RMM for internal IT teams: what changes when you are not an MSP

RMM software is built for MSPs and sold to them, which leaves the head of IT at a single organisation reading datasheets written for somebody else. Choosing an RMM for an internal IT team means translating: working out which features exist because MSPs bill forty clients, and which exist because machines break and auditors ask questions. The two lists overlap less than the marketing suggests. This piece sorts them, then turns the result into requirements you can hand to procurement.

The MSP features you can safely ignore

A large share of any RMM and PSA stack exists to run a services business. If you are not invoicing anyone, most of it is dead weight in the trial and noise in the menus.

• Multi-tenant client hierarchy. MSP platforms organise everything by client. You have one organisation, so you will use sites or departments instead. Check the tool lets you group by location or business unit without pretending each is a customer.
• Client billing and contract management. Retainers, block hours and invoice runs matter enormously to an MSP and not at all to you, unless you recharge IT costs internally. Even then a spreadsheet export usually suffices.
• Branded client portals. White-labelling is for MSPs protecting their brand. Your users need a simple way to raise and follow tickets, nothing more. Our piece on what clients actually use in a portal applies to internal users too: they ignore most of it.
• Quoting and sales pipelines. Skip entirely.

Time tracking is the borderline case. You do not bill it, but it is the only honest way to show the board where your team's week goes. Keep it if it is light.

What matters more in-house than it does at an MSP

An MSP answers to clients. You answer to auditors, insurers, the board and occasionally a regulator. That shifts the weight from speed to evidence.

Patching evidence, not just patching

Installing updates is table stakes. What an internal team needs is proof: which devices were compliant on a given date, which failed, and why. Cyber Essentials, cyber insurance questionnaires and ISO 27001 audits all ask this in different words. We cover mapping the controls in detail in evidencing Cyber Essentials with your RMM.

Third-party applications are where evidence usually collapses. Windows Update will not touch Chrome, Zoom or Adobe Reader, and those are precisely what an assessor finds out of date.

The date test: ask the vendor to produce a patch compliance report for a date three weeks ago. If the tool only shows current state, it cannot evidence anything. Skip this and you will be screenshotting dashboards the night before an audit.

Asset visibility you can trust

An MSP inherits an asset list with each contract. You are the asset list. Hardware inventory, warranty dates, installed software and last-seen timestamps are the backbone of every refresh budget and every licence true-up. The requirement is not a pretty inventory page; it is that the data is fresh, exportable and covers devices that rarely touch the office.

A ticket trail an auditor can read

Internal teams often run the helpdesk from a shared mailbox and a good memory. That works until someone asks who approved an admin rights request last March. A ticketing system tied to the device record gives you an audit trail for free: request, approval, action, closure. If you share the queue with an outside provider for specialist work, see how to share a ticket queue with an MSP.

Microsoft 365 oversight

For most organisations, identity is the estate. MFA status, licence assignment, mailbox forwarding rules and admin role membership belong in the same view as the endpoints, because incidents cross both.

Pricing built for MSPs, translated for one organisation

MSP pricing models assume endpoint counts grow as the MSP signs clients, so per-device billing tracks revenue. You have no revenue from endpoints. Every device is pure cost, which changes the arithmetic.

Per-technician pricing is a quiet trap for internal teams. You may have three engineers but want your first-line desk, a security lead and a finance colleague viewing reports. Seat-based pricing makes that expensive, so people end up sharing logins, which is the opposite of what the auditor wanted. Our explainer on flat rate RMM pricing works through when each model wins.

Add-ons matter more than the headline. Patching third-party apps, remote access, backup monitoring and M365 management are frequently separate SKUs. Price the whole requirement, not the base licence.

Sizing guidance for a 100 to 500 endpoint estate

Estates in this band are usually run by one to five people, and the tooling should reflect that rather than enterprise ambition.

• 100 to 200 endpoints. Typically one or two IT staff. Prioritise automation over configurability: you do not have time to build policy trees. Automated patching with approval rings, alerting that does not wake you for disk at 81 per cent, and a helpdesk your users will actually use.
• 200 to 350 endpoints. Often a split between first-line and a senior engineer. Role-based access becomes essential, as does scripting so one fix runs everywhere. Multiple sites start to matter.
• 350 to 500 endpoints. Reporting and change control dominate. Expect to need patch rings by department, scheduled compliance reports for management and a clean way to onboard and offboard staff at volume.

Do the arithmetic yourself: multiply the per-endpoint rate by your count plus roughly ten per cent headroom for refresh overlap, add every add-on you need, and compare the annual figure against flat tiers. Our RMM pricing in pounds at 100, 250 and 500 endpoints gives market reference points.

A requirements list you can copy

1. Historical patch compliance reporting, including third-party applications, exportable by date.
2. Hardware and software inventory with last-seen dates and warranty data, exportable to CSV.
3. Ticketing linked to device records, with approvals and a permanent history.
4. Microsoft 365 visibility: MFA, licences, admin roles, forwarding rules.
5. Role-based access with read-only roles that do not cost a full seat.
6. Remote access included, logged per session.
7. Transparent total price for your endpoint count, with no annual lock-in required.

Failure modes: how in-house RMM choices go wrong

Buying the MSP platform with the best reputation often means paying for a PSA built around billing you will never use. Buying the cheapest monitoring tool often means patching evidence lives in a second product and tickets in a third, which is tool sprawl wearing a thrift costume. The middle path is a single platform whose MSP features you can switch off without losing the evidence trail.

Where this fits with Helios

Helios is built for MSPs and internal IT teams alike, and every feature is on every plan, so you are not upselling yourself into audit-grade reporting. Patching including third-party apps, asset inventory, M365 management, remote access and ticketing sit in one product, and Helio, the AI agent, triages tickets and investigates device issues so a small team stretches further. Pricing is flat and published, with no annual lock-in; see the pricing page for where a 100 to 500 endpoint estate lands. Honestly, much of this list is discipline, not tooling: no platform will write your change process for you.