Copilot Managed Runtime and Copilot Code

Last week, I attended Microsoft’s Frontier Tour in London, a free event for colleagues in AI leadership where Microsoft run demos, lightning talks, lab exercises, and a keynote about what’s happening in the world of AI at Microsoft.

The boss came too, and at about 2:30pm in the afternoon I received a short series of somewhat cryptic WhatsApp messages from him: “Copilot Managed Runtime.” “Interesting.” “Have a read”.

I’d not booked into any talks on it, and I’d never heard the term before. A few hours later, I realised Microsoft might have quietly solved one of the biggest problems with AI-generated software: building the app is easy now, but somebody still has to run it.

I’m lucky that in previous roles I worked as an IT Manager, and an Infrastructure Manager. I got the opportunity to see loads of cool software get deployed, but also some absolute disasters. Almost all of these applications came under necessary scrutiny because they all raised the same kinds of questions.

• What data do we need to store?
• Where do we store it?
• What infrastructure do we need to deploy?
• How much is it going to cost?
• What happens as the business grows and we need to support more users?
• How do we keep it safe, secure, and reliable?
• How do we manage vulnerabilities?

These questions remain as relevant as ever in the era of AI-generated software. GitHub Copilot, Claude, Codex, Cursor, Lovable, and others - they’ve dramatically reduced the time and expertise required to turn an idea into working software. I’m not convinced that building the software is actually the hard bit anymore. The questions I would’ve asked when I ran IT infrastructure and IT teams haven’t gone away. It’s now trivially easy to build really crappy apps and deploy them to all manner of unmanaged cloud services.

But then Copilot Code came along.

Yesterday, I was on a call with a colleague explaining to her how AI can assist her in her job, despite it being very manual. She showed me a plethora of spreadsheets: trackers, lists, WIP reports, issue logs. She showed me how some of them are stored on file shares on on-premises servers, and that as they’d grown bigger, they took longer to open. She showed me formatting errors, and inconsistently applied formulae. And she showed me how, for her role, some of these spreadsheets were effectively mission critical. She told me that AI was never going to be able to replace them. One of them is the Company Car Tracker, into which she puts the details of every company car on lease, along with the financials, MOT dates, contract end dates, notes on key events (crashes, scratches, lost keys, etc…). If this spreadsheet were to go missing, she’d have to reconstruct it from hundreds of emails, scanned lease agreements, phone calls, Teams messages. Hell on Earth.

So, I opened Copilot Code (in our dev tenant). Using a simple prompt framework, I explained my (temporary) role as SCG’s Fleet Manager. I explained that I needed an app to track our fleet of cars, and I listed the data we wanted to hold: make, model, driver, P11d value, lease value, contract dates, delivery dates, driving licence status. And I watched.

With a conventional AI coding tool, building the application would only have been half the job. I’d still have needed to make decisions about the database, hosting model, authentication, deployment, infrastructure and security. I’d even have to think about the basics: did I want a full fat desktop app, or a lean and responsive mobile-friendly web app? The AI could certainly have helped me make those decisions, and written most of the code, but ultimately they would still have been my decisions. And all the questions I used to ask as an Infrastructure Manager would have come back to haunt me. More importantly, if I hadn’t been a software developer in a past life, I might not even have known which questions I needed to ask.

Copilot Code, on the other hand, built an entire browser-based app. It ran on Microsoft infrastructure associated with our Microsoft 365 tenant, followed our data residency requirements, used our existing Entra deployment for authentication, and sat within our existing tenant-level controls. That’s Copilot Managed Runtime.

Microsoft describe it thus: “Copilot Managed Runtime hosts Microsoft 365 line-of-business applications that automatically inherit organizational governance, security, and compliance controls from the moment they’re created. Whether you build an app through Copilot Cowork, Microsoft Copilot Studio, Copilot Code, or the Copilot Managed Runtime SDK, the resulting app runs in a Microsoft-hosted environment, uses Microsoft Entra authentication, follows tenant governance policies, and is visible to admins in the Microsoft 365 admin center for monitoring and management.” At first glance, I think I’d describe it as the answer to an awful lot of the governance questions that your CISO is going to ask.

That’s the bit I find interesting. The breakthrough isn’t that Copilot can build a CRUD app. AI coding tools have been able to do that for a while. The interesting bit is that I didn’t have to become its infrastructure team afterwards. I didn’t provision a database, create an app registration, choose a hosting platform, build a deployment pipeline or hand the thing over to somebody to patch. The environment in which the application lives is part of the product.

While Copilot Managed Runtime takes care of much of the underlying hosting, identity, governance and operational plumbing, at design-time each iteration of the application is stored in a Microsoft-managed git repository for version control.

There’s an irony here. Generative AI has the potential to create the biggest explosion of shadow IT we’ve ever seen. When anybody can build an application in an afternoon, anybody can also build an application that IT doesn’t know exists. Copilot Managed Runtime feels like Microsoft’s attempt to square that circle: make application development radically more accessible, without making the resulting applications invisible to IT. In other words, the answer to shadow IT might not be stopping people from building things. It might be giving them somewhere governed to build them. And speaking from experience, there are few things IT departments hate more than shadow IT.

Copilot Code is, of course, not the only way to build applications that run on the Copilot Managed Runtime. 20 minutes and 1,100 AI Credits later (around £11), I’d built a lightning fast fleet tracking tool which aligned with most of the expectations of our governance team, required no infrastructure deployment, and could be distributed in a browser. Usage is billed as additional AI Credits.

I’ve made it no secret among colleagues that I think Microsoft missed the mark with Cowork - it’s expensive, often only as good as Copilot Chat, and feels like a rushed effort by Microsoft to match some of the capabilities of Claude Cowork and ChatGPT Work. However, with Copilot Managed Runtime and Copilot Code, I think Microsoft have hit the nail on the head.

I’m genuinely excited to see where Copilot Managed Runtime and Copilot Code go as they move from Preview, through Frontier and towards General Availability.

I don’t think IT, security and governance teams are going to want to hand this capability indiscriminately to every employee. Nor should they.

But put it in the hands of the right people, and something interesting happens. The colleague who has spent ten years maintaining a mission-critical spreadsheet doesn’t need to become a software developer. And the person helping her doesn’t necessarily need to become a database administrator, infrastructure engineer and identity architect before they can replace it.

If Copilot Managed Runtime and Copilot Code deliver on that promise, we might finally be able to end the reign of spreadsheets pretending to be databases.

Sounds like heaven to me.