Questions to ask a managed IT provider before you sign

Request a walkthrough of one real request, such as a user who cannot open the shared drive on Tuesday morning, and see where it goes next. Ask who sees the request, how it is ranked against a printer fault in another office and who tells the user the cause. Tickets are the spine of the contract.

Look for a single front door, a portal or a shared helpdesk mailbox, instead of a phone number that rings one engineer’s mobile. Ask whether every request gets a ticket number and a closing note saying what was changed, so you can trace a repeat fault back to the first.

Ask to see a sample ticket history with client names removed, and check for categories, timestamps for first reply and resolution, and the engineer’s notes on root cause. Blank notes are a warning.

Many agreements promise a response within a set time, yet that response may be only an automatic email from the helpdesk tool. Ask whether the clock measures a first human reply, the start of work or the fix, and what service credit follows a missed target.

Ask about hours too. A target that runs only in office hours suits some teams, but it is useless for a shop that opens at seven and trades until the evening.

Request last quarter’s figures for a similar client, since a provider who tracks this will have a report ready, probably exported from the PSA or helpdesk tool. Nothing ready is a finding.

Find out who owns the domain, the mail tenant, the firewall login and the backup console, which should all sit in your company’s name. The provider joins as an administrator. Provider-owned accounts make leaving a negotiation.

Ask where the passwords are stored and who can see them, since a shared vault with named access and an audit trail is a good answer. A spreadsheet is not.

Ask for a list of your admin accounts, refreshed at every quarterly review, and confirm MFA on each one plus conditional access rules that block logins from other countries.

Every provider says they back up. Ask how often they test a restore, who performs it and whether you receive the result, since an untested backup is only a hope. The evidence you want is a monthly note naming the folder restored, the target machine and the minutes taken to bring it back.

Ask what a full server loss would look like, including how many hours pass until the accounting software runs again and which of that morning’s entries would be gone.

Ask about RPO and RTO in plain words: how much work you could lose, and how long you could wait before invoicing and stock movements stop. A shrug means keep looking.

Exit terms are dull until they matter. Ask about notice periods and minimum terms, and ask for a handover pack: the asset list, a network diagram, licence keys, admin credentials and notes on any custom settings. Ask which of those items the provider will charge to hand over, since a handover that carries a fee should appear in the contract before you sign.

Ask whether remote-control agents installed on your laptops are removed at exit, and who transfers licences that were bought in the provider’s name.

Insist on a clean offboarding of agents, VPN profiles and shared mailboxes, then take the same sheet to every interview and score the answers side by side. Get the exit answer in writing.