Registered office
20 Wenlock Road
London N1 7GU
Reviewed 18 August 2026.
A managed service provider (MSP) is an external company that takes ongoing responsibility for agreed parts of your technology. Instead of waiting for something to break, an MSP supports users, monitors systems, applies routine maintenance, manages security controls and helps plan improvements under a recurring agreement.
For a UK SME, that can provide the day-to-day capability of an IT department without employing every specialist internally. The important detail is the scope: “managed IT” only means something when the contract clearly states what is monitored, what is included, how quickly the provider responds and what remains your responsibility.
What does an MSP actually do?
An MSP’s work usually combines user support, system administration and risk reduction. A practical service may include:
- Helpdesk support for staff, devices, applications, printing and connectivity.
- Microsoft 365 or Google Workspace administration, including accounts and permissions.
- New-starter setup and timely leaver access removal.
- Device monitoring, operating-system updates and security patching.
- Endpoint protection, multi-factor authentication and security configuration.
- Backup monitoring and scheduled recovery tests.
- Wi-Fi, firewall, server, cloud and supplier coordination.
- Asset records, licence management and technology planning.
- Incident response, escalation and clear reporting.
Not every MSP includes all of these. Some focus on end-user IT, some on cloud or servers, and others specialise in cybersecurity. Ask for a service schedule that maps every promised outcome to a named activity and responsibility.
MSP vs break-fix IT support
| Area | Managed service provider | Break-fix support |
|---|---|---|
| Commercial model | Recurring fee for an agreed service | Pay for time or work when needed |
| Primary behaviour | Monitor, maintain, support and improve | Diagnose and repair reported problems |
| Incentive | Fewer avoidable incidents make the service easier to deliver | Revenue is linked to work requested |
| Budgeting | More predictable, subject to exclusions and projects | Variable and sometimes difficult to forecast |
| Knowledge | Maintains records and learns the environment over time | May need fresh discovery on each request |
| Best fit | Businesses that depend on reliable, secure technology every day | Simple environments with infrequent needs or a capable internal owner |
Break-fix support still has a place. It can suit a very small organisation with limited systems, or provide specialist help alongside an internal team. But if email, devices, payments, customer data or online sales are critical, waiting for failure often costs more than the repair invoice.
MSP vs an in-house IT employee
This is not always an either-or decision. One excellent internal IT manager knows the organisation deeply, but cannot simultaneously cover the helpdesk, cloud platforms, networks, security, projects, holidays and out-of-hours incidents. An MSP offers breadth and cover; an employee offers proximity and business context.
Growing firms often use a co-managed model: the internal person owns priorities and stakeholder relationships while the MSP provides tools, monitoring, escalation and additional specialists. The contract should make ownership explicit so tasks do not fall between teams.
How MSP pricing works in the UK
Common models include a fee per supported user, per device, per server, or a fixed monthly amount for a defined environment. Projects, hardware, licences, onsite visits and out-of-hours work may be separate.
ACA Tech’s managed IT plans currently start from £39 per user per month, but a meaningful comparison must use equivalent scope. A lower headline price may exclude onboarding, security tooling, backup, onsite help or support outside narrow hours.
Ask every provider to show:
- the users, devices, sites and services covered;
- what is included in the recurring fee;
- which licences or tools are charged separately;
- project and onsite rates;
- minimum term, notice period and annual price changes;
- onboarding, offboarding and data-export costs.
What a good MSP contract should contain
The NCSC’s guidance on choosing a managed service provider stresses clear responsibilities, security expectations and the ability to verify the service. Your agreement should cover at least the following.
Scope and responsibility
List managed systems and the tasks performed on them. Define what the customer must do, such as approving access, buying supported hardware or notifying the MSP about starters and leavers.
Service levels
Separate response targets from resolution promises. A provider can acknowledge an incident quickly without fixing it instantly. Define priorities with examples, hours of cover, escalation routes and communication intervals.
Security controls
Ask how the MSP protects privileged accounts, staff devices, remote access and customer data. Require least-privilege access, multi-factor authentication, prompt patching and a process for notifying you about security incidents that affect your service.
Backups and recovery
“Backup included” is not enough. Record what is backed up, how often, where copies are held, how long they are retained and how recovery is tested. Set realistic recovery objectives for important systems.
Reporting and evidence
Reports should help you govern the service, not merely count tickets. Useful evidence includes patch status, backup results, unresolved risks, asset changes, recurring incidents and agreed improvement actions.
Exit arrangements
Define how documentation, credentials, domains, licences and customer data will be returned. Confirm deletion procedures and transition support. You should not discover at the end that critical accounts belong to the provider.
Shared responsibility: who owns what?
| Responsibility | Typical MSP role | Typical customer role |
|---|---|---|
| Monitoring and patching | Operate tools, review alerts, deploy agreed updates and report exceptions | Maintain supported systems and approve disruptive changes |
| Joiners and leavers | Create, change and revoke access from authorised requests | Send accurate requests early and confirm employment status |
| Security | Configure agreed controls and respond to technical alerts | Set business policy, train staff and accept or remediate risk |
| Backups | Run and monitor the agreed backup service | Define critical data and acceptable recovery time |
| Procurement | Recommend compatible, supportable options | Approve budgets and purchasing decisions |
What happens during MSP onboarding?
- Discovery: map people, devices, sites, domains, cloud services, suppliers and known risks.
- Access handover: establish named, protected administrative accounts rather than sharing old credentials.
- Tool deployment: install monitoring, support and security agents with documented privacy and operational controls.
- Baseline: record assets, patch status, backup coverage, licences and configuration.
- Stabilisation: fix urgent issues, remove obsolete access and agree a prioritised improvement plan.
- Service launch: tell staff how to obtain help, what hours apply and how incidents are prioritised.
- Review: confirm the baseline, open risks, service measures and next actions with management.
A provider promising an instant takeover without discovery should prompt questions. Good onboarding reduces hidden assumptions before they become incidents.
Ten questions to ask a prospective MSP
- Which parts of our environment will you manage, and what is excluded?
- Who owns our domains, tenants, licences, documentation and administrator accounts?
- How do you secure privileged access and your own staff devices?
- How quickly will you tell us about a security incident affecting our service?
- Which patch, backup and monitoring reports will we receive?
- How are urgent incidents escalated outside normal hours?
- Which work is included, and what triggers a separate project charge?
- How do you cover staff absence and specialist escalation?
- Can you support a transition to another provider at contract end?
- Can we speak to a customer with a similar size and technology profile?
When is a small business ready for an MSP?
Typical signals include repeated IT interruptions, inconsistent onboarding, unclear admin ownership, missed updates, untested backups, growing compliance pressure, or a founder becoming the unofficial helpdesk. An MSP can also help before a growth phase, office move, cloud migration or cyber-insurance renewal.
The best time to choose one is before a crisis. You can then compare providers, document ownership and plan changes without negotiating during an outage.
Frequently asked questions
Does an MSP replace all internal IT?
No. The customer still owns business decisions, risk acceptance, budgets and staff policy. Many organisations retain an internal technology owner and use the MSP for operations and specialist depth.
Is an MSP responsible for cybersecurity?
Only for the controls and activities defined in the agreement. Cybersecurity is shared: the MSP can configure and monitor technology, while leadership must approve policy, train people and act on risks.
Can I change MSP later?
Yes, but transition is easier when you own your domains, accounts and licences and the contract requires usable documentation and exit assistance.
Talk through your current setup
ACA Tech Solutions provides managed IT support, cloud administration, websites and managed servers for UK SMEs. If you want a clear view of risks and priorities before choosing a plan, book our free IT health check or contact the team.
