"Managed IT services" is a label, not a standard. Two MSPs can quote you $150 per user per month and deliver catalogs that differ by a dozen line items. The gap shows up later as billable "out of scope" work — the most common source of MSP invoice disputes (CompTIA State of the Channel, 2025).
This guide lists what a managed services contract should include at each tier, what legitimately costs extra, and the exact catalog table to put next to every quote. When you're ready to compare real providers, our MSP directory covers 2,698 of them.
What does every managed IT contract include?
Five services form the core. If a quote is missing any of these, it's not managed IT — it's monitoring with extra steps.
| Core service | What it actually means | Standard scope in 2026 |
|---|---|---|
| Helpdesk support | Ticket-based user support, remote-first | Business hours; 24/7 costs ~20-30% more |
| RMM monitoring | Agents on every endpoint watching health, disk, uptime | All managed devices, alerting 24/7 |
| Patch management | OS + third-party app updates on a schedule | Weekly or monthly cycles, emergency patches faster |
| Endpoint protection | Antivirus at minimum; EDR is the 2026 standard | Every managed endpoint |
| Backup management | Server + cloud data backup with restore testing | Daily minimum; hourly increments common |
The market behind this is big and mature: managed services hit roughly $344 billion globally in 2024 and keep growing at 12-13% a year (Mordor Intelligence, 2026). Most MSPs deliver the core stack with near-identical tools — an RMM platform to watch devices, a PSA for tickets, and a security suite (Kaseya MSP Benchmark Report, 2025).
One more core item hides in plain sight: documentation. The MSP should keep a current map of your network, your passwords in a vault, and runbooks for your systems.
You own all of it by contract. If that clause is missing, leaving the MSP later gets expensive.
What's in a standard (mid-tier) plan?
The $125-$200 per-user band — where most SMB contracts land — adds management of the things your business actually runs on (ChannelPro Network pricing survey, 2026):
- Microsoft 365 / Google Workspace administration — licenses, mailboxes, sharing policies, onboarding/offboarding users
- MFA and identity management — enforcement, conditional access, password resets
- Email security — filtering, anti-phishing, impersonation protection
- Network management — firewall, switches, Wi-Fi monitoring and config
- Vendor management — the MSP calls your ISP, printer company, and software vendors so you don't
- Mobile device management — phones and tablets enrolled, wipeable, policy-controlled
- Asset and license tracking — what you own, what expires when
- Monthly or quarterly reporting — tickets, patch compliance, security posture
User onboarding/offboarding deserves attention in the scope language. Some MSPs include unlimited moves/adds/changes; others cap them monthly and bill overages at $150+ per event.
Cloud management sits in this tier too, but scope varies more than any other line. Managing your Microsoft 365 tenant is standard.
Managing Azure or AWS infrastructure — virtual machines, storage, cost optimization — is often a separate agreement. Ask which cloud workloads are in scope and which bill as projects.
What do security-focused tiers add?
Premium tiers ($175-$275/user/month) layer managed security on top. With the median SMB ransomware recovery bill at $1.5 million including downtime (Sophos State of Ransomware, 2025), this tier is where the money goes in 2026:
| Security add-on | What it does | Typical standalone price if bought separately |
|---|---|---|
| Managed EDR / MDR | Humans respond to endpoint threats, not just alerts | $8-$25/endpoint/mo |
| 24/7 SOC monitoring | Security operations center watching logs round the clock | $50-$150/user/yr |
| Security awareness training | Phishing simulations + training modules | $2-$5/user/mo |
| Dark web monitoring | Alerts when company credentials leak | $2-$10/user/mo |
| Vulnerability scanning | Scheduled internal/external scans with reports | $100-$500/mo |
| Compliance reporting | Evidence packs for HIPAA, PCI, SOC 2, CMMC | Varies; often project-priced |
If you carry a compliance framework, confirm the MSP has live clients in it — our HIPAA BAA guide for MSPs explains what healthcare buyers specifically need to see in writing.
What almost always costs extra?
These are the legitimate carve-outs. They're not nickel-and-diming — they're real labor outside steady-state operations. The problem is only when they're not priced in advance.
- Projects — migrations, server builds, office moves, new-site setups. Billed at $150-$250/hr or fixed-bid (TechTarget managed services pricing analysis, 2025)
- Hardware and software — laptops, servers, licenses. Pass-through cost, often with 10-20% procurement markup
- After-hours support — 1.5x-2x rates unless you bought a 24/7 plan
- On-site visits — remote-first contracts include 0-2 visits/month; more is billable
- Compliance audits — the audit itself and remediation work are project-priced
- Incident response beyond scope — a full ransomware recovery typically becomes a project, even on security tiers
- Onboarding — the first 30-60 days of setup, usually about one month's contract value
Get every one of these priced in the agreement before signing. The contract red flags guide shows the clauses that turn carve-outs into disputes.
How do you use this catalog to compare quotes?
Make a spreadsheet with every line item above as a row and each bidder as a column. Mark I (included), C (capped — note the cap), or X (extra — note the rate). Two things happen.
First, the cheap quote usually stops being cheap. A $110/user bid missing EDR, backup testing, and onboarding/offboarding bundles becomes $160+ once normalized. Second, you now have the basis for an apples-to-apples SLA conversation — pair it with our 15-point vendor selection checklist for the full evaluation.
Pricing model matters too. Per-user contracts bundle more per seat; per-device contracts itemize harder. The pricing models comparison covers when each works in your favor.
Frequently Asked Questions
What services are included in basic managed IT?
Five core services: remote helpdesk during business hours, RMM monitoring agents on every endpoint, scheduled OS and application patching, endpoint protection (EDR in 2026, not just antivirus), and managed backup with restore testing. Basic plans run $85-$125 per user per month in 2026.
Is cybersecurity included in managed IT services?
Baseline protection is — endpoint security, email filtering, and MFA management appear in most standard plans. Managed detection and response (MDR), 24/7 SOC coverage, security training, and compliance reporting are premium-tier or add-on items that push contracts to $175-$275 per user per month.
Are new computers and software licenses included in MSP contracts?
No. Hardware and licenses are pass-through purchases, typically with a 10-20% procurement markup. The MSP's labor to deploy them may be included (standard image, agent install) while larger rollouts get quoted as projects. Ask for the procurement markup percentage in writing.
Do managed IT services include on-site support?
Most 2026 contracts are remote-first. Plans commonly include zero to two on-site visits per month, with additional visits billed at $150-$250 per hour plus travel. Businesses needing daily floor presence should price a co-managed arrangement with one internal hire instead.
What's the difference between managed IT services and break-fix?
Managed services are proactive and flat-billed: monitoring, patching, and security run continuously for a monthly fee. Break-fix is reactive and hourly — you call when something breaks. Break-fix looks cheaper until incident hours stack up; managed contracts typically beat it on total cost above roughly 10 employees.
Related Reading
- What Is a Managed Service Provider? The Complete Guide
- MSP Pricing Models: Per-User vs Per-Device vs Flat-Rate vs A La Carte
- Managed Cybersecurity Services for Small Businesses
Sources
- CompTIA. "State of the Channel." 2025. https://www.comptia.org/content/research/comptia-state-of-the-channel
- Mordor Intelligence. "Managed Services Market Size & Share Analysis." 2026. https://www.mordorintelligence.com/industry-reports/global-managed-services-market-industry
- Kaseya. "MSP Benchmark Report." 2025. https://www.kaseya.com/resource/msp-benchmark-report/
- ChannelPro Network. "MSP Pricing Model Survey." 2026. https://www.channelpronetwork.com/2026/02/06/best-pricing-model/
- Sophos. "The State of Ransomware." 2025. https://www.sophos.com/en-us/content/state-of-ransomware
- TechTarget. "Popular Pricing Models for Managed Service Providers." 2025. https://www.techtarget.com/searchitchannel/feature/What-are-the-popular-pricing-models-for-managed-services-providers
— The MSP Directory Team