Co-Managed IT Services

What co-managed IT is and who it fits

Co-managed IT fits companies that already employ one or more IT people but cannot cover every skill, every hour or every project with them. It is often the next step for a company that has outgrown a single IT generalist.

Typical situations:

• A one-person IT department. One person cannot cover 24/7 security alerts, vacations and sick days, and still finish projects.
• A small IT team without security depth. A help desk and a systems administrator, but no one watching security alerts at night.
• A team stuck on tickets. Projects stall because staff spend the day on password resets.
• An internal developer or ERP specialist who handles the business software but not the network or devices.

It is different from full outsourcing, where the provider does all of the work and you have no IT staff. Our outsourced IT services page covers that model. In co-managed IT, your staff stay in charge and the provider works for them as much as for you.

The cost case: a network and computer systems administrator earned a median of $99,130 in May 2025 ² and an information security analyst $129,180 ³. Adding a second or third specialist is expensive. Renting those skills and a 24/7 monitoring team costs less than hiring them.

What the provider covers vs your internal staff

The provider usually covers work that needs round-the-clock staffing, specialist tools or extra hands, while internal staff keep the work that needs knowledge of your business and its people. The table above shows a common split. Your own split should be written into the contract as a responsibilities matrix.

Work that usually moves to the provider:

• After-hours and overflow help desk
• 24/7 monitoring of endpoint detection and response (EDR) and security alerts
• Patch deployment and reporting
• Backup monitoring and restores
• Network and firewall management, if your staff are not network specialists
• Engineers for large projects, such as a cloud migration

Work that usually stays inside:

• Business application support (ERP, line-of-business software)
• Onboarding and offboarding decisions
• Approving changes and accepting risk
• Vendor contracts, budget and strategy
• Relationships with department heads and users

Give every task one owner. A shared task with no single owner is how patches get missed and backup failures go unnoticed. When a security incident happens, the matrix should say who takes the first call, who can isolate a computer, and who calls the insurer. See our incident response page for what that process involves.

Typical co-managed IT use cases

The three most common reasons to buy co-managed IT are help desk overflow, security monitoring and project capacity. Many companies start with one and add others later.

Help desk overflow. The provider takes after-hours calls, vacation coverage, or all Tier 1 tickets so your staff can work on harder problems. Some companies route only overflow; others send every ticket through the provider's queue first. Our help desk outsourcing page covers per-ticket pricing if you only need this piece.

Security monitoring. This is often the strongest case for co-managed IT. Attackers do not keep office hours, and one internal person cannot watch alerts at 2 a.m. A provider can run managed detection and response on your endpoints and escalate to your team. Mainstream MDR runs $8 to $25 per endpoint per month in one 2026 market analysis ⁴.

Project capacity. Migrations, office moves, new network builds and Microsoft 365 rollouts need extra hands for a few months. A co-managed provider supplies engineers on a project basis, which avoids hiring for temporary work. See cloud migration services for a common example.

Compliance work. Regulated firms sometimes bring in a co-managed partner to run the technical controls needed for frameworks such as NIST SP 800-171, while internal staff own the policies and evidence.

Succession and coverage. If your only IT person leaves, a co-managed provider that already knows your environment can keep things running while you hire. That matters most where one person holds every password and all the system knowledge. Make sure the provider's documentation is current enough to make that handoff work.

Co-managed IT pricing

Co-managed IT pricing runs $45 to $175 per user per month in one provider's published 2026 estimate, depending on how much the provider takes on ¹. No neutral survey of co-managed pricing exists, so treat these figures as a guide and compare written quotes.

That estimate breaks into three tiers ¹:

• $45 to $75 per user per month: escalation support and basic monitoring.
• $85 to $130 per user per month: adds EDR and patch management.
• $130 to $175 per user per month: adds a security operations center (SOC) and SIEM layer.

For comparison, published guides put fully managed IT at $100 to $250 per user per month ⁵. Co-managed IT is usually cheaper per user because your staff still do part of the work. Some providers price co-managed work per device or as a flat monthly retainer instead.

Also ask about:

• Onboarding fees for deploying tools and documenting your environment
• Whether project hours are included or billed separately
• After-hours rates if overflow support is billed by the hour
• Licensing: whose name the tool licenses are in, and what happens to them if you end the contract

For full managed IT pricing models and what moves a quote up or down, see our managed IT services pricing page.

Tools access and how to make co-managed IT work

Co-managed IT works when both teams use the same ticket system and monitoring tools, and when your staff keep full admin access to everything. Agree on this before signing.

Settle these points in writing:

• Shared tools. Your staff should log into the provider's remote monitoring, ticketing and documentation systems with their own accounts, not request reports.
• Admin access stays with you. Your company owns the Microsoft 365 global admin, firewall, domain and backup accounts. The provider gets named, delegated access that you can revoke.
• Change control. Who can approve a firewall change or a new admin account, and how changes are logged.
• Escalation paths both ways. Your team escalates to the provider's engineers; the provider escalates business decisions to your team.
• A regular meeting. A short weekly or monthly sync to review open tickets, alerts and projects.
• An exit plan. How tools, documentation and access are handed back if the contract ends.

Ask providers how many co-managed clients they support today. Some MSPs are built only for full outsourcing and treat internal IT staff as an obstacle. Our guide to choosing an MSP lists more questions, and you can send a request through our form to hear from a provider that offers co-managed plans.