A complete managed IT support agreement includes unlimited helpdesk, proactive monitoring and patching, endpoint security, email security, backup with tested recovery, Microsoft 365 administration, user onboarding and offboarding, and network management, under a defined SLA. Anything less is a partial service wearing a full-service price tag, and the gap between providers is enormous: two quotes at $130 and $200 per user per month are routinely two completely different products.
This is the checklist we wish every business had before comparing quotes, including ours. What should always be included, what is legitimately extra, and the three items that should never appear as add-ons.
These eight items are the floor for a genuine managed agreement in 2026. A provider excluding any of them is not cheaper, it is selling less.
| Inclusion | What it actually means | The question that tests it |
|---|---|---|
| Unlimited remote helpdesk | Staff can log tickets without anyone counting. No per-incident fees, no monthly ticket caps | “Is there any cap on tickets or hours?” |
| Monitoring and patching | Endpoints, servers and network devices watched continuously, patched on a schedule with compliance reporting | “Show me last month’s patch compliance report for a client” |
| Endpoint security (EDR) | Modern detection and response on every device, not legacy antivirus rebadged | “Which EDR product, and who responds to its alerts?” |
| Email security | Phishing and spoofing protection, SPF/DKIM/DMARC configured and maintained | “Is our DMARC at enforcement, or just monitoring?” |
| Backup with tested recovery | Microsoft 365 and server backup, with recovery actually tested, not assumed | “When was our restore last tested, and can I see the evidence?” |
| M365 administration | Licence management, security configuration, tenant hygiene | “Who reviews our tenant security score, and how often?” |
| Onboarding and offboarding | New starters productive on day one, leavers’ access killed same day | “What is your offboarding turnaround from our request?” |
| Documentation | Your environment documented in a system you can access, not in one engineer’s head | “If we left, what documentation would we take with us?” |
Not everything belongs in the monthly fee, and a provider that claims everything is included has priced the risk in somewhere. Fair exclusions: project work (migrations, office moves, new infrastructure), hardware and software licences at cost, major version upgrades, after-hours work outside an agreed window, and compliance programmes like Essential Eight uplift or SMB1001 certification, which are structured engagements in their own right.
The test is not whether exclusions exist. It is whether they are written down before you sign. Scope surprises are the single biggest cause of MSP relationship breakdowns we see when businesses come to us from another provider.
Security basics. A quote where EDR, MFA enforcement or email security appears as an optional line item is a provider planning to run you insecure by default. In 2026, with mandatory ransomware reporting in force and insurers auditing controls, baseline security is the product, not the upsell.
Offboarding. Charging extra to remove a departed employee’s access is charging extra to close your biggest security hole. It should be same-day and included, full stop.
Your own documentation. Some providers treat documentation of your environment as their property, which converts into leverage the day you consider leaving. Your network diagrams, credentials and configurations are yours. Get that in writing.
The cheaper quote usually strips one of the eight core inclusions and hopes you will not notice until the invoice arrives. The dearer quote sometimes bundles services your business genuinely does not need yet. The only defence is comparing scoped inclusion lists side by side rather than headline rates, which is also why per-user price alone tells you almost nothing. We covered the actual dollar figures in our guide to how much IT support costs in 2026, and the in-house comparison in where the cost breakeven actually sits.
One more 2026-specific item worth asking about: AI. Staff at every business are already using AI tools, and a current agreement should say something about how that gets discovered and governed. If your provider has no answer, our 10 questions to ask your MSP about AI gives you the follow-ups.
Pull out your current agreement and score it against the table above. Most businesses find at least two of the eight core items missing or vaguely worded. Vague wording always resolves in the provider’s favour.
Ask your provider the eight test questions. In writing. A capable provider answers same-week with evidence. Silence or salesmanship is itself an answer.
Compare against a full-scope baseline. Our managed IT support agreements publish inclusions up front, and our free IT assessment maps your current coverage against the checklist. Contact us on 1300 EPIC IT to book one.
A complete managed IT support agreement includes unlimited remote helpdesk, proactive monitoring and patching, endpoint detection and response, email security, backup with tested recovery, Microsoft 365 administration, user onboarding and offboarding, and documentation of your environment, all under a defined SLA. Project work, hardware and major upgrades are usually separate.
Project work such as migrations and office moves, hardware and software licence costs, major infrastructure upgrades, and structured compliance programmes are legitimately quoted separately. The key is that exclusions are listed in the agreement before signing, not discovered on an invoice afterwards.
Baseline security, meaning EDR, MFA enforcement, email security and patch management, should be included in any managed IT support agreement in 2026. Advanced programmes like Essential Eight maturity uplift or penetration testing are fair as separate engagements. A quote listing basic security as an optional add-on is a warning sign.
Ignore the per-user rate first. Request a written scope from each provider, put the inclusion lists side by side, and check the eight core items: helpdesk limits, monitoring, EDR, email security, tested backup, M365 administration, offboarding turnaround and documentation ownership. Then compare price for the same scope. A cheaper rate with a thinner scope usually costs more in total.
You should. Documentation of your own network, credentials and configurations belongs to your business, and your agreement should say so explicitly. Providers that withhold documentation are creating switching costs, and it is one of the most common problems we untangle when onboarding businesses from other providers.
