MSP playbook
How to price and package Microsoft 365 security assessments as an MSP
Work out what an assessment really costs you, choose a pricing model that fits how you sell, and package tiers customers can say yes to. No invented benchmarks, just the arithmetic.
Part of our guide: Running Microsoft 365 assessments as an MSP: packaging, pricing and QBRs
Pricing an assessment is awkward because it's two things at once: a service with real cost, and a sales tool that leads to projects. Price it too low and it becomes free consulting; too high and prospects won't start. This guide gives you a way to calculate your floor and choose a model, without relying on anyone else's numbers. Market rates vary by region, customer size and specialism, so we deliberately don't quote any.
For where assessments fit in your service and how to run the QBR, see the pillar guide: running Microsoft 365 assessments as an MSP.
Step 1: Calculate your cost per assessment
Break the work into parts and estimate each one from your own time tracking:
| Component | What to include |
|---|---|
| Tool cost | Your subscription divided by the assessments you actually run in a month (not the plan maximum) |
| Setup | Scheduling, getting consent or access, kickoff call |
| Engineer review | Reading the results, checking context, removing false alarms, adding judgment |
| Write-up | Executive summary, tailoring findings, remediation plan and estimates |
| Presentation | Preparing and running the meeting, follow-up email |
| Overhead | Sales time, quality review, rework |
Then: cost = tool cost + (hours × fully loaded hourly cost). "Fully loaded" means salary plus benefits, tools, training and non-billable time, not just salary divided by hours.
A worked example (example inputs, not benchmarks)
Suppose an MSP on a plan costing $1,000 a month runs 15 assessments in a typical month. The tool cost is about $67 per assessment. If a mid-size tenant takes 1 hour of setup, 3 hours of review and write-up and 1 hour to present, that's 5 hours. At a fully loaded cost of H dollars an hour, the cost is $67 + 5H. Whatever your H is, the engineer time dominates, which is why shaving review time with good tooling and templates matters more than negotiating the tool price.
Step 2: Choose a pricing model
Cost-plus fixed fee
Add your target margin to the cost from step 1 and publish a fixed price per tier. Simple to explain and easy to approve. The risk is under-pricing complex tenants, which tiers solve.
Tiered by scope
Offer two or three fixed-price tiers, each with a defined scope. Customers choose; you stay profitable because effort scales with the tier:
| Essentials | Standard | Comprehensive | |
|---|---|---|---|
| Scope | Identity and licensing | Plus devices and email | Plus collaboration, data protection and a workshop |
| Tenant size | Small | Up to a set user count | Any, priced by size band |
| Deliverables | Summary and findings | Plus remediation plan with estimates | Plus executive presentation and roadmap |
| Best for | Prospects, quick health checks | New managed customers | Larger or regulated customers |
Value-based
Price on what the outcome is worth to the customer: an audit or insurance renewal passed, a board question answered, a merger due-diligence item closed. Works well for specific, high-stakes situations. It needs a clear conversation about the customer's goal before you quote.
Included in the managed service
Build recurring assessments (for example quarterly) into your per-user or per-device managed service price. The customer never approves each one, you get a steady rhythm of QBRs and projects, and the cost is spread across the contract. Make sure the managed price actually covers the engineer time for each review.
Credited against remediation
Charge for the assessment, and credit some or all of the fee against a project approved within a set period (for example 60 days). This lowers the barrier for prospects without making the assessment free, and rewards quick decisions.
Should you ever do it for free?
Free assessments can open doors, but they train prospects to expect free work and attract people with no intention of buying. If you offer one, keep it deliberately limited (a short automated summary and a 20-minute call, not the full review), and position the paid tier as the real engagement. Make sure you have the prospect's consent to assess their tenant; their Global Administrator should approve access, never share credentials.
Step 3: Package it so it sells
- Name the outcome, not the activity. "Microsoft 365 Security Baseline" or "Tenant Health Review" beats "M365 assessment, 5 hours".
- Show a sample. An anonymized sample report does more than a feature list.
- State the scope. Workloads covered, tenant size, number of meetings, what's excluded (for example: no penetration testing, no remediation work, no on-premises systems).
- Set expectations on time. When they'll get the report and when you'll meet.
- Include the next step. Every assessment ends with a proposal, even if it's "no action needed, re-check in a quarter".
Step 4: Price the follow-on work
The assessment's commercial value is mostly in what follows. Prepare fixed-price or estimated packages for your most common findings, sized by the counts the assessment gives you (users, devices, domains, sites): a Conditional Access baseline, Intune enrollment and compliance, email authentication, privileged access, a sharing clean-up. Our assessment checklist maps to these areas, and licensing gaps are explained in Business Premium vs E3 vs E5.
Step 5: Review your pricing every six months
- Compare estimated and actual hours per tier. If Standard assessments routinely take twice the estimate, re-scope or re-price.
- Track conversion: how many assessments lead to approved projects, and how long that takes.
- Track which findings customers actually buy fixes for; build packages around them.
- Check tool utilization. If you're paying for capacity you don't use, change plan or run more recurring assessments.
Common mistakes
- Pricing on tool cost alone and forgetting engineer time.
- One price for every tenant size.
- No written scope, so "can you also look at…" becomes unpaid work.
- Including recurring reviews in a managed service but never scheduling them.
- Selling the assessment as a certification or guarantee. It's a review of configuration at a point in time.
Presenting the price
- Lead with the problem it solves, such as an insurance questionnaire, a board question or a recent incident, before the number.
- Show tiers side by side so the conversation is about which one, not whether.
- Be clear about what happens next: the assessment ends with a plan and, where relevant, fixed-price options for the fixes.
- Put it in writing with scope, deliverables and dates, so both sides agree what "done" means.
How M365Assessments helps
M365Assessments is priced per plan, not per seat: MSP 10 ($1,000 a month), MSP 50 ($2,500) and MSP 100 ($5,000) cover 10, 50 or 100 tenants with 20, 100 or 200 assessments a month, at early-access prices; annual billing is ten times the monthly price. That makes your tool cost per assessment predictable. Automated collection and a report that's ready to present cut review and write-up time, and on MSP 50 and above the Sales Guide prices remediation projects with your own rate card. See pricing and plans and limits.