co-managed it support

Co-Managed IT Support: How It Works and When It Fits

IT lead and provider reviewing a shared support ticket

Co-managed IT support is an arrangement in which your internal IT person or team and an outside provider share the work. You keep the decisions and the knowledge of your business. The provider covers the pieces you agree on, such as after-hours monitoring, help desk overflow, security, backup or specialist projects. It sits between wholly in-house IT and fully outsourced IT, and it works best when the split is written down before anything breaks.

This guide explains how the split works in practice, what to hand off and what to keep, how escalation should run, which security controls to insist on, and how to tell whether your organization is a good fit.

Key Takeaways

Co-managed IT keeps your internal team in charge while an outside provider covers agreed gaps: hours, skills, tools or projects.
The agreement matters more than the label. Name who owns each task, who gets called first, how fast, and what you keep if the relationship ends.
Insist on multifactor authentication (MFA), logged access and a written split of security roles for any provider that touches your systems.
It fits organizations with an IT lead or a small IT staff that is stretched. If nobody internal owns IT, a fully managed model is usually the simpler choice.
We can scope support around the gaps your team has. Start with a free network assessment or the 10-minute readiness audit.

What co-managed IT support means
Co-managed vs. fully managed IT
What an outside provider can add
How the work gets divided
Escalation: who gets called, in what order
When co-managed IT makes sense
Security and access: what to settle first
What to put in the agreement
Co-managed support for local industries
Where we fit
How to get started
FAQ
Sources

What co-managed IT support means

The plain version: you already have someone responsible for technology, and you add a provider to share the load. That someone might be an IT director at a 150-person company, a single IT manager at a manufacturer, or an office administrator who also handles the network because nobody else will.

The internal side keeps what only it can know: how your practice, firm or plant actually operates, which systems are critical, what the budget is and which risks the business will accept. The provider supplies what the team lacks: round-the-clock coverage, specialist skills, standard tools and a bench of people who can step in during vacations, resignations or busy seasons.

It is not a handover and it is not a temporary staffing fix. Both sides work from the same tickets, alerts and documentation, and each knows which jobs belong to whom.

Co-managed vs. fully managed IT

The difference is who runs the day-to-day. In a fully managed model, the provider runs most or all of the organization's IT and is often the main contact for users. In a co-managed model, your team stays the front door for the work it keeps.

	Co-managed IT	Fully managed IT
Who users call first	Your internal IT person or team, or the provider for the tiers you hand off	The provider's help desk
Who makes technology decisions	Your team, with provider advice	Shared, with the provider leading day-to-day
Best fit	Organizations with an IT lead or small IT staff	Organizations with no internal IT
What the provider adds	Coverage, skills, tools, projects	Most or all of IT operations
Main risk	Unclear ownership if the split is not written down	Less internal knowledge of your own environment
Key document	Responsibility matrix and escalation path	Service agreement and scope

Neither model is better in the abstract. A dental practice with no IT staff will usually be well served by a fully managed plan. A manufacturer with a capable IT manager who needs nights and weekends covered is a classic co-managed case. If you are weighing the first option, our guide to what managed IT support means for small businesses covers it in detail.

What an outside provider can add

Most co-managed arrangements are built from a short menu. Pick the pieces that close your gaps and leave the rest with your team.

24/7 monitoring and alert response

One person cannot watch servers, firewalls, endpoints and cloud accounts around the clock. A provider can monitor continuously and either fix problems or page your team with context. This is often the first thing organizations hand off, because the gap is obvious: nobody is looking at 2 a.m. on a Saturday.

Help desk overflow and after-hours support

Your team handles the questions it knows best, such as line-of-business software and the quirks of your office. The provider takes password resets, printer problems and new-hire setups, or covers the phones when your lead is out. That frees your person for work that moves the business forward.

Cybersecurity

Security is where a small internal team most often runs out of hours and specialist skill. A provider can manage endpoint protection, email filtering, phishing defenses and ransomware readiness, and bring a consistent baseline across every device. Our cybersecurity services are built around that kind of layered protection.

Backup and data recovery

Backing up is easy. Restoring on a bad day, within a time you can live with, is the hard part. A provider can run backups, test restores on a schedule and document recovery steps, so the plan does not live only in one person's head. See how we approach backup and recovery.

Microsoft 365 administration

Tenant settings, conditional access, licensing, mailbox migrations and security hardening all take time. A provider can own the configuration work while your team handles user requests. CISA publishes secure configuration baselines and assessment tools for Microsoft 365, and notes that although they were developed for federal civilian environments, they can help any organization strengthen SaaS security. We cover the practical side in our Microsoft 365 support and in a 30 to 90 day Microsoft 365 security checklist.

Network management and projects

Firewall changes, Wi-Fi redesigns, office moves and new-site buildouts are bursts of work that a small staff cannot absorb. Handing off a project, or ongoing network management, keeps daily operations from stalling. For planning and roadmaps, IT consulting fills the strategy gap.

How the work gets divided

There is no standard split. The parties can divide responsibility by support tier, hours, technical domain or project. Here is how each looks in a small organization.

By tier. Your team handles level one and two requests. The provider takes the harder level three problems, such as server faults and complex network issues.
By hours. Your team owns business hours. The provider covers nights, weekends, holidays and your lead's vacation.
By domain. Your team owns applications and user support. The provider owns security, backup and the network.
By project. Your team runs daily operations. The provider delivers specific projects, such as a Microsoft 365 migration or a new firewall.

Many organizations combine two of these. A common pattern is domain plus hours: the provider owns security and backup and also monitors everything after hours.

Escalation: who gets called, in what order

Most co-managed failures are handoff failures. A ticket sits because both sides assumed the other had it. The fix is a written escalation matrix that states who is called, in what order, and how quickly.

A workable matrix has four parts:

Severity levels. Define what counts as an outage, a degraded service and a routine request, in terms your staff would recognize ("nobody can open patient records" rather than "P1").
Contact order. For each level, name the first call, the second and the fallback, with numbers that work after hours.
Response targets. State how fast each level gets a human response, not just an automated acknowledgment.
Shared record. Both teams work from the same ticket queue and alerts, so nothing lives in a private inbox or a chat thread.

Communication habits matter as much as the tooling. Long back-and-forth threads in chat hide decisions, and moving a discussion from chat to email after a few replies keeps a durable record that either side can find later. The same principle applies to your tickets: the final decision should be in the ticket, not in someone's memory.

When co-managed IT makes sense

Consider it if several of these are true:

You have an IT manager or director, or a small IT staff, and they are consistently overloaded.
Your hours of coverage are thinner than your hours of operation.
One person holds critical knowledge, and a resignation or illness would stall everything.
Security or compliance work keeps slipping behind daily tickets.
You are growing, opening a location or running a big project, and cannot hire fast enough.

TechTarget reported in April 2021 that co-managed offerings gained traction during the pandemic as a remedy for overtaxed IT departments and tight budgets, and described prime candidates as companies with about 150 end users, an IT director or manager and a small IT staff. Many small businesses in Oklahoma are smaller than that, and the principle still applies: the more your internal person is stretched across tasks, the more a defined split helps.

If you have no one internal who owns IT, co-managing leaves a hole where the decisions should be. A fully managed plan, with a provider that explains things in plain language, is usually the better starting point.

Security and access: what to settle first

An outside provider with administrator access is a powerful partner and, if poorly controlled, a risk. Government guidance is consistent on the basics.

Make the contract say who owns security

In a May 2022 joint advisory, the NSA, CISA and partner agencies from Australia, Canada, New Zealand and the UK recommended that contracts between providers and customers transparently identify who owns each ICT security role and responsibility. The same release recommended enforcing MFA on provider accounts that access the customer environment. CISA's companion advisory adds that customers should understand the security services the provider delivers and cover any requirements outside the contract's scope. In a co-managed setting, that means a line-by-line answer to: who patches, who reviews alerts, who handles an incident, who talks to your insurer.

Require MFA, central identity and logging

CISA's identity guidance recommends MFA, centralized identity governance, and monitoring and auditing of identity activity, because logs help detect suspicious behavior, misuse of privileged access and compliance problems. Apply this to both teams. Your own administrators should use the same controls as the provider's.

Control privileged accounts

The federal Privileged Identity Playbook recommends inventorying privileged accounts, minimizing the number of privileged users, limiting how long privileged logins last, enforcing least privilege, and logging and auditing privileged activity. In practice:

List every account with administrator rights, internal and external.
Give each person their own named account, never a shared login.
Grant only the rights each role needs.
Review the list on a schedule and remove access when someone leaves either organization.

Guest and external access deserves the same care. Our note on Teams guest access and MFA gaps shows where small organizations leave doors open, and good website and cloud security practices reinforce the same discipline for customer-facing systems.

What to put in the agreement

A co-managed agreement should answer these questions in writing. The same checklist also appears in ITBroker's definition of co-managed IT.

Task ownership. Who owns each recurring task, from patching to onboarding to backup checks.
Tickets and alerts. How they are received, triaged, assigned and escalated.
Access. How it is granted, controlled and logged on both sides.
Response targets. How fast the provider responds at each severity level.
Documentation. Where network diagrams, passwords, runbooks and configurations live, and who updates them.
Exit terms. What documentation, data and tool configurations you keep if you part ways.

The last item is the one organizations skip. If every configuration lives in the provider's tools, leaving becomes painful. Ask up front what you would receive, and in what format.

Co-managed support for local industries

The right split varies by the type of organization. These are examples of how the domain approach often plays out, not fixed packages.

Dental and medical practices. A practice manager or one technician handles daily requests, while a provider takes security, backup testing and compliance guidance, including HIPAA-related safeguards.
Law firms. An internal administrator manages users and software, while the provider handles data protection, Microsoft 365 hardening and recovery planning so client files stay protected.
Manufacturers. A plant IT lead looks after production systems. The provider monitors the office network around the clock and manages the firewall, and can advise on frameworks such as CMMC where contracts require it.
Nonprofits. A part-time or volunteer tech lead sets priorities. The provider covers monitoring, backup and security so limited staff time goes to the mission.

Compliance obligations differ by organization and contract, so confirm your specific requirements with your counsel or the relevant regulator, and then map each requirement to a named owner in your matrix.

Where we fit

We are a locally owned provider serving small businesses in Norman, Moore and Oklahoma City. Our services include 24/7 monitoring, a responsive helpdesk, cybersecurity, backup and recovery, Microsoft 365 management, network management and IT consulting. We explain things in plain language, aim for same-day response and do not require long-term contracts.

If you already have someone handling IT, tell us what that person covers and where the gaps are, and we will build a plan around those gaps rather than a one-size package. Our managed IT support page outlines the core service.

Not sure where your gaps are? Take the 10-minute readiness audit, or request a free network assessment and get a clear picture of your environment before you decide on a split.

How to get started

List what your team does today. Include the hidden jobs: onboarding, backups, vendor calls, license renewals.
Mark the gaps. Note after-hours coverage, security tasks, projects and anything that depends on one person.
Choose the split model. Tier, hours, domain, project, or a mix.
Draft the matrix. Owners, escalation order, response targets and shared tickets.
Lock down access. MFA for everyone, named accounts and logging.
Review quarterly. Check ticket trends, test a restore and adjust ownership as the business changes.

For a broader look at how this compares with other arrangements, see our overview of the shared IT services model and our explanation of what a managed service provider does. Our piece on proactive IT support explains why catching issues early matters.

FAQ

Is co-managed IT the same as managed IT services?

Not quite. Managed IT usually means the provider runs most or all of your IT and is the main contact for users. Co-managed IT shares defined parts of the work with your internal team, which keeps ownership of decisions and business knowledge.

Do we need an internal IT team to use co-managed IT?

You need at least one person who owns IT decisions, such as an IT manager or a capable administrator. Without that, a fully managed plan is usually simpler because the provider can lead day-to-day operations.

Will a provider replace our IT person?

The purpose of co-managed IT is to support your person, not replace them. The provider takes the tasks you agree on, such as after-hours monitoring or security, so your internal lead can focus on work that depends on knowing your business.

What should a co-managed agreement include?

It should state who owns each task, how tickets and alerts are handled and escalated, how access is controlled and logged, response targets, and what documentation and configurations you keep at exit. It should also name who owns each security role.

How do we keep outside access secure?

Require MFA on every account with access to your systems, give each person a named account, limit administrator rights and review activity logs. These steps follow CISA and NSA guidance on provider and customer security.

Sources

Want help putting this into practice?

We'll audit your security, speed, and hardware in under an hour — no commitment, no sales pitch. Just a clear roadmap of what to fix and why.

Schedule Your Free Assessment

Co-Managed IT Support: How It Works and When It Fits