What £50–150 Per User Per Month Actually Buys from a UK Managed Service Provider

Procurement teams at UK mid-market organisations face a peculiar problem when sourcing managed IT services: there is no standard price list. One provider quotes £45 per user per month for what another charges £120. The scope behind each figure varies wildly, the terminology shifts from one proposal to the next, and the SLA commitments range from rigorous to deliberately vague. The opacity is not accidental. Managed service providers benefit from making direct comparison difficult, which is precisely why procurement professionals need an independent benchmarking framework before entering negotiations. This guide exists to arm procurement teams with a GBP pricing framework that maps what each price band should include, what contractual commitments to insist upon, and where providers routinely hide margin in ambiguous line items. The figures draw on Canalys channel forecasts, Kaseya's global MSP benchmarking data, CompTIA's UK channel research, and interviews with procurement leads who have negotiated these contracts across professional services, manufacturing, and financial services verticals. Whether you are re-tendering an existing contract or sourcing managed IT for the first time, the tier definitions and SLA floors in this guide give you a defensible baseline for evaluating every proposal that lands on your desk.

Why UK MSP Pricing Is Opaque by Design

Managed service providers in the United Kingdom do not publish rate cards. This is deliberate. Unlike commodity software licensing where list prices are discoverable, MSP pricing is built around bundled scopes that make direct comparison difficult. A provider quoting £60 per user per month might include endpoint security, patching, and a four-hour response SLA. Another quoting the same figure might exclude endpoint security entirely but bundle in on-site support visits. The absence of a standard framework benefits providers and disadvantages buyers, particularly procurement teams who lack the technical background to interrogate what sits behind each line item.

Canalys research on the UK channel market shows managed services revenue growing at 13 per cent year-on-year in 2025, outpacing hardware and project-based work. That growth attracts new entrants — IT resellers bolting a monitoring tool onto their existing break-fix practice and calling it managed services. The result is a market where pricing tells you very little unless you know exactly what each tier should contain. The problem is compounded by the fact that MSP proposals are typically structured around bundles — bronze, silver, gold — where the naming convention tells you nothing about what is actually included. Two providers offering a "gold" package may deliver entirely different service scopes, making like-for-like comparison impossible without a standardised specification.

Kaseya's global MSP benchmark report, which includes a meaningful UK and European sample, puts the median per-user price at $100–150 per month (roughly £80–120 at current exchange rates). But that median masks enormous variation. Providers serving regulated industries or offering compliance-aligned services sit at the top of the range. Those offering monitoring-only or shared-desk support sit well below it.

Tier One: Basic Managed Services — £30–50 Per User Per Month

At the entry level, a UK MSP charging £30–50 per user per month should deliver a defined set of services that keep the lights on and the obvious threats out. This tier is appropriate for organisations with low regulatory exposure, limited compliance requirements, and staff who are broadly capable of self-service for common IT tasks.

The baseline should include remote monitoring and management (RMM) of all endpoints and servers, automated patch management for operating systems and core applications, a cloud-hosted helpdesk with ticket logging and email support, standard antivirus or modern endpoint protection, and basic backup for critical data with a daily recovery point objective.

What procurement teams should watch for at this tier: response times are typically measured in business hours, not clock hours. A "four-hour response" SLA at this price point almost certainly means four business hours — so a ticket raised at 4pm on Friday gets a response by noon on Monday. Uptime commitments at this level are rarely backed by financial penalties. If the provider offers a 99.5 per cent uptime SLA with no service credits for breach, the commitment is aspirational rather than contractual.

The red flags at this tier are providers who bundle hardware procurement margin into the monthly fee without disclosing the markup, or those who define "managed" as monitoring dashboards without any proactive remediation. If the provider's response to an alert is to email your internal team and tell them to fix it, you are paying for a dashboard, not a managed service.

Procurement teams should also scrutinise the helpdesk model at this tier. Shared-desk arrangements where your tickets enter the same queue as hundreds of other clients are standard at this price point, but the target response and resolution times should still be documented. Ask for the provider's average first-response time and mean time to resolution across their base — any credible provider will have these figures available from their PSA tooling.

Tier Two: Mid-Range Managed Services — £50–80 Per User Per Month

The mid-tier is where the bulk of UK mid-market contracts land. At £50–80 per user per month, the service should extend meaningfully beyond basic monitoring into security, compliance support, and proactive management.

This tier should include everything in Tier One plus: advanced endpoint detection and response (EDR) tooling with 24/7 monitoring, security information and event management (SIEM) or equivalent log analysis, a dedicated service desk with phone support and defined escalation paths, quarterly business reviews with a named account manager, proactive capacity planning and technology roadmap input, Microsoft 365 or Google Workspace administration and optimisation, multi-factor authentication management and identity governance, and regular vulnerability scanning with remediation tracking.

SLA commitments at this price point should tighten considerably. Critical incident response should be guaranteed within 15 minutes, measured in clock hours, not business hours. Uptime commitments should sit at 99.9 per cent minimum with service credits attached — typically 5 per cent of the monthly fee per 0.1 per cent below target. Patch compliance should be reported monthly and should sit above 95 per cent of estate within 14 days of release.

CompTIA's UK channel research highlights that mid-market buyers increasingly expect their MSP to hold Cyber Essentials Plus certification as a baseline. Procurement teams should treat this as a non-negotiable qualifier at this tier, not a differentiator. Beyond Cyber Essentials Plus, ask whether the provider's internal operations align with ISO 27001 or SOC 2 Type II. A provider that holds these certifications for their own environment is far more likely to apply disciplined security practices to your estate than one that treats certification as a sales exercise.

The margin traps at this level are more subtle. Watch for providers who quote EDR but deliver basic antivirus with a different label, or who promise 24/7 monitoring but outsource overnight coverage to a third-party SOC without disclosing the arrangement. Ask specifically whether the SOC is in-house, outsourced, or a vendor-provided service (such as Huntress or Arctic Wolf), and whether the provider's own analysts triage alerts before they reach your team.

Tier Three: Fully Managed IT with Advisory — £80–150 Per User Per Month

At the top of the range, a fully managed engagement should function as a near-complete outsourced IT department with strategic advisory layered on top. This tier suits mid-market organisations in regulated sectors — financial services, legal, healthcare, or any business handling sensitive personal data at scale.

This tier should include everything in Tiers One and Two plus: a named virtual Chief Information Officer (vCIO) providing quarterly strategic planning, full compliance management aligned to frameworks such as ISO 27001, Cyber Essentials Plus, or sector-specific standards, managed detection and response (MDR) with dedicated analyst time, full Microsoft 365 security stack management including Defender for Endpoint, Intune, Conditional Access, and Data Loss Prevention policies, identity and access management with privileged access controls, business continuity and disaster recovery planning with tested failover, vendor management for third-party software and hardware suppliers, and on-site engineering days included in the contract rather than billed separately.

SLA expectations at this tier should be the tightest in the market. Critical incident response within 15 minutes with resolution targets attached — not just acknowledgement but active remediation underway. Backup success rates reported weekly and held above 99 per cent. Documented root cause analysis for every Priority 1 incident. Annual penetration testing included in scope rather than sold as an add-on.

The distinction between a genuine Tier Three provider and a Tier Two provider charging Tier Three prices often comes down to the vCIO function. If the strategic advisory amounts to a quarterly slide deck rehashing the previous quarter's ticket volumes, you are not receiving Tier Three service. A credible vCIO engagement should produce a rolling three-year technology roadmap, budgetary forecasts aligned to your financial year, and recommendations that occasionally involve reducing the MSP's own scope where that serves your interests — for example, recommending an in-house hire for a function that does not justify outsourced rates.

The SLA Benchmarks That Matter

Pricing without SLA context is meaningless. A provider quoting £120 per user per month with vague response commitments is a worse deal than one quoting £70 with tight, penalty-backed SLAs. Procurement teams should benchmark against these floors, drawn from Kaseya's benchmarking data and CompTIA's UK research.

Critical incident first response should be 15 minutes or less, measured 24/7/365. High-priority incidents should receive a response within one hour during extended business hours (7am–9pm). Standard requests should be acknowledged within four business hours and resolved within eight. Uptime across managed infrastructure should be guaranteed at 99.9 per cent minimum with documented service credits. Patch compliance should sit at 95 per cent or above within 14 days of release, reported monthly. Backup success rate should be 99 per cent or above, reported weekly. Mean time to resolution for all incidents should be reported monthly with a target below 24 hours.

Kaseya's benchmark data shows the average ticket resolution time across MSPs globally sits at 25.6 hours. UK providers serving the mid-market should beat that figure comfortably — if they cannot, the operational maturity is not there to justify mid-tier or premium pricing.

Where Providers Hide Margin

Every procurement professional negotiating an MSP contract should understand the five places where margin is typically embedded beyond the headline per-user price.

First, project work carved out of scope. The monthly fee covers business-as-usual, but any change — a new office, a migration, a new application deployment — is billed at day rates that often exceed £1,000 per engineer per day. Insist on a clear definition of what constitutes BAU versus project, and negotiate a capped day rate for project work written into the contract.

Second, hardware and software procurement markup. Providers buy at channel pricing and sell to you at list price or above. The margin on a laptop can exceed 20 per cent, on networking equipment even more. Either negotiate pass-through pricing with a transparent handling fee or procure hardware independently.

Third, licence management fees. Some providers charge a per-user administration fee on top of the Microsoft or Google licence cost, typically £2–5 per user per month. This is reasonable if it includes genuine optimisation — licence right-sizing, security configuration, compliance reporting. It is unreasonable if the administration amounts to annual renewal processing.

Fourth, out-of-hours support surcharges. If the contract specifies business-hours support with out-of-hours available at a premium, check the premium rate. Some providers charge 150–200 per cent of their standard rate for out-of-hours incidents, which can turn a single weekend server failure into a four-figure invoice.

Fifth, exit costs. Termination clauses in MSP contracts frequently include data extraction fees, knowledge transfer charges, and minimum notice periods of 90 days or more. Negotiate these at the point of signing, not at the point of leaving. A clean exit clause with 30 days' notice and data provided in standard formats should be achievable at any tier.

How to Run a Credible MSP Procurement

With the pricing benchmarks and SLA floors established, the procurement process itself should follow a structured approach that prevents the comparison problem described at the outset.

Start by defining a service specification before approaching the market. Map your current IT estate — user count, device count, server count, application estate, compliance requirements — and write a scope document that every bidder responds to identically. This eliminates the problem of comparing proposals that bundle different scopes.

Request pricing in a standardised format: per-user per-month for the managed service, with separate line items for any project work, hardware, or one-off costs. Insist on a three-year total cost of ownership calculation that includes annual uplifts — providers frequently quote a competitive year-one rate and apply 5–8 per cent annual increases that compound significantly.

Ask for three references from organisations of a comparable size and sector. Speak to the references without the provider present and ask specifically about SLA adherence, responsiveness to escalations, and whether the provider has ever issued service credits without being asked.

Finally, include a benchmarking clause in the contract that allows you to review pricing against market rates at the 18-month mark. The managed services market is maturing rapidly, and a rate that was competitive in 2026 may be above market by 2028. A benchmarking clause protects you without requiring a full re-procurement.

One final consideration: involve your IT leadership in the evaluation even if procurement owns the process. The technical depth of MSP proposals requires someone who can distinguish genuine capability from marketing language. A joint scoring matrix — weighting commercial terms, technical scope, SLA commitments, and cultural fit — produces better outcomes than leaving either function to evaluate in isolation.