Most South Australian small businesses, not-for-profits and smaller councils do not need a full in-house IT team, but they do need someone dependable looking after laptops, Microsoft 365, backups, security and the systems that keep the doors open. That is what a managed IT provider, or managed service provider (MSP), is for. The difference between a good arrangement and a frustrating one is rarely the price per user. It is whether the scope, service levels, security expectations and exit terms were written down clearly before anyone signed. This guide explains, in plain words, what to ask for, how to read a service level agreement (SLA), what a provider with admin access to your systems should be doing to protect you, and how to keep control of your own accounts and data. It is general guidance, not legal or procurement advice.
Start with what you actually need looked after
“Managed IT” means different things to different providers. Before you ask for quotes, list what you have and what you want covered, so every proposal answers the same question. A one-page inventory is enough:
- People and devices. Number of staff, laptops, desktops, phones and shared devices, and whether anyone works from home or remote sites.
- Accounts and identity. Microsoft 365 or Google Workspace, how sign-in works, who holds global admin rights, and whether multi-factor authentication (MFA) is on for everyone.
- Business systems. Accounting (Xero, MYOB), CRM, booking, case management or council line-of-business systems, and who supports each today.
- Cloud and hosting. Websites, AWS or Azure accounts, domain names and DNS, and any servers still in a cupboard.
- Data and backups. Where important files and records live, what is backed up, how often, and when a restore was last tested.
- Obligations. Privacy, records, funder or contract requirements, cyber insurance conditions, and any government security expectations such as the ACSC Essential Eight or the SA Government ISMF.
If you already have a project brief template, the same discipline applies. Our guide to briefing software and website projects shows how a clear brief makes quotes comparable.
What a managed IT agreement should cover
A sound agreement says plainly what is included in the monthly fee, what is charged separately and what is not covered at all. Use a table like this to compare proposals line by line:
| Area | What to look for in the scope |
|---|---|
| Service desk | How staff log a request (phone, portal, chat), hours of cover, and whether unlimited or capped support is included. |
| Devices and patching | Operating system and application patching on a defined schedule, device management (for example Intune), encryption and remote wipe for lost devices. |
| Microsoft 365 and identity | MFA for every account, Conditional Access, admin account separation, licence management and joiner, mover and leaver processes. See Zero Trust and Conditional Access and our staff onboarding and offboarding checklist. |
| Email security | Filtering, phishing protection and SPF, DKIM and DMARC set up and monitored. See our email security guide. |
| Backup and recovery | What is backed up (including Microsoft 365 mailboxes and SharePoint), retention, offline or immutable copies, and scheduled restore tests with results reported. See backup and disaster recovery. |
| Security monitoring | Endpoint protection, alert handling, who responds out of hours and how quickly you are told about a suspected incident. |
| Cloud and applications | Monitoring, patching and cost reporting for AWS or Azure, and support for the business applications you rely on, not just the desktops. |
| Advice and vendor management | Regular reviews, a technology roadmap, budget planning and dealing with software vendors and telcos on your behalf. |
| Exclusions | Projects, hardware, after-hours work, travel, third-party licences and anything else billed separately, written down rather than discovered on the first invoice. |
Service levels that mean something
An SLA is only useful if both sides agree what counts as urgent and what is being measured. Look for these elements:
- Priority definitions in business terms. For example, “the whole office cannot work” or “a suspected security incident” is the highest priority; “one person cannot print” is low. Vague definitions let every ticket be treated as low priority.
- Response and resolution are different. A fast response time (someone acknowledges the ticket) does not mean a fast fix. Ask for both response and target resolution or workaround times for each priority.
- Hours of cover. Business hours in Adelaide are fine for many small organisations. If you run services on weekends, after hours or across time zones, agree what is covered outside business hours and what it costs.
- Measurement and reporting. A monthly report showing tickets by priority, how many met the SLA, recurring problems, patch status, backup results and security alerts.
- What happens when targets are missed. Service credits, an escalation path to a named senior person, or a right to end the agreement after repeated misses.
Set targets that suit your organisation rather than copying the most aggressive numbers you can find. Faster cover costs more, and a two-person office has different needs from a council customer service centre.
The provider’s own security matters as much as yours
A managed IT provider usually holds privileged access to your systems, often remotely and often across many customers at once. That makes the provider part of your security perimeter. ASD’s Australian Cyber Security Centre publishes questions to ask managed service providers, and they are a good starting checklist. In practice, ask the provider to show you, not just tell you:
- How they protect their own environment, including whether they apply the Essential Eight internally.
- How admin access to your systems works. Named individual accounts with MFA rather than shared logins, the least privilege needed, and access that can be reviewed and removed. For Microsoft 365, ask whether they use granular delegated admin privileges (GDAP) with limited roles rather than broad, permanent admin rights.
- How remote management tools are secured, because those tools are an attractive target for attackers who want to reach many customers at once.
- How they log and monitor their own activity in your environment, and whether you can see those logs.
- How and when they will tell you about an incident, including one that starts in their systems rather than yours. Your cyber incident response plan should name the provider and this notice period.
- Where your data and their support staff are located. Offshore support or tooling can matter for privacy, contracts and government work. See Australian data residency.
Keep ownership of your accounts, data and documentation
The most painful managed IT problems usually surface when an organisation wants to change provider and finds it does not control its own systems. Write these points into the agreement from day one:
- You own the tenancy. Your Microsoft 365 or Google Workspace tenancy, domain names, DNS, cloud accounts and software licences are registered to your organisation, not the provider. Our domain, DNS and admin account ownership checklist shows how to check each one.
- You hold break-glass access. At least one emergency global admin account, protected and stored securely by your organisation, that does not depend on the provider.
- Documentation is a deliverable. Network diagrams, system inventory, configuration notes, admin account list and backup procedures are kept current and handed over on request.
- Exit assistance is defined. A notice period, a handover plan, return of data and credentials, and removal of the provider’s access on a set date.
- No lock-in through tools. If the provider’s own tools manage backups or devices, agree how your data and settings move to a replacement.
Our guide to provider due diligence and exit planning goes further for organisations with regulated customers or funders.
Pricing models and how to compare them
Most managed IT is priced in one of a few ways: per user per month, per device per month, a monthly retainer for a defined scope, or blocks of prepaid hours. None is right for everyone. To compare fairly:
- Map each proposal against the same scope table above and note what is excluded.
- Ask what a typical month looks like for an organisation of your size, including likely extra charges.
- Check onboarding fees, minimum terms and price review clauses.
- Separate licences (Microsoft 365, security tools, backup storage) from labour, so you can see what you are paying for. Our Microsoft 365 licence review guide shows how to check the licence side.
- Ask how cloud costs are monitored. A provider that reports on your AWS or Azure spend can often save more than its fee. See cloud cost control.
Extra points for councils and government work
Councils and organisations that deliver services to SA Government often face more specific expectations. Procurement rules may require quotes or a panel arrangement, security requirements may reference the ISMF or the Essential Eight, and contracts may set terms for data location, background checks, insurance and incident notice. Check your council’s procurement policy, keep a register of the managed services you use and what data each one touches, and make sure the provider can supply evidence for audits. Suppliers to government can read our guides to SA Government ICT panels and the SA Industry Participation Policy.
Questions to ask before you sign
- What exactly is included in the monthly fee, and what will be charged separately?
- How are priorities defined, and what are the response and resolution targets for each?
- What hours are covered, and what does after-hours support cost?
- What will the monthly report show, and can we see an example?
- How do your staff access our systems, and how is that access secured, logged and reviewed?
- Do you apply the Essential Eight to your own business, and how can you show it?
- How and how quickly will you tell us about a security incident, including one in your systems?
- Where are your support staff and tools located, and where is our data stored?
- How often are our backups restore-tested, and will we see the results?
- What happens to our accounts, data and documentation if we leave?
The first 90 days with a new provider
A good onboarding sets the tone for the whole relationship. In the first month, expect an assessment of your environment, an up-to-date inventory, a check of admin accounts and MFA, and confirmation that backups work. In the second month, expect quick security wins such as removing old accounts, tightening admin rights, patching overdue devices and fixing email authentication. By the end of the third month you should have a written baseline, a prioritised improvement roadmap with costs, and your first monthly report against the SLA. If you are also planning to roll out Microsoft 365 Copilot or other AI tools, this is a good moment to tidy permissions first. See Copilot readiness.
How EITSAA helps
EITSAA is an Adelaide technology consultancy, founded in 2018. Our managed IT and cyber security service is offered as a monthly retainer with clearly defined scope and service levels. Standard support is during Adelaide business hours, with extended options available. We can support systems we did not build, starting with a short onboarding assessment to understand and document your environment, and we provide Essential Eight assessments and uplift, Microsoft 365 and identity security, cloud operations and part-time technology leadership. We can also review an existing managed IT agreement or a set of quotes against the checklist above. We are not lawyers or certification assessors, so contract and compliance decisions stay with you and your advisers.
Talk to an Adelaide team
If you are choosing a managed IT provider, reviewing your current agreement or want a clear picture of your security baseline, talk to us about managed IT and cyber security or call 0402 401 584, Monday to Friday 9am to 5:30pm. See also our DevOps and cloud and team training services and the Microsoft 365 secure workplace architecture.