Microsoft Copilot Managed Runtime Repo: Vite 8 Template and a Claude Code Plugin

Microsoft published a public GitHub repo, microsoft/Copilot-Managed-Runtime, containing a Vite 8 React/TypeScript starter template and a plugin that lets Claude Code and GitHub Copilot scaffold apps for its Copilot Managed Runtime, which is in public preview. The repo is MIT-licensed and had no stars or forks at the time of writing; the SDK, CLI (binary `ms`) and Vite plugin ship separately as npm packages under the `@microsoft` scope, and runtime billing runs through Power Apps Premium or Copilot Credits at 0.1 credits per API call. Apps built on the runtime inherit Microsoft Entra authentication and governance controls — data source limits, sharing limits, Conditional Access, Advanced Connector Policies and Data Loss Prevention — enforced by the platform and visible in the Microsoft 365 admin center, with connections to more than 1,500 data sources including Microsoft Graph, SQL and SharePoint.

Microsoft has opened a new public GitHub repo, microsoft/Copilot-Managed-Runtime https://github.com/microsoft/Copilot-Managed-Runtime?ref=explainx , with project templates and a plugin that lets AI coding agents build apps for its governed hosting layer. The plugin works with both Claude Code and GitHub Copilot. The runtime itself is in public preview, and the repo had no stars and no forks when we fetched it, so this is a day-zero look. This matters because it shows how Microsoft wants AI-built internal apps to ship: an agent scaffolds the code, and the platform, not the developer, enforces identity, data and policy rules. If you have followed our coverage of the Copilot Home, Code and Autopilot relaunch https://explainx.ai/blog/microsoft-copilot-home-code-autopilot-relaunch-2026 , this is the developer-facing piece of the same runtime. Quick reference | Question | Answer | |---|---| | What is it? | A repo of templates and a coding-agent plugin for apps on Copilot Managed Runtime | | Status | Public preview; APIs, templates and tooling may change README | | License of the repo | MIT | | Template | vite8 : React, TypeScript and Vite 8 starter | | Agents supported | Claude Code and GitHub Copilot; partial Codex packaging | | CLI binary | ms | | Runtime billing | Power Apps Premium, or Copilot Credits 0.1 credits per API call | | Where apps are governed | Microsoft 365 admin center | What is Copilot Managed Runtime? The README describes it as hosting for Microsoft 365 line-of-business apps that "automatically inherit organizational governance, security, and compliance controls from the moment they're created." Microsoft Learn adds that apps get Microsoft Entra authentication without custom code and can connect to more than 1,500 data sources such as Microsoft Graph, SQL and SharePoint. Admins see every app in the Microsoft 365 admin center, with usage analytics and health alerting. Governance rules such as data source limits, sharing limits, Conditional Access, Advanced Connector Policies and Data Loss Prevention apply by default, according to the Microsoft Learn SDK page https://learn.microsoft.com/microsoft-365/managed-apps/developer/?ref=explainx . Microsoft announced the runtime in September as the host behind apps made in Cowork, Code and Copilot Studio, and as an open door for third-party tools. Our relaunch explainer https://explainx.ai/blog/microsoft-copilot-home-code-autopilot-relaunch-2026 covers that announcement. The new repo is the first place where outside developers and their agents can see the templates. What is inside the repo According to the README, the repo is organised like this: - templates/ : first-party templates. Today there is one, vite8 , a React, TypeScript and Vite 8 starter. - plugins/copilot-managed-runtime/ : the plugin, with skills, agents and hooks for building apps with AI coding agents. - .claude-plugin/ : a marketplace manifest, so agents can install it with a /plugin marketplace add command. - .agents/plugins/ : a Codex marketplace entry pointing to the same plugin directory. - schemas/ , scripts/ and github-actions/ : supporting files. The tooling is not in the repo. It ships as npm packages under the @microsoft scope: an SDK, a CLI and a Vite plugin. The repo is also "the home for public issues," so bug reports go there. One-button deploy of a container to the cloud, as with the Copilot Managed Runtime deploy command How to try it with Claude Code The plugin README gives a short path. Open your agent in any project folder: claude Then add the marketplace and install the plugin: /plugin marketplace add microsoft/Copilot-Managed-Runtime /plugin install copilot-managed-runtime@Copilot-Managed-Runtime GitHub Copilot CLI uses the same two commands. You need Node.js 22 or newer per the plugin README, plus Git, Git Credential Manager and access to a tenant where Copilot Managed Runtime is enabled. Microsoft Learn is stricter and asks for Node.js 24.11.0 or newer, so use the newer version to be safe. The README says the /create-app skill installs the CLI for you. The plugin exposes slash commands in groups: | Group | Commands | |---|---| | Scaffold | /create-app | | Lifecycle | /dev , /deploy , /play , /share , /share-link , /delete-app , /list-apps | | Backend database | /add-backend | | Data sources | /add-data-source , /add-dataverse , /add-sharepoint , /add-excel , /add-office365 , /add-teams , /add-onedrive , /add-azuredevops , /add-workiq , /list-connectors and others | Apps run locally against an "App Player" with hot reload via ms app dev , and deploy to the cloud only when you choose. That local-first loop is a sensible default for agent work, because a failed run costs nothing in production. A prompt to start with, after install: "Create a Copilot Managed Runtime app that lists open items from a SharePoint list, with a filter and an owner column. Run it locally and do not deploy." Connector scopes shown as cables passing through a ring, matching the data-source commands in Copilot Managed Runtime What does it cost? Microsoft Learn states that licensing is enforced when developers run an app locally through the CLI and when end users run it. Users need one of: 1. Power Apps Premium plan: covers all app operations without using Copilot Credits. 2. Managed Application Copilot Credits: charged each time an app launches and for each API call, at 0.1 credits per call. Users who rely on credits and lack them get a warning and can keep going for free until they reach 20 app operations or five minutes of use, whichever comes first. Then access is blocked. For a builder, the lesson is to estimate API calls per screen early. An app that makes ten connector calls on load costs about one credit per launch, plus the launch charge. Microsoft Learn does not state a credit price in the page we read, so check your tenant's Copilot cost management settings. Repository choices and limits Each app has a repository chosen at creation, and the choice cannot be changed later. The default is platform-managed Git. You can instead bind a GitHub repo with --repo <url , but the docs limit this to organizations on GitHub Enterprise Cloud. GitHub Enterprise Server, personal accounts and Azure DevOps are not supported. This is a real constraint. A small team on a personal GitHub account cannot bring its own repo, and must use the managed one. Where it is still rough - Package names disagree. The Learn page tells you to run npm install -g @microsoft/managed-apps-cli . The repo README lists @microsoft/cmr-cli , @microsoft/cmr-apps and @microsoft/cmr-apps-vite-plugin . Both name the binary ms . This looks like a rename in progress, but we have not confirmed it, so verify before you script an install. - Preview terms apply. Learn calls the page "prerelease documentation" under supplemental terms of use. - Codex support is partial. The plugin README says the portable package "does not establish full Codex runtime support" and has no Codex architect agent or hooks. - No community history. With zero stars and forks at fetch time, there is no independent testing yet. We did not run the plugin against a live tenant, so we cannot report hands-on results. - Telemetry attribution. The plugin asks agents to set MS CLI ORIGIN=plugin , a hint used for attribution. The README notes this depends on the agent following instructions, not enforcement. Read the hooks before you install, as with any plugin that can run commands. Security and trust: read before installing A plugin with skills, agents and hooks can run commands in your terminal. Treat it like any third-party code. Read plugins/copilot-managed-runtime/hooks and the skills first. Our guide to the official Claude plugin directory https://explainx.ai/blog/anthropics-claude-plugins-official-directory-structure-install-submit-trust-guide-2026 explains how plugin marketplaces work and what to check. The governance promise covers the app's runtime, not your local agent session. Your local agent session needs its own review and permission settings. How it compares Microsoft has shipped several coding-agent add-ons lately. The FoundryX plugin https://explainx.ai/blog/microsoft-foundryx-plugin-github-copilot-foundry-agent-skill-canvas-cli-guide-2026 targets Foundry agents. The TokenEconomizer plugin https://explainx.ai/blog/microsoft-tokeneconomizer-coding-agent-cost-control-plugin-claude-code-codex-copilot-2026 cuts agent token spend. This one targets internal business apps with built-in identity and policy. If you want to know why plugins are becoming the default way to ship tool know-how to agents, see our primer on agent skills https://explainx.ai/blog/what-are-agent-skills-complete-guide and on MCP https://explainx.ai/blog/what-is-mcp-model-context-protocol-guide . Note that this plugin bundles no MCP server, per its README. Compared with building an internal tool in plain React with your own auth, the trade is clear. You give up hosting freedom and accept Microsoft billing. In return, you do not write login code, and admins get one inventory and one policy set. Who should try it - Microsoft 365 shops that want agents to build small internal tools without a security review per app. - Teams already on GitHub Enterprise Cloud that want branch policies and pull request review to apply to agent-written code. - Not a fit yet: consumer apps, teams outside Microsoft 365, or anyone who needs a stable, versioned API today. What people will ask next Do I need a Microsoft 365 Copilot license to run an app? The coverage we found says app users do not need one, and Microsoft Learn lists only Power Apps Premium or Managed Application Copilot Credits as the licensing options. Confirm this for your own tenant, because licensing in preview can change. Can I use my own editor? Yes. Learn states that you can edit code in any IDE and that there is no required editor and no required template beyond the scaffold the CLI creates. Builds and deploys flow from real Git commits, so the usual git add , git commit and git push apply. Can the agent deploy without me? The plugin includes a /deploy command, so an agent can ship an app if you let it. The safer pattern is to keep the agent on /dev and /play locally, review the diff, and run the deploy yourself. This matters more here than in a normal project, because a deployed app can reach live company data through connectors. What stops an agent from adding a risky data source? Per Learn, governance policies such as data source restrictions are enforced automatically by the platform. That is the main pitch: the agent can write the request, but tenant policy decides whether the connector call is allowed. It is a design claim from Microsoft, and we have not tested how strict the enforcement is. Is this the same as Power Apps? Not exactly. It overlaps in licensing, since a Power Apps Premium plan covers app operations, but the build path here is code in Git with an agent, not a low-code canvas. Teams that already use Power Apps should expect two ways to build governed apps for a while. What to watch 1. A rename or merge of the npm packages and a settled install command. 2. A second template beyond vite8 . 3. Independent hands-on reports from developers who run the plugin on a real tenant. 4. Clear Copilot Credit prices for managed apps. Related reading Details are accurate as of November 5, 2026 and come from the repo README and Microsoft Learn; the runtime is in public preview and may change.