How to start a managed service provider (MSP) business in Australia

What an MSP does

A managed service provider looks after a client’s IT for a fixed monthly fee. Instead of waiting for something to break and charging for the repair (often called “break-fix”), an MSP keeps systems running, secure and backed up, and fixes problems before the client notices.

Typical services include:

• Help desk support by phone, email or remote access.
• Monitoring and patching computers, servers and network devices.
• Backup and disaster recovery for devices, servers and cloud services such as Microsoft 365 and Google Workspace.
• Cyber security, including endpoint protection, email security and staff security awareness training.
• Cloud and licence management, from setting up new staff to managing subscriptions.
• Advice and planning, such as technology roadmaps, compliance and, increasingly, AI adoption.

The recurring revenue is what makes it a business rather than a job. Each new client adds predictable monthly income, as long as you can serve them without adding the same amount of work.

The opportunity in Australia

According to the Australian Bureau of Statistics, there were 2,814,778 actively trading businesses in Australia at 30 June 2026, and 996,203 of them employed staff. Most of those employing businesses are too small to justify a full-time IT person, yet they rely on email, cloud software, online banking and customer data every day.

Three pressures are pushing more of them towards outside help.

AI-enabled cyber threats. In its Annual Cyber Threat Report 2025-26, the Australian Signals Directorate (ASD) says AI is enabling malicious cyber actors to operate with greater scale, speed and sophistication. ASD received over 82,000 cybercrime reports, one every 6 minutes. The average self-reported cybercrime cost was $93,500 per business report, up 16%, and $141,300 for medium businesses, up 45%. Convincing phishing emails, fake invoices and voice scams are now easier to produce, and a small business owner can’t be expected to keep up alone.

Compliance. Clients are being asked harder questions by customers, tenders, insurers and regulators. Depending on the business, they may need to think about the Privacy Act and data breach notification, ASD’s Essential Eight, certification standards such as SMB1001, and ransomware payment reporting. Under the Cyber Security Act 2024, businesses with annual turnover of $3 million or more must report ransomware or cyber extortion payments to the Government within 72 hours. See Privacy Act, SMB1001 and cyber insurance. An MSP that can explain these requirements in plain language, and produce evidence that controls are in place, is far more valuable than one that only fixes printers.

AI adoption. Businesses are switching on AI assistants and AI features inside the software they already use, often without checking who can see what. MSP Notes describes “shadow AI” (staff using AI tools the business hasn’t approved) as a major opportunity for MSPs to become trusted AI adoption advisers: assessing readiness, cleaning up permissions and data sharing, and managing AI tools as part of the service.

The market is also crowded. MSP Notes, citing industry research from Omdia, says the problem for MSPs is not demand but differentiation. Undifferentiated providers struggle, while those that wrap advice, security and ongoing management around the technology earn more.

Step 1: Choose your niche and services

Trying to serve everyone is the fastest way to compete on price alone. Pick a focus you understand, such as:

• An industry: medical and allied health practices, accountants and law firms, builders and trades, real estate agencies or not-for-profits.
• A size: for example, businesses with 5 to 50 staff.
• A location: your city or region, where on-site visits are easy.

Then decide on a small, clear service list you can deliver well from day one. Many new MSPs start with three packages, for example:

Projects such as new office setups, migrations and AI readiness assessments are usually quoted separately.

Step 2: Set up the business

• Choose a business structure and register for an ABN. Many start as a sole trader and move to a company as they grow. See Business structures, and talk to an accountant early.
• Register a business name and check that the matching domain name is available.
• Register for GST if your GST turnover will be $75,000 or more. You can also register voluntarily below that.
• Talk to an insurance broker about professional indemnity and cyber cover for your own business. An MSP’s mistake can affect many clients at once, and some clients will ask for evidence of cover.
• Use written agreements. A master services agreement and a service level agreement should cover what’s included and excluded, response times, support hours, who owns data and licences, security responsibilities, what happens at the end of the contract and how you hand over passwords and data. See Contracts and legal basics, and get legal advice on your templates.

Step 3: Build your tech stack

An MSP’s tools are its production line. A typical stack covers:

• RMM (remote monitoring and management): see every device, push patches, run scripts and connect remotely.
• PSA or service desk: tickets, time tracking, contracts and billing.
• Backup and disaster recovery for devices, servers and cloud apps.
• Security: endpoint protection, endpoint detection and response (EDR), email security, data loss prevention and security awareness training.
• Documentation: client networks, passwords, procedures and assets.
• CRM and marketing: tracking prospects and proposals. See Choosing a CRM system.

There are two broad approaches. Many MSPs assemble separate best-of-breed tools, such as NinjaOne, ConnectWise or Atera for RMM, HaloPSA for service desk, IT Glue or Hudu for documentation, and a separate security vendor. That gives flexibility, but each tool has its own agent, console, contract and integration to maintain.

The other approach is an all-in-one platform. Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) is a good example of how this works. According to Acronis, it lets service providers:

• Install one agent, configure one policy and operate one console for backup, security, management and recovery.
• Deliver security services including endpoint protection, EDR, managed detection and response, email security, data loss prevention, security awareness training and GenAI protection (to discover and control the AI tools staff are using).
• Protect and manage Windows and macOS computers, servers, and Microsoft 365 and Google Workspace data.
• Run the business side with a service desk, asset management, compliance monitoring against framework controls, and automated provisioning and billing across client accounts.
• Store data in Australia. Acronis lists a data centre in Sydney, which matters to clients with data sovereignty questions.

For a new MSP, the commercial model is also important. Acronis says service providers get a partner account where they create client accounts, switch on products as needed, and are billed per actual usage in arrears. That means you pay as you add clients rather than buying large upfront licence blocks.

Whatever you choose, keep the number of tools small. MSP Notes points out that labour can be up to 80% of a typical MSP’s costs, and that average MSP profit margins are around 8% to 12%. Fewer consoles, fewer agents and more automation mean each technician can look after more clients, and that’s where margins improve.

Step 4: Secure your own business first

An MSP has privileged access to every client’s systems, which makes MSPs an attractive target. ASD’s guidance, Questions to ask managed service providers, lists what clients should ask you, so prepare your answers before they do:

• Are you implementing the Essential Eight? Many clients will also ask whether you hold, or are working towards, SMB1001 certification.
• Are you securely administering your systems and services, especially remote access?
• Are you monitoring activity on your systems and services?
• Are you regularly assessing your systems for vulnerabilities?

In practice, that means multi-factor authentication on every admin account, separate admin accounts, least-privilege access for technicians, logging, tested backups of your own systems, and a written incident response plan. Consider certifying your own business against a standard such as SMB1001 or working towards Essential Eight maturity. It’s a strong selling point when clients face the same questions.

Step 5: Price for profit

Most MSPs charge a fixed monthly fee per user or per device, based on the package. To set your prices:

1. Add up your costs per user: platform and licence costs, plus the technician time a typical user needs each month.
2. Add overheads: your own salary, insurance, accounting, marketing, vehicles and office.
3. Set a target margin and check your prices against local competitors.
4. Price projects separately, with a scope, fixed price or estimate, and a rate for anything outside scope.
5. Review prices once a year and when your vendors’ prices change.

Avoid unlimited support at a low price. Define what’s included, set fair-use limits, and charge for work outside the agreement.

Step 6: Win your first clients

Many MSPs begin with former employers, former colleagues, friends’ businesses and existing break-fix customers. From there:

• Referrals. MSP Notes recommends making referrals easy: a short, forwardable email and a one or two page summary of your services, with a quote from a happy client. Thank people who refer you.
• Local search. A complete Google Business Profile, reviews and a simple website with your service area and industries.
• Partnerships. Accountants, bookkeepers, business brokers and office fit-out companies often hear about IT problems first.
• Networking. Local business chambers, industry associations and referral groups.
• Free assessments. A short security or AI readiness check gives you a reason to talk and shows clients exactly what needs fixing.

Before spending on advertising, MSP Notes suggests reviewing your last 10 enquiries: who followed up, which ones had a problem you could solve, and where the conversation stopped. More leads won’t help if your sales process loses them.

Step 7: Onboard well and grow

The first month sets the tone. Use a standard onboarding checklist: collect admin access, document the network, deploy your agent, check backups, turn on multi-factor authentication, remove old accounts and fix the biggest risks first. Then hold a short review with the client to show what you found and fixed.

As you grow:

• Standardise the software, settings and security policies you deploy for every client.
• Automate patching, alerts, reports and routine tickets. Many platforms now include AI assistants and automated ticket triage.
• Hold regular reviews with each client to discuss risks, compliance and upcoming projects, including AI.
• Hire when the numbers support it, and document your processes so new technicians can work your way from day one.