Coverage varies by tier and provider, but a quality managed IT agreement at the mid-market tier typically includes:
Core support (every tier)
- Unlimited remote helpdesk during business hours
- On-site support for issues that can't be resolved remotely
- OS and application patch management
- Endpoint protection (antivirus / next-gen AV)
- Microsoft 365 administration (user provisioning, mailbox management, license management)
- Cloud backup of core data
- Monthly reporting on health, tickets, and trends
Mid-tier additions
- 24/7 monitoring and alerting
- Endpoint Detection and Response (EDR) instead of basic AV
- Security awareness training + phishing simulations
- Microsoft 365 backup (Microsoft does not back up your data)
- DNS-layer security and content filtering
- Quarterly business reviews
Premium additions
- Managed Detection and Response (MDR) with 24/7 SOC analyst response
- Application allowlisting / zero-trust endpoint controls
- Identity threat detection and response
- Dark web monitoring and credential protection
- Compliance framework readiness (HIPAA, CMMC, SOC 2, PCI)
- vCIO / fractional IT leadership and strategic planning
What's usually NOT included
Hardware purchases, third-party software licensing (M365, security tools), major project work (cloud migrations, office relocations), after-hours emergency work outside the SLA, and compliance audit fees themselves (the auditor is separate from your MSP).
Have a different question?
Talk to a real engineer — free 30-minute consultation, no pressure pitch.
Ask Maverick
615-274-9555