Every managed service provider’s pitch sounds the same: proactive, responsive, security-focused, “like having your own IT department.” The differences — and they’re enormous — live underneath the pitch, in operations you can’t see from a proposal. The good news: twelve questions surface them reliably, and the way a provider answers is often as revealing as the answer. Here they are, with what to listen for. (Yes, we’re a provider publishing the list we’d be grilled with — that’s rather the point: the good ones want informed buyers.)

1. “Who answers when we call — your staff, or a call center?” Listen for: named local humans, and a real first-contact-resolution number. Outsourced tier-one isn’t automatically bad, but you should know before you’re on hold with it.

2. “What are your response commitments, in writing, and can you show us your actual performance against them?” The SLA question with teeth: providers who publish their real numbers to clients rarely have numbers worth hiding. Vague “we’re really fast” answers are an answer.

3. “What exactly is in the monthly fee — and what’s the complete list of what isn’t?” The apples-to-apples exercise: after-hours, on-site, projects, security tooling, item by item. The gaps between quotes are where surprise invoices are born.

4. “Walk me through your security stack, and who watches it at 3 a.m.” The 2026 sorting question. Listen for EDR with genuinely staffed monitored response, layered email defense, backup with immutable copies and a testing log, training — included, not a menu of upsells. “We install antivirus” is a time capsule.

5. “How do you verify our backups actually restore?” A date and a stopwatch number, or a pause. The pause tells you everything about how the invisible work gets treated.

6. “What does onboarding look like, and what will you document?” Listen for a structured first 90 days — discovery, cleanup, a written inventory and environment documentation. Providers who onboard casually support casually.

7. “Who owns our documentation and credentials, and what happens if we leave?” The character question. The business owns its environment’s knowledge, exportable on demand — full stop. Hesitation here is the exit predicting itself.

8. “What’s your contract term — and why do you need one?” Long contracts aren’t automatically wrong, but the question deserves a confident answer. Month-to-month providers have to earn the relationship monthly; it does wonders for service, which is why we’ve worked that way since ‘97.

9. “What will the strategic relationship look like?” Listen for real quarterly reviews with interpretation, a roadmap and budget you’ll actually see, and — the tell — examples of advising clients to spend less. A provider whose every recommendation points at their catalog is a sales channel with a help desk.

10. “How many clients our size, in our industry — and can we call two of them?” Then make the calls, and ask the references one question: what do you know now that you wish you’d known at signing? Also ask about a time something went wrong — how a provider handles the bad week is the product; anyone can handle the good ones.

11. “What does offboarding a client look like?” The mirror of question 7, asked separately on purpose: credentials handed over, documentation exported, tooling removed, on what timeline. Providers with a graceful documented exit are confident; providers without one are counting on friction.

12. “What would you fix first in our environment, and why?” After any assessment, this reveals judgment: listen for risk-ordered priorities tied to your business — the exposed backup gap before the shiny platform migration — with honest prices attached. A first-fix list that leads with their most profitable project has answered a different question.

Reading the answers

Three patterns across all twelve: specificity beats adjectives — dates, numbers, and documents versus “absolutely, we’re very proactive” · candor beats polish — the provider who says “here’s what we’re not great at” is showing you how the relationship will handle problems · and questions back are a good sign — a provider interrogating your business, your risks, and your downtime tolerance is designing a fit; one who quotes without asking is selling a SKU. Score your finalists against what a business your size should expect, weight the reference calls heavily, and remember the meta-signal: how a provider treats you during the sale — responsiveness, honesty, follow-through — is the ceiling of how they’ll treat you after it.

The bottom line

MSPs differentiate on operations, not pitches — and twelve questions expose the operations: who answers, what’s proven, what’s included, what’s owned, what happens at the exits, and whether the strategy is real. Ask them all, call the references, and grade candor over comfort. The provider relationship is a years-long dependency on another company’s habits; an hour of pointed questions is the cheapest diligence that dependency will ever get. One more lens worth adding to the twelve: the honest case for locally staffed support, including when geography genuinely matters and when it’s just marketing.