Most managed IT relationships that go bad showed warning signs early. A vague answer during the sales call, a contract ...
Most managed IT relationships that go bad showed warning signs early. A vague answer during the sales call, a contract that is hard to leave, a backup nobody tested. The trick is knowing what to look for before you sign, or before you renew.
Here are the red flags SMB leaders should watch for when evaluating a managed IT provider, grouped into security, support, and accountability. Use it as a checklist for new providers and as an annual check on your current one.
Key Takeaways: MSP Red Flags
- Security that is sold as an add-on instead of built into the base plan is a warning sign.
- Vague SLAs and slow sales-process responses predict slow support later.
- You should own your data, accounts, and documentation.
- A provider that cannot explain its pricing clearly will be hard to budget around.
- No regular reporting or planning meetings means no accountability.
Security Red Flags
1. Cybersecurity Is an Add-On
If multi-factor authentication, endpoint protection, and email security cost extra, many clients skip them. Basic protection should be standard.
2. No Proof of Backup Restore Testing
"We back everything up" is not enough. Ask when they last restored data for a client and how often they test.
3. Patching Without Reporting
If they cannot show you which devices are up to date, you cannot know whether they are.
4. Weak Security at the MSP Itself
Attackers target MSPs to reach many clients at once. A provider should be able to explain how they protect their own tools and accounts.
5. No Incident Response Plan
Ask what happens in the first hour of a suspected breach. A good provider has a documented answer. See What to Do in the First 24 Hours After a Cyberattack.
Support Red Flags
6. "Best Effort" Response Times
Without written response targets by priority level, you have no way to hold the provider accountable.
7. No Local or On-Site Option
Remote support solves most issues, but some problems need hands on equipment. Ask how quickly someone can be on-site.
8. A Revolving Door of Technicians
If you speak to someone new every time and have to explain your setup again, knowledge is not being documented or shared.
19. No Microsoft 365 Expertise
For most SMBs, Microsoft 365 is the center of daily work. Your provider should manage licensing, security settings, and backups for it, not just reset passwords.
Accountability Red Flags
11. Unclear or Hidden Pricing
If you cannot tell what is included, you cannot budget. Ask for a written list of inclusions and exclusions.
12. Hard-to-Exit Contracts
Long auto-renewals, steep termination fees, and no transition commitments make it hard to leave a bad fit.
13. They Hold Your Admin Credentials Hostage
You should own your domain, Microsoft 365 tenant, and admin access. Your provider should not be the only one with the keys.
14. No Documentation
You should have access to documentation of your network, systems, and vendors. Without it, switching providers is painful.
15. No Reporting or Planning Meetings
Regular reports and roadmap meetings show what the provider is doing and what is coming next. Silence is not a sign that everything is fine.
Quick Red Flag Checklist
| Question | Good answer | Red flag |
|---|---|---|
| Is security included? | Yes, in the base plan | Only as add-ons |
| When was your last restore test? | A specific recent date | "We back everything up" |
| What are your response times? | Written, by priority level | "As soon as possible" |
| Who owns our accounts and data? | You do | Unclear |
| What happens if we leave? | Documented transition plan | Fees and no handover |
In Conclusion: Small Signs, Big Consequences
Red flags rarely look serious on their own. Together, they predict how a provider will act when something goes wrong. If you spot several, keep looking.
For a structured process, read Questions to Ask Before Hiring Managed IT. And to see what transparent pricing looks like, try Cloud Cover's instant pricing calculator.
FAQs About Managed IT Provider Red Flags
What is the biggest red flag in a managed IT provider?
Not being able to prove backups can be restored. Data loss is one of the hardest problems to recover from.
Is it a red flag if an MSP requires a long contract?
Not by itself. Look at the exit terms. A fair contract explains how to leave and commits to a clean handover.
Should I worry if my MSP has my admin passwords?
They need access to do their job. The concern is if you do not also have admin access and ownership of your accounts.
How often should I review my current MSP?
At least once a year, ideally before renewal.
Seeing Red Flags With Your Current Provider?
Tell us a little about your business and a Cloud Cover team member will follow up with answers, not a sales pitch.