LAN Service Group is a managed IT provider headquartered in San Ramon in the San Francisco Bay Area, serving clients across the United States and in major international cities since 1992. We run IT either as your fully outsourced IT department or co-managed alongside your own staff: help desk, device and Microsoft 365 management, security, backups and IT strategy. Below are straight answers to the questions our clients ask most.
Managed IT: common questions
What is an outsourced IT help desk and how does it work?
An outsourced IT help desk is a contracted provider that handles your employees’ IT requests, such as login problems, device issues, software access and outages, by phone, email, chat or portal. It works best as part of a provider that also manages your devices, accounts and systems, so the people answering tickets can actually fix the underlying problem rather than log and forward it.
What should I look for in a managed service provider contract?
A good managed service provider contract clearly defines scope and exclusions, service levels by priority, security responsibilities on both sides, incident notification and handling, who holds administrator access, your ownership of data and documentation, pricing and change rules, and exit terms including handover. If any of these are vague, clarify them in writing before you sign.
Does Microsoft back up my Microsoft 365 data?
Not in the way most companies assume. Microsoft keeps its service resilient and retains deleted items for limited periods, but under the shared responsibility model your data remains your responsibility, and Microsoft’s Services Agreement recommends you regularly back up your content. For protection against ransomware, mass deletion or long-delayed discovery, you need a backup: Microsoft 365 Backup or a third-party product.
How do I know if we should replace our IT provider?
You should consider replacing your IT provider when the same problems keep recurring after you have raised them clearly: missed service levels, repeat outages, weak security practices, untested backups, no documentation, or no help with the decisions your business faces. Before switching, secure your admin credentials, domains, licenses and documentation, and plan an overlap so monitoring and backups never lapse.
What should an IT onboarding and offboarding checklist include?
An IT onboarding checklist should cover account creation, multifactor authentication, role-based access, a configured and managed device, and security training. An offboarding checklist should block sign-in and revoke sessions promptly, recover or wipe devices, preserve and hand over email and files, remove licenses and third-party access, and document each step. Both should be triggered by HR, not by memory.
How do you migrate from one Microsoft 365 tenant to another?
A Microsoft 365 tenant-to-tenant migration moves users, mailboxes, OneDrive and SharePoint content, Teams and domains from one tenant to another, typically after an acquisition, divestiture or rebrand. It is done with Microsoft’s cross-tenant migration features or third-party tools, and succeeds or fails on planning: identity mapping, licensing, domain cutover, permissions and user communication.
What is co-managed IT and when does it make sense?
Co-managed IT is an arrangement where a managed IT provider works alongside your internal IT person or team instead of replacing them. Your staff usually keep business applications and user relationships, while the provider adds monitoring, security tooling, patching, after-hours coverage and project capacity. It makes sense when you value your internal staff but lack depth or coverage, and only works with a written split of responsibilities.
What is the security difference between Microsoft 365 Business Premium, E3 and E5?
Microsoft 365 Business Premium, for up to 300 users, includes Entra ID P1, Intune, Defender for Business and Defender for Office 365 Plan 1. Microsoft 365 E3 includes Entra ID P1, Intune and Defender for Endpoint Plan 1, but not Defender for Office 365. E5 adds Entra ID P2, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity and Defender for Cloud Apps.
What security controls do I need to get cyber insurance?
There is no single cyber insurance standard, and each insurer sets its own application questions. Expect to be asked about controls that CISA treats as baseline: multifactor authentication, endpoint detection and response, offline and tested backups, prompt patching, security awareness training and an exercised incident response plan. GAO has reported that underwriters scrutinize risk more closely and that cyber controls affect premiums.
How do I write an incident response plan for a small business?
A small-business incident response plan names who decides and who acts, lists emergency contacts, sets steps for detecting, containing and recovering from common incidents such as ransomware and email compromise, and defines when to notify customers, insurers and authorities. Base it on NIST SP 800-61 Rev 3, published April 2025, and test it with CISA’s free tabletop exercise packages.
What should I expect from an IT security assessment?
An IT security assessment should start with an agreed written scope, combine interviews and document review with technical testing such as vulnerability scanning and configuration review, and end with a report that ranks findings by business risk. Expect an executive summary, detailed findings with evidence and a remediation roadmap. Prioritization should weigh known exploited vulnerabilities and the systems that matter most.
What should a Pleasanton business look for in a managed IT provider?
A Pleasanton business should look for a managed IT provider that combines remote help desk, monitoring and Microsoft 365 administration with scheduled on-site work at your office, lab or warehouse. Because Pleasanton hosts life-science, software and healthcare employers, also check that the provider understands your regulatory exposure, offers fully outsourced or co-managed models, and writes service levels into the contract.
How should a Walnut Creek business choose a managed IT provider?
A Walnut Creek business should choose a managed IT provider that offers responsive remote support, scheduled and urgent on-site work, and a security baseline for Microsoft 365, email and backups. Office-based firms handling client money or confidential files should press hardest on email-fraud defenses, phishing-resistant MFA for admins, written service levels, and whether the provider runs all of IT or co-manages with your staff.
What should the first 90 days with a new MSP look like?
The first 90 days with a new managed IT provider should run in three phases: secure handover of admin access and documentation in the first month, urgent security fixes such as MFA, backups and patching in the second, and stabilization with a documented environment and IT roadmap in the third. You should see measurable progress and written deliverables at each checkpoint, not just tickets closed.
What is phishing-resistant MFA and do we need it?
Phishing-resistant MFA is multifactor authentication that a fake login page cannot capture and replay, meaning FIDO2/WebAuthn passkeys or security keys and PKI-based smart cards. CISA calls it the gold standard. Text codes, one-time codes and plain push approvals can be phished or abused, so roll out phishing-resistant MFA to administrators and high-value users first, then to everyone else.
What is an outsourced IT department and is it right for my company?
An outsourced IT department is an arrangement where a managed IT provider runs most or all of your IT function under contract: help desk, devices, networks, cloud services, security operations and projects. It suits small and mid-size companies that cannot staff every IT skill internally. Your company still owns risk decisions, so the contract, oversight and data access need to be clearly defined.
What should a Microsoft 365 security baseline include?
A Microsoft 365 security baseline is the documented minimum set of security settings every tenant should meet. At its core: multifactor authentication for all users, stronger protection for administrators, legacy authentication blocked, and email, sharing and device settings hardened. Use Microsoft security defaults or Conditional Access to enforce it, Microsoft Secure Score to track it, and CISA’s SCuBA baselines as a detailed reference.
How do I choose a managed IT provider in the San Francisco Bay Area?
Choose a Bay Area managed IT provider by testing five things: its own security practices, on-site coverage for your locations, experience in your industry and compliance requirements, a contract with clear scope and service levels, and how it controls administrative access to your systems. Ask for references from similar-sized companies and confirm who will actually support you day to day.
Looking for a managed IT partner?
LAN Service Group, Inc. is an IT management, cybersecurity, compliance and AI services firm in San Ramon, California, serving businesses since 1992. More answers are in our executive library at CIO Support.