MSP & Channel
What Is Co-Managed IT?
Co-managed IT is a hybrid service delivery model where an organization's internal IT team and an external Managed Service Provider (MSP) work collaboratively to manage IT infrastructure and services.
Co-managed IT is a hybrid service delivery model where an organization's internal IT team and an external Managed Service Provider (MSP) work collaboratively to manage IT infrastructure and services. The internal team maintains strategic control and institutional knowledge while the MSP augments capacity, provides specialized expertise, and handles specific workloads—such as 24/7 monitoring, patch management, security operations, or complex projects. Co-managed IT allows organizations to retain IT staff while benefiting from MSP expertise and resources.
How does co-managed IT operate?
Co-managed IT operates as a three-way partnership with defined responsibilities:
Organizational Structure: Leadership—the CIO, IT Director, or business executives—sets IT strategy and priorities. The internal IT team owns day-to-day operations, institutional knowledge, and long-term strategy. The MSP partner provides capacity, specialized services, tools, and 24/7 support that augment internal capabilities.
Shared Responsibilities Model: Internal teams typically handle long-term IT strategy and architecture decisions, vendor evaluation and relationship management, strategic projects and system upgrades, institutional knowledge and business context, desktop and user support with front-line issue handling, and policy development and governance.
MSPs typically handle 24/7 monitoring and alert response, proactive maintenance including patching and updates, vulnerability management and security scanning, backup and disaster recovery, help desk escalations and complex technical issues, specialized services such as cybersecurity operations, compliance reporting, or cloud management, and tool provisioning and access management.
Integrated Workflows: Shared ticketing systems with escalation procedures ensure seamless handoffs between internal teams and MSPs. Joint on-call rotations provide after-hours incident coverage without burdening internal staff exclusively. Regular sync meetings between internal teams and MSPs align priorities, review incidents, and plan upcoming changes. Documented service catalogs and SLAs define which party handles which functions. Shared performance metrics and reporting provide visibility to leadership. Collaborative incident response procedures specify roles during major outages or security incidents.
Resource Allocation: Internal teams focus on strategic initiatives—technology roadmaps, business alignment, custom application development—while MSPs handle reactive and repetitive workloads—monitoring, patching, backup validation. MSPs provide overflow capacity during peaks—major rollouts, incident surges, vacation coverage. MSPs provide expertise for specialized projects—cloud migrations, security assessments, compliance audits—without requiring internal teams to develop niche skills.
How does co-managed IT compare to alternatives?
Aspect | Co-Managed IT | Fully Managed IT | Break/Fix | Internal IT Only |
|---|---|---|---|---|
Internal IT Staff | Retained (1-5+ people) | Eliminated or minimal | None or ad-hoc | Full team (3-10+ people) |
Control | Internal team maintains control | MSP has operational control | Customer controls when to call | Complete internal control |
Cost | 30-40% less than fully managed | Full per-endpoint cost | Unpredictable | High fixed cost |
Decision-Making | Internal team decides | MSP advises and decides | Customer decides reactively | Internal team decides |
Specialization | MSP fills specific gaps | MSP handles all IT functions | Technicians assigned randomly | Limited by hired skills |
Institutional Knowledge | Retained in-house | Must be transferred to MSP | None developed | Concentrated internally |
Flexibility | High (scale MSP up/down) | Fixed commitment | Pay per incident | Fixed staffing |
Ideal For | Growing businesses, skill gaps | SMBs, cost minimization | Very small orgs, budget constraints | Large enterprises, strategic control |
Co-managed IT costs approximately 33% less than fully managed IT according to Evalve Tech and ASI Networks. A 100-person company might pay $30-80 per endpoint monthly for co-managed services ($3,000-8,000/month total) versus $50-150 per endpoint monthly for fully managed ($5,000-15,000/month total).
Fully managed IT outsources all IT operations to the MSP, eliminating or minimizing internal staff. This maximizes cost efficiency for organizations seeking to avoid IT staffing entirely but sacrifices strategic control and institutional knowledge. Co-managed IT retains internal staff for strategic direction and business alignment while outsourcing commodity functions.
Break/Fix provides no proactive management, relying on reactive technician dispatch when systems fail. Co-managed IT provides proactive monitoring and maintenance from the MSP while internal teams handle strategic work and user support.
Internal IT teams provide complete control and deep institutional knowledge but require significant fixed costs and may lack specialized expertise in emerging areas—cloud security, compliance, advanced threat detection. Co-managed IT augments internal teams with specialized skills and 24/7 coverage without full outsourcing.
Why is co-managed IT gaining adoption?
Approximately 60% of businesses now use managed or co-managed IT services according to market analysis from Compass MSP and Aztech IT. IT managed services revenue reached $595 billion globally in 2025, growing 13% year-over-year. The co-managed model is gaining traction as an alternative to full outsourcing.
MSP 3.0 Market Shift: Industry analysis from Canalys and Omdia identifies 2025 as marking a shift toward "MSP 3.0" with co-managed and cloud-first focus. Customers are moving away from traditional fully managed models, preferring to retain strategic control while outsourcing operational functions. Co-managed and co-partnering with MDR (Managed Detection and Response) and XDR (Extended Detection and Response) providers is becoming industry standard.
Cost Savings Without Sacrificing Quality: Organizations achieve 25-45% IT cost reduction from co-managed services adoption according to Boyer Associates and ITonDemand, while operational efficiency improves 45-65%. Co-managed IT provides hybrid cost models: lower than fully managed, predictable unlike break/fix, and more affordable than large internal teams.
Skills Gap Mitigation: Internal IT teams often lack specialized expertise in cybersecurity, cloud architecture, compliance, or emerging technologies. Rather than hiring specialists at $120,000-180,000 annually, organizations access MSP expertise through co-managed relationships at a fraction of the cost.
Reduced Internal IT Burnout: Co-managed IT reduces workload on internal teams through shared responsibility. The MSP handles after-hours monitoring, routine maintenance, and repetitive tasks, allowing internal staff to focus on strategic projects rather than operational firefighting. This improves retention and job satisfaction.
Organizational Profile: Co-managed IT works best for growing businesses with 30-500 employees, organizations with existing IT staff of 1-5+ people, companies needing specialized expertise without full outsourcing, organizations with seasonal IT demand fluctuations, and businesses requiring 24/7 monitoring while wanting internal strategic control.
Regional Adoption: North America shows highest co-managed adoption at 60%+ according to industry analysis. Europe shows growing co-managed model adoption as organizations seek balance between control and cost. Asia-Pacific represents an emerging market for co-managed services as IT complexity increases.
What are the limitations of co-managed IT?
Coordination Complexity: Co-managed IT requires clear role definition between internal teams and MSPs. Potential gaps or overlaps in responsibilities create confusion and delayed response. Communication overhead between two teams—internal and MSP—adds coordination burden. Decision-making can be slower when requiring alignment between parties, particularly during incidents requiring rapid response.
Cultural and Team Issues: Internal IT staff may resist external "oversight" or feel threatened by MSP involvement. MSPs may be viewed as threats to internal team job security, creating defensive behavior. Co-managed IT requires buy-in from internal IT leadership for success. Training internal teams to work with MSP processes, tools, and workflows adds onboarding time.
Service Level Challenges: SLA responsibility divided between internal teams and MSPs makes accountability harder to assign during incidents. Escalation paths may be unclear—does the MSP or internal team handle specific issue types? Multiple points of failure exist: is the problem caused by internal management or MSP tools? Potential finger-pointing during incidents creates friction and delays resolution.
Cost Factors: Co-managed IT is not necessarily cheaper than fully managed MSP if internal staff are underutilized. Organizations must invest in training internal teams on MSP tools and platforms. MSP tools and platforms may increase costs if not optimized or if redundant with internal tools. Integration costs for connecting internal systems with MSP platforms add implementation expenses.
Knowledge and Expertise Issues: Internal teams may lack deep expertise in areas MSPs provide, creating dependency. Knowledge silos form if cross-training and documentation are inadequate. Institutional knowledge may be lost if internal staff depart, particularly if MSP relationships rely on specific personnel. MSPs may resist detailed documentation to maintain value and customer dependency.
Service Consistency: Multiple organizations—internal IT and MSP—with different standards, processes, and cultures can impact quality and consistency. Hard to ensure 24/7 quality when relying on part-time internal staff during business hours and MSP staff after hours. Peer review and quality control become more complex across organizational boundaries. Service maturity depends on both internal team and MSP capabilities, with the weakest link determining overall quality.
Who provides co-managed IT services?
MSPs Offering Co-Managed Services:
- Cenetric specializes in co-managed IT services with flexible engagement models
- Compass MSP provides co-managed resources and strategic IT partnerships
- ConnectWise delivers integrated co-managed platforms with RMM, PSA, and documentation tools
- Datto offers co-managed IT services alongside backup, security, and recovery solutions
- Kaseya provides VSA RMM with co-managed support options and flexible deployment
- Level IT focuses specifically on co-managed IT partnerships
- Meriplex operates as a co-managed IT provider for mid-market organizations
- Microage delivers co-managed IT services with regional presence
- Synoptek provides co-managed services consulting and strategic IT partnerships
- VC3 specializes in co-managed IT for growing businesses
MDR and XDR Co-Managed Security Partnerships: The 2025 trend identified by Canalys shows co-managed security partnerships becoming standard. Organizations combine internal security teams with external MDR providers:
- CrowdStrike Falcon Complete partnered with customer security operations
- Fortinet FortiSOC combined with internal SOC teams
- Mandiant Managed Defense integrated with customer incident response
- Palo Alto Networks Cortex XDR co-managed with internal security teams
Internal Tools Enabling Co-Managed Models:
- Atlassian Jira provides shared ticketing and workflow management
- Azure and AWS offer shared infrastructure visibility and management
- Confluence delivers documentation and knowledge management
- ServiceNow enables IT service management across teams
- Slack facilitates team communication and coordination
FAQs
Is co-managed IT right for my business?
Co-managed IT works best if you have 1-5+ internal IT staff, are experiencing growth requiring additional capacity, or need specialized skills in security, cloud, or compliance without hiring full-time specialists. If you have zero internal IT staff, fully managed MSP is typically better. If you're purely cost-focused with under 10 employees and minimal IT requirements, break/fix may be cheaper despite higher risk.
How do we define responsibilities between internal IT and the MSP?
Document responsibilities in a clear RACI matrix: Responsible (who does the work), Accountable (who owns the outcome), Consulted (who provides input), and Informed (who receives updates). Typical split: MSP handles 24/7 monitoring, patching, and technical support escalations; internal team handles strategy, vendor management, user support, and business-specific customization. Weekly sync meetings ensure alignment and surface issues early.
How much does co-managed IT cost?
Co-managed IT typically costs $30-80 per endpoint monthly, roughly one-third less than fully managed IT at $50-150 per endpoint monthly. For a 100-person company, co-managed costs approximately $4,000-8,000 monthly versus $5,000-15,000 for fully managed services. Organizations must also budget for internal IT staff salaries—typically 1-3 people at $60,000-100,000 each annually plus benefits.
Can we transition from fully managed back to co-managed?
Yes, but this requires rebuilding internal IT capability through hiring and knowledge transfer from the MSP. Plan 2-6 months for transition: hire internal staff, transfer knowledge through documentation and training, migrate tools and processes to internal management, and adjust MSP contract to co-managed scope. MSPs should provide comprehensive documentation and training to internal teams during transition to ensure continuity.
How do we handle security in a co-managed IT model?
Modern co-managed IT adds an MDR (Managed Detection and Response) security layer as identified in 2025 industry trends. The MSP or specialized MSSP monitors for threats 24/7 using EDR and XDR tools. Internal teams implement fixes, manage user access, and handle security policy development. Define clear incident response procedures specifying who escalates to whom, who has authority to isolate compromised systems, and who manages communications with stakeholders and regulators.
