Managed IT services

This page explains what managed IT services include, how they work day to day, what they cost to plan for and how to choose a provider. It is written for owners, office managers and operations leads of small and mid-sized organizations: law firms, clinics, dental offices, accounting firms, brokerages, trades offices, nonprofits, schools and manufacturers. Canada Create™ is a Toronto agency with an office at 126 Willowdale Avenue, serving organizations across Canada with managed IT alongside our web, marketing and security work.

Contents

• What managed IT services cover
• The managed IT service family
• Help desk, people and devices
• Microsoft 365, email and the cloud
• Networks, Wi-Fi and the office
• Backups and recovery planning
• Security basics and how they connect to cyber security
• Organizations that use managed IT and what each needs
• AI tools, copilots and governance
• Privacy and compliance to plan for
• How we work
• What managed IT costs
• How to choose a managed IT provider
• Your next step

What managed IT services cover

Managed IT means handing the ongoing care of your technology to an outside team for a predictable monthly fee, instead of calling someone only when something breaks. The provider looks after the people who use the technology, the devices they use, the accounts they sign in to, the network that connects them and the data they cannot afford to lose. The point is less firefighting and more planning: problems are caught earlier, changes are documented, and somebody owns the question of what your office needs next year.

The everyday side

Most of the value shows up in ordinary moments. A new hire starts on Monday and has a working laptop, an email address, the right shared folders and a phone extension. A partner cannot print a closing document and gets help within the same conversation. A password is reset properly, with the right checks, rather than shared over text. A laptop that has missed its updates is flagged and fixed before it becomes a problem. None of this is dramatic, which is exactly the goal.

The planning side

The other half is the work owners rarely have time for: keeping a list of every device and when it should be replaced, knowing which software subscriptions you pay for and who uses them, deciding when to move a file server to the cloud, and setting a yearly technology budget that does not surprise anyone. A good managed IT relationship produces written answers to these questions and updates them as the organization changes.

What it is not

Managed IT is not a single product you install. It is also not the same as a full security operations service, website hosting or software development, although it touches all of them. Clear scope matters, so the written proposal should list exactly which users, devices, locations and systems are covered, and which related services sit alongside it.

The managed IT service family

The words used for this work overlap, and buyers search for it in many ways. Here is how the main names relate, so you can compare offers on equal footing. Each of these will get its own page over time; for now they are explained here.

MSP and managed service provider

An MSP, or managed service provider, is the company that delivers managed IT. When you see MSP in a proposal, it simply means the outside team responsible for your technology on an ongoing basis, usually with a defined scope and a monthly fee. If you run an MSP yourself and are looking for clients rather than support, our page on marketing for MSPs and IT providers is the one written for you.

IT support, IT support services and help desk support

IT support is the reactive part: answering questions, fixing problems and handling requests. Help desk support is the front door to it, the place your team sends a ticket, an email or a phone call. In a managed arrangement, IT support services are bundled with the proactive work rather than billed one call at a time.

IT services, IT consulting and IT consulting services

IT services is the broad umbrella. IT consulting is advice and planning: an assessment of what you have, a roadmap, help choosing software, or a second opinion before a large purchase. IT consulting services are often sold as projects, while managed IT is ongoing, and many organizations use both.

IT outsourcing

IT outsourcing means handing some or all of your technology function to an outside firm. For a small office it usually means the provider is the IT department. For a larger one it may cover only the help desk, after hours coverage, or a specific system while an internal person keeps the rest.

Cloud migration, Microsoft 365 support, data backup and network support

These are the focused strands inside managed IT. Cloud migration moves files, email and applications off old servers and into cloud services. Microsoft 365 support covers licences, email, Teams, SharePoint and OneDrive. Data backup covers copies of your information and the ability to restore it. Network support covers the internet connection, firewall, switches and Wi-Fi. Each is covered in more detail below.

IT security services

IT security services is the overlap between managed IT and cyber security. The everyday basics belong in any managed IT plan, while deeper testing, compliance and monitoring are handled by our cyber security services.

Help desk, people and devices

For most owners, the help desk is managed IT. It is where staff feel the difference, and where a provider earns or loses trust.

How a help desk request should flow

A good help desk has one clear way to ask for help, a record of every request and a person who owns each one until it is closed. Most requests, such as a stuck application, a mailbox rule or a printer queue, are solved over a secure remote session with the user watching. Requests that need hands on equipment are scheduled. Recurring problems are noted, so the fifth time the same laptop freezes leads to a fix for the cause rather than a fifth restart.

Onboarding and offboarding

New staff need an account, a licence, a device, access to the right shared drives and applications, multi-factor authentication set up on day one and a short welcome on how to ask for help. Departing staff need the opposite, done the same day: sign in blocked, devices collected and wiped, mailbox converted or forwarded, files handed to a manager and shared passwords changed. A written checklist for both is one of the simplest and most useful things a managed IT provider can give you.

Devices, patching and the asset list

Every laptop, desktop, tablet and phone that touches company data should be on a list with its owner, purchase date and condition. Operating system and application updates should be applied on a schedule and checked, not left to each user. Devices should be encrypted, protected with a screen lock and manageable, so a lost laptop can be locked or wiped. The asset list then drives the replacement plan, so you replace a few machines each year instead of all of them in a crisis.

Printers, phones and line of business software

Small offices often lose the most time to the least glamorous equipment. Multifunction printers, scanning to email, desk phones and softphones, and the trade software your office relies on, such as practice management, accounting, estimating or design applications, should all be in scope and documented, including who the vendor is and how to reach their support.

Microsoft 365, email and the cloud

For most small and mid-sized organizations in Canada, Microsoft 365 or Google Workspace is now the centre of daily work: email, calendars, files, chat and video meetings. Getting it set up well matters more than any single device.

Microsoft 365 support

Microsoft 365 support covers the right licence for each person, shared mailboxes for general inboxes, distribution lists, Teams channels that match how your office actually works, SharePoint sites for shared files and OneDrive for personal ones. It also covers the security settings that often get skipped during a rushed setup: multi-factor authentication for every account, limits on who can be an administrator, rules against automatic forwarding to outside addresses and sensible sharing settings for external guests.

Email that arrives

Email trouble is often a configuration issue rather than a server issue. Your domain needs correct SPF, DKIM and DMARC records so that messages you send are trusted and messages pretending to be you are rejected. When a website form, a CRM or a newsletter tool also sends mail from your domain, each needs to be authorized properly. This is one place where IT and marketing meet, and where having one team that understands both, from IT to CS+, our CRM, avoids finger pointing.

Cloud migration

Many offices still run an old file server in a closet or an accounting application on one aging computer. Cloud migration plans the move: what goes to SharePoint or OneDrive, what stays on a local server, how folder permissions carry over, and how staff are shown where things now live. A careful migration is staged, tested with a small group first and timed around your busy periods. Some line of business applications are not ready for the cloud, and a good plan says so plainly.

Licences and vendors

Software subscriptions add up quietly. A managed IT provider should keep a register of every licence, who uses it and when it comes up, and flag unused seats before they are paid for again. Software licences are paid to the vendor and shown separately from our fees, so you always see what goes to Microsoft or another platform and what goes to us. The same register should list your internet provider, phone carrier, domain registrar and website hosting account, with who to call for each.

Networks, Wi-Fi and the office

The network is the plumbing nobody thinks about until the video call freezes. Network support keeps it reliable and secure.

Internet, firewall and switches

A business internet connection should have a firewall that is supported, updated and configured for your office rather than left on factory settings. Switches and cabling should be labelled so a move or an expansion does not turn into guesswork. Where the internet connection is critical, a second connection from a different carrier can take over if the first fails, and the plan should say which offices need that.

Wi-Fi that matches the space

Good Wi-Fi is about placement and separation. Access points should cover the rooms people actually work in, staff devices should sit on a different network from guests, and smart TVs, cameras and other connected gear should be kept apart from computers that hold client files. Clinics, law offices and showrooms that offer guest Wi-Fi should never let it reach the same network as their records.

Multiple locations and people on the move

Organizations with more than one location, a warehouse, a job site trailer or staff who travel need secure access to shared files and applications from anywhere. Often the cleanest answer is moving files to the cloud rather than building tunnels back to an office server. Where a secure connection back to the office is still needed, it should require multi-factor authentication and be documented.

Backups and recovery planning

Backups are the part of IT every owner assumes is done and few have tested. Data backup in a managed plan answers three plain questions: what is copied, where the copies live and how quickly you can get them back.

What to back up

Servers and line of business databases are obvious. Less obvious are Microsoft 365 or Google Workspace mailboxes and files, which the platform keeps available but which many organizations also choose to back up separately, so a deleted folder or a compromised account does not mean lost work. Laptops that hold files outside the cloud, accounting data and the configuration of your firewall and phone system belong on the list too.

Where copies live

A sound approach keeps more than one copy, on more than one kind of storage, with at least one copy kept away from your office and protected from being changed or deleted by an attacker who gets into your network. Where client or patient data is involved, ask where the copies are stored and choose Canadian storage where your obligations or your clients expect it.

Testing restores

A backup that has never been restored is a hope, not a plan. Restores should be tested on a schedule and the results recorded. The recovery plan should name what gets restored first, who decides, and how staff keep working in the meantime, whether that is a spare laptop, cloud access from home or a paper process for the front desk. Recovery speed depends on your systems and budget, so set expectations in writing rather than accepting a vague promise.

Security basics and how they connect to cyber security

Security in a managed IT plan starts with basics that are inexpensive and effective, applied consistently to every account and device.

The basics every office should have

• Multi-factor authentication on email, file storage, banking, payroll and any system that holds client data.
• A business password manager, so staff stop reusing passwords and shared logins are stored and changed properly.
• Separate administrator accounts that are used only for administration, held by as few people as possible, with the owner holding a copy.
• Device encryption, automatic screen locks and endpoint protection on every computer.
• Updates applied on a schedule, with exceptions recorded.
• Staff who can recognize a suspicious message and know who to tell.

Phishing and staff training

Most incidents in small offices start with a convincing email or text. Short, regular training and simulated phishing messages build the habit of pausing before clicking, and of reporting rather than hiding a mistake. Our security awareness training for staff covers this in depth.

When you need more than the basics

Some organizations need evidence for insurers, clients or regulators, or simply want an independent view. A cyber security audit reviews your setup against good practice. Penetration testing checks whether an attacker could actually get in. Cyber security compliance work helps you document controls for a framework or a client questionnaire. Managed security services for monitoring and response add continuous watching of alerts, and cloud security reviews focus on Microsoft 365, Google Workspace and other cloud settings. Managed IT keeps the house in order; these services test and watch it.

Organizations that use managed IT and what each needs

Managed IT suits any organization that depends on computers but does not want to run an IT department. The needs differ by trade, and a good provider asks about yours before proposing anything.

Law firms

Firms live in documents and email. They need reliable document management, secure client file sharing, careful handling of trust accounting software, and strict offboarding when a lawyer or clerk leaves. Partners also want their mobile devices managed without losing control of personal ones. Confidentiality expectations from clients and the law society shape how files are stored and shared.

Clinics, dental offices and other health practices

Practices depend on scheduling and charting software, imaging equipment, front desk computers and phones that must work from the first appointment. They need patient information kept in systems built for it, guest Wi-Fi separated from clinical systems and backups that cover the practice database. In Ontario, health information custodians follow PHIPA, which shapes access, logging and breach handling.

Accounting, bookkeeping and tax firms

Tax season is the stress test. Firms need every workstation updated and every licence ready before the busy period, secure client portals instead of email attachments, and backups of accounting data that are tested before deadlines rather than during them.

Real estate, mortgage and insurance brokerages

Brokerages have agents and brokers who work from phones and cars as much as desks, often on their own devices. They need clean onboarding and offboarding as people join and leave, strong protection on email accounts that handle deposits and closing details, and clear rules about client documents on personal phones.

Construction, trades and field service offices

These offices combine a small head office with crews in the field. They need estimating and accounting software kept healthy, shared drawings and photos accessible from job sites, rugged tablets or phones managed centrally, and a reliable way to add and remove seasonal staff.

Nonprofits, charities and schools

Nonprofits and independent schools often run on donated or older equipment and a patchwork of accounts created by volunteers. They benefit most from consolidation: one set of accounts, a list of who has access to what, nonprofit licensing where eligible, and clear handover notes so knowledge does not leave with a volunteer or a staff member.

Manufacturers and distributors

Plants and warehouses mix office computers with production equipment, scanners and inventory systems. They need the office network separated from machines on the floor, careful timing for updates around shifts, and a recovery plan that keeps orders and shipping moving.

AI tools, copilots and governance

AI tools arrived in most offices before anyone wrote a policy for them. Staff are already pasting text into chat assistants, using meeting transcription and trying writing tools built into email. Managed IT now includes helping owners decide what is allowed, how it is set up and where company data goes.

Microsoft 365 Copilot and similar assistants

Assistants built into Microsoft 365 or Google Workspace can search across the mail, files and chats a user already has permission to see. That is useful, and it also means old sharing mistakes become visible quickly: a salary spreadsheet shared with everyone years ago can surface in an answer. Before turning these assistants on, review sharing permissions, tidy old shared folders and decide which groups get licences first.

A short AI use policy

A practical policy fits on a page. It lists approved tools, says which kinds of information must never be entered into public AI tools, such as client files, health details or financial records, explains how to check AI output before it reaches a client, and names who approves new tools. It should be part of onboarding and revisited as tools change.

Where AI helps the office itself

Beyond assistants, AI can answer common phone and chat questions, draft routine replies and route requests. Those projects belong with our AI agency services, where chat and voice agents are planned with your own data rules in mind. The IT side makes sure accounts, permissions and records behind them are sound.

Privacy and compliance to plan for

Technology decisions carry privacy obligations. Your provider should help you meet them, while your own lawyer or advisor confirms what applies to you.

PIPEDA breach reporting

Under PIPEDA, private sector organizations must report breaches of security safeguards that create a real risk of significant harm, notify affected people and keep records of breaches. That makes logging, access records and a written incident plan practical necessities rather than paperwork. Your IT setup should make it possible to answer what happened, when and to whose information.

PHIPA for health custodians in Ontario

Clinics and other health information custodians in Ontario follow PHIPA, which sets expectations for who can access personal health information, how access is tracked and what happens after a privacy breach. Systems that hold patient records should be chosen and configured with that in mind.

Quebec and Law 25

Organizations that handle personal information of people in Quebec have additional obligations under Law 25, including naming a person responsible for personal information and assessing privacy impacts in certain projects. Our team works in English and French, which helps when policies and staff guidance are needed in both languages.

Storage location and records

Know where your data lives, who at your provider can reach it and how access is logged. Keep a simple record of systems that hold personal information. This is a marketing observation, not legal advice.

How we work

Our approach is plain and written down at each step.

1. A free review first. We talk through your users, devices, locations, software and what is frustrating today, and look at what you already have in place.
2. A written plan and proposal. You receive the scope, what is in and out, the onboarding steps and fees quoted in writing. We aim to get you a proposal in one business day once we have the details.
3. Onboarding at agreed milestones. We document your environment, confirm admin access is held in your name, fix the urgent gaps and set up the help desk process with your staff.
4. Ongoing care and monthly reporting. Each month you see the requests handled, the updates applied, backup checks, devices due for replacement and recommendations for the next quarter.

Accounts and documentation in your name

Your Microsoft 365 or Google Workspace tenant, domain, firewall, backup accounts and software licences are registered to your organization, with an owner level administrator account that you hold. The documentation we keep, including network diagrams, the asset list, the licence register and the onboarding checklist, belongs to you and is available whenever you ask.

One team for IT and the rest of your technology

Because Canada Create™ also builds websites, runs marketing and provides website maintenance and security, issues that cross the line between IT and the web, such as email records, form delivery or a CRM that needs new users, are handled without bouncing between vendors. You can see the full list of our services to understand what sits alongside managed IT.

What managed IT costs

Managed IT fees are quoted in writing after the free review, because the honest answer depends on what you have and what you need. Here is how pricing usually works across the field and what moves it.

Common pricing models

• Per user. A monthly fee for each person supported, covering their devices and accounts. Simple to budget as you hire.
• Per device. A fee for each computer, server or network device. Useful where shared workstations outnumber people.
• Flat monthly. One fee for a defined environment, reviewed when the organization changes.
• Project. A fixed scope for one piece of work, such as a cloud migration, a new office fit out or a network rebuild.

What drives the price

The number of users and devices, the number of locations, the age and variety of your equipment, the line of business software involved, the hours you need covered, regulatory needs, backup volume and how much cleanup is needed at the start all affect the fee. An office with tidy, modern equipment costs less to support than one with a mix of aging machines and undocumented accounts.

What is shown separately

Hardware, Microsoft 365 or Google Workspace licences, backup storage and other software are paid to the vendor and shown separately from our fees, so you can compare offers fairly. When comparing quotes, check that each one covers the same users, devices, hours and services, and ask what counts as a project billed separately.

How to choose a managed IT provider

Choosing a managed IT provider is choosing who holds the keys to your office. These questions help you compare.

• Who owns the accounts? The answer should be you. Your tenant, domain, firewall, backups and licences should be registered to your organization, with an owner level admin account you hold.
• What exactly is in scope? Ask for a written list of users, devices, locations, software and services covered, and what is billed as a project.
• How do staff ask for help? Look for one clear channel, a record of every request and named ownership of each ticket.
• How are backups tested? Ask how often restores are tested and whether you see the results.
• What documentation will we have? You should receive an asset list, licence register, network notes and onboarding and offboarding checklists.
• How is security handled? Ask about multi-factor authentication, admin accounts, patching and staff training, and how deeper security work is arranged.
• What do monthly reports show? Ask to see a sample so you know what you will receive.
• Can they support your languages and locations? Ask about service in French if your team or clients need it, and about your offices outside Toronto.

Signs of a good fit

A good provider asks about your work before talking about tools, explains trade offs in plain language, puts fees and scope in writing, and is comfortable with you holding every admin password. You can learn about our team and history, which goes back to 2008, and check that we are a BBB Accredited Business with an A+ rating.

Offices across Canada

We are based in Toronto and support organizations across the GTA and the rest of Canada. You can see the cities and regions we serve, and ask during the free review how support will work for each of your locations.

Your next step

Start with a free managed IT review. Tell us how many people and locations you have, what software your office relies on and what is not working today. We will look at your setup and send a written plan with fees quoted in writing.

Call our Toronto office at (416) 273-9030 or the 24/7 toll-free sales and support line at +1 (800) 808-9235, or send us a message through our contact page. We reply within one business day. You are welcome at our office at 126 Willowdale Avenue, Suite 3, Toronto.