Co-managed vs fully managed IT: which is right for you?

You can outsource all of your IT, or only part of it. The choice between co-managed and fully managed IT comes down to one question: do you have people in house who should own IT decisions? Both are called managed IT, but they suit very different organisations, and the contract looks different for each.

Fully managed IT

With fully managed IT, a provider becomes your IT department. It runs the helpdesk, manages every device and Microsoft 365, and handles security, patching, backup, starters and leavers. It also gives you a roadmap and regular reviews. You pay a predictable monthly fee, usually based on the number of devices or people.

It suits organisations without an IT team, or with one person whose IT work has outgrown them, and leaders who want one accountable partner rather than managing IT themselves.

Co-managed IT

With co-managed IT, your in-house team stays in charge and the provider adds the skills and time you are missing. That might be third-line engineering, specialist Jamf or Intune skills, extra capacity for a project, holiday and sickness cover, or a second opinion on a change. The provider works inside your tools and ticketing, and passes knowledge to your team as it goes.

It suits organisations with a capable IT team that lacks time or specialist knowledge, and those that want to keep control and knowledge in house.

Side by side

Responsibilities are the real difference

In a fully managed service, the answer to “who does this?” is nearly always the provider. In a co-managed service, the answer changes area by area, and that is where things go wrong if nobody writes it down. The NCSC’s guide to choosing a managed service provider calls a matrix of responsibilities, setting out what the provider does and what you do, good practice. It also says the contract should cover roles, incident reporting and liability.

A typical co-managed split looks like this: your team handles day-to-day requests and everyday administration; the provider takes third-line fixes, root-cause analysis, design work on platforms such as Jamf and Intune, and project delivery; documentation is shared. Agree it at the start and review it as your team changes.

Access in a shared model

When two teams administer the same systems, access needs more care, not less. The NCSC recommends giving a provider only the permissions it needs (least privilege) and requiring 2-step verification on its accounts. For Microsoft 365, Microsoft’s granular delegated admin privileges (GDAP) give partners customisable, time-bound roles instead of blanket admin rights, and you can see and remove any partner’s roles at any time from the Partner relationships page in the Microsoft 365 admin center. Named accounts for each engineer make it clear who changed what.

Comparing cost fairly

Co-managed IT usually costs less than fully managed, because the provider covers less. That is not the right comparison, though. Compare fully managed IT with the full cost of the in-house team you would otherwise need, and compare co-managed IT with the cost and delay of hiring the missing skills. For reference, our managed IT support starts from £25 per device per month, excluding VAT and licences, and agreements normally run for two years, with a one-year minimum. Co-managed work is agreed to fit your workload.

Questions to ask yourself

• Do we have someone in house who can own IT decisions?
• Where are tickets or projects delayed today: time, skills or both?
• What happens when our IT person is on holiday or leaves?
• Do we want to build knowledge in house, or hand it to a partner?

When to change models

Many organisations start with one model and move to the other. A growing business may hire its first IT manager and move from fully managed to co-managed, keeping the provider for specialist work. Another may find its internal team cannot keep up and hand the whole service over. Cranbrook Legal, a central London legal practice, had relied on an internal team that lacked the technical depth to give a consistent service, and moved to a fully managed service with us. Because the provider already knows your environment, moving between models is usually straightforward.

How we help

We offer both. Our fully managed IT support makes us your complete IT department. Capacity Creation, our co-managed IT service, gives in-house teams senior engineers and Apple and Microsoft specialists when they need them. See how our pricing works, and we will tell you honestly which model fits.