What managed IT support covers
A managed IT contract usually covers helpdesk support for staff, maintenance of laptops and servers, the office network and Wi-Fi, email and cloud accounts such as Microsoft 365 or Google Workspace, backups, antivirus and security patching.
It does not usually cover new projects such as a move to a new office, a server upgrade or custom software. Those are quoted separately. The first conversation with a provider should establish which of your problems are inside the monthly fee and which are billed on top.
Small offices in Dubai, with 5 to 30 staff, typically pay AED 100 to 300 per user per month, or AED 1,500 to 6,000 a month in total, depending on the response times and the hours covered. These are typical Dubai figures; in the other emirates costs are often similar or somewhat lower.
Check the licence and the people
Ask for the trade licence and check that the activity covers IT services, computer systems or network installation. Our guide to verifying a trade licence shows how.
Ask for the names and certifications of the engineers who will work on your account. Vendor certifications from Microsoft, Cisco or Fortinet are useful, and ISO 27001 for the company shows a documented security process. Ask how many engineers cover your account if the main contact is on leave.
Be careful with a one-person provider who is also the owner, the engineer and the invoicing contact. The service may be excellent until that person falls ill.
Service levels you can hold them to
A service level agreement (SLA) should state response time, resolution target and hours of cover. Typical figures from reasonable providers: a response within one to four working hours, a critical outage handled the same day, and cover from 8:00 to 18:00 on working days, with an out-of-hours number for emergencies.
Ask for the SLA in the contract, not in the brochure. Ask what happens when the provider misses it. Service credits of 5 to 10 percent of the monthly fee are common.
Ask for a monthly report listing tickets opened, the time taken to answer and resolve, and recurring problems. A provider that cannot produce this report is not measuring its own work.
Ask to see one real monthly report from a current client with the name removed. The ticket count, the median time to first response and the list of repeat problems show whether the provider fixes causes or only symptoms. A provider that logs the same printer fault nine months in a row has stopped looking.
Who owns the accounts and the data
Insist that you are the owner of every account the provider sets up for you: the Microsoft 365 or Google Workspace tenant, the domain name, the cloud storage, the firewall licences and the backup service. The provider should be an administrator, not the owner.
Ask where your data is stored. The UAE Personal Data Protection Law makes you responsible for the personal data of your customers and staff, and a provider that stores it must handle it lawfully. Ask whether data stays in the UAE or moves to another country, and which cloud region is used.
Ask how your backups work. A sound routine keeps three copies on two kinds of storage with one off-site, and tests a restore at least quarterly.
Pricing models and what they hide
Three models are common. Per user per month is simple and scales with your team. Fixed monthly fee suits a stable office and is easy to budget. Pay as you go at AED 150 to 400 an hour suits the smallest offices with few issues, but costs more when something breaks.
Watch for the extras: charges for onsite visits, for out-of-hours work, for hardware, for licences resold at a markup and for onboarding. A low monthly fee with a high onsite charge is a way of winning the contract and recovering the margin later.
Ask what the minimum term is. Twelve months is common, and a three-year lock-in with auto-renewal deserves a negotiation.
Security basics every provider should show you
Ask how the provider handles multi-factor authentication, patching, endpoint protection, email filtering, admin privileges and staff leavers. The right answers are specific: multi-factor on every email account, monthly patching, named people who remove access on the day someone leaves.
Ask what happens in a security incident. A provider should have a documented plan, a way to isolate affected machines and a duty to tell you promptly. Ask whether it carries professional indemnity or cyber insurance.
If your company deals with government entities in any emirate, check any standards that the entity requires of suppliers. In Dubai, the Dubai Electronic Security Center sets security standards for government bodies, and those can reach their suppliers.
The exit clause, and if it goes wrong
Before signing, read the clause on termination. You should be able to leave with 30 to 90 days' notice, receive all documentation, passwords and configuration, and have the provider cooperate in the handover for a fixed fee.
If the provider locks you out, holds admin accounts or refuses to hand over, write to the manager with a deadline. Your rights depend on the contract, so keep the signed copy. If you own the Microsoft 365 or domain registrar account, you can usually reset access through the vendor.
For a serious breach, such as a data leak, take legal advice and report it as required by the UAE data protection rules. For a billing dispute, the consumer protection section of the emirate's economic department (DET in Dubai) takes complaints against licensed companies.
Any AED amounts in this guide are typical ranges for Dubai as of October 2026; prices in other emirates are often similar or lower. They are not quotes and not offers: real prices depend on the job, the company and the date, so ask for written quotes.
Frequently asked questions
How much should IT support cost for a 10-person office?
In Dubai, typically AED 1,500 to 4,000 a month, and often similar or somewhat lower in the other emirates, depending on response times and whether onsite visits are included. Check that licences, antivirus and backups are inside the fee.
Should my IT provider hold the admin password?
A provider needs admin access, but the owner account must stay with you, with multi-factor authentication on a phone you control. Ask for a named admin account for the provider, not the owner login.
Does the UAE data protection law apply to my small company?
If you handle personal data of customers or staff, yes, in general. The law has exemptions and some free zones, such as DIFC and ADGM, have their own regimes. Ask a lawyer about your case.
How often should backups be tested?
At least every quarter, by restoring a sample file and a full mailbox to a test location. Ask the provider for the date and result of the last test.
