What is excluded from a managed IT services monthly cost?

A managed IT services monthly cost normally covers the recurring activities listed in the service agreement, not every technology-related requirement an organisation may have. Exclusions usually arise where work falls outside the agreed users, devices, locations, services or support boundaries, or where it requires a separate purchase, specialist engagement or one-off piece of work.

Scope limits are one of the most important exclusions. A contract may define the number of supported users, endpoints, servers, sites or network environments. Adding an employee, device, office or business system may therefore change the charge or require a revised agreement. Equipment used outside the agreed environment may also be excluded, particularly where it has not been documented, configured or approved for support.

Specialist work is often treated separately from day-to-day support. Examples include data migration, application implementation, office moves, major network redesigns, infrastructure remediation and the creation of new technical environments. These activities require planning, testing and allocated project resources, so they are commonly estimated separately rather than absorbed into a recurring support fee.

Business applications may have their own support boundaries. An IT provider can manage access, devices, hosting arrangements or integrations without being responsible for the internal operation of a specialist application. The software publisher, application developer or business process owner may remain responsible for faults within the application itself. The agreement should state whether support covers the technology running an application, the application configuration, or both.

Security and compliance work may also sit outside the standard service. Routine security management can be part of a managed service, while activities such as formal compliance assessments, penetration testing, forensic investigation, regulatory reporting and extensive incident remediation may need a separate scope. This distinction matters because a security event can require evidence preservation, specialist analysis and coordinated communication rather than ordinary service desk assistance.

Data protection responsibilities should be read separately from support coverage. A provider may operate backup processes or help restore systems, but the contract should clarify what is covered if data is corrupted, deleted, inaccessible or subject to a legal retention requirement. It should also explain the customer’s responsibilities, such as identifying critical data, approving retention settings and maintaining suitable access permissions. A backup service is not automatically the same as full data recovery, business continuity planning or disaster recovery consultancy.

Training and internal change activity are commonly excluded. Basic guidance associated with supported systems may be included, but structured staff training, creating extensive documentation, developing internal procedures and repeated assistance caused by inadequate user knowledge may be chargeable separately. The distinction is usually between helping a user resolve a technical issue and delivering a training or organisational change programme.

Other points that can affect the monthly cost include:

• support for personally owned devices or unmanaged equipment;
• custom development, scripting or bespoke integrations;
• recovery of unsupported, obsolete or incorrectly configured systems;
• work caused by unauthorised changes or failure to follow agreed procedures;
• specialist legal, compliance, consultancy or audit services;
• consumable items, physical replacement parts or specialist installation services;
• additional storage, usage-based resources or services billed according to consumption; and
• fees that the provider collects on behalf of another supplier.

The contract should also explain how excluded work is authorised and charged. Common approaches include a fixed project quotation, a separate statement of work, an agreed rate for additional labour, or direct billing by the relevant supplier. It should identify whether approval is required before work begins, how urgent exceptions are handled and whether unused monthly support can be carried forward. Without these rules, an organisation may understand what is excluded but still be unclear about the resulting cost.

For a meaningful comparison between providers, ask for an itemised scope rather than relying on the monthly figure alone. Check the definitions of a supported user, device, site and service; the treatment of third-party faults; the boundary between support and project work; and the charges for additional requirements. Also confirm whether taxes, supplier charges and usage-based costs are shown separately, and whether the agreement contains an annual or periodic review mechanism.

A well-defined exclusion is not necessarily a disadvantage. It prevents complex, unpredictable work from being hidden within a standard recurring fee and makes it easier to budget for routine support separately from projects, specialist services and changes to the organisation’s technology environment.