Can fully managed IT support cover a mixed cloud and on-premises environment?

Yes. Fully managed IT support can cover a mixed environment in which some workloads, applications or devices remain on local infrastructure while others run in cloud services. The important requirement is not that every system is managed in the same way, but that the environment has clear ownership, consistent policies and defined connections between its components.

Start with an accurate technical inventory. Before support arrangements are agreed, the provider should identify the systems in use, where they are hosted, who relies on them and how they interact. This normally includes local servers, network equipment, endpoints, cloud platforms, line-of-business applications, identity services, storage, backup systems and remote access tools. Documenting dependencies is particularly important where a cloud application relies on local directories, a local server exchanges data with a hosted service, or users need access to resources in both locations.

This assessment should also distinguish between systems that are business-critical and those that can be replaced or restored with less operational impact. A server supporting production, finance or shared files may require a different support and recovery approach from a standalone application used by a small group. Without this distinction, an organisation can have technical monitoring in place but still lack a practical understanding of which failure would affect its operations most seriously.

Identity is often the connecting layer. Users may need one set of credentials for cloud applications and another for local resources, or the organisation may use a synchronised identity arrangement. A managed service should define how accounts are created, changed and removed across both environments. It should also establish which system is authoritative for user information, how privileged access is controlled and how access is reviewed when someone changes role.

Identity arrangements need particular care during onboarding, role changes and departures. A user who is removed from a cloud application but retains access to a local server, or who keeps an unused privileged account, represents an avoidable control gap. The same principle applies to service accounts, administrator credentials and accounts used by applications to connect between environments.

Network design must reflect the hybrid arrangement. Local offices, remote users, cloud services and hosted applications may all follow different routes to business data. Support should therefore cover the boundaries between networks as well as the individual devices and services within them. Relevant considerations include:

• Which users and devices can reach local servers and administrative interfaces;
• How remote access is authenticated and restricted;
• Whether cloud-to-local connections are necessary and what they are permitted to do;
• How traffic is separated between users, guests, servers and operational equipment;
• Where security controls are applied when an application is accessed directly through the internet; and
• How changes to connectivity are recorded and assessed before implementation.

These controls should be proportionate to the systems involved. A local server containing sensitive business information should not be exposed more broadly than required simply because a cloud service needs limited integration with it. Similarly, remote access should provide access to the required resources rather than placing an entire internal network within reach.

Support processes should account for different technical lifecycles. Cloud services are usually updated by their provider, while local servers, network devices and specialist applications may depend on planned maintenance, compatibility testing and hardware replacement. A fully managed arrangement should record which party controls each update, what testing is required and how changes are communicated to affected users. This avoids treating a cloud change and a local infrastructure change as if they carried the same risks.

Some older applications may also depend on a particular operating system, database version or local server configuration. In those cases, the provider should document the dependency rather than assume that moving one component to the cloud will remove it. The practical options may include retaining the local component, replacing the application, redesigning the integration or placing a defined control around a system that cannot yet be modernised.

Backup and recovery need to be designed per workload. A cloud service may offer retention or recovery features, but those features are not automatically equivalent to an independent business backup. Local servers, cloud data, configuration information and critical application records may each require different recovery methods. The plan should state what is protected, where copies are held, how long they are retained and which dependencies must be restored first.

Recovery planning should also consider a loss of connectivity. If cloud services cannot be reached, the organisation may need an agreed temporary process for accessing essential information or continuing priority operations. Conversely, if a local server fails, users may need to continue using cloud services while the local function is restored. Testing these scenarios can reveal gaps that are not apparent from backup status reports alone.

Service boundaries should be explicit. In a mixed environment, responsibility can be divided between the managed IT provider, cloud service providers, software suppliers, connectivity providers and the organisation itself. A support agreement should clarify who manages each component, who is authorised to approve changes, who holds administrative access and how third-party faults are escalated. It should also identify exclusions, such as unsupported legacy applications or equipment outside the agreed estate.

Useful documentation includes a current asset register, network and integration diagrams, data ownership information, administrator access records, recovery procedures and a schedule of planned changes. These records make it easier to diagnose faults that cross the cloud and on-premises boundary and reduce reliance on individual knowledge.

S2 Technology Group can assess and manage hybrid arrangements as part of its wider managed IT support approach. For a business considering this model, the key questions are whether the proposed service covers every relevant system, how dependencies will be documented, how identity and access will be controlled, how recovery will work for each workload, and how responsibility will be divided where a third party owns part of the technology.