One of the most practical benefits of co-managed IT is access to enterprise tools. A good partner brings a remote monitoring and management platform (RMM), a professional services automation or ticketing system (PSA), documentation software and backup tools. Many small IT teams could not justify buying and maintaining those on their own.
The natural worry is control. If the partner's tools run your environment, who is really in charge? The answer depends on how the tools are set up. Here is how to share them without giving away the keys.
RMM: software agents on your computers and servers that report health, push patches, run scripts and allow remote access. It is powerful, which is exactly why access matters.
PSA: the ticketing system, plus time tracking, contracts and reporting. It is where requests come in, get assigned and get closed.
Documentation platform: where passwords, network diagrams, procedures and asset records live.
Each one needs its own access plan.
Your internal IT staff should have their own named accounts in every shared tool. They should be able to see every device, every ticket, every script and every alert. If a partner offers only a summary report with no direct access, that is not true co-management.
Visibility also means audit logs. You should be able to see who did what, and when, inside the RMM and the documentation platform.
Not everyone needs the same rights. Set roles deliberately:
Internal IT leads: full administrative rights, including the ability to approve or block automations.
Internal technicians: rights that match their job.
Partner helpdesk: rights to handle Tier 1 work, but not to change core policies.
Partner engineers: elevated rights for specific systems, granted by agreement.
Review these roles every quarter and whenever someone joins or leaves either team.
The RMM can push a change to every device at once. That is useful and dangerous. Agree on which kinds of changes need approval from your team before they run. Common examples include new scripts, new patch policies, software deployments and anything touching servers or network gear.
A simple rule works for most teams: routine, pre-approved actions run automatically; anything new or unusual waits for a named person on your team to approve it in the ticket.
In the PSA, define queues and routing rules together. For example:
Password resets and standard new-hire setups go to the partner's helpdesk.
Anything involving finance systems, the electronic health record or executive devices goes to your internal team first.
After-hours tickets go to the partner, with a morning summary to your team.
Your IT manager should be able to change these rules as priorities shift.
Ask a direct question before signing: "If we end this partnership, what happens to our data?" You should be able to export tickets, documentation, asset lists and passwords in a usable format. The partner should remove their agents cleanly and hand over credentials. A good partner will put this in writing.
This is not about expecting the relationship to fail. It is about making sure your organization, not a vendor, owns its own records.
Administrative accounts for your systems, such as Microsoft 365, firewalls and domain controllers, should be owned by your organization. Partner engineers should use their own named accounts, ideally with multi-factor authentication, so their access can be reviewed and removed. Avoid shared "admin" logins whenever possible.
Partner technicians using a shared login, so nobody can tell who made a change
Automations added quietly because "it was a small change"
Internal staff never logging into the tools, so they slowly lose visibility
No regular review of who has access
Each of these is easy to prevent with a short quarterly access review.
Shared tooling should make your team more capable, not less in control. With named accounts, role-based permissions, clear change control and a clean exit plan, you get enterprise tools without giving up the keys.
Sidecar IT shares its RMM, ticketing, documentation and backup platforms with client IT teams under exactly these principles. Call or text 512-631-0480 if you would like to see how the access model works.
Your IT team keeps control; we add coverage, tooling and specialists behind them.
Call or text: 512-631-0480
New customers: [email protected]
Existing partners: [email protected]
Service area: based in Austin, Texas, with technicians across the South and Midwest
Hours: Mon–Fri 8 AM–5 PM CT; after-hours coverage for partners