Security1 publisher2 min readPublished
Microsoft's Copilot Managed Runtime runs user-built apps inside the Microsoft 365 tenant
Microsoft put Copilot Managed Runtime into public preview, hosting code from three Copilot builders and third-party tools like Lovable inside the M365 tenant. For security teams the launch is a policy job over who may deploy code that reads tenant data.
The Watch · Security desk
What happened
- Microsoft put Copilot Managed Runtime into public preview as a Microsoft-hosted platform that runs code inside the Microsoft 365 tenant boundary under IT governance.
- The runtime already hosts the apps people build in Copilot Cowork, Copilot Code and Copilot Studio, according to Microsoft.
- Microsoft is extending the runtime beyond its own builders to third-party tools and professional developers.
- Entra handles identity for these apps, and organizational policies govern which connectors, data and endpoints each app can use.
- Admins get one inventory in the Microsoft 365 admin center covering access, usage, health and policy for apps from every supported build tool.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Admins have to decide who holds build rights over which data sources before builders arrive, since that grant sets what deployed code can read.
- exposure Code generated in third-party tools such as Lovable can now reach tenant data through the same sign-in and connectors, so review has to cover output from tools the security team may never have assessed.
- capability Tenants that used Cowork, Code or Studio may already have apps on this runtime, and defenders can now find them in one inventory across every build tool.
Microsoft's post describes a product launch, with no flaw or exploitation attached [1]. What a defender has to assess is the access path. At runtime, an app reaches the host through SDK APIs that Microsoft says provide governed access to enterprise data, identity and Copilot work context [8]. Builders define the data connections an app needs, generate typed TypeScript services for its connectors, then deploy and version it through the same CLI [11]. The hosts that run it are Microsoft's [10].
By Microsoft's account, IT holds the controls. The company says IT keeps control over how apps run and over "who is able to build over which enterprise data sources" [7]. "Microsoft operates the platform; your organization sets the boundaries; you remain in control," the post says [12]. A stolen session for a builder's account would carry that builder's grants.
The pitch is broad. "Code is becoming easier for anyone to create with AI," Microsoft wrote at the top of the post [14]. The post does not say whether build rights start open to every user or stay closed until an admin grants them.
Code from outside Microsoft's own tools takes the same route into the tenant. "With the Copilot Managed Runtime SDK, an app made with Lovable can now run inside your Microsoft tenant, the same way everything else does: same sign-in, same policies, same app inventory," Lan Roche, head of global partnerships at Lovable, said in Microsoft's announcement [4].
Every app gets automatic version and source control via Git, according to Microsoft [9]. A reviewer gets a change history for each app. Apps also inherit Microsoft 365 sharing and live data connections [13], so one person's app can reach colleagues through ordinary sharing.
What to watch
- Which third-party build tools beyond Lovable ship support for the Copilot Managed Runtime SDK.
- Whether the admin center inventory adds audit records of what data each app pulled through its connectors.
- A general-availability date, and whether preview policy settings carry over unchanged.