The company has 45 people and a single IT person, who also handles purchasing and now and then fixes the printer on the second floor. One Monday he goes on vacation, and by Tuesday nobody knows how to reset a Microsoft 365 password. On Wednesday, management decides to "outsource IT". On Thursday the proposals arrive, each one covering everything from the network to the servers, and nobody knows where to start.
Managed IT services work for a small or mid-sized business when you buy them in pieces and in the right order. Outsourcing everything at once tends to end in a large contract nobody supervises and a messy handover. A better approach is to start with repetitive, measurable work, keep decisions in-house, and add managed services as each one proves itself.
We've already written about what managed IT services include and about weighing outsourced versus in-house support. The question here is narrower: if you're going to outsource, what goes first?
Why outsourcing everything at once backfires
When a provider takes over everything, it spends its first weeks learning how your operation is put together. If that overlaps with a password reset campaign, an email migration and a laptop refresh, any problem becomes hard to pin on anyone. Was it the provider, the documentation, or a process that never existed?
Starting with one narrow area lets you measure the service with two or three indicators and gives your team time to get used to working with an outside firm. And if the provider doesn't work out, replacing it after four months is cheap.
A sensible order to start with
There's no single sequence. In SMBs this order has worked well for us, because each stage cleans up something the next one needs.
| Stage | What to outsource | Why at this point | What to measure |
|---|---|---|---|
| 1 | Help desk and user requests | High-volume, repetitive and easy to measure | Response time, tickets solved on first contact |
| 2 | Microsoft 365 administration | Onboarding, offboarding, licenses and access depend on clear procedures | Time to create and remove users, accounts without an owner |
| 3 | Endpoints and updates | Needs the inventory the earlier stages left behind | Share of devices current on patches |
| 4 | Backups and restore tests | You need to know which data matters and where it lives | Successful test restores per quarter |
| 5 | Monitoring of servers, network and services | Only useful once someone is ready to act on alerts | Incidents caught before a user complains |
Help desk first
The help desk is the most natural way in. Tickets can be counted and classified, and within the first month you know whether the service responds. It also gives you a record of the problems that keep coming back, which helps you decide what to hand over next.
Microsoft 365 before infrastructure
In many small companies the mess is in Microsoft 365 rather than in the servers: former employees' accounts still active, licenses assigned to nobody, folders shared with "anyone with the link". Cleaning up onboarding, offboarding and permissions is procedural work, a good fit for an outside team with a clear service catalog.
Endpoints and updates
This is where laptops and desktops come in. Windows 10 support ended on October 14, 2025, and organizations can keep receiving security patches only by paying for Extended Security Updates (ESU), bought one year at a time for up to three years. If you still have Windows 10 machines, taking inventory and planning their replacement is a good first job for whoever takes this stage.
Backups, which aren't the same as the recycle bin
Plenty of companies assume Microsoft backs everything up. That's not quite how it works. In Exchange Online, deleted items can be recovered for 14 days by default, extendable to a maximum of 30. In SharePoint, deleted content is kept for 93 days from deletion. That's fine for recovering a file someone deleted by mistake. It won't help if the problem surfaces three months later, or if someone encrypts or wipes data in bulk.
Outsourcing backups means agreeing on what gets backed up, for how long, and how often someone tests a restore. If you've never restored a backup, you don't know whether it works.
Monitoring, last
Monitoring is only worth it if someone acts on the alerts. That's why it makes sense once a provider already has access, documentation and an SLA to respond. Buy it first and you usually end up with alert emails nobody reads.
What to keep in-house
You can outsource operations and still keep the decisions. These tasks should stay with someone inside the company, even if that person isn't technical:
- Setting priorities: which system is critical and what can wait.
- Approving access to sensitive information such as payroll, customer data or contracts.
- Deciding on software purchases and contract renewals.
- Acting as the provider's counterpart: reading the monthly reports and asking for corrections.
- Knowing the business processes in depth, which no outsider understands better than the people who live them.
In a small company that counterpart can be the finance and admin manager, or the IT person you already have. The role stops being about putting out fires and becomes about oversight.
How to prepare the handover
Before signing, pull together the minimum the provider needs so it doesn't start blind:
- An inventory of users, devices, licenses and applications, even if it's a spreadsheet.
- The list of admin accounts and who holds them today.
- Your current vendors (internet, phones, software) and their contacts.
- A log of the most frequent problems from the last few months.
Two contract issues shouldn't be left for later if you operate in Chile. If the service is delivered by the provider's staff under a subcontracting arrangement, the Dirección del Trabajo explains that your company is secondarily liable if it exercises its rights to information and withholding, and jointly liable if it doesn't. Asking for labor compliance certificates every month removes that risk.
The second issue is personal data. A provider that manages your accounts or backups can see employee and customer information, and acts as a data processor. Chile's Law 21,719 takes effect on December 1, 2026 and requires that relationship to be governed by a contract. Include it from the first stage, not after the provider already holds every password.
Frequently asked questions
What should a small business outsource first?
Usually the help desk. It's repetitive, easy to measure, and it leaves a record of problems that helps you plan the next steps.
Do managed IT services replace the in-house IT person?
Not necessarily. In many cases that person moves from solving tickets to managing the provider and setting priorities, which is exactly the part you shouldn't outsource.
Doesn't Microsoft 365 already include backups?
It includes recovery windows for deleted items (14 to 30 days for email, 93 days in SharePoint), but that doesn't replace a backup policy with defined retention and restore tests.
Start with one area and measure it
At Disrupsoft we run IT outsourcing with a Microsoft focus: staff augmentation by the hour or month, squads with a PM, developers and QA, and managed services with a catalog, response and resolution SLAs, and 9x5 or 24x7 coverage. If you want to work out where your company should start, look at the plans on Disrupsoft IT Outsourcing and tell us what you have today.
