MSP Reference Check Questions

This article is for educational purposes only and does not constitute professional compliance advice or legal counsel. Your specific situation may vary, and you should evaluate any service provider relationship based on your organization's unique requirements.

References are where MSP sales pitch meets reality. When you talk to actual customers about their experience, you get information the MSP can't control. A reference who's been with an MSP for years can tell you things the sales team will never volunteer—what actually happens during an emergency, whether billing surprises emerge, whether the support quality degrades over time. References who've had problems and can discuss how the MSP handled them are gold. They're showing you what to expect when things go wrong, which is usually when you'll find out what an MSP is really made of.

The challenge is getting useful references and asking the right questions once you have them. MSPs will naturally provide their happiest customers, so you're not getting a random sample. But even happy customers have complaints, and the way they discuss those complaints reveals the nature of the relationship. An enthusiastic customer who says "they've been great" is different from an equally satisfied customer who says "they're good, though we did have some communication issues last year."

How to Get References That Matter

Start by asking the MSP for at least five references. Specifically ask for customers who are similar in size and industry to you. A customer with 5,000 employees might have a completely different experience than one with 50 employees—the infrastructure is different, the support requirements are different, the escalation processes might not even apply. You want apples to apples.

Ask for recent customers—ideally someone who's been with the MSP for two to five years. That's the sweet spot. Long enough that they've experienced the relationship through normal times and crisis, short enough that their experience is current. But also ask for at least one customer who's been with the MSP much longer—seven years or more if possible. Long-term customers can tell you whether the MSP improves over time or whether service degrades, whether they're still delivering value or whether you're just locked in.

Be skeptical if the MSP can only provide two or three references. They should have many satisfied customers willing to talk. If they're struggling to get references, that's a signal. Be skeptical if all references are within the last six months—ask for older customers too. Be skeptical if they only provide references from the same industry unless you're in a specialized vertical—they might have deep expertise in your industry but weak capability elsewhere.

Ask for a mix of roles. Ideally, talk to the IT decision-maker who evaluated and selected the MSP—they can discuss the sales process, pricing, and strategic fit. But also talk to the person who deals with helpdesk issues daily, like an office manager or IT support person. They experience the MSP's service quality at ground level. One might say "they're a great strategic partner," and the other might say "they're hard to reach when we need them." Both perspectives matter.

Responsiveness: The Real-Time Signal

Start with responsiveness because it's the most immediate signal of how the MSP will treat you. Ask references directly: When you have an issue, how responsive is the MSP? When you submit a ticket or call, how long does it take to hear back? How often do they fail to meet their stated response times?

Listen for specifics. A good reference will say "they respond to critical issues within an hour, usually faster" or "I can usually reach someone within 15 minutes of calling." A vague reference saying "they're pretty responsive, I guess" is less informative and slightly concerning—if the customer can't remember responsiveness positively, maybe it's inconsistent.

Ask a follow-up: Have you had situations where you desperately needed the MSP and couldn't reach them? How did that get resolved? This reveals whether responsiveness is consistent or whether there are failure modes where they go dark. Most vendors have bad days. The question is what happens on those days.

Ask specifically about account continuity: Has your main contact changed? If they say "we've had the same account manager for three years," that's a positive signal. If they say "the account manager has changed three times in two years," that's concerning. Institutional knowledge about your account matters, and constant turnover disrupts it. New technicians need time to understand your environment, and if they're constantly being replaced, you're living in a state of perpetual transition.

SLA Compliance and Enforcement

Ask: Do you have an SLA with your MSP? Can you tell me what it commits to? Most customers won't have memorized it, but they should know the basics—response time, resolution time, uptime targets. If a customer can't recall their SLA, they might not be tracking it, which is itself informative.

Ask specifically: Has the MSP ever missed an SLA commitment? This is the important question. No vendor hits SLAs 100% of the time—sometimes things happen. The question is what happens when they miss. If the reference says "yeah, they've missed it a few times," ask: What happened then? Did you get credit? Was that automatic or did you have to ask? An MSP that automatically credits customers when they miss is demonstrating accountability. One that makes you fight for credit is showing you a problem.

If the reference says "we have an SLA but neither of us really tracks it," that tells you the SLA is window dressing. It's not enforced and doesn't matter. That's a meaningful finding—you might not want an MSP that doesn't take their commitments seriously enough to track compliance.

Staffing Stability and Relationship Quality

Ask: Has your MSP's team been stable? Do you interact with the same people or does the team constantly change? Staffing instability is one of the biggest complaints about MSPs. If references mention constant turnover, that's a major red flag. If they mention having built relationships with the same team over years, that's positive. Relationships matter because they enable communication and reduce the learning curve when issues arise.

Ask more specifically: Do you feel like the people serving you understand your environment? Or are you constantly explaining things to new people? This is the operational impact of turnover. Even if the MSP is hiring competent replacements, the time spent reboarding new people is lost productivity.

Ask whether there's one primary contact or multiple people. If it's multiple people who are all familiar with your account, that's good—it provides coverage if someone is unavailable. If it's siloed to one person and that person goes on vacation or leaves, you're stuck. Ask specifically: If you need something after hours, who do you reach? If the reference can't answer this clearly, the MSP isn't well-organized.

Ask about professionalism: How would you rate the professionalism of the MSP's team? This is open-ended and the tone matters more than the words. Are they describing competent, responsive professionals or are they describing amateurish behavior, poor attitude, or lack of expertise?

Cost Control and Billing Transparency

This is where many MSP relationships reveal problems. Ask: Is your MSP cost predictable? Do bills match the quote you received? Have there been surprise charges?

Listen carefully to how they answer. If they say "the base price is what we agreed to, but we get billed extras for things like new user setups and additional servers," that's concerning. The contract should specify what's included and what isn't. If surprises keep happening, the MSP is either interpreting scope narrowly or is intentionally vague so they can bill for extras later.

If they say "cost is exactly what we agreed to and we rarely see surprises," that's a positive signal about billing predictability. Ask for detail: What would trigger an extra charge? The reference should be able to give specific examples. If they say "we don't really know what might cost extra," the scope definition in the contract is too vague.

Ask about price increases: Have your costs gone up? By how much? Were you informed in advance? Reasonable MSPs increase prices to keep up with inflation—3% to 5% annually is standard. If increases are higher or they surprise you without advance notice, that's a problem. Ask: Did they raise your price to match your growing needs, or did they just raise it? If the answer is "they raised the price without asking for more features," that's a red flag.

Ask this one: Does the MSP try to upsell you on things you don't need? An MSP trying to juice revenue by recommending unnecessary add-ons will be obvious to references. An MSP recommending things you actually need is different.

Security and Incident Handling

Ask: Have you had any security incidents while using this MSP? If yes, how did the MSP handle it? If they've had an incident, they can tell you how the MSP responded—whether they were transparent, whether they helped investigate, whether they fixed the underlying problem or just patched it.

Even if the reference hasn't had an incident, ask: If you had a security breach affecting your data, do you feel confident the MSP would help investigate and notify? Or do you think there would be finger-pointing? This is about trust. A customer should feel like the MSP is a partner in security, not someone they'd have to fight with if something went wrong.

Ask about security monitoring: Does the MSP provide security monitoring? What does that look like? If they include security monitoring, how often does the reference see the MSP proactively catching things and alerting them? If the answer is "we've never seen them find anything," either the MSP's monitoring is weak or the environment is exceptionally clean. If the answer is "they catch things regularly," the monitoring is working.

Ask whether the MSP is proactive or reactive about security. When the MSP finds something concerning, do they tell you immediately or do you discover it later? Good MSPs flag security concerns proactively. Reactive MSPs wait for you to ask about monitoring results.

Problem Escalation and Accountability

Ask: When something goes wrong, how does the MSP handle escalation? Do they investigate the problem or do they just blame your systems? Listen for whether the reference trusts the MSP to solve problems or whether they feel like they're fighting with the MSP to accept responsibility.

A good MSP owns problems and works toward resolution, even if the ultimate cause wasn't their fault. A bad MSP defends their processes and blames the customer. An MSP that says "we investigate every problem to understand the root cause" is different from one that says "we respond quickly but the issue is usually on your end."

Ask: Can you think of a time a problem wasn't resolved to your satisfaction? What happened? How is the MSP compensating you or addressing it? Some problems take time to resolve—that's normal. What matters is whether the MSP is transparent about progress, responsive to follow-up questions, and willing to escalate when the initial approach isn't working.

Overall Satisfaction and Direction

Ask directly: Would you recommend this MSP to others? Why or why not? Listen for enthusiasm versus resignation. Someone saying "yeah, we're happy with them, we'd recommend them" is different from someone saying "they're fine, we'll stick with them." The first sounds like genuine satisfaction. The second sounds like they've accepted their current situation.

Ask: If you could change one thing about working with them, what would it be? This usually elicits honest feedback. Even satisfied customers will have something. The nature of the complaint tells you what matters to them.

Ask forward-looking: How much longer do you plan to stay with this MSP? If the reference says "we're actively looking at other options" or "until we find someone better," they're dissatisfied. If they say "probably for years, they're doing a good job," they're satisfied.

Red Flags in Reference Conversations

Pay attention to patterns across multiple references, not just individual comments. If multiple references mention poor communication, that's a pattern. If multiple mention constant staff changes, that's consistent. Patterns are more meaningful than individual complaints.

Specific red flags in references: "We've had to push back hard on billing multiple times." "The main contact changed and we lost continuity on our account." "We had a problem and they blamed it on us instead of investigating." "We're looking at other options right now." "They're okay but there are things that frustrate me constantly." "We're locked in by the contract or we'd already be gone."

Specific green flags: "They've been proactive about suggesting improvements." "We trust them to handle things." "They've saved us money." "They take security seriously." "I'd recommend them to a friend without hesitation." "We've been with them for five years and we're still happy."

What References Reveal

References won't tell you everything, but they'll tell you whether the MSP's sales pitch matches the reality customers experience. An MSP can tell you they're responsive, but a reference will tell you whether they actually are. An MSP can tell you they're professional, but a reference will tell you whether that's true every day or just on good days.

The best references are ones from customers who have similar needs to yours, have been through crises together, and have clear eyes about both the MSP's strengths and weaknesses. A customer who says "they're great for X and weak at Y" is more credible than one who says "they're amazing." And a customer who says "they messed up and here's how they fixed it" is more informative than one who says "they're never made mistakes."

Take reference calls seriously. Listen not just for what they say but for how they say it. The tone and enthusiasm matter. And ask follow-ups if something isn't clear. You're trying to get a realistic picture of what working with this MSP would actually be like, and references are your window into that reality.

Fully Compliance provides educational content about IT compliance and cybersecurity. This article reflects general guidance about evaluating managed service providers. Individual MSP relationships vary—evaluate any provider based on your organization's specific needs and risk profile.