What to Look for in a Managed IT Services Provider in Toronto
A scoring sheet for the meeting itself. Ten questions to ask any managed IT provider, what a good answer contains, and the answers that should worry you. Score each one 0 to 2 and compare providers on paper, not on how the meeting felt.
Reviewed by the ITRS security team · Last updated
How to use the sheet
Ask every provider the same ten questions, ideally in the same order, and write down what they actually said. Give 2 points for an answer that matches the 'good answer' column with specifics, 1 for a partial or vague answer, 0 for a red-flag answer or no answer.
A total under 12 out of 20 is a weak fit no matter how low the price. For the step-by-step buying process around this meeting (scope, quotes, contract), see the IT support buyer's guide.
Questions 1 to 5: how they will run your environment
| Question | A good answer contains | Red flag |
|---|---|---|
1. Who owns our admin accounts, domain and licences? | You do. They operate under named accounts you can remove. Break-glass credentials stay with you. | 'We hold the admin password for you' or the tenant is in their name |
2. What do you do in the first 30 days? | A written onboarding list: inventory, admin review, MFA gaps, backup check, documentation handover. | 'We install our agent and you're set' |
3. What evidence do we get each month? | Patch compliance per device, backup results and last restore test, ticket summary, security alerts with actions. | A generic newsletter or nothing unless asked |
4. How do you prioritize tickets? | Written priority levels with definitions and target times you can hold them to. | 'We get to everything quickly' |
5. What is excluded from the fee? | A specific list: projects, hardware, after-hours non-urgent work, third-party vendor time. | 'Everything is covered' with no list |
Questions 6 to 10: security, exits and people
| Question | A good answer contains | Red flag |
|---|---|---|
6. What would you change in our Microsoft 365 first? | Specific settings: MFA for all, legacy sign-in blocked, audit log, admin count, DMARC. | Talk about products, not settings |
7. What happens when you find a compromise at night? | Who is called, what they can do without you (disable account, isolate device), how evidence is kept. | 'We'll email you in the morning' |
8. Who will actually work on our account? | Names or roles of the team, how knowledge is shared so you are not dependent on one person. | Only the salesperson can answer |
9. How do we leave? | Notice period, documentation and credential handover, data export, no hostage tooling. | Long auto-renewing terms, exit fees, 'we've never had anyone leave' |
10. Can we talk to two current clients our size? | Yes, with permission, in a similar industry. | No references or only logos |
Reading between the lines
Watch for answers that describe tools instead of outcomes. 'We use an industry-leading platform' tells you nothing; 'we patch monthly, report compliance per device and chase anything older than 30 days' tells you what you are buying.
Credentials claimed in a meeting should be named and checkable. If a provider says its staff hold specific Microsoft or security certifications, ask which ones and check them. Insurance should be stated with a coverage amount; we carry $2M in cyber liability insurance, for example, and you should expect a similar written answer from anyone you shortlist.
See how our managed IT plans are structured and our managed IT support practice, or go straight to IT support in Toronto.
A worked score
An illustrative comparison of two imaginary providers, to show how the sheet changes the conversation.
| Question | Provider A | Provider B |
|---|---|---|
Account ownership | 2 | 0 (tenant created in provider's name) |
Onboarding | 2 | 1 |
Monthly evidence | 1 | 2 |
Priorities | 2 | 1 |
Exclusions | 2 | 0 |
Microsoft 365 changes | 2 | 1 |
Night-time compromise | 1 | 1 |
Team | 1 | 2 |
Exit terms | 2 | 0 |
References | 2 | 2 |
Total | 17 / 20 | 10 / 20 |
After the meetings
Ask the top two for a written quote against the same scope and run them through the quote checker. Then read the contract against our contract guide, paying most attention to term, exit and exclusions.
Keep the filled-in sheets. If the provider you choose later falls short, the answers they gave in the meeting are a fair yardstick for the conversation about it.
If you want a provider-neutral view, the IT companies guide explains the different kinds of firm you will meet, so you can tell a break-fix shop, an MSP and a security specialist apart before you score them.
Related reading.
- ArticleHow to Buy IT Support in the GTA: 2026 Buyer's GuideThe buying process from first conversation to signed contract, in six steps.
- ToolWhat is missing from your managed IT quote?Two managed IT proposals can carry the same monthly price and cover completely different things.
- ArticleWhat a Managed IT Services Contract Should Include: Ontario GuideWhat a managed IT services contract should include for Ontario businesses: scope and exclusions, SLA priority and response terms, onboarding, data ownership, PIPEDA and…
- ArticleIT Companies in Toronto: Which Type Does Your Business Actually Need?Toronto IT companies range from break-fix shops to full MSPs and security-focused MSSPs. What each type actually does, what it costs, and how to pick the right fit.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.