Most managed services providers treat schools as small businesses with summer breaks. That mental model fails on contact with the real operating environment: a school has more users than a business its size, more devices, a more complex identity story, a regulatory layer that businesses don't carry, and an academic calendar that turns minor issues into crises if they hit during the wrong week. Choosing the wrong MSP is one of the most expensive mistakes a private school can make — not because of the contract value, but because of everything that breaks downstream.
Why Generic IT Doesn't Cut It
A generic MSP can keep your servers up and your email working. That is not the bar. The bar is whether they can help the registrar reconfigure Blackbaud after a grading-scale change in the middle of the trimester, whether they understand why the development office's email blast got blocked by Mimecast, whether they know how to provision a new student in the SIS and have it propagate to Microsoft 365, the print system, and the gradebook in fifteen minutes instead of three days.
Those scenarios are not edge cases for a school — they are Tuesday. An MSP that can't speak the language of student information systems, learning management systems, and admissions platforms is going to leak hours on every ticket while your administrators end up doing IT work themselves.
Criterion 1: Education-System Fluency
Ask any prospective MSP to name the major SIS platforms, the major LMS platforms, and the major billing systems for private schools. Then ask which ones they have admin-level experience in. If they cannot name FACTS, Blackbaud, Veracross, Canvas, Schoology, and the differences between them, they are not a schools MSP. They are a generic MSP who will learn on your tickets.
The right MSP either has a dedicated Blackbaud (or FACTS, or Veracross) practice in-house, or has a clear partnership with one. Be wary of the firm that claims to support everything — depth matters more than breadth in this category.
Criterion 2: Real Security Posture, Not Just Antivirus
Schools have become a meaningful target for ransomware and account-takeover attacks. The data is sensitive — student records, financial information, family addresses — and the security posture in many schools is generously described as casual. An MSP serving schools needs to bring a real security stack: endpoint detection and response (not just antivirus), managed detection and response, identity protection layered on top of Microsoft 365 or Google Workspace, phishing simulation, and a security awareness program.
- Endpoint detection and response (EDR) on all faculty/staff devices
- Multi-factor authentication enforced for all staff, including in remote scenarios
- Managed detection and response or 24/7 SOC monitoring
- Quarterly phishing simulation with reporting
- A documented incident response plan with the school's name in it
- Backups that are tested with real restores, not just status emails
Criterion 3: Response Times That Match the Calendar
Schools have peak periods that look nothing like a normal business. The first week of school. Report card week. The day re-enrollment opens. Application deadline week. The first day of online classes during a snow day. An MSP whose SLA reads 'next-business-day response' is going to fail you on every one of those days.
Ask any candidate MSP how they staff during back-to-school week, whether they have an on-call rotation, and whether they pre-stage support hours during predictable peak weeks. The right answer involves specific dates on a specific calendar, not platitudes about being 'responsive.'
Criterion 4: Vendor-Agnostic Recommendations
An MSP that makes most of its money on hardware margin and software resale is structurally biased. They will recommend what they sell. That can be fine, until the day they recommend a $40,000 storage refresh you don't actually need or steer you away from a SaaS option that would be a better fit because it cuts into their managed services revenue.
Look for transparent billing models, separation between consulting and procurement, and a willingness to recommend things they don't sell. The right MSP will sometimes tell you to keep what you have — and will not lose sleep over the absence of a hardware sale.
Criterion 5: Documentation You Actually Own
If you fire your current MSP tomorrow, can your next MSP pick up where they left off? In most engagements we audit, the answer is no — the existing MSP holds passwords, network diagrams, and license keys in their own internal systems, and the school has no real artifact of what their environment looks like.
A good MSP delivers documentation as a contractual artifact, owned by the school. Network diagrams, password vault, license inventory, asset registry — all in formats and platforms the school controls. This single line item is worth more than most schools realize, because it converts the MSP relationship from hostage situation to partnership.
Red Flags To Walk Away From
- Cannot produce references at peer schools — or only at schools you've never heard of
- Refuses to share their actual support tooling (ticketing, monitoring, RMM platform)
- Won't commit to specific response times for specific incident severities
- Recommends the same stack to every customer regardless of fit
- Cannot articulate how they handle the start-of-year peak
- Owns critical credentials or domain registrations the school cannot independently access
What a Good Onboarding Looks Like
The first 60 days with a new MSP tell you most of what you need to know about the next five years. A good onboarding inventories your environment, documents what they find, identifies the top five risks, and presents a 90-day stabilization plan with specific dates. A bad onboarding bills the same as a good one but produces nothing the school can point to.
Ask any candidate MSP what their first 60 days will look like — by week, with deliverables. Vague answers about 'getting to know your environment' are a warning sign. Specific answers with named artifacts are a green light.
How Mezzoly Engages With Schools
Mezzoly is purpose-built for education. Our managed services include a dedicated Blackbaud practice, real security tooling, calendar-aware support coverage, and documentation the school owns. We're transparent about pricing, we don't take vendor kickbacks, and we structure engagements so the school can leave us at any time without operational damage. If your current MSP can't say all of that on paper, we should probably talk.