Managed IT Services Pricing: The Four Models Explained

Managed IT services typically cost somewhere between £60 and £180 per user per month, though that band moves a lot depending on stack complexity, region and what's actually bundled in. Anyone quoting you a single flat number without asking about your device count, compliance needs and helpdesk hours is either guessing or hiding something in the small print.

How much do managed IT services actually cost?

There's no honest single answer here, and I'd be suspicious of anyone who gives you one without a follow-up question. What years of watching client contracts land on my desk have taught me is that pricing sits in bands, not fixed points. Basic support with patching and a helpdesk sits at the lower end. Add security monitoring, EDR, backup management and compliance reporting, and you climb the scale fast. Add a highly regulated stack or specialist software, and you climb further still.

The mistake most buyers make is comparing headline numbers across providers without checking what sits inside each one. A quote that looks 30% cheaper than the next often means fewer included hours, no out-of-hours cover, or backup that's "available" rather than "managed". Use HostList's MSP shortlisting tool to compare providers against a consistent checklist rather than a single price line.

What are the four MSP pricing models?

Nearly every managed IT quote falls into one of four structures. Knowing which one you're being sold matters more than the number attached to it, because each model hides cost in a different place.

• Per user. You pay a flat fee for each named employee, regardless of how many devices they use. Good for organisations where staff have multiple devices.
• Per device. You pay for every endpoint, laptop, server, printer, mobile. Good when headcount is low but device sprawl is high.
• Tiered or bundled. Fixed packages (Bronze/Silver/Gold style) with set inclusions at each level. Simple to compare on paper, easy to misread in practice.
• All-inclusive. One flat fee covers everything from helpdesk to security to strategic IT consulting. Highest sticker price, fewest surprises.

Each of these can be a fair deal or a bad one depending on your organisation's shape. A ten-person consultancy with three devices per employee gets burned by per-device pricing. A retail business with forty tills and six office staff gets burned by per-user pricing. Match the model to your actual environment, not the other way round.

Where does per-user pricing hide cost?

Per-user IT support pricing looks clean until you read the fine print on what counts as a "user". Some providers charge per named employee even if that employee only logs in from one laptop. Others quietly reclassify shared accounts, service accounts or seasonal staff as full users, and your bill balloons at renewal without your headcount actually changing.

The other place cost hides is device count creep. If your per-user contract doesn't cap devices per person, someone bringing a second laptop or a personal phone onto the network can trigger additional per-device charges layered on top of the per-user fee. Ask explicitly whether devices are capped, and get the cap written into the contract, not just mentioned on a call.

Where does per-device pricing hide cost?

Per-device models look predictable until your device count grows faster than your headcount, which happens constantly with servers, network kit, IoT sensors and shared workstations. A warehouse with twelve staff but eighty scanners and printers will find per-device pricing far more expensive than it first appeared.

The other trap is decommissioned or duplicate devices sitting on the invoice. I've seen contracts where old servers, retired laptops and test devices kept generating charges for months because nobody told the provider to remove them. Ask for a quarterly device audit clause. If a provider won't agree to one, that tells you something about how they run their own asset tracking.

What should tiered or bundled pricing include?

Tiered packages are the easiest to compare on the surface and the easiest to misjudge underneath. A "Silver" tier from one provider might include 24/7 monitoring and patch management. A "Silver" tier from another might mean business-hours-only support with patching billed as an extra. The tier names mean nothing on their own; the inclusions list is everything.

At minimum, a decent mid-tier bundle should specify: response time targets by ticket severity, whether after-hours cover is included or billed separately, how many onsite visits are included per quarter (if any), and whether security tooling like EDR is bundled or an add-on. Get this in writing line by line rather than trusting a sales deck. Our buyer's checklist for choosing a managed service provider walks through exactly what to ask for before signing.

Is all-inclusive pricing worth the premium?

All-inclusive contracts carry the highest headline price and, in my experience, cause the fewest arguments six months in. You know what you're paying, you know what's covered, and there's no separate invoice landing in your inbox every time something needs patching or a new starter needs onboarding.

Where all-inclusive falls down is with organisations that have unpredictable project work, like frequent office moves, mergers, or major software rollouts. If you're paying an all-inclusive fee that assumes steady-state operations, big one-off projects usually sit outside it anyway, so you're paying premium rates for stability you might not need. For steady, predictable environments it's often the least stressful option even if it's not the cheapest on paper.

What should be inside the base fee versus billed separately?

This is where most disputes start, and it's entirely avoidable if you ask the right questions before signing. A fair base fee for managed IT services should generally include:

• Proactive monitoring of servers, endpoints and network devices
• Patch management and routine maintenance
• Helpdesk support during agreed hours, with clear response time targets
• Endpoint detection and response (EDR) or equivalent baseline security tooling
• Backup monitoring and regular restore testing, not just "backup exists"

What should reasonably sit outside the base fee, billed separately or as a project:

• New hardware purchases and major refresh cycles
• Software licences beyond a basic security stack
• Office moves, network redesigns or cloud migrations
• Compliance audits or penetration testing beyond baseline monitoring

If a provider tries to bill routine patching or basic backup monitoring as a "project", walk away. That's a baseline responsibility, not an upsell. On the security side specifically, the FTC's small business cybersecurity guidance is a useful independent reference for what baseline protection should look like, and it's a fair yardstick to hold any MSP quote against.

How do you normalise three quotes to per-user-per-month?

This is the single most useful exercise you can do before signing anything, and almost nobody does it properly. Here's the method I've walked clients through more times than I can count:

1. Strip out one-off costs. Onboarding fees, setup charges and hardware purchases don't belong in a monthly comparison. Note them separately.
2. Convert everything to per-user-per-month. If a quote is per-device, divide by your actual device-to-user ratio, not a generic assumption. If it's a flat bundle, divide the monthly bundle cost by your headcount.
3. Add back excluded costs at your expected usage. If after-hours support is billed separately, estimate your realistic after-hours ticket volume and add that cost in. Don't compare a quote that excludes something to one that includes it.
4. Weight for coverage hours. A cheaper per-user rate for business-hours-only support isn't comparable to 24/7 cover. Either normalise both to the same hours or note the gap explicitly.
5. Line up security and backup inclusions side by side. This is where the real cost differences usually surface once you've done steps one to four.

Once you've done this across three quotes, the real per-user-per-month cost is often much closer between providers than the headline numbers suggested, and the differences that remain are usually about scope, not efficiency. If you want a structured way to compare providers rather than doing this from scratch each time, HostList's MRI ranking methodology explains how we score MSPs on exactly these inclusions, and our MSP directory lets you filter by region and stack before you even request quotes.

Regional pricing differences are real too. An MSP quote in London often reflects different labour costs and compliance overheads than one in Texas, so don't assume a national average tells you much about what you'll actually pay locally. Always get quotes from providers who work in your specific market.

Which pricing model fits your organisation?

There's no universally "best" model, only a best fit for your specific mix of headcount, device count and predictability of workload. High device-to-user ratios favour per-user pricing. Low headcount with lots of hardware favours per-device pricing, provided you cap it. Organisations wanting budget certainty above all else tend to do better with all-inclusive. Everyone else usually lands somewhere in tiered bundles, provided they read the inclusions list line by line rather than trusting the tier name.

It's also worth stepping back and asking whether managed services are the right model at all versus break-fix or co-managed arrangements, particularly if you already have some internal IT capability. Our piece on managed IT versus break-fix versus co-managed models covers that decision in more depth before you even get to pricing structure.

If you've had a genuinely bad experience with a provider misrepresenting what was included in a quote, it's worth filing a claim with HostList so other buyers get an honest picture before they sign.

Frequently asked questions

What's a reasonable per-user IT support price for a small business?

Small businesses typically see quotes ranging widely depending on included security tooling and support hours, and the honest answer is that the number matters far less than what's included underneath it. Compare inclusions line by line rather than anchoring on a single figure.

Do managed IT services include cybersecurity?

A decent base fee should include baseline endpoint protection, monitoring and patching, but full compliance audits, advanced threat hunting or penetration testing are usually billed separately. Always ask your provider to specify exactly where that line sits.

Why did my managed IT services bill increase at renewal?

Renewal increases usually come from device count creep, added users, or the provider quietly reclassifying support hours. Request an itemised breakdown at renewal and compare it against your original contract's inclusions list rather than accepting the new figure at face value.

Is per-device or per-user pricing cheaper?

Neither is inherently cheaper. It depends entirely on your device-to-user ratio. Calculate your actual ratio before comparing quotes, since a provider quoting per-device on an environment with high device counts per employee can end up costing more than an equivalent per-user contract.