What does managed IT support include, and what should it include?

What is managed IT support, in plain terms?

Managed IT support means a provider looks after your IT for a fixed monthly fee, instead of charging each time something breaks. The difference matters more than it sounds. When a provider is paid by the hour, a fault is income. When they're paid a fixed fee, a fault is a cost to them. That's why good managed providers spend so much effort on monitoring, patching and security: preventing a problem is cheaper than fixing it.

The trouble is that "managed IT support" covers everything from a remote helpdesk with antivirus to a full service with a 24/7 security operations centre. The phrase doesn't tell you what you're buying. The list of inclusions does.

The core services every package should include

These are the minimum. If any of them is sold as an extra, the monthly price isn't comparable with a provider that includes it.

1. Helpdesk support by phone, email and portal, with a published first-response time and real figures to back it up.
2. Monitoring and patching of servers, laptops and network devices, so updates are applied on schedule and warning signs such as a failing disk are spotted early.
3. Endpoint detection and response (EDR) on every device, to protect against viruses and ransomware. Traditional antivirus looks for known threats; EDR watches for suspicious behaviour.
4. Email security against phishing and impersonation. Phishing was the most common attack reported by UK businesses in the government's 2025/2026 breaches survey, affecting 38%.
5. Backup, including Microsoft 365. Microsoft keeps your service running, but protecting your data from deletion, ransomware or a departing employee is your responsibility, so it needs its own backup.
6. Microsoft 365 management: users, licences, Teams, SharePoint, OneDrive, multi-factor authentication and security settings.
7. Device management, for example with Microsoft Intune, so a lost laptop or phone can be locked or wiped.

What's often left out, but shouldn't be

Some of the most valuable parts of managed IT support don't show up in a ticket count.

Documentation. Every password vault, network diagram, licence and configuration should be written down in a system the provider maintains. Without it, only the one engineer who set things up can fix them, and switching provider becomes painful.

Security configuration, not just security tools. Buying EDR and email filtering is easy. Checking that multi-factor authentication is on for every account, that old admin accounts are removed and that devices are encrypted takes time. The Cyber Security Breaches Survey 2025/2026 found only 47% of UK businesses use two-factor authentication.

Staff security training. Most attacks start with a person clicking something. Short, regular training and simulated phishing emails change behaviour more than a one-off session.

Technology reviews. A roadmap that tells you which laptops need replacing next year, which licences you're paying for but not using, and what's coming, such as the PSTN switch-off on 31 January 2027.

Joined-up communications. Your phones and broadband run over the same network as your IT. If your provider can't see them, faults bounce between suppliers.

How do packages usually differ?

Most providers sell tiers. Here's how Indigo Unified Communications' four packages compare, as a worked example of what changes between levels.

Three differences matter most when you choose. First, 24/7 monitoring versus a 24/7 SOC: monitoring spots system problems around the clock, while a security operations centre has analysts watching for and responding to attacks. Second, the Microsoft 365 licence: Business Premium adds Microsoft Defender for Business and Intune device management, for organisations of up to 300 users (Microsoft Learn). Third, on-site time and PC builds: if you hire regularly, the number of builds included can make a real difference to the total you pay.

Which level is right for you?

Example 1: a 15-person office that works mostly in Microsoft 365, with no sensitive data and little hiring. Remote support with monitoring, patching and security tools covers the essentials, and occasional visits can be paid for when needed. That's the shape of a Silver-type package.

Example 2: a 60-person construction contractor with a head office, site cabins and staff starting every month. 24/7 monitoring, security training, a licence bundle and included PC builds usually save money and hassle. That's the shape of Gold. See our construction technology guide for the site-specific issues.

Example 3: a business bidding for public sector work or handling sensitive personal data. A 24/7 security operations centre (SOC), Business Premium security and help with Cyber Essentials are worth the extra. According to NCSC figures reported in September 2026, organisations with Cyber Essentials are 92% less likely to claim on their cyber insurance.

Registered charities have their own considerations, from charity licensing to OSCR reporting. The charity technology guide covers them.

In practice: what "included" looks like at Indigo

Our experienced engineering team works across first, second and third line, backed by three consultants and a Service Delivery Manager. We manage more than 2,000 endpoints through Datto RMM, log every ticket in Autotask and document every client environment in IT Glue, so whoever picks up your ticket can see how your setup works. In September 2026 we handled 1,854 tickets, resolved 65% within two hours and averaged a 13-minute first response.

How Indigo does this. Every Indigo package includes the helpdesk, device monitoring and updates (Datto RMM), Kaseya 365 endpoint protection against viruses and ransomware, INKY email security to block phishing, and backup, including Datto SaaS Protection for Microsoft 365. Gold adds 24/7 monitoring and security training; Platinum and Charity add a 24/7 RocketCyber security operations centre. We're certified to Cyber Essentials Plus and ISO 27001:2022. See our packages →

What to do next

1. Ask your current or prospective provider for their inclusions list and check it against the seven core services above.
2. Find out whether you have 24/7 monitoring, a 24/7 security team (SOC), both or neither.
3. Check who holds your documentation, passwords and admin accounts.
4. Count how many new starters and site visits you had last year, and see what they'd cost under each package.
5. Book a free technology assessment for a written view of your gaps.