Lovable lets enterprises run apps inside their own Azure subscription

What Deploy on Azure does

Lovable says many of its customers work in Microsoft environments: people sign in with Microsoft Entra ID, data lives in Microsoft 365, Microsoft Fabric and Microsoft Azure, and security teams decide where apps may run. For some apps the rules are strict, and both the app and its data must stay inside the company's own Azure subscription. Deploy on Azure is aimed at that case.

Teams keep building in Lovable the same way they do today. Lovable recommends the option when data has to stay in the customer's own infrastructure and apps need to reach internal systems over the company network.

The feature is in private preview for select Enterprise customers. Lovable says some features available when hosting on Lovable are not yet offered, and the company is working toward full feature parity.

How the setup works

The components needed to run a deployed app sit in a dedicated VNet in the customer's Azure subscription. According to Lovable, these include:

• The Lovable data plane on an Azure Kubernetes Service (AKS) cluster, including the preview sandboxes where builds run during iteration
• Published apps, with static files in Azure Blob Storage and dynamic requests handled by Azure Functions
• The app database on Azure Database for PostgreSQL, plus app storage in Azure Blob Storage
• Application logs, which can go to Azure Blob Storage or a Log Analytics workspace
• The connector gateway and the secrets for integrations

Lovable notes that some of these components roll out during the private preview, and account teams can confirm what is available for a given setup. Apps reach internal systems such as a data warehouse or CRM over VNet peering, so those systems stay off the public internet.

To get started, an admin creates a new Enterprise workspace and chooses to host it in Azure. Lovable generates an Azure Resource Manager template, which the customer's team reviews and runs. Lovable's container images are copied into the customer's own Azure Container Registry, so they can be scanned in the same pipeline as any other vendor image. A Lovable runner on a virtual machine in the VNet provisions and manages the data plane, and also maintains the PostgreSQL Flexible Server and the Blob Storage used by apps.

Lovable manages and updates what it deploys, while the customer's infrastructure team owns the Azure footprint. Enterprise controls still apply, including SSO and SCIM through Entra ID, publishing limited to workspace members by default, a security scan on every build, and audit logs.

What stays with Lovable and how data is protected

The building work stays in Lovable's multi-tenant service: the editor, the agent, chat and project history, and workspace settings, identity and billing. AI model requests made while building are still processed by Lovable's AI service.

App data stays in the customer's VNet under their own Azure encryption and access controls. The components in the customer's subscription make an outbound-only, mTLS-encrypted connection to Lovable, so Lovable never needs an inbound connection into the customer's network. Chat and project history are encrypted at rest. With bring your own key, admins can connect their own Azure Key Vault key in Workspace settings and revoke Lovable's access at any time.

One of three Microsoft options

Lovable presents Deploy on Azure as one of three ways to run in a Microsoft environment, starting with the one that keeps the most inside the customer's Microsoft setup.

• Copilot Managed Runtime (public preview): Microsoft hosts the app inside the customer's tenant. Apps are internal only, sit behind Entra sign-in and inherit tenant settings, DLP and connector controls. It needs Copilot Credits or a Power Platform premium license, and Lovable's database, secrets and backend functions are not available in these apps. It is in public preview for Business and Enterprise workspaces.
• Host on Lovable with Microsoft connectors: Apps run on Lovable and work with existing Microsoft data through connectors for Microsoft 365, Entra ID, Azure management and Fabric. Connector traffic leaves from a fixed IP range that can be allowlisted, and each connector needs admin consent. Lovable hosts the app and database in the region chosen for the workspace with the full feature set. Lovable says it is SOC 2 Type II and that Enterprise workspaces cannot create public projects.

Teams can build across multiple workspaces, so more than one option can be used at the same time.

What it means for enterprise customers

For organizations whose security rules require apps and data to stay in their own Azure subscription, the preview offers a route to keep using Lovable for building without moving runtime data to Lovable's hosting. Access is limited for now. Interested customers can talk to their account team or email [email protected].