MSP industry guide: key challenges and solutions
A managed service provider (MSP) is a company that takes ongoing responsibility for a client's IT, monitoring and supporting it under a service level agreement for a predictable monthly fee. This MSP industry guide covers how the model works, what it costs clients, and the challenges that squeeze MSP margins today, with a practical fix for each.
For most MSP owners, the biggest challenge shows up as margin. Tickets that should close themselves still take 10 to 15 minutes each, every day, while "AI" tools write summaries that change nothing. If you're trying to build a profitable MSP, that's where the work starts.
What an MSP is and how the MSP industry works
Wikipedia describes managed services as a model of IT outsourcing in which a third party assumes ongoing responsibility for managing and maintaining a customer's IT infrastructure and end users. The difference from break/fix is timing, because break/fix support arrives after something fails, while an MSP monitors and maintains systems proactively under a subscription.
The relationship is usually governed by a service level agreement, which LogMeIn describes as the contract that defines what's being managed, how it's measured and what success looks like. Small and medium-sized businesses, nonprofits and government agencies are the typical clients, and some keep internal IT and run a co-managed IT arrangement instead of outsourcing everything.
What MSPs manage day to day
LogMeIn lists the core of the work as:
- Endpoint monitoring and management for servers, desktops, laptops and mobile devices
- Patch management for software and operating systems
- Remote support and troubleshooting, often run through scripts across many endpoints at once
- Helpdesk services for end users
Most MSPs run that work through two systems, an RMM for the endpoints and a PSA for tickets, time and billing. If the split is new to you, the guide to the difference between RMM and PSA covers it.
How MSPs charge
Wikipedia notes that most MSPs bill an upfront setup or transition fee and then a flat or near-fixed monthly fee, which gives clients predictable IT costs. STACK Cybersecurity puts managed IT services in the United States at roughly $100 to $300 per user per month, with higher tiers for advanced security and compliance, and says the range varies widely with scope and environment. For how MSPs build those numbers, see the guides to managed services pricing and MSP per-user pricing.
How big the MSP industry is
Grand View Research, quoted by STACK Cybersecurity, estimated the global managed services market at $401.15 billion in 2025 and projected $847.41 billion by 2033. An IDC Spotlight cited by SAP projects the global managed services business to reach $711 billion by the end of 2028. The two firms use different definitions and timeframes, so treat them as a direction, and remember that a growing market does nothing for your own MSP profit margins if each ticket still costs a tech's time.
MSP challenge: margin lost on L1 tickets
L1 tickets burn margin because people still gather context, make simple changes and document the closeout by hand. The volume clusters around the same tasks, so the waste compounds as password resets, unlocks, license tweaks, basic permissions and light triage repeat all day.
Where minutes disappear in your queue
A user locks themselves out. Someone checks the identity provider, performs the reset, sends instructions, updates the PSA and moves on, and ten to fifteen minutes are gone on a task that needed no judgment. Do that 200 to 400 times a month and the math gets ugly, which is why it's worth checking how much of your queue is password resets.
I'm not saying you should never touch L1 tickets. Most of them could close without a tech, and they still land on one because the tools speed up writing without taking action, which keeps your cost per ticket tied to payroll. You feel it most after hours, when tickets stack, SLAs slip and you wake up to a wall of "urgent" that could have been resolved in a few minutes.
- The usual drains are resets, unlocks, MFA re-enrollments, mailbox and group permissions and simple license changes.
- The hidden tax is intake ping-pong, context switches across four to six consoles, and duplicated notes.
Why better summaries don't close tickets
Summaries read well, but a tidy paragraph in your PSA still leaves someone to click through Entra, confirm group membership, change a license or push a remediation script. The gap between suggestion and execution is where the margin goes. If a tool can't act across your PSA, identity provider, RMM and chat, the queue looks the same at the end of the month, and a lot of MSP "AI" turns out to be a workflow engine with a chatbot on top. The piece on why AI support that cannot act falls short goes further on this.
MSP challenge: the setup tax on automation
Workflow platforms can be powerful, but they need months of modeling before they do anything useful, and small and mid-sized MSPs rarely have a full-time admin to feed them. The cost lands before the value does.
A person whose job is the tool
You've probably lived this. You buy the platform, assign a smart tech to own it, and six weeks later they're still chasing edge cases and approvals. Some processes go live and many don't, while the queue looks the same and your people still work nights.
Most MSPs already own plenty of automation. What they have too much of is tools that need babysitting, each with another dashboard, another vendor to manage and another backlog of "we'll automate this next quarter." Warning signs that you're paying the setup tax:
- Your SOP library keeps growing while the queue doesn't shrink.
- Flows break on minor changes.
- You log into the tool more often than it logs work for you.
- You can't name the hours it saved this week.
What ticket volume hides
High volume is easy to see. Rework is harder to spot, because intake without context spawns back-and-forth, thin documentation drives reopens, and serial checks across tools burn time while someone pieces the problem together by hand.
Ambiguous tickets are the test. "Nothing works", "I can't access files" and "VPN is flaky" either get a guess or get checked against identity, device and service data at the same time, and the guess is the expensive option.
MSP challenge: after-hours coverage, SLAs and approvals
Running a help desk at 11 pm is a mix of adrenaline and dread. You want to serve clients well, but the queue fills with issues that shouldn't need a human, and even when a tech jumps in, half the time goes to gathering context your tools already hold.
The simple math you cannot ignore
Take 300 L1 tickets at 12 minutes each. That's 60 hours, and at a loaded 40 to 50 dollars an hour you're spending 2,400 to 3,000 dollars a month on one category, often resets and unlocks alone. Add MFA re-enrollments, mailbox permissions and group changes and the total climbs quickly. The MSP ROI calculator runs the same math against your own volume.
You also pay in delay. Tickets opened at 11 pm sit until morning, which hurts SLAs and your first response time, and users who can't work open duplicate tickets. During broad outages, duplicates flood the queue unless you link them under a parent incident and communicate clearly. Microsoft 365 Service health and the Google Workspace Status Dashboard exist for exactly this, and if your system isn't checking them, your people will.
The minutes add up like this:
- 5 to 10 minutes of intake ping-pong when key information is missing
- 3 to 5 minutes per console hop, with 3 to 6 hops per ticket
- 2 to 4 minutes to document, with reopen risk if the guidance is unclear
The human side of repetition
Repetition wears people down. Your good techs joined to solve interesting problems, and instead they reset passwords and paste the same instructions ten times a night, which is how you burn out talent and slow the project work that grows the business.
I've watched teams lose weekends to duplicate outage tickets: same symptoms, slightly different wording, five clients hitting the queue at once. Without correlation and parent incidents, everyone works each ticket separately and nobody gets a break. Small changes help a lot here, because users get clear instructions without waiting, approvals happen in your team chat instead of email, and techs start from correlated findings instead of a blank page.
The approval ping-pong that wastes days
Mailbox access, license upgrades and group changes often need a manager's yes. If that manager has to find an email thread, reply, and hope the right tech sees it, you lose a day while a user sits blocked.
Approvals should reach people where they already work, and the system should remember the patterns. The approver for Finance at Client A is not the approver for Marketing at Client B, and your tools should know that as well as your dispatcher does.
MSP challenge: identity, vendor risk and AI governance
Identity resets and MFA changes are routine but time sensitive. Standards like the NIST SP 800-63B Digital Identity Guidelines call for consistent, auditable flows around enrollment, recovery and lockouts, and if you improvise those steps under pressure, mistakes follow. A written help desk identity verification process is the cheapest fix.
Vendor risk is the other item that moved up the list this year. MSPAlliance used the ConnectWise Cloud Backup incident, in an article published October 20, 2026, to ask who actually carries the risk when a supplier fails, and its argument is that MSPs can be held accountable for risks in systems they don't directly control. That matters more as security requirements and oversight increase.
AI adds its own questions. MSPAlliance's September 2026 office hours on AI governance covered writing an AI acceptable use policy, whether your MSA mentions AI, how to audit AI use and where to keep a human in the loop. If you plan to let any AI act in client tenants, settle what permissions an AI agent should have and build a risk-based autonomy matrix before the pilot.
Solutions for MSPs: cross-stack diagnosis and execution with guardrails
The fix for most of these challenges is the same approach. Use how your team already handles each request, act across the stack with guardrails, and close the loop in the PSA. Diagnosis should run checks in parallel, correlate the results and propose a likely cause in seconds, and routine L1 actions should run with approvals inline and a full audit trail.
Cross-stack checks first, then targeted remediation
Ambiguous tickets get cheap when the system pulls identity status, device telemetry and service health at the same time and correlates the signals, whether the cause is a VPN split tunnel misconfiguration, a crashed print service or a failed MFA enrollment. Once a fix is safe and in scope, deploy it through your RMM, confirm it worked and record the result in your PSA. If a human is needed, hand the ticket over with everything attached, including next steps.
In practice the flow looks like this:
- Intake in the PSA or chat, with targeted follow-up questions to fill gaps
- Parallel checks across the identity provider, RMM and service health
- Correlation and a recommended action, with a confidence score
- Run safe fixes, and ask for approval where policy requires it
- Notify the user, update the ticket, and close or dispatch
Start narrow and widen as trust builds
Time to value matters because you don't have quarters to wait. Start with resets, unlocks and MFA re-enrollments, then expand as trust builds, and use the first weeks to tune guardrails and permissions. The guide to autonomous L1 resolution covers which ticket types to add next. Once routine L1 runs around the clock, your weekends change and so does your margin.
Ready to see what that looks like in practice? See how Rallied AI works: Learn more about Rallied AI
How Rallied closes L1 tickets in your PSA
Rallied is the AI agent that closes MSP tickets in your PSA. It runs the fix in Microsoft 365 and your RMM, then writes the notes and time entry back to the ticket, so the work in the flow above happens without a tech logging into four consoles.
Where it works and where it stops
Rallied works with ConnectWise, HaloPSA and Autotask on the PSA side, with Microsoft 365, with RMMs including NinjaOne, and with IT Glue or Hudu, where it pulls the client's documentation during triage. Triage and diagnosis run on every ticket.
It acts only where your policies allow it. When it can't finish a ticket or isn't allowed to act, a tech picks it up with the triage and diagnosis already written, and Rallied doesn't charge for that ticket.
What it costs
Rallied is $300 a month, billed monthly, with 2,000 credits included. Each ticket is charged once for the most work the agent did on it: 1 credit for replies, notes and status updates, 3 credits for looking up or changing something in another system such as resetting a password, and 8 credits for work across three or more systems using six or more actions, or running a script. In Rallied's production data a charged ticket averages about 2.7 credits, so 2,000 credits covers roughly 700 tickets in a typical month, though that is a typical figure and not a guarantee.
Setup, tickets where the agent took no action, and tickets it couldn't finish are never charged. At zero credits the agent pauses and posts an internal note on the ticket, and nothing is charged beyond your balance.
Want to move routine L1 off your techs so they can spend the time on L2, L3 and project work? Get started with Rallied AI: Learn more about Rallied AI
If your goal is higher margins, fewer nights on call and a help desk that doesn't drown in repeats, see what Rallied does against your own queue: Learn more about Rallied AI
Frequently Asked Questions
What is an MSP?
A managed service provider is a third-party company that takes ongoing responsibility for a client's IT infrastructure and end users. It monitors and maintains systems proactively under a subscription and a service level agreement. Break/fix support is different because it only arrives after something fails.
How do MSPs charge for managed services?
Most MSPs bill an upfront setup or transition fee, then a flat or near-fixed monthly fee. STACK Cybersecurity puts managed IT services in the United States at roughly $100 to $300 per user per month, with higher tiers for advanced security and compliance. The range varies widely with scope, industry requirements and how complex the environment is.
How big is the MSP industry?
Grand View Research estimated the global managed services market at $401.15 billion in 2025 and projected $847.41 billion by 2033. An IDC Spotlight cited by SAP projects $711 billion by the end of 2028. The two estimates use different definitions and timeframes, so read them as a direction.
What are the biggest challenges MSPs face?
The common ones are margin lost to manual L1 tickets, automation tools that take months to set up, after-hours coverage and SLAs, and identity work that has to be fast and auditable. MSPAlliance has also pushed vendor risk and AI governance up the list in 2026, through its coverage of the ConnectWise Cloud Backup incident and its September session on AI policies.
Which L1 tickets can an AI agent close on its own?
Password resets, account unlocks, MFA re-enrollments, mailbox and group permissions and simple license changes are the usual starting set, because they repeat and need little judgment. The agent needs permission to act in your identity provider and RMM, plus approval rules for anything your policy says a person must sign off. Start with a narrow set and widen it as you check the results.
How much does Rallied cost?
Rallied is $300 a month, billed monthly, with 2,000 credits included. A charged ticket averages about 2.7 credits in Rallied's production data, so 2,000 credits covers roughly 700 tickets in a typical month, though that is not a guarantee. Setup, tickets with no action taken and tickets the agent couldn't finish are never charged.