Co-Managed vs Fully Managed IT: Which Model Fits Your Business?

Fully managed: the provider runs the helpdesk, devices, accounts, security, backups and vendors under a written scope. You have no internal IT staff, or the person who 'does IT' does it on the side.

Co-managed: you keep at least one internal IT person and the provider fills specific gaps, usually security tooling, after-hours incidents, projects and second-level support. If you are still deciding whether to hire at all, start with managed vs in-house.

Copy this into your contract schedule and change the cells to match your deal. Blank or 'shared' cells without a named lead are where incidents fall through. I = internal staff, P = provider.

We see the same failure modes again and again when two parties share one environment. Each one has a simple fix.

1. 01

   Shared admin accounts

   Both sides use one 'admin@' login, so the audit log cannot tell you who changed what. Fix: named admin accounts for every person, MFA on all of them, and two emergency access accounts kept out of daily use.

2. 02

   No change log

   The internal person tweaks a firewall rule on Tuesday; the provider's monitoring alerts on Wednesday and someone reverses it. Fix: one shared change record, even a simple ticket per change, written before the change is made.

3. 03

   Two tools doing one job

   Two antivirus agents or two patch tools fight each other and slow machines down. Fix: agree which tool is authoritative for each job and remove the other.

4. 04

   Nobody owns the gap

   Something new (a Copilot rollout, a new phone system) arrives and each side assumes the other has it. Fix: a standing rule that anything not in the matrix goes to one named person to assign within a business day.

5. 05

   The internal person becomes a dispatcher

   All the interesting work goes to the provider and your staff member ends up forwarding tickets. Fix: give them ownership of specific areas in the matrix and include them in project work.

Fully managed suits offices without anyone technical on staff, or where the owner wants one accountable party. It depends entirely on a written scope, because 'everything' is not a scope.

Co-managed suits firms with 20 or more staff and a capable internal person, firms with on-site needs (a warehouse, a lab, a clinic) where someone must be physically present, and firms whose internal IT lead wants senior backup for security and incidents without hiring a second person.

• Will your technicians use named accounts in our tenant, and can we see the audit log of their changes?
• Which of your tools will you install, and which of ours will you take over or remove?
• If our internal person is on holiday, what changes in your scope for those two weeks?
• How do you hand back documentation if we end the arrangement? See how to switch IT providers for what a clean exit needs.

Fill in the matrix with your current reality, not the ideal. Every blank cell is a conversation to have before you sign. Our co-managed IT service page describes how we structure the split.