Your IT manager is good. They're also one person, working 37.5 hours out of the 168 in a week, and they're the only one who knows where the firewall password lives.
That's usually when the question comes up. Do you add a provider beside them, or hand the whole thing over?
Here's the short answer. Co-managed IT means an outside provider works alongside your in-house IT staff and takes the pieces you agree on. Fully managed IT services mean the provider runs all of your IT and you keep no IT staff of your own. If you have at least one capable IT person who knows the business, co-managed usually fits. If you have nobody, or IT keeps pulling your operations lead away from their real job, fully managed does.
The rest of this guide covers what each model includes, what they cost in Canada in 2026, and the part rival guides skip: who's accountable under PIPEDA and Quebec's Law 25 when something breaks. We run co-managed IT services for Canadian firms from North York, so this is a builder's view.
What is co-managed IT, and what does fully managed mean?
Both are forms of managed IT services: a provider takes ongoing responsibility for part or all of your IT under a monthly contract. The difference is who else is in the room.
What is co managed IT services?
Co-managed IT is a shared model. Your internal IT team keeps what it's best at, usually the relationships, the business context and the day-to-day requests. The provider adds what's hard to hire for: after-hours cover, security monitoring, senior network or cloud skills, and the tooling to watch everything at once.
Your people stay in charge. The provider is extra hands and extra depth.
What does fully managed mean in IT?
Fully managed means the provider owns the outcome. Help desk, patching, backups, security, vendor calls, planning. You don't employ IT staff. You manage the contract and hold the provider to it.
It's the usual choice for small firms with no IT staff at all.
How do co managed IT services and fully managed IT services compare?
Co-managed IT | Fully managed IT | |
|---|---|---|
In-house IT staff | You keep them | None needed |
Who leads IT decisions | Your IT manager | The provider, with your sign-off |
Help desk | Split, or yours with overflow to the provider | Provider |
After-hours cover | Provider | Provider |
Institutional knowledge | Stays in-house | Lives in the provider's documentation |
Cost shape | Provider fee plus your salaries | One monthly fee |
Biggest risk | Blurry lines about who owns what | Dependence on one provider |
The last row is the one that matters. Co-managed deals rarely fail on skill. They fail when a ticket falls between two teams and each thinks the other has it.
What are some examples of managed IT services in each model?
Here are typical managed IT services examples and where they usually land. Your split will differ, but it should be written down this clearly before you sign.
Service | Co-managed: usually yours | Co-managed: usually the provider's | Fully managed |
|---|---|---|---|
User requests and onboarding | Yes | Overflow and after-hours | Provider |
Patching and endpoint management | Yes | Provider | |
24/7 monitoring and alerting | Yes | Provider | |
Restore requests | Design, testing, off-site copies | Provider | |
Network, firewall and Microsoft 365 | Small changes | Design, upgrades, hard faults | Provider |
Security operations | Yes, or a managed security service provider | Provider or MSSP | |
IT strategy and budget | Yes | Advises | Provider, with you |
Want to see how we'd draw your split? Our co-managed IT page shows the four-step engagement, starting with a responsibility map.
How much do managed IT services cost in Canada?
Most Canadian providers price per user per month. Two Canadian MSPs published 2026 price guides worth knowing:
- The first puts fully managed IT at $100 to $300 per user per month, with many firms planning around $175 to $250 (published 2026-06-02, updated 2026-08-13).
- The second, a Toronto provider, lists fully managed at CA$185+ per user per month and co-managed at CA$160+ (updated September 2026).
Look at that second pair. The per-seat gap is only $25, about 14%. That surprises people, but in a co-managed deal the provider still runs the monitoring stack, the security tools and the after-hours desk. You save with co-managed by not hiring a second or third IT person, not by paying less per seat.
So what does that in-house person cost? Job Bank lists the median wage for a user support technician at $33.00 an hour in Ontario, $31.47 across Canada, $30.77 in Quebec and $26.00 in Nova Scotia (updated 2025-11-19). At a full-time 1,950 hours, the Ontario figure is about $64K a year before benefits, tools or training. And it buys one person, awake for roughly a quarter of the week, who also takes holidays.
A rough rule for managed IT services pricing:
- No IT staff, under about 50 users: fully managed usually wins. At 20 to 30 users it costs about the same as one hire, and covers the whole week instead of a quarter of it.
- One or two capable IT people: co-managed usually wins. You keep the knowledge and buy the depth.
- 100+ users with a real IT team: co-managed for specific gaps, such as security operations or after-hours cover.
We don't publish one number, because honest pricing depends on your endpoint count and what we find in the first two weeks. We give you a fixed monthly figure after that first mapping session.
When does co managed IT support make more sense?
Picture a 90-person food manufacturer in Mississauga. It has one IT manager, Priya, who's been there eight years. She knows which production PC can't be rebooted during a shift and which supplier still sends invoices by fax.
A fully managed provider would spend months learning what Priya already knows. So the firm goes co-managed. The provider takes monitoring, patching, backups and nights. Priya keeps the users and the plant. The first time a switch fails at 2am, the provider's engineer handles it, and Priya reads the ticket at breakfast.
Co-managed IT fits when:
- You have at least one capable IT person who knows the business
- They're drowning in tickets and never get to projects
- You need skills you'd never hire full-time, such as firewall design or cloud architecture
- Nobody watches your systems overnight or on weekends
When are fully managed IT services the better fit?
Now picture a 22-person accounting firm in Ottawa. There's no IT person. The office manager, Marc, resets passwords between client calls and renews licences when something stops working.
At 22 seats and the $175 to $250 many firms plan around, fully managed runs roughly $46K to $66K a year. One hire costs about $64K before benefits, and still leaves nights, holidays and security uncovered. For the same money, fully managed covers the whole week. It's the obvious call here.
Fully managed IT services fit when:
- You have no IT staff, or IT is someone's side job
- You want one number on the budget and one team to call
- Your IT is standard: Microsoft 365, laptops, a firewall, a few line-of-business apps
- You'd rather manage a contract than manage people
One warning. Fully managed means your IT knowledge lives with the provider. Make sure the contract says you own the documentation, the admin credentials and the licences, and that the provider hands them back in a usable state if you leave.
Is managed services vs outsourcing the same decision?
Not quite. IT outsourcing is the broad idea of paying an outside firm to do IT work: a project, staff on loan, or a whole department. Managed services are one type of outsourcing. They're ongoing, priced monthly, and the provider watches your systems before anything breaks.
Fully managed IT is the closest thing to outsourcing the whole department. Co-managed is outsourcing selected functions while keeping the department. If you're weighing a full handover, see our IT outsourcing services.
What do PIPEDA and Law 25 change in either model?
This is where most comparison guides go quiet.
Neither model moves your legal accountability. Under PIPEDA, your organisation stays responsible for personal information it transfers to a third party for processing, and has to use contracts or other means to protect it. On 2026-09-10 the Office of the Privacy Commissioner published new guidance on assessing third-party service providers. It expects you to check a provider's privacy practices before you sign, to write down roles and responsibilities, to monitor the provider afterwards, to agree breach roles in advance, and to confirm how data is returned or destroyed when the contract ends.
In Quebec, section 18.3 of the Act respecting the protection of personal information in the private sector (as amended by Law 25) requires a written contract with any service provider that handles personal information. It has to include specific confidentiality and breach-notice terms. If you have staff or clients in Quebec, see our Quebec Law 25 compliance work.
Here's what that means in practice:
- Fully managed: one provider, one contract. Simpler to document, but you rely completely on its controls.
- Co-managed: two teams touch the same systems. The contract has to say who holds which admin accounts, who reviews access, and who calls whom during a breach. Leave that vague and you'll find out during an incident, which is the worst possible time.
The Canadian Centre for Cyber Security's checklist for buyers of managed services (ITSM.50.030) is a good free starting point for either model. Our PIPEDA compliance team uses the same questions.
How do you choose a co managed IT provider in Canada?
Ask these six questions, whichever model you pick:
- Can you show me a sample responsibility matrix? If they can't, the lines will blur.
- Who answers at 2am, and how fast? Get a number in the contract, not a promise in the pitch.
- Will you work with our IT manager, or try to replace them? You'll feel the answer in the room.
- Where is our data stored and backed up? Canadian residency matters for many regulated clients.
- Who owns the tools, licences and documentation if we leave?
- Can someone be on site when a switch dies?
That last one is local. Monitoring, patching and most restores run remotely from anywhere. A failed switch or a cabling fault needs hands. Check how close the provider really is. We work from North York and cover managed IT services in Toronto, Ottawa, Montreal and Halifax. Each city page spells out what's on site and what's remote.
Bottom line
- Co-managed IT keeps your IT people and adds depth, after-hours cover and tooling. It fits firms with at least one capable IT person.
- Fully managed IT services hand the whole job to a provider. They fit firms with no IT staff, or where IT is someone's side job.
- Per-seat prices are close. In Canada in 2026 they typically run $100 to $300 per user per month. The real saving in co-managed is the hire you don't make.
- Accountability never moves. PIPEDA, the OPC's September 2026 guidance and Law 25 keep it with you, so write the split down.
Not sure which side of the line you're on? Book a mapping session and we'll show you what we'd take, what stays with your team, and a fixed monthly figure. Start with co-managed IT, or talk to a senior engineer. One replies within an hour.
