What Is a Managed Service Provider (MSP)? A Plain-English Answer

A managed service provider (MSP) is an outside IT company that takes ongoing, contracted responsibility for a business’s technology, supporting its people and maintaining and securing its systems for a recurring monthly fee rather than a bill per repair. VJNetworks is one, for businesses with 5 to 60 employees across the Tri-State area.

The label covers a lot of very different companies, though. So what does one actually do? The useful answer is what an MSP takes on, what it leaves out, and how it compares with the other ways a small business gets its IT done.

My own first assignment here was a block of hours in one building. I was hired, as I still put it, “to basically work half the week, like a good 20, 25 hours a week, at a private school. Because they needed so much.”

One way to buy IT. You pay for a person’s time, inside your walls. An MSP sells something else. Responsibility for the whole environment, written into an agreement, and mostly delivered from somewhere other than your office.

What a Managed Service Provider Is

An MSP manages part or all of another organization’s IT on an ongoing basis under a contract, instead of showing up one incident at a time. The Cybersecurity and Infrastructure Security Agency, writing with its counterparts in four other countries, defines MSPs as “entities that deliver, operate, or manage ICT services and functions for their customers via a contractual arrangement, such as a service level agreement.” A contract, in other words.

The Canadian Centre for Cyber Security gets more practical. Its guidance describes an MSP as a company that remotely manages IT infrastructure and end-user systems for a client, and, citing the MSP Alliance, says MSPs typically run a help desk, monitor and manage most of the client’s systems remotely, maintain those systems proactively, and use a predictable billing model so the client knows its regular IT cost ahead of time.

Keep that last item in mind. It comes back.

How VJNetworks packages all of this as a service, with pricing and onboarding, lives on our managed IT services page. This post stays on the general question of what an MSP is.

The “remotely” part is newer than most people think. We “started deploying remote access tools about 20 years ago, like 2006, 2007.” Huge shift. Before that, support meant calling someone, waiting twenty or thirty minutes for them to walk over to your desk, and then standing in the corner while they took your chair and worked on your computer. Now most fixes start with a shared screen a few minutes after the callback. Does anyone still visit? Yes, when something physical has actually failed.

What Sits Inside a Typical MSP Agreement

Every MSP draws its line in a different place, which is why the agreement matters far more than the acronym on the website. Here is what sits inside ours, in roughly the order I would walk a prospect through it.

• Unlimited support. No meter running on the help desk. Most of it is ordinary work. Passwords come first, then printers, then something lost, then Outlook and QuickBooks.
• Endpoint security on the computers we manage, plus monitoring of those endpoints and advice on what turns up.
• Management and security for Microsoft 365 or Google Workspace, whichever one the business runs.
• Line-of-business platforms where they matter. The tax program at an accounting practice, say, or the design software at an engineering office.
• Network security and network maintenance, Wi-Fi included.
• Repairs.
• Help meeting compliance goals. We put the controls in place. We don’t audit you or certify you.
• A hand in HR’s onboarding and offboarding, so accounts open on a new hire’s first day and close on a departing employee’s last day.
• vCIO strategy and roadmapping, the planning layer that decides what you buy next year and why.

I’ll admit that list came out of a conversation, not a brochure. When I first ran through it, I said I should check our website, because it “probably enumerates things a lot better than my brain can right now.” We checked. Our services page names the same pieces and adds backup, patch management, vendor management, and hardware lifecycle planning.

Response time belongs in the agreement too. Ours is short. My team responds within 15 minutes during business hours. I would rather under-promise on that number than the other way around. “15 minutes is what we say, but a lot of times it’s even quicker than that.”

What an MSP Leaves Out, and Why You Should Hear It First

The question prospects ask me most has nothing to do with technology. It’s about money. They want to know what will generate an extra charge. Underneath it is a fear of signing and then getting nickel-and-dimed for a year. Fair fear.

So the answer should be boring and specific. What’s not in it? Materials, hardware, and toner are not in our agreement. A new laptop is a purchase. So is a replacement firewall. Software licensing beyond what we manage under contract is its own line too.

“We like to spell everything out. Just for that exact reason, there’s no feeling of being nickel and dimed or surprise charged. Nobody likes that.”

That’s half of it. Approval is the other half. Anything outside the agreement gets discussed with you before anyone does the work, and the way I say it on that first call is simple. “You’re not gonna get a surprise bill for something that you didn’t approve of.”

CISA arrives at the same habit from the security side. Its advisory asks MSPs to give “clear explanations of the services the customer is purchasing, services the customer is not purchasing,” and tells customers to cover any security requirements that fall outside the contract. Different motive. Same discipline.

Our own line, side by side.

MSP vs Break-Fix, Fairly Compared

Break-fix is the older arrangement. Something breaks, you call a technician, and you pay for the hours and the parts. No monthly fee at all. Simple.

A lot of MSP marketing treats that as a mistake. I don’t. We have a break-fix client right now who buys quality systems, opens a ticket when something needs attention, gets the same service a contract client gets, and pays nothing month to month. It works for them.

Why? Quality equipment lasts, and stable applications don’t generate much work. On break-fix you hold on to the money every month and spend it when there’s actually something to fix.

Where break-fix goes wrong is rarely the billing model. It’s the client. The one who won’t spend when the technician says a machine needs replacing, who asks for the cheaper way every single time, and who ends up paying for the same temporary fix over and over. That pattern costs more over the years whichever way the invoices arrive.

An MSP starts to make more sense once the business can’t afford to find out about problems only after they break, or once the owners want a number for regular IT they can budget against. If you want the cost side worked through, we did that in managed IT vs break-fix.

Co-Managed IT, an MSP Next to Your IT Person

Some businesses already employ an IT person, and a good one. They almost never want to replace that person. They want help behind them. Backup, mostly.

That’s co-managed IT. The MSP takes a defined slice of the work and the internal person keeps the rest, and the scope gets built around what the client actually asks for. One shape we offer is infrastructure and cloud only, meaning network equipment, on-premises and Azure servers, the Microsoft 365 tenant, backups, and patches, with no workstation or user support at all. If the internal person wants hourly desktop help for the days they’re out, that gets disclosed up front as a separate option instead of quietly bundled in.

The usual trigger is plain. One IT person, no backup. When that person takes a vacation, the coverage leaves with them, while an MSP has the rest of its team behind the same agreement. It adds to what you have. It doesn’t replace it. The trade-offs between the two models are laid out in co-managed vs fully managed IT.

MSP vs MSSP

The extra S? Security. A managed security service provider sells security operations as its main product, watching security alerts and logs, investigating what they turn up, and responding to threats, and some run a dedicated security operations center for that work. An MSSP generally won’t reset a password or sort out the printer. Not its job.

An MSP runs the whole IT environment, and security is one layer inside it. In our agreement that layer is endpoint security with monitoring and advice, sitting next to the help desk, the network, and Microsoft 365. Some larger organizations hire both kinds of provider.

For a 25-person insurance agency or a 40-person manufacturer, the acronym matters less than one practical question. Is the security work you need written into somebody’s contract? Ask that first. CISA’s advice holds whichever provider you pick. Understand exactly which security services you’re buying, and cover whatever sits outside the contract.

Five Ways a Small Business Gets IT Done

Side by side, the arrangements look like this. None is wrong for everyone.

Who an MSP Fits, and Who It Doesn’t

An MSP suits a business that runs on its technology but doesn’t want to staff a department to look after it. For us that means accounting practices, architecture and engineering offices, insurance agencies, manufacturers, and contractors, most of them between 5 and 60 employees, across Rockland, Westchester, and Bergen. We’ve been doing this for over 20 years, and our client retention sits at 97%.

Who doesn’t fit? It’s a weaker fit for a company that wants to buy hours and direct every task itself. Same for a company with a strong internal team that only needs one project done. Nothing wrong with either. They just aren’t buying what an MSP sells.

Different question entirely. If you’re already past “what is it” and on to “which one,” our MSP buyer’s guide walks through choosing a provider, stage by stage.

Questions People Ask About MSPs