Managed IT services in 2026 run $100 to $250 per user per month on a national average, and that range on its own tells a buyer almost nothing. A proposal at $120/user from one MSP and $220/user from another can describe the same scope of work priced differently, or they can describe two genuinely different services wearing the same billing unit. The gap between those two possibilities is where most SMBs get burned — not by paying too much, but by not knowing what they bought until something breaks and the exclusion clause in the contract gets read for the first time.
This guide breaks down the three billing models MSPs actually use, what each realistically covers at different price tiers, what compliance requirements add to the base rate, and how to line up competing proposals so you're comparing scope rather than headline numbers.
The Three Billing Models
Nearly every MSP proposal you'll see in 2026 uses one of three structures, and it's common to see all three during a single evaluation cycle.
Per-user pricing. The dominant model. One monthly rate covers every device tied to a given employee — workstation, laptop, phone, and the software licensing overhead that comes with managing them. It simplifies budgeting because cost tracks headcount directly, and it works cleanly for companies where employees carry two or three devices each. Typical 2026 ranges: entry-level help desk and patch management runs $100–$150/user/month; mid-range service adding endpoint detection and response (EDR) and backup monitoring runs $150–$200/user/month; comprehensive service with a 24/7 security operations layer and compliance reporting runs $200–$300+/user/month.
Per-device pricing. Each managed device is billed on its own rate regardless of how many people touch it. This model fits environments with a high device-to-user ratio — manufacturing floors, healthcare practices with shared workstations, or any company running significant server infrastructure. Workstations typically run $50–$100/device/month, servers $100–$400/device/month depending on criticality, network hardware (firewalls, switches) $30–$75/device/month, and mobile devices under MDM $15–$40/device/month.
All-inclusive flat fee. A fixed monthly rate covering the whole environment, common for businesses under roughly 20 employees where a per-unit calculation produces awkward math on either side. These packages commonly run $1,500–$5,000/month for a 5–15-person company, and they typically cover baseline managed services without compliance-specific work layered in.
What "All-Inclusive" Actually Excludes
The word "all-inclusive" is defined by the contract, not by the marketing copy. Two categories are excluded from nearly every proposal regardless of how it's framed: major project work (migrations, new-office buildouts, large hardware refreshes, application implementations are scoped and billed separately), and hardware procurement (most MSPs act as reseller or advisor, and hardware cost passes through at cost or with a markup rather than being absorbed into the monthly fee).
Beyond those two near-universal carve-outs, read the contract specifically for: whether "24/7 monitoring" means 24/7 response or just alerting that waits for business hours; how many on-site visits are included before travel time gets billed separately; and whether vendor management covers software you didn't buy through the MSP.
Compliance Adds Real, Predictable Cost
Regulated environments cost more to support because compliance frameworks require documentation, specific technical controls, and audit-prep labor that unregulated environments don't need. Based on 2026 MSP pricing data and vendor rate cards, add-on ranges above the base per-user rate commonly run: HIPAA compliance support $30–$50/user/month; PCI DSS quarterly vulnerability scanning and reporting roughly $10–$20/user/month; and CMMC Level 2 preparation and ongoing support $40–$90/user/month, plus a one-time readiness project fee that commonly runs $25,000–$80,000 depending on scope — a reflection of the substantial technical controls required under NIST SP 800-171. See our CMMC guide for small defense contractors for what those controls actually require, and our CMMC Phase 2 deadline update for the current state of the mandatory third-party assessment requirement. SOC 2 readiness and evidence-collection support is typically billed as a separate project fee rather than folded into the per-user rate — see our SOC 2 audit cost guide for that breakdown.
If your business operates under a specific framework, get a line-item breakdown of every compliance-related charge before signing. This is where proposals that look identical on the cover page diverge the most once you're a few months into the contract.
How Company Size Moves the Number
MSPs apply volume discounts, and the thresholds are fairly consistent across the market. Companies in the 10–50-employee range often see $100–$175/user, frequently bundled into simplified flat-fee or per-user tiers with compliance work priced separately as projects. The 50–150-employee band tends to see the most competitive per-user pricing, at roughly $125–$225/user, with more compliance bundling available. The 150–500-employee range often lands lower again, $100–$200/user, as volume discounts and dedicated account management kick in. Above 500 employees, pricing is effectively custom-negotiated, often under a co-managed IT structure rather than a pure MSP arrangement.
The MSP market has consolidated meaningfully at the high end over the past several years, but the 10–50-employee segment is still served largely by regional providers. Regional shops often quote lower per-user rates but may lack the specialist depth — compliance engineers, a dedicated SOC, cloud architects — that a mid-market buyer with real regulatory obligations actually needs. Match the provider's depth to your actual requirements, not just your headcount.
The Hidden Costs That Widen the Real Number
Multiple industry pricing surveys converge on a consistent pattern: a 30–50% gap between the quoted per-user rate and actual annual spend once add-ons, project fees, and overages accumulate over a contract year. The categories where this shows up most reliably:
Out-of-scope project billing. Even with a tight scope definition, every business generates IT projects. Clarify up front how these are priced — block-hour packages, time-and-materials at a stated rate, or bundled project credits — before you need the answer mid-contract.
Software licensing pass-throughs. If your MSP manages your Microsoft 365 or similar licensing, that cost passes through on your invoice. It's licensing, not managed-services cost, but bundled proposals sometimes blur the line to make the headline number look smaller.
After-hours support premiums. Some MSPs run a flat 24/7 rate; others apply a multiplier to after-hours incidents. Check the SLA document, not the sales deck.
Onboarding fees. Many MSPs charge a one-time onboarding fee equal to one to three months of service. That's often legitimate — onboarding a new client is genuinely labor-intensive — but it needs to be disclosed and quantified before signature, not discovered on the first invoice.
How to Normalize Competing Proposals
Take every proposal you receive and map the same eight categories across all of them: help-desk hours (business-hours vs. 24/7, and response vs. resolution SLA at each severity tier); endpoint security depth (antivirus only, or full EDR with threat hunting); backup scope (monitoring only, or managed backup with tested recovery drills); email security (basic spam filtering, or advanced threat protection with phishing simulation); patch management breadth (OS patches only, or third-party application patches too); compliance documentation included for your specific framework; strategic services (quarterly business reviews, roadmapping, vendor management); and how project hours are priced once the included block is used.
If one proposal doesn't mention a category the other proposal explicitly covers, assume it's not included and ask directly. An MSP that answers "is X included, and how?" with a specific, concrete answer is a materially different vendor than one that answers with reassurance. An MSP at $175/user delivering 24/7 EDR, tested backup recovery, and quarterly compliance reporting is cheaper in real terms than one at $110/user that bills project rates every time you need something outside a narrow base scope. See our full buyer's guide to choosing an MSP for the evaluation questions and contract clauses that go alongside the pricing comparison, and our guide to negotiating MSP contracts for how to get these terms in writing.
Frequently Asked Questions
Is per-user or per-device pricing better for a small business?
Per-user pricing is usually simpler and more predictable for companies where each employee has one or two standard devices. Per-device pricing tends to favor companies with a high device-to-employee ratio — shared workstations, significant server counts, or heavy network hardware — where billing by headcount would understate the actual management burden. Ask any MSP to model your environment under both structures before choosing.
Why do two MSP quotes for the same company vary by 50% or more?
Almost always scope, not margin. The lower quote is frequently missing 24/7 response, EDR, tested backup recovery, or compliance documentation that the higher quote includes. Before comparing price, map each proposal against the same service categories — help desk hours, endpoint security depth, backup scope, compliance support — so you're pricing identical scope rather than two different products.
Does managed IT pricing include cybersecurity?
Basic security hygiene — patch management, antivirus, MFA enforcement — is typically included in even entry-level MSP tiers. Advanced capability like EDR, 24/7 SOC monitoring, and formal incident response usually requires a mid-range or comprehensive tier, or a separate MSSP engagement. See our MSP vs. MSSP comparison for where that line typically falls.
Should a compliance requirement change which pricing model we choose?
It changes what you need in the base scope more than which billing model you pick. HIPAA, PCI, and CMMC all require specific documentation, audit trails, and technical controls regardless of whether you're billed per-user, per-device, or flat-fee. What matters is confirming the compliance add-on is itemized and that the MSP can produce the documentation an auditor or assessor will actually ask for — not just a general assurance that "we handle that."