How to Buy an IT Services Business or MSP (2026)

MRR vs. project revenue: the only split that matters

Before anything else, get the seller to break revenue into three buckets for the trailing 24–36 months:

• Contracted managed services (MRR): Recurring per-user or per-device agreements covering monitoring, help desk, patching, and security. This is the revenue that earns a premium multiple, because it renews without a sales effort.
• Recurring pass-through: Resold licenses (Microsoft 365, security tools), hosted voice, and cloud infrastructure. Predictable, but usually a much thinner margin than managed services — ask for revenue and gross margin by line, because a business with a large license-resale book can look bigger than it is profitable.
• Projects and break-fix: Migrations, hardware refreshes, hourly work. Real profit, but it restarts at zero every month and it's the first thing clients cut. Value it, but don't pay an MRR multiple for it.

A seller quoting a blended multiple on total revenue is doing you no favors. Model the buckets separately and you'll usually find the defensible price is below the ask.

Contract quality: read every agreement

Recurring revenue is only worth a premium if it's actually contracted. On small MSPs, it frequently isn't, or the paperwork is far weaker than the seller implies. Check every agreement for:

• Term and renewal: Is it a fixed multi-year term with auto-renewal, or month-to-month? A book of month-to-month agreements is a book of intentions.
• Termination clause: 30-day termination for convenience is common and materially reduces the value of the contracted revenue. Know how much of the MRR sits behind a short-notice out.
• Assignment: Does the agreement transfer to a new owner without client consent? If it requires consent, you are effectively re-signing the entire client base as a condition of the deal — and you should structure the price around that.
• Scope and rate: Per-user or per-device pricing, what's included versus billable, and when rates were last increased. A book that hasn't seen a price increase in five years is either an opportunity or a sign that clients would leave if you tried.
• Service-level commitments and liability: Response-time obligations and any uncapped liability language you'd be inheriting.

Client concentration and churn

Ask for revenue by client for the trailing three years and calculate the top-one and top-five concentration yourself. Small MSPs very often have one anchor client — a local manufacturer, clinic, or law firm — producing an outsized share of revenue. That's not automatically disqualifying, but it should change both the price and the structure: concentration risk is what earnouts and holdbacks exist for.

Then look at churn from the other direction. Request a list of every client lost in the last three years with the reason. Sellers present current clients; the departures tell you whether the business retains accounts on service quality or on the owner's personal relationships. Also ask when each remaining client last had a genuine executive-level conversation with someone other than the owner — if the answer is "never," you're buying the owner's rolodex, and it isn't for sale.

The team and the tech stack

Two operational areas quietly determine whether an MSP survives a transition:

• Technician retention: Identify who actually holds the client knowledge. In small shops it's often one senior engineer who knows every environment. Confirm compensation is at market, and make retention or transition agreements with key technicians a closing condition — losing that person in month two can cost you the client base.
• Owner dependence: Ask what percentage of billable and escalation work the owner personally handles. If the owner is the top technician and the salesperson, normalize the financials for two market-rate replacements before you value anything.
• Tooling and documentation: Confirm what RMM, PSA, ticketing, backup, and security tooling is in place, whether contracts for those tools transfer, and what they cost per endpoint. Then check documentation quality — are client environments, credentials, and network diagrams documented in the PSA, or in the senior engineer's head? Undocumented environments are the most common hidden cost in this category.
• Vendor agreements and margins: Microsoft partner status, distributor relationships, and volume tiers can affect resale margin and may not transfer automatically on a change of ownership.

Security and liability diligence

An MSP holds privileged access to every client's network, which makes it a target and makes you an inheritor of whatever hygiene the seller practiced. Before closing, verify: whether the business has ever had a security incident affecting clients (ask directly, in writing); whether privileged credentials are stored in a proper vault with MFA; whether the RMM tool — the single highest-value target in the stack — is properly hardened; whether cyber liability and errors-and-omissions coverage exists and what the loss runs show; and whether any client contracts include compliance obligations (HIPAA, PCI, CMMC) that carry requirements you'd need to meet from day one.

Financing an MSP purchase

SBA 7(a) is the most common path for owner-operator buyers in this category, and lenders are generally comfortable with IT services when there's a real recurring-revenue base and a documented transition plan. Expect roughly 10% down, personal guarantees, and questions about your technical or management background. Since these deals are usually asset-light, there's little collateral beyond the goodwill, which makes the cash-flow story and client retention plan the centerpiece of the underwriting.

Seller financing and earnouts are especially common here and genuinely appropriate: tying a meaningful part of the price to client retention over 12–24 months aligns the seller with the introductions and handoffs you actually need. Expect the seller to stay on in some capacity through the client transition.

What makes a good MSP acquisition target

The best targets have: a high share of revenue under contracted managed-services agreements with real terms and assignment language; no single client above a comfortable concentration threshold; documented client environments in a proper PSA; a technician team that handles escalations without the owner; a security posture you'd be willing to stand behind on day one; and rates that have been increased at least once in recent memory.

Red flags: revenue that's mostly project and break-fix work sold as "recurring"; month-to-month agreements with 30-day outs; an owner who is the primary technician and the only client contact; undocumented environments; no cyber liability coverage; unaddressed compliance obligations in client contracts; and clients acquired entirely through the owner's personal network with no repeatable lead source.

Related Guides