Buyer guide
What is included in managed IT services
Two agreements at the same monthly price can differ by tens of thousands of dollars a year once you account for what each one leaves out. This is the line by line scope, split into what is genuinely included, what varies by provider, and what is never covered.
The rule of thumb
A managed agreement buys labour, tooling and accountability.
It does not buy equipment, licences or projects. If a quote appears to include all three, read it twice.
The full scope, line by line
Sixteen items cover almost every managed agreement in this market. The middle group is where quotes diverge, so those are the lines to interrogate before comparing prices.
| Item | Status | Note |
|---|---|---|
| Remote help desk on covered systemsUnlimited during business hours. Ticket volume is not capped. | Included | Unlimited during business hours. Ticket volume is not capped. |
| 24 by 7 monitoring and alertingEndpoints, servers, network hardware and backup jobs. | Included | Endpoints, servers, network hardware and backup jobs. |
| Patch managementOperating system and third party applications on a defined cycle. | Included | Operating system and third party applications on a defined cycle. |
| Endpoint detection and responseTooling licence and the response labour behind it. | Included | Tooling licence and the response labour behind it. |
| Backup management and restore testingManaging the system. Storage costs are sometimes billed separately. | Included | Managing the system. Storage costs are sometimes billed separately. |
| Identity, MFA and access controlEnforcement, conditional access policy and periodic access review. | Included | Enforcement, conditional access policy and periodic access review. |
| New starter setup and leaver offboardingThe account work. Hardware itself is a purchase, not a service. | Included | The account work. Hardware itself is a purchase, not a service. |
| Vendor liaison on your behalfWe call your line of business software company so you do not have to. | Included | We call your line of business software company so you do not have to. |
| Onsite visitsIncluded in better agreements, capped or billed per trip in others. Ask. | Check | Included in better agreements, capped or billed per trip in others. Ask. |
| After hours workIncidents usually covered. Scheduled work outside hours often is not. | Check | Incidents usually covered. Scheduled work outside hours often is not. |
| Security awareness trainingSometimes bundled, sometimes an add-on priced per user. | Check | Sometimes bundled, sometimes an add-on priced per user. |
| Compliance evidence and audit supportAlmost always a separate line where a regulator is involved. | Check | Almost always a separate line where a regulator is involved. |
| Hardware and software you ownLaptops, servers, firewalls and licences are capital, not service. | Excluded | Laptops, servers, firewalls and licences are capital, not service. |
| Project workOffice moves, major migrations, new site builds. Quoted separately. | Excluded | Office moves, major migrations, new site builds. Quoted separately. |
| Cabling and electricalSubcontracted. Coordinated by us, billed by the trade. | Excluded | Subcontracted. Coordinated by us, billed by the trade. |
| Application developmentCustomising or building line of business software. | Excluded | Customising or building line of business software. |
The six grey areas
These are the lines that turn a competitive quote into an expensive one nine months later. Get each answered in writing before you compare totals.
- Onsite visits: included, capped at a number of hours, or billed per trip
- Security incident response: whether investigation and remediation labour is covered or billed at an emergency rate
- Backup storage: whether the cost of the storage itself sits inside the monthly fee
- Third party licences: passed through at cost, marked up, or bundled into the per user rate
- After hours scheduled work, such as a weekend server migration
- Support for equipment past end of support, which many providers exclude outright
How to read a scope document
Skip the marketing pages at the front. The scope lives in two places: the schedule listing covered assets, and the exclusions clause. Read those two first and the rest becomes easy to assess.
Look for named products
Advanced endpoint protection means nothing. A named product means you can look up what it actually does and what it costs, which tells you a great deal about the rest of the quote.
Look for counts, not adjectives
Regular patching is an adjective. Monthly, within seven days of release for critical vulnerabilities, is a commitment. The same applies to backup frequency, restore testing and access reviews.
Look for what happens on exit
Documentation, credentials, asset inventory and backups should be returned to you within a stated period. If the agreement is silent, assume the answer is unfavourable.
Common questions
Answered before you ask.
What does covered systems actually mean?
It means the specific devices, servers, network hardware, identity platform and applications named in the agreement. Anything not on that list is out of scope, including personal devices, unmanaged equipment and systems you have asked the provider to leave alone. Ask for the list as an appendix rather than a description, because a general phrase like all business systems will not help you when there is a disagreement.
Why is hardware excluded when it is essential?
Because it is a purchase rather than a service. A managed agreement buys labour, tooling and accountability. Bundling hardware into a monthly fee is possible under a hardware as a service arrangement, but it is a financing product with a different cost profile, and it usually locks you to that provider for the length of the term.
Is unlimited support really unlimited?
Unlimited normally means unlimited remote support on covered systems during covered hours. It does not mean unlimited onsite visits, unlimited project work or unlimited after hours labour. That is reasonable, but it is worth reading the sentence in full rather than the word in the heading.
How do I stop scope from drifting over time?
The asset list in the agreement should be reviewed at least annually and updated as the business changes. A provider raising a scope question when you open a second location is doing the right thing. A provider silently absorbing it will eventually either reprice sharply or quietly reduce service.
Read next
The rest of the buying decision.
What managed IT services cost in Tacoma
Per user pricing bands, what moves the number up, and how to read a quote.
Managed IT versus break-fix
Three year cost comparison and the cases where break-fix still wins.
IT contracts and SLAs explained
Auto renewal, out clauses, and who owns your data and documentation.
IT support and help desk
Tiered support with published response targets, remote and onsite.
IT compliance and risk
HIPAA, CMMC, PCI DSS and cyber insurance requirements.
See the scope against your actual environment.
The assessment produces a written asset list and a scope document specific to your systems, so you have something concrete to compare quotes against.