What Should a Managed Services Agreement Include?

What a Managed Services Agreement Does for an MSP

A managed services agreement is the document your recurring revenue stands on. It turns a monthly fee into a defined promise: which users and devices you look after, how fast you respond, what the client must do in return, and what happens when either side wants out. When a client disputes an invoice, blames you for a breach or asks why a project is not included, the agreement is the first thing anyone reads.

A weak agreement shows up in your numbers before it shows up in a dispute. Unbilled work creeps into the flat fee, your managed services gross margin slides, and technicians spend hours on requests nobody priced. A strong one lets you say no politely, quote the extra work, and point to the clause that explains why.

This answer covers the sections an MSP agreement needs and the decisions inside each one. It is practical guidance, not legal advice: contract law, consumer protection and data rules differ by state, province and country, so a lawyer who works with IT service firms should review your final version.

The Core Sections Every Agreement Needs

A practical structure uses two layers. A master services agreement holds the terms that apply to every client and rarely change. A schedule or statement of work per client holds what varies: the service tier, the covered users and devices, the price and the start date. That split means a price change or an added site is a new schedule, not a renegotiated contract.

Scope: What Is Covered and What Is Not

Scope is where most MSP agreements leak money. List the included services by name for each tier: help desk, patching, endpoint security, backup monitoring, vendor management, onboarding and offboarding of users. If you sell an all-inclusive plan, say what "all" means, because an all you can eat promise with no exclusions invites the client to test it.

The exclusions list matters as much as the inclusions. Write it so a technician can apply it at the ticket without calling the owner.

• Projects: new sites, migrations, server replacements and major upgrades, quoted separately. Your statement of work for each project, not the monthly fee, is where that work gets priced.
• Hardware, software licenses and cloud subscriptions, resold or passed through at a stated markup.
• Unsupported equipment: devices past vendor support, personal devices under a BYOD policy, and anything installed without your approval.
• Line of business applications beyond first-line triage and escalation to the vendor.
• After-hours work outside the coverage window, billed at a stated rate.
• Recovery from incidents caused by the client ignoring your written recommendations.

Define the billing unit precisely. If you price per user, say whether a shared mailbox, a service account or a part-time contractor counts, and how often you true up. The all-in seat price only means something if the seat count is right.

Service Levels, Response and Remedies

The SLA section sets priority levels, the targets for each, and the hours they apply. Define priorities by business impact, not by how loudly the client asks: a whole office down is not the same as one user's printer. Commit to response times you can hit on a bad week, because the client will remember the miss, not the average.

Decide what a missed target costs you. A common remedy is a service credit against the next invoice, capped at a share of that month's fee, and only when the client asks for it in writing. Avoid open-ended remedies such as termination without notice for a single miss. Track SLA attainment every month so you see a problem before the client raises it at a QBR.

Security Responsibilities and Shared Obligations

Security is now the clause clients and insurers read first. Spell out the controls you run as part of the service, the ones you offer at extra cost, and the ones the client owns. If a client declines a control you recommended, such as MFA on every account, the agreement should say that the risk from that decision sits with them, and you should keep their written refusal on file.

Government guidance gives you a useful checklist. CISA's advisory on threats to MSPs and their customers recommends that contracts require MFA on every MSP account used to reach customer environments, forbid reusing admin credentials across customers, specify monitoring and logging, and require the MSP to notify customers of confirmed or suspected security incidents. The same advisory says organizations should store their most important logs for at least six months, which is a sensible floor to write into your agreement.

Regulated Clients

Some clients bring legal obligations that flow down to you. A healthcare client under HIPAA needs a business associate agreement alongside the main contract; our answer on how HIPAA applies to MSPs explains what it commits you to. Financial clients covered by the FTC Safeguards Rule are told to choose service providers who can maintain safeguards and to write their security expectations, monitoring and periodic reassessment into the contract. The rule also requires those clients to notify the FTC no later than 30 days after discovering a breach affecting at least 500 consumers, so your incident notice to them has to arrive well inside that window.

Money: Fees, Increases and Payment Terms

State the fee, the billing unit, the true-up schedule and when invoices are due. Bill managed services in advance and projects on milestones. Add a late fee and the right to suspend non-emergency work after a stated period of non-payment, and use it: slow payment shows up directly in your days sales outstanding.

Build in the right to raise prices. Vendors raise what they charge you every year, and an agreement that fixes your fee for its whole term hands that cost to your margin. A common approach allows an annual increase with written notice, plus an immediate pass-through when a vendor raises a licensed product's price. When the time comes, the price increase letter and our article on renegotiating a renewal when seat prices rise walk through the conversation. For the pricing model itself, see how MSPs price their services.

Term, Termination and Offboarding

Choose a term that matches your onboarding cost. If bringing a client on takes weeks of unbilled work, a short term with easy exit means you may never recover it. You can charge an onboarding fee instead and keep the term short, which removes the objection from clients who dislike long commitments. Either way, state how renewal works and how much notice either side must give.

Offboarding is the clause everyone skips until they need it. Say what you hand over when the relationship ends, in what format, and within what window: admin credentials, documentation, backups, license ownership and domain registrar access. Say that transition work beyond that handover is billed at your standard rate, and that you release everything only once the account is paid. A clean, documented exit protects your reputation with the next MSP and the client's next referral.

1. Confirm the final invoice and any early termination fee.
2. Transfer admin credentials and remove your own accounts and tools.
3. Hand over documentation and any client-owned data or backups.
4. Transfer license and domain ownership held in your name.
5. Get written confirmation from the client that the handover is complete.

Keeping the Agreement Current

An agreement written once and never revisited drifts away from what you deliver. Review it every year against your ticket data: if a request type keeps landing in the exclusions gray area, decide whether it is included and say so. Update the security section when your stack changes, and move new clients onto the current version at signing and existing ones at renewal.

Use onboarding to make the agreement real. Walking a new client through scope, exclusions and responsibilities in the first weeks, as the client onboarding checklist does, prevents most of the disputes the contract would otherwise have to settle later.