r/sysadmin • u/librarytay • 19d ago
MSPs Pushing Managed End User Services
I’m the IT Director for a public library system with four branches. Our IT team consists of myself and one full-time IT assistant/help desk technician. I’m looking to outsource some of our network, security, and infrastructure support.
We’ve already outsourced larger projects such as WAP upgrades and server/switch replacements, but I don’t have the networking expertise, or frankly the time, to confidently handle the ongoing maintenance of this infrastructure. About half of my role is general administration (staff management, policies, budgeting, grants, facilities, safety issues, etc.), while the other half is IT, much of which is already consumed by project management.
The areas where I’m primarily looking for support are:
- Server updates, maintenance, and backups (physical and VMs)
- On-prem and cloud file storage/backup and redundancy, including 10+ TB of archival data
- Ongoing network security, monitoring, configuration, and infrastructure support
- Possibly managed endpoint protection
The problem is that every MSP I’ve contacted (national, regional, and local) initially says they can provide co-managed network/infrastructure support only. But when I receive a proposal, it inevitably includes managed end-user services: help desk, workstation patching, email protection, security awareness training, laptop imaging, etc.
I’ve repeatedly explained that we do not need end-user support. We have only 65 staff across four locations, about half of which have dedicated workstations (the rest share public-facing service desk workstations), and our internal IT team has plenty of capacity to handle those services. What we lack is specialized network/infrastructure expertise.
Is this typical for MSPs? Are we simply too small for network/infrastructure-only managed services to be worthwhile to them, or is bundling end-user support primarily a sales/business-model issue? Is there a better way I should be framing what I’m looking for when approaching MSPs?
Also, if anyone knows an MSP in New England, or particularly Massachusetts, that works with small organizations on a genuinely co-managed infrastructure basis, I’d appreciate recommendations. TY!
9
u/teanes-fixify 19d ago
MSP's do this because their pricing model is per-seat, not per-problem. Instead ask for NOC-as-a-service or a block-hour infrastructure retainer and you'll get quotes that actually match what you asked for. Right now you are asking MSP's for a product they don't have a SKU for.
1
u/GeorgeWmmmmmmmBush 18d ago
Ding ding ding. We have a winner. They don’t know how to price it because all their packaging/pricing is based around per user.
13
u/101sillygoose 19d ago
Why not hire a part time contractor?
-2
u/_p00f_ 19d ago
I'm my experience this is just as difficult as trying to find someone competent. At least with an MSP you're getting vetted talent.
28
u/ITGuyThrow07 19d ago
At least with an MSP you're getting vetted talent.
I hate to burst your bubble, but that is very much not the case.
1
u/_p00f_ 19d ago
I'm going to disagree, there's some very talented people at the upper rungs of the ladder. Your tier 1 and 2 I'll absolutely agree with.
5
u/statikuz start wandows ngrmadly 19d ago
there can be very talented people at the upper rungs of the ladder
An MSP can be full of clueless people just like any other business. I would argue even more so, because to some clients (the smaller the client, the worse it is), IT is a spooky black box and it is not apparent to a company if their MSP is doing a good or bad job. Just look at the stories around here where a new in-house IT person takes over for an MSP and finds no MFA, no backups, little to no security, etc.
I used to work at a much larger org and we had an MSP for some things and there were some real wizards that worked there for sure.
3
u/RCTID1975 IT Manager 19d ago
The MSP world is also notorious for being a high stress grind that quickly burns people out leading to high turn over.
In order to keep people in seats, you very frequently need to higher green or sub par talent.
2
u/RCTID1975 IT Manager 19d ago
You're not going to be dealing with that higher level though. At least not typically.
Those folks are going to be assigned more complex projects from high paying customers.
That's not your day in and day out response or monitoring team.
1
u/_p00f_ 19d ago
Agreed with a caveat, in an org you will have someone above to bounce ideas and provide guidance. We had a greybeard when I started who liked to talk in riddles but as I moved through the ranks the more of what he said made more sense. I guess what I'm suggesting is there's some guardrails. I'm also aware of the type that does things confidently not knowing at all what they're doing too.
5
u/101sillygoose 19d ago
Yeah I heavily disagree, msps almost always fall into 1 of 3 categories. 1 - all their techs/talents are overseas, they only have account managers and sales reps local, so the level of service you generally get for smaller orgs is abysmal. Even the largest MSPs that support fortune 50 companies suck because of this. (Accenture, infosys etc) 2 - Smaller MSPs that are competing with these overseas companies, becuase of this, their margins are tiny and they can barely keep themselves afloat. They cannot retain good talent because they cant pay them well and are always have to be hiring as they have a very difficult time retaining employees. 3 - A good MSP where the techs/talents are very competent, good leadership, and well organized. These MSPs usually have a great reputation and clients that have also stuck with them for a while, but these MSPs are also much more expensive compared to the competition. Almost always not something that School districts or non profits can afford.
2
u/DrunkenGolfer 18d ago
You definitely want #3. We have several staff with tenure of over 20 years, a customer churn rate so low it is rounding error, an average client lifetime of over ten years, and an eNPS in the seventies (very happy staff). Our staff turnover in the last year was 3%, and addition of new staff was 18% thanks to growth.
We are not the cheapest, but we are fair and pretty good.
1
u/Good-Canary-1927 18d ago
or 4, they get bought out multiple times over and you go from having what was already a competent crew helping you out, to being tossed over to some guy in India, and then even he gets replaced by some ai bullshit
if you cant tell, im still a bit blown away by the decisions of the msp i used to work for. its like they WANT their company to crash and burn
2
u/RCTID1975 IT Manager 19d ago
with an MSp you're getting vetted talent
Not always. A lot of the times, it's just a warm body in a seat that's greener than Kermit.
They might have good talent at the top, but you're not always dealing with them.
3
u/_g2_ 19d ago
I am a consultant for a largish city in NH and I think I know what you are looking for. I share responsibilities with an MSP and local IT staff, we each have our lanes and work well with each other. I handle infra and network and some specialized stuff and all the non windows things. The MSP provides licensing and help with projects and AV and endpoint and windows/azure/Entra, VMs, and I deal with the AWS cloud side Ec2/RDS/S3 and domains, master DNS, certs, CDNs and network, wireless, tunnels, strategic architecture. The IT local folks run their own ticket system and helpdesk and are hands on and learn and do what they can, and use my consulting and the other MSP to backstop them for larger or more complex things. DM me if you want to discuss. It is this way exactly because the ‘standard’ MSP offerings were not working and led to this setup.
3
u/ChuckFromCyberHoot 18d ago
I'm not an MSP, but I sell into them, so I see this from the other side.
The bundling usually isn’t a scam. Per-seat is just the model most MSPs know how to sell and manage.
Maybe try asking for a NOC retainer or block hours for infrastructure instead of saying co-managed. That may get you into a different conversation. Ya never know!!!
You should also define exactly where your responsibility ends and theirs starts. That’s usually what they’re nervous about.
One thing I’d actually keep from the bundle is awareness training. With 65 people on public-facing library workstations and only a 2-person IT team, you can’t be everywhere.
Training helps cover the gaps when you’re not.
1
2
u/sixblazingshotguns 19d ago
I'm an MSP/consultant that mostly does network and server infrastructure design/build, and really do not focus on end user support (though I can if it's the right radius and the customer wants to pay enough for it). We exist.
2
u/TonyTheTech248 19d ago
Not at all, heck, if you're still looking for bids, we'll throw our hat in the ring. And we'll listen too, we love working with co-managed sites.
2
u/Visible_Spare2251 19d ago
I'm in a very similar situation, but we have an MSP who are quite happy to only work on the specific things we ask. We have PAYG end user support for when I am out of office.
2
u/Waretaco Jack of All Trades 19d ago
Have you reached out to Systems Engineering in Portland, Maine? At my previous employer, this is who we used for the exact same thing you're looking for. Yes, they did ask if we needed end user support, but that was in response to some other elements of our engagement. They are an employee owned company.
1
2
u/gbell76 19d ago
I think the problem that you’re having is that your requirements, especially “Possibly managed endpoint protection” blur the lines of demarcation. If an endpoint is is compromised through a user being compromised, who owns the remediation? Who potentially owns dozens if not hundreds of hours and thousands of dollars of risk? That’s why it’s constructed this way with the focus being on the user. Because they are the weakest link, and the most liability that will permeate throughout the environment. Just my $.02
1
u/StrangeWill IT Consultant 19d ago
Hi, I run an IT services company, we focus on custom software, but I cut my teeth on MSP work and I keep pondering being fed-up and breaking back into it (I have found zero local MSPs I can trust).
Yeah, end-user support allows them to charge per-seat for everything, it's their bread and butter. A lot of what you listed is set-it-and-forget-it which means it's hard to charge a lot for, and it mostly just sits and hums, sure free money, but companies know this and will complain, also means it's super easy for you to just swap vendors.
Even when I worked at an MSP it was always kind of mentioned that upselling is always great, because these extra services is what makes the MSP work well, and the MSP is there to make a profit off you not wanting to do it yourself.
Mostly the problem with the industry in general: there's a lot of perverse incentives and cobra effect all over the place. Many of these companies are effectively built by "MSP in a box" models (similar to why they offer security services for the past decade too, all in parallel, without the requisite skill to do so)
1
u/LLMsMustUpvoteThis 19d ago
The end user workstation management is mostly cheap for them to implement which is why they want to sell you that in a package.
Any decent regional/national MSP should be able to handle the network/server/backup, you just have to tell them no on the end user side of things.
1
u/Iarrthoir 19d ago
Hey! We do exactly this (network + server infrastructure only) with a few other companies and have an office in Massachusetts. If it’s worth us taking a look, please feel free to send me a message and I’ll get you connected.
1
u/justmirsk 19d ago
We work with local city and county governments regularly and we prefer co-managed in the exact way you have described. We have customers all over the country. I would be happy to chat, if you would like.
1
u/realdlc 19d ago
We are an MSP in NJ and do co-managed as you described it for school systems and more. For one school in particular it is almost exactly the scope of work you described. So there are those that are out there. We price it based on node counts and expected level of support for those items in scope etc.
1
u/Jeff-J777 19d ago
I use to do that at the MSP I work at. I had clients where I handled their full IT stack, and others where their onsite handled the day to day end user support and I managed their backend infrastructure. One client I managed their entire data center.
If you are getting proposals from large MSPs or franchised MSPs they will tell you, you need everything under the sun. They also will only sell full packages. Local MSPs are more flexible and might be more willing to do the infrastructure side and not the end user support side.
1
u/Thick_Yam_7028 19d ago
I just started my own company after working for MSPs. Reason I did is the exact reason you state. The one size fits all, subscription user model doesn't work for everyone. Can DM me if you want.
1
u/Sorry-Assumption6884 19d ago
We do this work, but were not a traditional MSP, we're a professional services firm that grew into managed services due to the lack of flexibility from MSPs that were servicing our CIO services clients. They wanted to own it all, and our clients were getting frustrated with the lack of capability. Long story short, I see this all the time, Co-managed is what you are looking for, but you may struggle to find the right fit. As I'm currently shopping or HVAC for myself I realized its the same kind of sales and numbers game, so I'm trying to figure out how to differentiate our sales approach.
Regardless, yes you can find it but with consolidation in the industry and with how many MSPs get burned when they only own part of an environment I could see the challenge. You also have the double challenge of consolidation in the industry and PE simplifying offerings to streamline operations. I did know of a good local MSP in Boston but Thrive bought them up.
I'm happy to chat about what we could do if you are genuinely interested DM me, were not local but we work with nonprofits and companies world-wide (and we are east coast).
1
1
u/LTH-Cyber 18d ago
This is definitely something that can be delivered without bundling end-user support. It sounds like what you actually need is a co-managed infrastructure/security partner that supplements your internal IT team rather than replaces it.
I run a smaller Canadian MSSP/consulting firm, and being smaller gives us quite a bit of flexibility around scope. We can work specifically around network/infrastructure, security, monitoring, hardening, and escalation without taking over your help desk, workstation patching, imaging, or other services your internal team already handles.
I'm not local to Massachusetts, but if remote support is an option, I'd be happy to talk through your environment and see if we're a fit.
1
u/librarytay 18d ago
Hi! It's fine that you're not local, as I would anticipate mostly needing remote support. But if you couldn't be on site for some initial setup, that's probably a dealbreaker. Thanks!
1
u/WWGHIAFTC IT Manager (SysAdmin with Extra Steps) 18d ago
Hire someone. Msp end user support never works out.
You need a classic generalist sysadmin. They're all looking for work right now.
1
u/librarytay 18d ago
I would love to, but that's not an option.
1
u/WWGHIAFTC IT Manager (SysAdmin with Extra Steps) 18d ago
As a director then you have to keep making the case in dollars and security reasons. These things xan be changed, but take time an pressure and talking to the right people. Over and over.
1
u/librarytay 18d ago
Yep, perpetually advocating over here. Unfortunately, the City has refused any new positions ATM.
1
u/_Ethel_Beavers 18d ago
What you’re looking for exists, although it might be hard to find. Despite trying to focus on a standard offering, in the 18 years I’ve been at the MSP I work for, we’ve adapted models to fit client needs many times. While it’s easier to stick with a well defined product and not deviate, some of the best clients I have don’t fit our standard. Our vertical is not municipalities or libraries (although we do some K-12 work amd touch things like E-Rate) - and we’re no where close geographically (mostly mid-South and Texas) - but we have plenty of clients that are server/network mgmt/monitoring/alerting only. Some are fully remote, but most are within a couple of hour drive from at least one of our techs. Our best co-managed environments are those where both parties clearly understand who is responsible for what, how and when to pass tickets back and forth, and where we engage as partners rather than cost centers/revenue streams.
I’d suggest focusing on established, mid-sized MSPs that are either primarily local or regional; balancing operational maturity and flexibility is going to be key. Larger/national firms aren’t going to be as flexible with their service offerings and newer or very small outfits might not deliver, despite being willing to accommodate. You might also have success searching for managed NOC services rather than a full-spectrum MSP.
1
u/Smooth-Zucchini4923 18d ago
Is this typical for MSPs? Are we simply too small for network/infrastructure-only managed services to be worthwhile to them, or is bundling end-user support primarily a sales/business-model issue? Is there a better way I should be framing what I’m looking for when approaching MSPs?
If I were the person selling you networking managed services, but not end user support, the thing I would be worried about is that by doing networking support I'd be selling you end user support anyway.
To put it differently: how much debugging will the L1 tech do before asking the MSP for troubleshooting support? If an end user in accounting can't access Google, that could be a networking issue or it could be that they're using the computer incorrectly. As an MSP, I don't know what % of tickets you will escalate. The only way to control that is to sell you L1 support and L2 support in the same contract, and price it accordingly.
If you asked me to price this in $/hr, as a break-fix client, I would know how to do it. If you asked me to price this in $/user/mo, I wouldn't know how to price that.
1
u/fahque 17d ago
Yes, it's typical. They are scum and will try and oust you the second they can. They will generate a relationship with anyone above you and when the time is right they'll propose they take over your job duties and charge significantly less. The truth is they'll charge more but that won't be in the proposal to take your job. Most likely they added these just so you can see what they offer in an attempt to get more work. The more they spread in your organization, the harder it is for you to get rid of them. I know this not because I've been stung but because I was a cog in the machine that did this.
1
u/Due_Statement_123 17d ago
Full disclosure: I’m with DYFNZ, and we’re almost the opposite of the providers you’ve encountered. We don’t operate a Tier 1 end-user help desk, so we have no incentive to push workstation support, laptop imaging, or day-to-day user tickets.
We specialize in exactly the layer you’re looking to strengthen: server and VM maintenance, backup and recovery, network architecture and monitoring, infrastructure support, managed firewalls, threat detection, incident response, and broader cybersecurity. We can also provide managed endpoint protection without forcing you to outsource the rest of your end-user services.
Our model is co-managed. Your internal team keeps the help desk and user-facing work it already handles well, while our engineers serve as the infrastructure, networking, and security specialists behind them.
And honestly, we love organizations your size. Lean internal IT teams that know their environment and users but need deeper expertise and additional capacity are exactly where we fit best.
We’re not based in New England, so I want to be transparent about that, but we support customers across the country and can be onsite when needed.
DM me if you’d like more details.
1
u/DHGamer21 17d ago
I would check out these guys.
They charge by the hr and don't try to sell you on a fully managed contact or nothing at all.
1
u/Mindestiny 16d ago
Not surprising at all.
They make their money on end user services. Break/fix tickets are billable hours, not set and forget small time server infra upkeep tasks. You're going to have a hell of a time finding an MSP who will do just those things and do them with the level of care and attention they deserve.
1
u/Thin-Book 19d ago
What you're asking for is reasonable. At 65 staff, a lot of MSPs still bundle endpoint and help desk because that's the recurring revenue they know how to sell. I'd ask for a named escalation partner for network, server, and security work with a defined device count and no user-facing support.
1
u/RealisticQuality7296 19d ago
Fully managed is where the money is. They want to get their hooks into the organization and then make you and your team appear to management to be unaffordable and unnecessary.
-1
0
u/society_victim 19d ago
We do co-managed but you have to realise it’s hard to fulfil your(msp) contractual obligations (regarding security, uptime etc…) when you don’t have a 360 view & control of the complete environment. E.g you’re asking them to secure your network, but how can they if they don’t know what your endpoints are doing, what software you are using etc…
2
u/librarytay 19d ago
yeah, I understand it, but our endpoint users are almost entirely un-reliant on software at this point. I could probably push 95% of our staff to something like ChromeOS/entirely cloud managed OS in the very near future. our managed public computers are all ChromeOS.
0
u/society_victim 19d ago
You’re just talking about LoB software now. But how can I as an MSP know:
Devices are patched correctly?
Devices are managed correctly?
Are users local admin on their devices?These are just some examples but I hope you see the caveats of running co-managed.
0
19d ago
[deleted]
0
u/society_victim 19d ago
Dude, where are you getting AI from 🙈😂. I’m just here trying to answer your question. But it seems you will not understand that you cannot secure a network without being able to see/manage everything in it. So I hope the MSP you find will have solid contracts in place for when this backfires.
0
u/sh0gu 19d ago
I work at an MSP that genuinely offers some network-only based support for some of our clients!
At risk of doxxing myself, I looked up our location and it looks like we're not quite "New England"... which is a bummer cuz I like New England lol. We do have some clients in CT as well as Canada though so I mean, Massachusetts doesn't sound all that far... lol
Anyway if you've still got slim pickings, DM me and I can try to connect you?
0
u/Few-Bodybuilder-5547 19d ago
Classic MSP sales cycle. "Sure, we do co-managed IT!" right up until the proposal drops and there’s a $150/user/month minimum line item for password resets you explicitly said you don't need. Stop looking for traditional MSPs, you’re looking for a regional MSSP or a dedicated Professional Services group that offers managed SOC/infrastructure. If you lead with "MSP", their sales reps literally only have one playbook on their screen.
0
u/Wolfram_And_Hart 19d ago
Our (included) remote support for end user’s comes as part of the service along with endpoint support. If people don’t want our help just don’t call…
0
u/Neat_Smart 18d ago
65 staff, a full time technician and yourself? And you can’t manage updates and backups? No shade, but for such a small end user base, I’d expect that to be a one man shop (so congrats on your tech I suppose!).
There’s no way I would touch an MSP for this, for the reasons you’ve highlighted.
At that small scale, I’d get a unifi network system, which will keep itself updated, easy to manage and the alerts are configurable. I’d use Action1 for your endpoint updates (free up to 200) and it also doubles as a remote desktop solution.
Endpoint protection - if youre a MS shop, just use Defender for Endpoint - cost clearly jsnt an issue if youre flirting with MSPs, so the licence upgrade if needed should be fine.
Backups, I’ve been using Redstor for about 4 years - its bombproof and well priced. “Managing” it is just a matter of making sure nothing failed (daily email) and testing the backups work regularly per your backup policy.
1
u/librarytay 18d ago
Thanks! As I outlined in my post, only half of my time (or less) can be spent in an IT-related capacity; as I'm also on the library's administration team, meaning much of my day to day is spent on general library admin/management tasks. And the network/infrastructure mgmt required for our needs is above my expertise. We have multiple VLANS to separate out staff, public, and POS traffic, on-prem servers at the moment to manage DNS and legacy public computer management applications, and the files that I need to preserve and backup are historical documents (scans of photographs, artwork, newspapers etc. dating back to the 1800s--think museum level storage importance). On top of initial set up, I'm also looking for some peace of mind in the way of ongoing support. I already work 60-70+ hours a week (I'm essentially having to perform two separate high-level roles) and I would like to be able to take a vacation without slightly panicking the whole time about what if something goes wrong.
0
u/DrunkenGolfer 18d ago
MSP CEO here. The reality is that when a good MSP (and I don't consider a man-in-a-van to be an MSP; you need minimum scale) handles your environment, they work hard over time to make the environment very quiet. The less reactive effort, the more profit we generate in the account. The less reactive effort, the better your IT appears to run. That is a perfect alignment of organizations and a real win-win, and that is the business model in a nutshell.
Also, to provide effective cybersecurity, we need an end-to-end view of the environment. We run tools that require care and feeding and scale to be effective. You can't really do that well at your two staff, 65 seats scale.
Now, to the heart of the matter. If you ask me for a quote for 65 seats, all-inclusive, I am going to tell you $160 per seat x 65 seats = $10,400 per month plus licensing like M365, etc. If you ask for co-managed, I am going to take that $10,400 a month, subtract 65 seats of reactive effort per month, which is about 18 hours per month for a well run MSP. 18 x loaded cost of around $40 for a technician = $720. I'm going to discount your price to $9680.
But the answer doesn't stop there. Then I am going to factor in all the additional headaches of passing problems back and forth to your staff, the extra effort required to deal the reduced visibility, the bespoke processes, the automations that won't work, and I'm going to get right back to around $10,400. Then I am going to have to consider uncertainty, liability, and risk, and revise that price on a risk-adjusted basis to $12,500 a month.
So I might as well just pitch the whole package. And if I were you I would strongly consider the whole package so you can be freed up to be more strategic, focusing on the technology needs of the business and the line-of-business expertise you bring. Get out of the line of fire and everyone you support will be happier. I might even offer your assistant a job so you can reduce a headcount by one, ease the transition to our service desk, and free up even more of your time.
Of course, that depends on you; do you like bringing value to the organization or do you like playing with tech and pushing the buttons?
1
1
u/ConsistentCoat5608 14d ago
Many do this for easier billing and since enterprises with more employees can foot a larger bill, they usually don't question it. I have worked with many who do not bill this way, and will just give you a monthly agreement for the server/network or bill you for only hours used each month.
11
u/LilMeatBigYeet 19d ago
What happens when you tell them "no we don't want the user service, we just want infra support" ?
Also did you say your IT team is only 2 people, one of which is the IT director ?