Managed App Setup: Plan a Copilot Managed App

Updated November 7, 2026

Managed App Setup

Not saved yet

The rules behind the live plan

The plan applies the same rules as the td-synnex-managed-app skill (references/decision-rules.md). Rules marked [I] are judgement calls.

Which tool leads

Score each answer, then lead with the tool that is ahead by 2 or more. Within 1 point, use both.

Answer	Code	Cowork
Builder is a developer	+3
Builder is new to building		+3
Builder has some experience but isn't a developer		+1
More than 25 users, or writes to confidential data	+1
More than one session or person changes the app	+2
GitHub repository mode	+3
Uses the ms CLI, GitHub Copilot CLI, Claude Code, VS Code or GitHub Actions	+2
8 or more screens	+2
5 or fewer screens		+1
Stage is production	+2
Stage is prototype		+1
Independent reviewer wanted	+1
Weekly health routine wanted		+1
Attached requirements, process maps or screenshots		+1
Two or more integrations (flows, agents, MCP, custom connectors, Power BI in the app)	+1

Result	Pattern	What it means
Code	Code builds, Cowork accepts	Code makes each change and runs the checks; Cowork opens the live app in a signed-in browser and walks the acceptance checklist
Cowork	Cowork shapes and builds	Cowork does discovery, the build and the walk-through; move to Code when the app outgrows it
Both	Cowork shapes, Code ships	Cowork finds the data, people and process and can do the first build; Code engineers, tests and releases

Risk tier

High if any: highly confidential data; sensitive personal data; regulated data; the app sends email; a third-party MCP server; outside web addresses; an organization-wide app that writes data.

Medium if any: confidential data; the app writes records; more than 25 users; automated flows; customer contact data. Low otherwise.

Release bar and extra gates

Tier	Bar	Extra gates
Low	The blueprint's bar, 90 by default	None
Medium	At least 90	The owner's preview checklist is answered
High	At least 95	Independent reviewer score; security review signed off; data owner sign-off

A gate is added when the app sends mail, and another when any source is marked never write.

Permission level for each source

Situation	Level
Dataverse table	5, security roles
Read-only source	2 with users on Read and only a named account writing, if confidential, unclassified or above; else 1
Highly confidential or regulated, read-write	5
Creators edit only their own items, and nobody who creates may edit any	3, item-level
Confidential, or more than one role	2, own permissions with Contribute
Otherwise	1, inherited

SharePoint site address

Blocker if the address is a OneDrive (-my) site, the root site, or has non-ASCII or percent-encoded characters in the site name. It must be https://tenant.sharepoint.com/sites/Name or /teams/Name.