Microsoft managed apps let anyone build an app in Copilot Studio and spend Copilot Credits, on by default. Where the switch is and what to have ready first.
What Microsoft has shipped
In late September 2026 Microsoft put Copilot Managed Runtime into public preview. The short version is that people in your tenant can now describe an app in plain English and get a working, Microsoft-hosted app at the end of it. Microsoft calls them managed apps. They can be built in Copilot Studio, in Cowork if your tenant is on the Frontier programme, or by developers using a new SDK and command line. They run inside your Microsoft 365 tenant, sign people in with Entra, and can reach more than 1,500 connectors. Every app shows up in a new Apps area of the Microsoft 365 admin centre with usage, health and an owner against it.
It is a good idea, and a well-built one. The apps are governed from the moment they exist, which is more than can be said for most of the spreadsheets they will replace. We like it. The point of this post is not that managed apps are bad. It is that the Copilot Studio creation path is switched on by default, and most organisations have not decided what they want to happen when a member of staff starts building.
Why it needs a decision now
Three things make this worth an hour of an IT leader's time this week rather than next quarter.
Building costs money from the first prompt. Building a managed app in Copilot Studio consumes Copilot Credits, and the authoring, testing and evaluation are all billable from the moment someone starts. Microsoft bills that through your existing Copilot Studio arrangement, per environment, which is managed in the Power Platform admin centre. If you have pay-as-you-go turned on, someone experimenting on a Friday afternoon is spending real money, and the bill lands in whichever environment they happened to be in.
Running apps costs money too. Users without a Power Apps Premium licence consume credits every time they use an app, under a separate per-user spending policy. During the preview, a user who runs out of credit gets a warning and is then cut off after a handful of operations. That is a bad way for a finance team to discover that the holiday request app everyone adopted was never budgeted for.
Nobody owns the result. An app that was easy to build is easy to abandon. If forty people build forty apps in a month, you will have forty new line-of-business tools with data in them, each with an owner who may leave, and none of them on an inventory anyone looks at. We wrote about this trap with ordinary Power Apps in When a Power App is the right fix, and when it is not. Managed apps lower the barrier further, which makes the problem arrive sooner.
Where the switch is
The control is not in the Power Platform admin centre, which is where most Power Platform people will look first. It is in the Microsoft 365 admin centre. Go to Apps, then Overview, and find the card for app creation paths. The set up link opens a page where you choose where people can create apps. Copilot Studio is the one that is on by default. Turn it off.
If you would rather do it from the command line, the Power Platform CLI has a tenant setting for it: pac admin update-tenant-settings with the setting name powerPlatform.powerapps.enableManagedAppsMcsPreview set to off. There is a companion setting that restricts creation to named Entra security groups, which is the better end state once you are ready. Copilot Studio only re-reads the tenant settings on a page refresh, so allow up to fifteen minutes for an open tab to catch up.
Two things that switch does not do. It does not touch Cowork, because app creation there is governed by your Frontier onboarding rather than the tenant toggle. And it does not touch the developer SDK path, which is off by default anyway and is controlled per environment. So a small, named group can carry on testing and learning in Cowork while the rest of the organisation waits until you are ready.
Credit where it is due: it was a LinkedIn post by David Wyatt, a Microsoft MVP, that flagged where this setting is and why it matters. He found it before most admins knew the feature existed.
What to have ready before you turn it back on
Turning it off is the easy part. The reason to turn it off is to buy time to put four things in place, and then turn it back on deliberately.
A FinOps process. Decide who can spend Copilot Credits, how much, and who sees the bill. The Microsoft 365 admin centre has cost management for Copilot where you set spending policies, pick the people and groups they cover, and cap spend per policy and per user. Set that up before a single app is built, not after the first surprise invoice. If you have already had the licensing conversation for Fabric, this is the same discipline applied to a different meter; our post on Power BI and Fabric licensing explained covers how we approach it.
A governance baseline. Microsoft gives every tenant a default environment group with a starting set of around thirty approved connectors. Review it. Decide which connectors and data sources an app is allowed to touch, who can share an app and with whom, and what the data loss prevention policy says. Sharing an app does not share its data, so builders have to set up data permissions separately. That is correct, but someone needs to tell them. As AI starts to act, governance cannot be the top layer makes the wider argument, and our lightweight data governance framework is the practical version.
Training. Not a course on Copilot Studio. A short, plain explanation of what a managed app is, what it costs, where its data lives, and what you expect of someone who builds one. Who owns it. What happens when they leave. Where to put it if it turns out to matter. An hour with the people most likely to build will save you months.
A named pilot group. Use the security group setting rather than the tenant-wide on switch. Pick a dozen people across the business who have a real problem to solve, give them a budget, and let them build. Review what they made after six weeks. You will learn more about what managed apps are good for in your business from twelve real apps than from any amount of reading.
What this means for a mid-market IT team
Microsoft is going to keep doing this. Copilot Studio, Fabric, Power Platform and now managed apps all follow the same pattern: a capability arrives, it is on by default, and it is useful enough that people will use it whether or not you have a plan. The organisations that get value from these tools are not the ones that lock everything down. They are the ones that decided in advance who can build, what it costs, where the data goes and who looks after the result, and then let people get on with it. If you want help turning that into a working set of policies, our strategy and leadership team does exactly this, and our Microsoft AI and Copilot page explains where managed apps sit alongside the rest of the Microsoft AI estate.
Turn the switch off today. Then do the work that lets you turn it back on.
Related reading
When a Power App is the right fix, and when it is not
Microsoft AI isn't one product, it's five decisions
Is Power BI Copilot worth turning on, and what it needs first
The Fabric rollout that quietly goes wrong: workspace sprawl, shadow BI and the readiness checks
James Morley
Analytics Solutions Consultant
Part of the Hopton Analytics team, delivering governed analytics programmes for UK mid-market organisations.