A managed service provider, or MSP, is an outside company that takes ongoing responsibility for some or all of your business’s technology for a recurring monthly fee. In practice that usually means a help desk for your staff, monitoring and patching of computers and servers, Microsoft 365 or Google Workspace administration, security tools and backups. The difference from calling an IT person when something breaks is the incentive: an MSP is paid the same whether or not anything goes wrong, so its job is to stop problems happening rather than to bill for fixing them.
For most small and medium businesses, an MSP is the IT department they would otherwise have to hire. This guide covers what MSPs actually do, what’s included and what usually isn’t, how they charge, how they compare with break-fix support and in-house staff, what Canada’s Cyber Centre and its allied agencies say your contract should require, and how to choose one.
What a managed service provider actually does
The word that matters is managed. A managed provider is responsible for an outcome — systems that are current, protected, backed up and documented — not only for answering the phone. Most of that work happens before anyone notices a problem, through software installed on each computer and server that reports its health and lets the provider apply updates and fix issues remotely. The industry calls it remote monitoring and management, or RMM.
A typical MSP looks after:
- A help desk for your staff. People email, call or open a ticket, and most requests are resolved remotely, often within the same conversation.
- Computers and servers. Operating system and application updates, disk encryption, health monitoring, and replacing hardware before it fails.
- Microsoft 365 or Google Workspace. Accounts, licences, mailboxes, sharing settings and security policies, plus joiners and leavers.
- Security. Endpoint protection, email filtering, multifactor authentication and the settings that close common gaps. Our small business cybersecurity checklist lists the baseline.
- Backups. Of servers and cloud data, with restores tested on a schedule rather than assumed.
- The network. Firewall, Wi-Fi and switches kept updated, monitored and documented.
- Vendors. Calling the internet provider, the copier company and your line-of-business software vendor so your staff don’t have to.
- Planning. Regular reviews of what needs replacing, what it will cost and what’s changed in the business.
That last item is what separates a provider that keeps things running from one that improves them. If nobody has raised budget or planning with you in a year, you have a support contract, not a managed service.
What’s usually included, and what isn’t
There’s no standard definition of a managed IT plan, so the useful question is always what a specific quote covers. This is the typical split.
| Item | Usually | Notes |
|---|---|---|
| Help desk for covered users | Included | Often business hours; after-hours cover may be a higher tier or billed separately |
| Monitoring and patching | Included | Ask for a monthly report showing patch status, not just a statement that it happens |
| Endpoint security and email filtering | Included or add-on | Higher tiers often add phishing simulation and security awareness training |
| Backup | Included or add-on | Storage can be billed by volume; restore testing should be in writing |
| Microsoft 365 or Google Workspace licences | Separate | Billed by the vendor or resold by the provider; either way, the subscriptions should be yours |
| Hardware | Separate | Some providers quote and source it; you should own it |
| Projects | Separate | Office moves, server replacements and migrations are normally quoted one at a time |
| On-site visits | Varies | Included on some plans, billed hourly on remote-only plans |
| Onboarding | One-time fee | Covers discovery, documentation and installing the provider’s tools |
How MSPs charge
Most managed IT pricing uses one of a few models.
- Per user, per month. The most common model. One price covers a person and the devices they use, which suits businesses where staff work across a laptop, a phone and Microsoft 365.
- Per device, per month. A price per computer and per server. Useful where several people share machines, such as a clinic’s front desk or a shop floor.
- Tiered bundles. Good, better, best plans, where higher tiers add security monitoring, on-site visits or compliance work.
- Co-managed pricing. A lower rate where your own IT person keeps part of the work.
Prices vary widely because scope does. As of September 2026, the Canadian providers we found that publish prices listed standard rates from about $85 to $275 or more per user per month, with lower rates usually covering remote, business-hours support and higher ones adding 24/7 monitoring, stronger security or on-site visits. Our guide to managed IT services cost lists those published prices and works through a budget for a 15-person office.
Expect a one-time onboarding fee as well. Approaches vary from a fixed fee quoted after an assessment to a charge equal to one month of service.
MSP vs break-fix vs an in-house IT person
| Break-fix | In-house IT person | Managed service provider | |
|---|---|---|---|
| How you pay | By the hour or incident | Salary, benefits and tools | Fixed monthly fee, plus projects |
| The provider’s incentive | More problems mean more billable hours | Keeping their own workload manageable | Fewer problems mean more margin |
| Who handles prevention | You, unless you ask and pay | Your employee, alongside everything else | The provider, as part of the fee |
| Holidays and sick days | Depends on availability | A gap unless someone covers | A team covers |
| Range of skills | Whoever answers | One person’s experience | A team’s, plus the provider’s tools |
| Knowledge of your business | Limited | Deep | Grows with documentation and regular reviews |
Break-fix can make sense for a very small business with a handful of devices and little depending on them. A full-time IT employee makes sense once there’s enough work to fill the role and enough budget to cover holidays and specialist gaps. Most businesses in between end up with an MSP, or with an MSP supporting an in-house person. Our managed IT vs break-fix guide goes deeper on the trade-offs.
MSP, MSSP and co-managed IT
Three related terms come up in quotes, and they mean different things.
- MSSP — managed security service provider. A provider that specialises in security operations: round-the-clock monitoring for threats, investigating alerts and responding to incidents. Many MSPs include security basics and partner with a security operations centre for 24/7 monitoring; an MSSP goes deeper and usually doesn’t handle day-to-day IT support.
- Co-managed IT. An MSP working alongside your own IT person. Your employee keeps ownership and knowledge of the business; the MSP adds tools, after-hours cover, security monitoring and extra hands for projects. It works when the split of responsibilities is written down.
- Virtual CIO or IT consulting. Strategy rather than support: technology roadmaps, budgets, vendor selection and project leadership. Some MSPs include it; others offer it separately. See IT consulting.
What the contract should say about security
An MSP holds the keys to every customer it manages, which makes MSPs an attractive target: compromise one provider and you may reach many businesses. In May 2022, Canada’s Cyber Centre co-authored a joint advisory with cyber security agencies in the United States, the United Kingdom, Australia and New Zealand on protecting MSPs and their customers. Its recommendations for customers translate directly into contract terms.
What the advisory says customers should secure
- A contract that states who owns each security responsibility — hardening, detection, incident response — the MSP or you.
- A defined way the MSP will tell you about a confirmed or suspected incident affecting your systems, and how quickly.
- Multifactor authentication on the services you receive and on every MSP account used to access your environment.
- MSP accounts limited to the systems the MSP manages, not placed in your internal administrator groups, and never using admin credentials shared across customers.
- Your most important logs stored for at least six months, with visibility for you into what's being logged.
- Backups that meet your recovery requirements, stored somewhere retrievable such as the cloud or a location air-gapped from your network.
- Incident response and recovery plans that are tested at regular intervals.
- Regular audits that MSP accounts are used for appropriate purposes, with accounts disabled when not in use and when a contract ends.
The Cyber Centre’s guidance on contracting with managed service providers adds two questions worth asking before you sign: which security framework the provider follows, and whether critical data is encrypted with keys you control. A provider that can answer both clearly has thought about it.
Is an MSP right for your business?
The signs that usually point to yes:
- Staff lose real time to IT problems, and the same ones keep coming back.
- Your “IT person” is an office manager or owner doing it on the side.
- Nobody can say with confidence that every computer is patched and every backup restores.
- An insurer or a client has sent a security questionnaire you couldn’t answer.
- You’ve added staff, a second location or remote workers, and the setup hasn’t kept up.
And the signs it may not be: a business with very few devices and little riding on them, or one with a capable internal team that would be better served by co-managed support for the gaps. If you’re weighing a server replacement or a move to the cloud at the same time, our server vs cloud cost comparison is a useful companion.
How to choose one
Give three providers the same facts — headcount, devices, servers, locations, key software and the hours you need covered — and compare their quotes line by line. Then ask the questions a quote doesn’t answer.
Questions to ask any managed service provider
- What's included, and what's billed separately? Ask for the definitions behind “unlimited.”
- Who answers when we call, and what happens when the first answer isn't working?
- What are your response targets, and how do you report on them?
- What security is built in, and what's an add-on?
- Do admin accounts, our domain, licences and documentation stay in our name?
- What documentation will we receive, and how often is it updated?
- What are the notice period and exit terms, and what do you hand over when we leave?
- Can we speak to a client of a similar size?
Pay attention to how the onboarding is described. A provider that wants to document your systems before promising anything is telling you how they’ll work.
YVR Technology is a managed service provider for small and medium businesses across Greater Vancouver and the Fraser Valley, including Chilliwack, Surrey and Burnaby, and supports businesses on Vancouver Island and in the BC Interior remote-first. See managed IT services for what’s included, or get in touch to talk it through.