RMM vs PSA vs endpoint management: which tool does what

RMM manages machines and PSA manages work: an RMM monitors, patches and repairs devices, while a PSA handles tickets, time, contracts and billing. Endpoint management tools such as Intune cover the device layer again, but from the policy side. Ask three vendors where RMM ends and PSA begins and you will get three different maps, yet the underlying jobs are simple. There are exactly three: devices, tickets, and the business layer. This piece maps each category onto those jobs, shows where products blur the lines, and ends with a decision guide.

The map: devices, tickets, and money

Strip away the acronyms and every tool in this space does one or more of three things:

• Devices. Knowing the state of every machine you are responsible for, patching it, securing it, reaching it remotely and fixing it. This is the RMM job.
• Tickets. Capturing what your users ask for, routing it to the right person, tracking it against an SLA and closing it with a record. This is the front half of the PSA job.
• The business layer. Time tracking, contracts, billing, client records and reporting. Turning the work into invoices and the invoices into a business you can read. This is the back half of the PSA job, and it is the half internal IT teams mostly do not need.

Everything else, however it is branded, is one of these three jobs or a bundle of them. Hold that map and the rest of the article is just detail.

RMM: the device layer, in one sentence

Remote monitoring and management is agent software on every machine reporting back to a console, plus the ability to act on what it reports: run scripts, deploy patches, open a remote session, alert when a disk fills or a backup fails. We have written a fuller plain-English breakdown in what is RMM, but the one-sentence version is this: an RMM is how a small team looks after a large fleet without visiting it.

Note what is absent from that sentence. Nothing about clients, contracts or invoices. An RMM does not care whether the machines belong to your clients or to your own company. That is why internal IT teams buy RMMs just as MSPs do, and why the category is not MSP-only despite its heritage.

RMM vs PSA: the invoice test

A PSA, professional services automation, is the system of record for the work rather than the machines. Tickets, time entries, contracts, billing rules, client accounts. If the RMM answers "what state is this device in", the PSA answers "what did we do, for whom, how long did it take, and what does it cost". The full anatomy is in what is a PSA, explained.

The invoice test: if a piece of data could plausibly end up on a client invoice, it belongs in the PSA. Time spent, tickets closed, devices under contract, projects delivered. If the data describes the state of a machine, it belongs in the RMM. Disk space, patch level, last reboot, antivirus status. Most confusion about the two categories dissolves the moment you apply this test.

Endpoint management: the category that keeps renaming itself

Endpoint management, and its enterprise cousins UEM and MDM, is best understood as the device layer again, approached from a different direction. Where RMM grew up around monitoring and remote repair, endpoint management grew up around configuration and control: enrolment, compliance policies, app deployment, conditional access. Microsoft Intune is the obvious example.

The two categories now overlap heavily. A modern RMM patches, deploys software and enforces configuration. Intune, meanwhile, has grown remote actions and reporting. The practical distinction that survives is this: endpoint management tools assume the device is corporate-enrolled and identity-joined, and they are strongest at policy. RMMs assume nothing about the estate, which is messier and more honest, and they are strongest at investigation and repair. Many MSPs run both, using the RMM as the working surface and Intune as the policy engine underneath. That is not tool sprawl. It is two genuinely different strengths on the same layer.

Where modern products blur the lines

Almost nobody sells a pure RMM or a pure PSA any more. RMM vendors bolt on ticketing. PSA vendors bolt on monitoring. Combined platforms sell both under one roof, with wildly varying depth on each side. The result is a market where the category label on the box tells you less than it used to, and where you should evaluate the three jobs separately even when buying one product. A combined platform with a superb RMM and a ticketing module that amounts to a shared inbox with states is not an RMM and a PSA. It is an RMM wearing a PSA's name badge.

The honest question for any combined product is which side was built first and which was bolted on, because the bolted-on side is usually where the gaps live. We have set out what a genuinely unified product should include in all-in-one PSA and RMM software, and the short version is: full ticketing with SLAs, time tracking that flows to billing, and device management deep enough that you never open a second console to run a script.

A decision guide for common situations

• Internal IT team, no client billing. You need the device layer and the ticket layer: monitoring, patching, remote access, and a proper helpdesk with SLAs. You do not need contracts, rate cards or invoicing. Buy an RMM with credible built-in ticketing, or an RMM plus a lightweight helpdesk. Do not pay for a full PSA whose billing engine you will never open.
• One-person MSP or side business. Start with the RMM. Tickets at this scale can survive in a simple queue for a while; unmonitored client machines cannot. Add the business layer the month invoicing by memory first embarrasses you, which is sooner than you think.
• MSP with two or more technicians. You need all three jobs, and the ticket layer becomes the priority, because the moment two people share a queue, ownership, SLAs and time capture stop being optional. A combined platform saves you the integration tax of syncing devices, tickets and time between two vendors.
• MSP already on Intune-heavy Microsoft estates. Keep Intune as the policy engine. You still need the RMM for monitoring, scripting and repair, and the PSA for everything the invoice test catches.
• Co-managed arrangements. The internal team lives in the device and ticket layers; the MSP additionally needs the business layer. A shared queue with separate billing visibility is the shape that works.

The failure modes, side by side

Buying wrong looks different in each direction. An RMM with no ticket layer produces excellent machines and invisible work: things get fixed and nobody can say what, for whom, or how long it took. A PSA with no RMM produces beautifully documented ignorance: every ticket logged, timed and invoiced, and no idea a disk has been at 97 per cent for a month. Endpoint management alone produces compliant devices and abandoned users, because policy engines do not answer the phone. The order of severity for most teams: fix the device layer first, the ticket layer immediately after, and the business layer as soon as anyone bills anyone.

Where this fits with Helios

Helios is one platform covering all three jobs: monitoring, patching, remote access and scripting on the device layer, a full service desk with SLAs and time tracking on the ticket layer, and contracts and client billing on the business layer, with every feature on every plan so internal teams are not forced to pay for billing they will not use. The map above is vendor-neutral and holds whatever you buy. Flat monthly pricing is published openly, there is a 14-day trial and no feature tiers. Start free.

Related: MSP client portal software: what clients actually use and what they ignore, RMM for internal IT teams: what changes when you are not an MSP, Remote access software for MSPs: is a separate remote tool still worth paying for?

Researched and written with Helio SEO, our AI writer for business blogs.