Most businesses with an MSP have no real way of knowing whether it is doing a good job. The helpdesk answers, the invoices arrive and nothing has caught fire. That's a low bar.
We've run MSPs and we've overseen them on behalf of clients, so we've seen both sides. Most providers are doing their best on thin margins. But a good relationship needs evidence, not just goodwill. These ten checks don't need technical knowledge, just the right questions.
1. Can they show you the SLA report?
Ask for last quarter's ticket report: volume, response and resolution times against the contract, and the top recurring issues. A good MSP sends this without being asked. If it takes a fortnight to produce, nobody is looking at it.
2. Are the same problems coming back?
Look at the recurring issues. The same printer, the same VPN complaint or the same user every month means tickets are being closed, not problems solved. Ask what they're doing about the root cause.
3. When was a backup last restored?
Not "is it backed up", but when did someone last restore something and prove it worked. Ask for the date and what was restored. Microsoft 365 data needs its own backup too, so ask about that separately.
4. Is multi-factor authentication enforced for everyone?
Ask for a report showing every account and whether MFA is enforced, including admin accounts and shared mailboxes. "Most users" is not the right answer. Neither is "we've sent them the instructions".
5. Who has admin rights?
Ask for a list of everyone with global admin or domain admin access, including MSP staff. It should be short, named and justified. Shared admin logins that half the MSP's engineers know are a real risk.
6. Are you paying for licences you don't use?
Ask for a licence reconciliation: what you're paying for against active users. Leavers who still have a licence, and add-ons nobody uses, are common and easy to fix. A good MSP does this every quarter.
7. Is anything out of support?
Ask for a list of hardware and software that is out of support or will be within twelve months. Out-of-support systems don't get security updates and will fail Cyber Essentials. You want this on a roadmap with a budget, not a surprise.
8. Could you pass Cyber Essentials today?
Even if you don't need the certificate, ask your MSP whether you would pass. The scheme is a sensible baseline, and the answer tells you how seriously they take security for your business.
9. Do they bring you ideas?
A good MSP doesn't just react. In the last year, did they suggest anything that saved you money, reduced risk or made your staff's lives easier? A quarterly review with a short roadmap is a reasonable expectation.
10. Could you leave if you needed to?
Check the notice period and what happens to your documentation, passwords and admin access at exit. You should hold the keys to your own tenant and domain. If the MSP owns your domain registration or your Microsoft tenant, fix that now while the relationship is good.
What to do with the answers
If most answers are good, tell them. Good MSPs rarely get thanked. If several are vague, raise them at your next review and agree dates. Most issues are fixable and most providers will welcome a client who knows what to ask.
If you'd rather someone independent asked the questions and read the answers, that is a big part of what a fractional CTO or IT director does. We sit on your side of the table, set the direction and check the work.