October 2, 2026
On September 28, 2026, Lovable announced that apps built on its platform can now run directly inside a customer's own Microsoft tenant, using Microsoft's Copilot Managed Runtime SDK. That's the key detail: the app isn't hosted on Lovable's infrastructure and loosely connected to Microsoft 365 -- it runs where the company's other Microsoft-based software already runs. Sign-in happens through Microsoft Entra ID, so access is governed by the same directory IT already uses for everything else. On Business and Enterprise plans, that means SSO, SCIM provisioning, security scanning, and audit logs -- the identical controls IT applies to any other Microsoft 365 app. The resulting app shows up in the company's existing app inventory, not as a mystery URL someone on the marketing team bookmarked. Copilot Managed Runtime itself is in public preview, but Microsoft 365 connectors, Microsoft Fabric, and Microsoft sign-in are already live on every Lovable plan, preview or not.
Anyone who's sat across from a CISO evaluating an AI app builder has heard some version of the same worry: someone in ops or sales describes what they want in a chat window, an app appears, and six months later nobody in IT knows it exists, who has access to it, or what data it touches. That's not a hypothetical -- it's the exact failure mode that made "shadow IT" a dirty phrase long before AI entered the picture, and AI app builders have made it faster and easier to create that kind of unmanaged sprawl, not slower. Lovable is naming that objection directly and building against it. Instead of asking enterprise buyers to trust a brand-new, separate layer of identity and access management, it's routing everything through the identity and audit systems companies already have. We wrote about this dynamic a few days before the announcement, when Microsoft's Copilot Managed Runtime itself started giving AI app builders a credible path into enterprise governance -- Lovable's move is that same logic pushed all the way into a shipped product.
Speed was the entire pitch of vibe coding for the past two years: describe an app, get a working version in minutes. That pitch is still true and still valuable. But speed without governance has a ceiling, and that ceiling is exactly where enterprise deals go to die -- in security review, when IT asks where the app lives, who can see the data, and how access gets revoked when someone leaves the company. An app that can't answer those questions doesn't get rejected gracefully; it gets quietly excluded from anything that touches real customer or financial data, which is most of what enterprises actually want built. Plugging into Entra ID, SCIM, and existing audit logging doesn't slow Lovable down on the demo -- it's what lets the demo turn into a deployed, sanctioned piece of company software instead of a tool that lives in permanent pilot purgatory.
This is also why we think "does this integrate cleanly with our existing identity and audit systems" is becoming as important a question as "how fast can it build something" when evaluating any AI app builder -- a question we lay out in detail in our own security and compliance checklist. Microsoft is one major backbone, but the principle doesn't stop there. A company running on Google Workspace or Okta for identity should expect the same thing: the apps it builds with AI should show up inside whatever stack already governs access, not beside it. That's the standard we hold ourselves to across ViibeStack's platform, and it's the same reasoning behind our own integrations and security commitments -- an app nobody in IT can see isn't a shortcut, it's a liability with a head start.
This doesn't happen in a vacuum. Just a week before the Microsoft announcement, Okta formed the Blueprint Alliance with AWS, CrowdStrike, Databricks, Docker, Lovable, Proofpoint, ServiceNow, Wiz, and Zscaler -- a coalition built around a shared architecture for governing AI agents in enterprise environments, with principles like treating every agent as a first-class identity and keeping delegation traceable and reversible. At the time, that was a set of stated principles. The Microsoft partnership is Lovable actually building one of them: an identity-bound, auditable, revocable app, not just a company signing a pledge. That's the detail worth paying attention to -- governance-first language is cheap in this industry right now; shipping the SDK integration that makes it real is not.
None of this means Lovable has solved enterprise AI governance, and it doesn't mean every AI app builder needs a Microsoft-specific integration to be credible. But it does mean the bar for the category just moved. "We can build it fast" was enough to win a pilot. It is not enough to win the budget line, the security review, or the renewal -- and platforms that treat identity and audit integration as a later-stage feature rather than a day-one requirement are going to keep losing exactly those deals.
Sources