Co-Managed IT Services in Canada: What It Is, Who Does What, and What It Costs
Reviewed by Samad Mokrini, founder of IT Cares. See also the full Managed IT Services in Canada guide.
Co-managed vs fully managed vs in-house IT
The three models differ in who holds control, how you pay and what is covered when someone is away.
| Model | Who runs IT | Cost basis | Coverage gaps | Best for |
|---|---|---|---|---|
| In-house only | Your employees | Salaries, benefits, tools, training | Leave, after-hours, security depth | Larger teams with a full IT department |
| Co-managed | Shared, by written agreement | Your staff plus MSP per-user fee, retainer or project | Small, because the MSP covers the gaps | Firms with 1 to 5 IT staff who need more depth |
| Fully managed | The MSP | MSP fee only | Less internal knowledge of your business | Firms with no IT staff |
For the cost side of this choice see MSP vs in-house IT and break-fix vs managed IT.
Who does what: a sample responsibility split
The most common failure in co-managed IT is two teams assuming the other has it covered. Write the split down. The table below is a starting point to adapt, not a standard.
| Task | Internal team | MSP |
|---|---|---|
| Help desk, first line | Owns | Backup cover after hours |
| Escalated issues (second and third line) | Escalates | Owns |
| Patching and updates | Approves schedule | Owns execution and reporting |
| Endpoint detection and response, monitoring | Informed | Owns |
| Backup monitoring and restore tests | Shared, signs off tests | Owns monitoring |
| Microsoft 365 administration | Owns users and licences | Owns security configuration |
| Vendor and line-of-business apps | Owns | Advises |
| Projects (migrations, new offices) | Leads business side | Provides capacity and expertise |
| Strategy and budgeting | Decides | Advises |
| Compliance evidence (logs, reports) | Owns the obligation | Produces the evidence |
When co-managed IT makes sense
The model works best when the gap is specific. Look for signals like these:
- One overloaded technician. Everything routes through one person, and projects stall behind daily tickets.
- Key-person risk. If that person is sick, on vacation or quits, nobody can run the network.
- After-hours gaps. Alerts and outages happen when nobody is watching.
- Security depth you cannot hire. A client, insurer or auditor asks for monitoring, incident response or evidence you cannot produce.
- Growth or multiple sites. New offices, acquisitions or a cloud migration need temporary capacity.
If you have no one in IT at all, start with fully managed IT instead. See outsourced IT support for small business.
What co-managed IT costs in Canada
There is no regulated or standard price, so treat every figure here as a market estimate. US vendor guides we reviewed describe co-managed pricing in the range of roughly 100 to 200 per user per month, with onboarding fees on top. A Canadian roundup we found listed roughly 75 to 175. Providers also price by flat retainer, by hours, or by project. The spread is wide because scope matters more than the label. Currency matters too: confirm whether a quoted figure is in Canadian or US dollars.
What drives the price up or down:
- How much you hand over: security operations and after-hours cover cost more than a monitoring-only scope.
- Who supplies the tools: if the MSP's security and management software is included, the fee is higher but you avoid separate licences.
- One-time onboarding: documentation, agent deployment and cleanup.
- Service levels: faster response times and 24/7 cover raise the fee.
To compare models with your own headcount, use the managed IT cost calculator and read what managed IT services cost in Canada.
How to structure the agreement
A good co-managed contract is mostly about boundaries. Insist on these items in writing:
- Scope and responsibilities for each side, using a table like the one above.
- Service levels and escalation: response times, who calls whom, and what happens after hours.
- Access rights: which admin accounts the MSP holds, how credentials are stored, and that your team keeps top-level admin rights.
- Documentation and tool ownership: network diagrams, passwords and configurations belong to you.
- Data protection and breach terms: notification timing, cooperation, subcontractors and where data is stored.
- Exit clause: notice period, handover assistance and removal of the MSP's agents from your devices.
Risks of co-managed IT and how to avoid friction
- Territory conflict. Staff may feel threatened. Involve your IT person in choosing the provider and present it as added capacity.
- Duplicated tools. Two antivirus or remote tools on one machine cause performance and alert problems. Agree on one stack before onboarding.
- Unclear ownership during an incident. Name who leads and who decides, and rehearse once a year.
- Silent drift. Review the split every quarter, because staff and systems change.
The compliance angle: your accountability stays with you
Outsourcing security work does not outsource accountability. Under PIPEDA you remain responsible for personal information that a service provider handles for you, and Quebec's Law 25 adds duties around contracts and assessments when information is handled by others or leaves Quebec. A co-managed MSP is a service provider, so the contract should cover safeguards, breach notification and where data is stored. Start with our guides to PIPEDA compliance and data residency in Canada.
How to evaluate a co-managed provider
- ☐ Can they show a written responsibility split, not just a services list?
- ☐ Do they have experience working with an existing internal team?
- ☐ Will your team keep admin access and own the documentation?
- ☐ Are tools, onboarding fees and out-of-scope rates stated plainly?
- ☐ Are response times, after-hours cover and escalation defined?
- ☐ Is the exit process written, including removal of their software?
- ☐ Can they explain how they support Law 25 and PIPEDA obligations?
- ☐ Are references from similar-sized Canadian clients available on request?
Our guide on how to choose an IT provider goes deeper. If you want a conversation about splitting the work, IT Cares can review your setup and propose a clear split.
Frequently asked questions
What is co-managed IT?
Co-managed IT is a model where an external MSP works alongside your internal IT team rather than replacing it. The MSP fills gaps such as monitoring, security operations, after-hours coverage and specialist projects, while your staff keep the day-to-day work that depends on knowing your business.
What is the difference between co-managed and fully managed IT?
In fully managed IT the MSP owns the whole IT function, which suits businesses with no internal staff. In co-managed IT the responsibilities are divided between your team and the MSP in a written agreement, so you keep control and institutional knowledge while adding tools and expertise.
How much does co-managed IT cost per user in Canada?
There is no single published price. Vendor guides and Canadian roundups we reviewed show ranges from roughly 70 to 200 per user per month, and some providers price by flat retainer or by project. Treat that as a market estimate, confirm the currency, and ask for a written scope. Our cost calculator can help you compare models.
How many employees do I need for co-managed IT?
There is no fixed minimum. It usually fits when you have at least one internal IT person and the business has outgrown what that person can cover alone. Vendor guides often point to teams of about 50 to 75 employees as a common range, but headcount matters less than the gaps you need filled.
Will an MSP replace my IT person?
It should not. A co-managed agreement is designed to support your staff by handling routine monitoring, patching and specialist tasks so they can focus on projects and users. If a provider pushes to replace your team, you are being offered fully managed IT, not co-managed IT.
Who is liable in a data breach under co-managed IT?
Responsibility for personal information stays with your organization even when a provider does security work. Under PIPEDA and Quebec's Law 25 you remain accountable, so the contract should define security duties, breach notification timing and cooperation. Ask a lawyer to review the liability and indemnity terms.
Can we start co-managed and move to fully managed later?
Yes. Many organizations start with a narrow scope, such as security monitoring and after-hours support, and adjust the balance as needs change. Make sure the agreement lets you change scope without a full renegotiation.
What should a co-managed IT contract say?
It should list services and responsibilities for each side, service levels and escalation steps, access rights and credential handling, who owns documentation and tooling, data protection and breach terms, and how you can exit, including handover of passwords and records.
Get a free assessment
Tell us where you are, we send back a clear, no-pressure plan. Leads only, no payment.