MSP Navigator
Search
Portfolio architecture · Q4 2027 view

Sell outcomes. Build the stack underneath.

A sales module is a customer proposition, not a product. Capabilities deliver it; products implement capabilities. Customers pick commercial blocks; each block maps to the capabilities, technology, people, processes and contracts needed to fulfil it.

3,833
products across all mapped categories
427
products with an MCP server
18
capabilities
1 · Customer solutionSelected blocks, the covered environment and the service commitments.

An understandable purchasing configuration

Managed Microsoft 365 TenantManaged EndpointsCyber ResilienceGovernance and EvidenceBusiness-hours user supportQuarterly technology planning
2 · Commercial blocksFoundation, managed service modules, outcome extensions, engagement and coverage options.
Foundation

Establish the minimum operating relationship and the required controls.

Managed service module

Select what the MSP operates.

Outcome extension

Add a defined capability or a stronger commitment.

Engagement or coverage option

Change how work is delivered.

3 · Delivery capabilitiesWhat the MSP must be able to operate: identity, endpoints, detection, recovery, evidence, workflow operation, cost, advisory, service desk.
Identity and access

Authentication, access policy, account lifecycle, privileged access and delegated administration.

202 products · 17 MCP
Endpoint and workplace management

Inventory, configuration, patching, device compliance, application deployment and remote support.

204 products · 42 MCP
Collaboration and tenant management

Tenant configuration, email and collaboration administration, provisioning and configuration monitoring.

195 products · 14 MCP
Network and connectivity

Network inventory, configuration, monitoring, secure connectivity and controlled changes.

327 products · 26 MCP
Cloud and workload operations

Provisioning, configuration, observability, capacity, availability and change management for workloads.

95 products · 7 MCP
Security detection and response

Security telemetry, alert triage, investigation, containment and escalation.

874 products · 75 MCP
Backup and recovery

Protected-scope inventory, backup operation, recovery procedures and testing.

323 products · 42 MCP
Data governance and assurance

Data classification, retention controls, policy and evidence records, exception tracking.

370 products · 22 MCP
AI and workflow operations

Workflow execution, integration, access control, evaluations, monitoring, approvals and usage metering.

282 products · 56 MCP
Cost and subscription management

Entitlements, allocation, utilisation, consumption and renewal visibility.

99 products · 5 MCP
4 · Approved implementationsProducts, configurations and integrations; internal teams or partners; operating procedures. In the catalog: the categories and the products in them.

In this catalog, the categories under each capability and the products in them, with their verified API, CLI and MCP flags and the use-or-resell verdict.

Microsoft-first SMBHybrid, infrastructure-heavy SMBCo-managed organisation
5 · Shared MSP operating platformCommercial operations, PSA/ITSM, asset and configuration records, documentation, automation, billing and reconciliation, reporting, admin security.
Commercial operations 175 ·PSA and service management 317 ·Asset and configuration records 35 ·Documentation and knowledge 28 ·Automation and integration 125 ·Billing and reconciliation 200 ·Evidence and reporting 126 ·MSP administrative security 111

Five layers, top to bottom. Click a block or capability tile to read its card, or a category to open it.

Why this shape

What the evidence says

SignalEvidencePortfolio implication
Winning business needs clearer proof of value71% name acquiring customers as a major challenge; difficulty demonstrating value rose from 10% to 19%. Kaseya, 2026 State of the MSPEvery offer needs a buying trigger, a defined scope and evidence of what improves.
Security and recovery still fund the business71% report cybersecurity revenue growth; 50% report BCDR revenue growth. Shares of respondents, not market growth rates. Kaseya, 2026 State of the MSPStrengthen the foundation before spending on speculative services.
AI demand is ahead of commercial maturity48% put AI and automation among clients' top needs; 13% count it among their top revenue sources. Kaseya, 2026 State of the MSPThe opportunity is packaging and operating useful workflows, not reselling AI licences.
Governance differentiates a security offer36% offer formal compliance services, while cybersecurity is already mainstream. ScalePad, 2026 MSP Trends ReportAdd evidence management and governance where the client has a real requirement.
Strategic engagement tracks with performance42% of top performers offer vCIO services against 29% overall; stronger customer-success practice tracks with higher MRR and retention. ScalePad, 2026 MSP Trends ReportMake roadmaps, investment planning and value reviews part of the commercial architecture.
Delivery capacity limits expansion26% lack staff to serve more clients; 22% cannot find skilled staff to launch new services. ScalePad, 2026 MSP Trends ReportJudge services by repeatability and delivery capacity, not only potential revenue.

Caveat: 1,061 MSPs surveyed in November 2025, 76% in North America. Vendor-sponsored. More than 1,100 North American MSP professionals. Vendor-sponsored; associations, not causation. Buyers with revenue above $100 million; direction only, not an SMB benchmark.

The commercial vocabulary

Four kinds of block

Foundation

Establish the minimum operating relationship and the required controls.

Onboarding, supported-environment baseline, service management, delegated access.

Managed service module

Select what the MSP operates.

Workplace, Microsoft 365 tenant, network, cloud workloads, business applications.

Outcome extension

Add a defined capability or a stronger commitment.

Cyber resilience, governance and evidence, managed AI workflow, spend optimisation.

Engagement or coverage option

Change how work is delivered.

Assessment, implementation, business-hours or extended support, advisory cadence.

Per customer, conditional on managed scope: a cloud-workload customer does not need workplace management, but every customer needs access, ownership, records and controls.

Customers can choose their solution, but only from combinations the MSP has deliberately engineered to sell, deliver and support.
Layer 2 in full

The blocks

Foundation

Foundation

“Every managed relationship starts with the same controls: who has access, who owns what, what is recorded, and how service runs.”

Buying trigger: Any new managed relationship.

What is covered

The customer organisation, its tenants and the environments the MSP will manage.

Prerequisites

  • Signed responsibility split
  • Delegated administration accepted by the customer
  • Supported-environment baseline met, or remediation agreed

Operating activities

  • Onboarding and offboarding of the relationship
  • Delegated access with least privilege
  • Asset and configuration records kept current
  • Service management: requests, incidents, changes, reviews

Charging basis

Per customer, conditional on managed scope: a cloud-workload customer does not need workplace management, but every customer needs access, ownership, records and controls.

Commercial components

  • Onboarding project
  • Foundation service fee
  • Remediation project when prerequisites fail

Exit requirements

  • Access removal and credential rotation
  • Records and documentation handover
  • Transition plan

What the client hears

  • You know exactly what we manage, what you keep, and who to call.
  • Our technicians reach your systems through named, audited, least-privilege access.
  • There is one current list of what you have and what we cover.

Ownership

MSP:
Access model, records, service process.
Customer:
Business ownership of systems and data; approvals.
Third party:
Platform providers under their own terms.

Evidence

  • Access register
  • Coverage record per customer
  • Onboarding acceptance

Capabilities this block requires

Identity and accessRequired

202 products, 17 with MCP, clients pay for 185

Asset and configuration recordsRequired

35 products, 5 with MCP, clients pay for 19

PSA and service managementRequired

317 products, 75 with MCP, clients pay for 121

Documentation and knowledgeRequired

28 products, 11 with MCP, clients pay for 7

MSP administrative securityRequired

111 products, 15 with MCP, clients pay for 103

Evidence and reportingRequired

basic service evidence

126 products, 11 with MCP, clients pay for 40

Contracts should identify security ownership and responsibilities between MSP and customer. CISA, Protecting against cyber threats to MSPs and their customers

Managed service modules

Managed service module

Managed Workplace

“We operate your endpoints and users' workplace to a defined security and service standard.”

Buying trigger: A departed IT person, a growing team, or an audit that found unpatched devices.

What is covered

Users, devices and the workplace applications on them.

Prerequisites

  • Foundation active
  • Supported operating systems and device age
  • Identity capability in place

Operating activities

  • Device inventory and configuration
  • Patching to an agreed window
  • Baseline endpoint protection
  • Application deployment
  • Remote support and helpdesk within coverage hours

Charging basis

Per user or per device.

Commercial components

  • Per-device or per-user service fee
  • Endpoint management and protection subscriptions
  • Onboarding per device
  • Out-of-scope hardware and projects

Exit requirements

  • Agent removal
  • Configuration export
  • Device list handover

What the client hears

  • Every supported device patched within the agreed window, reported monthly.
  • A new starter has a working, compliant device on day one.
  • One place to call, with response times written down.

Ownership

MSP:
Configuration, patching, support, baseline protection.
Customer:
Device purchasing decisions, user policy, acceptable use.
Third party:
OS and application vendors.

Evidence

  • Monthly patch and compliance report
  • Asset list
  • Ticket and response statistics

Capabilities this block requires

Identity and accessRequired

202 products, 17 with MCP, clients pay for 185

Endpoint and workplace managementRequired

204 products, 42 with MCP, clients pay for 119

Security detection and responseRequired

baseline protection only, not MDR

874 products, 75 with MCP, clients pay for 849

Backup and recoveryConditional

defined covered scope, usually endpoint backup

323 products, 42 with MCP, clients pay for 312

Cost and subscription managementOptional enhancement

licence scope

99 products, 5 with MCP, clients pay for 74

Evidence and reportingRequired

service review

126 products, 11 with MCP, clients pay for 40

PSA and service managementSupplied by another block

317 products, 75 with MCP, clients pay for 121

Collaboration and tenant managementConditional

if the tenant is also managed

195 products, 14 with MCP, clients pay for 175

71% of MSPs report cybersecurity revenue growth; security is a core expectation inside the foundation, not an optional line. Kaseya, 2026 State of the MSP

Managed service module

Managed Microsoft 365 Tenant

“We keep your Microsoft 365 tenant configured, licensed and monitored to an agreed baseline.”

Buying trigger: A tenant nobody owns, a licence true-up, or a security review of the tenant.

What is covered

The tenant, its users, licences and collaboration workloads.

Prerequisites

  • Foundation active
  • Delegated administration (GDAP) with least-privilege roles
  • Agreed tenant baseline

Operating activities

  • Tenant configuration and drift detection
  • Identity and account administration
  • Licence administration
  • Configuration monitoring
  • Support and service reporting

Charging basis

Per user, with Microsoft subscriptions passed through and reconciled monthly.

Commercial components

  • Per-user service fee
  • Microsoft subscriptions, billed once
  • Baseline implementation project
  • Migration projects

Exit requirements

  • GDAP removal
  • Admin role transfer
  • Configuration documentation handover

What the client hears

  • Your tenant matches the agreed baseline, and we know within a day when it drifts.
  • Licences match headcount every month.
  • Joiners and leavers are handled the same way every time, with the log to prove it.

Ownership

MSP:
Configuration, identity administration, licence administration, monitoring.
Customer:
Business approval of changes, data ownership, user conduct.
Third party:
Microsoft, under its service terms.

Evidence

  • Baseline compliance report
  • Licence reconciliation
  • Change log

Capabilities this block requires

Identity and accessRequired

202 products, 17 with MCP, clients pay for 185

Collaboration and tenant managementRequired

195 products, 14 with MCP, clients pay for 175

Cost and subscription managementRequired

licence scope

99 products, 5 with MCP, clients pay for 74

Security detection and responseRequired

baseline protection only

874 products, 75 with MCP, clients pay for 849

Backup and recoveryConditional

M365 backup when in scope

323 products, 42 with MCP, clients pay for 312

Evidence and reportingRequired

baseline and licence reports

126 products, 11 with MCP, clients pay for 40

MSP administrative securitySupplied by another block

111 products, 15 with MCP, clients pay for 103

Reusable GDAP templates support least-privilege delegated administration across customer tenants. Microsoft 365 Lighthouse, what's new

Managed service module

Managed Network

“We keep your sites connected, configured and monitored, with every change controlled.”

Buying trigger: An office move, a connectivity outage, or an insurer asking about the firewall.

What is covered

Sites, network devices, firewalls and connectivity.

Prerequisites

  • Foundation active
  • Supported network equipment or a replacement plan
  • Documented topology

Operating activities

  • Inventory and configuration backup
  • Monitoring and alerting
  • Firmware and firewall policy changes under change control
  • Connectivity provider liaison

Charging basis

Per site or per managed device.

Commercial components

  • Per-site or per-device fee
  • Equipment and connectivity resold or passed through
  • Installation projects

Exit requirements

  • Credential handover
  • Configuration export
  • Monitoring removal

What the client hears

  • When a site goes down you hear from us first.
  • Every firewall change is recorded and reversible.
  • No unknown device on your network.

Ownership

MSP:
Configuration, monitoring, changes.
Customer:
Site access, provider contracts unless resold.
Third party:
Connectivity providers.

Evidence

  • Availability report
  • Change log
  • Configuration backups

Capabilities this block requires

Network and connectivityRequired

327 products, 26 with MCP, clients pay for 287

Identity and accessRequired

admin access

202 products, 17 with MCP, clients pay for 185

Security detection and responseConditional

network telemetry into resilience when bought

874 products, 75 with MCP, clients pay for 849

Asset and configuration recordsRequired

35 products, 5 with MCP, clients pay for 19

Evidence and reportingRequired

availability and change reports

126 products, 11 with MCP, clients pay for 40

Managed service module

Managed Cloud Workloads

“We run your cloud workloads to agreed availability, cost and security criteria.”

Buying trigger: A migration, a cost surprise, or a workload with nobody on call.

What is covered

Subscriptions, workloads, servers and the services around them.

Prerequisites

  • Foundation active
  • Accepted workload design
  • Cost baseline

Operating activities

  • Provisioning and configuration
  • Observability and capacity
  • Change management
  • Well-Architected reviews
  • Cost reviews

Charging basis

Per workload or managed resource, plus consumption.

Commercial components

  • Per-workload or per-resource fee
  • Cloud consumption passed through
  • Migration and design projects

Exit requirements

  • Subscription ownership transfer
  • Runbook handover
  • Access removal

What the client hears

  • Your workloads meet the availability we agreed, and you see the number monthly.
  • The cloud bill is explained line by line.
  • Changes go through a process, so nothing breaks on a Friday afternoon.

Ownership

MSP:
Operation, changes, monitoring, cost review.
Customer:
Application ownership, data, business continuity requirements.
Third party:
Cloud provider.

Evidence

  • Availability and capacity report
  • Change log
  • Cost report
  • Review findings

Capabilities this block requires

Cloud and workload operationsRequired

95 products, 7 with MCP, clients pay for 76

Identity and accessRequired

202 products, 17 with MCP, clients pay for 185

Backup and recoveryRequired

defined covered scope

323 products, 42 with MCP, clients pay for 312

Security detection and responseRequired

baseline protection only

874 products, 75 with MCP, clients pay for 849

Cost and subscription managementRequired

99 products, 5 with MCP, clients pay for 74

Evidence and reportingRequired

capacity and cost review

126 products, 11 with MCP, clients pay for 40

Use the Well-Architected pillars as review criteria for workloads: reliability, security, cost, operational excellence, performance. Microsoft, Azure Well-Architected Framework

Managed service module

Managed Business Applications

“We keep the applications your business runs on configured, integrated and supported.”

Buying trigger: An application nobody administers, a failed integration, or a vendor the customer cannot manage.

What is covered

Named line-of-business applications and their integrations.

Prerequisites

  • Foundation active
  • Application vendor support contract
  • Named application owner at the customer

Operating activities

  • Configuration and user administration
  • Integration monitoring
  • Vendor escalation
  • Release coordination

Charging basis

Per application, scoped by users and integrations.

Commercial components

  • Per-application fee
  • Application subscriptions when resold
  • Implementation and integration projects

Exit requirements

  • Admin transfer
  • Integration documentation
  • Data export support

What the client hears

  • Someone owns the application, and it is us.
  • Integrations between systems are watched, not assumed.
  • Upgrades are planned with you, not sprung on you.

Ownership

MSP:
Administration, integration monitoring, vendor liaison.
Customer:
Process ownership, data, vendor contract unless resold.
Third party:
Application vendor.

Evidence

  • Application availability and ticket report
  • Integration health
  • Release notes

Capabilities this block requires

Identity and accessRequired

202 products, 17 with MCP, clients pay for 185

AI and workflow operationsConditional

integration and automation scope

282 products, 56 with MCP, clients pay for 182

Backup and recoveryConditional

323 products, 42 with MCP, clients pay for 312

Asset and configuration recordsRequired

35 products, 5 with MCP, clients pay for 19

PSA and service managementSupplied by another block

317 products, 75 with MCP, clients pay for 121

Evidence and reportingRequired

operational evidence

126 products, 11 with MCP, clients pay for 40

Outcome extensions

Outcome extension

Cyber Resilience

“Detect, respond and recover within an agreed operating model.”

Buying trigger: A cyber insurance renewal, a near miss, a supplier questionnaire, or a peer company in the news.

What is covered

Covered users, devices, tenants and workloads, with a named recovery scope.

Prerequisites

  • A managed module for the covered scope
  • Accepted recovery design and protected inventory
  • Escalation authority agreed in writing
  • Staffed 24x7 coverage or an approved partner

Operating activities

  • 24x7 detection and response
  • Incident escalation and containment
  • Vulnerability cadence
  • Recovery testing
  • Security posture reviews

Charging basis

Tenant minimum plus covered users, devices and workloads.

Commercial components

  • Tenant minimum plus per covered user, device or workload
  • Detection, backup and awareness subscriptions
  • Readiness assessment and hardening project
  • Incident response beyond retainer at agreed rates

Exit requirements

  • Telemetry disconnection
  • Backup data handover or retention agreement
  • Runbook handover

What the client hears

  • Someone is watching around the clock, and you see what they caught last month.
  • When something happens there is a plan, a phone number and a tested restore.
  • Critical systems come back within the recovery time we agreed, and we rehearse it.
  • The insurance questionnaire is answered from evidence, not memory.

Ownership

MSP:
Detection, response within authority, recovery operation and tests.
Customer:
Business decisions during an incident, data ownership, user training participation.
Third party:
SOC or IR partner where used, under a back-to-back agreement.

Evidence

  • Monthly detection report
  • Incident records
  • Recovery test results
  • Posture review

Capabilities this block requires

Identity and accessRequired

202 products, 17 with MCP, clients pay for 185

Security detection and responseRequired

874 products, 75 with MCP, clients pay for 849

Backup and recoveryRequired

323 products, 42 with MCP, clients pay for 312

Endpoint and workplace managementConditional

if endpoints are covered

204 products, 42 with MCP, clients pay for 119

Data governance and assuranceOptional enhancement

incident and test evidence into the control register

370 products, 22 with MCP, clients pay for 343

Evidence and reportingRequired

risk and recovery review

126 products, 11 with MCP, clients pay for 40

Network and connectivityConditional

network telemetry when sites are covered

327 products, 26 with MCP, clients pay for 287

71% of MSPs report cybersecurity revenue growth and 50% report BCDR growth. Kaseya, 2026 State of the MSP

Outcome extension

Governance and Evidence

“Maintain an agreed control framework and usable evidence.”

Buying trigger: A regulator, a large customer's supplier audit, a cyber insurance condition, or a certification the board asked for.

What is covered

The customer's control framework, its evidence sources and its suppliers in scope.

Prerequisites

  • The frameworks the customer is actually held to
  • Named control owners at the customer
  • Evidence sources available from managed modules

Operating activities

  • Control register maintenance
  • Evidence collection on a cadence
  • Policy review
  • Exception and remediation tracking
  • Supplier-risk reviews
  • Audit support within agreed boundaries

Charging basis

Organisation fee plus scope and complexity. Never sold as 'we make you compliant'.

Commercial components

  • Organisation fee plus scope and complexity
  • GRC and DLP subscriptions
  • Gap analysis and remediation projects
  • Audit support days

Exit requirements

  • Register and evidence export
  • Ownership transfer
  • Tool access removal

What the client hears

  • A control register your auditor can read, with an owner next to every control.
  • Evidence collected on a schedule, so the audit is a lookup rather than a scramble.
  • A map of where your sensitive data lives and who can reach it.
  • Clear lines on what we do, what you do and what your suppliers do.

Ownership

MSP:
Register, evidence operation, exception tracking, reporting.
Customer:
Control ownership, policy approval, business decisions on exceptions.
Third party:
Auditors and certification bodies.

Evidence

  • Control status report
  • Evidence packs
  • Exception register
  • Audit-support log

Capabilities this block requires

Data governance and assuranceRequired

370 products, 22 with MCP, clients pay for 343

Identity and accessRequired

for in-scope controls

202 products, 17 with MCP, clients pay for 185

Evidence and reportingRequired

126 products, 11 with MCP, clients pay for 40

Security detection and responseSupplied by another block

evidence input from resilience

874 products, 75 with MCP, clients pay for 849

Backup and recoverySupplied by another block

evidence input

323 products, 42 with MCP, clients pay for 312

Endpoint and workplace managementConditional

204 products, 42 with MCP, clients pay for 119

36% of MSPs offer formal compliance services while cybersecurity is mainstream. ScalePad, 2026 MSP Trends Report

Outcome extension

Managed AI Workflow

“Keep a named business workflow useful, controlled and operational.”

Buying trigger: A department started using AI tools on its own, or a leader wants one named process to run faster.

What is covered

A named workflow, for example inbound documents into a business system, with its data sources, integrations and users.

Prerequisites

  • Approved data sources and permissions
  • A workflow owner at the customer
  • Defined approval points
  • Supported integration
  • Evaluation criteria
  • Consumption budget and limits

Operating activities

  • Workflow operation and monitoring
  • Evaluations against the criteria
  • Bounded changes under change control
  • Incident handling and rollback
  • Consumption reporting
  • Quarterly effectiveness review

Charging basis

Managed-workflow fee plus consumption. 'AI support included' is not a scope.

Commercial components

  • Managed-workflow fee
  • Platform and model consumption, metered
  • Discovery, data remediation and pilot as separate engagements

Exit requirements

  • Workflow shutdown procedure
  • Data and configuration export
  • Credential revocation

What the client hears

  • The workflow we agreed runs every day, and you see how long it takes and what it costs.
  • Your data is only reachable by the tools and people we listed, and we can show the log.
  • When a model or a vendor changes, we test before you notice.
  • If it misbehaves there is a switch, and we own it.

Ownership

MSP:
Operation, monitoring, evaluation, bounded change, rollback.
Customer:
Workflow ownership, data decisions, approval of changes, adoption.
Third party:
Model and platform providers under their terms.

Evidence

  • Evaluation results
  • Run and consumption report
  • Change and incident log
  • Effectiveness review

Capabilities this block requires

AI and workflow operationsRequired

282 products, 56 with MCP, clients pay for 182

Identity and accessRequired

202 products, 17 with MCP, clients pay for 185

Data governance and assuranceRequired

evaluation and change evidence

370 products, 22 with MCP, clients pay for 343

Cost and subscription managementRequired

consumption

99 products, 5 with MCP, clients pay for 74

Security detection and responseConditional

on scope

874 products, 75 with MCP, clients pay for 849

Backup and recoveryConditional

on workflow data

323 products, 42 with MCP, clients pay for 312

Evidence and reportingRequired

effectiveness review

126 products, 11 with MCP, clients pay for 40

48% of MSPs put AI and automation among clients' top needs; 13% count it among their top revenue sources. Kaseya, 2026 State of the MSP

Outcome extension

Cloud and SaaS Optimisation

“Control spend and keep services fit for purpose.”

Buying trigger: A licence true-up, a cloud bill that doubled, or a finance lead asking what the subscriptions are for.

What is covered

Subscriptions, licences and cloud accounts in scope.

Prerequisites

  • Entitlement records
  • A measured spend baseline
  • Access to billing data

Operating activities

  • Licence reviews and allocation reporting
  • Subscription hygiene
  • Cloud-cost reviews
  • Rightsizing and commitment decisions
  • Renewal calendar

Charging basis

Base fee plus managed scope; savings claims tied to the measured baseline.

Commercial components

  • Base fee plus managed scope
  • Subscriptions resold through the distributor
  • Clean-up projects

Exit requirements

  • Entitlement records handover
  • Marketplace ownership transfer

What the client hears

  • A licence count that matches headcount every month.
  • A cloud bill you can explain line by line, with the next saving identified.
  • No surprise renewals: every subscription has a date and an owner.

Ownership

MSP:
Analysis, recommendations, hygiene within authority.
Customer:
Spend decisions, vendor contracts unless resold.
Third party:
Distributors and marketplaces.

Evidence

  • Allocation report
  • Savings against baseline
  • Renewal calendar

Capabilities this block requires

Cost and subscription managementRequired

99 products, 5 with MCP, clients pay for 74

Collaboration and tenant managementConditional

for M365 licences

195 products, 14 with MCP, clients pay for 175

Cloud and workload operationsConditional

for cloud spend

95 products, 7 with MCP, clients pay for 76

Asset and configuration recordsRequired

35 products, 5 with MCP, clients pay for 19

Evidence and reportingRequired

cost review

126 products, 11 with MCP, clients pay for 40

Billing and reconciliationSupplied by another block

200 products, 11 with MCP, clients pay for 75

Engagement and coverage options

Engagement or coverage option

Assessment

“Establish the current state, the scope and the business case before anything is changed.”

Buying trigger: Before every extension, and whenever an environment fails prerequisites.

Charging basis: Fixed price per assessment type.

Capabilities this block requires

Asset and configuration recordsRequired

35 products, 5 with MCP, clients pay for 19

Evidence and reportingRequired

126 products, 11 with MCP, clients pay for 40

Engagement or coverage option

Implementation

“Perform a bounded change against acceptance criteria.”

Buying trigger: After an accepted assessment; never absorbed into a recurring fee.

Charging basis: Fixed price or time and materials with a cap.

Capabilities this block requires

Documentation and knowledgeRequired

28 products, 11 with MCP, clients pay for 7

Asset and configuration recordsRequired

35 products, 5 with MCP, clients pay for 19

Automation and integrationOptional enhancement

125 products, 15 with MCP, clients pay for 70

Engagement or coverage option

Support coverage

“Choose when we respond: business hours, extended hours or around the clock.”

Buying trigger: Shift work, multiple time zones, or a regulator's availability requirement.

Charging basis: Uplift on the managed modules it applies to.

Capabilities this block requires

PSA and service managementRequired

317 products, 75 with MCP, clients pay for 121

Engagement or coverage option

Technology Leadership

“Make better technology investment decisions, on a cadence.”

Buying trigger: A growth plan, a merger, a budget cycle, or a board with a technology question and nobody to ask.

Charging basis: Monthly retainer by cadence.

Capabilities this block requires

Evidence and reportingRequired

126 products, 11 with MCP, clients pay for 40

Cost and subscription managementOptional enhancement

99 products, 5 with MCP, clients pay for 74

Asset and configuration recordsSupplied by another block

35 products, 5 with MCP, clients pay for 19

42% of top-performing MSPs offer vCIO services against 29% overall. ScalePad, 2026 MSP Trends Report

Dependency reference

Module-to-capability matrix

CapabilityManaged WorkplaceManaged Microsoft 365 TenantManaged Cloud WorkloadsCyber ResilienceGovernance and EvidenceManaged AI WorkflowCloud and SaaS Optimisation
Identity and access
Required
Required
Required
Required
Required
for in-scope controls
Required
·
Endpoint and workplace management
Required
··
Conditional
if endpoints are covered
Conditional
··
Collaboration and tenant management
Conditional
if the tenant is also managed
Required
····
Conditional
for M365 licences
Security detection and response
Required
baseline protection only, not MDR
Required
baseline protection only
Required
baseline protection only
Required
Supplied by another block
evidence input from resilience
Conditional
on scope
·
Backup and recovery
Conditional
defined covered scope, usually endpoint backup
Conditional
M365 backup when in scope
Required
defined covered scope
Required
Supplied by another block
evidence input
Conditional
on workflow data
·
Data governance and assurance···
Optional enhancement
incident and test evidence into the control register
Required
Required
evaluation and change evidence
·
AI and workflow operations·····
Required
·
Cost and subscription management
Optional enhancement
licence scope
Required
licence scope
Required
··
Required
consumption
Required
Evidence and reporting
Required
service review
Required
baseline and licence reports
Required
capacity and cost review
Required
risk and recovery review
Required
Required
effectiveness review
Required
cost review
RequiredOptional enhancementConditionalSupplied by another blockCustomer-providedOut of scope

Baseline protection inside a managed module never implies managed detection and response unless that extension is bought.

Configuration, not tiers

Three dimensions, not good/better/best

Managed scope

Users, devices, tenants, locations, applications and workloads.

Service commitment

Coverage hours, response targets, escalation and review cadence.

Outcome modules

Resilience, governance, AI operations, optimisation and advisory.

Not a licence line

AI is an operational responsibility

CategoryWhat it isTreatment
AI used inside the MSPTicket summaries, triage, documentation and technician assistance.A delivery capability; not automatically a customer product.
AI adoption servicesReadiness, configuration, training and first workflow implementation.Assessment and project revenue.
Managed AI operationsOngoing operation of agreed customer workflows.Recurring service with explicit limits and consumption treatment.
Layer 3 and 5 in full

Capabilities and the catalog under them

Delivery capability

Identity and access

Authentication, access policy, account lifecycle, privileged access and delegated administration.

Required functions

Directory and lifecycleMFA and conditional accessPrivileged accessDelegated administration (GDAP)Access reviews

202 products, 17 with MCP, clients pay for 185

Used by Foundation, Managed Workplace, Managed Microsoft 365 Tenant, Managed Network, Managed Cloud Workloads, Managed Business Applications, Cyber Resilience, Governance and Evidence, Managed AI Workflow

Delivery capability

Endpoint and workplace management

Inventory, configuration, patching, device compliance, application deployment and remote support.

Required functions

Device inventoryConfiguration deploymentPatch managementCompliance visibilityRemote supportExportable operational records

204 products, 42 with MCP, clients pay for 119

Used by Managed Workplace

Delivery capability

Collaboration and tenant management

Tenant configuration, email and collaboration administration, provisioning and configuration monitoring.

Required functions

Tenant baseline and drift detectionMailbox and collaboration adminProvisioningLicence administration

195 products, 14 with MCP, clients pay for 175

Used by Managed Microsoft 365 Tenant

Delivery capability

Network and connectivity

Network inventory, configuration, monitoring, secure connectivity and controlled changes.

Required functions

Network inventory and topologyConfiguration backupMonitoring and alertingSecure remote connectivity

327 products, 26 with MCP, clients pay for 287

Used by Managed Network

Delivery capability

Cloud and workload operations

Provisioning, configuration, observability, capacity, availability and change management for workloads.

Required functions

Provisioning and IaCObservabilityCapacity and availabilityChange managementWell-Architected reviews

95 products, 7 with MCP, clients pay for 76

Used by Managed Cloud Workloads

Delivery capability

Security detection and response

Security telemetry, alert triage, investigation, containment and escalation.

Required functions

Endpoint and identity telemetry24x7 triageInvestigation and containmentEscalation authorityIncident records

874 products, 75 with MCP, clients pay for 849

Used by Managed Workplace, Managed Microsoft 365 Tenant, Managed Cloud Workloads, Cyber Resilience

Delivery capability

Backup and recovery

Protected-scope inventory, backup operation, recovery procedures and testing.

Required functions

Protected inventoryBackup operation and monitoringRecovery proceduresScheduled recovery testsRecovery evidence

323 products, 42 with MCP, clients pay for 312

Used by Managed Cloud Workloads, Cyber Resilience

Delivery capability

Data governance and assurance

Data classification, retention controls, policy and evidence records, exception tracking.

Required functions

ClassificationRetention and archivingLoss preventionControl register and evidenceException register

370 products, 22 with MCP, clients pay for 343

Used by Governance and Evidence, Managed AI Workflow

Delivery capability

AI and workflow operations

Workflow execution, integration, access control, evaluations, monitoring, approvals and usage metering.

Required functions

Workflow runtimeIntegration to systems of recordPermissions and data accessEvaluations and monitoringApproval points and rollbackConsumption metering

282 products, 56 with MCP, clients pay for 182

Used by Managed AI Workflow

Delivery capability

Cost and subscription management

Entitlements, allocation, utilisation, consumption and renewal visibility.

Required functions

Entitlement recordsAllocation and utilisationConsumption trackingRenewal calendarRightsizing decisions

99 products, 5 with MCP, clients pay for 74

Used by Managed Microsoft 365 Tenant, Managed Cloud Workloads, Managed AI Workflow, Cloud and SaaS Optimisation

Shared operating capability

Commercial operations

Offer configuration, eligibility checks, pricing, quoting, approvals, procurement and renewals.

Salesbuildr quotes from a service catalog at live distributor pricing and pushes accepted quotes into Autotask, ConnectWise and HaloPSA.

Required functions

Approved offers and rulesQuoting and approvalsProcurementRenewals

175 products, 10 with MCP, clients pay for 48

Shared operating capability

PSA and service management

Tickets, requests, incidents, changes, projects, time, service commitments and escalations.

Required functions

Ticketing and requestsIncident and changeProjects and timeService levels and escalation

317 products, 75 with MCP, clients pay for 121

Used by Foundation, Support coverage

Shared operating capability

Asset and configuration records

Customers, tenants, users, devices, workloads, relationships and service coverage.

Required functions

Configuration items and relationshipsCoverage per customerLifecycle state

35 products, 5 with MCP, clients pay for 19

Used by Foundation, Managed Network, Managed Business Applications, Cloud and SaaS Optimisation, Assessment, Implementation

Shared operating capability

Documentation and knowledge

Runbooks, configuration standards, support knowledge and customer-specific operating information.

Required functions

RunbooksStandardsCustomer operating information

28 products, 11 with MCP, clients pay for 7

Used by Foundation, Implementation

Shared operating capability

Automation and integration

Provisioning, configuration checks, event routing, reconciliation and controlled remediation.

Required functions

ProvisioningConfiguration checksEvent routingControlled remediation

125 products, 15 with MCP, clients pay for 70

Shared operating capability

Billing and reconciliation

Match contracted quantities, delivered scope, vendor charges and customer billing.

Required functions

Quantity reconciliationVendor charge matchingInvoicing feeds

200 products, 11 with MCP, clients pay for 75

Shared operating capability

Evidence and reporting

Service performance, control status, recovery tests, financial performance and customer value.

Required functions

Service reportsControl and test evidenceValue reviews

126 products, 11 with MCP, clients pay for 40

Used by Foundation, Managed Workplace, Managed Microsoft 365 Tenant, Managed Network, Managed Cloud Workloads, Managed Business Applications, Cyber Resilience, Governance and Evidence, Managed AI Workflow, Cloud and SaaS Optimisation, Assessment, Technology Leadership

Shared operating capability

MSP administrative security

Technician access, credential protection, audit trails and separation between customers.

Required functions

Per-customer admin identitiesPrivileged access and vaultingLeast-privilege delegationAudit trails

111 products, 15 with MCP, clients pay for 103

Used by Foundation

Standardise before you choose a vendor

Capability standards before vendor choices

Microsoft-first SMB

Microsoft-centric workplace profile: Entra, Intune and Defender with Lighthouse and GDAP for delegated administration, M365 backup, a managed detection partner on top. Validate licence tiers and features before promising a control.

Microsoft 365 Lighthouse, what's new
Hybrid, infrastructure-heavy SMB

Mixed-environment profile: RMM-led endpoint management, on-premises and cloud workloads under one monitoring and backup standard, network under change control, Well-Architected reviews for the cloud part.

Co-managed organisation

Customer-tooling profile: the customer's internal IT keeps its console and some capabilities; the responsibility split names what the MSP operates, what the customer retains and what is shared, per capability.

  • One preferred implementation per archetype.
  • A limited number of approved alternatives.
  • A documented exception process.
  • Vendor-neutral means the model is not hard-coded to a vendor, not that technicians support unlimited combinations.
  • Coverage is separate from purchasing: one licence can enable several capabilities; one capability can need several products and a partner.
Same shape, every time

Every block has a delivery blueprint

Customer promiseWhat the customer is buying.
Managed objectsTenants, users, devices, sites, workloads or workflows covered.
PrerequisitesConditions that must be met before activation.
Required capabilitiesWhat the MSP must be able to operate.
Approved implementationsSupported technology and delivery profiles.
Operating activitiesRecurring work, triggers and cadence.
OwnershipMSP, customer and third-party responsibilities.
Coverage and commitmentsSupport hours, response targets and escalation.
EvidenceHow delivery and effectiveness are demonstrated.
Commercial componentsService, subscriptions, consumption and project charges, kept separate.
Exit requirementsAccess removal, data handover and transition activities.
Composing blocks

Worked example: Managed Microsoft 365 with extensions

Managed Microsoft 365 Tenant

We keep your Microsoft 365 tenant configured, licensed and monitored to an agreed baseline.

  • Tenant configuration and drift detection
  • Identity and account administration
  • Licence administration
  • Configuration monitoring
  • Support and service reporting
Cyber Resilience

Adds

  • 24x7 detection and response
  • Incident escalation and containment
  • Vulnerability cadence
  • Recovery testing
  • Security posture reviews

Reuses

Identity and access, Security detection and response, Backup and recovery, Evidence and reporting

Governance and Evidence

Adds

  • Control register maintenance
  • Evidence collection on a cadence
  • Policy review
  • Exception and remediation tracking
  • Supplier-risk reviews
  • Audit support within agreed boundaries

Reuses

Identity and access, Evidence and reporting, Security detection and response, Backup and recovery

Managed AI Workflow

Adds

  • Workflow operation and monitoring
  • Evaluations against the criteria
  • Bounded changes under change control
  • Incident handling and rollback
  • Consumption reporting
  • Quarterly effectiveness review

Reuses

Identity and access, Cost and subscription management, Security detection and response, Backup and recovery, Evidence and reporting

What has to be true

Dependency rules

Offer
  • requires → capability
  • includes → service component
  • depends on → prerequisite
  • compatible with → implementation profile
  • governed by → service specification
  • measured by → evidence definition
Capability
  • implemented by → technology configuration
  • operated by → team or delivery partner
  • executed through → runbook
  • A recovery commitment requires a defined protected inventory and an accepted recovery design.
  • Extended incident response requires staffed coverage or an approved partner arrangement.
  • Managed AI operations require named workflow ownership and evaluation criteria.
  • Co-managed services require an explicit responsibility split per capability.
  • A shared subscription is billed once; the service work on it is costed separately.
  • An unsupported environment triggers remediation, an approved exception or rejection.
  • Baseline protection inside a managed module never implies managed detection and response unless that extension is bought.
From quote to renewal

The commercial loop

  1. 1Configured offer
  2. 2Quoted and agreed scope
  3. 3Provisioned and activated service
  4. 4Observed inventory and consumption
  5. 5Reconciled billing and delivery cost
  6. 6Service evidence and expansion opportunities
SoldProvisionedAccepted into serviceActively managed

These are separate states.

Salesbuildr sits at the commercial configuration and control layer: approved offers, rules, component pricing, quotes, approvals and mappings. The PSA owns the delivery work, asset systems own inventory, platforms own enforcement, and finance owns posting. salesbuildr.com

Portfolio management

How to prioritise for 2027

  1. 1Is the buying trigger clear and frequent in our target segment?
  2. 2Can we explain and demonstrate the value?
  3. 3Can we deliver it repeatedly with the capacity we have?
  4. 4Do we understand its component costs and margin?
  5. 5Does it deepen the relationship or open a logical expansion path?
  6. 6Are the obligations and risks bounded?
Invest

Strong demand, repeatable delivery, attractive economics.

Repair

Useful offer; pricing, scope or operations need correction.

Partner

Commercially important, inefficient to build in-house.

Retire

Weak demand, too many exceptions, poor contribution.

Where to start

  • Three customer archetypes: Microsoft-first SMB, hybrid and infrastructure-heavy SMB, co-managed organisation.
  • Six to eight customer-facing blocks.
  • About a dozen reusable capability categories.
  • One preferred implementation profile per archetype.
  • A delivery blueprint and dependency rules for every block.
  • Separate service, licence, consumption and implementation components.
  • Versioned configurations, so existing agreements do not change when the reference stack does.
  • Model Managed Microsoft 365 Tenant plus Cyber Resilience and Governance first.

Sources

Put this architecture to work.

Build your stackBrowse the categoriesConnect your agent

Buyer's guides for the categories above: Email security, RMM platforms and data loss prevention.