Microsoft Opens Its Managed Runtime to Lovable, Bringing Vibe-Coded Apps Under Enterprise Governance

AI has made writing code almost trivial. Running that code safely inside an enterprise has not gotten any easier. That gap is exactly what Microsoft is targeting with Copilot Managed Runtime, a new hosting platform introduced in public preview on September 25 that executes AI-generated apps inside the Microsoft 365 tenant boundary under IT control.

The headline for the broader market, though, is who else gets to plug in. Microsoft is opening the runtime to third-party build tools through a new SDK, and vibe-coding platform Lovable is the first partner it has named. In practice, that means an app someone spins up in Lovable can now be deployed into a Microsoft tenant and run with the same identity, policies, and oversight as anything built in Microsoft’s own Copilot tools.

In a blog post announcing the launch, David Blyth, VP and GM of Managed Apps and Agents at Microsoft, framed the problem plainly: functioning code is only the start. Provisioning cloud resources, configuring identity and security, applying policy, and managing deployments are what slow teams down, and every app-building platform tends to bring its own governance model with it. In this article, I’ll break down what Microsoft is launching, what it means for Lovable users, and why this move matters in the race to own enterprise AI development.

What Is Copilot Managed Runtime?

Copilot Managed Runtime is an enterprise-grade platform for running code inside the Microsoft 365 tenant. Microsoft operates the hosting; the customer organization sets the boundaries. It already powers the apps people build in Copilot Cowork, the new Copilot Code experience, and Microsoft Copilot Studio.

Rather than forcing each team to assemble its own foundation for every new app, the runtime bundles that foundation into the deployment model. Core capabilities include:

• Identity and sharing through Microsoft Entra, so access is authorized the same way as the rest of Microsoft 365
  
• Microsoft-hosted runtime environments for the applications themselves
  
• Organizational policies governing which connectors, data sources, and endpoints an app may use, along with auditing
  
• Lifecycle controls for deployment and versioning, including automatic Git-based source control that supports real developer workflows and co-development
  
• Central inventory and monitoring, giving IT visibility into usage, health, and policy compliance
  

Connectors and Work IQ are also integrated, simplifying how apps access and authorize against the business data they need. Notably, teams can preview and refine a new version of an app while the current version stays live for users, a small detail that matters a great deal once internal apps become business-critical.

Where Lovable Fits In

The piece that makes the Lovable connection possible is the Copilot Managed Runtime SDK, which Microsoft describes as the connective layer between the code a builder creates and the runtime host. It gives both Microsoft and third-party development tools a consistent way to build against Microsoft services and move an app from development into an enterprise-managed environment.

Importantly, the SDK and its accompanying command-line interface cover the full development lifecycle, not just the final packaging step. Developers can scaffold and configure projects, define the data connections an app requires, and generate typed TypeScript services for working with connectors. They can run and preview apps during development, then deploy and version them through the same toolchain. At runtime, SDK APIs act as a secure bridge to services exposed by the host, including governed access to enterprise data, identity, and Copilot work context.

For Lovable customers, the upshot is straightforward. Lan Roche, Head of Global Partnerships at Lovable, said apps made in Lovable can now run inside a customer’s Microsoft tenant with “same sign-in, same policies, same app inventory” as everything else there.

That’s a meaningful unlock for Lovable. Vibe-coding tools have proven remarkably popular with individual builders and business users, but the jump from a slick prototype to something IT will sanction for production use has been a persistent barrier. By routing Lovable-built apps through Microsoft’s governed runtime, that barrier gets considerably lower, and the code itself remains editable, Git-backed, and built on familiar web technologies.

One Governance Model, Many Build Tools

As more people gain the ability to build apps, and build them faster, every organization faces the same practical questions: What’s running? Who can access it? Which data and services can it reach? Does it still comply with policy?

Microsoft’s answer is a new Apps experience in the Microsoft 365 admin center. Every app hosted on Copilot Managed Runtime shows up there, whether it was built in Copilot Cowork, Copilot Code, Copilot Studio, or an SDK-compatible third-party tool like Lovable. Admins get a single inventory for reviewing access, usage, health, and policy, and they can enable or disable apps and review default policies from the same place.

The principle Microsoft is leaning on here is that central governance shouldn’t require centralized creation. Builders can keep working in whichever tool suits their role, while IT gets a common operating layer for deployment, security, monitoring, and lifecycle management. Microsoft offered a few scenarios to illustrate how that plays out:

• A team builds a launch-management app in Copilot Cowork, connects it to approved planning data, and deploys it through a governed path.
  
• A developer pulls down that same code, extends it with familiar web technologies, and ships updates without forking it or standing up a separate runtime and governance stack.
  
• An administrator reviews the app in the central inventory, monitors usage, and applies a consistent set of controls across apps that originated in different tools.
  

The key point is that the operating model stays the same regardless of which authoring tool was used. That’s what allows organizations to scale app creation without scaling operational risk at the same rate.

Availability

The Copilot Managed Runtime host and SDK are both in public preview. Microsoft’s own entry points, Copilot Cowork, Copilot Code, and Copilot Studio, are already live on the runtime, and developers can use the SDK and plugins to build apps for the host today. Administrators can manage hosted apps and review default policies through the Apps experience in the Microsoft 365 admin center. Expect more detail at Microsoft Ignite, which runs November 17–20, 2026.

Final Take

This is a shrewd strategic move from Microsoft. Rather than trying to win every battle at the build layer, where AI coding tools are multiplying rapidly and user loyalty is fickle, Microsoft is positioning itself as the trusted place where all that code ultimately runs. Build anywhere, run on Microsoft.

It’s a familiar playbook. Microsoft has long won enterprise business by being the system IT trusts to manage identity, compliance, and security, and Copilot Managed Runtime extends that role to the flood of AI-generated apps now arriving in every organization. Welcoming a popular third-party tool like Lovable signals that Microsoft would rather govern shadow IT than fight it.

For Lovable, the partnership offers a direct route into the enterprise accounts where Microsoft 365 is already the default, along with an answer to the security and compliance questions that tend to stall vibe-coded apps at the prototype stage. You can learn more about Lovable at Community Summit North America 2026, running October 11-15 in Nashville, TN. Hear from Olof Hedin, head of GTM for Lovable, during a fireside chat as part of the Keynote program. Hedin will be joined on stage by Microsoft’s Georg Glantschnig; the two will discuss the partnership between the two companies and what it means for customers. Attendees and customers can also connect with the team at the Lovable Lounge at Booth 141 on the Show Floor.

For CIOs, the message is the most compelling of all. AI will keep lowering the barriers to building software, but trust, control, and reliability need to keep pace. A single governance plane spanning both Microsoft and third-party build tools is precisely the kind of foundation enterprises need to say yes to citizen development at scale. The question now is how many other AI coding platforms follow Lovable through the door.

Community Summit NA is the largest independent Microsoft AI & Business Applications User Conference on the planet. Register today for four days of big ideas, education, training, networking, and more to define your relevance in the AI era.