Small Business IT Support and Managed IT

Small business IT support: what you need and what it costs

Most small businesses with 10 to 50 staff are best served by managed IT at $100 to $250 per user per month in published provider guides ¹³. Very small offices of one to five people can often get by with good setup and hourly help.

Two things decide which you need: how many people and devices you have, and how much damage a day of downtime or a hacked email account would cause. A three-person design studio working in the cloud has very different needs from a 30-person dental practice holding patient records.

Small businesses are not too small to be targets. In the Identity Theft Resource Center's 2025 survey of small business leaders, 81% reported a security breach, and among those breached, 36.7% faced costs over $500,000 ⁴. The FBI received 1,008,597 internet crime complaints in 2025 with $20.877 billion in reported losses, and business email compromise alone accounted for about $3.05 billion ⁵.

Our cybersecurity for small business page goes deeper on threats and security tools.

The minimum IT stack every small business needs

Every small business with employees needs the six items in the checklist above, and none of them is expensive on its own. These match what CISA, the SBA and cyber insurers ask for ⁶⁷⁸.

1. Multi-factor authentication (MFA). Turn it on for email first, then banking, payroll and anything with admin rights. A Microsoft study found MFA reduces the risk of account compromise by 99.22% ². CISA tells small businesses to enforce it with technical controls rather than relying on staff to turn it on ⁶.

2. Backups you have tested. Back up computers, any server, and your Microsoft 365 or Google data. CISA stresses regularly testing partial and full restores ⁶. Untested backups are a common unpleasant surprise in a ransomware recovery. See our backup and disaster recovery page for what a good setup looks like.

3. Automatic patching. The SBA advises setting software to install updates automatically ⁷. Exploiting unpatched vulnerabilities became the top way into breached organizations in the 2026 Verizon DBIR, at 31% of breaches ⁹. Any Windows 10 computer still in use needs Extended Security Updates, which cost $61 per device in year one and double each year ¹⁰.

4. Endpoint detection and response (EDR). Modern antivirus that watches behavior, not just known files. Microsoft Defender for Business lists at $3.00 per user per month ¹¹; managed versions with a human response team cost more.

5. Email security. Filtering for phishing and impersonation. Microsoft Defender for Office 365 Plan 1 lists at $2.00 per user per month ¹².

6. A properly configured Microsoft 365 or Google Workspace tenant. Security defaults on, separate admin accounts, licenses in the company's name, and a departing-employee routine. Our Microsoft 365 support page covers this setup in detail.

If you buy cyber insurance, expect the application to ask about most of these. Our cyber insurance requirements page lists the usual questions.

What IT costs at small scale

A 10-person office paying for managed IT should budget roughly $12,000 to $30,000 a year, using the $100 to $250 per user per month range from published guides ¹. That is our arithmetic, and it usually includes the help desk, patching, monitoring and most security tools.

If you assemble the minimum stack yourself and pay for help hourly, the tool costs are small. Using list prices for 10 users:

Business Premium already includes Defender for Business and Intune device management ¹³¹¹, so many small offices do not need a separate antivirus product. The tools are the cheap part. The cost is the time to set them up correctly, check them every month and respond when something goes wrong. That labor is what a managed IT fee buys.

For the full range of pricing models (per user, per device, tiered bundles) and what moves a quote up or down, see our managed IT services pricing guide.

Break-fix vs managed IT for a small business

Managed IT is the better fit once you have about 10 staff, a server, or regulated data. Break-fix can work below that, as long as someone owns the routine checks.

Break-fix (hourly) support - You pay only when something breaks: $75 to $250 per hour, $300 or more for emergencies ¹. - No one monitors backups, patches or security alerts between calls. - Costs are unpredictable, and the provider earns more when things go wrong.

Managed IT (flat monthly) - A fixed per-user or per-device fee covering help desk, monitoring, patching and usually security tools. - Problems are often caught before staff notice them. - You pay every month whether or not anything breaks.

A middle route many small offices use: a managed plan for monitoring, patching and backups, with help desk requests billed hourly or in a prepaid block. Ask providers whether they offer this. If you are weighing an outside provider against hiring, our outsourced IT services page compares the costs of one in-house hire with outsourcing.

When a one-person business should not buy managed IT yet

A solo owner or a two-person business working entirely in the cloud usually should not buy a managed IT plan yet. Most managed IT plans are built around offices with several users, a network and shared devices, and the fee pays for monitoring you may not need.

Do these yourself instead, in one afternoon:

• Turn on MFA for email, banking, payroll and your domain registrar.
• Use a password manager.
• Set computers and phones to update automatically.
• Turn on the built-in disk encryption on your laptop (BitLocker or FileVault).
• Add a third-party backup for your Microsoft 365 or Google account.
• Write down where your passwords, licenses and domain login live.

Then keep an hourly IT contact for setup jobs and emergencies.

Revisit the decision when you hire your third or fourth person or take on health, financial or defense data. An insurer or client security questionnaire, a new server or a shared office network are also triggers. If you hold health information or work on defense contracts, the rules apply regardless of size. See HIPAA compliance services or CMMC for what those rules require.

How to choose small business IT support

Choose a provider that works with businesses your size, prices clearly, and includes the minimum security stack in the base fee. A good small business provider will tell you when you need less, not only when you need more.

Questions to ask:

1. What is the smallest client you support, and how many clients are under 25 users?
2. Are MFA enforcement, EDR, email filtering and backup with restore tests included, or extra?
3. Is help desk unlimited, or billed hourly?
4. Who owns the Microsoft 365 or Google admin account and the licenses? The answer should be your company.
5. What does onboarding cost, and what is the contract term?
6. Will someone come on site, and what does that cost?

Our guide to choosing an MSP has the full question list. To find providers near you, start at managed IT services, or send a short request through our form and a local provider will contact you within one business day.