Twelve questions to ask an MSP before you sign

Managed services proposals are difficult to compare because the differences that matter are rarely in the document. Two providers quote a similar price per seat for what reads like a similar service, and the gap between them only becomes visible eighteen months later, usually during an incident.

These twelve questions surface the difference early. Ask them verbally, in a meeting, and pay as much attention to how quickly the answer arrives as to its content.

On capability

1. Walk me through your last security incident.

Not a case study — a specific incident, with a timeline. Detection to containment to eradication to notification. Any provider operating at reasonable scale has had one, and a provider claiming otherwise is either very new or not counting. What you are listening for is whether they have a process or a story.

2. When did you last perform a full restore test, and how long did it take?

Backup success reports are not restore tests. Ask for the measured recovery time from an actual test, on an actual client system. If the answer is a target rather than a measured result, it has never been tested.

3. What is your patch compliance percentage across your client base?

A provider who measures this will know it, and will usually volunteer that it is imperfect. A provider who does not measure it will describe their process instead. Note the difference between the question you asked and the question answered.

4. Who answers the phone at 2am, and where are they?

“24/7 support” covers everything from a rostered team to a single engineer with call diversion. Ask specifically: rostered or on-call, onshore or offshore, and does that person have permission to isolate a machine without waking somebody up first.

On commercials

5. What is your margin on hardware and licences?

Everyone has one and it is entirely legitimate. The question tests transparency. A provider who states a percentage without hesitation is telling you something useful. A provider who says pricing is “highly competitive” is telling you something else.

6. What is explicitly out of scope?

The most important question in the list. Every managed service has boundaries. Ask for them verbally and then check they match the schedule in the agreement. Providers who describe their service as “fully inclusive” without naming exclusions have exclusions you will discover on an invoice.

7. What does it cost to leave, and what do we get?

Notice period, exit assistance rate, and precisely what is handed over: documentation, tenant administrative access, asset register, credentials. If exit assistance is not priced in the agreement, it will be priced at your least convenient moment.

8. Are our tenants and licences in our name?

They should be. Some providers hold licences in their own tenant and resell you seats, which makes leaving considerably harder and occasionally makes it impossible to take your data with you in a usable form. This is a yes or no question and the answer should be immediate.

On accountability

9. Show me a monthly report from a real client, redacted.

The single most revealing request in this list. You will learn what they measure, whether anything is ever red, and whether the report is written for a technical reader or for reassurance. A report where everything has been green for six months is not a report.

10. What do you do when you miss an SLA target?

Listen for whether it appears in the client's report automatically, or whether it is raised only if the client notices. The former is a process. The latter is a hope.

11. What have you told a client recently that they did not want to hear?

An unusual question, and the pause before the answer is informative. Every provider doing this work properly has recently told a client that a system is past end of life, that a project is not viable at that budget, or that a preferred product is the wrong choice. A provider who cannot think of an example either has unusually agreeable clients or does not raise these things.

12. Who specifically will work on our account, and what else are they responsible for?

The senior people in the room during the sales process are frequently not the people who will do the work. That is normal — but you should know it before you sign, and you should meet whoever it actually is.

Four answers that should end the conversation

• “We guarantee you won't be breached.” Nobody can, and a provider willing to say it will be equally relaxed about other claims.
• “You don't need backup, it's all in the cloud.” Microsoft's own shared responsibility model says otherwise. This answer indicates a provider who has not read it.
• “We can start Monday.” Without an assessment, they are agreeing to take on an environment they have not seen, at a price they cannot yet justify. It will be repriced later, or corners will be cut.
• “Our contract is standard, everyone signs it.” Possibly true. It is also the answer given when a provider would rather you did not read the schedules, which is exactly where scope and exit terms live.

One thing to do before any of this

Get an independent assessment of your current environment first — ideally from somebody who is not bidding for the managed services contract. Without it, every proposal you receive is priced against assumptions, and you have no basis for comparing them beyond the number at the bottom.

It also means that when you do appoint someone, the first thing they tell you can be checked against something.