Copilot Managed Runtime overview and key concepts for admins (preview)

[This article is prerelease documentation and is subject to change.]

Copilot Managed Runtime helps teams build internal line-of-business apps that automatically comply with your organization's IT governance policies. Every app is governed from the moment you create it - no extra setup required. Each app appears in the Microsoft 365 admin center, where admins can track usage, monitor health, and manage its lifecycle.

Important

  • This is a preview feature.
  • These features are subject to supplemental terms of use, and are available before an official release so that customers can get early access and provide feedback.

Copilot Managed Runtime brings three audiences together around the same governed app:

  • Users discover and run apps from a web portal.
  • Makers and developers build apps using tools and languages they already know.
  • Administrators govern apps across the tenant.

To learn how people create apps across Cowork, Copilot Studio, and the CLI, see What is Copilot Managed Runtime (preview).

Key features

  • Microsoft Entra authentication and authorization out of the box
  • Access to 1,500+ connectors, callable directly from JavaScript and TypeScript
  • A native Git inner loop with a repository for source control and collaboration
  • Automatic adherence to your IT policies, including sharing limits, conditional access, advanced connector policies, and data loss prevention (DLP)
  • Centralized inventory, usage analytics, and operational health in the Microsoft 365 admin center

Common scenarios

Copilot Managed Runtime fits scenarios where teams need flexibility while staying within enterprise governance boundaries:

  • Personal productivity apps. Tools an individual builds and uses in their own developer environment.
  • Team productivity apps. Shared apps that small teams use to automate workflows and collaborate.
  • Organizational apps. Broader solutions that IT or development teams deploy across the tenant with admin-controlled distribution.

Key concepts

To work more effectively with Copilot Managed Runtime, it's important to understand the following key concepts:

Term Description
Copilot Managed Runtime SDK The developer libraries and tooling used to build apps with Copilot Managed Runtime. Provides built-in Microsoft Entra authentication, connectivity to more than 1,500 data sources, and enforcement hooks for governance policies.
Personal developer environment A dedicated, isolated sandbox provisioned for each developer, separate from production, so they can build and test safely.
Governance policies Rules that control how apps built with Copilot Managed Runtime are deployed, who can access them, what data they connect to, and how their lifecycle is managed. The app creation process enforces these policies automatically.
App inventory A centralized, real-time view in the Microsoft 365 admin center of all apps built with Copilot Managed Runtime across the tenant, including usage, health, and compliance state.
Distribution controls Admin-managed settings that determine who can discover and use each app built with Copilot Managed Runtime across the tenant.

Enable Copilot Managed Runtime for your tenant

Configure Copilot Managed Runtime enablement separately for each app creation method.

Note

Creating apps with Copilot Managed Runtime by using the Cowork skill is governed by your tenant's Frontier onboarding rather than the tenant switch. After your tenant is onboarded to Frontier, app creators who have access to Cowork can build apps.

Defaults by app creation path

Creation path Public preview Frontier public preview
Cowork Not available. Admins are guided to sign up for Frontier. On by default through Frontier program.
CLI Off by default. Admins can enable using environment settings and the environment group rule. Off by default. Admins can enable using environment settings and the environment group rule. See Control whether apps can be created using the CLI.
Copilot Studio On by default. Admins can manage it in the Microsoft 365 admin center. On by default. Admins can manage it in the Microsoft 365 admin center. See Create an app in Microsoft Copilot Studio (preview).

Permissions

Role What they can do
Global Administrator Manage the CLI and Copilot Studio app creation paths.
Power Platform Administrator Manage the CLI and Copilot Studio app creation paths.
Global Reader, AI Administrator, AI Reader View only. Guided to contact an administrator to enable features.

Enabling the Cowork app builder skill requires onboarding the tenant to the Microsoft Copilot Frontier Program. Power Platform administrators can't enable Frontier; they're guided to contact an administrator with the required permissions. See Get started with the Microsoft Copilot Frontier Program.

Where the settings live

The app creation path controls are in the Microsoft 365 admin center, under Apps > Overview > Set up app creation spaces. You can also configure creation paths by using Microsoft Power Platform CLI.

To turn off Copilot Studio app creation, use the following command:

pac admin update-tenant-settings --setting-name powerPlatform.powerapps.enableManagedAppsMcsPreview --setting-value 'off'

For more information, see Programmability and extensibility - Power Platform and Microsoft Power Platform CLI admin command group.

Note

Copilot Studio retrieves the tenant settings each time you refresh the page. If you leave a Copilot Studio tab open, the settings are cached for up to 15 minutes or until the next page load.

Scope access to Copilot Studio app creation with security groups

To restrict Copilot Studio app creation to specific Microsoft Entra security groups, set powerPlatform.powerapps.enabledGroupsManagedAppsMcsPreview to a security group's object ID (GUID). To configure multiple groups, use a comma-separated string of object IDs.

The following example configures access for one security group. Replace <SGID> with the Microsoft Entra security group object ID:

pac admin update-tenant-settings --setting-name powerPlatform.powerapps.enabledGroupsManagedAppsMcsPreview --setting-value '<SGID>'

When the Copilot Studio app creation path is enabled, users who belong to any configured security group can create apps.

Control source and deployment options

Copilot Managed Runtime supports external repositories owned by GitHub Enterprise Cloud organizations. Configure repository visibility and other repository management policies in GitHub Enterprise Cloud. For more information, see Enforcing repository management policies in your enterprise.

Administrators can use External artifacts in managed apps to control whether developers can deploy prebuilt artifacts produced outside the Microsoft-managed build system. The setting is disabled by default and can be configured for an individual environment or an environment group.

See Configure source and deployment controls.

Govern apps

Apps built with Copilot Managed Runtime are governed from the moment they're created, with no extra setup required. The governance model is built around three principles: apps are safe by default, admins can govern at scale, and the platform balances controls with developer productivity.

Safe by default

Every app built with Copilot Managed Runtime has governance built in from the moment it's created. Developers and admins don't need to add governance as a configuration step afterward:

  • Built-in authentication. Every app uses Microsoft Entra ID—no extra identity configuration needed.
  • Automatic policy enforcement. Conditional access, data loss prevention (DLP), advanced connector policies, sharing limits, and data source restrictions apply to every app by default.
  • Isolated developer environments. Each developer works in a personal, Microsoft-managed sandbox that inherits these policies automatically.

Govern at scale

As the number of apps in a tenant grows, a centralized governance layer keeps them manageable:

  • Centralized inventory. Every app appears in the Microsoft 365 admin center, so admins know what exists and who owns it—no manual registration.
  • Usage analytics and health. Built-in adoption metrics and health alerting help admins track use and resolve issues before they affect users.
  • Lifecycle management. Admins manage the full app lifecycle from the Microsoft 365 admin center.

Balance controls and productivity

The Copilot Managed Runtime model is designed so that security and compliance controls don't impose unnecessary friction on developers or end users:

  • Developers keep their tools. The SDK handles governance integration, so developers focus on the app, not compliance plumbing.
  • Admins get granular control. Set controls around distribution, data access, and lifecycle instead of blocking custom apps entirely.
  • Users find apps easily. Apps surface in familiar Microsoft 365 experiences, reducing shadow IT.

Licensing and billing

Apps on Copilot Managed Runtime use consumption-based billing through Copilot Credits, and building an app is billed separately from running it:

  • Building an app is billed through the tool the maker uses. Cowork and Copilot Code use spending policies in the Microsoft 365 admin center. Copilot Studio uses environment credits in the Power Platform admin center, or spending policies in the Microsoft 365 admin center for environments that have moved there as Copilot Studio cost management moves to the Microsoft 365 admin center. The CLI doesn't require a license for development.
  • Running an app requires either a Power Apps Premium license or Copilot Credits through a spending policy that includes Copilot Managed Runtime, which administrators set up per user in the Microsoft 365 admin center. Sharing an app gives people access to it, but it doesn't cover the cost of running it. Each person running the app also needs a Power Apps Premium license or must be included in a spending policy that includes Copilot Managed Runtime.

For setup steps, recommended policy patterns, cost examples, and troubleshooting, see Manage licensing and Copilot Credits for apps on Copilot Managed Runtime. For answers to common licensing questions, see the Copilot Managed Runtime licensing FAQ.

For detailed requirements and configuration guidance, see:

  • Last updated on