← All Blogs

Out of scope: the two words that decide your real annual IT spend

By Best IT MSP Editorial Team - Updated October 20, 2026 - 11 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What does out of scope mean in a managed services agreement, and how did we evaluate it?

Out of scope means every task your monthly fee does not cover. In a managed services agreement it is the list that decides your real annual spend, because anything on that list arrives later as billable work at rate card prices.

Your real annual spend is a simple sum. Multiply the monthly fee by twelve, add a realistic estimate of the excluded work your year will produce, then compare proposals on that total. Two quotes with the same fee and different exclusions are not the same price. The monthly fee is the number every buyer argues about, and the exclusion list is the number that actually lands.

We evaluated the exclusions 4 ways, and none of them involved a vendor survey. We priced each commonly excluded item against published figures, using the IRS mileage rate for travel, the Department of Labor overtime rule for after-hours work, Bureau of Labor Statistics wage and turnover data for labour and staff moves, and Microsoft's own lifecycle and licensing pages for version upgrades. We then ran two illustrative proposals through the same arithmetic. Every dollar rate in this guide is illustrative, not market pricing.

One honest limit shapes the whole guide. No public dataset of MSP exclusion lists exists, so we quote no figure for how common any single exclusion is. The only authoritative exclusion list is the one in your own paperwork, which is where this method sends you.

This guide covers the exclusions and how to price them. For market ranges, read How Much Do Managed IT Services Cost?. For the clauses that cost the most money, read MSP Contract Red Flags. For the billing unit underneath the fee, read Per-User vs Per-Device Pricing, and for what a response promise commits to, read First Response vs Resolution SLA.

Why is the exclusion list a forecast of your invoices?

The exclusion list is a forecast because a provider excludes the work it expects to be asked for. Nobody writes a clause to carve out work that never happens. Read the list and you are reading what an experienced provider thinks your year looks like.

Follow the labour cost and the incentive is plain. The Bureau of Labor Statistics puts the median annual wage for network and computer systems administrators at $99,130 as of May 2025, which is about $47.66 across 2,080 working hours. The same agency reports that wages and salaries averaged $32.82 an hour and accounted for 70.0 percent of total employer costs in June 2026, so the fully loaded cost of that hour is roughly $68. An illustrative project rate of $175 an hour is about 2.6 times that cost. Inside the fixed fee, the hour is already paid for. Outside it, the same hour earns a margin the moment it is worked.

None of that is dishonest, and no reasonable buyer expects a provider to absorb unlimited project work for a flat fee. It does explain where the care goes. The brochure is written in adjectives. The exclusion list is written by someone who has watched hundreds of companies your size and knows what they ask for in month seven.

So a long exclusion list under a low monthly fee is not a bargain. It is a low base rate with the real work moved to a rate card. The fee buys the predictable work, the monitoring and the help desk, while the unplanned work is repriced every time it happens. The proposal that looks cheapest on page one is often the one that moved the most hours to page nine.

Negotiate the fee and you win a discount once. Negotiate the exclusion list and you change what the fee covers for the whole term.

What is usually out of scope in an IT support contract?

Nine items recur on exclusion lists more than anything else. Project work and migrations, hardware procurement and installation, third-party vendor liaison, after-hours work, site visits beyond a radius or a count, major version upgrades, structured cabling, security incident response, and user onboarding and offboarding above a threshold.

Project work and migrations

Project work is any job with a start, an end and a deliverable, which is why it sits outside a fee built for steady-state support. A cloud migration, an office move, a new site build and a firewall replacement all qualify. Ask what the agreement counts as a project, because an 8-hour threshold and no threshold at all produce very different years. Nobody should migrate a mailbox or a server on an open-ended hourly estimate, so ask for a statement of work with a fixed price or a capped estimate before anyone starts.

Hardware procurement and installation

Buying the hardware and installing it are two separate charges, and both usually sit outside the fee. Procurement is billed as the device cost plus a markup or a flat handling fee, and installation is billed by the hour from the rate card. Windows 10 support ended on October 14, 2025, so a refresh is on most small-business horizons rather than off them. Ask whether you may buy the hardware yourself, and what the provider charges to install hardware it did not sell you.

Third-party vendor liaison

Vendor liaison is the hours your provider spends on hold to somebody else's software, and it is excluded more often than buyers expect. Your practice management, accounting or ERP vendor runs its own support queue on its own clock. If nobody owns that call in writing, your office manager owns it. Total employer compensation costs for private industry workers averaged $46.89 per hour worked in June 2026, so 20 absorbed hours is about $938 of your own payroll rather than a saving.

After-hours work

After-hours work carries a multiplier because the provider's own labour does. Federal rules require covered employees to receive overtime pay for hours worked over 40 in a workweek at a rate not less than time and one-half their regular rate. A 1.5x after-hours rate is therefore normal, and a 2x weekend or holiday rate is common. Get the multiplier, the hour it starts, the minimum billing increment and who escalates a 2am call in writing, because a 15-minute call billed at a 2-hour minimum is the real price.

Site visits beyond a radius or a count

A site visit charge is travel, and travel has a published benchmark. The IRS set the business standard mileage rate at 76 cents per mile for July 1 through December 31, 2026, after 72.5 cents per mile for the first half of the year. A provider billing $1.50 a mile charges roughly double the federal rate, which can be fair when it also covers the technician's time, so ask which it is. Then fix the included radius in miles and the included visits per month.

Major version upgrades

Major version upgrades are excluded, and their dates are already published, which makes them the most forecastable line on the list. Microsoft's lifecycle page puts the extended end date for Windows Server 2016 at January 13, 2027 in Pacific time, which is the close of January 12. Deferring is not free, and it is not safe. Verizon finds that exploitation of vulnerabilities is now the most common initial access vector for breaches, at 31 percent. Windows 10 Extended Security Updates cost $61 per device for Year One, and the price doubles every consecutive year for a maximum of three years, and they are cumulative, so enrolling in Year Two means paying for Year One too. The program also excludes technical support, new features and customer-requested nonsecurity updates, which is an exclusion list inside an exclusion list.

Structured cabling

Cabling is a licensed trade, usually subcontracted, and almost always out of scope. Expect the subcontractor's price plus a coordination markup. Ask for that markup as a percentage and ask whether you may contract the cabling firm directly. Our Structured Cabling Buyer's Guide covers what the work involves.

Security incident response

Security incident response is the exclusion that lands at the worst possible moment, so it is the one to price before you need it. Verizon found ransomware in 48 percent of all breaches, up from 44 percent the previous year. IBM puts the global average cost of a data breach at $4.99 million and the average time to identify and contain one at 247 days. The FBI logged $20.877 billion in reported losses across 1,008,597 complaints in 2025, a 26 percent rise in a year. An incident response retainer agreed in advance fixes the rate, the hours and the escalation path before the clock starts.

User onboarding and offboarding above a threshold

Onboarding and offboarding above a stated threshold is billable, and national turnover data shows how often that threshold gets crossed. The 2025 annual average total separations rate was 3.3 percent, which is a monthly rate, and there were 62.8 million total separations against 63.0 million hires across the year. At that rate a 40-person business averages about 16 leavers and 16 joiners, so 32 staff moves a year. A threshold of 2 moves a quarter leaves 24 of them billable. Most of that movement is not yours to schedule, because quits were 38.0 million in 2025 and accounted for 60.6 percent of all separations. Use your own payroll history rather than the national average, because a stable team churns far less. What the onboarding fee should buy is a topic of its own.

How do you compare two quotes that exclude different things?

To compare two quotes, convert each one into a real annual spend. Multiply the monthly fee by twelve, price the excluded work you can forecast from that provider's rate card, and add the two together. The proposal with the lower fee often loses.

Run a 40-person business with 55 devices through two illustrative proposals. Provider A quotes $3,900 a month and excludes project work over 8 hours, hardware installation and cabling. Provider B quotes $2,950 a month and excludes all project work, hardware procurement and installation, vendor liaison, after-hours work, site visits above 2 a month, major version upgrades, cabling, security incident response, and staff moves above 2 a quarter. On fees alone, B saves $11,400 a year.

Now price B's exclusions for one ordinary year. 24 billable staff moves at an illustrative $150 each is $3,600. One Windows Server 2016 migration at 20 hours and $175 an hour is $3,500. Two after-hours call-outs of 4 hours at the 1.5x rate is $2,100. Ten extra site visits at a one-hour minimum, plus 30 miles each at the IRS rate of 76 cents a mile, is about $1,978. Installing 10 replacement PCs at 15 hours is $2,625. Twenty hours of vendor liaison absorbed by your own office manager at the average employer cost of $46.89 an hour is $938. B's excluded work totals $14,741.

Provider A's shorter list still bills. Installing the same 10 PCs costs $2,625, and the 20-hour server migration bills the 12 hours above its 8-hour threshold, which is $2,100. A's excluded work totals $4,725.

Real annual spend lands at $51,525 for A and $50,141 for B. The $11,400 headline saving has shrunk to $1,384, so 88 percent of it was consumed by the exclusion list. One 40-hour cloud migration erases most of what remains, because it bills 40 hours at B and 32 hours at A, a swing of $1,400.

Your inputs will differ, and that is the point of the method rather than a weakness in it. Halve the staff churn and B pulls ahead again by roughly $4,000. Add one security incident and A pulls ahead. The arithmetic only becomes possible when both rate cards are on the table, which is why the rate card matters more than the discount. A prepaid bank of block hours drawn against that rate card is one way to pre-price the work, so ask whether unused block hours expire.

What contract language should you ask for?

To price excluded work before it happens, ask for 3 things in the managed services agreement itself. A rate card attached as an exhibit, a written change order process, and a rule that no billable work above a stated approval threshold starts until you approve it in writing.

Attach the rate card, do not reference it. A referenced rate card is a document the provider can replace between terms. An attached exhibit is part of the agreement and changes only by amendment. Ask for every line you can foresee, including standard hours, after-hours, weekends, holidays, travel, project work and emergency response, and ask that those rates stay fixed for the initial term. That makes the price contractual rather than conversational.

Put the change order process in writing. The federal government does not accept verbal change orders either. FAR 2.101 defines a change order as a written order, signed by the contracting officer, directing the contractor to make a change. Copy the shape of it. Any out-of-scope work gets a written description, an hours estimate, a price and a named approver before it starts.

Set the approval threshold in dollars. Pick a number you can live with, perhaps $500, and write that no out-of-scope work above it begins without written approval. Below the threshold, let the provider act and report monthly, because an approval process that stalls a 20-minute fix helps nobody.

Six further clauses make the agreement explainable rather than negotiable every month.

• Define project work with a number, so an hours threshold decides what needs a statement of work.
• Name the after-hours rate, the hours it applies to, and the minimum billing increment.
• Fix the site visit radius in miles and the number of included visits per month.
• State the onboarding and offboarding threshold per quarter, and whether unused moves roll over.
• Price an incident response retainer and an escalation path before an incident, not during one.
• Require a monthly statement of billable work, so a true-up never arrives as a surprise.

None of this makes an IT bill perfectly predictable, and no honest provider promises that. It makes the bill explainable, which is the part you can hold somebody to. Termination rights, auto-renewal notice, SLA credits and documentation ownership belong in the same read-through, and we cover each of them separately.

What does the exclusion list tell you about the provider?

The exclusion list tells you which risks the provider has decided not to carry, and that information is free. A provider that excludes security incident response has told you who holds the bag during a breach. One that excludes vendor liaison has told you your line-of-business software is your problem.

Three questions turn the list into a conversation. Ask which exclusion they bill most often across their client base, because the honest answer names projects or staff moves and the evasive answer is a shrug. Ask for the last three change orders they raised for a client your size, with the hours and the price. Ask what it would take to move one excluded item into the fixed fee, because a provider who can price that has read its own book.

Watch what happens when a provider refuses to exclude anything. An all-inclusive fee with no exclusion list is not generous. It usually means the scope of work is thin, the escalation path is undefined, or the provider intends to decide later what the fee covered. Ambiguity is not coverage.

Price the exclusions, compare the totals, then take the same questions to three independent providers. The one who hands you an attached rate card without being asked twice is usually the one running a disciplined business.

FAQ

What does out of scope mean in an IT support contract?

Out of scope means any task the monthly fee does not cover, billed separately at rate card prices. Common examples are project work, hardware installation, after-hours work, cabling and security incident response. The exclusion list, not the fee, decides your real annual spend, so price it before you sign.

What is usually not included in a managed services agreement?

Nine items recur. Project work and migrations, hardware procurement and installation, third-party vendor liaison, after-hours work, site visits beyond a radius, major version upgrades, cabling, security incident response, and staff moves above a threshold. Microsoft's lifecycle page already dates one of them, with Windows Server 2016 support ending in January 2027.

Should the MSP rate card be attached to the contract?

Yes, attach the rate card as an exhibit rather than referencing it. A referenced rate card can be replaced without your signature, while an attached one changes only by amendment. Ask for rates fixed for the initial term covering standard hours, after-hours, weekends, travel, project work and emergency response.

Why is after-hours IT support charged at a higher rate?

Because the provider's own labour costs more at night. Federal rules require covered employees to receive overtime at not less than time and one-half for hours over 40 in a workweek. A 1.5x weeknight rate is normal. Get the multiplier, the start hour and the minimum billing increment in writing.

How do I compare two MSP quotes with different exclusions?

Convert each quote into a real annual spend. Multiply the fee by twelve, then price the excluded work from each rate card using your own history of projects, staff moves and after-hours calls. In our illustrative comparison, 88 percent of an $11,400 fee saving disappeared once both exclusion lists were priced.

← All Blogs