IT AMC Renewal Checklist: What to Review First

If your IT AMC ends in the next few months, review the past year before you sign the next one. Check whether the provider met its response and resolution targets, what you paid for outside the annual fee, whether the scope still matches your users and devices, who holds admin access to your Microsoft 365 tenant, and what happens if you leave. Most of these checks need only the reports your provider should already be sending you, and each one gives you something concrete to negotiate or a clear reason to switch. If you are comparing options, see how our IT annual maintenance contract in Dubai handles renewal.

When should you start reviewing an IT AMC renewal?

Start at least two months before the end date. That leaves time to collect reports, ask questions, get competing quotes and, if you decide to leave, give notice and plan a handover without a gap in support.

First, find two clauses in your current contract: whether it renews automatically, and how much notice you must give to stop it. If renewal is automatic and you miss the notice window, you may be committed to another year on the old terms.

Our own terms avoid this. Renewal is never automatic. In the 11th month of each year we send you a renewal notice with the price for the coming year, for you to review and approve. The price will vary every year, and you see it before you commit.

Did the provider meet its response and resolution targets?

Ask for the full year's ticket report by priority, with every missed target and its reason. A line saying the SLA was met is not enough.

• Response: when an engineer started work, not when an automatic reply was sent.
• Resolution: how long each ticket took to close against its target.
• Misses: which tickets missed, why, and what changed afterwards.
• Priority setting: whether urgent problems were logged as urgent, or downgraded to a slower clock.

For comparison, our P1 response, when the business has stopped, is 5 minutes, 24/7, on every package. P2 is 10 minutes and P3 is 30 minutes in support hours (Monday to Friday 9:00 to 18:00, Saturday 9:00 to 14:00); P2 and P3 run 24/7 on GR IT AMC Scale and GR Managed IT Professional, and are set in the contract on GR Managed IT Enterprise. P4 is next business day. Resolution targets are 4 hours for P1, 1 business day for P2, 3 business days for P3 and 5 business days for P4, and every miss is listed in the monthly report with the ticket, the time it took and the reason.

Which faults kept coming back?

Look for the same fault on the same device, user or system recurring through the year. A repeat ticket can mean the symptom was fixed and the cause was not.

Ask the provider which repeat incidents it found, what root-cause work it did and what it recommended. If the answer is a list of closed tickets with no analysis, that is a gap to close in the new contract. In our escalation matrix, a repeat incident is flagged on the third occurrence, a root-cause analysis is assigned, and it is reviewed in the monthly report.

What did you pay for outside the annual fee?

Add up every invoice that was not the annual fee. The total shows the real cost of the contract and what the fee did not cover.

• Onsite visits and travel.
• Parts, devices and licences bought through the provider.
• Projects, such as a new office or a migration.
• After-hours or weekend work.

Then compare the list with the contract. A joint advisory from CISA and the cyber security authorities of the UK, Australia, Canada and New Zealand says providers should give clear explanations of the services a customer is purchasing and the services it is not purchasing. If you found charges you did not expect, ask for the new contract to name them. Our packages are delivered 100% remotely, and onsite visits are booked and charged separately.

Does the scope still match your users, devices and sites?

Compare what the contract covers with what you have today. A contract written for last year's estate can leave new equipment uncovered or include equipment you have retired.

• Users: your headcount now, and what you expect over the next year.
• Devices: laptops, desktops, Macs, phones and tablets added or retired.
• Servers and network: servers, firewalls, switches, access points and NAS boxes added or switched off.
• Sites: a new office, a warehouse or staff working from home.
• Cloud services: apps and tools the provider now looks after informally.

The provider's asset register should answer most of this. If there is no register, or it is out of date, that is a finding in itself. Our packages are annual and paid in advance, with one fee per user, so the user count is the first number to confirm at renewal.

Who has admin access to your Microsoft 365 tenant?

Check it yourself before you renew. In the Microsoft 365 admin center, go to Settings, then Partner relationships, to see the partners you work with, and select a partner to see its details. Microsoft says you can remove admin roles from a partner at any time, and that removing the roles does not end the partner relationship, so a partner can keep working with you in another capacity, such as a reseller.

• Remove what you no longer need. Former providers and finished projects should not keep admin roles in your tenant.
• Prefer GDAP. Granular delegated admin privileges give a partner least-privileged, time-bound access, and Microsoft says customers must explicitly grant that access.
• Keep Global Administrators few. Microsoft advises you to limit the number of Global Administrators as much as possible, because the role has almost unlimited access to your organisation's settings and most of its data.
• Require MFA on provider accounts. The CISA advisory says contracts should require MFA on all provider accounts used to access customer environments.

If a previous provider still controls your tenant or will not hand back access, see how we handle Microsoft 365 tenant recovery and handover.

Can the provider prove that backups restore and patches land?

Ask for evidence, not assurances. A backup job that reports success is not the same as a restore that works, and a patching policy is not the same as patched devices.

• Backups: the date of the last test restore and what was restored. The CISA #StopRansomware Guide advises organisations to regularly test the availability and integrity of backups in a disaster recovery scenario.
• Patching: a report showing which devices are up to date and which are not, with a reason for each exception.
• Incident response: a written plan for a serious incident, and the date it was last tested. The CISA advisory says customers should make sure these plans are tested at regular intervals.

Does the contract say who is responsible for what?

It should, in plain words, before you sign again. The CISA advisory recommends that provider contracts clearly identify who owns each security role and responsibility, and that they set out how and when the provider tells you about an incident affecting your environment. At renewal, ask for the targets per priority, the escalation path, the contents of the monthly report, who owns your accounts and documentation, and the exit terms, all in writing.

Our escalation matrix sets this out by priority. For a P1, the service manager is notified within 30 minutes, a director is briefed within 1 hour, and the managing director is briefed within 2 hours if the ticket is still open. Reporting starts with a monthly ticket and SLA report on GR IT AMC Start, adds a quarterly review call on GR IT AMC Grow, and adds a monthly review call with a roadmap on GR IT AMC Scale.

What happens if you decide not to renew?

Give notice in writing, inside the period your contract sets, and plan the handover before the last day. The handover should cover documentation, admin credentials, licence and vendor portal logins, and the asset register, all moved to accounts your organisation controls.

Then close the doors behind the old provider. The CISA advisory says customers should disable provider accounts that are no longer managing their systems, and notes that this can be overlooked when a contract ends. Remove the old partner's admin roles in the Microsoft 365 admin center as well.

Our terms for leaving are the same at any point in the year. Give us at least 30 days' written notice and you receive a handover pack: documentation, credentials and the asset register. The fee is not refunded if you leave early. Our guide to switching IT AMC provider in Dubai covers the handover checklist and what to collect before you give notice.

What should be on your IT AMC renewal checklist?

• The end date, the notice period and whether the contract renews automatically.
• The year's ticket report by priority, with every missed target and its reason.
• Repeat incidents and the root-cause work done on each one.
• Every charge outside the annual fee, compared with the contract.
• An up-to-date asset register that matches your users, devices and sites.
• Partner admin roles in Microsoft 365, cut back to what is still needed.
• Evidence of tested restores, patch status and a tested incident plan.
• Written terms for responsibilities, escalation, reporting, renewal and exit.

If you would like to compare your current terms with ours, contact us with your user count and the scope you have today.