Questions to ask before you sign with an MSP

If you have three managed IT proposals on your desk right now, they probably look similar. Comparable monthly figures, a list of things that sound like the same list, and a page about proactive partnership. The differences that matter are mostly not on the cover page.

Here is what we would ask, in your position. Some of these are uncomfortable to answer. That is rather the point: how a provider handles an awkward question in the sales process tells you how they will handle one at 4pm on a Friday.

Scope and billing

What is specifically excluded?

Ask for the exclusions, in writing, as a list. Every agreement has them, and the ones that surprise you later are always the ones nobody named up front. Common carve-outs: projects above a certain size, cabling, anything involving a vendor's own support contract, work caused by hardware that was already end of life.

"Unlimited support" is a real offer in most agreements, and it almost always means unlimited support work rather than unlimited project work. That is reasonable. You just want to know where the line sits before you are standing on it.

What turns a support ticket into a billable project?

There is usually a threshold, measured in hours or in whether the work changes something rather than fixing it. Get the actual number. A provider who cannot tell you has either never thought about it or would rather decide later.

What happens if our headcount changes?

Find out how the price moves if you hire five people, or lose five. Some agreements true up annually, some monthly, some not at all until renewal.

Response, and who actually turns up

What is the response target, and is it in the agreement?

Response and resolution are different things, and some proposals blur them. A one hour response target means someone acknowledges you within an hour. It says nothing about when the problem goes away. Ask for both, and ask what counts as business hours.

Who physically arrives when something needs hands on it?

Plenty of providers subcontract site visits. That is not automatically bad, but you should know, because it decides whether the person in your server room has ever seen your network before.

Will we get the same people?

At a large provider you will get whoever is on the queue, which means re-explaining your environment each time. At a small one you get continuity, and the trade is that there are fewer of them. Both are defensible. Know which you are buying.

The backup question

If you only ask one thing, make it this one.

Can you show me a restore?

Not a backup report. A restore. Backups fail quietly and often, and a job that reports success every night can still produce nothing usable when you need it. The gap between "we back you up" and "we have restored from that backup recently" is where ransomware does its real damage.

A provider with a good answer will describe how often they test restores, what they test, and who signs off. A provider with a bad answer will talk about their backup software's features.

Ask about retention too, and about where the offsite copy lives. If the offsite copy is in the same building, it is a second copy rather than an offsite one.

Ownership, and what happens if you leave

Whose name is on everything?

Your domain registration, your Microsoft or Google tenant, your firewall licences, your public IP block. These should be registered to your business, with the provider holding administrative access. The other way round is common and it is a problem, because it makes leaving expensive.

Do we get the documentation?

Network diagrams, addressing, configurations, credentials, licence keys. Ask whether you get them during the relationship or only at the end, and what format they arrive in. A provider who treats documentation as their intellectual property is telling you something about how the ending will go.

What is the notice period, and what does offboarding cost?

Thirty to ninety days is normal. What matters more is whether they will assist a handover to whoever comes next, and at what rate. Get it in writing while everyone is still pleased with each other.

Two more worth asking

What do you not do?

Any honest provider has a list. If the answer is that they do everything, you are either talking to a large firm with real depth in each area, or to someone who has not thought about it. Both exist, and they are very different purchases.

Who else do you work with that looks like us?

Not a logo wall. A business of roughly your size, in roughly your line of work, that you could call. Whether they hand over a reference says as much as the reference does.

Red flags

Individually these are worth a follow-up question. Together they are a pattern.

• Response targets that exist in the proposal but not in the agreement
• Vagueness about what is excluded, or an exclusions list that arrives only after you ask twice
• No answer on restore testing beyond naming the backup product
• Your domain or tenant registered to the provider rather than to you
• Documentation described as something you receive when the contract ends
• A proposal that costs noticeably less than the others without explaining which of the above it leaves out

That last one matters. Managed IT is mostly labour, and labour has a floor. A number well under everyone else usually means a thinner scope, slower response, or work being done by someone more junior than you assumed. Any of those can be the right trade for your budget, as long as you are choosing it rather than discovering it.

---

We put our own answers to all of this in writing before anyone signs, because the alternative is a conversation about it later when something is broken and nobody is in the mood.

If you want to see how we handle it, the managed IT page covers what is in scope and what drives the price, or you can send us the details and we will come back with a number and a straight answer to every question above.

• Managed IT
• MSP
• Buying