Skip to main content
Before anyone in your organization can publish Lovable apps to Microsoft Copilot Managed Runtime, a tenant admin completes a one-time setup: consent to the Lovable application in Microsoft Entra, and allow externally built apps in your environments. The whole setup takes about 20 minutes. A Lovable workspace admin also enables the connector in Lovable, described in Set up your Lovable workspace. This page is for IT admins. If you are a builder, see Build and publish apps to Microsoft Copilot Managed Runtime. For Microsoft’s own admin guidance, see Microsoft Copilot Managed Runtime overview and key concepts for admins and What is Microsoft Copilot Managed Runtime.

​
What you are consenting to

Lovable connects to your tenant through a single dedicated Microsoft Entra enterprise application. All of its permissions are user-delegated. Lovable acts only on behalf of the signed-in user, with that user’s own rights, to create the app, deploy it, and connect the data sources the user chooses.
  • Lovable receives no admin access to your tenant and holds no application-level permissions.
  • Lovable can never do more than the signed-in user is already allowed to do under your policies.
  • You can revoke consent at any time in Microsoft Entra, which immediately blocks new access.
Users sign in with their organizational Microsoft Entra identity when they connect Lovable. For this to work, a tenant admin first adds Lovable as an enterprise application and grants consent. The fastest and most reliable path is the admin consent URL:
1

Get your tenant ID

Find your Microsoft Entra tenant ID in the Microsoft Entra admin center.
2

Open the admin consent URL

Replace {tenant-id} in the following URL with your tenant ID, and open it in a browser:
3

Review and accept

Sign in as a tenant admin and review the consent screen. It lists the permissions Lovable uses to create, deploy, and run apps in Copilot Managed Runtime on a user’s behalf. Accept to add Lovable managed apps to your tenant.
The enterprise application is still listed as Lovable managed apps in Microsoft Entra.
You can also add the application from the gallery: in the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications → New application, search for Lovable managed apps, and add it.
If you skip this step, builders’ Microsoft sign-in fails when they try to connect Lovable.
Most enterprise tenants restrict user consent. Granting admin consent up front prevents every builder from being blocked at sign-in.

​
Step 2: Allow external artifact deployment

Lovable compiles apps outside Microsoft’s platform, so your environments need one policy change to accept them.
1

Open environment group rules

Sign in to the Power Platform admin center and go to Manage → Environment groups → GreenZone → Rules.
2

Enable the rule

Find the Allow external artifact deployment rule, enable it, and save.
If your organization uses other environment groups for environments where people build, enable the rule for those groups too.

​
Step 3: Decide where apps are created

When a builder publishes for the first time, Microsoft creates an environment under their identity. Each builder gets one environment, it holds all of their projects, and Microsoft reuses it on later publishes. These environments are created without Dataverse. You have two levers:
  • Let builders use their own environments. Check that your nominated builders are allowed to create environments under Settings → Tenant settings → Developer environment assignments in the Power Platform admin center.
  • Target a specific environment instead. Create or pick an environment, and give its environment ID to your builders. They paste it into the Environment ID field when they set up their Lovable connection, and apps are created there instead.

​
Review connector and data policies

Apps in Copilot Managed Runtime reach data through connectors published by Microsoft in the app’s environment, so your existing data policies apply to them at runtime. Review the data policies for the environments your builders will use, and confirm the connectors they plan on (for example SharePoint, Outlook, Excel Online, or Dataverse) are allowed there. Database connectors such as SQL Server need a connection created upfront, with credentials, at make.powerapps.com → Connections in the app’s environment.

​
Network requirements

Allow these domains through proxies, firewalls, and browser policies for everyone who builds or uses apps in Copilot Managed Runtime:
  • lovable.dev and subdomains
  • login.microsoftonline.com
  • *.powerapps.com
  • *.managedapps.cloud.microsoft
  • *.lovable.app
  • *.lovableproject.com
The in-editor preview runs inside the Copilot Managed Runtime host as an embedded frame. Proxies that inspect TLS traffic or browser policies that strip embedded third-party content break the preview silently. Include a builder on your normal corporate network in your first test. Conditional Access. Your Conditional Access, multi-factor authentication, and identity protection policies apply when a builder signs in and consents. After consent, Lovable refreshes access server-side from its own infrastructure. If you enforce location-based or device-based Conditional Access, test those policies with a real builder sign-in before rolling out.

​
Licensing

Builders need permission to create apps in your environments. People who open a published app need the Microsoft license your organization uses for Copilot Managed Runtime. Confirm current requirements with your Microsoft contact, since licensing for Copilot Managed Runtime is set by Microsoft, not Lovable.

​
Set up your Lovable workspace

Microsoft tenant setup is one half of the admin work, and a Lovable workspace admin completes the other half. The Microsoft Copilot Managed Runtime connector is available on Business and Enterprise plans.
  1. Choose who can create Microsoft Copilot Managed Runtime connections. Go to Connectors → Admin settings → App + chat connectors and pick one of three options for the connector: No one, Admins, or Editors & admins. The setting doubles as the availability switch. On Enterprise plans it defaults to No one, so the connector stays disabled until you change it. On Business plans it defaults to Admins. See Who can create connections and clients.
  2. Each builder creates their own connection with their own Microsoft sign-in, and controls who can use it. Connection access also gates project sharing: teammates need access to a project’s connection to work in that project. See Who can use connections and clients.

​
Governance and auditing

Published apps in Copilot Managed Runtime behave like any other app in your Microsoft estate:
  • They appear in your admin inventory, and you manage their lifecycle there, including sharing and deletion.
  • Your data loss prevention and connector policies are enforced at runtime.
  • App activity flows into your Microsoft audit logs.
  • End users’ runtime activity in published apps stays in your Microsoft estate. It does not flow back to Lovable.
Lovable’s own record of a project (its source code and chat history) stays in Lovable, governed by your Lovable workspace settings.

​
Revoke access

To remove Lovable’s access to your tenant:
  1. In the Microsoft Entra admin center, go to Enterprise applications → Lovable managed apps and delete the application or its permissions. This immediately blocks new access. Access already granted expires within about an hour.
  2. Have builders remove their Microsoft connections in Lovable, which deletes the stored grant.
  3. Delete or reassign published apps and environments in the Power Platform admin center. Removing apps there is the authoritative teardown. Lovable cannot remove an app from your tenant.

​
Troubleshooting

Admin consent has not been granted, or was granted after the builder’s first attempt. Complete step 1, then have the builder retry the connection.
The connector’s Who can create connections and clients setting is set to No one, which is the Enterprise default. A Lovable workspace admin changes it under Connectors → Admin settings → App + chat connectors.
Check that the target environment allows external artifact deployment (step 2), and that the builder either can create an environment or has a valid environment ID in their connection (step 3).