Quick answer: A managed IT service gives a small business or nonprofit an outside team that takes ongoing responsibility for support, security, devices, Microsoft 365 and backup for a predictable monthly fee. The right provider publishes clear service levels, enforces a security baseline, documents everything in your name and reviews performance with you quarterly. Compare providers on scope and accountability, not just per-user price.
Key takeaways
- Managed IT replaces reactive break-fix billing with proactive, accountable operations under a written agreement.
- Core scope should include help desk, monitoring, patching, identity and Microsoft 365 administration, endpoint security and backup.
- Per-user pricing is most common for small organizations; always get a written list of inclusions and exclusions.
- You should own every credential, license, domain and document, and be able to leave cleanly.
- Co-managed IT suits organizations that already have an internal IT person.
Managed IT is the most common way small businesses and nonprofits get professional IT without building an in-house department. This guide explains what a good managed service should include, how pricing works, and how to compare providers. For an overview of how we deliver it, see our managed IT services page.
What does a managed IT service include?
A managed IT service covers the day-to-day running, securing and supporting of your technology under a recurring agreement. The scope should be written down, and it should be broad enough that you are not paying hourly for routine work.
A complete small-business scope usually includes:
- Help desk support by phone, email, chat or portal, with defined response times
- Remote monitoring and management (RMM) of laptops, desktops and servers, with alerting
- Patch management for operating systems and common third-party applications
- Identity and Microsoft 365 or Google Workspace administration, including users, licenses, groups, mailboxes, Teams and SharePoint
- Endpoint security, typically endpoint detection and response (EDR), disk encryption and device compliance through a tool such as Microsoft Intune
- Email security such as phishing filtering and SPF, DKIM and DMARC configuration
- Backup and recovery for devices, servers and SaaS data, with restore testing
- Network management of firewalls, switches and Wi-Fi
- Vendor management for internet providers, printers, phone systems and line-of-business software
- Documentation, asset inventory and quarterly reviews with a technology roadmap
Managed IT vs break-fix vs in-house IT
The three common models differ mainly in who carries the risk when things break.
| Model | How it is billed | Incentive | Best for |
|---|---|---|---|
| Break-fix | Hourly, when something breaks | More problems mean more revenue | Very small offices with minimal IT |
| Managed IT (fully outsourced) | Fixed monthly per user or device | Fewer problems mean more margin | 5-100 users without internal IT |
| Co-managed IT | Monthly fee for tools and selected services | Shared responsibility | Organizations with one or two IT staff |
| In-house only | Salaries plus tooling | Depends on staffing depth | Larger organizations with complex on-site needs |
For most organizations under about 75 users, a fully managed model is the most cost-effective way to get security tooling, after-hours coverage and breadth of skills. Above that size, co-managed arrangements are common: an internal IT generalist handles on-site and institution-specific work while the provider supplies tools, escalation and project capacity.
How is managed IT priced?
Managed IT is typically priced per user per month, per device per month, or as a flat fee for a defined environment. Per-user pricing is the most common for small organizations because it scales with headcount and covers the multiple devices each person uses.
When comparing quotes, line up these questions:
- Which security tools are included, such as EDR, email filtering, security awareness training and DNS filtering?
- Is backup of Microsoft 365 or Google Workspace data included, or billed separately?
- Are after-hours and weekend support included, and at what priority levels?
- How many on-site visits are included, and how are extra visits billed?
- Which software licenses, such as Microsoft 365, are bundled versus billed directly to you?
- How are projects, such as onboarding a new office or migrating servers, quoted?
A lower monthly price with many exclusions often costs more over a year than a comprehensive one. Ask for a sample invoice and a written inclusions list.
What security baseline should a provider enforce?
A provider should apply a minimum security baseline to every client, not offer security as an optional add-on. At a minimum, expect:
- Multi-factor authentication (MFA) on every user account, with phishing-resistant methods for administrators where possible
- Separate, named admin accounts, with no shared global admin passwords
- EDR on every managed endpoint, monitored for alerts
- Automated OS and application patching with compliance reporting
- Full-disk encryption on laptops
- Backups that follow the 3-2-1 rule, with scheduled restore tests
- Email authentication (SPF, DKIM and DMARC) on your domains
Our IT security checklist for small businesses expands each of these into actionable items, and backup and disaster recovery planning covers recovery objectives and testing.
How do you choose a managed IT provider?
Choose a provider based on accountability and fit, not only price. These criteria separate strong providers from weak ones:
- Written service levels. Response and resolution targets by priority, with reporting. Our IT support SLA guide explains what good targets look like.
- Ownership and exit terms. You own the tenant, domains, licenses, credentials and documentation. The agreement describes how they are handed over.
- Cloud and Microsoft 365 depth. Most small organizations now run on Microsoft 365 or Google Workspace, so tenant administration skill matters more than server skills. See Microsoft 365 administration best practices.
- Modern device management. Look for Intune or equivalent cloud management rather than reliance on an on-premises domain. Our Intune endpoint management guide explains why.
- Proactive reviews. Quarterly business reviews with ticket trends, security posture and a roadmap.
- Local presence when needed. Remote support handles most work, but on-site help for network and hardware issues is valuable.
- References in your sector. Ask to speak with organizations of similar size and type.
What happens during MSP onboarding?
Onboarding typically takes two to six weeks and should follow a predictable sequence:
- Discovery of users, devices, licenses, network equipment, applications and vendors
- Credential collection into a secure password vault owned by your organization
- Agent deployment for monitoring, EDR and backup, running in parallel with any existing tools
- Security remediation of the highest-risk gaps, usually MFA, admin accounts, patching and backup coverage
- Documentation of the environment and support procedures
- Go-live of help desk with staff communication on how to request support
If you are leaving another provider, keep the old tools running until the new ones are verified, then remove them and rotate all shared admin passwords.
Managed IT for nonprofits
Nonprofits get the most value when the provider understands nonprofit licensing and operations. Microsoft, Google and many security vendors offer donated or discounted products to eligible nonprofits, often through programs such as TechSoup, and these need correct licensing and assignment. Nonprofits also manage volunteers with short-term access, shared devices at program sites and sensitive donor or client data. Ask providers how they handle guest and volunteer accounts and how they help you budget around grant cycles.
Next steps
Start with an assessment of your current environment, including security posture, backup coverage and license usage. That baseline makes provider quotes comparable and reveals quick wins. If you are also considering moving remaining servers to the cloud, a cloud readiness assessment can be run alongside it. To talk through your situation, contact Desai InfoTech.
Frequently asked questions
What is a managed service provider (MSP)?
A managed service provider is a company that takes ongoing responsibility for some or all of an organization's IT under a recurring contract. Typical services include help desk support, device monitoring and patching, Microsoft 365 or Google Workspace administration, security tooling, backup and vendor management, delivered against defined service levels.
Is managed IT worth it for a 10-person company?
Usually, yes, if staff are losing time to IT problems or security basics like MFA, patching and backups are not consistently in place. A 10-person office rarely justifies a full-time IT hire, but it faces the same phishing and ransomware risks as larger firms. A managed provider delivers those controls and support at a fraction of a salary.
What is not usually included in a managed IT agreement?
Common exclusions are hardware and software purchases, large projects such as migrations or office moves, support for personal devices, custom application development and third-party vendor fees. Some agreements also exclude after-hours work or on-site visits beyond a set number. A good agreement lists these explicitly so there are no surprise invoices.
How long are managed IT contracts?
Contracts commonly run one to three years, sometimes with a 30- to 90-day termination clause. Shorter terms give flexibility; longer terms may lower the monthly rate. Whatever the length, make sure the agreement covers offboarding, including handover of documentation, credentials and configuration, if you leave.
Part of the Managed IT Services hub.