Handing your IT to a managed provider (an MSP) is one of the highest-trust decisions a small business makes. The right one quietly keeps everything running and secure; the wrong one locks you into a contract, holds your data hostage, and shows up only when something breaks. The good news is that you can tell them apart before you sign, if you ask the right questions. Here is how to choose well.
If you are still deciding whether you need an MSP at all, start with what a managed IT provider actually does. This guide assumes you are ready to shop, and focuses on picking the right one.
Get clear on what you need first
Before you talk to anyone, write down what you actually want covered: day-to-day helpdesk, security, cloud and Microsoft 365, backups, compliance, on-site visits, new-hire setup. The clearer you are on scope, the easier it is to compare providers and the harder it is for one to quote you a low number that leaves out the things you need. A two-person shop and a thirty-person firm with client data need very different things; know which one you are.
The questions that actually separate good from bad
Most MSPs will tell you they offer "24/7 support" and "enterprise-grade security." Push past the brochure with specifics:
- Response and resolution: what are your guaranteed response times, in writing? Who answers when I call, a named team or a queue? How do urgent issues escalate, and what are your hours?
- Security, practised not just preached: do you enforce MFA and least-privilege on your own systems? Will you help us meet client or insurer security requirements? What happens, step by step, if we get breached?
- Scope and the fine print: what is included in the monthly fee versus billed extra? Is onboarding, after-hours, or on-site work included? What is explicitly not covered?
- Proactive or reactive: do you monitor and patch our systems on a schedule, or only fix things once they break? Will you manage our backups and test that they restore?
- People and local fit: who is our actual contact? Do you support us in our timezone? Where is our data stored, and is that a problem for Canadian privacy rules?
Understand how they charge
MSP pricing comes in a few shapes, and the cheapest sticker is rarely the cheapest provider. Common models are per-user (a flat fee per employee, easy to budget), per-device (per server, laptop, and so on), and flat-rate or all-inclusive (one predictable monthly fee for an agreed scope). Some still sell break-fix, where you pay by the hour when something goes wrong, which looks cheap until the month it is not. What matters is not the model but what the price actually includes: a low quote that excludes security, backups, or after-hours support is not a deal, it is a gap you will pay for later.
The red flags
Walk away, or at least ask hard questions, if you see these:
- No clear service-level commitments in writing, just verbal promises of "fast" support.
- Long lock-in contracts with painful exit terms, especially paired with a reluctance to explain how you would leave.
- They will not share references from businesses your size, or dodge questions about their own security.
- They hold the keys. If your domain, Microsoft 365 tenant, passwords, or documentation are registered to them and not to you, you do not really own your own IT.
- One person with no backup. A solo operator can be excellent, but ask what happens when they are sick, on vacation, or simply unreachable.
Check the contract and the exit before you sign
The time to think about leaving a provider is before you join one. Confirm in writing that your business owns its accounts, domains, data, and documentation, and that you would get them all back cleanly if you ever left. Look at the notice period, what offboarding includes, and whether there are fees to get your own information out. A confident, honest provider has no problem with any of this; one that gets cagey is telling you something.
How to actually decide
Shortlist two or three providers that fit your scope and feel straight with you. Ask each the questions above, get the answers in writing, and call a reference or two that resemble your business. Then weigh responsiveness, security, transparency, and ownership over price. The best-value MSP is the one you stop having to think about, because things just work and you trust the people behind them.