Field Evidence, Troubleshooting, Templates

Chapter 8 of 830-minute readParts 24–29Facts current as of 7 November 2026

Evidence tagsD DocumentedO ObservedC CommunityI Inference

Every claim in this handbook carries a tag, so you can tell documentation from observation from opinion.

DDocumented. Documented by Microsoft on Learn, Support, Message center, GitHub or an official blog, as of the dates in Appendix E
OObserved. Observed first-hand on 7 November 2026 in a live Copilot Code cloud session: its tools, its sandbox, an example tenant's policy verdicts, and the repository of a production partner-sales app
CCommunity. Reported by the community (MVP blogs, forums, videos, GitHub issues) and not confirmed by Microsoft
IInference. Inference or recommendation by the author; test it before you rely on it

Part 24

Case study: four days, 53 commits, one production app

What it isAn anonymised case study of a production partner-sales app built with Copilot Code: its numbers, how it was run and what it taught.
What you doCopy the habits that worked: a spec per initiative, a rubric read every session, scored and logged releases, and tested read-only guards.
Watch outVisual checks were the bottleneck, and overrides of the release bar must be logged with the evidence still owed.

The app behind most of the O evidence in this guide is a production partner-sales app: an opportunity tracker, an email workspace, customer and contact views, and a read-only view of data another team owns. It was built with Copilot Code, released from parallel sessions, and examined read-only for this guide on 7 November 2026. O

The case-study app by the numbers

Units: as labelled on each tileSource: section 24.1Evidence O

4 days, first commit to 7 November4 to 7 November 2026O section 24
53 commits in those daysFrom parallel sessionsO section 24.1
576 files under version control477 app source, 69 tests and toolsO section 24.1
495 tests passingPlus a screen check and a release scanO section 24.1

Show the data

Item	As stated	Unit	Evidence	Part	Source
days, first commit to 7 November	four days, 53 commits	days	O	24	In the part text
commits in those days	\| 53 \|	commits by 7 November 2026	O	24 (24.1)	In the part text
files under version control	576	files under version control	O	24 (24.1)	In the part text
tests passing	495 passing	tests passing	O	24 (24.1)	In the part text

24.1

By the numbers

Measure	Value
First commit	4 November 2026
Commits by 7 November	53
Files under version control	576, of which 477 are app source and 69 are tests, fixtures and tools
Bound connectors	SharePoint, Office 365 Outlook, Office 365 Users and the Work IQ Copilot MCP connector
Tests	495 passing in the latest local run, plus a screen check and a release scan
Release bar	90 out of 100 with hard gates (rubric version 2.1)
Libraries added beyond the template	None

24.2

How it was run

Each initiative had its own spec in the repository: a single-email specification with seven staged releases behind switches, and a separate plan for a combined partner view. The rubric was read at the start of every session that changed the app, every release was scored and logged, and when the agent had no browser it posted a preview checklist for the owner instead of claiming a visual check it had not done. Hard rules that had to survive across sessions, such as never writing to another team's system, were kept both in the code (as a tested read-only guard) and in saved memory. O

24.3

What went right

The old email composer is being retired in planned stages; the first stage went live with every switch off and scored 91.
Tests and the release scan caught regressions before users did.
The fetch-first habit found "lost" work twice, already live from another session.
The read-only boundary with another team's system held, enforced by code and a test.

This is the app's own Work IQ pattern, the canonical copy of which sits in section 14.4.

24.4

Lessons

Visual verification was the bottleneck. Most releases lost points only on preview items because no agent browser was available; scripted Chromium screenshots and a Cowork walk-through would close most of that gap. OI
The bar only works if overrides are visible. Two releases shipped below 90 by a logged owner override, and both are logged with the evidence still owed. O
Direct pushes were refused in some sessions, so the one-call publish became the normal release path. O
A layout squeeze at about 900 pixels has sat in the known-issues backlog; known issues need owners and dates like anything else. O
The repository is approaching the size at which others have reported fetch errors; plan for it rather than discovering it during a release. OC

Part 25

What people are building

What it isPublic builds, costs, habits, pain points and comparisons reported by the community, with each source named.
What you doUse these reports to set expectations and budget per app, and build the data layer before the screens.
Watch outCommunity reports are not confirmed by Microsoft, and entries marked unverified have no source link in the research.

Public evidence is still thin for the newest tools. Copilot Code began rolling out to Frontier tenants in late October, and Copilot Studio Apps coverage is mostly licensing explainers, so most hands-on reports concern Cowork's App skill and the older App Builder agent and Power Apps tools. Searches found no meaningful Reddit, Hacker News or X discussion of these products as of this edition. C

What whole-app builds have cost, against per-task planning bands

Units: Copilot credits per build, log scaleSource: section 25.1, section 2.3Evidence C C · unverified

Hollow dots are community figures with no source link in the research (marked unverified in section 25.1). Budget per app, not per task.

Show the data

Item	As stated	Unit	Evidence	Part	Source
Space Invaders, Copilot Code (unverified)	267	credits	C	25 (25.1)	In the part text
Frogger, Copilot Code (unverified)	374 credits	credits	C	25 (25.1)	In the part text
Time tracker rebuild, Copilot Code	669 credits	credits	C	25 (25.1)	Source
HubSpot-style CRM, Copilot Code	5,415 credits	credits	C	25 (25.1)	Source
Per-task planning bands	25 to 200-plus credits	credits per task (planning bands)	C	2 (2.3)	Source

25.1

Notable builds

Build	Tool	What stands out	Reported by
SharePoint CRM with a drag-and-drop pipeline, company and contact workspaces, activities and a dashboard	Cowork App skill, with the lists created by Copilot in SharePoint from a Markdown schema	Built in a little under an hour for about US$46.54 in credits, from an as-built schema document	Daniel Anderson, 11 Sep 2026
Project Delivery Command Center on a live SharePoint list, with search, filters and write-back	Cowork	Includes an admin and governance walkthrough	Reza Dorrani, YouTube, Oct 2026
A team suite: scrum, scheduling, career management and AI adoption maturity	Cowork	Plus a custom skill that writes the documentation, a training deck and an accessibility report	Clay Wesener, Microsoft, Sep 2026
An agent-driven CRM: a Cowork plugin writes records and a managed app displays them	Cowork plugin and managed app	Asked Microsoft for deep links into a record, which are not supported yet	GitHub issue 60, 5 Nov 2026
A Cowork-built app extended with about 1,000 GitHub Copilot agent, instruction and skill files	Cowork, then developer tooling	Then hit a repository fetch error	GitHub issue 48, 29 Oct 2026
Tic-tac-toe and a potluck organizer	Cowork	A tour of where apps are saved and of connector, sharing and CSP settings	Daniel Christian, 18 Oct 2026
A street-racing game, a gamified adoption app with quests and XP, and room booking from a floor-plan image	Power Apps code apps and vibe	Minutes per build	Markus Franz, conference recap
A personal Power Platform admin center, "100% AI coded"	A code app with an external coding agent	Roles from Excel, solution deployments, flow runs	David Wyatt, 14 Jun 2026
Bid management on Dataverse with an email-triggered workflow and an evaluation agent	Copilot Studio	App, flow and agent designed together	Microsoft Mechanics, 6 Oct 2026
One app moved from Cowork to Code to Copilot Studio	All three	A live demonstration of the shared runtime	Microsoft demo, 21 Oct 2026
A HubSpot-style CRM: 13 lists and 3 libraries, drag-and-drop deals and activity linking	Copilot Code, plan mode first, on SharePoint	Plan mode returned the information architecture in about two minutes; the build cost 5,415 credits (about US$54)	Daniel Anderson, 23 Oct 2026
A canvas time tracker rebuilt as a managed app: 7 Dataverse tables, 5 screens	Copilot Code with effort set to High	Built from an attached spec, an ERD and screenshots in under an hour for 669 credits	Nick Doelman, 24 Oct 2026
An equipment-loan app on a SharePoint list	Copilot Code	Rebuilt from a canvas app in about 10 minutes, with a cost comparison against Power Apps Premium	Powercademy; Can Dedeoglu, 2 Nov 2026
Space Invaders and Frogger	Copilot Code	Playable games for 267 and 374 credits	Daniel Anderson, Oct 2026 C · unverified
Apps calling Copilot Studio agents, a Fabric SQL database and Power BI semantic models	Code and the CLI	Integration-heavy builds, each of which ran into a policy or harness limit first	GitHub issues, Oct to Nov 2026

25.2

What successful builders have in common

They build the data layer first and hand the agent an as-built schema.
They name every list, table and site explicitly.
After each test action they open the backing list; it shows the bug before the screen does.
They plan first and work in passes, testing each pass before saying "Continue".
They watch cost as they go, with /cost in Cowork.
They keep an exit: source they can export, and data in SharePoint or Dataverse that they can open themselves.
They test sharing with an account that doesn't own the app.

25.3

Pain points people report

Re-check after Ignite

Apps that look finished before the data actually saves.
People pickers that don't resolve users.
Confusion about licensing and runtime credits for the people who use the app.
The contradiction in the documentation about whether sharing an app shares its data.
Churn: the App Builder agent and vibe.powerapps.com retire on 30 November 2026; one-click Migrate app goes to Apps in Copilot Studio only, and moving to Cowork is a manual rebuild D; and the SDK packages are being renamed.
CLI and SDK rough edges: an ambiguous Dataverse connector option, no agent-runtime operation for calling Copilot Studio agents, clone problems on macOS, route errors.
No deep links into a specific record or page.
No app events seen in the Purview audit log yet.
Agents quietly creating mock data locally that "looks great until you realize nothing is hitting Dataverse"; ask every build summary to confirm it uses live data only. C
Whole-app builds costing far more than per-task planning bands suggest: 669 and 5,415 credits against bands of 25 to 200-plus credits per task. C
Testing against a separate test database isn't possible inside one app, because a managed app always uses the data source configured during development. C

25.4

How people compare it

Against consumer tools such as Lovable and Bolt, the most-quoted verdict, from Daniel Anderson, is that a Copilot-built app runs inside Microsoft 365 under your own permissions, with its data in lists you can open yourself. C Lovable itself now deploys into Microsoft tenants through the Copilot Managed Runtime SDK, which makes the runtime, not the builder, the thing being compared. D Against developer agents, one commercial commentator (Ritesh Agarwal, Appycodes) argues the real advantage is work context, and the real gap is everything a business user doesn't think to specify: row access, validation, audit and rollback. C Skeptics advise treating early Copilot Studio drafts as sketches (Helen Jones, Collab365). No credible head-to-head comparisons with v0, Replit, GitHub Spark or Retool were found. C

Against Power Apps canvas apps: "Power Apps is not dead, at least not yet," with open questions about ALM, sharing control and Dataverse security roles (Nick Doelman). Others describe managed apps as an evolution of Power Apps code apps on the Microsoft 365 side (Sean Astrakhan). C
On governance: Copilot Managed Runtime moves governance from the build tools "to the place their code runs," with a Power Platform environment behind every app (Holger Imbery). C
On maintenance: these are real code apps whose dependencies age, so someone has to own updates (an Ask HN thread); and "the gap is everything a business user cannot be expected to specify" (Appycodes). C
On cost: builders now pay too, because Microsoft won't let the builder become a free model endpoint (Jukka Niiranen); and Microsoft 365 or Dynamics 365 use rights don't cover running these apps (Holger Imbery). C

Part 26

The frontier: patterns almost nobody is using yet

What it isThirty-two app patterns built from documented or observed pieces that almost nobody uses yet, plus what isn't possible today.
What you doPick a pattern, run the check in its last column in your tenant first, and ask for any admin exception early.
Watch outEvery pattern needs a tenant test, and several depend on actions or connectors outside the default policy.

Every pattern below is built only from documented or observed pieces, but almost none appear in public examples yet. Each needs a tenant test, and some need an admin exception; the last column says what to check first. I

Filter 32 rows

Pattern	Building blocks	Check first
1. Field inspection kit: photo, barcode, signature, PDF report	Template camera, barcode and pen controls; PDF export; a SharePoint list and library	Camera permission in the player and on phones; attachment sizes
2. Asset check-in kiosk	Barcode control, a Dataverse or SharePoint table, keyboard shortcuts	How a shared device signs in
3. Work IQ brief beside every record	Work IQ Copilot MCP connector, Office 365 Users, the record's list	Latency (timeouts, retries, cache) and Work IQ billing
4. Draft-and-approve outreach desk	Outlook connector (draft, read back, update, send), recipient guards, an outreach log list	Send checks on every path; do-not-contact data
5. Read-only cockpit over another team's system	Table-mode bindings with read-only adapters and tests	The data owner's agreement; a kill switch
6. Permission-trimmed case workbench	Dataverse with security roles; SharePoint documents	Roles set before launch
7. Meeting-to-commitment tracker	Outlook calendar, Planner, Teams, a SharePoint status list	Which actions are allowed
8. Release readiness cockpit	Azure DevOps connector, Planner, Teams, Dataverse decisions	Azure DevOps actions allowed in the policy
9. Bookings exception desk	Microsoft Bookings, Outlook, an exceptions list	Bookings operations allowed
10. Policy attestation tracker	SharePoint policy files, Dataverse attestations, Outlook reminders	Server-side permissions on attestations
11. Analytics with write-back	Power BI ids looked up in Code; Dataverse or SharePoint for decisions	Framing in the content security policy; Power BI licensing
12. 3D product or part viewer	Template 3D viewer reading glTF or STL from SharePoint	File sizes
13. Training quest or adoption game	three.js in the template, a scores list	Keyboard and screen-reader access
14. Daily self-test by Cowork	A Cowork schedule plus browser use: open the play link, check totals, post results to Teams	Admin opt-in for browsing; credits
15. App, agent and flow together	A Copilot Studio agent and a Power Apps-trigger flow, bound from the app	Flow binding for managed apps is undocumented; the Copilot Studio connector needs an exception
16. Pilot rings for features	Feature switches read per user or group from a SharePoint config list	New code still needs a release
17. Personal store per user	A JSON file in each user's OneDrive with a local cache	Merge rules across devices
18. Spec-to-test traceability	Numbered DESIGN.md items mapped to tests; the release scan fails on unmapped items	Discipline
19. Scripted visual regression	Chromium screenshots of every route at two widths, compared release to release	Fixture data and flaky renders
20. Help desk grounded in Microsoft Learn	Microsoft Learn Docs MCP server	Public documentation only
21. Fabric-backed analytics app	Fabric MCP server	Which operations your admins allow
22. Bring your own build	ms CLI with --repo none and external artifacts	Off by default; you own supply-chain checks
23. Goal check-in desk on Power BI scorecards	Power BI connector actions to read goals, create check-ins and add notes; no freeform queries needed	Scorecard permissions; which goal actions your policy allows
24. One-click board pack	Power BI "Export To File" for a filtered report, then an Outlook draft with the PDF attached	Export needs capacity-backed workspaces; keep sending as a draft
25. Refresh-after-entry	The app writes adjustments, then calls the Power BI "Refresh a dataset" action so the report catches up	Refresh limits per day on your capacity
26. Agent quality console	Copilot Studio connector actions to run evaluation test sets and read test runs	Copilot Studio connector needs a runtime exception
27. Cowork night shift	A Cowork scheduled prompt reads the app's list each morning, posts overdue items to Teams and drafts follow-ups for approval	Include record ids in messages, since record deep links aren't supported
28. Inbox-to-app intake	A Cowork event trigger on matching mail creates a record; the managed app is the review screen	Triggered actions draft for approval by default
29. Project as the app's memory	One Cowork Project holds the spec, ERD, as-built schema and instructions, which take precedence over global instructions	Files can't yet be removed from project outputs
30. Release-pack skill	A custom skill that writes release notes, a training deck and an accessibility report for each version	Skill limits: 50 skills, 1 MB per SKILL.md
31. 3D and maps inside the default policy	Bundle three.js locally; draw static SVG maps instead of loading tiles	Worker-based loaders and tile servers need admin-approved origins
32. Fabric-backed app data	The plugin's feature-gated backend workflow stores data in Fabric so Power BI can report on it	Preview, and announced rather than shipped in Copilot

26.1

Not possible today, and what to do instead

Offline use or an installable app: service workers are blocked by the default content security policy. D
Direct calls to arbitrary web APIs: they need an admin-approved origin, and "Send an HTTP request" actions are blocked by default. D
Deep links into a specific record or page: not supported yet; show a recent-items list on the home screen. C
A dev, test and production pipeline for one app: only preview and live exist; use feature switches or a second app for user testing. DI
Microsoft Graph from app code: no token path is documented; use connectors. DI
Embedding the app in Teams or SharePoint: not documented for managed apps, and framing needs admin changes to the content security policy. D

Guest and partner access is the most common request on this list, so the alternatives are spelled out here.

Part 27

Troubleshooting and known limits

What it isCommon symptoms, their likely causes and fixes, and the known limits of this edition.
What you doFind the symptom in the table, apply the fix, and read the related part for detail before you escalate.
Watch outSome causes come from community reports, so read the evidence tag before you treat a fix as settled.

Filter 30 rows

Symptom	Likely cause	Fix
The app looks done but nothing saves	The source was never bound, so screens run on sample data	Ask which screens use sample data, bind the source by its exact name, then check the list after a test save
A connector shows as allowed but calls fail with 403	Runtime connector policy, a blocked action, or mixed connector policy and DLP	Check the environment group's connector rule and the action toggles with your admin
Something silently doesn't load	The content security policy blocked it	Read the browser console's CSP message and ask for one narrow origin to be added
Users see a consent prompt or "connection needed"	First open, or an expired connection	Approve once; owners check connection status before releases
A user can't open a shared app	Not in the environment security group, a guest, or no license or credits	Check the group, the user type and the spending policy
Users are blocked after a few minutes	No Power Apps Premium and no runtime credits	Assign Premium or add them to a managed-applications spending policy
The live app doesn't show the change	Built or pushed but not deployed, or an older commit deployed	Deploy the remote tip and confirm on the live link
A deploy shipped an older version	The latest build failed and the deploy fell back to the last good build	Read the build log, fix, redeploy the intended commit
git push refused as "disabled"	The session blocks direct pushes	Use the one-call publish, which pushes, builds and deploys
Fetch fails with an I/O or write error	Workspace file system or repository size	Retry with core.logAllRefUpdates turned off; keep an eye on the object count
Environment setup in progress	Your developer environment is being created on first use	Wait about two minutes and retry
A tester can't open the preview	The preview needs repository write access	Test on live behind a feature switch, or give edit access only to co-owners
A Work IQ panel spins forever	Long-running calls or throttling	A three-minute timeout, one retry on 429 or 5xx, a per-user cache and a visible error
A Dataverse table can't be found	Personal developer environments start without Dataverse	Add Dataverse to the environment in the Power Platform admin center
Excel data stops at 256 rows	The connector's default page size	Page through results, or move the data to a list or table
You can't link to a specific record	Deep links aren't supported yet	Link to the app and show recent items on the home screen
Two sessions keep undoing each other	No locking, overlapping scopes	One scope per session; fetch and rebase; handoff notes
A method you expected is missing from generated/	Policy filtered the operation out before code generation	Check the connector's action-level policy; ask for an exception (section 16.7) or use another action
Works in the local loop, fails after publishing	A Conditional Access challenge or consent the hosted app hasn't got	Test the published preview with an ordinary user; read the status code and response body together
Only some recipients were shared	Unresolved email addresses are skipped with a warning	Re-run with object ids and check `ms app share list --access play`
The SharePoint binding is refused	Root site, OneDrive or an unusual site URL	Move the list to a plainly named site under /sites/ or /teams/
The app can't call a Power Automate flow	The Logic flows connector is blocked or not on the runtime allow-list	Have the app write a record that triggers the flow instead (Part 13)
The play link shows RouteNotFound but the preview link works	An open platform issue reported in some regions	Test with the preview link and report the app id on the GitHub repository C
Power BI "Run a query" isn't generated or is reported as blocked	The default runtime policy blocks freeform queries	An admin allows that action in the environment group's policy, or use another pattern (Part 12) CD
The admin center says no connectors are allowed	An older environment group without an advanced connector policy	Check the group's connector policy and data policies in the Power Platform admin center D
ms app clone fails on a Mac	A reported libcurl problem	Clone on Windows or Linux until it's fixed C
A Copilot Studio agent can't be called from the app	Only standard agents are callable; agents on the GitHub Copilot harness aren't yet	Use a standard agent for app calls C
SQL actions return 404	A routing bug in an older SDK	Upgrade the SDK; table-mode reads were unaffected C
The Code tab doesn't appear in the Windows app	Code on the desktop needs the unified Copilot app, the right channel and, for local sessions, an admin opt-in	Use the web at copilot.cloud.microsoft for cloud sessions, and ask your admin about desktop access (Part 3) D
Cowork can't bind to an existing SharePoint site	A Graph permission error that needed an admin	Ask an admin before a demo, or use a site you own C

27.1

Known limits in this edition

Guests can't open apps, and there is no offline mode.
No deep links into a record or page.
No documented ownership transfer or co-owner model.
No managed-app events documented in the Purview audit log.
No manual retry for a failed platform build.
The preview is visible only to people with repository write access.
In Code cloud sessions the interactive browser was switched off and code edits are local only.
Cowork's browser use needs Edge on the web and an admin opt-in.
The admin inventory can lag by up to 15 minutes, and alert rules are limited per tenant.

Part 28

Templates you can copy

What it isTemplates to copy: prompts, DESIGN.md and QUALITY-RUBRIC.md skeletons, a release log entry, checklists, a list specification, an exception request and an announcement.
What you doCopy the templates into your repository on day zero and replace the placeholders with your app's details.
Watch outA template helps only if every session reads it, so keep the prompts and rubric in step with your own files.

28.1
Kickoff prompt

Plan only; don't build yet. We are creating [app name] for [users] so they can [outcome], and we will know it works when [measure]. Data: [system of record with exact site, list or table names]. These sources are read-only and must never be written to: [list]. Create README.md, DESIGN.md (numbered, testable items; data contract; navigation rules: every screen names itself and has a one-click Back link; out of scope), DECISIONS.md, QUALITY-RUBRIC.md (release only at 90 of 100 with hard gates), RELEASE-LOG.md, HANDOFF.md and src/features.ts. List which screens will run on sample data and why. Ask me what you need as multiple-choice questions, then show me the plan.

This is the same kickoff prompt as section 18.4, with both read-only and rubric rules restored.
28.2
Session-start prompt

Fetch the app and compare with the remote main. Read DESIGN.md, QUALITY-RUBRIC.md, RELEASE-LOG.md and HANDOFF.md. Tell me what is live, what is committed but not released, what is in progress in other sessions, and the next step. Don't change anything yet.
28.3
Release prompt

Release this change. Run the machine checks and show the output. Render the changed screens at 1280 and 390 pixels and show me the screenshots. Score it against QUALITY-RUBRIC.md with evidence for every item. If it is 90 or more with every gate passed, pull with rebase, publish, confirm that the live app holds the change, and log the scorecard. If not, list the missing points and how to earn them, and stop.

28.4

DESIGN.md skeleton

Section	What to write
Purpose and users	One paragraph: the problem, who it is for, the measure of success
Numbered spec items	D1, D2 and so on: each something a person can see or click, including empty, loading and error states
Data contract	For each source: system, exact name, table or action mode, fields used, read or write, owner
Navigation	Screen map; every screen names itself; Back links; shared switches between sibling modes
Sample data	Which screens use sample data, and the date it must be replaced
Out of scope	What you chose not to do, and why
Open questions	Each with an owner and a date

28.5

QUALITY-RUBRIC.md skeleton

Section	Content
Release bar	Release only at 90 out of 100 with every hard gate passed
Release run	The nine steps in section 20.1
Machine checks	The commands, what each covers, what blocks a release
Scoring rules	No evidence means zero; half points; when not applicable is allowed
Hard gates	The list in section 20.3
The 100 points	Areas A to J with item-level criteria
House style	Spelling, words to avoid, visual rules
Known issues	Each with a date, an owner and a severity
Scorecard log	One entry per release

28.6

Release log entry

Field	Example
Date and time	2026-11-07 13:30 CST
Commit	e4f5a6b
Spec items	D1 to D4 done; D5 deferred, agreed in chat
Score	91 out of 100 (area C at half points: checked at one width only)
Gates	All passed
Evidence	Check output, 495 tests passing, scan clean, screenshots at 1280 and 390
Still owed	Owner's preview checklist items 3 and 4
Rollback point	a1b2c3d

28.7

Preview checklist for the owner

Number	Check
1	Spec item 1: where to click and what you should see
2	Spec item 2: where to click and what you should see
3	Make the window phone-width: nothing overlaps, cuts off or scrolls sideways
4	Press Tab through the changed screen: you can see where you are, and Enter works
5	Anything misaligned, cramped or off-brand? Reply with the numbers that fail, or "all good"

28.8

Handoff note

Heading	What to write
Live now	The deployed commit and what it contains
Committed, not released	Commits held back, and why
In progress	Files or branch, and their state
Next step	The single next action
Watch out	Anything fragile, and any shared file you changed

28.9

SharePoint list specification

Keep one table like this per list in DESIGN.md, and paste it into the prompt that creates the list.

Display name	Internal name	Type	Required	Indexed	Notes
Title	Title	Single line of text	Yes	No	Short summary shown in lists
Status	RequestStatus	Choice: New, In review, Approved, Rejected	Yes	Yes	Default New; changed only by the approval flow
Requester	Requester	Person	Yes	Yes	Filled from the signed-in user
Due date	DueDate	Date only	No	Yes	Used for the "due this week" view
Amount	Amount	Currency	No	No	Validation: greater than zero

28.10

Admin exception request

There is no self-service exception request, so make the admin's decision easy. Send one message with these fields, and ask for the narrowest change, at the group level. DI

Field	What to write
App	Name, app id, environment and environment group
Change requested	The exact connector and action, MCP server, or content security directive and origin (copy the blocked origin from the browser console)
Why	The business justification: the outcome and who benefits
Data	Classification of the data that will flow, and its system of record
Scope and duration	Group level or narrower; permanent or until a date; report-only mode first for content security changes
Evidence	Reproduction steps, the blocked origin or error from the browser console, and test results from a preview build
Owner	Builder, backup owner and the admin contact who approved it

Copy these fields into the message you send your admin.

28.11
Sharing announcement

"Hi team, [app name] is ready: [play link]. It helps you [outcome]. Open it in your browser while signed in to your work account; the first time, approve the connection to [data source] when asked. You'll only see the [records] you already have access to in SharePoint. It's also listed at managedapps.cloud.microsoft. Questions or problems: [support contact] or the Feedback button in the app."

Part 29

Appendices

What it isReference material: the ms CLI, the admin settings map, where sources disagree, a glossary and the sources used.
What you doUse Appendix B to find a switch, and Appendix C to decide what to do when sources conflict.
Watch outAdmin paths and package names move often, so search the admin center for the setting name if a path has changed.

Appendix A

ms CLI quick reference

The CLI is published as @microsoft/managed-apps-cli and invoked as ms; Learn still documents it under that name, while the new GitHub repository lists @microsoft/cmr-cli. It needs a recent Node LTS, Git and Git Credential Manager, and every command accepts --json, --non-interactive, --no-color and --cloud. DC

Group	Commands	Notes
Sign in	ms auth login, logout, status, switch; ms git auth refresh	The Git command maps your Entra identity to GitHub for your own repositories
Create	ms app create, clone, init	--repo <url>, --repo none or the platform repository; the choice is fixed
Connectors	ms connector list, list-actions	See what your environment allows
Data sources	ms app add, remove, refresh data-source	Table or action mode; regenerates the typed clients
Develop	ms app dev	Local loop with a config server; open it in the same browser profile as your tenant
Build and deploy	ms app pack, build, build-status, deploy	build-status --show-log for failures; deploy --commit to pin; deploy --artifact for external builds where allowed
Run	ms app play	--mode live or preview
Share	ms app share, share list, unshare; ms app share link create, list, revoke	Play or edit; tenant-wide links only here
Manage	ms app list, show, info, get-settings, set-setting, delete	delete leaves your local code and the repository
Telemetry	ms telemetry enable, disable, status	CLI telemetry only

GitHub Actions can install the CLI, pack and deploy with a service principal for apps created without a repository. Microsoft's coding-agent plugin adds the same lifecycle as slash commands inside GitHub Copilot and compatible agents. D

Appendix B

Admin settings map