Every MSP sales deck says the same things. "24/7 support." "Proactive monitoring." "Your technology partner." After the third meeting, the promises blur together and the buyer — often a CFO, operations director, or overextended internal IT person — has to make a six-figure decision based on marketing language rather than operational substance. This guide is the antidote. It covers what to actually evaluate, what to demand in writing, and the contract clauses that separate professional service providers from expensive help desks.
What a Managed IT Provider Actually Does
A managed IT service provider (MSP) takes over some or all of the day-to-day operational management of a company's IT infrastructure under a recurring contract, usually priced per user per month. The scope varies enormously. A basic MSP might provide remote monitoring of your servers and a help-desk phone line. A full-service MSP might manage your network, endpoint security, backup and disaster recovery, vendor relationships, and provide a virtual CIO who advises on technology strategy.
The key word in that definition is "operational." An MSP is responsible for keeping existing systems running reliably. It is not typically responsible for deciding what systems you should run — that is IT strategy, which is a separate (and usually higher-cost) engagement. Many SMBs conflate these two things during sales conversations and are disappointed when their MSP installs Windows updates competently but never tells them their aging phone system is a liability.
Understanding this boundary before you shop prevents the most common buyer mistake: hiring an operational MSP and expecting strategic consulting.
Defining Your Requirements Before Any RFP
Before you talk to a single vendor, document four things:
User count and endpoint count. MSPs price primarily on users or endpoints (sometimes both). Know your exact numbers — full-time employees, part-time staff who touch company systems, and contractors with company device access. A 35-person company might have 50 endpoints once you count mobile devices and spare machines. Vendors price differently based on how they count.
Your existing infrastructure. List what you have: on-premises servers (and their age), cloud workloads (Microsoft 365, AWS, Google Workspace), network hardware, any line-of-business applications that require special support. An MSP that is not familiar with your ERP or practice management software is a risk.
Compliance requirements. HIPAA for healthcare, PCI-DSS for card data, SOC 2 for SaaS companies, CMMC for defense contractors — each imposes documentation and process requirements on your IT provider as well as on you. If you're subject to a compliance framework, your MSP needs to be able to support it, not just acknowledge it.
The problems you're actually trying to solve. Slow ticket resolution? Poor documentation? No disaster recovery plan? A recurring outage on a specific system? Naming the real problems gives you a way to evaluate whether a prospective MSP has actually solved similar problems for clients like you, or is just promising to.
What Per-User Pricing Actually Looks Like
Based on publicly available RFP data and vendor pricing pages as of 2024, SMB MSP pricing typically runs:
Basic remote monitoring and help desk: $75–$125 per user per month. This tier usually covers remote monitoring, patch management, help-desk access (usually business hours only with after-hours phone for critical issues), and basic antivirus. It does not typically include endpoint detection and response (EDR), backup, or on-site support.
Full-service managed IT: $125–$200 per user per month. Adds EDR, managed backup, and vendor management. On-site support may be included or priced separately (travel fee or hourly rate).
Comprehensive managed IT + security: $175–$300+ per user per month. Includes SIEM or MDR service, incident response capability, security awareness training, and some compliance support. This tier starts to compete with MSSP (managed security service provider) pricing.
These are directional ranges, not guarantees. Geographic market, infrastructure complexity, and contract length all affect pricing. The important thing is knowing what tier you're in before signing — many buyers sign a base-tier contract and discover that everything they actually needed is an add-on.
Five Questions That Separate Good MSPs from Average Ones
Ask every MSP you evaluate the same five questions. The answers reveal operational maturity, not marketing polish.
1. What is your average ticket-to-close time by severity tier, and what were your actual numbers last quarter? Any MSP worth hiring tracks this. If they can't produce the data, they're not measuring it, which means they're not managing it. A good MSP will have P1 (critical/down) under 4 hours mean time to resolution, P2 under 24 hours, P3 under 5 business days.
2. How many clients does each of your engineers support? This ratio tells you whether their staff is stretched. An acceptable ratio depends on client complexity, but above 100 endpoints per engineer is a warning sign for anything beyond basic monitoring. Above 150 is a red flag.
3. Walk me through what happens if my server room floods at 3am on a Saturday. This tests their incident response process, not their sales script. You want to hear: who gets paged, what the escalation chain is, what your recovery time objective is contractually, and whether they have a tested runbook for exactly that scenario.
4. What does your offboarding process look like? The willingness to answer this question honestly tells you a lot. MSPs that make offboarding deliberately painful (holding documentation, slow handoffs, ambiguous termination clauses) are signaling that they know their service doesn't retain clients on merit.
5. Can you provide three references at companies of our size, with contact names, where I can ask about the last time something went wrong? Not three happy customers — three customers where they can discuss a failure and how it was handled. The best MSPs have these conversations readily.
Contract Terms You Must Negotiate
The MSP contract is where the real terms of the relationship live. Marketing promises aren't binding. These clauses are.
SLA definitions with financial teeth. An SLA that says "we'll respond within 4 hours" is meaningless without defining what "respond" means (a human acknowledging the ticket? A technician actively working it?) and without specifying a credit or remediation if the SLA is missed. Push for a service credit equal to one month's MRR for each SLA breach above a defined threshold.
Data ownership and portability. All documentation, configurations, credentials, and system data must be contractually owned by you, not the MSP. Get specific: network diagrams, Active Directory documentation, backup configurations, vendor account access. Specify that this documentation must be delivered to you within 30 days of contract signature and updated quarterly.
Termination without cause. Negotiate the ability to terminate the contract for any reason with 60–90 days notice. Many MSP contracts auto-renew for one-year terms and require 90–180 days notice to cancel — buried in the fine print. If your MSP insists on a two-year lock-in with no exit, that's a problem.
Scope definition. Get a detailed list of what's included and what's explicitly excluded. "Unlimited help-desk" does not mean unlimited on-site support. "Managed backup" does not mean managed disaster recovery testing. Every gap will become a surprise invoice.
Red Flags to Walk Away From
Several patterns in the sales process reliably predict poor service relationships:
Any MSP that can't tell you their staff-to-client ratio, or that gives you a suspiciously low number that doesn't hold up to basic math, is either understaffed or not being honest.
Any MSP that refuses to provide references or that provides only references it pre-screens (rather than letting you call clients directly) is managing your perception, not your infrastructure.
Any MSP that prices significantly below market without a clear explanation of how they're achieving the margin is either cutting corners on staffing, using junior-only technicians, or selling below cost to lock you in and recoup via add-on fees.
Any MSP that cannot produce evidence of their security posture — their own endpoint protection, their own backup practices, their own staff security training — is not a security-competent partner regardless of what they sell.
Frequently Asked Questions
What is the difference between an MSP and a break-fix IT provider?
A break-fix provider charges hourly for reactive support — you call when something breaks, they fix it, you pay. An MSP charges a flat monthly fee for ongoing management and proactive monitoring. Break-fix is appropriate for very small businesses with low IT complexity; it becomes expensive and disruptive as infrastructure scales.
How many employees do you need before an MSP makes financial sense?
There is no hard threshold, but the math typically favors an MSP over break-fix at 15–25 employees, and over a single internal hire at 30–60 employees (depending on IT complexity and your local IT labor market). A fully loaded internal IT hire including salary, benefits, training, and tools often costs $90,000–$130,000/year in major US metros for 2024. An MSP at $100/user/month for 40 users is $48,000/year.
Should your MSP also handle cybersecurity?
A managed IT provider should include basic security hygiene — patch management, EDR, multi-factor authentication enforcement, and security awareness training — as standard. For organizations with serious security requirements (healthcare, finance, defense), a specialized MSSP (managed security service provider) may be more appropriate. See our guide to MSP vs MSSP for a fuller comparison.
What should you do if your current MSP is underperforming?
Document specific failures against your SLA with dates, ticket numbers, and business impact before starting any conversation. Review your contract's dispute resolution and termination provisions. If you decide to transition, do not announce the transition until you have a signed agreement with the new provider — MSP offboarding can be adversarial, and you want your data protection strategy locked before the relationship gets formal notice.
Is a local MSP or a national MSP better for SMBs?
Local MSPs often have faster on-site response and better knowledge of your local business environment and vendor ecosystem. National MSPs often have more resources, deeper specializations, and standardized processes. The answer depends on how much on-site support you actually need and whether you have geographically distributed offices. For a single-location company that primarily needs remote support, geography matters less than service quality.
For a full breakdown of per-user, per-device, and all-in pricing ranges — including what compliance frameworks add to the base rate — see our 2026 managed IT services cost guide.
← Back to Guides | MSP vs MSSP: When You Need a Security Specialist →