IT Outsourcing Models Explained: Fully Managed, Co-Managed or Selective?

The short answer: IT outsourcing means paying an external provider to run some or all of your IT. There are three main models. Fully managed hands the whole job to a provider. Co-managed keeps your in-house IT person or team and adds a provider for cover, tools and specialist skills. Selective outsources specific services, most often cyber security, backup or telephony. Most businesses without their own IT staff choose fully managed; businesses with one or two IT people usually get more from co-managed.

Last updated: 29 September 2026. Written by the ATS Connection team from the outsourcing arrangements we run for clients, with government sources linked below.

In this guide

• What is IT outsourcing?
• The three IT outsourcing models compared
• Fully managed IT
• Co-managed IT
• Selective outsourcing
• What you should never outsource
• Which model is right for you?
• Frequently asked questions

What is IT outsourcing?

IT outsourcing is using an external company to deliver IT work that would otherwise be done by your own staff. That can range from the entire IT function, including helpdesk, security, devices and planning, down to a single service such as backups or the phone system.

It is common, particularly for security. The government’s Cyber Security Breaches Survey 2025/2026 found that 44% of micro businesses now use an external cyber security provider, up from 39% a year earlier.

If you are still deciding whether to outsource at all, start with why outsource your IT support and in-house vs outsourced IT support. This guide is about the next question: once you outsource, which model should you use?

How do the three IT outsourcing models compare?

	Fully managed	Co-managed	Selective
Who runs day-to-day IT	The provider	Shared: in-house team and provider	Your team, or nobody
Who your staff call	The provider’s helpdesk	Usually in-house first, provider as backup or second line	Your team, with the provider for its service only
Typical fit	No in-house IT staff	One to a few in-house IT people	Specific gap, such as security or telephony
Cost pattern	Fixed monthly fee per user	Smaller monthly fee for the agreed share	Fee per service
Biggest risk	Choosing a weak provider	Unclear split of responsibilities	Gaps between services that nobody owns

What is fully managed IT?

Fully managed IT means a provider acts as your complete IT department. It answers your staff’s support requests, monitors and patches every device, runs Microsoft 365 and security, manages backups, deals with suppliers and plans your IT budget. You keep ownership and decision-making; the provider does the work and is accountable for it.

This suits most businesses of 5 to 250 people that do not employ IT staff. The price is predictable, typically £30 to £90 per user per month in the UK. See our outsourced IT support service and published pricing.

A local example: at the Norfolk Arms Hotel in Arundel, a listed 37-room hotel, we took on the IT, security and telecoms together, installing a leased line, Wi-Fi across the building and gardens, a VoIP phone system with a handset in every room, and remote monitoring of every device, with the work planned around a hotel that runs at high occupancy all year.

What is co-managed IT?

Co-managed IT is an arrangement where an external provider works alongside your own IT staff, with the responsibilities split between them. The in-house person keeps the local knowledge and the relationships; the provider adds cover, tooling and specialist skills that one or two people cannot realistically hold.

It usually makes sense when:

• Your IT manager is the single point of failure, and holidays or sickness leave the business exposed.
• Your team is buried in support tickets and never gets to projects.
• You need security skills, such as Cyber Essentials, Conditional Access or incident response, that nobody in-house has.
• You want professional monitoring, patching and backup tools without buying and running them yourself.

The single most important part of a co-managed arrangement is a written split of who does what. A typical split looks like this:

Task	In-house IT	Provider
First-line user support	Leads	Overflow and holiday cover
Monitoring, patching and endpoint security	Informed	Leads
Microsoft 365 security policies	Approves	Designs and maintains
Backups and restore testing	Informed	Leads
Line-of-business applications	Leads	Escalation support
IT strategy and budget	Leads	Advises
Security incidents	Informed and involved	Leads the technical response

What is selective IT outsourcing?

Selective outsourcing hands over one or more specific services while the rest stays in-house or unmanaged. The services businesses most often outsource on their own are:

• Cyber security, such as managed endpoint protection, monitoring and Cyber Essentials. See managed cyber security.
• Backup and disaster recovery. See backup and disaster recovery.
• Microsoft 365 administration. See Microsoft 365 services.
• Phones and connectivity, including VoIP and business broadband ahead of the 2027 landline switch-off. See VoIP phone systems.
• Projects, such as office moves, migrations and network upgrades. See IT consultancy.

Selective outsourcing can sit neatly alongside an in-house team. Brighton College has its own network manager; we supplied and rolled out its endpoint antivirus across the whole network, and it now largely runs itself, with alerts sent to the network manager only when action is needed.

Selective outsourcing works well when there is a clear owner for everything else. It goes wrong when the pieces sit with different suppliers and nobody owns the gaps between them: the backup provider assumes the Microsoft 365 provider handles retention, and the Microsoft 365 provider assumes the reverse.

What should you never outsource?

Whichever model you choose, some things should stay with the business:

• Ownership of your accounts. Your Microsoft 365 tenant, domain names and admin credentials should be registered to your business, with the provider given access. Never the other way round.
• Decisions about risk and spend. A provider should advise; the business decides.
• Knowledge of where things are. Insist on documentation you can read and keep, so you can change provider without starting again.
• A right to leave. Check notice periods and what handover you get before you sign.

The NCSC’s guidance on choosing a managed service provider covers the contract and security points in more detail, including certifications, incident notification and exit terms.

Which IT outsourcing model is right for you?

A quick way to decide:

• No IT staff, and IT matters to how you work: fully managed.
• One or two IT people who are stretched or isolated: co-managed.
• A capable IT team with one specific gap: selective, for that gap.
• Very small team with simple needs: fully managed on a lower tier often costs little more than ad hoc support and removes the risk.

ATS Connection provides fully managed IT support, and individual services such as cyber security, Microsoft 365, backup and business phones, for businesses across Sussex and the UK. We have been doing it since 2015 and look after more than 100 businesses. If you are unsure which model fits, a free IT review with one of our senior engineers is a good place to start.

Frequently asked questions

What is IT outsourcing?

Using an external provider to deliver IT work that would otherwise be done by your own staff, from the whole IT function to a single service such as backups or security.

What is co-managed IT?

An arrangement where an external IT provider works alongside a business’s in-house IT staff, with a written split of responsibilities. The provider typically handles monitoring, security, patching and cover, while the in-house team keeps local knowledge and first-line support.

What is the difference between fully managed and co-managed IT?

Fully managed means the provider acts as your complete IT department. Co-managed means the provider shares the work with your own IT staff.

What IT services are most commonly outsourced?

Cyber security, backup and disaster recovery, Microsoft 365 administration, telephony and connectivity, and projects such as migrations. The government’s 2025/2026 breaches survey found 44% of micro businesses use an external cyber security provider, up from 39% the year before.

How much does outsourced IT cost?

Fully managed IT support in the UK typically costs £30 to £90 per user per month. Co-managed and selective arrangements usually cost less because the provider only covers part of the work.

What should stay in-house when you outsource IT?

Ownership of your Microsoft 365 tenant, domains and admin accounts, decisions about risk and budget, and documentation of your systems. These keep you in control and let you change provider if you need to.

Sources

• GOV.UK: Cyber Security Breaches Survey 2025/2026
• NCSC: Choosing a managed service provider (MSP)