Choosing managed IT support services is difficult for a specific reason: every proposal says the same things. Responsive. Proactive. Secure. Trusted partner. The claims are free, so they don't help you choose.
What does help is asking the same set of pointed questions to every provider on your shortlist, and comparing the answers side by side. Below are the six areas that determine whether the relationship works, the questions worth asking in each, and what a good answer actually sounds like.
The six areas to evaluate:
Service reliability and how support really works
Cybersecurity and compliance
Microsoft 365 management
Azure and cloud infrastructure
VoIP and telephony
Pricing and commercial terms
There's a scorecard at the end you can use to compare three providers across all six.
How to run the process
Shortlist three providers, not six. Ask all three the same questions, in writing where you can. Then score them consistently rather than going on how much you liked the person in the meeting, because the person in the meeting is often not the person who'll be supporting you.
Budget four to six weeks. Rushing this is how businesses end up switching again eighteen months later.
1. Service reliability and how support really works
This is the area you'll feel every day, and the one where proposals are vaguest.
Ask: How do you measure response time, and does the clock start on acknowledgement or on someone actually starting work? What are your resolution targets? What do you report to us each month? How many people are in the support team, and will we speak to the same faces? Is support delivered by your own employees or subcontracted? What's the escalation path when something isn't going well?
A good answer sounds like: specific numbers, a distinction between acknowledgement and engagement, an offer to share real performance data rather than targets, and a named escalation route that ends with someone senior.
Red flag: a response time in the sales deck that doesn't appear in the contract, or vagueness about who's actually doing the work.
Also ask for a reference client of similar size, and ask them the awkward question: what has gone wrong, and how did the provider handle it? Every provider has had a bad month. How they behaved during it is the thing worth knowing.
2. Cybersecurity and compliance
Scope varies more here than anywhere else, and the differences are expensive to discover later.
Ask: What security is included as standard, rather than sold as an add-on? Is there 24x7x365 security monitoring by real analysts, or just endpoint software? Do you hold Cyber Essentials Plus yourselves? Who handles our client security questionnaires? Is Cyber Essentials or compliance consultancy inside the fee or a separate project? What happens in the first hour of an incident, and who talks to our staff and clients?
A good answer sounds like: a clear line between included and chargeable, evidence of their own certification rather than just recommending yours, and a specific incident response process rather than reassurance.
Red flag: a provider selling you certifications they haven't achieved themselves. Your IT provider holds administrative access to almost everything you own, which makes them part of your risk profile, not just your defence against it.
For context on where the bar sits: we hold Cyber Essentials Plus, which involves an independent technical audit rather than a self-assessment, and our packages include a 24x7x365 Security Operations Centre to keep our clients safe even when they're not working.
3. Microsoft 365 management
Nearly every provider will say they manage Microsoft 365. The question is how far past user administration they go.
Ask: Beyond adding and removing users, what do you actually manage? How do you configure tenant security and conditional access? Do you back up our Microsoft 365 data, and how would we recover a deleted mailbox from six months ago? Who owns our tenant and licences, us or you? Are licence costs inside your monthly fee or billed separately?
A good answer sounds like: security and governance described as part of the service, not an extra. Backup treated as standard. Clear confirmation that you own your own tenant.
Red flag: treating Microsoft 365 as just mailbox admin, or assuming Microsoft's own retention counts as backup. Microsoft keeps the platform running. Recovering your data after a deletion or a ransomware event is your responsibility.
The licensing question matters for comparison too. A quote that bundles licences will look higher than one that doesn't, for identical service. Establish this before you compare numbers.
4. Azure and cloud infrastructure
Only relevant if you run workloads in Azure, but if you do, this is where money quietly leaks.
Ask: What do you manage in our Azure environment? How do you monitor and control consumption? Will you alert us when spend spikes, and do you review right-sizing? Can we see a monthly breakdown we can actually understand? Who holds the subscription ownership?
A good answer sounds like: cost management described as an active, ongoing service with alerting and review, plus honesty that consumption itself isn't fixed.
Red flag: a proposal presenting Azure as a flat monthly line with no explanation. Azure is billed on usage by design. A provider can fix the price of managing it. Nobody can fix the cost of the platform itself without padding the number heavily or capping what you're allowed to use. If someone tells you otherwise, ask what happens in a busy month.
5. VoIP and telephony
Telephony used to sit outside IT support conversations. In 2026 it can't, because there's a deadline attached.
The UK's copper phone network is being switched off on 31 January 2027, and Openreach has warned that roughly 350,000 business premises were still running on legacy copper with about six months to go. Anything on analogue lines or ISDN stops working. So does a surprising amount attached to those lines: alarms, lifts, door entry systems, card terminals and fax.
Ask: Will you audit every line we have and everything connected to them? What's the migration plan and timeline? Can we port our existing numbers? Does telephony integrate with Microsoft Teams if we use it? Is call recording available if we need it for compliance?
A good answer sounds like: an offer to run a line audit as part of onboarding, a realistic timeline that accounts for number porting taking weeks rather than days, and questions back to you about door entry and alarms.
Red flag: a provider who hasn't raised the switch-off with you at all. With less than a year to go, it's a reasonable test of whether they're paying attention to your business or just running a helpdesk.
6. Pricing and commercial terms
Ask: How is a user defined, and can we flex numbers down as well as up? Is remote support genuinely unlimited, and are there fair use clauses? Is on-site time included, capped or chargeable? What's excluded from the monthly fee? What does onboarding cost, and is it priced separately? What's the initial term and notice period? If we left, what would we take with us?
A good answer sounds like: exclusions stated plainly and early. A provider who volunteers what isn't covered is easier to trust than one who waits to be asked.
Red flag: a low headline figure with a long list of chargeable extras, a term beyond 24 months, or hesitation about who owns your documentation.
On the numbers: most UK providers price per user per month. Our own agreements typically fall between £50 and £150 per user per month, depending on how much security, compliance and on-site time you need.
Fully outsourced or co-managed?
Worth settling before you start, because it changes who you should be talking to.
Fully outsourced IT support suits businesses with no internal IT. The provider takes on everything.
Co-managed IT support suits businesses that already have an IT person or small team. Your internal lead keeps ownership and decides what gets handed over, typically overnight monitoring, routine work, holiday cover and specialist projects. Done well, it means your IT manager finally gets to do the job they were hired for.
If you have someone internal, add one question to every conversation: how would you split responsibilities on day one, and would you work in our existing ticketing system or insist on yours? A provider who treats your IT team as an obstacle rather than a colleague will make that person's life worse, and they'll leave.
The scorecard
Score each provider out of 5 in each of the six areas, for a total out of 30. The pattern usually matters more than the total: a provider strong on price and weak on everything else is telling you something.
Here’s what you’re scoring in each area.
Service reliability, out of 5. Response times that are measured rather than promised, willingness to share real performance data, a named escalation route, and references from businesses of similar size.
Cybersecurity and compliance, out of 5. 24x7 monitoring included rather than sold as an upgrade, certifications they hold themselves, a specific incident process, and support with compliance evidence and client questionnaires.
Microsoft 365, out of 5. Security and governance rather than user administration alone, backup of your Microsoft 365 data included, and clear confirmation that you own your tenant and licences.
Azure and cloud, out of 5. Active cost monitoring with alerting, right-sizing reviews, a monthly breakdown you can follow, and honesty that consumption itself can’t be fixed. Score this zero if it doesn’t apply to you and work to a total out of 25.
VoIP and telephony, out of 5. A line audit offered as part of onboarding, a credible migration plan ahead of the switch-off, and Teams integration if you need it.
Pricing and terms, out of 5. Exclusions stated plainly and early, a sensible contract term, a clean exit, and confirmation that you own your documentation.
How to read the result. Anything scoring 2 or below in security, pricing or reliability is worth ruling out regardless of the total, because those three are the areas that cost you most to get wrong. A provider scoring evenly at 3 across the board is usually a safer choice than one scoring 5, 5, 5, 1, 1, 1.
Frequently asked questions
What should I look for in a managed IT support provider? Measured response times you can verify, security included rather than sold as add-ons, genuine Microsoft 365 management beyond user administration, clear pricing with stated exclusions, a sensible contract term, and references from businesses of similar size.
How much do managed IT support services cost in the UK? Most providers charge per user per month. Ranges vary with scope, particularly around on-site time, security monitoring and compliance work. Ours typically fall between £50 and £150 per user per month. Always compare what's included before comparing the numbers.
How long should a managed IT support contract be? Twelve months is common and shorter rolling terms are increasingly available. Be cautious about anything beyond 24 months, especially at the start of a relationship.
Should managed IT support include cybersecurity? Endpoint protection, email filtering and patching should be standard. Deeper elements vary, particularly 24x7 security monitoring, awareness training and compliance consultancy, so ask about those specifically.
Can we switch providers without disrupting the business? Yes, with planning. Expect a structured handover covering documentation, admin access, licences and monitoring over four to six weeks. Most disruption during a switch comes from rushing it.
Does managed IT support cover phone systems? Increasingly yes, and it matters this year with the copper network switching off in January 2027. Any business still on analogue or ISDN lines needs a migration plan and an audit of everything else attached to those lines.
Start with a conversation
If you're partway through this process and the proposals aren't lining up, we're happy to look at them with you, even if you don't end up choosing us.
It's a 30-minute conversation, there's no charge, and if your current provider is doing a good job we'll tell you that too.
1-Fix has been the IT and Technology partner for growing UK businesses since 2002, from our base in Bracknell. We're Cyber Essentials Plus certified and rated 4.9 out of 5 on Google.