The Managed IT Buying Guide: How to Choose an MSP That Actually Fits

Every managed IT provider's website says the same things: proactive, partnership, peace of mind. The industry has thousands of firms, from two-person shops to national platforms, and from the outside they are nearly indistinguishable. Meanwhile the decision matters more than most technology purchases, because you are not buying a product you can switch off next quarter. You are choosing the people who hold your credentials, your backups, and your help desk queue.

This guide is how we evaluate managed IT providers as advisors, written down so it is useful even if you run the process alone. It is the advice-side companion to the quoting work we do every week, and none of it requires buying anything from us.

Start with the model, not the vendor list

The most common mistake in MSP selection is collecting quotes before deciding what job the provider is actually being hired to do. There are three distinct models, and providers who excel at one are often mediocre at the others.

• Fully managed. The provider is your IT department. Help desk, devices, network, servers or cloud, security baseline, vendor management, and a recurring strategy conversation. This is the default for companies without internal IT, usually up to a few hundred employees.
• Co-managed. Your internal team keeps strategy and the work they want; the provider takes a defined slice, most often the help desk, patching and monitoring, or after-hours coverage. This is the fastest-growing arrangement in the market, and it is also where scope disputes breed if the boundary is vague.
• Help desk or monitoring only. A narrow contract for a narrow job. Cheapest, and correctly so; just do not let a narrow contract wear a fully managed price tag.

Decide the model first. It cuts the field by more than half before you read a single proposal, and it changes every question you ask afterward.

The scope trap: no two quotes cover the same things

Managed IT quotes are famously incomparable. One provider's one hundred forty dollars per user includes security tooling, backup licensing, and unlimited on-site visits; another's one hundred ten covers remote help desk and patching with everything else billed as a project. Neither is dishonest. They are just answering different questions.

Before quotes arrive, write a one-page scope sheet and make every bidder price against it:

• Users, devices, and locations. Including the office that is really a warehouse and the executives who expect white-glove response.
• What counts as included work versus a project. New-hire setup, office moves, server migrations, application rollouts. Project creep is where cheap contracts get expensive.
• Security responsibilities, named explicitly. Who runs endpoint protection, who watches the alerts at 2 a.m., who owns response when something gets through, and which compliance frameworks the provider must support. If a bidder is vague here, that is your answer. Where requirements run deeper, a dedicated security provider alongside the MSP is a legitimate design, and a good MSP will say so rather than overclaim.
• Response and resolution expectations. Not the marketing SLA; the priority definitions and the measured numbers they will commit to in writing.
• The backup question. What is backed up, how often it is tested with a restore, and who attests to it. Ask to see the last test.

With a common scope sheet, the spread between bids becomes information instead of noise. Without one, the low bid is usually just the smallest scope.

Questions that actually separate providers

Reference calls and site visits are worth doing, but most of the separation happens in a handful of questions:

• Who is on the other end of the help desk? Employees or subcontractors, how many, in what time zones, and what happens to your ticket at 6 p.m. Friday. Ask for their average speed to answer and time to resolution, measured, not promised.
• What does onboarding look like, in writing? The good ones produce a dated plan: documentation capture, credential transfer, tooling deployment, a named transition lead. Providers who improvise onboarding improvise everything else.
• How standardized is their stack? Mature MSPs run one way of doing things: one remote monitoring platform, one security baseline, one documented escalation path. A provider that adapts to whatever each client already has sounds flexible and operates chaotically.
• What is their own security posture? MSPs are prime targets precisely because they hold keys to many companies at once. Ask how they secure their own tools, whether they carry cyber insurance, and when they last had an outside assessment. Hesitation here should end the conversation.
• Depth beyond the founder. In smaller shops, ask who handles your account when the two best engineers are on vacation. There are excellent small MSPs; the difference is whether the answer is a process or a person.
• A quarterly business review you would actually attend. Ask to see a real (redacted) QBR deck. If it is a ticket-count printout, the strategy relationship you are being sold does not exist.

How the pricing actually behaves

Per-user per-month is the dominant model, with per-device pricing surviving in environments where devices outnumber people. The number moves with scope more than with headcount, and a few mechanics are worth knowing before you negotiate:

• The range is real but scope-driven. Help-desk-only arrangements can sit well under one hundred dollars per user; fully managed with a serious security bundle can run well past two hundred. Where you land inside that range is mostly a scope decision you control.
• Onboarding fees are negotiable. Many providers charge one, many waive it on a three-year term, and the waiver is often worth less than the term concession you gave for it. Price them separately.
• True-ups cut both ways. Headcount goes up and the bill follows automatically; headcount goes down and the bill often does not. Make the adjustment symmetric and monthly.
• Hardware margin is not a service. A provider whose economics depend on selling you equipment has a conflict you will feel at every refresh. Procurement through the contract is fine; procurement as the profit center is a flag.
• Term length buys you less than it costs. One-year terms exist in this market. Three-year terms should be paid for with real concessions, and everything above still applies to the renewal you will eventually face.

Negotiate the exit before you need it

The single most valuable clause in an MSP agreement is the one nobody reads at signature: what happens when you leave.

Your documentation, credentials, tenant ownership, and runbooks must belong to you, in writing, with a defined offboarding obligation and a capped transition fee. Every administrator account should live in your identity system, not the provider's. The backup data must be exportable in a standard format. None of this is hostile; a provider confident in their service agrees to all of it without friction, and the ones who resist are telling you how the relationship ends.

We see the alternative regularly: a company that wants to switch but cannot produce its own network documentation or global admin credentials, negotiating its exit from a position of dependence. Ten minutes of contract language at the start prevents all of it.

Where an advisor fits

You can run everything above yourself, and this guide is meant to make that genuinely possible. What an advisor adds is compression and leverage: we already know which providers fit your size, industry, and service model, which ones treat co-managed as a real practice, and what comparable companies actually pay, because we see the live quotes. The advice costs you nothing, the shortlist is not tilted toward any provider, and you sign directly with the one you choose.

If a managed IT decision is on your calendar this year, a thirty-minute conversation is the cheapest due diligence you will do.