Many Toronto businesses reach a stage where they have an IT person on staff. a systems administrator, an IT coordinator, or a technically capable operations manager who handles IT alongside other responsibilities. but find that one person cannot cover everything the environment needs. After-hours monitoring, security tooling, specialized project work, coverage during holidays and sick days, and the sheer breadth of modern IT infrastructure often exceed what a single internal resource can manage reliably.
Co-managed IT services fill this gap without displacing the internal IT investment the organization has already made. This article explains how the shared IT management Toronto model works, what responsibilities typically sit with the internal team versus the MSP, why it is often a better fit than either pure break-fix or fully managed IT for this profile, and how to structure a co-managed arrangement so the two sides work together rather than creating confusion.
What co-managed IT actually is
Co-managed IT is a hybrid IT support model where the internal IT and MSP relationship is defined by a clear split: an internal IT person or team retains ownership of certain IT responsibilities while a managed service provider handles others. The division of responsibilities is defined in the service agreement and can be adjusted as the organization's needs evolve.
The model is built on a straightforward premise: the relationship between internal IT and MSP is complementary. Your internal IT person has context about your business, relationships with your staff, and knowledge of your applications and workflows that an external provider does not. At the same time, a managed service provider has specialized tooling, 24/7 monitoring infrastructure, security platforms, a full team with diverse expertise, and the operational processes that a single internal resource cannot replicate cost-effectively. Co-managed IT combines both.
The most common hesitation internal IT staff have about a co-managed arrangement is whether the MSP is there to replace them. A well-structured co-managed engagement makes this concern unfounded in practice. The internal person retains ownership of the areas they manage best. The MSP provides the infrastructure layer. monitoring, security tooling, backup systems, and after-hours coverage. that gives the internal person a stronger foundation to work from, not a threat to their position.
How the responsibility split works in practice
The specific split between internal IT and the MSP varies by organization, but a common pattern for Toronto businesses with a single internal IT person looks like this:
Business-specific and relationship work
- User onboarding and offboarding
- Business application support and configuration
- On-site hardware deployments and moves
- Direct staff relationships and ad hoc requests
- Vendor management for business-specific tools
- IT input on business projects and decisions
- First-line helpdesk for common requests
Platform, monitoring, and coverage depth
- 24/7 monitoring, alerting, and automated response
- Automated OS and third-party patching
- Endpoint Detection and Response (EDR)
- Cloud backup with monitored job completion
- Microsoft 365 security configuration and monitoring
- After-hours and weekend helpdesk coverage
- Helpdesk overflow during busy periods or leave
- Specialized project work and infrastructure upgrades
- Security operations, dark web monitoring, MDR
The split shown above is illustrative. Some organizations prefer the internal person to own helpdesk entirely and use the MSP only for monitoring, tooling, and projects. Others want the MSP to handle all helpdesk and use the internal person exclusively for business application ownership. The agreement is flexible and should reflect the specific strengths and preferences of the internal IT staff involved.
When co-managed IT makes sense for a Toronto business
Co-managed IT is the right model for a specific operational profile. It is not the answer for every business, but for organizations in the following situations it typically delivers more value than either fully managed IT or purely internal IT could alone.
- You have one IT person managing a 30 to 100 device environment. A single person cannot be monitoring 24/7, patching reliably, maintaining security tooling, handling all helpdesk, and doing project work simultaneously. Something is always getting deferred. The MSP layer provides the continuous monitoring and tooling that a single person structurally cannot maintain alone.
- Your internal IT person has business application depth the MSP does not. If your environment includes specialized ERP systems, industry-specific software, or custom integrations that require deep organizational knowledge to support effectively, internal ownership of those systems makes sense. The MSP handles the infrastructure layer while the internal person owns the application layer.
- You need after-hours and holiday coverage. A single internal IT person cannot provide 24/7 coverage. Ransomware does not respect business hours. Co-managed IT with an MSP providing after-hours monitoring and incident response closes this gap without requiring a second internal hire.
- Your internal IT person is stretched across IT and non-IT responsibilities. Many Toronto businesses have a person who handles IT alongside other operational or administrative duties. The MSP takes the continuous operational IT responsibilities off their plate, allowing them to focus on the work that requires their organizational knowledge.
- You want continuity protection. If your single internal IT person leaves, takes medical leave, or is unavailable during an incident, having an MSP with full environment visibility provides a continuity layer that does not exist in a purely internal arrangement.
Co-managed IT pricing and the block hours model
Co-managed IT arrangements are typically priced in one of two ways: a reduced per-endpoint fee that covers monitoring, tooling, and security without full helpdesk, or a block hours arrangement where a bank of prepaid hours covers supplemental support, project work, and escalations beyond what the internal team handles.
At Echoflare, the block hours model is the most common choice for businesses with internal IT staff. The internal person handles first-line helpdesk and business application support. Echoflare provides the MyITFleet monitoring platform, EDR, automated patching, backup monitoring, and Microsoft 365 management as a baseline. The block hours bank covers on-site work, infrastructure projects, specialized technical tasks, and after-hours incidents that exceed the internal team's capacity or expertise.
This structure means the organization gets MSP-grade monitoring and security infrastructure without paying for helpdesk services that the internal person already covers competently. The block hours provide a cost-effective overflow mechanism rather than a redundant layer.
Echoflare's MyITFleet platform is available to internal IT staff under co-managed arrangements. This gives your internal IT person real-time fleet visibility, device health scoring, patch compliance reporting, and ticket tracking across the full environment. the same operational picture the Echoflare team works from. Rather than managing IT blind or building their own monitoring setup, the internal person inherits a mature platform from day one.
Making co-managed IT work: avoiding the common failure mode
The most common way co-managed IT arrangements fail is through unclear responsibility boundaries. When both the internal team and the MSP assume the other is handling something, things fall through the gaps. When they step on each other's work, it creates friction and duplicated effort.
A well-structured co-managed engagement addresses this with a written responsibility matrix from day one. This document specifies, for each category of IT work, who owns it, who provides backup support, and what the escalation path looks like. It does not need to be complex. It needs to be specific enough that both sides can answer the question "who handles this?" without ambiguity for every category of request that arises.
- Define ticket routing clearly. The helpdesk ticket system should reflect the responsibility split. Tickets that go to the internal person should route there automatically. Tickets that go to the MSP should route there. Overlap creates both confusion and delays.
- Establish escalation protocols. When the internal person is unavailable, what happens? When a ticket exceeds the internal person's expertise, what is the process for engaging the MSP? These should be agreed and documented, not improvised during an incident.
- Review and adjust quarterly. The right responsibility split at month one is often not the right split at month twelve. As the internal IT person's capabilities grow and the organization's needs evolve, the agreement should reflect the current reality rather than the initial configuration.
Key takeaways
- Co-managed IT is a shared model where internal IT staff own some responsibilities and the MSP owns others. The split is defined in the service agreement and reflects each side's strengths.
- The model is not about replacing internal IT staff. It is about giving them the monitoring platform, security tooling, after-hours coverage, and specialized backup that a single person cannot cost-effectively provide alone.
- Co-managed IT is particularly well-suited to Toronto businesses with one IT person managing 30 to 100 devices, organizations where internal IT knowledge of business applications is deep, and any environment where after-hours and holiday coverage is a gap.
- Block hours is the most common pricing model for co-managed engagements with internal IT staff. The MSP provides the monitoring and security baseline. Block hours cover supplemental work, projects, and overflow beyond the internal team's capacity.
- Clear responsibility boundaries documented from day one are the difference between co-managed IT that works smoothly and an arrangement where things fall through the gaps.
Frequently asked questions
What is co-managed IT?
Co-managed IT is a hybrid model where an internal IT person or team handles some IT responsibilities while a managed service provider handles others. The split is defined in the service agreement and can be adjusted over time. The model is designed for businesses that have internal IT staff but need additional platform capabilities, coverage depth, or specialized support that a single internal person cannot provide alone.
Does co-managed IT replace my internal IT person?
No. Co-managed IT is explicitly designed to work alongside internal IT staff. Your internal IT person retains ownership of the areas they manage best: business application support, direct staff relationships, and on-site presence. The MSP provides the monitoring platform, security tooling, after-hours coverage, and specialized project capability that strengthens the internal person's position rather than displacing them.
How is co-managed IT different from fully managed IT?
Fully managed IT means the MSP takes responsibility for all IT functions with no internal IT staff. Co-managed IT means responsibilities are shared between internal staff and the MSP. Co-managed suits organizations that want to preserve internal IT ownership and staff relationships while gaining MSP-level infrastructure, monitoring, and coverage. Fully managed suits organizations without internal IT staff who want to outsource the function entirely.
What does a co-managed IT arrangement typically cost?
Co-managed IT pricing depends on the scope of what the MSP provides. A monitoring, tooling, and security baseline without full helpdesk typically runs $30 to $70 per device per month. Block hours arrangements are common for co-managed engagements where the internal team handles most day-to-day support but needs supplemental hours for projects, escalations, and overflow. Echoflare's block hours model is frequently chosen by businesses with internal IT staff for exactly this reason.
What happens to co-managed IT when my internal IT person leaves?
One of the underappreciated benefits of co-managed IT is continuity. Because the MSP already has full environment visibility through the monitoring platform, asset inventory, and documentation, the departure of an internal IT person does not create a knowledge gap or emergency. The MSP can either continue at the existing scope or expand to a fully managed engagement while you recruit, without the environment being left uncovered during the transition.
Have an internal IT person and need backup?
Echoflare's co-managed IT arrangements are built around your internal team, not in competition with them. Book a free 30-minute conversation and we will outline exactly how a shared model would work for your environment. Our IT consulting team can also help you assess the right model before committing.