What an IT AMC in Dubai should actually include

An annual maintenance contract is the most common way UAE businesses buy IT support, and the least standardised. Two quotes for "AMC — 25 users" can differ by a factor of three, and the cheap one is not always the worse deal. You cannot tell from the number, because the number is not the product. The scope is the product.

This is the checklist we would use if we were the ones buying.

1. What exactly is covered — by name

A contract that says "IT support for 25 users" is not a scope. Ask for it in inventory terms: how many workstations, how many servers, how many network devices, how many mobile devices, which cloud tenants. Support is priced off the count of things that can break, not the count of people.

Watch specifically for whether your servers and firewall are inside or outside the number. They are the two items most often quietly excluded, and the two whose failure costs you the most.

2. Response targets, by priority, in writing

"We respond quickly" is not a service level. A real SLA defines priority levels and attaches a target to each — typically P1 for business-down through to P4 for a routine request — and states whether the target is a response time or a resolution time. Those are very different promises and the distinction is frequently blurred.

Then ask the question that actually matters: what happens when the target is missed? A target with no consequence attached is marketing. Service credits are the normal answer.

3. Remote versus on-site, and how many visits

Most issues resolve faster remotely, so a remote-first contract is a sign of competence rather than corner-cutting. But you need the on-site terms: are visits included or billed, is there a monthly cap, what is the target for an engineer physically arriving, and does that change for Jebel Ali versus Deira?

If on-site visits are "as required", establish who decides what is required.

4. Coverage hours, and what out-of-hours costs

Standard cover is usually Sunday to Thursday business hours. If your business trades on Saturday, or your finance team closes the month at 11pm, that is the gap that will hurt. Get the out-of-hours rate into the contract rather than discovering it on an invoice.

5. The exclusions list

This is the most informative part of any AMC and the part nobody reads. Reasonable exclusions are project work, hardware costs, third-party software licences, cabling and structured works, and anything caused by a third party you engaged directly.

What you are checking for is whether routine work has been pushed into the exclusions so it can be billed later — user onboarding and offboarding, for instance, or password resets, or new device setup. Those are day-to-day support, not projects.

6. Patching and updates — proactive or not

Ask directly: do you patch our systems on a schedule, or do you fix things when we report them? A break-fix arrangement dressed as a maintenance contract is the most common mis-sell in this market. Maintenance implies somebody is doing something while nothing is wrong.

7. Backup — and specifically, restore testing

Almost every AMC claims backup is included. Very few include a tested restore. A backup you have never restored from is a hypothesis, not a safety net. The contract should state how often a restore is tested and that you receive evidence of the result.

This applies to Microsoft 365 too. Microsoft replicates your data; it does not keep an independent backup of it for you beyond its retention windows. That is a widespread and expensive misunderstanding.

8. Monthly reporting

You should receive, without asking: tickets raised and closed, SLA attainment against each priority, patch compliance, backup and restore-test status, and any recurring issue that ought to be fixed permanently rather than repeatedly. If reporting is only available on request, it will not happen.

9. Who owns your credentials and documentation

Your domain, your Microsoft 365 tenant, your firewall admin account and your network documentation must be in your name, with the provider holding delegated access. This is the single most important clause in the contract and the one most likely to be wrong.

If a provider holds your tenant in their own account, you are not a client, you are a hostage. Ask what an exit looks like before you sign. A confident provider has a clean answer ready.

10. Named engineers and escalation

Ask who will actually attend, whether you get a named primary engineer, and what happens when they are on leave. Then ask for the escalation path by name and role, not by a generic support address.

11. Term, notice and price review

Twelve months is standard. Check the notice period, whether it auto-renews, and whether the provider can raise the price mid-term. Also check whether you can add users mid-term at the same per-user rate — growing companies get caught here.

12. What happens on day one

A provider who starts taking tickets without first documenting your environment is guessing. Onboarding should include an audit of what you have, a documented network and tenant baseline, and a short list of what they found that needs fixing. If nobody has looked, nobody can maintain.

AMC or managed services?

An AMC covers support when something needs fixing. Managed IT services adds proactive monitoring, scheduled patching, backup verification and roadmap planning, so fewer things need fixing in the first place. The price difference is usually smaller than the downtime difference, but an AMC is a perfectly sensible starting point for a business with a stable, simple environment.

The test is roughly this: if your IT is quiet and predictable, an AMC is proportionate. If you are growing, handling sensitive data, or have been surprised more than twice this year, you have outgrown it.