Co-Managed IT

By Anoush d’Orville, Founder and CEO

Insourcing vs. Outsourcing IT is the Wrong Question

Most growing companies get talked into a binary question they never should have asked in the first place: build an internal IT team, or hand everything to an MSP. Pick a side. Every vendor conversation, every board deck, every “IT strategy” slide reinforces the same false choice.

It is a bad question. The companies that get IT right stopped treating insourcing versus outsourcing as a debate and built a co-managed model instead: a core internal hire or two, backed by an MSP that covers the specialist depth and the redundancy no single hire can provide alone.

If you are a 60 to 100 person company with an IT hire already on staff, or you are about to make one, the decision that actually matters is which functions, like MDM, identity, or service desk, your hire should run directly, and which ones are better covered by a specialist bench around them.

Run the math before you run the org chart

Here is what “just hire internally” actually costs once you account for what IT work really requires. A functioning IT operation for a company this size needs three distinct skill sets, not one generalist:

That total does not include benefits, payroll taxes, recruiting costs, or the ramp time before any of the three is fully productive. And it still leaves out service desk coverage and hands-on strategic advice, because a $150,000 identity engineer is not fielding password reset tickets.

Compare that to what a co-managed engagement costs at the same headcount. For a 100-person company, a comprehensive co-managed relationship runs approximately $110 per managed device per month, or roughly $132,000 a year, excluding professional services engagements or onsite work. That figure covers warehouse and logistics, vendor management, MDM engineering, identity engineering, service desk, and strategic advice, delivered by specialists in each domain rather than one person stretched across all of them.

The gap is substantial: the difference between one generalist doing their best across four disciplines, and a bench of specialists doing each one well, at roughly a third of the fully loaded cost of building it internally.

The redundancy problem nobody budgets for

Cost is the argument that gets attention in the board meeting, but continuity is the argument that gets attention when something breaks.

We have watched this pattern play out enough times to know it is not an edge case: a company builds its entire IT operation around one person. That person understands the identity configuration, the MDM policies, the vendor relationships, all of it, because they built it. Then they leave. Not maliciously, not even avoidably, just a resignation, a medical leave, a new opportunity. And the company discovers that its entire IT continuity was sitting inside one person’s head, with no documentation, no backup, and no backup to absorb the gap.

We have seen companies hit exactly this moment ourselves, often at the worst possible time, with no coverage in place to catch it. A single IT hire is a single point of failure by definition, no matter how good they are. Co-managed IT exists specifically to remove that fragility: when your internal hire is out, sick, or gone, the MSP side of the relationship does not disappear with them.

For an HR leader, this is the part worth internalizing. Onboarding and offboarding smoothness, compliance posture, and employee experience during IT transitions all depend on continuity that a single headcount cannot guarantee. Co-managed IT is a business continuity plan as much as it is a staffing decision.

Why “just hire a generalist” does not hold up technically

Here is the part that will resonate with whoever owns the technical decision. MDM and identity each demand enough depth that covering both well is rare for a single IT person. OS specific MDM, macOS and Windows fleet support, Okta and Entra ID configuration: each of these is a specialization with its own depth, its own failure modes, and its own pace of change.

We see this constantly across our client base. An internal hire is strong on MDM and has never properly configured authentication policies in Okta. Or they came up through identity and treat MDM as a black box they poke at cautiously. It reflects how specialized these domains actually are: expertise in one rarely carries over to fluency in the other. Finding one person who is a true expert in both is rare and expensive when you find them, and you still have no backup when they are out.

A co-managed model resolves this by keeping your internal hire focused on the domains they know best. Your person owns the relationship, the context, and the judgment calls that require knowing your business. The MSP brings the specialist depth in the domains where a single generalist cannot realistically keep pace.

Where co-managed sits on the spectrum

Think of IT support as a spectrum rather than a binary. Fully outsourced sits on one end: no internal hire, the MSP owns everything. Fully internal sits on the other: every function staffed in-house, including the specialist roles that are hardest to fill and retain. Co-managed IT is the pragmatic middle, and for companies in the 60 to 100 person range, it can often be the correct answer.

The real decision is which gaps to augment and which to keep in-house.

If you already have an internal IT hire and are weighing whether to build out a full internal team, the more capital-efficient move is almost always to keep that hire, define what they own, and layer in an MSP for the specialist domains and the redundancy your internal team cannot provide alone. That is a deliberate insourcing path in its own right.

What a good co-managed relationship actually looks like

Done well, co-managed IT means a defined division of ownership: your internal team owns the relationships and day-to-day judgment calls that require business context; the MSP owns the specialist engineering, the redundancy, and the on-call coverage that a single hire cannot provide.

That division should be explicit and written down. Which systems does the MSP administer directly. Which decisions require your internal hire’s sign-off. What happens, specifically, the day your internal hire is unreachable. Vague ownership is the most common reason a co-managed arrangement quietly turns into outsourcing with extra steps, or insourcing with a support contract nobody has tested.

The bottom line

Insourcing versus outsourcing was never the real decision. The real decision is which gaps in your IT operation are filled by a specialist bench rather than a single hire, at a fraction of the fully loaded cost of building that bench yourself, with none of the single-point-of-failure risk.

Advisory runs co-managed IT engagements for companies who want to keep their internal hire and close the gaps around them. We provide the MDM engineering, identity engineering, service desk coverage, and strategic advice that turn a single IT hire into a fully covered IT operation.