What Is Included in Managed IT Services?
A checklist of help desk hours, monitoring, patching, security, backup testing, Microsoft 365, and reporting.
Managed IT services are a monthly agreement to look after a defined set of technology. The name is used loosely. Two proposals can both say "fully managed" and cover different work. This checklist is the list to mark up before you sign. It uses ordinary service descriptions: help desk, monitoring, patching, security, backup, Microsoft 365, and reporting. It does not set a price.
A useful agreement answers three things for each row. Is the work included in the flat monthly rate? Is it available as extra project work? Or is it not offered? If the proposal skips a row, ask. Silence is how backup testing and after-hours support turn into surprise invoices. Read what managed IT services are for the longer definition, and how flat rates work for the cost drivers.
How to use the checklist
Print the table or copy it into the proposal you are comparing. Write "included", "extra", or "not offered" beside each row. Then ask the question in the last column out loud. You are listening for a specific answer, not a slogan. "We take care of everything" is not an answer. "Help desk is 8:00 AM to 6:00 PM on weekdays, and a P1 after those hours uses the on-call number" is an answer.
Group 4 Networks, the publisher of this guide, works to a 15-minute P1 response target with 24/7 coverage including weekends and holidays. That is one example of a response commitment. Your provider may describe a different target. Write the target next to the help desk row so you can compare it later. A target is how quickly someone responds. It is not a promise that the fault is fixed in the same window.
Firms of about 15 to 75 users, without a full internal IT team, are the usual fit for this kind of scope. Smaller teams may only need a few of the rows. Larger teams may already employ someone who owns identity and still want a provider for monitoring and after-hours coverage. The checklist still applies. The mix of included and extra will differ.
Checklist
| Service area | What good looks like | Question to ask |
|---|---|---|
| Help desk | A single way to ask for help, with hours written down and a priority list so an outage is not queued behind a printer question. | What are the help desk hours, and how do we reach someone after those hours? |
| Monitoring | Someone sees alerts for the servers, firewall, backup jobs, and internet connection you listed, and a ticket is opened when an alert matters. | Which devices are monitored, and what happens when an alert fires? |
| Patching | Supported systems receive updates on a schedule you can live with, and exceptions are written down. | Which systems are patched automatically, and which need a maintenance window? |
| Security | Endpoint protection, mail filtering, and multi-factor authentication are in the monthly scope, with someone to call if an account looks wrong. | Which security tools are included, and which are a separate project? |
| Backup and restore testing | The systems you named are copied on a schedule, the copy is not only on the same disks, and a restore has been tried. | When did you last restore a file from our backup, and how long did it take? |
| Microsoft 365 | Mailboxes, shared mail, and account changes for starters and leavers are administered as part of the monthly service. | Are new accounts and leavers included, or are they billed one by one? |
| Reporting | A short monthly note covers recurring tickets, failed backups, patches that did not apply, and any priority incident. | Can we see a sample report before we sign? |
Help desk hours
The help desk is the front door. Good looks like one phone number or one portal, a written definition of priorities, and a named way to escalate when the business is stopped. Ask whether password resets, new starters, and leavers are included. Those three tasks are where a "managed" plan either feels real or turns back into hourly billing.
Also ask what happens on a weekend. Some agreements cover monitoring all week and the help desk only on weekdays. That can be a fair scope if it is written down. It is a poor surprise on a Saturday.
Monitoring and patching
Monitoring should name the devices. A firewall, a server, the backup jobs, and the office internet connection are the usual minimum. An alert that nobody sees is not a service. Patching should name the systems and the window. A laptop fleet and a line of business server do not have to follow the same schedule, but both need an owner.
Ask which systems are excluded. Exclusions are normal. An unwritten exclusion is how a machine stays unpatched for a year.
Security, backup, and Microsoft 365
Security in a monthly plan is usually endpoint protection, mail filtering, and multi-factor authentication, plus someone to help when an account is suspected. A full incident investigation or a new security product rollout may be extra. Ask which is which.
Backup should name the systems, the retention, and where the copy lives. The question that matters is the last successful restore, not the last successful job. Microsoft 365 administration should include shared mailboxes and the starter and leaver process if your staff live in mail and files all day. Licensing questions, a tenant-to-tenant move, and a new intranet are often projects. Mark them as extra if that is the answer.
Reporting and what sits outside the fee
Reporting is how you tell whether the rows above happened. A short note each month is enough: recurring tickets, failed backups, patches that failed, and any priority incident. Ask for a sample.
Then list the work that is outside the fee on purpose. Office moves, a cloud migration, a new line of business application, and a compliance audit are common projects. Keeping them out of the monthly fee is fine. Pretending they are included, then billing them later, is the failure mode this checklist is meant to prevent.
When you have marked the table, you can compare providers on scope instead of on adjectives. If you are ready to talk to the publisher of this site, the contact page explains what happens next.
Questions people ask
What should a managed IT agreement list as included?
It should name the help desk hours, what is monitored, how patching is handled, which security tools are in scope, which systems are backed up, whether backups are tested, and how Microsoft 365 is administered. If a line is missing, ask whether it is extra or not offered.
Is backup the same as a tested restore?
No. A backup job that reports success is not the same as a restore you have tried. Ask which systems are copied, how far back you can go, and who is allowed to request a test restore.
Are projects such as a cloud move included in the monthly fee?
Usually they are not. A flat monthly rate covers the routine scope. A migration, an office move, or a new line of business system is typically a separate project. Ask for that split in writing.
What response target should I ask about?
Ask how priorities are defined and what the first-response target is for a priority incident. Group 4 Networks works to a 15-minute P1 response target, with 24/7 coverage including weekends and holidays. A target is a response commitment, not a promise that every fault is fixed in that window.