What Should You Outsource To An MSP? A Guide To Fully Managed And Co-Managed IT

Outsourcing IT sounds like a fairly straightforward decision. Your business needs technical support, you find a managed service provider (MSP) that offers it, and they take care of the work. But things get more complicated when you've already got an internal IT team, several different systems to manage, and responsibilities you can't simply hand over to someone else. 

Some IT services need specialist skills your team doesn't have. Others need constant monitoring or support outside normal working hours. Then there are the systems your employees know inside out, where bringing in an external provider could create more work than it saves. 

According to Whitelane Research's 2025/2026 European IT Sourcing Study, 30 per cent of surveyed organisations plan to increase spending on external IT providers, while 20 per cent expect to reduce it. The reasons vary, but the findings show why there's no single approach that works for everyone. 

The question is what to outsource to an MSP, and how much responsibility your business actually wants to give them.

What Should You Outsource To An MSP?

Businesses can outsource almost any part of their day-to-day IT operations to a managed service provider, from handling employee support requests to maintaining servers, networks and cloud systems. But just because a service can be outsourced doesn't mean your business needs to outsource it. Common managed IT services include:

• Service desk support: Helping employees resolve technical problems and manage IT requests.
• Endpoint management: Maintaining laptops, desktops and other devices used across the business.
• Network and infrastructure management: Monitoring systems, maintaining equipment and resolving operational problems.
• Cloud operations: Managing cloud resources, configurations and routine maintenance.
• Patch management: Testing and installing software updates to fix problems and address vulnerabilities.
• Backup and recovery: Running backups, checking that they work and helping restore systems when something goes wrong.
• Identity administration: Creating, updating and removing user accounts and access permissions.

The UK's Department for Science, Innovation and Technology identified a similarly broad range of services in its 2025 research on managed service providers. An MSP might handle an entire service or only the parts your internal team needs help with. 

For example, your IT department could manage the network during working hours while an MSP monitors it overnight. How you divide that work depends partly on whether you choose fully managed or co-managed IT.

Fully Managed Vs Co-Managed IT

The main difference between fully managed and co-managed IT is how much of the day-to-day work your MSP takes responsibility for. Both models can support businesses with internal IT teams, and neither requires you to outsource every service.

When does fully managed IT make sense?

With fully managed IT, the MSP takes responsibility for running an agreed service. That might mean handling employee support requests, monitoring infrastructure, installing updates and fixing problems without your internal team managing every task. This can work well when you don't have enough staff to run a service yourself, or when maintaining the necessary expertise would be difficult.

 It's also useful for work that needs consistent attention, particularly outside normal business hours. However, fully managed doesn't mean giving up every decision. Your business still needs to set its requirements, understand the risks and decide what the provider is allowed to change without approval.

When does co-managed IT make sense?

Co-managed IT is a shared arrangement where an MSP works alongside your existing IT team. Instead of replacing internal staff, the provider takes on specific tasks or provides additional expertise and capacity. For example, your team might manage cloud architecture and major changes while the MSP handles routine monitoring and maintenance. 

Or the MSP could provide specialist engineering support when your employees need help with systems they don't work with every day. Co-managed services are becoming a more prominent part of the MSP market. 

The N-able MSP Horizons Report 2025, based on research by Canalys, found that 37 per cent of surveyed MSPs expected to primarily use a co-managed model in 2025, up 17 percentage points from the previous survey. Those figures reflect provider plans rather than enterprise adoption. Still, they show that working alongside internal IT teams is an established part of managed service delivery. 

Your business can also combine both approaches, using fully managed services where internal capacity is limited and co-managed arrangements where your team wants to remain involved.

How To Decide Which IT Services To Outsource

Choosing what to outsource starts with understanding how your IT department actually works. Two services might look similar on paper but need very different levels of expertise, business knowledge and control. Before deciding who should manage a service, consider what your team can realistically deliver and what could happen if something goes wrong.

Can your internal team deliver the service effectively?

Start with the people and resources you've already got. Does your team have the skills, time and equipment to manage the service properly? Can they maintain it as the business grows, or are they already struggling to keep up? A small team might be perfectly capable of managing everyday employee support but lack the specialist knowledge needed for complex cloud infrastructure. 

Equally, an experienced infrastructure team might need someone else to handle routine support requests so they can focus on more demanding work. You also need to consider availability. A service that needs 24-hour monitoring can be difficult to manage internally if your employees only work standard office hours.

How much business knowledge does the work require?

Some IT tasks are relatively easy for an external provider to understand. Others depend heavily on knowing how your business operates, which systems employees rely on and what happens when those systems change. Take a business application that's been customised over several years. 

Your internal team might know which processes depend on it, which changes cause problems and why certain configurations exist. An MSP could learn those details, but that takes time and effort. If the work involves frequent decisions based on business knowledge, keeping more responsibility internally may make sense.

What happens if the service fails?

Not every IT service carries the same level of risk. A delayed software update might cause a minor inconvenience in one system, while an unexpected restart of another could interrupt business operations. Consider how long the service can be unavailable, what depends on it and how quickly it needs to recover. 

You'll also need to account for any security, data protection or regulatory requirements that affect how the work can be performed. The US National Institute of Standards and Technology's cybersecurity supply chain risk management guidance provides a useful basis for assessing risks associated with external technology suppliers and services. 

Outsourcing a critical service isn't necessarily a bad idea. But the more serious the consequences of failure, the more carefully you need to define the provider's responsibilities and limits.

Does outsourcing offer a practical advantage?

An MSP should address a real need, whether that's specialist expertise, extra capacity, better coverage or support for a growing IT environment. Cost is part of the decision, but comparing an MSP's monthly fee with an employee's salary won't tell you the whole story. You need to consider the tools, training, management time and additional resources required for each option. 

External support also creates dependencies. Your team may need to coordinate work with the provider, share information and manage access to important systems. If that adds more effort than the service saves, outsourcing may not be worthwhile. The aim is to find an arrangement that improves how the work gets done without creating problems your business isn't prepared to manage.

Which IT Responsibilities Should Stay In-House?

Even when an MSP handles most of your IT operations, there are decisions your business will usually need to remain involved in. These include setting IT priorities, deciding which risks are acceptable and approving changes that could affect important business processes. For example, an MSP might be responsible for installing software patches. 

But your internal team may need to approve when those updates happen, particularly if restarting a system could interrupt production or another critical service. The same applies to employee access. A provider can create accounts and update permissions, but the business should determine who needs access to sensitive information and who can approve it. 

The UK's National Cyber Security Centre explains in its cloud shared responsibility guidance how responsibilities change depending on the services being used. It also notes that bringing an MSP into cloud operations adds another party with potential access to those systems. Although the guidance focuses on cloud security, the underlying distinction is useful for wider IT outsourcing. 

The person performing a task doesn't always need to be the person making the decision. Your business can delegate operational work while retaining authority over strategy, business requirements, risk acceptance and major changes. Exactly where that boundary sits will depend on the service, which is why it's worth documenting the responsibilities before approaching a provider.

Build Your IT Sourcing Responsibility Matrix

Once you've assessed your internal capabilities and the work you need help with, you can start putting those decisions together. An IT Sourcing Responsibility Matrix gives you a practical way to assess individual services and decide whether they should remain internal, be fully managed by an MSP or be shared between both teams. 

It isn't a scoring system that automatically tells you what to outsource. It's a way to organise the information you need to make those decisions.

Assess each IT capability

Start by listing the services your IT department currently manages. Then assess each one against five questions:

• Do you have the people, skills and time to manage it?
• Would specialist expertise or additional support improve delivery?
• How much understanding of your organisation does the work require?
• What happens if the service becomes unavailable?
• Which decisions and approvals need to remain internal?

You can use the following matrix as a starting point.

Complete each assessment using your organisation's actual requirements. For example, a business with a capable internal cloud team might need external support only for overnight monitoring. Another business could need an MSP to manage routine cloud operations because it doesn't have those skills internally. 

You can extend the matrix to include network management, patching, software administration, asset management and any specialist systems your business uses.

Assign operational work and decision authority

After deciding on a delivery model, break down what each party will actually do. A service marked as shared still needs clear responsibilities, otherwise both teams could assume the other is handling something. For each capability, establish:

• Who performs routine tasks and maintenance?
• Who responds when something goes wrong?
• Who approves changes that could affect the business?
• Who can make urgent decisions when internal staff aren't available?
• When does the work need to be passed to someone else?

Backup and recovery is a useful example. An MSP could manage backups, monitor failures and carry out recovery procedures. But the business may need to decide which systems should be restored first and whether it's acceptable to interrupt another service during recovery. 

Your completed matrix should give you a clear picture of the services you need, how you want them managed and which responsibilities your internal team will retain. That's a much more useful starting point for choosing an MSP than a list of everything a provider happens to offer.

When Should You Reconsider Your MSP Model?

Your IT outsourcing requirements won't necessarily stay the same as your business grows. New systems, changing workloads and different staffing needs can all affect how much external support makes sense. You might bring a service back in-house after hiring employees with the right expertise. 

Alternatively, expanding into new markets could create a need for support outside your existing team's working hours. Changes to regulations, infrastructure or business operations can also affect which responsibilities you're comfortable outsourcing. A service that was once straightforward to manage externally might become more closely tied to important internal decisions. 

It's worth revisiting your sourcing matrix whenever these changes affect your team's ability to deliver a service. That way, your managed IT arrangements can change alongside the business rather than becoming something you continue using simply because it's already in place.

Final Thoughts: Define The Work Before Choosing The Provider

Deciding what to outsource to an MSP isn't about finding the longest list of services you can hand over. It's about understanding what your internal team does well, where it needs support and which decisions your business needs to keep control of. Fully managed and co-managed IT both have their place. 

The right combination depends on the work involved, the people available and the requirements of the business. Once you've defined those responsibilities, you can approach potential providers knowing what you're asking them to deliver. And as your technology and business needs change, you'll have a clearer basis for deciding whether that arrangement still makes sense. 

Those decisions are part of a much wider conversation about how enterprises manage increasingly complex IT environments. EM360Tech's insights into infrastructure management and enterprise technology can help inform the choices that follow, as businesses work out how best to support the systems they depend on.