If you’re comparing proposals from an Apple managed service provider, or checking the one you already pay, you’ll find most of them list the same things: device management, a helpdesk, patching, security. Because they all say it, the list won’t help you choose. This scorecard turns each item into something you can ask to see, and ends with a score you can use on a proposal today.
For managed support against paying per fix, see what good IT support actually looks like. Apple MSP vs traditional MSP covers the wider comparison, and switching MSP walks through a move.
What does an Apple managed service provider actually do?
An Apple managed service provider (MSP) looks after your Macs, iPhones and iPads for a fixed monthly fee. They set devices up, keep them secure and fix things when they go wrong. (“Apple MSP” also gets used for Messaging Service Providers, which run Apple Messages for Business. Different thing entirely.) The gap between a specialist and a generalist shows up in the detail.
What should a managed Mac service include?
These are the ten things we’d expect in the contract, each with what good looks like and the evidence to ask for. Get it in writing where you can, because a confident answer on a call is easy to give.
1. Zero-touch enrolment through Apple Business
New Macs ship straight to the new starter, and company settings, apps and security arrive the first time they sign in. Devices are registered in Apple Business (formerly Apple Business Manager) under your organisation. Ask them to walk you through a new starter’s first day, from opening the box to sending their first email.
2. Ongoing device management and configuration
Every device should sit in a DMS (formerly MDM) built for Apple, with settings applied as policy. Dr Logic runs client fleets on Addigy; Jamf and Iru (formerly Kandji) are other common choices. Ask which tool they use, who administers it, who owns the account, and what happens to your device records if you ever leave.
3. Patching that doesn’t interrupt the working day
Updates should be scheduled with deferrals and deadlines, so nobody gets a forced restart halfway through a client pitch, and high-risk or critical fixes still land within 14 days. That window comes from the NCSC’s Cyber Essentials requirements and applies to Cyber Essentials and Cyber Essentials Plus alike. Under the current question set, missing it is an automatic fail. Ask for the written patch policy and a report showing how quickly the last critical macOS update reached every device.
4. A helpdesk run by Apple specialists
You want unlimited requests, or limits written down clearly, answered by engineers who work on Macs every day. Ask how a ticket reaches an engineer. A direct line to someone who knows your setup beats a general service desk that logs the call and passes it along.
5. Onboarding and offboarding, including contractors and personal devices
There should be a documented process for joiners and leavers that also covers freelancers and staff using their own phones. For leavers, that means accounts closed, data recovered and the Mac released from Activation Lock. Ask for the checklist itself. If personal devices are in the mix, our BYOD policy template is a useful comparison.
6. Endpoint protection and monitoring
Every Mac, iPhone and iPad should have protection running, with alerts that a person actually reads. Ask what’s covered, including cloud accounts, and who sees alerts outside office hours.
7. Backup and restore, with tested restores
Microsoft 365 or Google Workspace data should be backed up separately from the platform (we use CloudAlly), and restores tested on a schedule. Cyber Essentials doesn’t require backups, though the NCSC strongly recommends them, so a certificate tells you nothing on this one. Ask when they last tested a restore for a client and how long it took.
8. Compliance reporting against a stated benchmark
Reports should measure your fleet against something specific, such as Cyber Essentials or your own security policy. Ask for a sample.
9. Asset lifecycle and refresh planning
Look for a live list of devices with age and warranty status, and a refresh plan you can budget for. Ask to see an example forecast.
10. A named account manager and regular service reviews
Someone should know your business, with a regular review covering tickets, risks and the year ahead. Ask for the review agenda and who attends from their side.
Which questions separate a specialist from a generalist?
Most providers can answer the ten above in some form. In Dr Logic’s experience, these five are where a generalist’s answers start to go vague.
What happens to Activation Lock and recovery keys when someone leaves?
Activation Lock ties a device to an Apple Account. If a leaver turned it on with their personal account and nobody planned for it, a perfectly good MacBook Pro becomes a very expensive paperweight. A specialist will explain how their DMS stores Activation Lock bypass codes and FileVault recovery keys, and how an Apple Business administrator can switch off Activation Lock on organisation-owned devices. Apple’s own guidance is that if you change device management provider, you should get those bypass codes handed over or have Activation Lock cleared first.
Who else holds Apple Business admin access if your main contact leaves?
Someone needs admin rights on your Apple Business account whoever moves on. Ask for the named administrators on both sides; we’d want at least one person at your company on the list. The NCSC also counts accounts your organisation owns as in scope for Cyber Essentials, even when a provider is the one using them. If you’re not sure who holds that access today, we’re happy to check it with you.
Can they show a compliance report from a real client fleet?
Ask for one from a real fleet with the client’s name removed. A template filled with sample data won’t tell you how their reports read when something is actually wrong.
How do they evidence patching for Cyber Essentials Plus?
At Plus, an assessor tests a sample of your devices directly. Ask how the provider proves every in-scope Mac and iPhone took critical updates inside 14 days, and when they last supported a client through a Plus assessment.
More on this in: Cyber Essentials Plus requirements for a Mac and iPhone fleet.
Where do the engineers who answer the phone sit, and what do they specialise in?
Ask who actually picks up, where they’re based and how much of their week goes on Apple devices.
How do you score a provider or a proposal?
Go back through the ten items and give one point for each the provider can back up with evidence: a document, a report, or a walkthrough of a real process. A promise on a sales call scores zero.
Eight or more is a strong result. Five to seven means asking for the missing items in writing before you sign. Below five usually points to a generalist managing Macs the way they’d manage Windows laptops.
Three questions worth sending to your provider, or anyone on your shortlist, this week:
- Can you send our leaver checklist, including how you handle Activation Lock and FileVault recovery keys?
- Who are the named administrators on our Apple Business account, on your side and ours?
- When did the last critical macOS update reach all of our devices, measured against the Cyber Essentials 14-day window?
Dr Logic is an Apple Premium Technical Partner, and if you’d like to see how we answer the ten, our Apple managed service provider page covers each one.
Related articles
- Apple MSP vs traditional MSP: a side by side breakdown
- Switching MSP? How to evaluate a new Apple-centric IT partner after a bad experience
- What good IT support actually looks like: A no-nonsense guide for UK businesses choosing or reviewing an MSP
FAQs
What is an Apple managed service provider?
An Apple managed service provider looks after a company’s Macs, iPhones and iPads for a fixed monthly fee. That covers setting devices up through Apple Business, managing them in a DMS, patching, security, helpdesk support and planning replacements. It’s a different thing from an Apple Messaging Service Provider, which handles Apple Messages for Business.
How can you tell an Apple specialist from a generalist provider?
Ask Apple-specific questions and listen for detail. A specialist can explain how they handle Activation Lock and FileVault recovery keys when someone leaves, who holds your Apple Business admin access, and how they prove critical updates reached every Mac within 14 days. A generalist tends to answer in Windows terms or go vague.
Does Cyber Essentials require Mac updates within 14 days?
Yes. The NCSC’s requirements say high-risk or critical security updates must be installed within 14 days of release, and that applies to Cyber Essentials and Cyber Essentials Plus alike. Under the current question set, it’s an automatic fail if you miss it, so your provider’s patch policy needs to hit that window every time.
What happens to Activation Lock when an employee leaves?
If the Mac is organisation-owned and registered in Apple Business, an administrator can switch Activation Lock off, and a well-run DMS also stores bypass codes for this. Trouble starts when a device was never registered or was locked to someone’s personal Apple Account. A good leaver checklist covers this before the person’s last day.
Should our company or our provider own the Apple Business account?
Your organisation owns its Apple Business account, and your provider is given admin access to run it. We’d always want at least one named administrator inside your company too, so you’re never locked out if a contact leaves on either side. Ask your provider for the current list of administrators.
