One hire covers five specialisms shallowly and creates key-person risk
Endpoints, identity, network, applications, security and procurement. No individual is strong across all of them.
Microsoft Intune · Small & Mid-Market
Build or buy the IT function
The instinct is to hire. It is not always right, and the reasoning matters more than the conclusion.
Abstract
Build or buy the IT function
Summary
Somewhere between forty and a hundred people, the arrangement where a capable person handles IT alongside their real job stops working. Laptops take a week to arrive configured, nobody is certain which devices are encrypted, and the person doing it has quietly stopped doing the job you hired them for.
This paper sets out what one hire actually buys, what buying the capability buys instead, and the five questions that settle the decision — none of which is headcount.
Key findings
Four things this paper argues
If you read nothing else, read these. The analysis that follows sets out the evidence for each.
The real trade is responsiveness against depth, not cost against cost
Both options cost roughly similar amounts at this scale. They fail differently, which is the more useful comparison.
The hybrid model scales without a re-decision at 150 people
One internal person owning priorities and relationships, with specialist depth bought in behind them.
Fixing provisioning first often changes what the answer needs to be
Zero-touch provisioning removes most of the skilled hours from every joiner and replacement, which frequently determines whether one person is enough.
Analysis
The argument in full
What one hire actually gets you
A single competent generalist covering endpoints, identity, network, applications, security and procurement. That is five specialisms and no individual is strong in all of them.
It also gets you a single point of failure with holidays, a notice period, and a knowledge base that exists only in their head. For a fifty-person business that is a real risk, and it is the one most often discovered at the worst moment.
What it does get you, genuinely, is somebody in the building who knows your people by name and can walk to a desk. That is worth more than most managed service marketing admits.
What buying the capability gets you
Depth across all five areas and none of the key-person risk, at the cost of somebody who is not in your office and does not know your staff personally.
The honest trade is responsiveness for depth. A good managed service closes most of that gap with named contacts and agreed response times, and it does not close all of it. Any provider claiming otherwise is overselling.
The questions that settle it are not about headcount. How often do you need somebody physically present rather than reachable. Does your sector impose requirements — residency, vetting, on-site working — that need an employee. Is your estate standard or does it carry unusual applications only a dedicated person will learn. Do you want the capability to grow with you or to be replaced by an internal team in two years. And who covers the four weeks a year your hire is on leave.
- Presence: how often somebody must be physically in the building
- Sector requirements: residency, vetting or on-site working that need an employee
- Estate complexity: standard, or carrying applications only a dedicated person will learn
- Trajectory: growing the capability, or replacing it with an internal team in two years
- Continuity: who covers annual leave, illness and a notice period
Why provisioning changes the answer
Whichever route you take, endpoint management determines how the arrangement feels day to day. Zero-touch provisioning through Autopilot removes most of the skilled hours from every joiner, replacement and rebuild.
That single change frequently determines whether one person is enough, which makes it worth doing before the hiring decision rather than after. A business spending a day per device on manual setup and a business spending twenty minutes have materially different staffing requirements, and the difference is a configuration exercise rather than a capability one.
The hybrid arrangement — one internal person owning priorities, relationships and anything requiring presence, with specialist depth bought in behind them — is the model we see work most consistently. It also scales without needing to be revisited at a hundred and fifty people, because the internal person stops being the IT function and becomes the person who directs it.
Framework
Something you can apply without us
Every paper in this series ends with a framework you can run internally. We would rather you used it and reached your own conclusion than took ours on trust.
Framework
Settling the decision
Five questions. None of them is headcount.
1
Presence
How often does somebody genuinely need to be in the building?
2
Obligation
Does your sector require an employee for residency, vetting or on-site work?
3
Complexity
Is the estate standard, or does it carry things only a dedicated person will learn?
4
Trajectory
Are you building a capability to keep, or bridging to an internal team?
5
Continuity
Who covers the four weeks a year your hire is not there?
Implications
What this means, depending on your seat
The same argument lands differently across an executive team. These are the three versions worth separating.
References
Where to check this for yourself
Microsoft's own documentation for the product behaviour described above. We would rather you verified the basis than accepted our summary of it.
01
Windows Autopilot deployment
02
Microsoft Intune device compliance policies
03
BitLocker management with Intune
04
Microsoft 365 Business Premium
05
Microsoft Entra Conditional Access
On these references: each entry names a Microsoft Learn article or documentation area by title, because deep links change while titles are stable. Searching the title on learn.microsoft.com will reach the current version. Where we have cited a figure or a product behaviour, it is Microsoft's statement rather than ours; where we have given a number of our own it is labelled as such in the text.
Recognise the situation?
We will assess your current estate and model both options honestly, including the case where hiring is clearly the right answer and we are not.
Discuss this paper Run the related checklist We reply to every message within one business day.
Keep reading
Related papers
The insurability of the mid-market
Insurers have quietly become the most effective security auditors in the mid-market. This paper examines what they ask, why, and what it means for how you prioritise.
July 5, 2026 · 13 pages · 14 min readRead
The mid-market ERP decision
Nobody outgrows their accounting package on a particular Tuesday. It happens through a series of individually sensible workarounds until the workarounds are the process.
February 22, 2026 · 11 pages · 12 min readRead
The cost of not finding things
The cost is invisible because it is distributed: a few minutes per person per day looking for things, and nobody adds it up.
January 4, 2026 · 10 pages · 11 min readRead