If you run a UK business with 10 to 200 staff, you’ve probably had a conversation about “fully managed IT” that ended without much clarity. The phrase means different things to different providers — and that ambiguity costs money. Some contracts marketed as “fully managed” only cover monitoring; others cover everything up to and including your compliance paperwork. The gap between the two is often £30–£50 per user per month, and the difference in what you actually get is enormous.

This guide gives you the plain-English version: what “fully managed” should mean in 2026, what to be sceptical of, and how to score a contract you’re being pitched. No jargon, no vendor spin, and no filler.

Why the phrase matters (and how to read it)

“Fully managed” was originally a distinction from “break-fix” — the old model where you paid an IT provider only when something went wrong. Break-fix creates a perverse incentive: your supplier makes more money when your systems fail. Fully managed flips that. You pay a fixed monthly fee, and your supplier only stays profitable if they can keep things running smoothly.

The catch: it’s now a marketing term. Nine out of ten UK MSP websites use it. What actually differentiates a real fully managed service from a “managed-branded” break-fix contract is what’s in the SLA, what’s in the exclusions list, and whether you can name specific commitments without opening the paperwork.

By the end of this page you should be able to look at any managed-IT quote and say: “This one covers the ten core components — this one doesn’t.”

The 10 core components you should expect

1. Proactive monitoring and 24/7 automated response

What it is: Continuous monitoring of every server, workstation and firewall — plus automated remediation for common issues (a stuck Windows update, a full disk, a Defender status flip) without a human ticket in the loop.

Why it matters: Ninety per cent of endpoint issues have a scripted fix. A modern MSP resolves them before you notice. Ask specifically: “What percentage of your alerts get auto-remediated before they reach a technician?” If the answer is “we look at every alert manually” — that’s a red flag disguised as attention to detail.

2. Patch management (including third-party apps)

What it is: Automated Windows patching AND third-party patching — Chrome, Zoom, Adobe, TeamViewer, the long tail of desktop apps that get exploited between Microsoft Patch Tuesdays.

Why it matters: The NCSC’s 2024 annual review put unpatched software in the top three breach causes for UK SMEs. Windows Update alone doesn’t cut it — the Chrome vulnerability on Tuesday won’t be fixed by Wednesday’s WSUS run. Ask: “Do you patch third-party apps, and how often?”

3. Backup, disaster recovery and ransomware isolation

What it is: Automated backups with tested restore procedures, defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs), and immutable storage that ransomware can’t encrypt in-place.

Why it matters: Untested backups are a false comfort. A significant minority of businesses hit by ransomware in the UK find at some point that their backups also got encrypted, or their restore procedure hadn’t been tested and doesn’t work. Ask for the last successful restore test date. If they can’t tell you, treat it as though there aren’t any backups.

4. Cybersecurity aligned to a UK standard

What it is: Endpoint protection, MFA enforcement, conditional access policies, phishing simulation and a documented incident response plan — mapped to Cyber Essentials, Cyber Essentials Plus, or the NHS Data Security and Protection Toolkit (DSPT) for healthcare providers.

Why it matters: “We do cybersecurity” is meaningless. “We help you achieve and maintain Cyber Essentials Plus certification” is a commitment you can hold someone to. If you’re in healthcare, DSPT is not optional — it’s a contractual requirement for handling patient data. Ask which standard your provider maps to and whether certification support is included in the monthly fee or billed as a project.

5. Helpdesk with realistic SLAs — and a UK service desk

What it is: Defined response and resolution times per priority level, a named point of contact for your account, and staff you can actually understand on the phone.

Why it matters: The SLA is only meaningful if it’s enforced. A “1-hour response” that’s actually an automated ticket acknowledgment is not a response. Ask: “When you say 1-hour response, do you mean a human engineer investigating, or an email confirming you received the ticket?” Aurora’s target is a human engineer looking at high-priority tickets within 30 minutes during working hours — the auto-acknowledgment is separate and instant.

6. Hardware lifecycle and procurement

What it is: Advice on device refresh cycles, warranty tracking, procurement at wholesale pricing, and asset disposal that meets UK data-destruction standards.

Why it matters: Buying laptops through your MSP should be cheaper than direct — because they buy through UK distributors at scale. If your quote is more expensive than John Lewis, you’re being marked up. And when the laptop retires, the drive needs to be sanitised to a documented standard (NCSC-approved erasure or physical destruction with a certificate). Skipping this step is a GDPR breach waiting to happen.

7. Cloud services and Microsoft 365 administration

What it is: Full administration of your Microsoft 365 (or Google Workspace) tenant — licence rightsizing, security configuration, SharePoint architecture, mailbox management, and cost control on the cloud bill.

Why it matters: Microsoft 365 quietly moved most SMEs’ security posture into the cloud. If your MSP treats M365 as “we set up the mailboxes and moved on”, they’re leaving 80% of the security surface unmanaged. Ask specifically about Conditional Access, Sensitivity Labels and licence audits.

8. Vendor and third-party management

What it is: Coordinating with your line-of-business software vendor, your telecoms provider, your printer supplier — so you don’t spend Tuesday afternoon on hold with three different companies pointing at each other.

Why it matters: Vendor bounce-back is the number one time-drain in SMEs without an internal IT function. If your MSP won’t get on the call with your finance software vendor, you’re paying office-manager wages to do IT project management.

9. Compliance reporting and evidence packs

What it is: Monthly or quarterly reports covering patch compliance, backup success rates, security incidents, licence usage — and an evidence pack ready when auditors, insurers or clients ask for it.

Why it matters: When your cyber insurance renewal asks “what percentage of endpoints were patched within 14 days last quarter?”, the answer needs to exist before you’re asked. When a big client’s procurement team runs a security assessment on you, the evidence pack is your ticket into the shortlist. Reactive compliance is expensive; documented compliance is a sales advantage.

10. Strategic IT planning (with a real IT director)

What it is: Quarterly business reviews with someone who understands your industry — not a generic account manager reading a spreadsheet.

Why it matters: IT investment decisions have a lifespan of three to five years. If you’re planning a hybrid working overhaul, a new office, a merger, or a compliance audit, you need someone who’s seen it before. Ask whether your provider does formal quarterly reviews and what a typical roadmap looks like — the answer tells you whether they’re a technical shop or a strategic partner.

What “fully managed” shouldn’t include (and the red flags)

Some things dressed up as “fully managed” are anything but. Watch for:

• “24/7 support” that’s actually 8×5 with an emergency line. Ask specifically who answers a Saturday night call, and what their hourly rate is if it turns out to be a “P1 emergency callout”.
• Monitoring with no automated remediation. Real modern MSPs auto-fix most alerts. “We monitor and alert you to issues” means you’ll be paying support fees to be told about problems.
• Onshore desk that’s actually offshore. UK-registered doesn’t mean UK-answering. Ask: “Where is the person picking up my ticket physically sitting?”
• Vague or missing SLAs. “Best endeavours” is not a service level. Insist on numeric response and resolution times per priority.
• No exit plan. If the contract doesn’t say how you get your data, your licences, your admin credentials and your documentation when the relationship ends, you’re being fenced in.
• Suspiciously low headline fee, with a long list of “not included”. The proper comparison is total cost of ownership, not the sticker. Ask for a fully-loaded quote covering everything you’d realistically need in a year.

What a real onboarding looks like — and why the exit plan matters equally

A proper onboarding is a project, not a form. Expect a discovery audit of your current estate (usually a week), a documented “as-is” and “to-be” architecture, a phased migration schedule, and named training for your team. Small standardised businesses can be onboarded in 3–6 weeks; larger multi-site or regulated environments (healthcare, finance) can take 2–4 months.

The exit plan matters just as much. A trustworthy MSP will document upfront how you get your data out (formats, timeline), how ownership of licences transfers (M365, Adobe, backup subscriptions), and how administrative access hands over. If you can’t get a clear answer on the exit process during the sales conversation, that’s the same as being told you can never leave.

Predictable pricing — with honest ranges

In the UK in 2026, fully managed IT typically prices at one of two shapes:

• Per-user models: around £45–£75 per user per month, covering their laptop, mobile and cloud services. Better fit for knowledge-worker businesses where one person uses multiple devices.
• Per-device models: around £75–£150 per endpoint per month, covering the physical machine. Better fit for shift-based businesses (retail, manufacturing floors, healthcare wards) where multiple people share the same device.

Additional costs to expect on top of the base fee: server management (a monthly per-server fee), Microsoft 365 or Google Workspace licences (billed at wholesale + a small margin), specific compliance projects (Cyber Essentials certification, DSPT audit prep), and hardware.

What should not be a separate line: routine helpdesk tickets, patch management, backup monitoring, monthly reporting. If you’re seeing those on a per-incident invoice, it’s break-fix wearing a subscription costume.

The Yorkshire (and broader UK) reality

Aurora is based in Leeds and supports businesses across Leeds, Harrogate, Wetherby, Ilkley, York, Bradford and the wider Yorkshire region — plus healthcare clients across the UK. That local grounding matters more than it sounds:

• On-site coverage: Some issues genuinely need boots on the ground — a physical server needing a new drive, a broken printer, a cabling job. If your MSP is 200 miles away, your on-site help costs a day of travel per visit.
• Connectivity realities: Aurora has spent years dealing with the actual mix of infrastructure across Yorkshire — from FTTP in Leeds city centre to slower connections in Wharfedale and rural North Yorkshire. A national MSP handling everyone from London to Aberdeen doesn’t build in that local nuance.
• Supplier relationships: Local knowledge means knowing which broadband providers actually deliver in your postcode, which VoIP providers have UK peering that survives a router firmware update, and which distributors deliver in North Yorkshire on a Friday afternoon.

Score your current provider — a quick 10-point check

Reading this as an existing MSP customer? Score your provider against these ten items. Anything you’d have to phone them to check counts as a “don’t know”. Anywhere below 7/10 is worth a conversation — anywhere below 5/10 is worth a second-opinion review.

1. I can name my provider’s target response time for a P1 (high priority) issue — and it’s under an hour.
2. I know the date of the last successful backup restore test on my critical systems.
3. My M365 tenant has Conditional Access policies documented and MFA enforced on every user (no exceptions).
4. I have a report showing what percentage of my endpoints were patched within 14 days last quarter.
5. I know whether the person answering my helpdesk tickets is UK-based.
6. I have a documented exit plan — how my data and licences transfer if the contract ends.
7. I’ve had a strategic review meeting with my provider in the last six months (not just a helpdesk stat update).
8. My compliance evidence pack (patches, backups, incidents, licences) is prepared before my insurer or auditor asks.
9. My provider auto-fixes routine issues before they hit a technician’s queue.
10. I don’t get separate per-hour invoices for anything I consider “normal” IT support.

If you’d like Aurora to run this scorecard for you — no obligation, no sales-y follow-up unless you ask for one — get in touch and we’ll walk you through where you stand.

FAQ

Is fully managed IT expensive for a business our size?

Not compared to the total cost of the alternative. The proper comparison isn’t “monthly fee vs no monthly fee” — it’s “monthly fee vs (staff hours lost to IT issues + emergency call-out fees + downtime + one-off compliance projects)”. For most 10–200 staff businesses, the fully managed monthly cost is lower than the true cost of the ad-hoc alternative, and it’s predictable — which matters more than the raw number.

We’re in healthcare — do you support NHS DSPT compliance?

Yes. Aurora supports NHS Data Security and Protection Toolkit compliance as part of the standard managed service for healthcare clients. That includes the annual toolkit submission, evidence collection, policy templates, staff awareness training and audit-ready reporting. DSPT is not a bolt-on for us — it’s built into how we structure the service for practices, GP surgeries and healthcare-adjacent businesses.

Do you handle Cyber Essentials certification?

Yes. Cyber Essentials and Cyber Essentials Plus certification support is included for managed clients — we prepare the evidence, we sit the assessment with you, and we hold you to the ongoing controls afterwards. It’s a genuine differentiator for tender-winning and cyber-insurance premiums, and it’s a lot less painful than doing it from scratch every year.

Will we lose control of our systems?

No — you retain ownership of everything (licences, data, admin accounts). Aurora takes operational responsibility, but you have visibility through the dashboard and access via named administrators on your side. Nothing changes hands unless you specifically ask; nothing gets locked away from you.

How long does onboarding take?

3–6 weeks for a single-site business with standard Microsoft 365, in-house computers and no major legacy servers. 2–4 months for multi-site, hybrid, or regulated environments (healthcare, finance). We don’t do “big bang” cutovers — the migration is phased so day-to-day work continues throughout.

What if we want to leave?

Standard exit clause: 30 days’ notice, a documented handover pack (credentials, network diagrams, license transfers, historical tickets), and a return of your data in agreed formats. We’d rather you left cleanly than stayed unhappy — a fenced-in customer is a bad customer.

Can you support hybrid and home workers?

Yes. Secure remote access, endpoint management, home-office setup and troubleshooting are all standard. Increasingly the majority of a UK SME’s staff work at least partly from home — the managed service assumes that and is priced accordingly.

Final thoughts

The best fully managed IT service is boring — in a good way. It removes the surprise emergencies, the frantic Friday-afternoon calls, the “we forgot to renew that licence” moments. It replaces them with predictable monthly cost, evidence-backed compliance and a strategic partner who’s paying attention to what’s coming next.

If you’re evaluating providers, use the ten-point score above. If you’d like Aurora to run through your current setup with you — including the DSPT or Cyber Essentials angle if that’s relevant — get in touch on 0330 2235401 or drop us a note.

Darren Northfield founded Aurora Tech Support in 2003. Over the last 22 years he’s helped UK SMEs, healthcare providers and professional services firms across Leeds, Harrogate and the wider Yorkshire region get IT, phones and connectivity right. Specialist areas include NHS Data Security and Protection Toolkit (DSPT) compliance, Cyber Essentials certification, Microsoft 365 administration and business connectivity. Reach him on (0330) 2235401.