What does an MSP actually do day-to-day? A real week from inside one

Most of what we do nobody sees, which is exactly the goal. Good IT is invisible. But "invisible" is a bad answer when a director asks what they're paying for, so here's a real working week from our service desk in Denton — a composite of recent days, with names and numbers changed.

Monday: the Monday surge

Monday morning is always the busiest part of the week. People come back to laptops that have been off all weekend, password expiries that have ticked over, and emails from Friday afternoon they forgot about.

By 10:30am we'll typically be 18–22 tickets in. The mix:

• Half are accounts and access: someone's locked out, someone forgot their MFA token at home, someone's been added to a new SharePoint site they can't see yet.
• A quarter are device-related: "my laptop's slow today", a Windows update that didn't quite finish, a printer that's lost its connection.
• A quarter are application-specific: Outlook stopped syncing, Teams microphone won't pick up, a CRM integration has thrown an error overnight.

None of this is glamorous. All of it adds up. Our standard is to acknowledge every ticket within 15 minutes during business hours and have first response within an hour. On Monday mornings we put extra capacity on the front line specifically because of the surge.

Tuesday: the proactive day

Tuesday is usually quieter on the helpdesk, which is when the proactive work catches up. A typical Tuesday for me looks like:

• Patch review across managed estates. Our RMM (Datto) shows me which devices are behind on critical patches. I'll usually see 5–10 stragglers across the book — laptops that have been off for a fortnight, a server with a deferred reboot. Each one gets handled or scheduled.
• Backup verification. I don't just check that backups ran — I check that recent test restores succeeded. A backup that hasn't been restored is just hopeful storage.
• EDR alert review. Most alerts are noise — a developer running a script that looks suspicious to the engine. But Tuesday is when I read through the week's alerts properly and tune anything that's generating false positives without missing real signals.
• Conditional access review for one client. We rotate through the book quarterly, checking that conditional access policies still match the business shape. Someone leaves, someone joins, an office moves — the policies need to keep up.

This is the work that gets cut first when an MSP is under-resourced. It's also the work that prevents Friday-afternoon disasters.

Wednesday: project day

Wednesdays are usually our project-heavy day, when we're working on planned work rather than reactive. This week's projects on the board:

• An accountancy practice migrating from an on-prem file server to SharePoint. We're partway through. Today is Day 3 of the migration; we're moving the second department's shared folders, testing permissions, training the partners on Files On-Demand.
• A new starter onboarding for a 14-person legal client. Laptop imaged, Autopilot profile applied, joining the right Azure AD groups, M365 licence assigned, mailbox created, MFA set up over a 20-minute call with the user, welcome email with quick-start guide. Total time about 90 minutes once you've done it a few hundred times.
• Cyber Essentials remediation for a manufacturing client preparing for assessment in three weeks — tightening guest network rules and standardising lock-screen timeouts across the fleet.

Project days are the visible work. They have deliverables, before-and-after states, and obvious value. They're also only 20–25% of what we do.

Thursday: the quiet day where the hard problem lives

Every week has one of these. The day where the ticket count looks low, but one ticket is going to swallow most of your morning.

This week it was a recurring Outlook issue at one client. Three users, intermittent, started a fortnight ago, fixes itself if you restart the laptop but always comes back. The first-line team had been bouncing it around. I picked it up, spent 90 minutes on logs, found a pattern with a specific add-in that conflicts with a recent Office 365 update, removed the add-in across the affected users, opened a case with the vendor, documented it in our internal knowledge base.

That's the work that distinguishes a good MSP from a ticket-bouncing one. Recurring issues need to be killed at root, not patched over. The investment of 90 minutes on Thursday saves probably four hours of cumulative ticket time over the next month.

Friday: reporting, reviews, and the 4pm rule

Fridays we don't deploy anything. That's a hard rule — no patches go out on Friday afternoon, no migrations finish on Friday afternoon, no firewall rules change on Friday afternoon. Whatever breaks on Friday afternoon will break the weekend, so we hold non-urgent change for Monday.

Friday morning is when monthly reporting usually gets prepared. For each client we produce a one-page summary: ticket volume, response times, security posture, patch compliance, backup status, and anything noteworthy. Brett or Simon then reviews these before they go out for the relevant client reviews.

Friday afternoon is documentation, training, and prep for the next week. Anything new we learned, anything we want our junior tech to know, anything a client asked about that needs a written answer.

The ratio that actually matters

If you total an average week across the team, our split is roughly:

• 40% reactive helpdesk — the visible "we fix things" work.
• 30% proactive maintenance — the invisible "we prevent things" work.
• 20% projects — onboardings, migrations, planned change.
• 10% strategy, reporting, vCIO — the conversations that prevent the next twelve months of pain.

An MSP whose engineers spend 80% of their time on reactive helpdesk is drowning. An MSP whose engineers spend 80% on projects is probably under-investing in the existing book. The ratio is the tell.

The bit nobody talks about

Honestly? Most days, the most valuable thing we do for a client is take a 4-minute phone call from a finance director who's about to send £18,000 to a "supplier" whose email address looks slightly off. Or quietly catch a phishing wave in EDR before anybody's clicked. Or notice a backup that started failing silently three nights ago.

None of that shows up nicely in a status report. All of it is the actual job.

If you'd like to see what a normal month with us looks like, including a sample of one of those one-page reports, get in touch — we'll happily share an anonymised one.