What is a managed service provider (MSP)?

Managed service provider, defined

A managed service provider is a company that takes ongoing responsibility for running part or all of another organization's IT — monitoring, patching, backups, security, and support — for a fixed recurring fee under a service-level agreement. The term is almost always shortened to MSP. Three things separate it from every other kind of IT supplier: the work is continuous rather than project-based, the provider is accountable for an outcome rather than for hours worked, and the commercial relationship is a subscription rather than an invoice per incident.

The model exists because most organizations depend completely on technology without wanting to be technology companies. Running IT properly means covering networks, cloud, endpoints, identity, backup, security monitoring, and a help desk at once, around the clock. Staffing all of that internally takes more people than any single discipline's workload justifies, which is why in-house teams end up simultaneously overloaded and under-specialized. An MSP spreads specialists and their tooling across many clients, so each client reaches capability it could never afford to own outright.

What you are actually buying is accountability with evidence behind it. A serious MSP agrees measurable targets up front — how fast it acknowledges an incident, how fast it resolves each severity, what uptime it commits to — then reports against them on a fixed cadence. That reporting is the line between an MSP and an outsourced pair of hands. If nobody can show you last month's SLA performance, patch status, and backup tests in writing, you have bought labor, not a managed service.

What a managed service provider actually does

The visible half of the job is reactive. Users raise tickets, alerts fire, something breaks, and the service desk triages by severity and works the issue until it closes. Severity definitions matter more than most buyers expect: a good contract states in plain language what counts as critical — a site down, a security incident, a blocked payroll run — and what waits until business hours, so nobody negotiates priority mid-outage.

The half that decides whether the service was worth paying for is proactive, and it is invisible when it works. Patches go on inside agreed maintenance windows. Backups are not merely scheduled but restored on a test schedule, because an untested backup is a hypothesis. Certificates and licenses are renewed before they expire. Cloud spend is reviewed before it becomes a finance problem. Security baselines — MFA, endpoint protection, privileged-access reviews, log retention — are checked rather than assumed.

Underneath both halves sits tooling you rarely see but always pay for. MSPs run remote monitoring and management (RMM) agents on managed devices to collect health data and push updates, plus a professional services automation (PSA) platform handling ticketing, SLA timers, asset inventory, and billing. Ask to see both, and ask for the asset register they keep for an existing client. Documentation quality predicts year two better than any sales deck.

MSP, MSSP, break-fix, and in-house: what the labels mean

The most common confusion is between an MSP and an MSSP. A managed security service provider specializes in security operations — threat detection and monitoring, SIEM, vulnerability management, incident response, and compliance reporting — rather than general IT operations. An MSP keeps the estate running and applies security hygiene as part of that job; an MSSP watches for adversaries and responds when it finds them. The two overlap at the edges, and many organizations buy both.

Break-fix is the older model an MSP replaced. You call when something breaks, an engineer bills by the hour, and nobody is paid to prevent the next failure — the supplier's revenue rises when your systems fail, which is a hard incentive to defend. Break-fix still suits genuinely occasional, low-dependency IT. It stops making sense the moment downtime costs real money, because the model contains no mechanism for reducing how often it happens.

In-house is the fourth option and the one most often compared on the wrong axis. The honest comparison is not one salary against a monthly fee; it is the full cost of an internal team — salaries, benefits, recruitment, training, tooling, and the redundancy genuine out-of-hours coverage requires — against a contracted fee for the same scope and SLA. Most organizations land on a hybrid: their own people own strategy, and an MSP runs the always-on operational layer underneath.

How managed service providers price the work

Four pricing models cover most of the market. Per-user pricing charges a flat fee for each person supported and covers every device that person uses. Per-device pricing charges per managed endpoint — workstation, server, firewall, switch — and forecasts better in environments full of shared or unattended hardware. Tiered packages bundle features into levels such as basic, standard, and advanced. À-la-carte pricing bills each service separately.

The model matters far less than what falls outside it. Ask in writing which work sits inside the recurring fee and which is billed as a project: migrations, new-site build-outs, major version upgrades, security incident response, and after-hours work are the usual exclusions. Ask whether third-party licenses pass through at cost, and what happens to the fee when headcount changes mid-term. A low monthly rate with everything meaningful classed as a project is not a low rate.