September 29, 2026
On September 25, 2026, Microsoft relaunched Copilot around three pillars — Home, Code, and Autopilot — in a post on the official Microsoft blog. Tucked inside that relaunch was a narrower but more consequential move for anyone building apps with AI: the Copilot Managed Runtime, currently in public preview, with Lovable named as an early launch partner. According to Microsoft's Copilot Blog post announcing the capability, the Copilot Managed Runtime SDK lets an app built with Lovable run directly inside a company's Microsoft tenant, governed by the same sign-in, security policies, and app inventory as every other piece of enterprise software that IT already manages.
Strip away the product-launch framing and this is Microsoft using its distribution and governance muscle to address the one objection that has followed AI app builders around since they went mainstream: shadow IT. A business user vibe-codes a scheduling tool, an intake form, or an internal tracker in a tool like Lovable, it works, people start using it — and IT has no idea it exists. No SSO. No policy enforcement. No line in the app inventory. That gap is exactly why security and compliance teams have been slow to bless AI-built software, even when the app itself is fine. We've written before about the security and compliance checklist worth running before you build or buy anything, and "does IT know this exists" is usually the first question that trips teams up.
By making Lovable-built apps runnable inside the same governed tenant as Outlook, Teams, and every other Microsoft-managed app, Microsoft is telling enterprise buyers something specific: an AI-built app doesn't have to be a compliance exception anymore, it can just be another row in the inventory. That's a real, useful answer to a real objection. It's also a signal that reaches well past Lovable — it's Microsoft putting its weight behind the idea that AI-generated software belongs in the same governance conversation as everything else a company runs, which is a legitimizing moment for the entire AI-app-builder category, not just the one partner named in the announcement.
Here's the part worth saying plainly instead of treating this as unambiguous good news: governance solved this way is governance supplied by Microsoft, running on Microsoft's infrastructure, under Microsoft's terms. A team that builds in Lovable and runs the result in the Copilot Managed Runtime isn't eliminating the shadow IT risk so much as trading it for a different one — the app's runtime, its identity layer, and its policy enforcement all now live inside one vendor's tenant. If that tenant relationship changes, if pricing shifts, or if the company later wants to move that app somewhere else, the governance that made it enterprise-safe is also what makes it harder to extract.
For a lot of companies already fully committed to Microsoft 365 and Entra ID, that's a perfectly reasonable trade — you're consolidating onto infrastructure you already pay for and already trust. But it's a trade, not a free upgrade, and it deserves to be evaluated with the same clarity we'd apply to any other vendor lock-in decision. We've made this argument in the context of SaaS generally — see data ownership versus vendor lock-in — and it applies just as directly here: the question isn't whether governance exists, it's who holds the keys to it.
We're not neutral observers here. ViibeStack has been deploying Lovable-built apps to production for our customers since August, and governance has been part of that conversation from day one — see our own Security and Trust Center pages for how we think about identity, policy, and incident response for apps we run. So we agree with the premise behind Microsoft's move: an AI-built app that IT can't see is a real liability, and any credible answer to "build with an AI app builder vs. keep buying more SaaS" has to include a straight answer for how that app gets governed.
Where we'd push back is on the idea that Microsoft's tenant is the only place that governance can live, or the right default for every team. The Copilot Managed Runtime answers "can IT see and control this app" with yes — inside a Microsoft tenant. It doesn't answer whether a company wants its AI-built app's identity and policy layer permanently anchored to one vendor's infrastructure versus something more neutral, portable, or purpose-built for the app itself. That's a real strategic choice, and it's worth working through the same way we lay out in Buy vs. Build vs. ViibeStack — not as a governance checkbox to tick, but as a question about where control actually sits three years from now.
Microsoft solving the shadow IT problem for AI-built apps is good for the category — it removes a legitimate objection that's held enterprises back, and every AI app builder benefits from that objection getting weaker, not just Lovable. But treating a single vendor's managed runtime as the default governance answer is the wrong instinct. The right question for a business evaluating this isn't "does Microsoft's runtime make my AI-built app enterprise-safe" — it does. It's whether you want that safety to come with your app's runtime and identity permanently tied to Microsoft specifically. For teams already all-in on the Microsoft stack, that's a fine trade. For everyone else, it's worth building — or choosing a platform — where governance doesn't require picking a landlord first.
Sources