In-house vs. NOT

When you throw a huge party at the barns at your ranch. That's when you use an outhouse.

1. You don't want to let the crowds use the "facilities" in your home.
2. You don't want to let mere acquaintances invade your privacy.

The same two considerations dictate when and what you should outsource: manageability and security. You cannot avoid complexity in IT, but you cannot let it control you. You must unload some of it and pick your battles wisely.

First, there are the battles you cannot win alone, where the stakes are high for the enemy, but low for you. Hosting your own mail servers falls into this category. A mail server must accept connections from strangers at any hour, or it isn't a mail server; that is the stake for the enemy. Running one yourself wins you nothing your competitors don't already have; that is the stake for you. Leave these honeypots to specialists to spare yourself the high maintenance costs and security risks inherent in self-hosting.

However, "specialist" is a claim, not a category. In December 2022, ransomware crippled Rackspace's hosted Exchange service. Its customers were small and midsize firms that had outsourced their mail. Rackspace said the damage was contained to roughly 1% of its annual revenue.¹ But for their clients, that 1% was 100% of their mail. The solution wasn't just outsourcing; it was the architecture of Microsoft 365, which is fundamentally different from an Exchange server in a rented building. The value wasn't in buying someone else's operations; it was in choosing a different architecture. You can never outsource the choice itself, because whoever you would hand it to is the thing being chosen.

The same can be said of the hosting of file shares, once they leave the LAN. An SMB volume on the office network is reachable from the building and nowhere else, leaving it open to anything that gains a foothold on a local PC. A file share has two good homes; the office is neither. The first is your productivity suite provider, chosen the way you chose your mail. The second, where confidentiality is paramount, is your own estate: a single-tenant server, encrypted in the browser before anything reaches it, and reachable only through zero trust. The difference between them is not trust. The first can read your files and promises not to; the second cannot read them at all.

Then, there are battles that are important but not yours to fight. These involve Line-of-Business software vendors, who must manage their bugs, their ecosystem's changes, and your users' production environment. If they can be trusted with your data, you should choose vendors who host, maintain, and lease their applications as a service over the web.

Finally, there are the battles you must NOT fight because doing so is against your interests or too risky. Beware of bright shiny objects, over-engineering, misguided automation, and futile integration. You will not train a foundation model. The actual AI question a firm faces isn't which model to build; it's which of its documents a model may read. You can move a file share. You cannot move it retroactively.

When this is done, you are left with two battles to fight. First, you must build, manage, and protect the infrastructure that accesses, hosts, stores, and secures your applications, data, and documents, whether in the cloud or on-premises. This includes 365, Google, HCI, the identity provider everything else authenticates against, the conditional access that decides who reaches what from where, device compliance, threat detection, the perimeter around your mail, chat, and document storage, and the file shares no model may read. Second, you must configure and maintain the business applications you need that are not vendor-hosted.

Microsoft's own shared responsibility matrix illustrates what you don't "buy" even when you outsource:

Source: Microsoft Learn, Shared responsibility in the cloud, 5 May 2026.² Rows below "Network controls" are Microsoft's in every column but on-premises.

Outsourcing moves the bottom of that table, but the top three rows have never moved. An agent in your mail does not add a fourth row; it reads your data, acts as one of your identities, and accesses your configuration. An agent is all three at once. The vendor sells you the agent; you answer for everything it touches.

Microsoft's own CEO proposes a test: you should be able to swap out a general-purpose model without losing the expertise your firm has built around it. He calls this the test of a company's control and sovereignty.³ He also sells the platform you would build it on. That isn't a reason to ignore the test; it is a reason to apply it to him, and to everyone offering to think on your behalf.

Manageability and security decide every one of these issues. The two considerations never change. The world you apply them to does. Vendors are acquired. Services begin reading what they used to only store. A battle you rightly gave away lands back on your desk. Our Principal Stewards watch for that and tell you before it costs you.

Concierge CIO Partners is a unified Guild of senior technologists providing dedicated, long-term fiduciary IT leadership to midmarket service firms. It offers a strategic alternative to fragile internal IT silos and to Managed Service Providers who advise you on what to buy and are paid on what you buy. With transparent unit pricing and an automated service catalog, the Guild eliminates administrative bloat and ensures every IT dollar spent and decision made directly drives your financial performance. The choice of who fights which battle is the one that never leaves your desk, and the Guild makes it from your side of the table.

¹ Rackspace, Update on Recent Cybersecurity Incident, 9 December 2022, and Hosted Exchange Environment Update, 6 December 2022. Rackspace's own statements; the containment and the 1% are theirs, made while disclosing the incident. The business carried roughly $30 million of annual revenue. ² Microsoft Learn, Shared responsibility in the cloud, updated 5 May 2026. Reproduced from Microsoft's own table; the four physical-infrastructure rows are omitted. The same page argues elsewhere for cloud adoption. The matrix is cited here, not the argument. ³ Satya Nadella, "A frontier without an ecosystem is not stable", sn scratchpad, 14 June 2026: "A company should be able to switch out a 'generalist' model without losing the 'company veteran' expertise built into their learning system. This is the key 'test' of your control and sovereignty in the era ahead." He is the chief executive of Microsoft, writing on his own site, and the argument favours the platform his company sells. Quoted as a test worth applying, including to its author.