Managed IT & MSP

How It Works & Technology Overview

Managed IT is recurring operational ownership of a client's technology: monitoring, patching, helpdesk, backup, and security baseline, priced as a monthly fee. The delivery machine is the MSP stack: RMM (remote monitoring/management agents on every endpoint), PSA (tickets, time, billing), documentation platform (credentials, configurations, runbooks), backup/BCDR, and security tooling (EDR/MDR, email/DNS filtering). Margin lives in standardization: one stack, one patch policy, one onboarding runbook across all clients. The core operating boundary is routine maintenance (in the flat fee) vs. capital projects (migrations, buildouts — separate fixed-fee scopes); every unprofitable MSP contract erased that line somewhere. Helpdesk runs in tiers: L1 (password resets, known issues), L2 (workstation/server troubleshooting), L3/engineering (infrastructure, escalations).

Common Deployment Scenarios

• Full-managed SMB: MSP is the IT department; all-in per-seat pricing; complexity tiers — Tier 1 (<25 seats, cloud-only, no servers) ~30–45 min monthly maintenance; Tier 2 (25–100 seats, 1–3 servers, some on-prem) 2–4 hours; Tier 3 (100+ seats, hybrid, compliance) dedicated engineer time. Misclassifying Tier 3 as Tier 2 destroys margin within a quarter.
• Co-managed IT: internal IT keeps strategy/apps, MSP takes patching/monitoring/overflow helpdesk — the responsibility boundary must be written; the "strategic" internal person who routes all triage to your queue is a known failure mode.
• New-client onboarding: discovery scan, agent deployment, documentation build, credential capture, baseline remediation.
• Offboarding/lifecycle: user exits, asset retirement, license reclamation — high-liability admin work that must be priced, not gifted.
• Project overlays: server migrations, office moves, M365 work sold as separate projects on top of the agreement.

Products, Vendors & Characteristics

• RMM: NinjaOne, Datto RMM (Kaseya), N-able, ConnectWise Automate, Atera; automation-focused newcomers like ImmyBot for zero-touch onboarding/app deployment.
• PSA: ConnectWise PSA, Autotask (Kaseya), HaloPSA (fast-growing modern option), Syncro (SMB all-in-one).
• Documentation: IT Glue (Kaseya), Hudu (self-hostable alternative).
• Backup/BCDR: Datto, Veeam, Cove (N-able), Axcient — image-based with virtualization-tested restores is table stakes; M365/SaaS backup is a separate SKU clients assume they already have.
• Security add-ons: Huntress/Blackpoint (MSP-oriented MDR), Defender for Business, ThreatLocker (allow-listing), SaaS alerting via email/DNS filtering (Proofpoint, Umbrella, Avanan-class).
• Per-seat all-in market pricing commonly lands $100–200/user/month for full-managed SMB with security included; tooling COGS (RMM+EDR+backup+PSA) is a per-endpoint stack cost the fee must clear.

What Makes It Hard (Gotchas & Failure Modes)

• Unbillable labor drift is how MSP margin dies: undocumented "quick favors," out-of-scope work absorbed to keep the client happy, and chronic noisy environments nobody remediates.
• The onboarding iceberg: a 40-hour onboarding becomes 160 when discovery finds every user with local admin, the switch password on a sticky note, and the previous MSP's documentation fictional. Price onboarding off the discovery scan, not the sales call.
• Green-log backups: file-copy success masking silent database corruption because nobody ever ran a virtualization test restore — a backup that hasn't been restore-tested is a hope.
• Legacy anchors: end-of-life servers "in production" for one line-of-business app; flat networks; the custom database app with no vendor; Windows 10 machines (support ended October 14, 2025 — paid Extended Security Updates, priced per device and doubling yearly, end October 12, 2027, so they buy time, not a fix). Each is a support-liability premium or a remediation project — never silently absorbed.
• Contract ambiguity: backup/DR included or extra (the most common dispute), MAC policy undefined, after-hours expectations unpriced, offboarding free.
• Ticket-history blindness: pricing a prospect without 90 days of ticket logs misses unstable software and high turnover — the two best predictors of support load.

Effort & Estimation Patterns

• Onboarding (standard environment): 4–8 hours — agent rollout, documentation baseline, credential capture — gated on a discovery scan; heavily degraded environments run 3–4× that, so quote remediation separately.
• Monthly maintenance: by complexity tier (see scenarios): ~0.75 / 2–4 / dedicated hours per client-month; alert triage scales with environment health, not seat count.
• Helpdesk: L1 average 15–25 minutes per ticket; L2 45–90 minutes; typical SMB generates 0.5–1.5 tickets/user/month in a healthy environment — unhealthy ones run multiples of that.
• Server migration (physical→VM or cloud): ~1 day per server plus testing; M365 mailbox moves priced per-mailbox (see the Microsoft 365 category).
• Capacity planning: a loaded L1/L2 tech sustains support for roughly 250–400 well-managed endpoints; on-call/after-hours coverage adds 20–30% to labor cost if included.
• Pricing hygiene: floor on small clients (a minimum monthly fee regardless of seats), premium for unsupported/proprietary tool stacks the client refuses to migrate off, explicit per-event pricing for onboarding/offboarding users, and an annual rate-review clause.