The internal team and the provider agree on a split of duties in writing. A common pattern is that the provider handles routine tickets, patching, monitoring, and out-of-hours alerts, while internal staff keep projects, vendor relationships, and anything that needs knowledge of the business. Both sides usually work in the same ticketing and monitoring tools so nothing falls between them.
It suits companies with one or two IT people who are stretched thin. The business keeps someone on site who knows its systems, while gaining extra hands, cover for vacations and sick days, and specialist skills that would be hard to justify as a full-time hire. It can also give a lone IT manager a second opinion on security and planning decisions.
The main risk is unclear ownership. Write down who responds to each type of alert, who approves changes, and who holds admin access. Make sure the internal team is not locked out of the provider's tools and documentation, and review the split as the business changes. We work alongside in-house IT staff on this basis, taking on the areas the client chooses to hand over.