Deploy on Azure: keep your Lovable apps in your own subscription

retained text

Many of the teams building with Lovable work in a Microsoft environment. Their people sign in with Microsoft Entra ID, their data lives in Microsoft 365, Microsoft Fabric, and Microsoft Azure, and their security team sets the rules for where apps can run.
For some of those apps, the rules are strict. The app and its data have to stay inside the company's own Azure subscription. Deploy on Azure, now in private preview, makes that possible. Your teams keep building in Lovable the same way they do today.
It's one of three ways to run Lovable in a Microsoft environment. They start with the option that keeps the most inside your Microsoft environment and end with the one Lovable runs for you.
3 ways to build with Lovable on Microsoft
1. Deploy on Azure (private preview)
Your apps and their data run in your own Azure subscription. The editor and agent stay with Lovable.
Consider this option when the data has to stay in your own infrastructure and apps need to reach internal systems over your network. More on how it works below.
2. Copilot Managed Runtime (public preview)
You build in Lovable, and Microsoft hosts the app inside your Microsoft tenant. Apps are internal only, behind your Entra sign-in, and they inherit your tenant settings, DLP, and connector controls, with access to Microsoft's connector catalog. It needs Copilot Credits or a Power Platform premium license, and Lovable's database, secrets, and backend functions aren't available inside these apps.
Consider this option when you already invest in Power Platform and want your tenant's policies to apply. Read how Copilot Managed Runtime works.
3. Host on Lovable with Microsoft connectors
Apps run on Lovable, and they work with the Microsoft data you already have. Connectors cover Microsoft 365, Entra ID, Azure management, and Fabric, and connector traffic leaves from a fixed IP range you can allowlist. Each connector needs consent from your admin. Lovable hosts the app and its database in the region you pick for your workspace, with the full feature set: database, auth, storage, and secrets. Lovable is SOC 2 Type II, and Enterprise workspaces can't create public projects.
Consider this option when your apps need to read or write Microsoft 365, Entra, Azure, or Fabric data, and the app itself can live on Lovable.
Teams can build across multiple workspaces, so you can use more than one of these options at the same time.
How Deploy on Azure works
The components required to run the deployed app live in a dedicated VNet in your Azure subscription:
- The Lovable data plane on an Azure Kubernetes Service (AKS) cluster, including the preview sandboxes where builds run while your team iterates
- Published apps, with static files in Azure Blob Storage and dynamic requests handled by Azure Functions
- The app database on Azure Database for PostgreSQL, plus app storage in Azure Blob Storage
- Application logs, which can be sent to Azure Blob Storage or a Log Analytics workspace
- The connector gateway and the secrets for your integrations
Some of these components roll out during the private preview. Your account team can confirm what's available for your setup.
Apps reach internal systems, like your data warehouse or CRM, over VNet peering, so those systems stay off the public internet.
To set one up, an admin creates a new Enterprise workspace and chooses to host it in Azure. Lovable generates an Azure Resource Manager template, and your team reviews it and runs it. Lovable's container images are copied into your own Azure Container Registry, so you can scan them in your pipeline like any other vendor image.
Lovable manages and updates what it deploys, and your infrastructure team owns the Azure footprint. Your Enterprise security controls apply here too, including SSO and SCIM through Entra ID, publishing limited to workspace members by default, a security scan on every build, and audit logs.
A Lovable runner on a virtual machine in your VNet provisions and manages the data plane, which runs on an AKS cluster in the same VNet. The runner also provisions and maintains the Azure Database for PostgreSQL (Flexible Server) for database tables and the Azure Blob Storage your apps need for object storage.
What stays with Lovable
The work of building stays in Lovable's multi-tenant service: the editor, the agent, chat and project history, and workspace settings, identity, and billing.
AI model requests made while building are still processed by Lovable's AI service.
How your data is protected
- In your subscription. App data stays in your VNet, under your own Azure encryption and access controls.
- Between your subscription and Lovable. The components in your subscription make an outbound-only, mTLS-encrypted connection to Lovable. Lovable never needs an inbound connection into your network.
- With Lovable. Chat and project history are encrypted at rest. With bring your own key, admins connect their own Azure Key Vault key in Workspace settings and can revoke Lovable's access at any time.
Getting started
Deploy on Azure is in private preview for select Enterprise customers. Some features you get when you host on Lovable aren't available there yet, and we're working toward full feature parity. Your account team can walk your IT and security teams through the architecture.
Copilot Managed Runtime is in public preview for Business and Enterprise workspaces.
To join the private preview, talk to your account team or email byoc@lovable.dev. New to Lovable Enterprise? Talk to our sales team.

document fetched 2026-10-24 10:03