Skip to content
Managed IT & Support

How to choose a managed IT provider in Perth

What to ask a managed IT provider in Perth or regional WA before you sign, from service desk hours and onsite support to admin accounts and exit terms.

Geidi Infrastructure Team7 min read

In brief

What it is
The questions to ask a managed IT provider before you sign, from service desk hours and onsite support to admin accounts and exit terms.
Who it affects
Perth and WA office managers, practice managers and owners comparing managed IT proposals.
What to do
Ask each provider for written response times, evidence of its security baseline, proof that backups restore, and who holds the admin keys if you leave.
On this page
  1. Service desk hours, in Perth time
  2. Onsite support, in the metro area and beyond
  3. Response times that are written down
  4. A security baseline you can check
  5. Backups, and proof they restore
  6. Who owns the keys and the documentation
  7. Contract length and the way out
  8. Pricing models
  9. Local team or offshore helpdesk
  10. References
  11. If something has already gone wrong
  12. Where Geidi fits
  13. Sources

The renewal quote has gone up again, the same tickets keep coming back, or the person who "did the IT" has moved on. Whatever started it, you're now reading proposals from managed IT providers, and they all look much the same: a monthly fee, a service desk, some security, a contract to sign.

The differences show up later: at 7.30 on a Monday when the file server won't start, or on the day you decide to leave. These are the questions we'd want a Perth office manager, practice manager or owner to ask any provider before signing, including us.

A managed IT provider usually holds administrator access to your Microsoft 365, servers and firewall, and the Australian Signals Directorate (ASD) has been warning since 2017 that attackers compromise providers to reach their customers. So this is a security decision as much as a support one.

Service desk hours, in Perth time

Ask when the desk is staffed, and in which time zone. Western Australia runs on GMT+8 all year because it doesn't observe daylight saving. The east coast runs two hours ahead, and three hours ahead from October to April while New South Wales, Victoria, the ACT and Tasmania are on daylight saving. A desk staffed until 6pm Sydney time stops answering at 4pm in Perth for half the year, and at 3pm for the other half.

Then ask how a ticket moves: who answers, how it's prioritised and escalated, and whether you hear back without chasing. Ask for a sample monthly report. If it's only a ticket count, it tells you very little.

Onsite support, in the metro area and beyond

Most problems are fixed remotely now. Some aren't: a dead switch, an office move, a site that has lost its connection. Ask whether onsite visits are included or billed by the hour, where the engineers are based, and how soon someone can be at your door.

If you have regional sites, ask about each one by name. WA is about a third of Australia's land area, so "we cover WA" can mean very different things. How is an office in the Pilbara or the Goldfields supported: remote hands, a local contractor, scheduled visits, travel at your cost? Get the answer in the contract.

Response times that are written down

"We're very responsive" isn't a service level. Ask for response and resolution targets per priority, what counts as priority one, whose business hours the clock runs in, and what happens when targets are missed.

A security baseline you can check

ASD's Australian Cyber Security Centre (ACSC) publishes a short list of questions to ask a managed service provider. Are you implementing better practice cyber security, such as the Essential Eight? Are you administering your systems securely? Are you monitoring activity on them? Do you regularly assess them for vulnerabilities? Are you ready to respond to an incident? Ask all five and ask for evidence, not a yes.

Then ask about your own environment. Which Essential Eight maturity level will they get you to, and how will they prove it? Our guide to Essential Eight maturity levels explains what each level means.

ASD's guidance on engaging a provider adds controls worth putting in the contract:

  • Named accounts for each of the provider's staff, never one shared support login, so their activity is easy to pick out in your logs.
  • Multi-factor authentication on every way the provider connects to your systems.
  • Least privilege. Domain administrator groups stay empty by default, and rights are granted for a limited time when a job needs them.
  • A clause that obliges the provider to tell you about any incident that could endanger your network, including a compromise of their own systems.
  • Logs you can see. ASD recommends keeping event logs for at least 18 months.

ASD's Information Security Manual (ISM) went further in September 2026: provider access limited to tools, network addresses and time windows the customer approves, logged where the provider can't alter it. A fair benchmark, even if you don't need all of it.

Backups, and proof they restore

Ask what gets backed up (Microsoft 365 included), where the copies live, whether at least one copy is immutable or offline, and when a restore was last tested. Ask to see the result. Our article on backups that survive ransomware covers what good looks like.

Who owns the keys and the documentation

This is the one people forget until they want to leave. Ask whether you'll hold your own administrator accounts for Microsoft 365, the firewall and the domain name, and whether the network documentation and password vault belong to you, handed over on request and at exit.

The ISM says contracts should record what data you have and that you own it, and that data should be kept in a portable format so you can move without losing any.

If the provider also sells your Microsoft licences as a Cloud Solution Provider, it may hold admin rights in your tenant. Microsoft's current model, granular delegated admin privileges (GDAP), gives partners least privilege, time-limited access that you must approve. The older model gave partners Global Administrator. You can see what each partner holds in the Microsoft 365 admin center under Settings > Partner relationships, and Microsoft recommends reviewing it every quarter.

Contract length and the way out

Ask about the term, automatic renewal, the notice period and what leaving involves: handing over documentation and credentials, returning or destroying your data, helping the next provider, and what that costs. The ISM also suggests a right to verify the provider's security, break clauses if they fail to meet it, and at least one month's notice before a provider stops a service.

Since 9 November 2023, unfair terms in standard form contracts with small businesses (fewer than 100 employees or under $10 million turnover) are banned, with penalties. The ACCC's examples include terms that let only one side end or change the contract. A long term isn't unfair on its own, but read the termination and variation clauses closely and get advice if one looks one-sided.

Pricing models

You'll usually see per user, per device, a fixed fee for the whole environment, or blocks of hours. Our view: a fixed fee lines the provider's interest up with yours, while hourly billing pays more when things go wrong. Either way, ask what's excluded (projects, onboarding, after-hours work, travel, licences) and compare proposals on the same list.

Local team or offshore helpdesk

Neither is automatically better, but you should know where the people touching your systems are, and where your data is stored and accessed from. The ISM notes that offshore services carry jurisdictional risk because foreign laws can change with little warning, and that contracts should name the regions where data is processed and stored.

If you supply WA Government agencies, their policy reaches into your contracts too, including 24 hour incident reporting. Your provider has to be able to help you meet that. We cover it in the WA Government Cyber Security Policy for suppliers.

References

Ask for two or three current clients of a similar size and call them. ASD suggests this, and also asking the provider to walk you through how they'd administer your network.

If something has already gone wrong

If you think your systems or your current provider have been compromised, ask the provider what's affected, whether it's ongoing, what they're doing about it and who it has been reported to. Use a channel other than your company email. Report it through ReportCyber at cyber.gov.au or call 1300 CYBER1 (1300 292 371), and check whether the Notifiable Data Breaches scheme applies.

Where Geidi fits

Geidi is a Perth business based in Bentley, operating since 2000, for organisations of 5 to 1,000 staff across WA and Australia. Our managed IT support includes a 7-day service desk with unlimited incident and onsite support. Our cyber security service adds a 24/7 security operations centre, with security practices aligned to Essential Eight, ISO/IEC 27001 and SMB1001. If you're comparing providers and want to put these questions to us, get in touch.

Sources

More on Managed IT & Support

One partner for the whole environment.

Tell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.

Book a consultationCall 1300 855 049