The invoice arrives at the end of the month. €3,200. There's a list of line items below the total — "Managed Services Tier 2," "EDR Licence Q3," "Remote Support – 4.5h @€120," "Firewall Maintenance," "Onboarding New User – Project Work." You approve it because it's roughly what you expected, and because querying every line would take longer than the meeting you need to get to.

This is how most SMBs interact with their IT invoices. The total feels plausible, the line items are opaque, and nobody has the time or expertise to challenge them. The result is that IT costs drift upward — not through dishonesty, but through the natural stickiness of unchallenged recurring charges.

This article gives you the vocabulary and the framework to read any IT provider invoice clearly — and to know immediately whether each charge is justified or worth questioning.

The Two Models: Hourly vs. Flat Rate

Before we go through the line items, the single most important thing to understand about any IT invoice is the underlying billing model. Almost everything else follows from it.

Hourly billing (Break/Fix): You pay for time spent. When something breaks, the provider comes, fixes it, and bills the hours. When nothing breaks, you pay nothing — or a small retainer. This model appears cheap when things are working. The problem is structural: the provider's revenue depends on problems occurring and taking time to fix. There is no financial incentive to prevent issues, update systems proactively, or invest in documentation that makes support faster.

Flat-rate Managed Services: You pay a fixed monthly amount per user or device regardless of how many support requests occur. The provider's incentive is inverted — every problem prevented is time and cost saved on their side. This drives proactive maintenance, automatic patch management, and genuine investment in keeping systems stable.

Around 70% of SMBs come from an hourly billing model and are frustrated by its unpredictability. The invoice swings between €800 and €6,000 per month depending on how often the Exchange server, firewall, or old printer acts up.

If your invoice has hourly line items for standard support tasks, you're on a break/fix model — and the variability is a feature of the model, not an anomaly.

The Five Core Categories on Any IT Invoice

1. The base management fee

This is the central recurring charge — the foundation of the monthly invoice. In a flat-rate model, it covers ongoing monitoring, helpdesk access, patch management, and standard support within the agreed scope. In a per-user model, this multiplies by headcount.

What it should cover at minimum:

• 24/7 system monitoring
• Helpdesk with defined SLA response times
• Automatic software updates and patch management
• Standard support requests (password resets, software issues, configuration questions)
• Remote support for common problems

What to check: Does the base fee cover onboarding new employees? Many contracts exclude this and bill it separately as "project work" (see category 5). If your headcount is growing, this distinction matters significantly.

Market reference: For a 30-person SMB in Germany, a comprehensive flat-rate Managed IT fee runs between €2,500–€4,500/month — or €80–€150 per user per month. A fee significantly below this range almost certainly has significant exclusions.

2. Software licences

This is where invoices become confusing because the line items can be legitimate pass-throughs, inflated reseller margins, or genuinely necessary upgrades — and they look identical on paper.

Common legitimate licence items:

• Microsoft 365 Business or Google Workspace per-user fees
• Endpoint security/antivirus licensing (e.g. SentinelOne, WithSecure)
• Backup software licensing
• MDM platform licensing
• Specific SaaS tools managed by the provider

What to verify: Are these licences in your name and associated with your billing information? They should be. Licences that only exist in the provider's account are a vendor lock-in risk — if you switch providers, you lose the licences. Ask for a complete licence list with associated accounts at least annually.

Hidden risk: Software licences for employees who have left. Without automated offboarding, licences assigned to departed employees continue to appear on invoices months or years after the person has left. A proper software licence audit typically finds 20–30% of licences are unused.

3. Security services

Security has become the most common source of invoice expansion in 2026. It's also the area where scope creep is most easily justified — because everything related to security sounds necessary.

Legitimate security line items:

• Endpoint Detection and Response (EDR) — active threat detection on all managed devices
• Backup — including off-site copy and recovery testing
• DNS filtering — blocking malicious domains at network level
• Email security — spam filtering, phishing detection, attachment scanning

Charges worth questioning:

• "Security assessment" as a recurring monthly line item (a genuine assessment is a one-time project, not a monthly charge)
• Separate billing for patch management if you're already paying a management fee (patching should be included)
• "Security monitoring" without a defined SLA for response — monitoring that doesn't trigger a response when something is detected has limited value

Adding a security operations centre, advanced threat detection, and incident response can cost €50–€150 per user per month on top of the base fee. Before adding security add-ons, clarify exactly what each covers and what happens when a threat is detected.

4. Hardware

Hardware costs on a managed IT invoice fall into three subcategories, and they're handled differently.

Hardware procurement: Laptops, phones, accessories purchased through the provider. This is a legitimate pass-through — though it's worth checking whether you're paying a markup over market price. A 10–15% margin for procurement and logistics is standard; anything higher is worth negotiating.

Hardware included in the service fee: Some providers bundle device management and basic hardware refreshes into the monthly fee. This simplifies budgeting but usually means a longer contract commitment.

Hardware maintenance and repair: Emergency repairs, component replacements, and on-site hardware visits. These are almost always billed separately, often at hourly rates. They should be clearly defined in your contract as either included or billed at a specified rate.

What to confirm: Who owns the hardware? If the provider is billing a monthly "device fee" that includes the hardware, do you own the device at the end of the contract, or does it revert to the provider?

5. Project and out-of-scope work

This is the category responsible for most invoice surprises. Hidden and out-of-scope costs can add 30–50% to the actual managed IT bill. Onboarding fees, projects, hardware, and anything outside the contract are billed separately.

Common items that appear here:

• New employee onboarding (device setup, account creation, software installation)
• Office moves or infrastructure changes
• After-hours or weekend support
• On-site visits (if not included in the base fee)
• Major software upgrades or migrations
• Custom configuration or scripting

The legitimate vs. the questionable: Some project billing is entirely reasonable — a network infrastructure upgrade or a cloud migration genuinely requires project-level effort and should be scoped and priced separately. But standard tasks like onboarding a new employee should not be project-billed if your contract covers "user management" in the base fee.

The key question: Before any work begins that might be billed as a project, ask for a written estimate. A professional provider gives you a scope and price before doing the work, not a bill after.

The Most Common Hidden Charges

These are the line items that appear quietly, are rarely questioned, and frequently don't deliver clear value:

How to Read an Invoice Before Approving It

Most invoice approval decisions happen in under two minutes. Here's a more useful approach that takes about five:

Step 1 — Check the user count. If you pay per user, does the count match your actual headcount? Providers don't always automatically remove departed employees. Cross-reference against your offboarding records.

Step 2 — Identify any new line items. Compare this month's invoice to last month. New items should have been communicated in advance. If they weren't, ask for an explanation before approving.

Step 3 — Check project and out-of-scope charges. Were these pre-approved? Did you receive a written estimate before the work was done? If not, this is worth challenging.

Step 4 — Verify licence counts. Software licences should match the number of active users. Any licence assigned to someone who has left the company is waste that accumulates if unchecked.

Step 5 — Compare to your contract. Keep a copy of your SLA and contract scope. When a new charge appears, the first question is always: is this covered in the base fee or not?

What Transparent IT Pricing Looks Like

At deeploi, the invoice is one line: a flat monthly rate per active user. That rate covers:

• Full MDM device management for all enrolled devices
• Automatic patch management every 24 hours
• Endpoint protection via SentinelOne integration
• Unlimited IT support with 12-minute average response time
• Automated onboarding and offboarding triggered by HR system
• Licence management and offboarding reharvesting
• ISO 27001 certified infrastructure, GDPR compliant, EU-hosted

New employees are not billed as project work. After-hours support is not surcharged. Standard tasks don't become billable incidents.

The invoice has one number. You know what it covers.

Book a demo and see what transparent IT pricing looks like for your company size

Conclusion

An IT invoice is a window into how your provider thinks about their relationship with you. A bill full of opaque line items, variable charges, and unclear project surcharges signals a model where uncertainty benefits the provider. A single transparent monthly rate signals a model where preventing problems benefits everyone.

The framework in this article gives you the vocabulary to ask better questions — before you sign a contract and every time an invoice arrives. The most important question is still the simplest one: what exactly is not included in my monthly fee?

See what's included in deeploi's flat monthly rate

Frequently asked questions

What is a fair price for managed IT services for a 30-person SMB in Germany?

‍For a comprehensive flat-rate service covering helpdesk, device management, security, and patching, expect €80–€150 per user per month in 2026 — €2,400–€4,500/month for 30 users. Significantly lower quotes almost always have significant exclusions. Ask specifically what is not covered before comparing headline numbers.

Should onboarding new employees cost extra?

‍In a well-structured flat-rate contract, standard employee onboarding — device setup, account creation, software installation — should be included. If your provider bills this as "project work," it's either a scope limitation in your contract or a charge worth negotiating out. With deeploi, onboarding is part of the platform and triggers automatically via HR system integration.

How do I know if I'm being charged for licences I don't need?

‍Request a complete licence list from your provider annually, showing every software licence, the associated account, and the assigned user. Cross-reference against your current employee list. Any licence assigned to someone who has left is waste. A software licence audit typically finds 20–30% of licences are unused in companies without automated offboarding.

What should I do if a charge appears on my invoice that I didn't pre-approve?

‍Request the written estimate or work order that authorised the charge. Any project work should have been scoped and approved before the work began. If no written approval exists, you're within your rights to dispute the charge or request a credit. Professional providers welcome this clarity; it separates good partners from ones who rely on invoice opacity.

Why is deeploi's pricing simpler than most IT providers?

‍Because the platform automates the tasks that traditional IT providers bill hourly — onboarding, patching, licence management, offboarding. When these processes run automatically, there's no basis for billing them as time-and-materials work. The flat rate reflects the platform's efficiency, not a lower level of service.