Short answer: For a 10 to 50 person business, a managed IT plan should cover day-to-day help desk support with written response times, monitoring and patching of computers and servers, a security baseline (multifactor authentication, endpoint protection, email filtering and a managed firewall), backups that are actually test-restored, Microsoft 365 administration, onboarding and offboarding, vendor coordination, an up-to-date asset inventory and documentation, and regular strategy reviews. Projects and new hardware are usually billed separately. The contract should spell out exactly which of these are included, the response targets and how you leave.
Two providers can both say "managed IT" and deliver very different things. Use the checklist below to compare proposals line by line, and to check what your current plan really covers.
What should be on the checklist?
| Area | What it should include | Question to ask |
|---|---|---|
| Help desk | Phone, email and portal support for every user, remote fixes first, on-site visits when needed | What are the response targets, and are on-site visits included? |
| Monitoring and patching | Automated monitoring of computers, servers and network gear; scheduled operating system and app updates | How do you handle a patch that breaks something? |
| Security baseline | MFA, endpoint protection, email filtering, managed firewall, admin account control | Which security tools are in the monthly price? |
| Backup and recovery | Backups of servers, key computers and Microsoft 365, with regular restore tests | When was the last test restore, and can we see the result? |
| Microsoft 365 | User accounts, licenses, mailbox and sharing settings, security settings | Who owns the admin accounts? |
| People changes | New hire setup and departing employee lockout, on a checklist | How much notice do you need? |
| Vendors | Working with your internet provider, phone provider, copier company and software vendors | Will you call the vendor, or do we? |
| Inventory and documentation | List of every device, license, warranty and network setting | Do we get a copy, and is it ours if we leave? |
| Strategy | Scheduled reviews, budget planning, replacement schedule | How often do we meet, and with whom? |
What should help desk support look like?
Your staff should have one simple way to ask for help and a clear idea of how fast someone will respond. Look for:
- Unlimited or clearly defined support. Some plans cover unlimited requests, others cap hours. Know which one you're buying.
- Written response times by priority. "Everyone is down" should get a faster response than "my second monitor flickers." The contract should say what each priority level means.
- Remote first, on-site when it matters. A good help desk resolves many issues remotely, quickly, before a technician has to drive out. Ask whether on-site visits are included or billed hourly.
- Business hours and after-hours coverage. If you run evenings or weekends, ask what after-hours support costs.
What does monitoring and patching cover?
Monitoring software watches your computers, servers and network equipment for warning signs: failing drives, full disks, backups that didn't run, devices that dropped offline. Patching keeps Windows, macOS, Microsoft Office, browsers and common apps updated on a schedule.
CISA, the federal cybersecurity agency, lists keeping business software updated as one of its core steps for small businesses, along with inventorying hardware and software so you know which outdated or unsupported items need attention. That second part matters right now: Microsoft ended support for Windows 10 on October 14, 2025, so any machine still running it needs a plan.
Which security basics should be included?
A 10 to 50 person business doesn't need an enterprise security department, but the plan should cover a solid baseline:
- Multifactor authentication (MFA) on email, Microsoft 365, remote access and admin accounts. CISA recommends requiring MFA for small businesses.
- Endpoint protection on every computer and server, managed centrally so someone sees the alerts.
- Email filtering for phishing, malware and spoofed messages, plus some form of staff phishing awareness.
- A managed firewall with current firmware, a reviewed rule set and secure remote access.
- Admin account control: staff don't use admin rights for daily work, and admin access is limited and documented.
Ask exactly which security tools are included in the monthly price and which are add-ons. Advanced services such as round-the-clock security operations or compliance audits are often priced separately.
How should backup and recovery be handled?
The plan should name what is backed up (servers, key computers, Microsoft 365 email, OneDrive and SharePoint, line-of-business data), how often and how long copies are kept. CISA's ransomware guidance recommends offline, encrypted backups of critical data and regularly testing that backups can actually be restored.
The test is the part most often skipped. Ask for a restore test on a schedule and a short written result each time. If Microsoft 365 is your main system, also ask whether a separate Microsoft 365 backup is included, since Microsoft's built-in retention is limited.
What about Microsoft 365, new hires and departures?
Microsoft 365 administration should be part of the plan: adding and removing users, assigning licenses, managing shared mailboxes and Teams, and keeping security settings in place. Make sure your business, not the provider, owns the global admin account and the tenant.
New hires should get a ready computer, accounts and access on day one. Departing employees should lose access the same day, with their email and files handed off to a manager. Both should run from a written checklist. Our employee offboarding IT checklist shows what that looks like.
Does managed IT include dealing with other vendors?
It should. One of the biggest time savers for an office manager is having IT call the internet provider when the connection drops, work with the phone provider, and talk to the software vendor behind your scheduling, accounting or practice management system. Confirm which vendors are covered and whether the provider will open tickets on your behalf.
Why do inventory and documentation matter?
You should be able to get a current list of every computer, server, network device, license and warranty, plus network diagrams, passwords stored securely and notes on how things are set up. That documentation keeps support fast, makes budgeting possible and protects you if you ever change providers. The contract should say the documentation belongs to you.
What's usually not included?
Most monthly plans cover keeping what you have running and secure. These are usually quoted separately:
- Projects: office moves, server replacements, Microsoft 365 migrations, new network builds
- Hardware and software purchases: computers, servers, firewalls, licenses
- Cabling and electrical work
- Support for personal devices or home equipment
- Advanced security or compliance services beyond the baseline
- After-hours work that isn't an emergency, depending on the plan
None of that is unusual. The problem is finding out after the fact. Ask for the out-of-scope list in writing.
What should you look for in the contract?
- Scope: a clear list of included services, devices and users, and what triggers extra charges.
- Service levels (SLAs): response targets by priority, support hours and how they're measured and reported.
- Pricing changes: how adding or removing users changes the bill, and whether rates can rise mid-term.
- Term and exit: length of the agreement, notice period and any early termination fee.
- Offboarding the provider: a commitment to hand over admin credentials, documentation and data, and to cooperate with a new provider during the transition.
- Ownership: your accounts, domain, Microsoft 365 tenant and data stay in your name.
How is this different from cost and break-fix?
This checklist is about what's inside a plan. If you're still deciding how to pay for IT, our guide to managed IT vs. break-fix compares the two models. If you're budgeting, how much managed IT services cost covers typical pricing structures and what drives the monthly number.
FAQ
Is help desk support unlimited in most managed IT plans?
Many plans include unlimited remote support for covered users and devices, but some cap hours or bill on-site visits separately. Read the scope section before you sign.
Should backups be included in the monthly price?
Often they are, at least for servers and Microsoft 365, though storage amounts and retention vary. Either way, make sure restore testing is part of the service.
Who should own our Microsoft 365 admin account?
Your business should. The provider can have its own admin access, but the tenant and the top-level admin account should stay in your company's name.
Are new computers part of managed IT?
Setup and support of new computers usually are. The hardware itself is usually a separate purchase.
See what a full plan covers
TechCore provides managed IT services for small businesses in Nashville, Middle Tennessee and Chattanooga, with a help desk and on-site support when it's needed. Request a free IT assessment and we'll review what your current setup covers, where the gaps are and what a plan would include for your team.
