How to Buy an MSP or IT Services Business

Managed service providers occupy a unique position in the SMB acquisition landscape. They have the recurring revenue characteristics of a SaaS business (monthly contracts, predictable MRR, low churn in well-run shops) combined with the local market dynamics of a trade business (owner-operated, geographically anchored, deep client relationships built over years). For buyers who understand both technology and SMB operations, MSPs are among the most attractive targets in the lower middle market.

What is an MSP?

A managed service provider handles the ongoing IT infrastructure for small and medium businesses that cannot justify a full-time IT department. This includes network management, server maintenance, helpdesk support, cybersecurity monitoring, cloud migrations, and compliance work. Clients pay a fixed monthly fee per device or per user, which creates the recurring revenue stream that makes MSPs so valuable to acquirers.

A typical MSP with $3M to $8M in revenue manages IT for 30 to 100 client companies, with monthly contracts ranging from $2,000 to $15,000 per client depending on scope and client size. EBITDA margins of 15 to 25 percent are achievable for well-run shops with efficient technician utilization and limited overhead.

Why MSPs are exceptional acquisition targets

Three factors make MSPs particularly attractive right now. First, the cybersecurity threat environment has driven demand for managed security services that most small businesses cannot handle internally, expanding the addressable market for every MSP that offers security capabilities. Second, cloud adoption is creating an ongoing migration opportunity for MSPs that can guide clients from on-premise infrastructure to cloud platforms, generating project revenue on top of steady MRR. Third, the MSP industry is aging: many of the technicians who founded these companies in the early 2000s are now in their 50s and looking at exit options.

Monthly recurring revenue is the primary metric

For MSP acquisitions, monthly recurring revenue (MRR) is the number that matters most. MRR divided by the number of clients gives you average revenue per client, which tells you the scale and sophistication of the client base. Net MRR retention tells you whether the business is growing its wallet share. And MRR churn tells you whether the client base is stable or eroding.

A quality MSP with $250,000 in MRR, a client base of 50 companies, and 95 percent annual MRR retention is worth dramatically more than one with the same MRR and 15 percent annual client churn. The retention rate is the single number that separates a great MSP acquisition from a mediocre one.

Evaluating the technology stack

• Remote monitoring and management (RMM) tool: does the MSP use a leading platform like ConnectWise, N-able, or Kaseya? The RMM is the operational core of the business. A well-configured RMM reduces technician workload and enables scale.
• Professional services automation (PSA): ConnectWise Manage, Autotask, or HaloPSA. This is where tickets, time tracking, billing, and client contracts are managed. A clean PSA indicates operational discipline.
• Security stack: does the MSP offer endpoint detection and response, email security, and security awareness training? Cybersecurity services carry higher margins and are increasingly expected by clients.
• Vendor certifications: Microsoft partner status and similar certifications unlock technical support, product discounts, and referral programs from vendors.
• Documentation quality: does the MSP maintain detailed documentation on every client environment? Good documentation is evidence of operational maturity and dramatically reduces transition risk.

Customer concentration risk

The most common value-destroyer in MSP acquisitions is customer concentration. A $3M revenue MSP with one client representing 40 percent of revenue is not a $3M revenue MSP: it is a $1.8M revenue MSP with a single-client project attached. If that anchor client churns within a year of close, the business you bought is worth roughly half what you paid.

Set a concentration threshold before you evaluate any MSP. No single client should represent more than 15 percent of revenue. No single vertical should represent more than 40 percent. Diversification is the margin of safety in MSP acquisitions.

Valuation

MSPs trade at a wide range of multiples depending on revenue quality, growth, and specialization. A quality MSP with 90 percent or more of revenue on recurring monthly contracts, low churn, and cybersecurity capabilities will trade at 5 to 8 times EBITDA or 1.5 to 2.5 times revenue. Pure project-based IT shops without recurring contracts trade at 3 to 4 times EBITDA. The gap between these two multiples is the financial argument for building MRR into any IT services operation.

Common mistakes

• Treating all recurring revenue equally: a month-to-month contract is not the same as a 3-year agreement. Map out the contract lengths across the client base.
• Not accounting for key technician risk: in many MSPs, specific technicians hold all the institutional knowledge for key client environments. Losing one or two senior engineers post-close can trigger client churn.
• Overpaying for project revenue: if an MSP has a great year because one client did a large cloud migration, normalize that revenue out of your EBITDA model. Valuing one-time project revenue at the same multiple as MRR overpays significantly.
• Skipping a cybersecurity assessment: if you are acquiring a company that manages sensitive data for healthcare or financial clients, ensure that the MSP's own internal security posture is appropriate. A breach in the first year post-close can be existential.