Co-managed IT vs fully managed IT: which fits a company with one IT person?

By Hugh Donatello, LAN Service Group · Reviewed October 19, 2026

Short answer

If your one IT person is good and you want to keep them, co-managed IT usually fits better: they keep the work that depends on knowing your business, and a provider adds monitoring, security tooling, patching and cover for nights, vacations and departures. Fully managed IT fits better when that person is leaving, or when you would rather hold one provider accountable for everything. Either way, your company keeps the risk decisions.

Why one IT person changes the question

A company with one IT person has a coverage problem before it has a skills problem. One person cannot watch security alerts at night, be on vacation, be out sick and also be the only one who knows how the systems fit together. Everything that person knows, and every administrator password they hold, is concentrated in one place.

Microsoft names this risk directly. Among the situations where an organization might need an emergency access account, its Entra ID guidance lists the case where the person with the most recent Global Administrator access leaves the organization, because the company may then be unable to recover the account, for example if that person's account is deleted or disabled in on-premises Active Directory. For a company with one IT person, this is a direct risk: if that person holds the only Global Administrator access, one departure can leave the company unable to administer its own Microsoft 365 tenant.

NIST's Cybersecurity Framework 2.0 frames the underlying issue as governance. Among its outcomes are that roles, responsibilities and authorities for cybersecurity risk management are established, communicated, understood and enforced, and that adequate resources are allocated to match the organization's risk strategy and policies. One person can be very good at the job and still not be adequate coverage for those outcomes on their own. The choice between co-managed and fully managed IT is really a choice about how to add that coverage.

Co-managed vs fully managed IT: side by side

Co-managed IT means a managed IT provider works alongside your IT person under a written split of duties. Fully managed IT, also called fully outsourced IT, means the provider runs your IT function and becomes, in effect, your IT department. This table compares the two for a company that has exactly one IT person today.

Co-managed vs fully managed IT for a company with one IT person
Question	Co-managed IT (keep your IT person)	Fully managed IT (provider runs IT)	Source
Who does which tasks?	Your IT person stays. You agree in writing which tasks the provider takes on, which your IT person keeps and which are shared.	The provider takes on most tasks and responsibilities of the IT function, and the in-house IT role ends or changes. The same three questions still apply, with fewer items on your side.	[1]
Service levels	Cover the provider's share of the work. Your IT person's work sits outside them.	Cover the whole function. Ask for performance-related service levels that separate operational IT services from security services.	[1]
Nights, vacations and sick days	The provider covers whatever hours and services the contract specifies, so cover no longer rests on one person alone.	The provider covers the function under the hours and service levels in the contract.	[1]
Security monitoring and logs	If the provider monitors, the contract should require monitoring and logging of the systems it manages, and your IT person should see the same logs.	The provider monitors. Require direct access to security logging for the systems it manages.	[1] [2]
Transition	Smaller: the provider learns your environment while your IT person keeps running it.	Larger: ask for a transition plan before you sign, with any required downtime at a time you choose.	[1]
If your IT person leaves	A provider already working in the environment can keep systems running while you hire, as long as the company, not the departing person, holds the top admin and emergency access accounts.	Not applicable. The equivalent risk is changing providers, so plan the exit, including disabling the provider's accounts.	[5] [2]
Administrator access	Your IT person and the company's emergency access accounts keep the top roles. The provider gets least-privileged, time-bound roles.	The provider does most day-to-day administration through scoped, least-privileged, time-bound roles, not standing Global Administrator. The company keeps its own emergency access accounts.	[4] [5] [1]
Who is accountable for risk?	Your company, with duties split in writing.	Still your company. Outsourcing does not absolve an organization of risk management responsibilities.	[1]
Main risk to manage	Unclear ownership if the written split of duties is missing or vague.	Dependence on one provider, including provider accounts that are not disabled when the contract ends.	[1] [2] [3]
Cost vs risk	Salary plus a provider fee for part of the work, with more visibility kept in-house.	A provider fee for the whole function. CISA notes that ceding more responsibility may increase cost-efficiency but could also increase risk exposure.	[1]

A general comparison, not a standard. Scope, service levels and cost vary by provider and contract; get the specifics in writing.

When co-managed IT fits a one-person IT team

Co-managed IT usually fits when your IT person is capable, trusted and knows how the company actually works, but is stretched across work that does not need their knowledge. Patching, alert triage, backup checks and endpoint security are largely the same from one company to the next. Running a lab instrument integration, an ERP workflow or the systems a key department depends on is not. If the business-specific work is going well and the generic work keeps slipping, adding a provider for the generic work keeps the knowledge you would otherwise lose.

It also fits when the company needs depth one person cannot carry, such as preparing for a customer security questionnaire, a compliance framework or a Microsoft 365 security review, without hiring a second full-time person. The provider brings tooling and people behind it, and your IT person stays the one who knows which systems matter most.

Co-managed IT protects the company from the single point of failure without removing the person. If your IT person is out for two weeks, the provider covers what the contract says. If they leave, a provider working under documented access can keep things running during the search for a replacement, provided the documentation is current and the company holds its own emergency access accounts.

When fully managed IT fits better

Fully managed IT usually fits better when your IT person is leaving or retiring, when most of their time goes to standard work any provider could do, or when leadership would rather hold one provider accountable for the whole function than manage a split. It can also fit when the company's needs are fairly standard and no one internally needs to own business-specific systems.

If replacing the IT role is the goal, plan it openly. Use the time before the person leaves to document systems, accounts and vendor relationships, and to give the provider an overlap period. CISA lists a transition plan among the items to ask a managed service provider for before contract award, and recommends that any downtime the transition needs happen at a time the customer chooses.

Fully managed does not mean hands off. CISA's guidance for managed service provider customers says outsourcing the management of networks, cloud infrastructure, applications and devices does not absolve an organization of its risk management responsibilities, and that small and medium-sized businesses cannot completely delegate IT responsibilities to vendors. Someone in leadership, internal or fractional, still needs to review the provider's reporting, approve admin access and make risk decisions.

Questions to answer before choosing

CISA suggests that small and medium-sized businesses settle three questions in any vendor agreement: which tasks and responsibilities the provider will take on, which the business will continue to execute, and which will be shared. With one IT person, the honest answers often point toward one model.

A quick test helps. List the IT work done in the last quarter and mark each item as either business-specific, meaning it depends on knowing your company, or generic, meaning it would be done the same way anywhere. Then mark which items slipped. If the slipped work is mostly generic, co-managed IT targets the gap. If both kinds slipped, or nobody internally will own the business-specific work after a departure, fully managed IT deserves a serious look.

CISA also warns about the trade-off. Handing more responsibility to a provider may increase cost-efficiency but could increase risk exposure, because provider access can widen the potential attack surface and the company may lose visibility across its own IT environment. Co-managed IT keeps more of that visibility in-house. Fully managed IT has to recover it through contract terms, reporting and access to logs.

Is your IT person staying for the foreseeable future, and do you want them to?
Which of their current tasks depend on knowing your business, and which do not?
Who covers alerts, outages and urgent requests when they are unavailable today?
Who holds Global Administrator and other top-level access, and is any of it held only by that person?
Who in leadership will review the provider's work and approve access, whichever model you choose?

Protect the company either way

Some controls belong in place regardless of the model, because they keep the company, not any one person or provider, in charge of its own systems.

Keep emergency access in company hands. Microsoft recommends two or more cloud-only emergency access accounts holding the Global Administrator role, not associated with any individual user, used only when normal administrative accounts cannot be, and validated at least every 90 days. With one IT person, set these up first: they reduce the risk that one departure locks the company out.

Give the provider only what it needs. Microsoft's granular delegated admin privileges, known as GDAP, give partners least-privileged, time-bound access to customer workloads, and customers must explicitly grant that access. CISA recommends that provider accounts not be assigned to administrator groups, be restricted to the systems the provider manages, and be disabled when not in use.

Put security duties in the contract. The joint CISA, NSA, FBI and international advisory on threats to managed service providers recommends contracts that transparently identify ownership of security roles and responsibilities, and multi-factor authentication enforced on provider accounts used to access customer environments. CISA also recommends that customers keep logs of provider activity and offsite backups of critical data separate from the provider's storage.

Plan the exit on day one. The same advisory notes that disabling provider accounts can be overlooked when a contract ends, and NIST CSF 2.0 lists, as an outcome, supply chain risk plans that cover activities after a service agreement concludes. Keep a current list of every account, agent and delegated admin relationship the provider holds, so ending or changing the arrangement is a checklist rather than an investigation.

Making the change without losing knowledge

Whichever model you choose, the transition is where knowledge is often lost. Start by writing down what your IT person knows: systems, vendors, licenses, admin accounts, recurring tasks and the reasons behind unusual configurations. That documentation belongs to the company and should live somewhere both your IT person and the provider can see.

In a co-managed arrangement, turn the split into a short responsibility matrix with one row per area, such as identity, devices, Microsoft 365, backups, security monitoring and business applications, naming who does the work and who is accountable for each. A row where both sides say shared, or neither is accountable, is where to look first for gaps. One of NIST CSF 2.0's outcomes is that cybersecurity roles and responsibilities for suppliers are established, communicated and coordinated internally and externally, and the matrix is a practical way to do that.

Include the provider in your incident response plan from the start. Another CSF 2.0 outcome is that relevant suppliers are included in incident planning, response and recovery, and CISA's checklist for MSP customers recommends including key suppliers in incident response and business continuity planning. Review the arrangement after the first quarter and adjust the split based on what actually happened, not what was assumed at signing.

Common follow-up questions

Is co-managed IT cheaper than fully managed IT?

Not automatically. Co-managed IT adds a provider fee for a narrower scope on top of your IT person's salary, while fully managed IT replaces the salary with a provider fee for a broader scope. Compare both against the same scope list, including coverage hours, security tooling and backup testing, rather than comparing monthly fees alone.

Will co-managed IT replace my IT person?

It should not. Co-managed IT is built around your IT person staying and owning the work that depends on knowing your business, while the provider adds coverage and tooling. If replacing the role is the real goal, that is a fully managed engagement and should be planned openly, with a transition period.

What should we do if our only IT person is leaving?

Before they go, confirm the company holds its own emergency access accounts and controls every administrator account, transferring or disabling the departing person's, plus domains and licenses. Document systems and vendors, then bring in a provider early enough to overlap. You can then choose fully managed IT or co-managed IT with a new hire.

Can we start co-managed and move to fully managed later?

Yes. A provider that already works in your environment under a co-managed arrangement knows your systems, so expanding its scope later is simpler. Make sure the company, not your IT person or the provider, controls the administrator accounts, licenses, domains and documentation, so you keep options open in either direction.

Who should hold Global Administrator access with one IT person?

The company. Keep at least two cloud-only emergency access accounts with the Global Administrator role that are not tied to any one person, store their credentials securely, and test them regularly. Your IT person and any provider should use their own named, individual accounts with multi-factor authentication and only the roles they need.

Need help with this?

LAN Service Group offers both co-managed IT alongside in-house IT staff and fully outsourced IT, and helps leadership decide which model fits before anything changes.

Talk to LAN Service Group LAN Service Group managed IT services → (888) 281-7243