How to choose a managed IT provider, and the questions to ask
Shortlist three to five providers that support businesses like yours, confirm each one is the company it says it is, then compare them on what the contract covers, how fast they respond, how they protect their own access to your systems, and how you leave. Price comes after those, not before.
Before you talk to anyone
Write down what you have and what you need, so every provider quotes for the same thing: the number of users and devices, your offices and who works from home, the software you rely on, where your data lives, the hours you need support, and any standard you must meet (Cyber Essentials for a public-sector contract, a regulator's rules, a customer's security questionnaire). Note what goes wrong today. That list is your scope.
Make a shortlist
Three to five is enough to compare. Look for providers that support organisations of your size and sector, and ask each for two references you can call. The register lists managed IT providers by town: checked providers first, whose own website shows their company number and describes managed services, then every other company registered there under the closest code.
Confirm each one is real
A UK limited company must show its registered name, number and registered office on its website (the 2015 trading disclosure regulations, regulation 25). Find the number, look it up at Companies House, and check the company is active, its accounts are not overdue, and the directors are who you expect. The register's check page walks through each step and looks the company up for you.
The questions to ask
Service
- Which hours are covered, and what does out-of-hours support cost?
- What is the response time for an urgent problem, and is it written into the contract? Is it a time to respond or a time to fix?
- How is "urgent" defined, and who decides?
- How much is remote, and when will someone come on site?
Security
- How do you secure your own remote-access and management tools? Is multi-factor authentication enforced for every engineer?
- Do you hold Cyber Essentials Plus or ISO 27001, and what does the certificate cover?
- How are our backups tested, and how often?
- What happens, and who calls whom, if we are attacked?
Price
- What does one user include: how many devices, which services?
- What is charged as extra, and at what rate?
- Is there an onboarding fee? How are prices reviewed at renewal?
- Are licences bought through you, and at what margin?
People
- Who is our named contact, and who stands in when they are away?
- How many engineers do you have, and is any work subcontracted or offshored?
- Can we speak to two customers like us?
Leaving
- What is the minimum term and notice period? Does the contract renew automatically?
- When we leave, do we get every administrator account, password, licence and document, and at what cost?
- Who owns our Microsoft 365 tenant and domain names? (It should be you.)
The UK National Cyber Security Centre publishes its own guidance on choosing a managed service provider, focused on security, and it is worth reading alongside this list.
Warning signs
No company number on the website; reluctance to put response times in writing; the provider, not you, owning your Microsoft 365 tenant or the only administrator accounts; remote-access tools without multi-factor authentication; a long contract that renews automatically; and no written exit process.
Quick answers
How do I choose a managed IT provider?
Shortlist three to five providers that support businesses like yours, confirm each one is the company it says it is, then compare them on what the contract covers, how fast they respond, how they protect their own access to your systems, and how you leave. Price comes after those, not before.
What questions should I ask an MSP?
Ask what is included per user and what is extra; the support hours and the response time for an urgent problem; how they secure their own remote-access tools; whether they hold Cyber Essentials Plus or ISO 27001; who your named contact is; whether any work is subcontracted; the minimum term and notice period; and exactly what you get back when you leave.
How do I check an MSP is legitimate?
A UK company must show its registered number on its website. Look the number up at Companies House and check the company is active, filing accounts on time, and that the directors are who you expect. Ask for any certificate number and check it with the body that issued it. The MSP Register shows, for each checked company, the date its number was found on its own website.
What are the warning signs when choosing an MSP?
No company number on the website; reluctance to put response times in writing; the provider, not you, owning your Microsoft 365 tenant or the only administrator accounts; remote-access tools without multi-factor authentication; a long contract that renews automatically; and no written exit process.
Should I choose a local MSP?
Most support is done remotely, so distance matters less than it did. It matters if you need people on site for hardware, networks or a busy office, or if you want to meet the team. Ask how often they visit and what an on-site call costs.
Written 5 November 2026. Figures recomputed from the register on every build; these are from the register as retrieved on 5 November 2026.
New to the term? What a managed service provider is, and what one does.