Co-managed IT services pair your internal IT staff with an external managed IT provider. Your team keeps the work that needs business knowledge. The provider covers agreed gaps such as 24/7 monitoring, cybersecurity, escalations and projects.
If you’ve got a good IT person, or a small IT team that’s flat out, you probably don’t need to replace them. You need to stop asking them to be the helpdesk, the security team, the project manager and the after-hours on-call engineer all at once.
This guide is for Sydney business owners, practice managers and IT leads weighing up that decision. It covers how co-managed IT works in practice, who’s responsible when something breaks, what it costs, where these arrangements go wrong, and how to pick a partner your team will want to work with.
It’s written from both sides of the table. Before co-founding TECHD Group in 2019, our Managing Director Ben Neighbour spent over a decade working at managed service providers and leading internal IT teams for private businesses. You can read more about TECHD Group’s directors.
What are co-managed IT services?
Co-managed IT is a shared arrangement where your internal IT team and a managed service provider (MSP) each own defined parts of your technology. You decide the split, and it’s written down so nothing falls between the two.
Think of it as the middle ground. At one end, you run everything in-house. At the other, you hand the whole function to a provider through outsourced IT support.
Co-managed IT keeps your people and their knowledge of your business in place. The provider then adds what a small team can’t realistically maintain on its own: round-the-clock monitoring, a security operations team, specialist engineers and the tools that come with them.
What co-managed IT isn’t
It helps to rule out a few things that often get mistaken for co-managed IT:
- It isn’t a takeover. A good partner works around your team, not over it. If a provider wants to own everything from day one, that’s a fully managed pitch.
- It isn’t contractor hours. A labour-hire technician fills one seat. A co-managed partner brings a whole team, its tooling and 24/7 coverage.
- It isn’t a second helpdesk with no rules. Two teams with overlapping duties and no written split is the most common way these arrangements fail.
How does co-managed IT work day to day?
Both teams work from a shared ticket system, shared documentation and a written responsibility map. Business-specific requests go to your internal team, while after-hours alerts, security events and specialist work route to the provider.
From your staff’s point of view, very little changes. They log a request the same way they always have. Behind the scenes, it lands with whichever team owns that kind of work.
A working co-managed setup is built on five things:
- One ticket queue. Both teams see every request, so nothing gets lost between two systems and you get one set of reporting.
- One set of documentation. Network diagrams, passwords (stored in a vault), supplier contacts and how-to guides live in one place both teams can access.
- Agreed access levels. The provider gets admin access only to the systems it manages, through named accounts with multi-factor authentication and full logging.
- Named escalation contacts. Each side has a named person to call, with a backup, so an urgent issue never stalls while someone works out who to ring.
- A regular review rhythm. A short operational check-in each month, and a quarterly review of the roadmap, the risks and whether the split still makes sense.
Who’s responsible when something goes wrong?
Whoever your written responsibility map says. Decide it before anything goes wrong. Most co-managed failures come from grey areas, not technical gaps, so test the map against real situations rather than a list of IT functions.
Most guides split responsibilities by function: patching, backups, helpdesk tiers. That looks tidy on paper but tends to fall apart at 2am, when nobody’s sure whether “security monitoring” includes the authority to shut down a laptop.
A better test is to walk through the situations your business will actually face. Here’s how a typical split plays out:
| Situation | Your internal IT team | Your co-managed partner | Who makes the final call |
|---|---|---|---|
| A security alert fires at 2am on a Saturday | Briefed next business morning, or called straight away if a critical system is affected | Investigates, contains and documents the incident through its 24/7 security operations team | Agreed in advance: what the partner can isolate without asking first |
| A new starter begins on Monday | Sets up role-specific apps and approves access | Builds and secures the device, applies the security baseline, assigns Microsoft 365 licences | Internal IT lead |
| A staff member leaves on bad terms | Confirms timing with management and HR | Disables accounts, signs out active sessions, secures the mailbox and devices | Management |
| Your IT person takes two weeks’ leave | Hands over open work through the shared documentation | Covers the ticket queue and on-call duties | Internal IT lead, before leave starts |
| Your cyber insurance renewal arrives | Supplies business details and coordinates sign-off | Provides evidence of the security controls it manages | A director signs the declaration |
| You suspect client data has been exposed | Explains which systems, data and clients are involved | Leads the technical investigation and preserves evidence | Leadership decides on notifying clients and the regulator |
| The design team is moving to Macs | Confirms who needs what, and when | Deploys, enrols and manages the devices alongside your Windows fleet | Internal IT lead |
The last column is the one most agreements skip, and it’s the one that matters most in a crisis. Writing down what the partner can do without asking you, such as isolating a laptop that’s showing signs of ransomware, can save hours when every minute counts.
The data breach row deserves extra care. If your business is covered by the Privacy Act, the Office of the Australian Information Commissioner says you must take all reasonable steps to complete an assessment of a suspected eligible data breach within 30 calendar days of becoming aware of it (OAIC). Your co-managed agreement should say who raises the alarm and who leads the technical side of that assessment, so the clock doesn’t run down while two teams wait on each other.
When does a Sydney business need co-managed IT rather than fully managed IT?
Choose co-managed IT when you already have at least one capable internal IT person and want to keep their business knowledge. Choose fully managed when you have no dedicated IT staff, or your IT person is about to leave.
Here are the situations where co-managed IT tends to pay off.
You rely on one IT person
If one person holds every password, knows every quirk of your network and is the only one who can fix the finance system, you’ve got key-person risk. Holidays, illness or a resignation can leave your business without IT support overnight.
A co-managed partner gives that person backup and makes sure their knowledge is documented. We explore this risk in detail in our whitepaper Is One IT Person Enough?
Your IT lead never gets to the important work
When your most capable IT person spends their days on password resets and printer issues, the projects that would actually move your business forward keep getting pushed back. Handing routine and after-hours load to a partner frees them up for the work that needs someone who knows your business.
Security has outgrown your team
Cyber threats don’t keep business hours, and a team of one or two can’t watch your systems 24/7. The cost of a breach is real. The Australian Signals Directorate’s Annual Cyber Threat Report 2024-25 puts the average self-reported cost of cybercrime per report at $97,200 for medium businesses, up 55% on the year before, and $56,600 for small businesses (ASD’s ACSC).
A co-managed partner with a 24/7 Security Operations Centre can watch your devices, Microsoft 365 environment and firewall logs around the clock while your team sleeps.
A deadline or project is bigger than your team
An Essential Eight compliance uplift, a cloud migration or an office relocation can swamp a small team that’s also running day-to-day support. A co-managed partner can deliver the project under your team’s direction, then step back once it’s done.
Your fleet is part Mac, part Windows
This one’s often overlooked. Many MSPs are Microsoft-only, so when a business brings in Macs for its design or leadership team, those devices default to the internal IT person, who may not have Apple management experience either.
A partner with genuine Apple business deployment capability can manage Macs, iPhones and iPads in the same arrangement as your Windows devices and Microsoft 365.
When fully managed IT is the better fit
Co-managed IT isn’t always the answer. If you have no dedicated IT staff, or your internal team is complete with no skill or capacity gaps, you’ll either get better results from fully managed IT or not need outside help at all.
What should your internal IT team keep, and what should you hand over?
Keep the work that depends on knowing your people, processes and priorities. Hand over the work that needs 24/7 coverage, specialist tools or deep security skills that one or two people can’t realistically maintain.
Work your internal team is usually best placed to keep:
- Face-to-face support for staff and leadership
- Line-of-business applications, such as your practice management, design or job management software
- Onboarding and offboarding decisions
- Relationships with your key software vendors
- Internal projects that need deep business context
Work that usually makes sense to hand over:
- 24/7 monitoring and after-hours response
- Security operations: threat detection, investigation and response
- Patching and device security across Windows, Mac and mobile
- Microsoft 365 security and administration
- Backup monitoring and test restores
- Overflow tickets when your team is busy, on leave or off sick
- Large projects and specialist work, such as network upgrades, cloud migrations and compliance programs
Strategy is the exception. It works best as a shared job: your internal lead owns the roadmap because they know where the business is heading, while the partner brings what it’s seeing across the market and other clients.
What does co-managed IT cost?
Co-managed IT is priced by the scope the partner takes on, not just your headcount. Fees are usually lower than fully managed IT for the same business size, because your internal team still handles part of the work.
Providers typically price co-managed IT in one of three ways:
- Per user, per month, where the partner supports everyone in the business for an agreed set of services
- Per device, per month, which suits businesses with stable staff numbers but changing device counts
- A fixed scope fee, covering defined services like monitoring and security, with projects quoted separately
What are the risks of co-managed IT, and how do you avoid them?
The main risks are blurred accountability, uncontrolled admin access, duplicated tools, friction between the two teams and no exit plan. Each is avoidable with a written responsibility map, least-privilege access, one shared toolset and clear exit terms.
Grey-zone tickets. When a request could belong to either team, it often belongs to neither. Fix it with the scenario test above, and review the responsibility map every quarter as your business changes.
Admin access sprawl. Every extra person with admin rights is another way into your systems. Insist on named accounts for each engineer (never a shared login), multi-factor authentication on every privileged account, and a regular review of who has access to what. Ask the partner how it secures its own systems too, because its access becomes part of your risk.
No independent check. When two teams share the work, it’s easy for each to assume the other has covered a gap. Regular CREST-accredited penetration testing gives you an independent view of how well the combined setup is holding up.
Insurance declarations nobody can back up. Cyber insurance renewal forms ask you to confirm that specific security controls are in place. In a co-managed model, the person signing needs evidence from both teams. Our guide to answering cyber insurance renewal questions explains why that matters.
Your IT person feels replaced. This is the people risk, and it’s the one that quietly sinks arrangements. If your internal team sees the partner as a threat, they’ll keep knowledge in their heads instead of the shared documentation. Leadership needs to be clear from day one that the partner is there to back them up, not push them out.
No exit plan. Your documentation, passwords and configuration belong to you. The agreement should spell out how they’re handed back if you part ways, and what transition support you’ll get.
It should also cover the reverse situation. If your IT person resigns, can the partner step up to fully managed support while you decide whether to rehire? A good co-managed arrangement doubles as your safety net for exactly that moment.
How do you choose a co-managed IT partner in Sydney?
Pick a partner that has run co-managed arrangements before, shares its tools and documentation with your team, puts response times in writing, and can cover your whole environment, including Microsoft 365, security and any Apple devices.
These questions are specific to co-managed IT, and they’ll quickly separate experienced partners from providers who’d rather run everything themselves:
- Can you show us a responsibility map from a current co-managed client? (Names removed, of course.)
- Will our internal team see the same tickets, dashboards and reports you do?
- What can your team do during an incident without asking us first?
- How do you handle a disagreement between your engineers and our IT lead about the right fix?
- Which of our existing tools would we keep, and which could we cancel?
- If our IT person left tomorrow, how quickly could you take on full support?
Local presence matters too. Remote support handles most issues, but when a network fails or an office moves, you want engineers who can be on site across Greater Sydney.
For the broader checklist that applies to any provider, read our guide on how to choose a managed IT provider in Sydney.
How does TECHD Group work alongside internal IT teams?
TECHD Group works around your existing IT staff. We take on 24/7 monitoring, security operations, escalations and projects, and your team keeps the work that needs business knowledge. We’re based in Manly with on-site support across Greater Sydney.
Every co-managed engagement follows the same structure:
- IT assessment. We look at your environment, your team’s workload and where the gaps and risks sit.
- Responsibility map, agreed in writing. Built around real scenarios like the ones above, and signed off before we’re given any access.
- Access and monitoring. Named, multi-factor protected accounts for our engineers, then 24/7 Security Operations Centre monitoring across your devices, Microsoft 365 and firewall logs.
Beyond the day to day, you get support response and resolution timeframes in writing, CREST-accredited penetration testing with reports delivered within 48 hours, and Apple business deployment alongside Windows and Microsoft 365. That last one is uncommon among Sydney MSPs.
Internal IT leaders already work with us this way. Nic Zanelli, Head of Information Technology Operations, says TECHD Group “ensures that our operations run smoothly without any disruptions.”
Is your IT team stretched too thin?
Your IT person knows your business better than any provider ever will. They just shouldn’t have to carry everything alone.
Book a free IT assessment with TECHD Group. We’ll map what your internal team handles today, show you where the gaps and risks are, and give you a clear, written proposal for which responsibilities make sense to share. There’s no pressure to replace anyone. Prefer to talk it through? Call us on 1300 4 83243.
Already know you need broader support? Explore our managed IT services.
Frequently asked questions about co-managed IT
What’s the difference between co-managed IT and managed IT services?
Co-managed IT keeps your internal IT staff in place and adds an outside provider to cover agreed gaps, such as after-hours monitoring, security or projects. Fully managed IT hands the whole function to the provider. Co-managed suits businesses with at least one capable IT person, while fully managed suits businesses with no dedicated IT staff.
Is co-managed IT cheaper than hiring another IT person?
Usually, if your gap is specialist or after-hours work. A second hire adds one person’s skills during business hours. A co-managed partner adds a whole team with security, cloud and monitoring depth around the clock. If your gap is simply more everyday tickets, a junior hire can sometimes be the better value.
Will a co-managed IT provider replace our internal IT team?
A well-run co-managed arrangement shouldn’t. The point is to take repetitive, after-hours and specialist work off your team so they can focus on the work that needs real business knowledge. If a provider pushes to take over everything from day one, that’s a fully managed pitch, not a co-managed partnership.
Who is responsible for a cyber incident in a co-managed IT model?
Your written responsibility map decides it. Typically, the provider leads the technical response, your internal team supplies business context, and leadership makes the big decisions, such as notifying clients or the regulator. Agree this before go-live, including what the provider can do without asking, so nobody is guessing mid-incident.
Does co-managed IT work for businesses that use Macs?
Yes, as long as your provider genuinely supports Apple. Many MSPs are Microsoft-only, which leaves Macs and iPhones with your internal team by default. TECHD Group is an Apple Business Partner, so Apple deployment and management can sit inside the co-managed agreement alongside Windows devices and Microsoft 365.
