How Co-Managed IT Works at an MSP
In a co-managed engagement the client keeps its own IT staff and brings in an MSP for the parts that team cannot cover well: after-hours monitoring, security tooling, patching at scale, project capacity, or senior expertise. The full explanation of why clients choose it and how the relationship runs is in what is co-managed IT. This entry covers the terms and decisions an MSP owner needs when scoping one.
Splitting Responsibility
The whole engagement rests on a written division of work. A responsibility matrix, agreed before onboarding, is the single most useful document in a co-managed deal. A simple version looks like this:
| Area | Typical Owner | Why |
|---|---|---|
| Monitoring and alerting | MSP | Needs round the clock coverage and tooling |
| Patching and endpoint security | MSP | Scales with automation in the RMM |
| End user support | Client IT | Knows the people and the business applications |
| Line of business applications | Client IT | Institutional knowledge sits internally |
| Incident response | Shared | Needs a named lead and an escalation path |
| Strategy and budgeting | Shared or vCIO | Depends on the seniority of internal staff |
Every row should name who acts, who is informed, and how fast. That is also what the SLA should measure, because a response time is meaningless if nobody agreed who responds.
Pricing and Tooling Decisions
Co-managed is a different service, not a discount on fully managed. You carry the same tooling cost per endpoint, you spend more time coordinating, and your work is reviewed by people who understand it. Price the coordination, not just the endpoints, and confirm the numbers with the managed services pricing calculator.
Decide early whose tools are the system of record. Two ticketing systems and two documentation platforms guarantee lost work, so most MSPs either give internal staff access to their PSA or agree a single integration point. Grant internal IT access by named individual accounts only, with permissions matched to the matrix.
Keeping the Relationship Healthy
- Hold a regular QBR with both the internal IT lead and the executive who signs the contract, since their priorities differ.
- Report against the responsibility matrix, including items the client team owns, so gaps surface before an incident does.
- Revisit the split when internal staff change; a departure often moves work to the MSP without anyone updating the contract.
The strongest co-managed relationships treat the internal team as colleagues. Invite them to your documentation standards, share the runbooks for anything you both touch, and give them a direct escalation path to a senior technician. When the internal lead trusts your team, they defend the contract at renewal instead of questioning it. A senior vCIO can also fill the strategy gap many internal teams have, which is often the part of the engagement the executive values most.
Common Questions
Who owns admin credentials in co-managed IT?
Both sides need admin access, but each person should have a named account with permissions matching their role. Shared admin logins make every incident harder to investigate.
Can co-managed become fully managed later?
Often it does, usually when the internal IT person leaves. Write the contract so the scope and price can expand without renegotiating everything.
What if internal IT resists the MSP?
Agree the split with the executive sponsor, not just IT, and position the MSP as extra capacity rather than a replacement. Resistance usually comes from unclear roles.
Does co-managed suit small clients?
It is most common where a client has at least one dedicated IT person. With no internal staff there is nothing to co-manage, and a fully managed agreement fits better.