Your IT manager is good at the job. The trouble is there's one of them, and the job now includes security, cloud, a help desk queue and a phone that rings on Saturday. Co-managed IT is one way to give that person backup without replacing them, but it only works when it fits your situation and the split is clear. Here's how to tell, and how to set it up so both sides know who owns what.
Key takeaways
- Co-managed IT adds an outside team alongside your in-house IT staff. Your people keep direction; the partner takes agreed pieces of work.
- It fits best when capable IT staff are short on time, coverage or one specific skill. It's the wrong tool if you have no internal IT, or if the real plan is replacement.
- Start with one clearly bounded lane, not a full handover, and give every line of work a single named owner.
- Write down who decides, who does the work, and what access the outside team has. Federal cybersecurity guidance says the same.
What co-managed IT actually means
Co-managed IT is an arrangement where your internal IT team and an outside managed service provider share the work, with your team setting priorities and the provider handling the pieces you hand over. Your people keep the internal relationships and the knowledge of how things really work. The provider brings extra hands, after-hours coverage and specialists you couldn't justify hiring full time.
Two things it isn't. It isn't a slow-motion replacement plan, and it shouldn't feel like one to your staff. And it isn't a way to rent hours from strangers. The value comes from an outside team that learns your systems well enough to take real responsibility for part of them, and gets better at it month by month.
When co-managed IT makes sense
The clearest sign is a capable IT lead with more work than hours. A few patterns show up again and again:
- There's no backup. When your IT person takes a week off, things wait, or they answer email from the beach.
- One skill gap keeps coming up. Your team handles daily support well, but security monitoring, a cloud migration or networking sits outside what they do every day.
- Projects keep slipping. The ticket queue eats the week, so the upgrade planned for spring is still planned for spring a year later.
- Nights and weekends run on goodwill. Someone is always half on call, and it shows.
Picture a 70-person nonprofit in Manhattan with an IT manager and one junior tech. They know every staff member, every grant-funded laptop and every quirk of the donor database. What they can't do is watch security alerts at 2 a.m., or spend three weeks moving files to the cloud while the help desk keeps running. That's the gap co-managed IT is built for. The manager keeps running IT. The outside team takes the overnight watch and the migration, and reports back.
When it's the wrong fit
Co-managed IT assumes there's someone in-house to co-manage with. If you have no IT staff, or your "IT person" is an office manager who also orders the toner, you'll likely get more from fully managed IT, where one provider owns the whole job.
It's also the wrong move if the honest goal is to replace your IT lead. Calling it co-managed won't fool anyone for long, and it puts the outside team in an awkward spot from day one. Be straight about the plan.
And sometimes the gap isn't hands at all. If nobody owns IT decisions (what to buy, what to retire, what risk to accept), adding capacity just speeds up the confusion. That's a planning problem first, and an IT consulting and roadmap conversation is usually the better starting point.
How to split the work without stepping on each other
Most co-managed trouble comes from blurry lines, not bad people. Four habits keep the lines clear.
Start with one lane
Don't hand over a long list on day one. Pick one bounded piece of work, such as after-hours monitoring, patching or a single project, and run it for a few months. You'll learn how the other team communicates, how they escalate, and whether their notes are any good. Then add the next lane based on what you've seen, not on hope.
Give every line one owner
"Shared" is where things fall through. For each area of work, name one owner, even if both teams touch it. If patching is the provider's job, the provider owns the result, including the failed update at 11 p.m. If your team owns the finance application, the provider routes those issues to your team rather than guessing.
Separate who decides from who does
Your IT lead might choose which laptops the office buys next quarter, while the outside team sets them up and gets them to staff. Your finance director might approve a bigger backup budget, while the outside team runs the restore tests and reports what it found. Writing down "decides" and "does" as separate columns heads off most arguments before they start.
Write down access, too
An outside team needs admin access to do real work, but not to everything, and not forever. Give each outside engineer a named account, limit it to the systems they look after, and review it when roles change. This isn't just our opinion. A joint advisory from CISA, the NSA, the FBI and allied cyber agencies tells customers of managed service providers to make sure their contract specifies whether the MSP or the customer owns specific responsibilities, such as hardening, detection and incident response, and to keep provider accounts out of internal administrator groups. If security monitoring and response is one of the lanes you're handing over, start there.
A one-page summary of these four points makes a useful companion to the service agreement, because it's the document people will actually open when a question comes up. Agree on escalation paths up front, too, so nobody wonders who owns an incident at the worst possible moment.
The conversation with your IT lead
If you're the CEO, CFO or owner, how you raise this matters as much as what you sign. An IT manager who hears "we're talking to an MSP" from someone else will assume the worst, and you can't really blame them.
So start with them, and start with the workload. Ask what they'd hand off tomorrow if they could, and what they'd never give up. Their answers are the first draft of your split. Bring them into the vendor conversations and let them push back. The arrangement works when your IT lead is the one directing the outside team, not the one being audited by it.
If you're the IT lead making the case upward, frame it the same way. Point to the backlog, the coverage gap or the missing skill, and show the one lane you'd hand off first. Leadership hears a plan to get the backlog moving, not "I can't keep up."
How to tell it's working
Skip ticket counts. After a few months, look for these instead:
- Your IT lead isn't the one getting paged on Saturday night.
- At least one stalled project has actually moved.
- Documentation lives somewhere other than one person's head, so a week off doesn't stop anything.
- When something breaks, nobody asks "whose job was that?"
If those aren't happening, revisit the split before you blame the people. Usually a line got blurry.
Common questions
Is co-managed IT cheaper than hiring another IT person?
Sometimes, but cost shouldn't be the only test. A single hire brings one person's skills and one person's calendar. A co-managed partner brings a bench of specialists and coverage when your staff are out. Compare what each option actually covers, not just the monthly number.
Can we keep our own tools?
Often, though it depends on the provider and what you run today. Ask early, because tooling decides who can see what. Two teams working from separate ticket systems with no shared view is a common source of dropped issues.
What if we outgrow it or want to change course?
Then change the split. A merger, a second office, or a new security requirement from a funder or client can all change who ought to own what, so revisit the split at least once a year. Keep documentation and admin credentials in your own hands, so adjusting the split, or switching IT providers, is a planned change rather than a scramble.
Co-managed IT works best when it gives a good team room to do the work only they can do. Start with one lane, name the owners, and keep your IT lead in charge. If you'd like to talk through what that first lane could look like for your team, see how our co-managed IT service works.