MSP ARR

In the world of managed services, your valuation isn't built on one-off hardware sales or emergency break-fix calls. It is built on MSP ARR—Annual Recurring Revenue. This single metric represents the predictable, contractual income that allows an MSP to hire with confidence, invest in better tools, and eventually command a high multiple during an exit.

For many MSP owners, the transition from "busy technical shop" to "high-value recurring revenue engine" is the hardest jump to make. It requires a shift from selling labour by the hour to selling outcomes and managed outcomes by the month. Understanding how to track, grow, and protect your MSP ARR is the difference between owning a job and owning a scalable business.

MSP ARR is the total value of your contracted, recurring service revenue normalised over a single year. It excludes one-time project fees, hardware margins, and variable expenses. It focuses strictly on the "peace of mind" services—such as managed security, cloud hosting, and helpdesk support—that your clients pay for every single month without fail.

The Definition of MSP ARR

In its simplest form, MSP ARR is calculated by taking your Monthly Recurring Revenue (MRR) and multiplying it by 12. However, for an MSP, the definition must be stricter to be useful for valuation. It should only include services that are governed by a long-term contract (usually 12 to 36 months).

• Included: Managed IT support fees, SOC-as-a-Service, backup and disaster recovery subscriptions, and per-user security bundles.
• Excluded: Laptop sales, one-time office moves, emergency hourly billing, and cabling projects.
• The Grey Area: Software licenses (like Microsoft 365) are often included but should be tracked separately because they carry much lower margins than your own managed services.

When Luis Navarro co-founded Totality Services, the focus was never just on "more sales." The focus was on building a highly profitable MSP serving over 150 clients by ensuring that every new contract added to the long-term stability of the business. That journey, which led to a successful eight-figure acquisition, was paved with a relentless focus on the quality of recurring revenue.

Why MSP ARR is the Most Important Metric You Track

If you were to sell your MSP tomorrow, an acquirer would look at your EBITDA (earnings before interest, taxes, depreciation, and amortization), but they would apply a multiple based on the reliability of your revenue. A business with $2M in annual revenue that is 90% recurring is worth significantly more than a $4M business that is 90% project-based.

Building the Foundation for Recurring Growth

To grow your MSP ARR, you have to stop thinking like a technician and start thinking like a business partner. Clients don't want to buy "vulnerability scanning" or "patch management." They want to buy a reduced risk of downtime and a guarantee that their data is safe. When you shift the conversation toward risk management, the recurring fee becomes a logical business expense rather than a technical luxury.

This is where many MSPs struggle. They present a list of technical features instead of a commercial roadmap. Luis Navarro spent 15 years bridging this gap—taking complicated cybersecurity issues and explaining them in a way that was simple and commercially meaningful. He wasn't the "technical guy," and that allowed him to see that clients pay for confidence, not just configurations.

1. Standardising Your Service Tiers

You cannot grow ARR efficiently if your team is supporting 50 different versions of a "security stack." Standardisation is the secret to high-margin recurring revenue. By limiting your offering to one or two well-defined tiers, you reduce the "technical debt" of your support team and make your sales process repeatable.

A standard stack might include:

Endpoint Protection (EDR/MDR) Identity and Access Management (MFA) Cloud Backup and Recovery Regular Security Reviews and Risk Assessments Unlimited Remote Support

When every client is on the same stack, your cost of delivery stays flat as your ARR grows. This is the definition of scaling.

2. Moving Beyond "The Seat Price"

The "per-user" model is the industry standard for MSP ARR, but it shouldn't be a race to the bottom. If you are charging $100 per user while your competitor charges $150, the difference isn't usually the quality of the helpdesk—it’s the inclusion of high-value security services.

To increase your average revenue per user (ARPU), you must integrate advanced security into your base offering. Don't make "security" an optional add-on that the client can decline. Make it the core of your service. If a client refuses the security components, they are likely a high-risk client that will eventually cost you more in support time and reputation than their monthly fee is worth.

The Role of Security Reviews in Driving ARR

One of the most effective ways to grow MSP ARR with existing clients is through the Security Review process. Many MSPs treat these as a "check-the-box" activity or a technical audit. In reality, a Security Review is a commercial opportunity to demonstrate value and identify gaps that require new recurring services.

A well-executed review does three things:

Demonstrates Value: It shows the client what you have been doing behind the scenes to keep them safe. Creates Accountability: It documents risks that the client has chosen to accept or mitigate. Identifies Upsell: It naturally leads to recommendations for new layers of security that increase the monthly contract value.

If you aren't conducting these reviews, you are leaving recurring revenue on the table. Clients are often willing to pay more for security, but they need to understand the why before they sign the what.

Strategic Upselling: Turning Projects into ARR

MSPs often fall into the trap of selling security as a one-time project. You might charge $5,000 to set up a new firewall or implement MFA. While that project revenue is nice, it doesn't contribute to the long-term valuation of your business in the same way MSP ARR does.

Instead of a one-time setup fee, consider how to bake the management, monitoring, and licensing of that technology into a recurring service. For example:

Instead of: Selling a firewall for $2,000. Try: Firewall-as-a-Service for $200/month, including hardware refreshes, monitoring, and configuration updates.

This approach not only increases your ARR but also ensures the client’s technology never becomes obsolete, strengthening the long-term relationship.

Measuring Success: Churn, Expansion, and Acquisition

To master your MSP ARR, you need to look at three specific levers. Most owners focus entirely on acquisition, but the most profitable growth often comes from the other two.

Churn (The ARR Killer)

Churn is the percentage of recurring revenue you lose each month. If you add $5,000 in new MRR but lose $4,000 due to clients leaving, your net growth is stagnant. High churn is usually a symptom of poor communication or a lack of perceived value. This is why regular communication—not just when something is broken—is vital for protecting your ARR.

Expansion Revenue

This is when an existing client pays you more. Perhaps they hired five new employees, or they upgraded to your "Premium Security" tier. Expansion revenue is incredibly high-margin because the cost of acquiring that revenue is nearly zero. You already have the relationship and the contract in place.

New Logo Acquisition

This is the traditional sales route. While essential, it is also the most expensive way to grow ARR. A healthy MSP balances new client acquisition with a strong focus on expansion and retention. This ensures that the "leaky bucket" isn't undermining your sales efforts.

Common Pitfalls in Managing MSP ARR

In his 15 years of building Totality Services, Luis Navarro saw firsthand where MSPs lose their way. It’s rarely a technical failure; it’s almost always a commercial one.

1. Fear of Increasing Prices

Many MSPs haven't raised their prices in years, fearing they will lose clients. In a high-inflation environment where tool costs and technician salaries are rising, failing to increase your recurring fees is effectively taking a pay cut. If you provide genuine value and communicate it clearly through Security Reviews, most clients will accept reasonable price adjustments.

2. Lack of Contractual Clarity

If your recurring revenue isn't tied to a written, enforceable contract, it’s not truly ARR—it’s just "likely revenue." Acquirers will discount revenue that isn't under contract. Ensure your agreements have clear terms, auto-renewal clauses, and defined scopes of work.

3. Over-servicing "C" Clients

Not all ARR is good ARR. If you have a client paying a small monthly fee but demanding 20 hours of support a month, they are eroding your profitability. Part of growing a high-value MSP is having the courage to offboard clients that no longer fit your model, freeing up your team to support high-value, high-margin accounts.

How to Talk to Clients About Recurring Costs

The "commercial bridge" is about moving the conversation away from the price of the tool and toward the cost of the problem. If a client balks at a $500/month increase for advanced threat hunting, don't explain the intricacies of the AI-driven SOC. Explain what happens to their business if they are offline for three days due to ransomware.

Use simple, direct language:

"This service isn't just a backup; it's a guarantee that we can have your staff working again in two hours instead of two days." "We are recommending this security layer because it addresses a specific gap in your current defences that could lead to a data breach." "Our goal is to move you from being reactive to being protected, which ultimately costs less than fixing a major crisis."

The MSP Agenda Approach to ARR We built MSP Agenda because we saw a gap in how MSPs manage their client relationships and security recommendations. Most tools focus on the "what"—the technical vulnerabilities. We focus on the "why" and the "what's next."

By standardising how you conduct reviews and present recommendations, you create a repeatable process for growing your MSP ARR. You stop being a "vendor" and start being a "strategic partner." When a client sees a clear roadmap of risks and recommendations, they are far more likely to approve the projects and recurring services that keep them safe and make your business more valuable.

The Long-Term Goal: The Eight-Figure Exit

Building a highly profitable MSP with operations across different regions, like Luis did with Totality Services, requires a foundation of solid, high-margin MSP ARR. When it comes time to exit, buyers are looking for a machine that works without the owner. They are looking for standardised processes, a loyal client base, and a predictable stream of recurring revenue.

Every decision you make today regarding your service tiers, your pricing, and your client reviews should be made with that eventual exit in mind. Even if you never plan to sell, a business that is "ready to be sold" is a much better business to own and operate.