954-539-5678Free audit
Menu

Managed IT · Co-managed

Keep your IT person and add a team behind them

How co-managed IT works, which tasks to split, and the one-page responsibility chart that prevents dropped balls.

Who usually does what

Sharing admin access safely

A responsibility chart to copy

Get your free Technology Health Assessment

30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.

The short answer

Co-managed IT means your in-house IT person or small team keeps their role, and an outside provider covers the work they cannot: overflow help desk, after-hours coverage, security tools and monitoring, backups, specialist projects and vacation cover. It works when every recurring task has one named owner in writing, both sides use the same ticketing and documentation, and admin access is shared through separate, auditable accounts. It fails when “we both handle security” means nobody does. The rest of this article shows how to split the work and set it up.

Why businesses choose co-managed IT

A business with 40 to 100 people often has one IT person who knows the company well. That knowledge is valuable and hard to replace. The problem is coverage. One person cannot be an expert in networking, Microsoft 365, security, backups and the accounting system at the same time, take vacation without a gap, and keep up with projects while answering every ticket.

Hiring a second person is expensive. The Bureau of Labor Statistics puts the May 2025 median pay for network and computer systems administrators at $99,130, before benefits, tools and training. Co-managed IT adds depth and tooling without a second full salary, and it gives your IT person someone to escalate to.

Typical triggers:

  • The IT person is buried in password resets and has no time for projects.
  • A cyber-insurance application asks about controls nobody has documented.
  • The business added a location or grew past the point one person can cover.
  • Leadership worries about what happens if the IT person leaves or is out sick.

Common ways to split the work

There is no single right split. These three patterns cover most small and midsize businesses.

Provider runs the platform

Your IT person handles users, on-site requests and business apps. The provider runs patching, endpoint protection, backups, monitoring and the network.

Provider runs the help desk

The provider takes first-line tickets. Your IT person focuses on projects, vendors and strategy, and handles escalations that need local knowledge.

Provider fills gaps

Your IT person does most of the work. The provider covers security tooling, after-hours, vacations and specific projects such as a migration.

Put responsibilities in writing

CISA’s joint advisory on managed service providers tells customers to clearly identify ownership of security roles and responsibilities, including who handles hardening, detection and incident response. In a co-managed setup that matters twice as much, because there are two parties who might each assume the other is doing it.

Build a one-page chart. List each recurring task, then mark one owner, who helps, and who must be told. A starting list:

  • New user setup and day-one accounts
  • Leaver account removal, same day
  • Windows and application updates
  • Endpoint protection alerts and response
  • Backup monitoring and quarterly restore tests
  • Firewall, switch and Wi-Fi changes
  • Microsoft 365 or Google Workspace admin settings
  • Line-of-business application support and vendor calls
  • Hardware purchasing and replacement planning
  • Security incident first response and escalation
  • Cyber-insurance questionnaire answers
  • Documentation of systems, passwords and vendors

Every line gets exactly one owner. Review the chart every quarter and whenever someone changes roles.

Share admin access safely

Co-managed IT means more people with administrator rights. Handle that deliberately.

  • Separate named accounts. Each person gets their own admin account, never a shared login. CISA advises that provider accounts be treated as privileged, protected with multi-factor authentication, and not reused across customers.
  • Least privilege. Give each account only the roles it needs. Microsoft’s granular delegated admin privileges (GDAP) let a partner receive specific, time-bound roles in your Microsoft 365 tenant, granted explicitly by you, instead of blanket global admin.
  • Logging. Turn on audit logs so you can see who changed what. CISA recommends keeping the most important logs for at least six months.
  • An exit switch. Know exactly which accounts to disable if the relationship ends. CISA notes that provider accounts are often left active after contracts end.

Make the day-to-day work

  1. One ticket system. Both sides work from the same queue, or the provider’s system feeds yours. Email threads are not a ticket system.
  2. One documentation store. Network diagrams, vendor contacts and procedures live in one place both sides can edit.
  3. Clear escalation. Agree which issues go straight to the provider, which go to your IT person, and how after-hours calls are routed.
  4. A regular meeting. Thirty minutes every two weeks to review open issues, upcoming changes and projects.
  5. Change notice. Neither side makes changes to shared systems without telling the other first.

If you want an outside read on where the gaps are before you split the work, our free Technology Health Assessment rates IT operations, cybersecurity and business continuity in a plain-language report the next day, with next steps in order.

Getting started: the first 60 days

  1. Weeks 1 and 2: discovery. The provider documents your users, devices, network, cloud tenant and key applications with your IT person, who knows where the quirks are.
  2. Weeks 3 and 4: agree the chart. Draft the responsibility chart together, get leadership sign-off, and set up admin accounts and the shared ticket queue.
  3. Weeks 5 to 8: install and stabilize. Deploy monitoring, endpoint protection and backup tools, fix urgent gaps found in discovery, and run a first restore test.
  4. Day 60: review. Look at ticket volumes, response times and anything that fell between the two sides, then adjust the chart.

Signs the arrangement is not working

  • Tickets bounce between your IT person and the provider with no one taking ownership.
  • Changes appear on shared systems that the other side did not know about.
  • Your IT person cannot see the tools or reports the provider uses.
  • Nobody can say when backups were last restored successfully.
  • The responsibility chart has not been updated since it was signed.

Most of these trace back to an unclear owner. Fix the chart first, then the process. If the same task keeps slipping, move it entirely to one side rather than sharing it, and write down why so the decision survives staff changes on either side.

Questions to ask a co-managed provider

  • How do you work with an internal IT person day to day, and who has the final say on changes?
  • Which tools will you install, and will our IT person have access to them?
  • How is pricing calculated if we split tasks rather than hand over everything?
  • What happens to our documentation and access if we end the arrangement?
  • Can you cover vacations and after-hours requests, and how are those billed?

JLB USA provides managed IT for businesses with roughly 25 to 100 employees and can work alongside an existing IT person, splitting the work the way your team needs. Security tooling and monitored backups are part of our cybersecurity services.

Keep reading

Book it now

Pick a time for your 30 minutes

Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.

Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.

Questions we hear

What is co-managed IT?

An arrangement where your in-house IT staff keep their role and an outside provider covers agreed parts of the work, such as help desk overflow, security tools, backups, after-hours support or projects.

Is co-managed IT cheaper than fully managed IT?

It depends on the split. You keep paying your IT person, so total cost can be similar. The value is depth and coverage that one person cannot provide, without hiring a second employee.

Will a co-managed provider replace our IT person?

It should not. A good co-managed setup makes your IT person more effective by taking routine or specialist work off their plate. Say so in writing if job security is a concern.

How should admin access be shared?

Give every person their own admin account with multi-factor authentication and only the roles they need, keep audit logs, and know which accounts to disable if the arrangement ends.

Who handles a security incident in co-managed IT?

Whoever the written responsibility chart names. Decide first response, escalation and outside help in advance, and test the plan once a year.

Related services

Want to know where your business stands?

Pick a time for my free assessmentCall 954-539-5678