Frequently Asked Questions

Managed IT is a service model where an outside provider (an MSP) takes ongoing responsibility for some or all of a company's technology — typically helpdesk support, monitoring, patching, backups, and security — for a predictable monthly fee instead of hourly break/fix billing. The exact scope varies by provider and agreement.

Fully managed IT means the MSP acts as the company's entire IT department. Co-managed IT means the MSP works alongside an existing internal IT person or team, typically filling specific gaps such as after-hours coverage, cybersecurity, tooling, or project capacity while the in-house team retains ownership of strategy.

MSPs commonly serve businesses from a handful of employees up to several hundred. The better question is whether you'd benefit from predictable monthly costs, proactive maintenance, and access to a broader skill set than a single hire could provide. Hourly break/fix or a single in-house generalist can become limiting as a company grows.

Break/fix providers bill hourly when something goes wrong — their revenue grows when your systems fail. MSPs charge a flat recurring fee and are incentivized to prevent issues before they cause downtime. Most modern providers operate on the managed model because it aligns the provider's interests with the client's uptime.

The two most common models are per-user and per-device. Per-user pricing tends to be simpler when employees use multiple devices; per-device pricing can be a better fit for environments with many shared or single-purpose endpoints. Either way, expect a flat monthly invoice for in-scope services, with hardware, licensing, and major projects quoted separately.

Most MSP agreements exclude hardware purchases (workstations, servers, firewalls), third-party software licensing (Microsoft 365, Adobe, line-of-business apps), and large project work such as office moves, full cloud migrations, or major infrastructure overhauls. These are typically scoped and quoted separately. Always confirm the scope of your specific agreement.

Term length varies. Some providers require multi-year commitments; others offer month-to-month or annual options. Annual agreements often come with better pricing. Read any termination, data-handoff, and price-increase clauses carefully before signing.

Confirm what's in scope versus billed extra, response-time commitments (SLAs), how onboarding works, who owns documentation and admin credentials, how offboarding works if you leave, what cybersecurity controls are deployed, and how price increases are handled. Get answers in writing.

A Service Level Agreement defines how quickly the provider will respond to and work on issues, usually tiered by severity. Look for separate response and resolution targets, clear severity definitions (e.g., outage vs. single-user issue), and what happens if targets are missed.

24/7 monitoring and automated security response are common inclusions. Around-the-clock human helpdesk is typically an upgrade or add-on. Many small and mid-sized businesses operate fine with business-hours helpdesk plus 24/7 monitoring and on-call security response.

Many MSPs include unlimited remote and on-site support for in-scope work under their flat fee, but definitions of 'in-scope' vary. Project work, third-party vendor management, and after-hours requests may be billed separately. Confirm the specifics in your statement of work.

Common channels include email, phone, a self-service portal, and Microsoft Teams or Slack integrations. The best providers meet end users where they already work and track every request in a ticketing system so nothing falls through the cracks.

Industry baselines generally include multi-factor authentication, endpoint detection and response (EDR), DNS or web filtering, email security and anti-phishing, encrypted and tested backups, patch management, and ongoing security awareness training. Cyber-insurance carriers increasingly require these as conditions of coverage.

The standard incident response sequence is contain (isolate affected systems), eradicate (remove the threat), recover (restore from clean backups), and investigate (root cause and notification obligations). Outcomes depend heavily on whether immutable backups exist, how quickly the incident is detected, and whether an incident response plan was in place beforehand.

Most successful breaches start with a person — typically a phishing email or a credential reuse. Regular training combined with simulated phishing measurably reduces click-through rates and is required by most cyber-insurance policies and many compliance frameworks.

Cyber insurance covers some of the financial fallout from a breach (forensics, notification, business interruption, sometimes ransom). Carriers now require specific technical controls — usually MFA, EDR, backups, training, and email security — before they'll write or renew a policy. Application questionnaires are detailed and answers are legally binding.

A typical migration includes discovery (what data and apps exist, who uses them), tenant setup, identity and licensing configuration, data and mailbox migration, endpoint and policy deployment, user training, and a cutover plan. Timeline depends on data volume, the source environment, and the number of users.

Almost never. Software licenses pass through from the vendor (Microsoft, Adobe, etc.) and are billed separately, though many MSPs will manage and right-size your licensing as part of their service.

It depends on the workload. File shares, email, and many collaboration tools usually belong in the cloud. Large databases, latency-sensitive line-of-business apps, and certain regulated workloads sometimes make more sense on-prem or in a hybrid setup. The right answer comes from evaluating cost, performance, security, and how the workload is actually used.

Microsoft replicates data for service availability and offers limited retention, but their shared-responsibility model puts long-term backup and recovery on the customer. Most organizations deploy a third-party M365 backup with point-in-time restore for mailboxes, OneDrive, SharePoint, and Teams.

An MSP can implement and document the technical controls a framework requires — access controls, encryption, logging, backups, vulnerability management — and produce evidence for auditors. MSPs are not auditors and don't issue compliance certifications themselves; that's the role of a qualified assessor (e.g., a C3PAO for CMMC, a QSA for PCI).

A Business Associate Agreement is a contract required under HIPAA whenever a vendor handles, stores, or transmits protected health information on behalf of a covered entity. Any IT provider working with a healthcare client subject to HIPAA should be willing to sign one.

Professional services (law, accounting, financial services), healthcare and dental, manufacturing, construction, nonprofits, and any business with regulatory or insurance-driven security requirements are common fits. Industry experience matters because each vertical has different applications, compliance obligations, and risk profiles.

A typical onboarding includes a discovery and security assessment, environment documentation, deployment of the new provider's monitoring and security tooling, knowledge transfer from the prior provider, introductions to the user base, and a transition of support channels. Most small and mid-sized engagements take a few weeks; complex environments take longer.

A good MSP manages the transition end to end: coordinating with the outgoing provider, taking ownership of documentation, licenses, and admin credentials, and running in parallel until cutover. Done well, the switch should be largely invisible to end users.

It happens. Experienced MSPs have playbooks for rebuilding documentation from discovery, recovering tenant ownership and admin access directly through vendors (Microsoft, domain registrars, etc.), and standing up new tenants where required. Your data and credentials belong to your business, not the outgoing provider.

For most small and mid-sized businesses, onboarding can begin within one to two weeks of signing. Emergency engagements — active breach, provider walking away, urgent migration — can typically be triaged faster, sometimes within 24 to 48 hours.

Liquid IT is based in Scottsdale and serves businesses across the Phoenix metro and Arizona, including Phoenix, Scottsdale, Mesa, Chandler, Gilbert, Tempe, Glendale, Peoria, Tucson, Flagstaff, Prescott, and surrounding areas.

Yes. Because most support, monitoring, and security tooling is delivered remotely, an MSP can support distributed teams almost anywhere. On-site visits are limited to the provider's physical service area, but the day-to-day model isn't dependent on geography.

Both. The majority of issues are resolved remotely in minutes. On-site visits are reserved for hardware work, network changes, new-office buildouts, and situations where in-person presence is genuinely needed.