What "managed IT" actually means — and what it doesn't

Walk into a room of business owners and ask what "managed IT" means. You'll get a different answer every time. Some imagine an offsite helpdesk that fixes things when they break. Others picture a person who shows up on a flatbed with new servers. Most are at least partially right — and partially wrong.

"Managed IT" isn't a feature; it's an operating model. The vendor takes responsibility for the day-to-day operation of your IT environment in exchange for a predictable monthly fee. The catch is that there's a wide range of how seriously different vendors take that responsibility.

What's actually included

A real managed-IT engagement covers four layers — and any vendor pitching you something less is selling a subset:

• Workstation and server management. Imaging, patching, asset tracking, monitoring, lifecycle. Every device you own is in a system that knows what it is and tells someone when it's drifting.
• Identity and access. Microsoft 365 admin, conditional access, MFA, onboarding and offboarding processes. The "who can do what" layer that, when wrong, becomes a breach.
• Security operations. EDR, MDR, backup, incident response. Not just "antivirus" — actual continuous detection and response.
• Helpdesk. A real person who responds when something stops working. The part most people think of as "IT support" — but only one of the four layers.

What it doesn't mean

Managed IT does not mean "we charge you a flat fee and ignore your environment until you call." A monthly retainer should buy proactive monitoring, regular reporting, and a relationship — not a refusal to pick up the phone.

It also doesn't mean "we replace your CIO." Managed-IT vendors can advise on strategy, but the responsibility for technology decisions stays with you. A good vendor will help you make those decisions — not make them in your name.

If the only time you hear from your MSP is when an invoice is due, you're not getting managed IT. You're getting break-fix with a monthly subscription.

Questions worth asking before you sign

1. What's the response-time commitment, and how do you measure it?
2. Who actually answers the phone? A queue, or a named person?
3. What security tools are included by default — and what costs extra?
4. How often will I see a written report on what you've been doing?
5. What happens if I'm unhappy six months in? What's the exit?

Any vendor who can't answer those clearly is either inexperienced or hoping you don't ask. Pick the one who answers them without flinching.