Most businesses assume they face a binary choice: hire an internal IT team or outsource everything to a provider. The reality in 2026 is more nuanced. Co-managed IT, where an internal IT person or team works alongside an MSP, is increasingly common, particularly in businesses going through rapid growth or platform transitions. But it only works when the internal and external responsibilities are clearly divided.
This article maps both models honestly, including where each one breaks down, and gives you a framework to decide which fits where your business is right now. If you want a detailed explanation of what co-managed IT involves, we have covered that in a standalone guide. What follows is the decision framework.
What Co-Managed IT Actually Means and What It Does Not
The Spectrum from Fully Internal to Fully Outsourced
Most businesses do not sit cleanly at either end of the IT model spectrum. A fully internal IT function means all technology decisions, infrastructure management, security operations, and helpdesk support are handled by employed staff. A fully outsourced model means all of those functions sit with an external provider. In practice, most businesses land somewhere between the two.
Co-managed IT is the formalised version of a mixed model. It has a defined split of responsibilities between an internal IT person or team and an external MSP. The keyword is defined. Many businesses already have an informal version of this, one internal IT person handling day-to-day requests, an MSP handling infrastructure and security, with no clear line between them. The informal version looks like co-managed IT but behaves like break-fix with a managed service contract attached.
What the MSP Handles vs What Stays Internal in a Co-Managed Model
A workable co-managed arrangement requires a written responsibility matrix before any work begins. Without it, issues fall through the gap between internal and external, each side assuming the other owns it.
The most common split: the internal IT person handles first-line helpdesk requests, asset management, and day-to-day user support. The MSP handles infrastructure monitoring, security operations, DMS configuration and management, Cyber Essentials programme management, and projects that require specialist capability. The line between them should be documented, reviewed quarterly, and updated when responsibilities shift.
The informal version, where nobody has written down who owns what, produces a pattern of dropped issues and escalation confusion that costs more in operational friction than either model saves individually.
What Fully Outsourced IT Gives You That Co-Managed Cannot
Single Point of Accountability
The strongest argument for full outsourcing is accountability. When everything is with one provider, there is no ambiguity about who owns a problem. A user cannot reach you, a device will not connect to the network, a security alert has fired: one call, one team, one responsibility. In a co-managed arrangement, the first question in any incident is which team owns it. That question takes time to answer, and in a security incident, time is the variable you cannot spare.
For businesses whose IT environment is complex or whose compliance requirements are demanding, single-point accountability is worth a significant premium over a co-managed model where the seams between teams become visible under pressure.
24/7 Coverage Without Internal Headcount
A fully outsourced managed service can provide out-of-hours monitoring and response as part of the contract, because the provider spreads that cost across their entire client base. An internal IT hire provides coverage during working hours. Anything outside those hours depends on contractual on-call arrangements, individual goodwill, or nothing.
For businesses with remote workers across time zones, a distributed workforce, or systems that require continuous monitoring, the coverage gap in a co-managed model is real. The MSP component can provide the monitoring, but incident response outside hours typically falls to the internal person unless the contract explicitly allocates it to the provider.
Access to Specialist Capability Across Apple, Security, and Compliance
A fully outsourced specialist MSP brings a depth of capability across Apple platform management, cyber security, and compliance programme management that a single internal IT hire cannot match, regardless of their competence. This is a function of focus: a specialist MSP works on these problems every day, across multiple clients, and develops the depth of experience that a generalist internal hire running a broader role cannot accumulate at the same rate.
For a business whose fleet is Mac-first, whose compliance requirements include Cyber Essentials or ISO 27001, and whose IT environment is evolving, the capability gap between a specialist MSP and a capable internal generalist is widest exactly where it matters most.
On cost: A mid-market IT support hire in London currently costs a business £42,000 to £55,000 per year in total employer costs, including salary, National Insurance, pension contributions, and basic benefits, before training, equipment, or management overhead. A fully outsourced managed service at this scale is typically competitive with that figure on a per-user basis, while providing broader capability and no single point of failure if the person leaves. For a direct cost comparison against your specific fleet size, Dr Logic can provide this as part of a no-obligation review.
When Co-Managed Is the Right Model
You Have an internal IT Capability That Handles Day-to-Day Well
Co-managed works when the internal IT person is genuinely capable of handling first-line support independently, and the MSP is adding specialist capability they do not have, not filling gaps in basic coverage. If the internal person is stretched handling routine requests, adding an MSP to handle the more complex work alongside them compounds the responsibility confusion rather than resolving it.
The honest version of this assessment: if your internal IT person would describe their role as primarily reactive, co-managed IT will not make it proactive. It will add a second team to a reactive environment.
You Are Going Through a Specific Transition
Co-managed IT works well as a transition model. A business moving from Windows to Mac, scaling from 30 to 100 users, integrating an acquired company’s IT environment, or implementing Cyber Essentials for the first time has a defined body of specialist work that runs alongside ongoing day-to-day support. An MSP brought in to handle the transition while the internal person maintains continuity for users is a practical structure with a clear end state.
The risk is treating the transition arrangement as permanent. Once the specialist project is complete, the co-managed model requires redefining what the MSP’s ongoing role is, or the arrangement drifts into the informal version described above.
You Want to Retain Strategic IT Control Internally
Some businesses have a deliberate reason to keep IT strategy and vendor relationships internal: a CTO or IT Director who wants external execution capability without external strategic influence, or a business where IT is a competitive differentiator and the knowledge needs to stay inside the organisation. Co-managed IT serves this need well when the internal strategic function is genuine and the external execution capability is clearly scoped.
When Fully Outsourced Is the Right Model
Under 100 Staff With No Dedicated Internal IT Person
For businesses under 100 staff with no internal IT function, full outsourcing is almost always the better model. The per-user cost of a managed service at this scale is typically lower than a single IT hire, and the capability is substantially broader. A single internal hire cannot provide 24/7 monitoring, specialist Apple expertise, security operations, and compliance programme management simultaneously. A managed service can, because those functions are distributed across a team.
The common mistake at this scale is hiring a junior IT person and also paying for a managed service, then finding that the responsibilities overlap and neither is working to full effect.
Compliance Requirements That Exceed Internal Capability
Cyber Essentials Plus, ISO 27001 certification, GDPR compliance programme management, and Cyber Essentials renewal cycles are all achievable by a capable internal IT person, but they represent a significant proportion of a single person’s time. For a business whose compliance requirements are growing, full outsourcing to a provider that holds these certifications itself and manages them continuously across its client base is typically more reliable and less expensive than building the programme internally.
A Remote or Distributed Team Where Consistent Support Coverage Matters
A distributed team across multiple locations or time zones creates a support coverage requirement that a co-managed model with one internal person cannot consistently meet. A fully outsourced service with defined coverage windows and remote support capability serves a distributed workforce more reliably than a model that depends on one person’s availability and location.
The Decision Framework: Three Questions to Answer Before You Choose
What Internal IT Capability Do You Currently Have and Want to Retain?
Strong internal capability that you want to keep, with a defined specialist gap, points toward co-managed. No internal IT function, or an internal function that is primarily reactive and stretched, points toward full outsourcing. The honest version of this question also asks whether the internal person wants to work in a co-managed arrangement: some IT professionals thrive with specialist MSP support alongside them; others find the shared responsibility model creates friction they would rather not navigate.
What Are Your Compliance Requirements Over the Next 12 Months?
A Cyber Essentials renewal, a first certification attempt, an ISO 27001 programme, or a regulatory audit in the next 12 months requires sustained specialist attention. If that capability exists internally, co-managed can work. If it does not, full outsourcing to a provider that manages compliance programmes continuously is the lower-risk choice.
What Does Your Growth Trajectory Look Like?
A business growing from 30 to 80 users in 18 months will outgrow a co-managed arrangement built for 30 users unless the model is actively managed and updated as the business scales. Full outsourcing with a per-user contract scales more naturally with headcount growth, because the cost and capability both adjust as the fleet grows.
For most businesses in Dr Logic’s core market, growing Mac-first businesses between 50 and 150 users with Cyber Essentials in scope and no dedicated internal IT Director, the answer is fully outsourced with a specialist Apple MSP. The co-managed model is the right answer for a smaller subset: businesses with a capable internal IT function, a defined specialist gap, and the management bandwidth to run a clear responsibility matrix between two teams.
If you are not sure which IT model fits your business right now, Dr Logic can run a no-obligation review of your current setup and give you an honest recommendation.
Related Articles
- What Are Co-Managed IT Services?
- Is Outsourced IT Support Right for Your Business?
- Switching to an Apple-Dedicated MSP: What the Transition Looks Like
FAQs
What is the difference between co-managed IT and fully outsourced IT?
Co-managed IT means an internal IT person or team works alongside an external MSP, with responsibilities divided between them. Fully outsourced IT means all IT functions sit with an external provider. Co-managed works when the responsibility split is clearly documented. Without a written matrix of who owns what, co-managed IT in practice becomes a reactive arrangement where issues fall through the gap between two teams.
Is co-managed IT or full outsourcing better for a growing business?
For most UK businesses under 100 staff with no dedicated internal IT function, full outsourcing is typically the better model. The per-user cost is usually comparable to or lower than a single IT hire, and the capability is broader. Co-managed IT suits businesses that have a capable internal IT function they want to retain, with a defined specialist gap that an MSP fills. Growth trajectory matters: full outsourcing scales more naturally with headcount than a co-managed model built for a smaller team.
When is co-managed IT the right choice?
Co-managed IT is the right model when a business has a capable internal IT function it wants to retain, a clearly defined specialist gap that an external MSP fills, and the management bandwidth to maintain a documented responsibility matrix between two teams. It also works well as a transition model during a specific project, such as a platform migration, a compliance programme implementation, or rapid headcount growth, where specialist external support runs alongside internal continuity.
