The MSP Model Is Changing — and the Software Stack Changed It

Walk into any managed service provider in America and you will find the same business. Not a similar business — the same one. The same PSA managing the same ticket workflows. The same RMM pushing the same patch schedules. The same QBR deck, often generated from the same vendor template, presenting the same "proactive vs. reactive" narrative that was written a decade ago.

This is not an accident, and it is not laziness. It is the franchise model. MSPs are franchise players. They don't design their operating model — they buy it from ConnectWise, Kaseya, NinjaOne, and Datto, and then they run the playbook those platforms prescribe. The peer groups and benchmarking organizations standardize the rest: the per-user pricing bands, the seat-plus-stack bundles, the agreement templates, the margin targets.

For twenty years, this worked. The franchise model exists because standardization was genuinely valuable — an owner-operator with eight technicians should not be designing patch management workflows from scratch. But the franchise playbook was written for a world that no longer exists, and the incentives inside it make it hard for a franchisee to rewrite the parts that no longer serve you.

To understand why the shape of the relationship needs to change, you have to start where the model itself started: the software stack.

The stack built the business

The modern MSP was not invented by entrepreneurs. It was invented by software vendors.

In the early 2000s, remote monitoring and management platforms made it possible to watch hundreds of servers and workstations from a single console. Professional services automation suites bolted a business on top: ticketing, time tracking, agreements, invoicing. Together, the PSA and RMM didn't just support the managed services model — they defined it. The unit of value became the monitored endpoint. The unit of revenue became the seat. The unit of work became the ticket.

Everything downstream followed from those design decisions. Pricing is per-user-per-month because the RMM licenses per endpoint. Service delivery is organized around ticket queues because the PSA is organized around ticket queues. The technician labor pyramid — L1 triage, L2 escalation, L3 engineering — exists because the tooling assumes a human touches every ticket and the billing model needs to account for that human's time.

The outcomes that were worth paying for in 2015

Be fair to the model: the outcomes it sold used to be hard, and they used to be valuable. Ten years ago, a mid-sized company genuinely could not do these things well without help:

Patch compliance. Keeping Windows fleets patched required WSUS servers, testing rings, maintenance windows, and someone who cared. Unpatched machines were how ransomware got in. An MSP that kept you at 98% patch compliance was earning its fee.

Endpoint protection. Antivirus had to be procured, deployed, updated, and monitored. Definitions went stale. Agents broke. Someone had to watch the console.

Backup verification. On-premises servers meant on-premises backup — tape rotations, then BDR appliances, then cloud replication. "Are the backups actually running, and can we actually restore?" was a question that required a human to answer weekly.

Uptime monitoring. Exchange servers, file servers, domain controllers, SQL boxes — the server closet was a zoo of things that failed, and knowing something was down before the users did was real value.

Help desk response. When something broke, a human answered within an SLA window and worked the ticket. Fifteen-minute response time was a differentiator worth paying a premium for.

The vCIO conversation. Quarterly, someone in a polo shirt reviewed a report, recommended a hardware refresh, and translated technology into business language for an owner who had no one else to ask.

Every one of these was a legitimate outcome in 2015. Every one of these is what MSP agreements still enumerate in 2026. And that is where the mismatch lives — because in the intervening decade, almost all of them stopped being outcomes and became defaults.

Microsoft ate the stack

The single biggest thing that happened to the MSP industry was not an MSP industry event. It was Microsoft absorbing the entire management layer into the platform itself.

Patch compliance is now Windows Autopatch and Intune update rings — policy-driven, self-enforcing, reported natively. Endpoint protection is Defender, built into the OS, managed from the same console, fed by one of the largest threat intelligence operations on earth. Identity, conditional access, and device compliance live in Entra. Configuration is Autopilot and policy, not imaging and hands-on-keyboard. The server closet that generated all that monitoring value has largely evaporated into M365 and SaaS, where uptime is Microsoft's problem, backed by an SLA no MSP could ever have offered.

The honest way to say it: the "managed" in managed services was mostly the operational burden of pre-cloud Microsoft. Microsoft fixed it. The invoice line items for that work often did not move.

What did the franchise platforms do in response? They kept selling agents. The RMM still deploys a monitoring agent to a laptop whose patching, protection, and compliance are already governed natively by Intune and Defender — a redundant layer whose principal function is to justify the per-endpoint line item. The stack that created the industry now exists substantially to preserve the industry's billing model.

The ticket is the product, and that's backwards

Strip away the stack and look at what's left of the value proposition: the help desk. This is where the model's incentives fully invert.

An MSP's per-seat revenue is fixed. Its costs are labor. The economically rational MSP therefore wants tickets to be cheap to handle, not rare. There is no mechanism in the standard agreement that rewards eliminating the causes of tickets — root-causing the recurring VPN issue, fixing the onboarding process that generates three tickets per hire, deflecting the password reset entirely. Every one of those improvements reduces billable justification at renewal time. The QBR will report ticket volumes and response times with pride, because response time is the one metric the model can optimize without threatening itself.

Meanwhile, the labor pyramid that services those tickets is the model's largest cost and its softest point. L1 triage — read the ticket, categorize it, ask the clarifying question, run the known fix, escalate if stuck — is precisely the work that large language models now perform at near-zero marginal cost, around the clock, in any language, with perfect recall of every prior ticket. The franchise platforms know this. Their answer, predictably, is a copilot: an AI that helps the technician work the ticket faster. It is hard for it to be anything else, because the platforms monetize per technician. A franchisor is slow to ship the feature that eliminates the franchisee's headcount, because that headcount is the franchisor's revenue. The evidence is now in the field: in Atomicwork's State of AI in IT 2026 survey, 82% of IT professionals report tangible value from their AI investments and 67% call the ROI positive — the commoditized layer of the work is genuinely being automated away.

That is the structural tension in one sentence: the MSP's operating model is rented from vendors whose revenue depends on the old model surviving — which makes it hard for the MSP to price against the technology that has already changed the work.

What the customer is actually paying for in 2026

Add it up from the buyer's side. A 200-person company paying $150 per user per month is spending $360,000 a year. For that, in 2026, they receive: a monitoring agent duplicating what Intune already does, patch reports restating what Autopatch already enforces, an after-hours answering service, a queue of L1 technicians performing triage that a model performs better, and a quarterly meeting recommending they buy more of the stack.

The outcomes that were worth $360,000 in 2015 are worth a fraction of that now — not because the MSP got worse, but because the platform got better and the standard MSP agreement was not written to pass those gains back to you. The pricing survived the value it was priced against. That's the gap the renewal conversation has to close.

How to renegotiate the relationship

The move here is not to leave your MSP. It is to audit what they still genuinely add, and to renegotiate scope against the work that software now does. Three principles keep the conversation honest:

Native, not agented. For the endpoint fleet, management should happen where Microsoft put it — Entra, Intune, Defender, Graph — not through a redundant third-party agent layer priced per endpoint. Line items that duplicate native capability are the first candidates to come off the contract.

AI as the fulfiller, not the copilot. Password resets, access requests, and other high-volume categories should be resolved by an agent that closes the ticket, with humans handling exceptions, engineering, and judgment. Where your MSP is willing to pass those deflection gains through in price, keep them; where they aren't, that scope belongs with an operator whose model is built around it.

Outcomes with physical teeth. Software deflects tickets, but laptops still have to be imaged, shipped, recovered, wiped, and certified. Device logistics — real facilities, chain of custody, compliant data destruction — is the part of IT operations that no platform absorbed and no software-only vendor can replicate. It is also the part the franchise stack never really covered. If your MSP does not offer it, that is a gap to close, not a reason to fight.

The practical shape of the new relationship is usually this: keep your MSP for the work they are genuinely good at — the projects, the escalations, the vendor-management, the on-prem oddities, the industry expertise — and move the commoditized endpoint layer to a productized operator whose pricing tracks what the software actually costs to run. How you realize the saving from there — a smaller MSP contract, internal IT redeployed to core-business work, or both — is your decision to make. The article is only trying to help you make it with clean numbers.