Question 1

What's a healthy gross margin for managed services?

Accepted Answer

A healthy gross margin for MSP managed services is 65-75%. Below 60% means your stack costs too much or you're underpriced. Above 80% usually signals underdelivery or impending churn.

Question 2

How do I calculate my effective hourly rate?

Accepted Answer

Total MRR from a client divided by total hours spent on work covered by that agreement. Support tickets, QBRs, and admin time count. Projects typically don't; they're priced separately. Most MSPs are shocked when they do this math. A $150/user client often nets $40/hour when you count everything included in the agreement.

Question 3

Should I price per user or per device?

Accepted Answer

Per user is cleaner for forecasting and scales better with remote work. Per device made sense when employees had one workstation. Now they have three. Per user wins unless you're supporting manufacturing floors or labs.

Question 4

What's the average revenue per endpoint for MSPs?

Accepted Answer

$100-200/endpoint/month for full stack. Lower end is basic RMM/AV. Higher end includes security stack, backup, vCIO, and compliance. Know your number and trend it monthly.

Question 5

What percentage of MSP revenue should be recurring?

Accepted Answer

70-80% minimum. Higher is better for valuation and stability. Below 60% means you're running a project shop that happens to do some managed services. That's a harder business to scale and sell.

Question 6

What pricing models work best for MSPs?

Accepted Answer

Per-user all-inclusive is the cleanest. Tiered packages (Good/Better/Best) work for sales teams. Per-device still works for infrastructure-heavy clients. Avoid hourly - it punishes efficiency and creates misaligned incentives.

Question 7

How long should an MSP quote take to create?

Accepted Answer

Under 30 minutes for a standard deal. If you're spending hours building quotes, you either lack templates or you're over-customizing. Both kill velocity.

Question 8

What should an MSP quote include?

Accepted Answer

Scope summary. Monthly recurring fee. One-time costs. What's included. What's excluded (this matters more than you think). Term length. Payment terms. Start date.

Question 9

How do I quote a prospect with no existing IT documentation?

Accepted Answer

Charge a discovery fee. $500-2,000 to assess their environment before quoting ongoing services. This filters tire-kickers and gives you real data to price accurately.

Question 10

How do I handle price objections from prospects?

Accepted Answer

Don't discount. Descope. If they can't afford full stack, offer a smaller package. Discounting trains them to negotiate every renewal and attracts price-sensitive clients who churn.

Question 11

What does a vCIO actually do?

Accepted Answer

Translates business goals into technology roadmaps. Runs QBRs. Manages vendor relationships. Owns the IT budget conversation. Presents options when leadership asks "should we do X?"

Question 12

How do I price vCIO services?

Accepted Answer

$500-2,000/month depending on client size and meeting frequency. Some MSPs bundle it. Some charge separately. Separate pricing makes the value visible and easier to defend at renewal.

Question 13

How often should a vCIO meet with clients?

Accepted Answer

Monthly for strategic accounts. Quarterly minimum for everyone else. More frequent touchpoints correlate with lower churn and higher expansion revenue.

Question 14

What is a technology roadmap for MSP clients?

Accepted Answer

A 12-36 month plan showing what IT investments the client should make, when, and why. Covers hardware refresh, security upgrades, software migrations, and budget allocation.

Question 15

How do I build a client technology roadmap?

Accepted Answer

Audit current state. Identify gaps against their business goals. Prioritize by risk and ROI. Assign rough timing and budget. Present options, not mandates. Update quarterly.

Question 16

How do I get clients to follow through on roadmap items?

Accepted Answer

Tie recommendations to business outcomes they care about. "Your server is old" doesn't land. "This server failing costs you $15k/day in downtime" does. Make the cost of inaction clear.

Question 17

What is CPQ software for MSPs?

Accepted Answer

Configure, Price, Quote. Software that automates building proposals based on rules, pricing logic, and service bundles. Eliminates manual spreadsheet errors and speeds up sales cycles.

Question 18

Do MSPs need CPQ software?

Accepted Answer

Depends on volume. Under 5 quotes/month, a good template works. Above that, manual quoting becomes a bottleneck and error source. CPQ pays for itself when you're missing deals due to slow turnaround.

Question 19

How does CPQ improve MSP margins?

Accepted Answer

Enforces minimum margins per service line. Prevents reps from discounting below floor. Ensures all costs are captured. Most MSPs leak 5-15% margin on manual quotes through missed line items.

Question 20

What is the best MSP quoting software in 2026?

Accepted Answer

The best MSP quoting software depends on your needs. For hardware-heavy quoting, Quoter and QuoteWerks lead. For polished proposals, Salesbuildr excels. For AI-powered scoping that feeds into quoting, Scopable addresses the gap between knowing what to quote and building the quote itself.

Question 21

What is MSP CPQ software?

Accepted Answer

MSP CPQ (Configure, Price, Quote) software helps managed service providers build accurate quotes for IT services and hardware. Traditional CPQ focuses on pricing and proposal generation, while newer tools like Scopable extend the workflow to include AI-driven scoping from real client environment data.

Question 22

How do I reduce MSP client churn?

Accepted Answer

QBRs that matter. Fast response times. Proactive communication. Contracts with teeth. But mostly: pick better clients upfront. Churn is a symptom of bad-fit acquisition.

Question 23

What makes an MSP more valuable for acquisition?

Accepted Answer

High recurring revenue percentage (80%+). Strong gross margins (65%+). Low client concentration (no client over 15% of revenue). Clean contracts. Documented processes. Sticky clients with multi-year agreements.

Question 24

How much do MSP compliance services typically cost?

Accepted Answer

MSP compliance services typically range from $25-150 per user per month depending on the service level. Basic compliance add-ons (policy templates, evidence collection) run $25-50/user. Managed compliance services (assessments, gap remediation, audit prep) run $75-150/user. vCISO-level services are priced per client at $3,000-15,000/month, not per user.

Question 25

What is the profit margin on compliance services for MSPs?

Accepted Answer

Well-run compliance programs generate 30-40% net margins. Poorly scoped programs run 10-15% or negative. The difference comes down to scope discipline, pricing accuracy, and client selection. Most MSPs underestimate the hidden costs (scope creep, audit panic, client education) that erode margins.

Question 26

Should MSPs offer vCISO services?

Accepted Answer

Most MSPs should not offer full vCISO services. The expertise required (strategic security leadership, risk quantification, executive communication) differs fundamentally from managed IT. MSPs who want to move in this direction should start with managed compliance services and develop strategic capabilities over time.

Question 27

What liability do MSPs have for client compliance failures?

Accepted Answer

MSPs providing compliance services have contractual liability (what the MSA promised), professional liability (errors and omissions in advice), and potential regulatory liability (as business associates under HIPAA or data processors under GDPR). Liability can be limited through clear scope documents, refusal waivers, appropriate insurance, and shared responsibility matrices.

Question 28

What is the average price for MSP compliance services?

Accepted Answer

MSP compliance services typically range from $50-150 per user per month for ongoing management, with project-based assessments running $5,000-40,000 depending on framework and complexity. HIPAA tends toward the lower end ($50-100/user), while SOC 2 and CMMC command higher rates ($75-150/user). Minimums of $1,500-3,000/month apply regardless of user count.

Question 29

Should I use per-user or retainer pricing for compliance?

Accepted Answer

Per-user pricing works for ongoing compliance management where effort scales with organization size. Retainer pricing works better for complex engagements where user count doesn't reflect actual effort, or for vCISO-level services. Many MSPs use per-user for standard compliance management and retainers for strategic advisory services.

Question 30

How do I price compliance services for multiple frameworks?

Accepted Answer

Don't add framework prices together at full value. Use declining percentages: first framework at 100%, second at 60-70%, third at 50-60%. This accounts for control overlap while recognizing the additional complexity of multi-framework management.

Question 31

What should be excluded from compliance pricing?

Accepted Answer

Always exclude: actual audit/assessment fees (client pays directly), legal review of policies and contracts, penetration testing (unless specifically included), infrastructure changes required for compliance, and security tool licensing. Define exclusions in your scope document before quoting.

Question 32

Do I need special insurance for compliance services?

Accepted Answer

Yes. Standard E&O policies may not cover compliance advisory services. Verify that your policy explicitly covers technology consulting and compliance services, and that it includes coverage for regulatory proceedings. Recommended minimum coverage is $2 million per occurrence for MSPs offering compliance services.

Question 33

What is a shared responsibility matrix?

Accepted Answer

A shared responsibility matrix documents who is responsible for what in a compliance engagement. It specifies which controls and activities are the MSP's responsibility, which are the client's, and how shared responsibilities are divided. For CMMC, it's required. For all compliance services, it's essential for limiting liability.

Question 34

How do I protect myself when clients refuse recommendations?

Accepted Answer

Use refusal waivers. Document the specific risk, your recommendation, the consequences of non-implementation, and the client's decision to decline. Get the client's signature acknowledging they understand the risk and accept responsibility. This provides evidence for your defense if the risk materializes.

Question 35

How do I know if my MSP is ready for compliance services?

Accepted Answer

You're ready if you have real compliance expertise (not just vendor training), clients who need compliance services, ability to invest $20,000-50,000 over 6-12 months, willingness to accept advisory-level liability with proper protections, and ability to fire bad clients. If any of these are missing, address the gap first or consider alternatives.

Question 36

What can I offer clients if I'm not ready for full compliance services?

Accepted Answer

Alternatives include compliance-adjacent technical services (implementing controls without advisory), partnering with compliance specialists for joint engagements, security-first services where compliance is a byproduct, and framework education and preparation without recommendations.

Question 37

Should I stop offering compliance services if they're not working?

Accepted Answer

Consider your options: invest to fix capability gaps, narrow scope to what you can actually deliver, partner with specialists and transition advisory work, or exit cleanly if there's no viable path to profitability. Continuing to lose money while accumulating liability is the worst option.

Question 38

Is it true that every MSP needs to offer compliance services?

Accepted Answer

No. That narrative serves vendors, not MSPs. Compliance services require expertise, investment, and risk tolerance that not every MSP has. You can build a successful MSP without offering compliance services by focusing on what you're good at and partnering for what you're not.

Question 39

What is a shared responsibility matrix in compliance?

Accepted Answer

A shared responsibility matrix documents who is responsible for what in a compliance engagement. For every control and activity, it specifies whether the MSP is responsible, the client is responsible, or responsibility is shared. It prevents disputes by documenting responsibilities before work begins.

Question 40

Is a shared responsibility matrix required for CMMC?

Accepted Answer

Yes. CMMC requires that organizations seeking certification document shared responsibilities when using service providers. The assessor will ask for this documentation. Without it, the assessment cannot proceed.

Question 41

How often should I update the shared responsibility matrix?

Accepted Answer

Review annually at minimum, and update whenever services change significantly. If you add new services, new systems come into scope, or responsibilities shift, update the SRM accordingly.

Question 42

What happens if the client doesn't sign the shared responsibility matrix?

Accepted Answer

An unsigned SRM provides weaker protection than a signed one. If the client won't sign, document their acknowledgment in meeting notes or email. Include language in your SOW that references the SRM and their acceptance of it.

Question 43

What HIPAA changes are coming in 2026?

Accepted Answer

The 2026 HIPAA Security Rule update eliminates the 'addressable' vs 'required' distinction for controls, mandates encryption at rest, expands business associate requirements, and requires complete technology asset inventories. It's the biggest overhaul since the original Security Rule.

Question 44

Do MSPs need to comply with HIPAA 2026?

Accepted Answer

Yes. MSPs that handle ePHI are considered business associates under HIPAA and must meet the same security standards as covered entities. The 2026 update expands BA requirements including verification, contingency planning, and incident response timelines.

Question 45

Is encryption at rest required under HIPAA 2026?

Accepted Answer

Yes. The 2026 HIPAA Security Rule update makes encryption at rest mandatory. Previously it was 'addressable,' meaning organizations could document why they skipped it. That flexibility is being eliminated.

Question 46

Does Teams record all calls automatically?

Accepted Answer

No. Teams does not record anything by default. Someone must manually start recording, unless compliance recording is configured with a third-party solution.

Question 47

Can my employer record Teams calls without telling me?

Accepted Answer

With compliance recording, yes. Users see a notification that recording is in progress, but they cannot stop it. The policy is set at the admin level.

Question 48

Where do Teams recordings go?

Accepted Answer

OneDrive for non-channel meetings (in the organizer's account). SharePoint for channel meetings. Not Microsoft Stream anymore. That changed in 2021.

Question 49

How long are Teams recordings kept?

Accepted Answer

120 days by default, then auto-deleted. Admins can change this to any value between 1 and 99,999 days, or disable expiration entirely.

Question 50

Can I record a Teams call to someone's phone?

Accepted Answer

Yes, if PSTN call recording is enabled in your calling policy. The other party hears an audio notification when recording starts.

Question 51

Do guests know when I'm recording a Teams meeting?

Accepted Answer

Yes. All participants see a banner notification and hear an audio alert when recording starts or stops.

Question 52

Can I record a Teams meeting without anyone knowing?

Accepted Answer

No. Not with Teams' built-in recording. All participants are notified. Third-party screen recording software is a different matter, but that creates legal issues in two-party consent states.

Question 53

Does Microsoft have access to my Teams recordings?

Accepted Answer

Microsoft stores recordings in your OneDrive/SharePoint. Their standard data processing agreements apply. They don't use customer recordings to train AI models without explicit consent.

Question 54

What's the difference between convenience and compliance recording in Teams?

Accepted Answer

Convenience recording is manual, user-initiated, and stored in OneDrive/SharePoint. Compliance recording is automatic, policy-based, requires a third-party solution, and stores recordings in the partner's system.

Question 55

Can I prevent specific Teams meetings from being recorded?

Accepted Answer

Meeting organizers can disable recording for their meetings using meeting options. Admins can also restrict recording capabilities through meeting policies assigned to specific users or groups.

Question 56

What happens to Teams recordings when someone leaves the company?

Accepted Answer

Recordings in that user's OneDrive follow the OneDrive deletion policy for departed users. Typically deleted 30 days after the account is removed unless IT takes action. Channel meeting recordings in SharePoint are unaffected.

Question 57

Does AI actually help MSPs or is it just vendor hype?

Accepted Answer

Both. The hype is real, but so are the use cases that deliver ROI. AI genuinely helps with quoting and scoping from client environment data, documentation that writes itself from tickets, security threat correlation across log sources, helpdesk deflection for repetitive issues, and proactive monitoring that predicts failures. What's still hype: AI features that just reword your notes or rebrand threshold alerts. The test: can the vendor show measurable output reduction or margin improvement? If not, it's marketing.

Question 58

What's the best use of AI for MSP profitability?

Accepted Answer

Quoting and scoping automation. Project scoping burns the most unbillable hours at most MSPs — 2-6 hours per quote across discovery, scope writing, and pricing. AI tools that pull real client environment data (from your PSA, RMM, M365) and generate accurate scopes from it cut that to under 30 minutes. That's where the margin impact is most direct. Documentation automation is second: knowledge that builds itself means faster onboarding and more consistent service delivery.

Question 59

How do I evaluate AI tools for my MSP?

Accepted Answer

Start with workflow fit, not feature lists. Does it integrate into your existing stack (PSA, RMM, M365) or does it require a separate workflow? Does it reduce actual work or just produce more output? Ask the vendor for customer references who can speak to measurable ticket reduction, time saved, or margin improvement. Avoid tools that require prompt engineering or manual data entry to function. The best AI for MSPs runs in the background and surfaces results where your team already works.

Question 60

How do I scope an MSP project before quoting it?

Accepted Answer

Start by collecting the client's environment data: user count, device inventory, server and network infrastructure, cloud services, and compliance requirements. Then map each finding to a service deliverable with estimated labor hours. Scoping before quoting prevents the two biggest margin killers: missed line items (which cost MSPs 5-15% per quote) and post-signature scope creep.

Question 61

What is agentic AI in MSP quoting?

Accepted Answer

Agentic AI refers to AI systems that can independently execute multi-step workflows rather than just answering questions or generating text. In MSP quoting, an agentic AI can pull environment data from your RMM and PSA, identify gaps, generate a scope of work, calculate pricing with real distributor costs, and produce a client-ready proposal, all without manual intervention at each step.

Question 62

How do I automate SOW generation for my MSP?

Accepted Answer

Automate SOW generation by connecting your assessment data (from RMM, PSA, or network scans) directly to a templating system that maps findings to predefined service deliverables, labor estimates, and pricing. The key is eliminating the manual translation step where a technician reads an assessment report and types the same information into a Word document. No dedicated MSP-specific AI SOW generator existed before 2026.

Question 63

Why do MSP quotes vary so much for the same client?

Accepted Answer

MSP quotes vary because each provider makes different assumptions about the client's environment complexity, scope of services included, and what counts as standard versus extra. The lowest quote often comes from the MSP that asked the fewest questions. The highest may reflect the only provider that actually assessed the environment accurately.

Question 64

What is the difference between an MSP proposal and a quote?

Accepted Answer

A proposal prepares a client for a future expense by showing what they'll need, why they need it, and approximate costs (5-15 min to build). A quote is a binding price for specific products and services, ready for signature (2-10+ hours to build). Proposals should come first to secure budget approval before investing engineering hours in detailed quotes.

MSP FAQ: Expert Answers for Managed Service Providers

Quick Answers

Pricing & Margins

Quoting & Sales

vCIO & Strategic Services

Client Roadmapping

CPQ & Automation

Revenue & Growth

GRC & Compliance

Microsoft 365

Ready to put these answers into action?

MSP FAQ: Expert Answers for Managed Service Providers

Quick Answers

What's a healthy gross margin for managed services?

How long should an MSP quote take to create?

What does a vCIO actually do?

What is CPQ software for MSPs?

Pricing & Margins

What's a healthy gross margin for managed services?

How do I calculate my effective hourly rate?

Should I price per user or per device?

What's the average revenue per endpoint for MSPs?

What percentage of MSP revenue should be recurring?

What pricing models work best for MSPs?

Quoting & Sales

How long should an MSP quote take to create?

What should an MSP quote include?

How do I quote a prospect with no existing IT documentation?

How do I handle price objections from prospects?

How do I scope an MSP project before quoting it?

Why do MSP quotes vary so much for the same client?

What is the difference between an MSP proposal and a quote?

How do MSPs quote multi-site or complex environments?

vCIO & Strategic Services

What does a vCIO actually do?

How do I price vCIO services?

How often should a vCIO meet with clients?

Client Roadmapping

What is a technology roadmap for MSP clients?

How do I build a client technology roadmap?

How do I get clients to follow through on roadmap items?

CPQ & Automation

What is CPQ software for MSPs?

Do MSPs need CPQ software?

How does CPQ improve MSP margins?

What is the best MSP quoting software in 2026?

What is MSP CPQ software?

How do I automate SOW generation for my MSP?

Revenue & Growth

How do I reduce MSP client churn?

What makes an MSP more valuable for acquisition?

GRC & Compliance

How much do MSP compliance services typically cost?

What is the profit margin on compliance services for MSPs?

Should MSPs offer vCISO services?

What liability do MSPs have for client compliance failures?

What is the average price for MSP compliance services?

Should I use per-user or retainer pricing for compliance?

How do I price compliance services for multiple frameworks?

What should be excluded from compliance pricing?

Do I need special insurance for compliance services?

What is a shared responsibility matrix?

How do I protect myself when clients refuse recommendations?

How do I know if my MSP is ready for compliance services?

What can I offer clients if I'm not ready for full compliance services?

Should I stop offering compliance services if they're not working?

Is it true that every MSP needs to offer compliance services?

What is a shared responsibility matrix in compliance?

Is a shared responsibility matrix required for CMMC?

How often should I update the shared responsibility matrix?

What happens if the client doesn't sign the shared responsibility matrix?

What HIPAA changes are coming in 2026?

Do MSPs need to comply with HIPAA 2026?

Is encryption at rest required under HIPAA 2026?

Microsoft 365

Does Teams record all calls automatically?

Can my employer record Teams calls without telling me?

Where do Teams recordings go?

How long are Teams recordings kept?

Can I record a Teams call to someone's phone?

Do guests know when I'm recording a Teams meeting?

Can I record a Teams meeting without anyone knowing?

Does Microsoft have access to my Teams recordings?

What's the difference between convenience and compliance recording in Teams?

Can I prevent specific Teams meetings from being recorded?

What happens to Teams recordings when someone leaves the company?

Ready to put these answers into action?