Managed Microsoft services: what belongs in the service level

Scope, stated as what is excluded

Every agreement lists what is included. Fewer list what is not, and the exclusions are where the disputes come from.

A specific exclusion list is a sign of a provider who has done this before: third-party applications they do not hold credentials for, hardware out of warranty, changes requested by someone outside the agreed contacts, work caused by changes the client made themselves.

Who holds the keys

This is the single most important clause and it is often missing. Does the client retain global administrator access to their own tenant? Can they revoke the provider's access unilaterally? Do they own the documentation?

A provider who is comfortable with the client holding their own keys is describing a relationship you can leave. One who is not is describing a dependency, whatever the notice period says.

• Client retains at least one global administrator account they control
• Provider access is named and auditable, not shared
• Documentation and runbooks are the client's, in a format they can read without the provider
• A defined exit process: what is handed back, in what form, within what period

Patching as a commitment, not a chore

Patching is in almost every agreement as a line item and almost never as a measurable commitment. The useful version states which systems are in scope, what the target window is for a critical patch, what the exception process is, and how compliance is reported.

Without that, patching is something that happens when there is time, and the reporting is a list of actions taken rather than a statement about coverage.

What ‘24/7’ actually covers

Round-the-clock coverage can mean a staffed operations centre, or an on-call rota, or an automated alert that reaches someone's phone and is triaged in the morning. All three are sold with the same two words.

The question to ask is what happens to a specific scenario at a specific time: a ransomware alert at 2am on a Sunday. Who is woken, what are they authorised to do without further approval, and how long until someone is actually working on it.

Review, and the right to change your mind

A service that is not reviewed drifts towards whatever is easiest to deliver. A regular review with asset, ticket and change reporting is what keeps the agreed scope and the delivered scope in the same place.

It is also when the agreement should be adjusted. The scope that was right at signing is rarely right two years later, and an agreement that cannot be amended without a renegotiation tends to get worked around instead.

Questions we get asked