A managed I.T. agreement decides what happens on your worst day: the server is down, an account is compromised or a key staff member cannot work. The sales conversation is about what the provider can do. The agreement is about what they must do. Read it with that in mind. This is a plain-English guide to the clauses that matter, not legal advice. For anything you are unsure about, check with your lawyer or business adviser before you sign.
1. Response times versus resolution times
These two terms are often blurred in conversation and kept separate in the contract.
- Response time is how quickly someone acknowledges or starts working on your request.
- Resolution time is how quickly the problem is fixed.
Most agreements commit to response times only. That can be fine, as long as you know it. Check:
- Whether the times are written down, and whether they are measured in business hours or clock hours.
- What counts as a "critical" issue, and who decides.
- Whether an automated email reply counts as a response.
- What happens outside business hours, and whether after-hours support costs extra.
- What the provider owes you if they repeatedly miss the stated times.
2. What is included and what costs extra
"Unlimited support" can mean many things. Ask for a written list of what is included and what is billed separately. Common grey areas:
- On-site visits versus remote support.
- Setting up new staff and removing departing staff.
- Projects, such as moving to a new server, office or system.
- Support for line-of-business software and liaising with its vendor.
- Printers, phones and home office equipment.
- Recovery work after a security incident.
- Hardware and software licences, which are usually separate from the service fee.
If a regular task is billed as extra, estimate how often you will need it. A cheap base fee with frequent extras can cost more than an inclusive plan.
3. Contract length and exit terms
Look for the minimum term, the notice period, automatic renewal and any early exit fee. Then read what the provider must do when you leave. A good agreement says the provider will hand over passwords, documentation and admin access, and cooperate with your next provider, within a set period.
Watch for clauses that make leaving expensive or slow: long automatic renewals, exit fees tied to the remaining term, or a separate charge to release your own documentation. For comparison, Black Wolf has no lock-in contracts: a 30-day exit with a free handover.
4. Who owns your admin accounts and data
This clause matters more than most business owners realise. The agreement should state that:
- Your business owns its data, domain names and documentation.
- Your business holds its own administrator account in Microsoft 365 and other key systems, separate from the provider's accounts.
- Your domain is registered in your business name with your contact details.
- Licences are in your name, or the provider will transfer them on request.
Microsoft recommends assigning the Global Administrator role to fewer than five people and keeping two emergency access accounts. Ask how the provider will set this up in your tenant, and who will hold those accounts.
The Australian Signals Directorate (ASD) notes that managed service providers often have privileged access to their customers' systems. Its published questions for providers include whether they securely administer your systems, monitor activity, regularly assess for vulnerabilities and are prepared to respond to incidents. Ask each of these and get the answers in writing.
5. Backups and test restores
A backup clause should say what is backed up, how often, where it is stored, how long it is kept and how often restores are tested. ASD's small business guidance on backups recommends testing the whole backup, not just a spot check, and keeping backups protected so ordinary accounts cannot change or delete them.
Check whether Microsoft 365 email and files are included. Microsoft's built-in recycle bins and retention windows have time limits, and ASD's guidance says those built-in features are not sufficient to recover from many incidents. If backup is listed as an optional extra, treat it as essential when comparing quotes.
6. Onboarding fees and the first 90 days
Many providers charge a setup or onboarding fee. Find out what it covers: an audit, documentation, installing tools, fixing urgent security issues, or all of these. Ask what you receive at the end, such as a written report or a documented network. Also ask what happens if the relationship clearly is not working in the first few months.
7. Security inclusions
Ask the provider to list the security controls they will put in place and maintain. Useful items to look for:
- Multifactor authentication for all staff and all admin accounts.
- Endpoint protection with detection and response on every device.
- Patching of operating systems and applications, with stated timeframes.
- Email security, including SPF, DKIM and DMARC for your domain.
- Security awareness training for staff.
- Incident response: who you call, what they do and what it costs.
Before you sign: checklist
- Response times are written down, with a clear definition of "critical".
- You have a written list of inclusions and extras.
- The minimum term, notice period and exit fees are clear.
- Handover obligations on exit are in the contract.
- Your business owns its data, domain, documentation and its own admin accounts.
- Backups cover Microsoft 365 and include scheduled test restores.
- The onboarding fee has a defined scope and deliverables.
- Security controls are listed, not implied.