What does a managed IT provider actually do?
Never hired one before? Here is what a managed service provider (MSP) does day to day. Then nine questions that tell a good one from a polished pitch.
Start here
A managed IT provider runs your IT for a fixed monthly fee per person.
They keep the boring things working: backups, patching, multi-factor authentication (MFA), accounts and devices. Your team gets a real person on the phone when something breaks. When it goes properly wrong, the provider owns the outcome. Most weeks you won't notice they were there.
It isn't
Break-fix support.
A tech you call when something is broken and pay by the hour. Cheap when nothing happens; expensive when everything does. No incentive to prevent the next outage.
It isn't
One internal IT hire.
One person can do helpdesk, or security, or networking, but not all three well. A managed provider gives you a team's worth of skill for less than one senior hire.
It isn't
A security product.
Security sits in every plan, but a licence on its own does nothing. Someone has to run it, check it, and fix it when it drifts. A product alone gives you a logo on a dashboard.
What you actually buy
Every managed IT plan includes the same basics.
This is what shows up day to day once a provider is running your IT.
A helpdesk that picks up the phone.
Your staff email or call. A ticket gets logged. A real tech in Australia replies inside a defined response time. No queue, no offshore, no scripts.
Devices that set themselves up.
A new starter on Monday: we drop-ship a laptop. They sign in once and the device configures itself against your security policies in under an hour. No two-week wait, no hands-on staging at our office.
A security floor that just runs.
MFA, tested backups, patching, password manager, same-day offboarding. Already on, every plan, every client. You don't pay extra for the basics being done.
A team accountable to your outcome.
A named team that knows your environment, owns the result when something breaks, and stays involved between incidents. You are not a ticket in a shared queue.
Compared to the alternatives
Managed IT compared with break-fix and hiring your own.
Break-fix support has its place, and so does hiring your own person. Managed IT replaces neither perfectly. Find the row you care about most and the choice usually answers itself.
-
Cost shape
Break-fix
Hourly. Cheap when nothing happens, painful when it does.
Internal IT
Fixed salary plus tools. Predictable, but one person carries everything.
Managed IT
Fixed per seat per month. Knowable, no surprise invoices.
-
Coverage
Break-fix
Reactive only. Nothing happens between calls.
Internal IT
One person, business hours. Holidays and sick days hurt.
Managed IT
A team behind the inbox. Holiday and sick-day cover built in.
-
Depth of skill
Break-fix
Whatever this tech is good at. No bench.
Internal IT
One person cannot be senior at helpdesk, security, and infrastructure.
Managed IT
Specialists for each layer. The hard problems go to the right person.
-
Security floor
Break-fix
Whatever you happen to set up yourselves.
Internal IT
Depends entirely on the person and how busy they are.
Managed IT
Contractual baseline. Already on. Not optional.
-
Accountability when it breaks
Break-fix
You own the outcome.
Internal IT
Your hire owns it. They also own everything else.
Managed IT
Contracted to a defined response and resolution standard.
Two different jobs
Most first-timers need security. Few need compliance.
Security
The things that keep you from being breached.
MFA, tested backups, patching and same-day offboarding are on by default, every plan. Application control and awareness training are required everywhere too, delivered by us from Compliance up, or by a provider of your choice on the base plans.
If you want to be more secure, you're already covered.
Compliance
The things that prove your security to a third party.
The Australian Signals Directorate (ASD) Essential Eight. ISO 27001. AUSTRAC's Tranche 2 rules. APRA's CPS 234. Each one means evidence, audits and reporting. Compliance is its own service, and it isn't cheap.
If somebody external is asking, you need it. Until then, you don't.
Choosing a tier
The managed IT plans, and what each one adds.
All four sit on the same security floor. What changes is how much of the rest we take responsibility for.
Plan
Managed IT
The base plan. Helpdesk, devices, identity, patching, tested backups, and the full set of controls we require. Everything you need to stop running IT yourselves.
Read the termsPlan
Managed IT + Services
Adds phones, internet, web hosting, password manager and signature management. One bill, one provider, one point of accountability for the whole stack.
Read the termsPlan
Managed IT + Compliance
Adds the controls and the evidence trail you need to satisfy an insurer, a regulator, or a prime contractor. Security is already in the base plan; this one produces the paperwork.
Read the termsPlan
Managed IT Complete
Everything in the three plans above. The anchor tier and where most CCP clients land. Onboarding included on a three-year term.
Read the termsMost CCP clients pick Managed IT Complete. The base Managed IT plan suits businesses that already have phone, internet and hosting relationships they want to keep.
Per-seat pricing for each tier sits on the plans page. Your seat count and your tier both move the number.
The first ninety days
Your IT, ninety days into onboarding.
Onboarding is three months of work. On our standard three-year term we don't charge for it. By the end, these are in place.
-
Devices via Intune
Drop-shipped, self-provisioning, centrally enforced. New starters on Monday work from Monday.
-
Identity moves to the cloud
The dusty server in the back room that authenticates everyone goes away. Identity lives in Microsoft Entra. Access removed in seconds.
-
MFA on for everyone
Every account, every login. Phish-resistant where the platform supports it. No exceptions for executives.
-
Backups get tested
Not 'we set up a backup tool'. Restores run on a schedule. If we can't get a file back, we know before you ask.
-
Patching runs on a schedule
Patches are applied within thirty days. You stop seeing emails about updates because we've done them.
-
Same-day offboarding
We cut someone's access the day they leave. If their device doesn't come back, we wipe it remotely. No more 'still has access a week later'.
Special cases
Non-profits, multiple entities, field staff and old servers.
-
Do non-profits get cheaper Microsoft 365 licensing?
Yes. Eligible Australian not-for-profits get the first block of Microsoft 365 licences free and the rest at heavily discounted rates. The application is admin-heavy, which is why most providers never sort it out for you. Most not-for-profits we onboard arrive paying full retail. Fixing the licensing is one of the first things we do, and it usually lowers a bill you were already paying.
-
Can a managed IT provider handle multiple trading entities?
Yes. Each entity should run as its own unit: separate Microsoft 365 tenants where needed, separate documentation, separate security policies. Billing then consolidates across the group so you get volume pricing. Staff in one entity should be able to reach files in another without a second account. Anyone working across entities should be billed once.
-
Do field workers count as seats with a managed IT provider?
Only if they have a company account that touches your data. Field staff who join as guests on their own accounts are not seats. That is the common pattern for support workers and contractors. A good provider walks through your actual staff structure during scoping instead of charging for every name on the payroll.
-
What happens to my on-premise server when I move to a managed IT provider?
Usually it gets retired during onboarding. Most of what it still does can move to Microsoft 365 and Microsoft Entra: logins, file shares and business apps. That takes a single point of failure out of your back room. A good provider inspects what is running before deciding. Sometimes there is a real reason to keep something on site, and they should say so.
-
Can a managed IT provider support Google Workspace instead of Microsoft 365?
Yes, in most cases. Most Australian providers default to Microsoft 365. It puts identity, devices, email, files and voice in one stack they can manage end to end. Fewer of them run Google Workspace fluently. We support Google clients. If you are open to it, moving to Microsoft 365 during onboarding cuts the number of vendors you juggle, and usually the cost with it.
Before you sign
Common questions about choosing a managed IT provider.
- Should a managed IT provider push back when an executive wants to disable a security control?
- Yes. A provider that always does what you ask isn't protecting you. Your insurer, regulator and lawyer won't care that 'the customer requested it'. A good provider tells you why they don't recommend the change, what the risk is, and what the alternative is. If you still want to proceed, they document the exception in writing and move on.
- Do Australian managed IT providers use offshore helpdesks?
- Many do. 'Australian helpdesk' often means a chat bot answers here and your ticket goes to a contractor in another timezone overnight. By the time the answer lands, your staff have stopped trying. At CCP, every tech is employed by us and works from our Welshpool office or remotely within Australia.
- Do managed IT providers offer after-hours support?
- Most do, though the shape varies. Severity is usually the dividing line. A business-down incident or a suspected breach should reach an on-call tech straight away. Lower-severity items queue for the next business day. Anything beyond that is negotiated per client. Ask for the service level agreement (SLA) in writing.
- How hard is it to switch managed IT providers?
- Less hard than you'd think, if your current provider has documented things properly. A clean handover moves admin credentials, network diagrams, application inventories, vendor relationships and tenant ownership across to the new provider. A good provider documents on the way in and on the way out, so your next one gets the keys, not a shrug.
- What happens to my IT if my managed IT provider goes out of business?
- If your documentation is current and you own the tenant, this is inconvenient rather than catastrophic. Microsoft 365 tenants, domain names and Azure subscriptions should be registered to your business, not your provider. Ask any provider you are evaluating whose name is on the tenant. The answer matters.
- Do managed IT providers assign a dedicated technician?
- Usually a named account team rather than one technician. The same handful of people will be replying most of the time, which is what you want. Specialist work goes to the specialist, so you will see other names occasionally: security, compliance, Microsoft 365 architecture, networking. Ask for the team structure during scoping.
- Do managed IT providers charge for hardware?
- Good providers don't bundle hardware sales into the engagement at a markup. Laptops get drop-shipped at supplier price, and managing them is baked into your monthly plan. Healthy equipment stays in place. Replacement happens when it makes sense, not on a schedule designed to invoice you.
Questions to ask
What separates a good managed IT provider from a polished pitch.
Bring these to any MSP conversation, including ours. The good ones answer clearly. The polished ones reach for talking points.
- 01
What's actually included in the monthly fee, and what triggers an extra charge?
Why it matters to you
Vague inclusions become surprise invoices. The border between 'managed' and 'extra' is where provider margins live. If you can't see it on day one, you'll find it on month three.
What a good answer sounds like
A written list of what's included, and a written list of what triggers an extra: new offices, major projects, software you've chosen yourselves. Plus a commitment that nothing gets billed without a heads-up first.
- 02
Who picks up the phone, and from where?
Why it matters to you
'Australian helpdesk' can mean a chat bot answers in Australia and your ticket gets routed offshore overnight. By the time the answer lands, your staff have stopped trying and gone around the system.
What a good answer sounds like
The techs answering tickets are employed by the provider, in Australia, and you can name the office. Bonus signal: they can name the senior tech who'd handle a serious incident.
- 03
What's already in the base plan as a default?
Why it matters to you
If MFA, tested backups, patching, password management and same-day offboarding aren't on by default in the base plan, they're an upsell. Insurers, regulators and breach investigators don't care that your provider offers it for an extra fee. They care whether it's actually running.
What a good answer sounds like
All of the above on by default in the base plan. They can describe how backups get tested, not just that a tool exists. They can name the patching window, and show that offboarding happens the same day.
- 04
How do you handle a new starter on Monday?
Why it matters to you
Some MSPs stage every new laptop at their office before sending it out. That's a two-week lead time and a courier in each direction for every hire. You'll feel it the first time you make four hires at once.
What a good answer sounds like
'We drop-ship from the supplier. The new starter signs in once and the device sets itself up in under an hour.' Microsoft Intune (or equivalent) handles the policy enforcement. If they say 'send us the device first', that's a clock and a cost.
- 05
Do you have any independent security certification?
Why it matters to you
ISO 27001 is the international standard for organisational data security. The certificate is a credential; the discipline behind earning it is what you're actually buying. A provider who can't pass independent scrutiny probably shouldn't be doing yours.
What a good answer sounds like
They name the certification, the body that issued it, and the renewal date. ISO 27001 and SOC 2 are the two you will see most. If they say 'we follow best practices' with no certificate, they're describing intent, not evidence.
- 06
What happens when an executive asks you to turn a security control off?
Why it matters to you
A provider that always does what the loudest person in the room asks isn't protecting your business. Your insurer, your lawyer and your auditor won't care that 'the customer requested it'. If you can't push back internally, your MSP has to be able to do it for you.
What a good answer sounds like
'We document the exception, escalate it formally, and only proceed when the decision is in writing and the risk is acknowledged.' Bonus: they have a recent story about saying no to a request like this.
- 07
Are there per-seat price breaks at higher volumes?
Why it matters to you
If you're growing, an MSP that charges every new seat at full price doesn't share the upside of scale with you. You'll quietly pay more per person at 100 seats than at 30, which is the wrong direction.
What a good answer sounds like
Written volume tiers, for example 10 to 25 seats at one rate and 26 to 50 at another. They should quote you against the tier you are growing into, not the one you start at.
- 08
Can you handle group billing if we have several trading entities?
Why it matters to you
Most providers' billing systems can't combine related entities cleanly. You end up with eight invoices, eight contracts and eight account managers across one group. You can't negotiate as one buyer.
What a good answer sounds like
They can run each entity as its own unit: tenants, documentation, security policies. Billing consolidates across the group for volume pricing. Staff working across entities are billed once.
- 09
If we're a non-profit, do you sort the Microsoft licensing discounts for us?
Why it matters to you
Microsoft offers big discounts and free licences to eligible non-profits. The application is admin-heavy, and most providers won't do it for you. You'll quietly overpay for years if nobody sorts it.
What a good answer sounds like
They know the not-for-profit licensing tiers, they can tell you what you're eligible for, and they lodge the Microsoft application during onboarding. Bonus: they have other not-for-profit clients on the books.
Use it as a scoring sheet. If a provider can't answer most of these clearly in conversation, move on. We hold ourselves to all nine. If we fall short on any of them, tell us.
When you're ready
Two ways in. Both end with a tech, not a sales call.
Call us and get straight to a tech. Or run the seven-question qualifier for a structured first pass; it lands in our team's queue.
Welshpool, Western Australia. Australian-owned, Australian-operated. Twenty plus years.