Co-managed IT for Microsoft 365: when an MSP supplements your internal team instead of replacing it

Most MSP conversations start with the assumption that the client has no internal IT capability. The reality for mid-market Australian businesses, 100 to 600 staff, is the opposite. They have a small internal team who knows the business well, can't handle everything the Microsoft 365 platform now demands, and aren't looking to be replaced. They need a partner who fills the gaps rather than elbowing them out.

Co-managed IT is the model that solves this. Done well, it's one of the highest-value service arrangements Frontrow runs. Done badly, it's the source of the most avoidable incidents, usually because responsibilities were never written down.

What typically sits with the internal team

Internal IT teams in this segment are usually strong on user proximity and institutional knowledge. They know which line-of-business applications exist, which executives have unusual setups, and who to call when Finance has a month-end emergency. What they tend to lack is time for platform-depth work, the configuration, security posture monitoring, and roadmap planning that M365 increasingly demands.

• Day-to-day helpdesk, the ticket queue that requires knowing the organisation's quirks
• Device provisioning and hardware lifecycle decisions
• Relationships with business unit leads and executive assistants
• Line-of-business integrations and legacy application support
• Internal change communications and training coordination

What typically sits with the MSP

The MSP layer is most valuable where depth and continuity of platform expertise matter more than organisational context. A three-person internal team cannot maintain current knowledge across Microsoft Entra ID, Intune, Purview, Defender for Endpoint and the M365 security roadmap simultaneously. Nobody expects them to, that's a full-time specialisation at each layer.

• Tenant configuration ownership, Conditional Access policies, Entra ID governance, Microsoft Intune baselines
• Security posture monitoring and incident triage via Microsoft Defender and Sentinel
• Licence management and optimisation, reclaiming unused seats, reviewing SKU mix at renewal
• Quarterly health reviews against an agreed tenant baseline
• M365 roadmap input, recommending platform capabilities that are ready for the client's maturity level
• Escalation path to Microsoft, a Gold Partner with an existing Premier Support relationship moves faster than a direct call from an IT manager

The document that makes it work

The single biggest predictor of a co-managed arrangement failing is the absence of a written RACI. Responsibility, Accountability, Consulted, Informed, applied to every significant service area. Without it, incidents fall through the gap between 'I thought you had that' and 'we assumed they were watching it.'

Frontrow's standard co-managed onboarding produces a one-page RACI across five domains: identity and access, device management, security monitoring, licence administration, and the M365 platform roadmap. It gets signed by the internal IT lead and the Frontrow engagement lead. When something goes wrong at 11pm, neither team is guessing who calls who.

Pricing signals to watch for

Co-managed pricing should reflect a reduced scope relative to a full managed service. An honest MSP will price lower because the internal team is carrying the helpdesk load. If the quote looks the same as a full-managed arrangement, the scope isn't differentiated, or the internal team isn't getting credit for the work they're already doing.

For a 200-seat organisation in Queensland, co-managed M365 support with Frontrow typically lands between $18 and $28 per user per month, depending on security monitoring depth and the number of quarterly reviews included. A full-managed arrangement covering helpdesk would sit materially higher. The gap is real, if a provider can't explain it, the model isn't genuinely co-managed.