IT AMC in Dubai: what a managed IT contract should actually cover

Ask three Dubai providers for an IT AMC quotation and you will get three numbers within a few dirhams of each other and three wildly different scopes. The price is the easy part to compare, which is exactly why it is the part everyone compares. The clauses underneath decide whether you have bought cover or whether you have bought the right to be invoiced again later.

These are the clauses we would read first if we were on your side of the table.

A response time means nothing until it is defined

Almost every AMC in this market advertises a response time. Very few define it. Before you accept one, get four things in writing.

• Response or resolution. Response is when a human acknowledges the ticket. Resolution is when the problem is gone. A 15 minute response with no resolution target is a promise to say hello quickly.
• What starts the clock. Ticket raised by portal, by email, by phone? Does a call at 19:40 start the clock at 19:40 or at 08:00 the next morning?
• Per priority, not one number. A P1 that stops the business and a P4 password reset should not share a target. Insist on a table, and insist on the definition of each priority, because the provider writes those definitions.
• What happens when it is missed. If there is no consequence, there is no service level, only a marketing claim. A service credit does not have to be large to change behaviour.

Included, or chargeable

This is where most of the difference between two similarly priced quotes actually sits. Go through the list and mark each item included, capped or chargeable:

• On site visits, and how many per month before they become billable
• Work outside business hours, weekends and public holidays
• New starter setup and leaver offboarding
• Operating system and third party patching
• Backup monitoring, and separately, backup restore testing
• Microsoft 365 or Google Workspace tenant administration
• Licence management and renewal tracking
• Liaison with your ISP, your landlord and your software vendors when a fault crosses a boundary
• Moves, adds and changes during an office fit out
• Projects, and where the line between support and project sits

The last one is worth pushing on. Every provider needs a support and project boundary, and a reasonable one is usually expressed in hours or in scope, not left to judgement after the fact.

Per user or per device

Per device looks cheaper on a spreadsheet and gets expensive in a business where people carry a laptop, a phone and use a shared workstation. Per user is normally the more honest model for an office, and it makes budgeting predictable when headcount moves. Whichever the provider uses, confirm two things: what counts as a billable unit, and how mid term changes are handled. Adding ten users in month three should not require a new contract, and losing ten should not be impossible until renewal.

Servers, firewalls and switches are usually priced separately. Make sure the count in the quotation matches the count on your asset register, not the count from the site survey six weeks ago.

The proactive half is what you are actually paying for

A reactive AMC is a call out contract with a monthly instalment plan. The value in a managed agreement is the work that stops tickets existing, and it is invisible unless the contract names it:

• Monitoring on every endpoint and server, with alerting that reaches a human out of hours
• Patch compliance reported as a percentage, not described as a policy
• Backup verification, meaning a test restore on a schedule, with the result recorded
• An asset and warranty register that is kept current, so a failed laptop is a warranty claim rather than a purchase
• Documentation of the estate, updated as it changes
• A quarterly review with the ticket data in front of both parties

If none of that is written into the agreement, you are paying a monthly fee for a reactive service and the provider has no commercial reason to reduce your ticket volume.

Decide explicitly whether security is inside the fee

Security is the most common gap between what a client assumes an AMC covers and what it covers. Name each item and say who owns it:

• Managed endpoint detection and response, and who triages the alerts
• Email filtering in front of Microsoft 365 or Google Workspace
• Multi factor authentication rollout and enforcement
• Firewall management, licensing and rule reviews
• Security awareness training and phishing simulation
• Out of hours monitoring, and what the provider is authorised to do at 02:00 without waking you
• Incident response, and whether it is inside the fee or billed at the worst possible moment

A UAE business also has records to keep. The federal Personal Data Protection Law has been in force since January 2022, and DIFC and ADGM entities sit under their own regimes. Your provider does not make you compliant, but a provider that cannot produce access logs, patch reports and backup evidence on request makes compliance considerably harder.

Exit terms tell you how confident they are

Read the end of the contract before the beginning. The questions are unglamorous and they matter:

• Who owns the Microsoft 365 or Google tenant, the domain name and the DNS? The answer should be you, on your own billing relationship where possible.
• Do you hold the global administrator credentials, or does the provider hold them alone?
• On exit, do you receive the documentation, the asset register, the monitoring and backup configuration and the ticket history, within a stated number of days, at no charge?
• What is the notice period, and is it symmetrical?
• Is any licensing, hardware financing or monitoring agent tied in a way that outlives the contract?

A provider that is comfortable with a clean exit clause is usually a provider that expects to earn the renewal.

Reporting, monthly, without asking

You should receive the same numbers every month, unprompted, in a format you can compare year on year:

• Tickets raised, resolved and still open, by priority
• Service level attainment against each target
• Repeat tickets, and the top recurring causes, which is the single most useful number in the pack
• Patch compliance percentage across the estate
• Backup success rate and the date of the last verified restore
• Security events handled
• Assets approaching end of warranty

The repeat ticket line is the one to watch. If it is not falling over two quarters, the proactive work is not happening regardless of what the contract says.

A baseline in week one, or you will never know

Insist that the first month produces a baseline: ticket volume, response times, patch state, backup state, licence position and asset ages as found. Without it, every later report is a number with nothing to compare it to, and any provider can claim improvement. With it, the conversation at the first quarterly review is factual.

A short checklist for comparing quotes

• Are response and resolution targets defined per priority, with a consequence for missing them?
• Are on site visits, out of hours work, starters and leavers included or capped?
• Is it priced per user or per device, and does the unit count match your asset register?
• Are monitoring, patching, backup restore testing and licence management named as deliverables?
• Is security inside the fee, and is incident response inside it too?
• Do you own the tenant, the domain and the administrator credentials?
• Is there a written exit clause with a handover list and a timeframe?
• Is a monthly report defined, and is a week one baseline included?
• Are the engineers named, based in the UAE, and do they work in the languages your staff speak?

If a quotation answers those nine questions in writing, the price is finally comparable to the one next to it.

How we write ours

Lunet runs managed IT for a fixed monthly fee with a 24/7 helpdesk staffed by named Dubai engineers, a 15 minute response written into the SLA, proactive monitoring across every device, patching, verified backups and licence management, reported monthly against a baseline taken in week one. See what our managed IT support covers, or talk to a Dubai engineer and we will price it against your actual device count.

Written by the Lunet Computers service desk team in Dubai.