If you've received a managed IT proposal and noticed a separate line for network management alongside the per-user rate, you're not looking at a billing error. That separation is intentional, and understanding why it exists will help you compare any managed IT quote accurately.
The short answer: a per-user managed IT rate covers the people and devices on your network. It does not cover the network itself. Firewall management, switch configuration, and wireless infrastructure are distinct recurring responsibilities with their own labor, tooling, and pricing variables. Combining them into one number would make it impossible to know what you're actually buying.
What the Standard Per-User Rate Actually Covers
Onsite Technical Services prices Standard Managed Services at $150-$200 per user per month, all-in. That rate funds a specific set of operational responsibilities tied to each user and the devices they work on:
- Endpoint monitoring, patching, and configuration management
- Endpoint Detection and Response (EDR): continuous monitoring of each laptop, desktop, and server for attack behaviors, with the ability to isolate a compromised device before a threat spreads
- Managed Detection and Response (MDR): a live Security Operations Center that triages every alert around the clock, separating false alarms from real threats and acting immediately when something genuine appears
- Identity Threat Detection and Response (ITDR): monitoring of Microsoft 365 accounts for compromised logins, impossible-travel sign-ins, and unauthorized changes
- Advanced email protection against phishing, business email compromise, and weaponized attachments
- Security awareness training and phishing simulations
- Application allowlisting, ringfencing, and endpoint controls
- PC encryption and Microsoft 365 backup (email, OneDrive, SharePoint, Teams)
- Business-hours helpdesk support, plus 24/7/365 monitoring and after-hours incident response
- Microsoft 365 administration and security configuration
- Business Technology Reviews (BTRs) included in the recurring scope, not billed separately
Everything above is user-centric and device-centric. A 20-person business pays for 20 units of this ongoing operational responsibility. What that rate does not include is the firewall sitting at the edge of your office, the managed switch the devices plug into, or the wireless access points broadcasting your internal network.
What Network Management Actually Is (and Why It Has Its Own Scope)
Network management is the recurring operational responsibility for the physical and logical infrastructure that connects your users, devices, servers, and internet connection. Specifically, this covers:
- Firewall: configuration, policy management, firmware updates, security rule review, VPN administration, and monitoring
- Switches: VLAN configuration, port management, firmware patching, and performance monitoring
- Wireless access points: configuration, coverage management, firmware updates, and guest network segmentation
These are infrastructure assets, not user assets. A 20-person company might have one firewall, several managed switches, and a handful of wireless access points. Adding a 21st user does not change the firewall configuration workload. Conversely, adding a second office location adds an entirely new set of network infrastructure to manage, regardless of how many users are there.
Because the scope and cost drivers are fundamentally different from per-user work, the billing has to reflect that. Folding network management into the per-user rate would mean a company with a simple single-site setup subsidizes the cost of managing a multi-location, complex infrastructure, or vice versa. Neither outcome is accurate or fair.
How Network Management Is Priced: Two Scenarios
The rate for network management depends on two variables: who owns the hardware, and whether compliance requirements (such as those that trigger a SIEM for log retention) apply. The price also scales with network size and complexity.
| Scenario | What It Covers | Planning Range (per site/month) |
| Client-owned hardware | OTS provides ongoing maintenance and monitoring of your existing firewall, switches, and access points. Optionally includes SIEM log management where compliance requires it. | Approximately $50-$200/month |
| OTS-provided hardware | OTS supplies the firewall, switches, and access points, plus subscriptions and SIEM where compliance requires it. Full infrastructure responsibility. | Approximately $150-$400/month |
These are planning ranges, not a guaranteed quote. The actual figure depends on the number of devices being managed, the complexity of the environment, the number of locations, and whether regulated-industry log retention requirements apply.
A Concrete Example: A 20-Person Phoenix Business
Consider a 20-person business in Phoenix running Standard Managed Services. Their monthly managed IT investment looks like this:
- Standard Managed Services: 20 users at $150-$200/user/month = $3,000-$4,000/month
- Network Management (single site, client-owned hardware): approximately $50-$200/month
- Network Management (single site, OTS-provided hardware): approximately $150-$400/month
If they own their own firewall and networking gear and want OTS to manage and monitor it, the total picture is roughly $3,050-$4,200/month for the full scope. If they want OTS to supply and own the hardware, the range shifts to approximately $3,150-$4,400/month.
Note that Microsoft 365 licensing is always its own separate line item, billed on Microsoft's terms, and is not included in either the per-user managed IT rate or the network management rate. Projects, migrations, hardware purchases outside of a managed network agreement, and compliance assessments are also billed separately.
Why This Structure Helps You Evaluate Any Managed IT Quote
When a managed IT provider bundles network management into a single per-user number, one of three things is usually happening:
- The provider is managing a very simple, standardized network and has averaged the cost across all clients. This works until your environment differs from their assumed baseline.
- The network management scope is minimal or undefined, meaning you may not know what happens when something breaks or needs configuration changes.
- The price is simply higher to absorb the hidden variable, which means simpler environments overpay.
A transparent line-item structure lets you verify what operational responsibility is actually included. Ask any provider: who manages my firewall day-to-day? Who updates firmware? Who changes security rules when your environment changes? Who monitors the switch for performance issues? If those answers are vague, the scope is vague.
At Onsite Technical Services, the division is clear by design. The per-user Standard rate covers user-centric and endpoint-centric operational responsibility. Network management is a separately scoped, separately priced line that reflects the actual infrastructure being maintained. You know what each line is paying for.
What Changes the Network Management Price Over Time
The network management rate is not fixed forever. Several factors can move it up or down at renewal or when your environment changes:
- Adding a second or third office location adds a per-site network management line
- Growing from a single firewall to a more complex multi-zone security architecture increases the management workload
- Moving into a regulated industry (healthcare, financial services, defense contracting) may add compliance-driven SIEM log retention requirements to the network scope
- Transitioning from client-owned hardware to OTS-provided hardware shifts the hardware ownership and infrastructure responsibility, and changes the applicable rate range
- Adding SD-WAN, redundant internet connections, or more complex VPN configurations increases scope
A well-structured managed IT engagement will identify these variables during the initial assessment so the quote reflects your actual environment, not a generic template.
Frequently Asked Questions
Why isn't my firewall management included in my per-user managed IT rate?
The per-user rate covers operational responsibility for your users and their devices: endpoints, security monitoring, helpdesk, email protection, identity management, and Microsoft 365 administration. Firewall, switch, and wireless management are infrastructure responsibilities that scale with your locations and network complexity, not your user count. Bundling them into the per-user rate would produce inaccurate pricing for most environments.
What does network management actually include on a monthly basis?
Ongoing management of your firewall (configuration, firmware, security rules, VPN), managed switches (VLAN setup, port management, patching), and wireless access points (configuration, firmware, guest network segmentation). The scope and price depend on who owns the hardware and whether compliance requirements add SIEM log management to the mix.
Does Onsite Technical Services provide the network hardware, or do I own it?
Both models are available. If you own your existing firewall, switches, and access points, OTS manages and monitors them at approximately $50-$200 per site per month. If you prefer OTS to supply and own the hardware, the rate is approximately $150-$400 per site per month. These are planning ranges that scale with network size and complexity.
Is Microsoft 365 licensing included in the Standard Managed Services rate?
No. Microsoft 365 licensing is always a separate line item billed on Microsoft's terms. The $150-$200 per user per month Standard rate covers the managed IT and security services OTS provides on top of the Microsoft 365 platform.
How does adding a second office location affect my managed IT bill?
Adding a location adds a new per-site network management line to your invoice, since each site has its own firewall, switches, and wireless infrastructure to manage. Your per-user Standard rate grows only if the user count grows. The two lines scale independently.
