Co-managed IT is an arrangement where your own IT staff and an outside IT provider share responsibility for your technology. Your people stay close to employees and daily operations, while the provider supplies what a small team cannot cover alone: security monitoring, senior escalation, tools, after-hours coverage, and project capacity. Done well, nobody is left carrying the whole environment, and nothing falls between the two teams.
It sits between fully managed IT, where a provider runs everything, and fully in-house IT, where your team does it all. The key to making it work is deciding, in writing, who owns what.
Key takeaways
- Co-managed IT fits companies that have, or want, at least one internal IT person but cannot build a full department around them.
- The internal team usually owns employee support and local knowledge; the provider usually owns security, the tool platform, escalation, and coverage.
- It fails when responsibilities are vague. A written responsibility map, shared ticketing, and clear escalation rules are what make it work.
- It can be permanent, or a bridge while your internal team grows into more of the work.
How does co-managed IT work?
Every co-managed arrangement divides the work. A typical split looks like this, though the right one depends on your team's strengths:
| Area | Usually your IT staff | Usually the IT provider |
| Employee support | First contact, desk-side help, onboarding | Overflow, after-hours, and escalated tickets |
| Security | Following procedures, reporting issues | Monitoring, response, security tools, and reviews |
| Tools and platform | Day-to-day use | Selection, configuration, licensing, and patching |
| Infrastructure | Local knowledge and hands-on work | Design, complex changes, and projects |
| Backup and recovery | Spotting problems, restoring single files | Monitoring, testing, and full recovery |
| Vendors | Everyday contact | Escalations and technical negotiations |
| Planning and reporting | Business priorities and context | Roadmap, risk reporting, and budgeting input |
Both teams work from the same ticketing system and documentation, so either one can see what the other has done.
Co-managed IT vs fully managed IT vs in-house IT
| Fully managed IT | Co-managed IT | In-house IT only | |
| Who does daily support | The provider | Mostly your staff | Your staff |
| Who owns security and tools | The provider | Usually the provider | Your staff |
| On-site presence | Scheduled or on request | Your staff, every day | Your staff, every day |
| Depth of expertise | The provider's whole team | Your staff plus the provider's team | Limited to who you hire |
| Risk if one person leaves | Low | Low | High |
| Best fit | No internal IT staff | One or a few internal IT staff | A large, fully staffed department |
For the full comparison, including the option most companies miss, read in-house IT vs MSP vs co-managed IT.
When is co-managed IT the right fit?
- You have one or two IT people who are always busy with tickets, so security, projects, and documentation keep slipping.
- Your IT person is the only one who knows how things work, and a vacation or resignation would leave you exposed.
- Insurers, auditors, or clients are asking security questions your team cannot answer alone.
- You want employees to have someone on site who knows them, but you also want a bigger team behind that person.
- You are bringing IT in-house from an MSP and want senior support while your team settles in.
It is usually not the right fit if you have no internal IT staff and no plans to hire, in which case fully managed IT is simpler, or if you already run a large department with its own security and engineering teams.
What should a co-managed IT agreement include?
- A responsibility map. Who owns each area, who approves changes, and who does the work.
- Shared ticketing and documentation. One system, so nothing lives in someone's inbox or memory.
- Escalation rules. When your team hands a problem up, how fast the provider responds, and how urgent issues are handled after hours.
- Access that the company controls. Administrator accounts, licenses, and documentation owned by the business, not by either team.
- Security roles. Who watches alerts, who responds, and who decides during an incident.
- Regular reviews. A monthly or quarterly look at tickets, risks, projects, and whether the split still makes sense.
- An exit plan. How documentation and access are handed over if either side changes. Our MSP handoff checklist covers what to ask for.
What co-managed IT looks like in practice
A single-location healthcare facility with more than 120 users called us after ransomware reached all of its servers and its backup environment. Once operations were restored, rebuilding the old model would have left the same gaps: one internal team carrying everything.
We helped the facility hire a new internal IT professional and built the outside structure around that person. The internal role stays close to staff and daily work. Spot On Tech runs the security program, manages the ticketing operation, handles escalations, and provides the bench for projects and complex problems. The facility kept someone on site who knows everyone, without asking one person to be the help desk, the security team, and the incident response team at once. Read the full healthcare co-managed IT case study.
How Spot On Tech does co-managed IT
We set up co-managed IT through Compass, our service for companies with their own IT staff. We map responsibilities, connect your team to our ticketing and documentation, run the security tools and platform behind them, and stay available as senior support for as long as you want. You choose the levels: L1, L2, or L3 support, with 24/7 coverage and security operations center (SOC) monitoring if you need them. If you do not have internal staff yet, Compass can also help you hire them. We support companies across New York and New Jersey, including Rockland, Westchester, Bergen, and Passaic counties and New York City.
Not sure where your team stands today? Start with our internal IT maturity assessment.
Frequently asked questions
What is co-managed IT?
Co-managed IT is a shared arrangement in which a company's internal IT staff and an outside IT provider divide responsibility for the company's technology, usually with internal staff handling daily support and the provider covering security, tools, escalation, and extra capacity.
What is the difference between co-managed and fully managed IT?
In fully managed IT, the provider runs everything, including daily support. In co-managed IT, your own staff handle much of the daily work and the provider fills the gaps, such as security monitoring, senior escalation, and after-hours coverage.
Is co-managed IT more expensive than fully managed IT?
It depends on the split. You pay for your own staff plus the provider's share, so total cost is often similar to or higher than fully managed IT. Companies choose it for the on-site presence and control that internal staff provide.
Will a co-managed provider replace our IT staff?
It should not. A good co-managed arrangement is built to support your staff, take work they cannot cover, and reduce the risk of depending on one person.
Can we move from fully managed to co-managed IT?
Yes. Many companies hire their first internal IT person and shift to co-managed IT. The provider hands over daily support gradually while keeping security, tools, and escalation.
