the Microsoft 365 admin center.

Balance controls and productivity

The Copilot Managed Runtime model is designed so that security and compliance controls don't impose unnecessary friction on developers or end users:

  • Developers keep their tools. The SDK handles governance integration, so developers focus on the app, not compliance plumbing.
  • Admins get granular control. Set controls around distribution, data access, and lifecycle instead of blocking custom apps entirely.
  • Users find apps easily. Apps surface in familiar Microsoft 365 experiences, reducing shadow IT.

Licensing and billing

Building apps consumes Copilot Credits and follows the spending policies and credit allocations you configure in the product where you create the apps. For running apps, administrators can configure separate spending policies and credit allocations in the Microsoft 365 admin center.

Building apps

App creation experience How build usage is billed Where admins manage build costs
Cowork Copilot Credits through the creator's Cowork spending policy, per user. Microsoft 365 admin center
Copilot Studio (preview) Copilot Credits through existing Copilot Studio billing, per environment. Power Platform admin center (PPAC)

Building in Cowork. Cowork requires a Microsoft Copilot license, but the subscription doesn't include Cowork usage. Consumption is billed separately through Copilot Credits. Administrators must also enable usage-based billing and include the creator in a spending policy that selects Cowork. Making Cowork discoverable alone doesn't enable users to start using the app-building skill.

Building in Copilot Studio. Apps are powered by the GitHub Copilot harness, so billable activity starts during creation, not only after publication, and includes natural-language authoring, testing, and evaluation.

Running apps

Administrators can configure separate per-user spending policies and credit allocations for app runtime in the Microsoft 365 admin center. These policies apply to runtime usage billed through Copilot Credits, including for apps built in Copilot Studio, Cowork, and using the CLI. Configure runtime coverage for the people who will use the app, separately from the billing configuration used to build it.

Note

For users with a Power Apps Premium license, running apps doesn't consume Copilot Credits unless the app uses separately billed services such as Work IQ APIs or usage exceeds the applicable Power Apps Premium API request limits. This runtime entitlement doesn't change build billing.

Important

For apps built in Copilot Studio, build billing is managed by environment in PPAC, but runtime usage billed through Copilot Credits is managed per user in the Microsoft 365 admin center. The environment-based billing model for Copilot Studio agent runtime does not apply to apps runtime.

Note

During preview, users who don't meet the credit requirements to run an app initially receive a warning. Access is blocked after the user completes 20 app operations or uses the app for five minutes, whichever occurs first.

Manage credits and control costs

  • Microsoft 365 admin center: Use Copilot > Cost management to configure spending policies for managed applications, select covered users, groups, and services, set policy-level and per-user limits, and monitor consumption.
  • Power Platform admin center: See Manage costs for agents powered by the GitHub Copilot harness for more details.

For detailed requirements and configuration guidance, see:

  • Last updated on