Managed App Kit Guide: Build Copilot Apps That Last

Copilot Playbook · Managed apps

Build Copilot apps that last

Copilot Cowork and Copilot Code can build a working business app from a conversation. This kit makes the decisions that keep it working: where the data lives, who can see what, who pays for runtime, and what “ready to share” means.

Open the setup → Download the skill Read the guide

Install the skill, answer the setup form, export your app blueprint, give it to Copilot. No prompt to write.

Publisher, the site that distributes this kit (your app never runs there):

One set of rules drives the setup’s live plan and the skill, so the two can’t disagree.

1 · What you can build

Start from a ready-made app, a pattern or your own idea

Pick one of 89 apps that teams build, start from one of 14 patterns, or describe your own. The setup opens with as much filled in as we know, so you start from a plan instead of a blank form.

What it isThree ways into the same setup: 89 ready-made apps in 13 roles, 14 app patterns, or a short interview about your own idea. Every answer stays yours to change.
What you doChoose your role and click the app nearest yours. The setup opens with its screens, roles, data and flows filled in. Nothing close? Describe your own app.
Watch outRisk, credits and tool on each card are estimates for typical answers, worked out by the setup’s own rules; credits count calls only. Your answers decide the real plan.

Ready-made apps by role

The gallery of 89 ready-made apps needs JavaScript on this page. Open the setup to browse them by role there.

Each card is a starting plan: screens, roles, a data source with its columns and statuses, flows and typical usage. Choosing one opens the setup with those answers filled in. Nothing names your tenant, sites or people; you add those.

The badges are worked out when the gallery is built, by running each app through the same rules as the setup’s live plan, so a card can’t claim something the setup would contradict.

On the card	What it means
Medium or high risk	The plan’s risk level for the typical answers. It sets the release bar: 90 for medium, 95 for high.
About N credits/month at 25 users	25 users × the app’s typical sessions a day × calls per session × 21 workdays × 0.1 credit per call. It counts calls only, so it’s a floor; the per-launch charge isn’t published.
Usually built with	The tool the setup recommends for the typical answers: Cowork, or Cowork and Code. Who builds it and how experienced they are can change it.

All 89 apps fit the default admin policy: none needs an admin exception as planned. Partners and channel apps are for your internal staff, because partners can’t open managed apps.

The ideas come from Microsoft Learn sample templates, Microsoft customer stories, other app galleries (for demand, not copied) and community posts, researched on 7 November 2026.

Fourteen app patterns

Know the shape but not the use case? Each pattern pre-fills the usual screens, roles and data source. The badges show the usual source and add-ons, not limits. Choose Something else for a blank plan.

TrackerTrack items through statuses: tasks, issues, renewals, certificationsSharePoint listSaved views Request and approvalPeople submit requests, approvers decide, everyone sees statusSharePointApproval flow Intake and triageCollect submissions and route them to the right ownerSharePointAttachments DashboardRead-only numbers from Power BI, SQL or lists, with drill-downPower BIExport PipelineAccounts, contacts and opportunities on a boardDataverseOutlook drafts Directory or portalSearchable people, partners or resourcesSharePointFavorites Field inspectionPhone-first forms with camera, location and signaturesCameraMapsPDF Check-in kioskVisitor or event check-in on a shared deviceQR scanPrint SchedulerBookings and capacity with conflict checksCalendarReminders Inventory and assetsCheck-out, check-in, audits and scanningBarcodeExcel import Knowledge hubSearch articles and ask questions, with cited answersSharePoint libraryAI add-on AI workspaceBriefs, drafts and insights from your own Microsoft 365 dataWork IQAI add-on Training or gameLessons, quizzes, scores and certificatesScoresCertificates Something elseStart from a blank planCustom

Choosing a card fills these answers in the setup. Change any of them; the live plan updates as you go.

Archetype	Screens	Data	Roles
Tracker	Home, List, Detail, Form, Help	SharePoint list, own permissions, Contribute	Member (view, create, edit anything); Owner (view, edit anything, administer, export)
Request and approval	My requests, New request, Request detail, Approval queue, Dashboard, Help	SharePoint list, item-level: people see and edit only what they created	Requester (view, create, edit their own); Approver (view, approve, export)
Intake and triage	Submit, Triage board, Detail, Admin	SharePoint list, item-level: people see and edit only what they created	Submitter (view, create, edit their own); Triager (view, edit anything)
Dashboard	Overview, Drill-down, Detail, Help	Power BI semantic model, read only at the source	Viewer (view, export)
Pipeline	Accounts, Contacts, Opportunities board, Detail	Dataverse table, Dataverse security roles	Seller (view, create, edit their own); Manager (view, edit anything, export)
Directory or portal	Search, Profile, Map, Favorites	SharePoint list, read only at the source	Viewer (view); Editor (view, edit anything)
Field inspection	Today, Inspection form, Photo capture, Map, Sync status	SharePoint list, item-level: people see and edit only what they created	Inspector (view, create, edit their own); Supervisor (view, approve, export)
Check-in kiosk	Welcome, Look-up, Badge, Admin	SharePoint list, own permissions, Contribute	Kiosk (view, create); Organizer (view, edit anything, administer)
Scheduler	Calendar, Booking form, My bookings, Admin	SharePoint list, own permissions, Contribute	Booker (view, create, edit their own); Admin (view, edit anything, administer)
Inventory and assets	Search, Item, Check out and in, Audit, Scan	SharePoint list, own permissions, Contribute	User (view, create); Asset manager (view, edit anything, export)
Knowledge hub	Search, Article, Ask, Feedback	SharePoint document library, read only at the source	Reader (view); Author (view, create, edit their own)
AI workspace	Brief, Compose, Insights, History	Work IQ, read only at the source	User (view, create, edit their own)
Training or game	Lessons, Quiz, Leaderboard, Certificate	SharePoint list, item-level: people see and edit only what they created	Learner (view, create, edit their own); Coach (view, export)
Something else	None: you add them	Decided for you by the plan	None: you add them

Data shows the starting source and its SharePoint permission level. Roles show what each role can do in the app.

Describe your own app

In the setup

The app interview

First, describe the app in your own words, as you’d explain it to a colleague. Then answer short, plain questions, each with Later: what it keeps track of, its stages, who uses it, who approves, who is told and how sensitive it is. The setup shows what it filled in, then you carry on with the ten steps.

Describe your app →

Rather talk it through?

Draft it with Copilot

In the interview, the Copy a prompt for Copilot button puts your description and answers so far on the clipboard. Paste it into Cowork with the skill installed: the skill runs its intake interview and returns a blueprint. Load that file back into the setup and review every answer. Nothing leaves your browser except what you paste.

Open the interview

What managed apps can’t do yet

People ask for these, but managed apps can’t do them today. Each card says what to build instead, so nobody wastes a build.

2 · How it works

From this page to a released app in five steps

You make the decisions once, in the setup. The skill turns them into project files, a plan you approve and guided build passes in Copilot Cowork or Copilot Code.

What it isFive steps: learn, configure, export, hand it over, then build, release and run. Steps 1 to 4 are yours; from step 5 the skill guides Copilot through the build.
What you doCheck your level’s prerequisites, answer the setup in about 20 minutes, export the blueprint, then attach it in Cowork or Code and say one sentence.
Watch outNothing is created before you approve the plan, nothing ships below the release bar, and nothing is shared without your yes.

Learn
About 5 minutes

You do
Read this page and check the prerequisites for your level.
The kit does
Shows what you can build, the three levels and which tool fits.
Configure
10 steps, about 20 minutes

You do
Answer ten short steps. Choose Later for anything you don’t know yet.
The kit does
A live plan shows the tool, risk level, release bar, blockers and cost.
Export
One download

You do
Download your app blueprint (one JSON file), the IT checklist and kickoff prompts.
The kit does
Refuses a blueprint that contains a password, key or token.
Hand it over
One message

You do
In Cowork or Code, attach the blueprint and say “Set up my app from this blueprint.”
The kit does
Checks it, shows a plan with blockers, tool, risk and cost, then waits.
Build, release, run
Five build passes

You do
Approve the plan, review each pass, and say yes to publish and share.
The kit does
Writes your day-zero files, guides the build, runs the release check.

Before anything is built, the skill checks the blueprint, shows the plan and waits for your approval. Then it writes the day-zero pack: 26 files for the deal-desk example in the kit, in the folders below.

Then it guides the build in five passes

Navigation shell, with empty, loading and error states.
Read real data.
Writes, with checks and tests.
Integrations, with flows reacting to rows the app writes.
Polish and accessibility.

After each pass: checks, screenshots and an updated HANDOFF.md. Unfinished work ships behind a switch in src/features.ts that is off by default.

Step	Who	What happens
1 · Learn	You	Read the guide; check prerequisites
2 · Configure	The setup	10 steps, about 20 minutes; live plan; Later allowed
3 · Export	The setup	App blueprint .json, IT checklist, kickoff prompts
4 · Prerequisites	IT, admin and site owner	Spending policies, app creation, environment
5 · Attach and ask	You	“Set up my app from this blueprint.”
6 · Validate and plan	The skill	Secrets, gaps, tool, risk, bar, blockers, cost; then it waits
7 · Data and access	IT, admin and site owner	Lists, permissions, exceptions, one security group
8 · Build in 5 passes	The skill	/app or Code; checks, screenshots and HANDOFF each pass
9 · Approve	You	Yes at the bar: publish, then share
10 · Release run	The skill	Score with evidence; confirm live; log
11 · Use it	App users	Play link; consent once; feedback button
12 · Change something	You	Edit the blueprint, revision +1, re-plan
13 · Operate	The skill	Weekly Cowork health check; quarterly review

Gates: nothing is created before the plan is approved (6); nothing ships below the bar (10); nothing is shared without a yes (9). Loop: changes go back through the blueprint (12), so the files, the plan and the app stay in step.

3 · Choose your level

Personal, team or governed department app

The level is set by who will use the app. It decides the data, the sharing, the quality bar and what you need from IT before you start.

What it isThree levels, from an app for you alone to one a whole department relies on. Each sets the data, sharing, quality bar and prerequisites.
What you doPick the level that matches who will use the app. Read its “You need” line, then open its IT list and send it to your admin.
Watch outLevels add up: each needs everything the level before it needs. From Level 2, every app user needs runtime coverage, not only you.

Level 1

Personal app

ForYou, or you and a colleague

Build withCopilot Cowork

DataA list or file you own

SharingNobody, or named people

QualityYour own check

You needCowork access and a spending policy that includes it

Level 2

Team app

ForA team of up to about 25

Build withCowork, with Code as it grows

DataA SharePoint list with its own permissions

SharingOne security group

QualityRelease bar 90 with the owner’s checklist

You needPlus runtime coverage for users

Level 3

Governed department app

ForA department or more

Build withCopilot Code, with Cowork for walk-throughs

DataSharePoint with item-level or flow-written records, or Dataverse

SharingOne security group for the app, the data and licensing

QualityRelease bar 90 to 95, an independent reviewer, security and data-owner sign-off

You needPlus admin exceptions where needed and a shared or production environment

Copilot Cowork access and a spending policy that includes Cowork. Cowork usage is billed in Copilot credits, not included in the license.
Cowork’s App skill (/app) is a Frontier preview: it needs Frontier membership and a personal developer environment.
Managed-app creation allowed for your environment group.

Users can’t enroll themselves in Frontier; an admin chooses All users or Specific users, and new features take up to three hours to appear.

Everything Level 1 needs, plus:

Runtime coverage for every app user: Power Apps Premium, or Copilot credits under a managed-apps spending policy.
One security group for the people who use the app.
A SharePoint list with its own permissions on a team site with a full /sites/ or /teams/ address: stop inheritance once at the list and grant the group Contribute, not Edit.
Copilot Code, if the app grows into it: Frontier membership and a spending policy that includes Code.

Everything Level 2 needs, plus:

A shared or production environment for the app, not a personal developer environment.
Admin exceptions where the plan needs them: SQL Server, Copilot Studio, Power BI queries, third-party MCP servers or outside web addresses.
Dataverse in the environment, if the plan chooses Dataverse (Premium).
Sign-offs before release: an independent reviewer score, a security review and the data owner.
One security group that holds the app sharing, the data permissions and the licensing, so all four access checks line up for one name.

4 · Cowork or Code?

Two tools, one app, and most teams use both

Both tools build the same kind of managed app on the same runtime, and either can load an app the other built. The setup weighs your answers and recommends one, or both, with its reasons.

What it isTwo ways to build the same managed app. Cowork suits first apps and people who don’t code; Code suits bigger apps, several builders and anything that needs tests.
What you doStart where your builder is comfortable, then follow the setup’s recommendation. Use the table to see how each tool starts, publishes and shares.
Watch outCode can’t see the running app in a signed-in browser; Cowork can. Plan a Cowork walk-through before each release, whichever tool leads.

Question	Copilot Cowork	Copilot Code
Best for	First apps, small apps, people who don’t code	Bigger apps, several builders, anything that needs tests
How you start	Ask for an app, or type /app and describe it	Describe it in the Code tab at copilot.cloud.microsoft; Plan mode first
What you see	A preview, and a signed-in Edge browser that can walk the live app	A preview canvas, the code, the diff and test output
Publishing	The Publish button, again after every change	Say “Publish it”; building never publishes on its own
Sharing	Publish, then Share	“Share it with the group so they can use it”

Most teams use both. Cowork shapes the app and checks it in a real browser; Code builds, tests and releases it.

Only Cowork

Walks the live app in Edge
Scheduled prompts
Email and Teams triggers
Up to 50 custom skills
Mobile, Outlook and Teams

Both

The runtime and play link
The app records
Connectors and policies
Plugins and work context
Credit billing for builds

Only Code

Plan mode, model picker
Shell, Git and tests
Folders on your machine
GitHub branches and PRs
Specialist sub-agents

What only Cowork does, what only Code does, and what they share.

The setup scores each answer, then leads with the tool that is ahead by 2 or more points. Within 1 point, it recommends both.

Answer	Code	Cowork
Builder is a developer	+3 points
Builder is new to building		+3 points
Builder has some experience but isn’t a developer		+1 point
More than 25 users, or writes to confidential data	+1 point
More than one session or person changes the app	+2 points
GitHub repository mode	+3 points
Uses the ms CLI, GitHub Copilot CLI, Claude Code, VS Code or GitHub Actions	+2 points
8 or more screens	+2 points
5 or fewer screens		+1 point
Stage is production	+2 points
Stage is prototype		+1 point
Independent reviewer wanted	+1 point
Weekly health routine wanted		+1 point
Attached requirements, process maps or screenshots		+1 point
Two or more integrations (flows, agents, MCP, custom connectors, Power BI in the app)	+1 point

For a builder who isn’t a developer, Both means Cowork leads and Code joins when the app passes about five screens, needs tests or gets a second builder.

Cowork shapes, Code ships

Use Cowork to find the data, the people and the process, and even for the first build. Move to Code once the app has more than a few screens, logic that must be right, or more than one person changing it.

Code builds, Cowork accepts

Code makes each change and runs the scripted checks; Cowork, in Edge, opens the live app as a real user with real data and walks the acceptance checklist; a person signs off.

Studio for the agent, Code for the app

Agents and flows are designed and governed where they live, in Copilot Studio; the app binds to them and tests the contract.

The CLI for the pipeline

When an app needs CI/CD, pinned tool versions, GitHub Actions deployment with a service principal or a third-party build tool, move that part to the ms CLI.

5 · Before you start

What has to be in place, and who does it

Three short lists: yours, your admin’s and your SharePoint site owner’s. Send each person their list before you open the setup.

What it isThe prerequisites for building and running a managed app, grouped by who does each one: you, your admin and your site owner.
What you doCopy or print the checklist and send each group its lines. The setup’s IT checklist later adds anything your own answers need.
Watch outCopilot Code needs Frontier and a spending policy that includes Code. Your admin has to act; it isn’t switched on for everyone automatically.

You

Access to Copilot Cowork.
Access to Copilot Code and Cowork’s App skill, if your tenant is in the Frontier preview. Code also needs a spending policy that includes Code.
A spending policy that includes the tool you’ll use.

Your admin

Managed-app creation allowed for your environment group.
Runtime coverage for app users: Power Apps Premium, or Copilot credits under a managed-apps spending policy.
Exceptions for SQL Server, Copilot Studio, Power BI queries, third-party MCP servers or outside web addresses, if your plan needs them.

Your site owner

A SharePoint team site with a full /sites/ or /teams/ address.
A plain ASCII site name, with no accents or symbols.
Permission for you to create lists on that site.

Managed apps run under a runtime policy that blocks some connectors and outside requests by default. Your plan lists the exceptions it needs; these are the usual ones:

The SQL Server connector.
The Copilot Studio connector, to call an agent.
Power BI Run a query.
Third-party MCP servers.
Outside web addresses, through a content security change.
Custom connectors.

How to ask for one

There is no self-service exception request, so make the admin’s decision easy. Send one message with these fields, and ask for the narrowest change, at the group level.

Field	What to write
App	Name, app id, environment and environment group
Change requested	The exact connector and action, MCP server, or content security directive and origin (copy the blocked origin from the browser console)
Why	The business justification: the outcome and who benefits
Data	Classification of the data that will flow, and its system of record
Scope and duration	Group level or narrower; permanent or until a date; report-only mode first for content security changes
Evidence	Reproduction steps, the blocked origin or error from the browser console, and test results from a preview build
Owner	Builder, backup owner and the admin contact who approved it

The skill writes these requests for you in governance/exception-requests.md. Never look for a way around a blocked connector or policy.

Each person who runs an app needs Power Apps Premium or Copilot credits: 0.1 credit per API call, plus a per-launch charge whose rate Microsoft hasn’t published. Users without coverage are blocked after 20 app operations or five minutes, whichever comes first. Power Apps Premium users are exempt. A Microsoft 365 Copilot license is not required just to run an app.

Coverage is one of four access checks

Open the app (play). Run-only access, granted as the Microsoft App Reader role.
Change the app (edit). Contributor rights on the app’s source repository. Play and edit are independent.
Reach the data. The app calls each source as that person, so someone without access to the list sees an empty screen, not your data.
Pay for runtime. Power Apps Premium, or Copilot credits under a spending policy.

Sharing the app covers only the first two. Share it with the same Entra group that holds the data permissions and the license, so all four checks line up for one name.

6 · Watch-outs

The four things that bite

Four platform rules catch most first apps. None of them is a bug you can fix, so plan around each one before you build.

What it isThe four rules behind most surprises: who can open the app, what sharing grants, what happens without runtime coverage, and how flows start.
What you doCheck each one against your app before you answer the setup. The live plan raises a blocker or warning when your answers trigger one.
Watch outTest with an ordinary colleague’s account, never only your own. Your own rights hide the gaps a real user hits on the first data call.

Who opens it

Guests can’t open managed apps

Even with guest sharing on. Build for your staff and give partners a public page or a shared document.

What sharing grants

Sharing the app isn’t access to the data

The app calls each source as that person. Without rights on the list, they see an empty screen.

Runtime coverage

Blocked after 20 app operations or 5 minutes

Users without Power Apps Premium or Copilot credits are stopped, whichever limit comes first.

How flows start

A flow starts from a row, not a call

An app can’t call a Power Automate flow in a documented way. It writes a row; the flow triggers on it.

Guests can’t open managed apps yet, even when guest sharing is switched on; Microsoft lists it as a known issue.

For partners, use one of three alternatives:

a public page or shared document;
a Power Pages site;
a canvas app with B2B guests.

Keep the managed app for internal staff, and never work around the limit by converting guests into member accounts. The setup marks external users as a blocker.

Access is four separate checks. Sharing the app covers only the first two; data permissions and runtime coverage are checked for every person, every time.

Open the app (play). Run-only access, granted as the Microsoft App Reader role. Environment access and app sharing are separate controls.
Change the app (edit). Contributor rights on the app’s source repository. Granting play never grants or removes edit.
Reach the data. The app calls each source as that person, so someone without access to the list sees an empty screen, not your data.
Pay for runtime. Power Apps Premium or Copilot credits under a spending policy.

Share the app with the same Entra group that holds the data permissions and the license, so all four checks line up for one name.

Every person who runs the app, not only the builder. Each needs Power Apps Premium, or Copilot credits under a managed-apps spending policy: 0.1 credit per API call, plus a per-launch charge whose rate Microsoft hasn’t published.

Without coverage, the app opens but the user is blocked after 20 app operations or five minutes, whichever comes first. Power Apps Premium users are exempt. A Microsoft 365 Copilot license is not required just to run an app.

If a user’s environment, license or data permissions are missing, the app opens but fails at the first data call. Always test with an ordinary colleague’s account.

There is no documented way for a managed app to call a flow. Instead, the app writes a row and the flow reacts to it.

Trigger: SharePoint “When an item is created” or “When an item is created or modified”, or Dataverse “When a row is added, modified or deleted”.
Status column: the app writes a correlation id and Status = Pending; a trigger condition fires only on Pending; the flow sets Processing, then Done or Failed.
Avoid: a browser call to a flow’s HTTP trigger needs a content security exception, and an anonymous HTTP trigger bypasses Entra ID entirely. Don’t build on either.

The skill writes the flow specs for you in integrations/flow-specs.md.

7 · What it costs

Runtime cost, before anyone builds

Building bills the builder’s Copilot credits. Running the app bills each user, through Power Apps Premium or Copilot credits. The estimator below uses the same formula as the setup and the skill.

What it isWhat running the app costs, separate from building it. Each user needs Power Apps Premium or Copilot credits under a managed-apps spending policy.
What you doEnter your expected users and usage for a monthly planning figure, then agree with your admin who pays for runtime and which policy covers it.
Watch outMicrosoft also charges per launch, at a rate it hasn’t published, so the estimate counts calls only. Treat it as a floor, not a quote.

Per API call0.1creditfor each launch, connector read and write

Per creditAbout 1centat pay-as-you-go pricing, as of 7 November 2026

Per launchNot publishedMicrosoft adds a per-launch charge but hasn’t published its rate

Each month, calls only

API calls: –calls
Copilot credits: –credits
At about 1 cent per credit: –a month

The defaults are the setup’s typical usage: 2 sessions a day, 15 calls each. Add the per-launch charge once Microsoft publishes it. Power Apps Premium users have no per-call meter.

Activity	Who pays	How to watch it
Building in Cowork	The builder’s Copilot credits, under the Cowork spending policy	/cost in the task
Building in Code	The builder’s Copilot credits, under the Code spending policy, with per-user spend limits	Copilot cost management. A /cost command is not documented for Code
Building in Copilot Studio	The environment’s Copilot Studio billing, from the first draft, set up in the Power Platform admin center	Power Platform admin center
Building with the CLI	No license needed, except to run the app locally	Not applicable
Running a managed app	Each user: Power Apps Premium, or 0.1 credit per API call (launches, connector reads and writes), plus a per-launch charge whose rate is not published, under a managed-apps spending policy	Copilot, Cost management
Work IQ calls from an app	Copilot credits, billed separately even for Premium users	The same spending policy, and admin billing reports

The bill is driven by chatty apps, so cache reads, avoid polling and load data on demand.

8 · What’s in the kit

The setup, the skill, the pack and the guide

Four parts that work together. Download the skill once; the setup runs in your browser and exports the blueprint the skill reads.

What it isEverything the kit includes: the setup page, the skill for Cowork and Code, the day-zero pack it writes, and the full practitioner’s guide.
What you doDownload the skill and install it once in Cowork; Code sessions use the same install. Then open the setup and export your blueprint.
Watch outThe full handbook publishes after Microsoft Ignite, in late November 2026. Until then, this page and the skill’s own references carry its rules.

Item	What it is
The setup (configurator)	Ten steps, a live plan, export of your app blueprint, IT checklist and kickoff prompts
The skill	td-synnex-managed-app for Copilot Cowork and Copilot Code; install once, use in both
The day-zero pack	26 files the skill writes from your blueprint: README, DESIGN, DECISIONS, QUALITY-RUBRIC, prompts, list specs, a provisioning script, a sharing plan, an IT checklist
The guide	Building Managed Apps with Copilot Code and Copilot Cowork, the full practitioner’s guide

The skill

td-synnex-managed-app-skill.zip · 180 KB

Upload it in Cowork under Customize, Skills, or copy the folder into OneDrive. One install serves Cowork and Code.

Download the skill

The whole kit

td-synnex-managed-app-kit.zip · 393 KB

The skill, the setup page to run offline, the four example blueprints with their expected plans, and the sample 26-file day‑zero pack.

Download the kit

The full guide

The practitioner’s handbook · coming soon

The full handbook publishes after Microsoft Ignite, in late November 2026, as web chapters you can read and share.

After Ignite, late November 2026

Cowork: Customize, Skills (labelled Agents & Plugins in newer builds), upload the skill’s zip. Or copy the folder to OneDrive, Documents/Cowork/skills/td-synnex-managed-app/.
Code: nothing extra. Personal skills installed for Cowork loaded in Code in the tenant tested. Start a new Code session after installing.
GitHub Copilot or Claude Code: copy the folder into your repository under .github/skills/ or .claude/skills/.
Your whole team: share the skill with named people from Customize; Re-share sends them the latest version.

If something goes wrong

The skill doesn’t appear: start a new session; check the folder name is exactly td-synnex-managed-app and SKILL.md is inside it.
It found a secret: remove the value from the blueprint and rotate it if it was real.
Blocker, external people: managed apps can’t be opened by guests. Keep the app internal and give outsiders a page or document instead.
The script won’t run: the skill falls back to its written rules; ask it to “plan by hand”.

9 · Questions

What partners ask before they start

Short answers to the ten questions that come up most, from guest access and runtime cost to the App Builder retirement.

What it isThe ten questions partners ask most, from who can open the app and what it costs, to what happens to App Builder apps on 30 November 2026.
What you doOpen a question for its short answer. If yours isn’t here, ask Copilot once the skill is installed; it carries the rules behind every answer.
Watch outFacts are current as of 7 November 2026. Copilot Code and the App skill are Frontier previews and change often, so recheck before you commit.

Can partners or customers open the app?

No. Managed apps can’t be opened by guests. Build the internal app for your staff, and give outsiders a public page or a shared document.

Do I install the skill twice for Cowork and Code?

No. It lives in your OneDrive skills folder; Cowork reads it and, in the tenant tested, Code sessions load it too. Start a new session after installing. That Code loads it was observed in one tenant, not documented, so every blueprint also carries its own fallback instructions:

This is an app blueprint for a Microsoft Copilot managed app. It holds decisions, not secrets. If the td-synnex-managed-app skill is installed, use it. If not: plan only and don't build yet; check every field, list what is marked later, recommend Cowork, Code or both, flag blockers (guests can't open managed apps; SharePoint tables need a full /sites/ or /teams/ address), then propose README, DESIGN, DECISIONS, QUALITY-RUBRIC, RELEASE-LOG, HANDOFF and src/features.ts and ask before creating anything.

What does it cost to run?

Each user needs Power Apps Premium or Copilot credits under a managed-apps spending policy, at about 0.1 credit per call, plus a per-launch charge Microsoft hasn’t published. The setup estimates a monthly figure from your usage answers; it counts calls only, so treat it as a floor. Try the estimator.

Do app users need a Microsoft 365 Copilot license?

Not just to run an app. They need runtime coverage as above.

Why does sharing the app not show anyone the data?

Sharing grants access to the app only. Each person also needs rights on the data source, because the app calls it as that person.

Can the app call a Power Automate flow?

Not directly in a documented way. The app writes a row and the flow triggers on it.

Can I put it in Teams?

Post the link in a channel. Pinning a managed app as a tab isn’t documented.

What happens to my App Builder apps?

App Builder retires on 30 November 2026. From 4 November, one-click Migrate app moves an app’s screens, navigation and logic to Apps in Copilot Studio. Moving to Cowork is a manual rebuild from the downloaded source: in Cowork, say “I’m migrating my app. I built this app.” for a faithful rebuild, then share it again. Sharing links don’t carry over; your data stays where it is.

Is my data safe in the blueprint?

The blueprint holds decisions, not secrets. The setup and the skill both refuse a blueprint that contains a password, key or token.

What if I don’t know an answer?

Choose Later. The skill asks for it only when a step needs it.

Not sure what your app is yet? Describe it in your own words and the setup’s interview asks the rest.

Managed App Kit Guide

Build Copilot apps that last

Start from a ready-made app, a pattern or your own idea

Ready-made apps by role

Fourteen app patterns

Describe your own app

The app interview

Draft it with Copilot

What managed apps can’t do yet

From this page to a released app in five steps

Learn

You do

The kit does

Configure

You do

The kit does

Export

You do

The kit does

Hand it over

You do

The kit does

Build, release, run

You do

The kit does

Then it guides the build in five passes

Personal, team or governed department app

Personal app

Team app

Governed department app

Two tools, one app, and most teams use both

Only Cowork

Both

Only Code

Cowork shapes, Code ships

Code builds, Cowork accepts

Studio for the agent, Code for the app

The CLI for the pipeline

What has to be in place, and who does it

How to ask for one

Coverage is one of four access checks

The four things that bite

Guests can’t open managed apps

Sharing the app isn’t access to the data

Blocked after 20 app operations or 5 minutes

A flow starts from a row, not a call

Runtime cost, before anyone builds

Monthly runtime estimate

The setup, the skill, the pack and the guide

The skill

The whole kit

The full guide

If something goes wrong

What partners ask before they start