What Businesses Should Review Before Signing an MSP Contract and Which Responsibilities Need to Be Clearly Defined

A managed IT services agreement should clearly define what the provider manages, when support is available, how cybersecurity responsibilities are divided, what work is included in the monthly service, what may cost extra, and what happens if the relationship ends.

For a 25–125 employee business, clarity matters because the agreement becomes the operating framework for the IT relationship. When an employee needs help, a security alert occurs after hours, a server fails, a new employee starts, or a major technology project comes up, both sides should already understand who is responsible.

The legal agreement may be accompanied by a statement of work, service schedule, security addendum, or other documents. The terminology varies between providers. Leadership should review the complete package and make sure the written scope matches what was discussed during the sales process.

Could your leadership team explain what the MSP owns, what your company owns, and what requires separate approval?

Start With Exactly What the MSP Is Managing

The scope of services should identify the users, devices, systems, locations, and technology the MSP is responsible for supporting.

Broad descriptions such as “complete IT management” or “unlimited managed services” do not provide enough information on their own. A business needs to understand how the agreement applies to its actual environment.

For a 60-employee company with two offices and remote workers, for example, does the agreement cover every employee? Are both offices included? What about home-based employees? Are company-owned laptops covered outside the office? Who manages Microsoft 365? What about servers, firewalls, switches, wireless access points, and cloud systems?

A scope review to try:

The business will change after the agreement is signed, so the scope should also explain what happens when employees, devices, locations, or systems are added.

Understand What “Unlimited Support” Actually Covers

An MSP may offer unlimited help desk support, but the word unlimited still needs a definition.

Leadership should understand who can request assistance, when the help desk operates, which types of problems are covered, how requests are submitted, and what happens outside normal business hours.

Response expectations deserve similar scrutiny, so an agreement may define several priority levels depending on the severity of the problem. An issue affecting one employee should be handled differently from a network outage affecting the entire company. Buyers should understand how priorities are assigned, what response means, and how an unresolved problem moves to a higher technical level.

There is also an important distinction between receiving an automated ticket acknowledgment and reaching someone who can begin working on the issue.

AT-NET managed IT clients have access to an internally staffed 24/7/365 help desk with less than 60-second response. Whatever provider a business is considering, the support model should be specific enough to compare rather than relying on general promises about fast service.

Make Onsite Support Part of the Conversation

Remote support can resolve many IT problems, but businesses still depend on physical technology.  Network equipment can fail. Computers need replacement. Wireless problems sometimes require physical troubleshooting. Servers and conference-room equipment can have hardware issues. An office expansion may require equipment to be installed and configured.

The managed services agreement should explain when onsite support is available and how it is billed.

For a company with multiple offices, confirm whether every location receives the same coverage. If the business expects to expand into additional locations, ask how the service would change.  This becomes especially important when comparing MSPs. One proposal may include routine onsite support while another bills for every visit. Both arrangements can work, but leadership should understand the difference before making a decision.

Cybersecurity Responsibilities Need Clear Ownership

Cybersecurity is one of the most important parts of the agreement to examine because responsibilities can easily become fragmented.

The MSP may manage certain protections while the business retains responsibility for others. Additional cybersecurity vendors may also be involved.  So, the written scope should identify responsibility for areas such as endpoint protection, multifactor authentication, email security, firewall management, patching, vulnerability management, security monitoring, identity protection, and other controls relevant to the environment.

Products are only part of the discussion. The agreement should also explain who responds when those products identify a problem.

Suppose suspicious activity is detected in an employee’s Microsoft 365 account late at night. Who reviews it? Who determines whether the account has been compromised? Who can disable access? Who contacts company leadership? Does that activity fall within normal managed services, a managed cybersecurity service, or a separate incident-response engagement?

Those responsibilities are much easier to establish while reviewing an agreement than during an active security event.

Backup Management and Disaster Recovery Need Separate Definitions

Seeing “backup” in an MSP agreement should lead to several follow-up questions.

Leadership should understand which systems and data are backed up, who monitors successful completion, how failed backup jobs are handled, how long data is retained, and whether recovery testing is performed.

The agreement should also clarify the difference between routine data recovery and a major disaster recovery event.  Restoring a deleted file is very different from rebuilding critical infrastructure after ransomware, hardware failure, or a facility outage. A large-scale recovery may require engineering work, replacement equipment, cloud resources, third-party vendors, or other services outside the normal monthly scope.

Businesses with defined recovery requirements should also understand whether their Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) are supported by the backup and recovery design.

Clear expectations here prevent a dangerous assumption that having backups automatically means every disaster scenario is covered.

Employee Onboarding and Offboarding Should Have a Defined Process

Employee changes are routine IT work with important security implications.

A new employee may need a computer, Microsoft 365 account, email, multifactor authentication, application access, security groups, permissions, and other resources. A departing employee may require account disabling, access removal, email handling, device recovery, data retention, and other security actions.

The agreement should identify which tasks the MSP performs and which decisions remain with the business.  It should also establish reasonable lead times. If the MSP needs several business days to prepare a new user’s equipment and accounts, managers and HR should know that before submitting a request the afternoon before the employee starts.

For departures, the process should support situations where access needs to be disabled at a specific time. Clear coordination between HR, management, and the MSP reduces both employee frustration and security risk.

Find the Boundary Between Support and Projects

One of the most important financial sections of a managed IT agreement defines the boundary between recurring services and separately billed projects.

Some activities are clearly projects. A company-wide cloud migration, new-office buildout, major network redesign, or server replacement will usually require planning beyond an ordinary help desk request.

Other situations can be less obvious.  Replacing one employee’s laptop might fall within normal service. Replacing 75 computers as part of a company-wide refresh may require a project. Adding one Microsoft 365 account is routine administration, while restructuring the company’s entire Microsoft 365 environment is a larger initiative.

Instead of asking only whether projects cost extra, ask the MSP to explain how it determines when work becomes a project.

Then use real situations from your business. Ask how the provider would handle an office move, firewall replacement, major software rollout, acquisition, or large equipment refresh.

Those examples reveal the financial boundaries much more clearly than the word “project” alone.

Know What Is Specifically Excluded

The exclusions section deserves the same attention as the included services.

An agreement might exclude certain applications, legacy systems, unsupported equipment, cabling, major projects, third-party software development, compliance consulting, hardware, software licensing, or specialized security services.  Exclusions do not necessarily make an agreement unfavorable. Providers need reasonable boundaries around what they can manage under a recurring service.

Problems arise when those boundaries are difficult for the customer to understand.

If a particular system is critical to daily operations, ask how the MSP will support it even if the provider does not directly administer the application. In some cases, the MSP may manage the computers, network, authentication, and vendor coordination while the software vendor remains responsible for the application itself.

Understanding that division ahead of time helps avoid finger-pointing when something stops working.

Vendor Management Can Be More Valuable Than It Looks

Growing businesses often have more technology vendors than leadership realizes.

Internet providers, phone companies, copier vendors, Microsoft, cloud applications, security platforms, industry-specific software companies, and other third parties may all be involved in the technology environment.

When a problem crosses several systems, someone needs to coordinate those vendors.

Suppose employees cannot access an important business application. The application vendor says the network is responsible. The internet provider says the connection is working. Employees simply know they cannot work.  An MSP that includes vendor coordination can troubleshoot the environment, gather technical information, work with the appropriate vendors, and help drive the issue toward resolution.

The agreement should explain how much third-party coordination is included and where the MSP’s responsibility ends.

Strategic IT Planning Should Be More Than a Sales Promise

Many providers describe themselves as strategic technology partners. The agreement should give leadership some indication of what that means in practice.

For a growing business, strategic IT management can include equipment lifecycle planning, infrastructure recommendations, cybersecurity priorities, budgeting, project planning, business technology discussions, and a 12–36 month technology roadmap.

The provider should also have a defined process for bringing those recommendations to leadership.

At AT-NET, the Technical Alignment Manager focuses on the technical condition and alignment of the environment, while the vCIO works with leadership on priorities, budgets, and longer-term technology decisions.  That distinction matters because technical findings do not automatically become a business plan. Someone needs to connect aging infrastructure, cybersecurity gaps, upcoming projects, and business changes to decisions leadership can act on.

When strategic planning influences your MSP decision, understand how it is delivered rather than relying solely on language such as “trusted advisor.”

Understand How the Agreement Changes as Your Business Grows

A managed services relationship should be able to accommodate ordinary business changes without creating confusion every time the company hires someone.

The agreement should explain what happens when users or devices are added or removed. Multi-location businesses should understand how opening another office affects service. Companies considering an acquisition should know how newly acquired users and infrastructure would be brought into the environment.

This also applies to technology changes.  A business may eliminate local servers, move applications to the cloud, introduce a new line-of-business platform, or substantially increase its cybersecurity requirements during the contract term.

Leadership should understand how material changes to the environment affect scope and fees, including when an updated statement of work or other agreement modification may be required.

Ownership of Accounts, Credentials, and Documentation Matters

Some of the most important questions in an MSP agreement involve assets that businesses rarely think about while the relationship is going well.

Who owns the Microsoft 365 tenant? Who controls the domain registration? Where are administrative credentials stored? Who owns network documentation? Who has access to backup systems? What happens to licenses purchased through the provider?

The MSP may administer these systems on behalf of the company, but the business should understand the ownership and access structure.

This becomes particularly important when changing providers.  A business should be able to transition its technology without losing access to critical accounts, documentation, configurations, or business data. The agreement should explain how information and administrative access are handled when services end.

Read the Exit Terms Before You Sign

The termination section is easy to overlook when everyone is optimistic about a new relationship. Review it anyway.

Businesses should understand the initial contract term, renewal provisions, notice requirements, termination conditions, and any obligations that apply when the relationship ends. Qualified legal counsel should review contractual provisions where appropriate.

Operationally, leadership should also understand how a provider transition would work.

Will the MSP cooperate with the incoming provider? How are credentials and documentation transferred? When are management and security tools removed? How are licenses handled? Is transition assistance included, limited, or separately billed?  A well-defined exit process protects both sides and makes future transitions more orderly.

Use a Responsibility Matrix Before You Sign

A responsibility matrix turns a complicated service agreement into a much easier management conversation.

List the important activities in your environment and identify who owns each responsibility.

This is an illustrative example, not a universal MSP responsibility model. The completed matrix should reflect the actual agreement being considered.

The value comes from forcing important assumptions into the open. If both sides believe the other party owns a responsibility, the gap becomes visible before it causes a problem.

Warning Signs That Deserve Clarification

An agreement deserves another conversation when important services are described broadly but the provider cannot explain the boundaries.

Watch for unclear definitions of “unlimited,” vague cybersecurity responsibilities, undefined project rules, confusing onsite charges, missing escalation expectations, or sales promises that are difficult to find in the written scope.

Pay particular attention to areas where several documents appear to contradict one another. The master agreement, statement of work, service schedule, proposal, and security documentation should collectively tell a coherent story about the relationship.

You do not need every possible future situation written into a contract. You should have enough clarity to understand how ordinary support, major incidents, business changes, and additional work will be handled.

Frequently Asked Questions About Managed IT Services Agreements

What is usually included in a managed IT services agreement?

The scope varies by provider, but agreements commonly address employee support, device management, network and server management, Microsoft 365 administration, cybersecurity responsibilities, backups, monitoring, vendor coordination, onsite service, and technology planning. The written scope should identify the specific services included for your environment.

What does unlimited IT support mean?

There is no universal definition. It may refer to eligible help desk requests while excluding projects, certain applications, hardware, onsite work, or other services. Ask the provider to define exactly what is unlimited and what falls outside the recurring agreement.

Should cybersecurity be part of the MSP agreement?

Cybersecurity responsibilities should be clearly documented whether they are included in the primary managed services agreement or provided under a separate security service. Businesses should know which protections the MSP manages and who is responsible for monitoring and responding to security events.

Are IT projects normally included in managed services?

Major projects are often scoped separately, although providers define projects differently. Ask for examples that show where routine managed services end and project work begins.

Who should own the company’s Microsoft 365 environment and IT accounts?

The business should understand the ownership and administrative-access structure for critical systems such as Microsoft 365, domains, cloud platforms, backup systems, and other technology assets. The agreement should also explain how access is handled during a provider transition.

Can an MSP agreement include onsite support?

Yes. The amount and pricing model vary by provider. Onsite support may be included, limited, or billed separately, so businesses should confirm the arrangement for every location they expect the MSP to support.

Should a lawyer review a managed IT services agreement?

Legal counsel can help evaluate contractual provisions such as liability, confidentiality, insurance, termination, renewal, dispute terms, and other legal obligations. Business and technical stakeholders should also review the service scope because legal review alone may not determine whether the provider’s operating model meets the company’s IT requirements.

Seven Questions to Answer Before Signing

By the end of the review process, leadership should be able to answer seven questions without searching through a proposal or calling the salesperson for clarification:

1. What technology and services is the MSP responsible for managing?
2. When can our employees get help, and how are serious issues escalated?
3. Who owns each cybersecurity, backup, and recovery responsibility?
4. What work falls outside the recurring service?
5. How are projects and additional charges identified and approved?
6. How will the MSP help us plan technology over the next 12–36 months?
7. What happens to our accounts, credentials, documentation, and services if the relationship ends?

Clear answers give leadership a much stronger basis for comparing providers. They also establish expectations that both the business and the MSP can use after the contract is signed.

A managed IT agreement works best when the day-to-day relationship does not depend on assumptions. Support, security, planning, ownership, and financial boundaries should be understandable before either side needs to test them.

About AT-NET

AT-NET has helped businesses manage and plan technology since 1999. Managed IT clients have access to an internally staffed 24/7/365 help desk with less than 60-second response, more than 20 engineers, a dedicated Technical Alignment Manager, and a dedicated vCIO.

AT-NET provides managed IT, cybersecurity, cloud, backup and disaster recovery, infrastructure, and strategic IT services for businesses throughout North Carolina, South Carolina, Florida, and Eastern Tennessee.

Reviewing a Managed IT Proposal?

Before signing, make sure you understand the support, security, responsibilities, exclusions, and strategic resources included in the relationship.

AT-NET can review your current environment and discuss what a managed IT service model should look like for your organization.

Request an IT Assessment