What an IT AMC actually is — and what it isn't
AMC — annual maintenance contract — is the term most UAE businesses use for what the rest of the world calls managed IT. The vocabulary comes from the region's facilities-management tradition, and it carries an assumption worth challenging: that maintenance means somebody turns up periodically and checks things still work.
A serious IT AMC is not a visit schedule. It is a transfer of responsibility — your provider owns the state of your IT, and site visits are one delivery mechanism among several rather than the product itself.
That distinction is commercial, not philosophical. A contract priced around visits rewards a provider for turning up and finding little to do; a contract priced around outcomes rewards them for there being nothing to turn up for. Read any AMC proposal with one question in mind: what is this provider paid to achieve, rather than paid to attend?
- Unlimited remote support — no per-ticket charges and no meter running while a user explains the problem.
- Proactive monitoring — servers, network hardware, endpoints and the Microsoft 365 tenant watched continuously, with alerts going to the provider rather than to you.
- Patch and update management — operating systems, firmware and third-party applications on an agreed schedule, not whenever a technician remembers.
- Backup ownership and restore testing — someone accountable both for the fact that the backup ran and for the fact that it restores. A retention policy is not a restore capability.
- Asset and licence records — a live inventory of every device, its warranty date, and every subscription you are paying for.
- User lifecycle and escalation — joiners, movers and leavers handled as routine rather than as an emergency — and a documented list of who gets called, in what order, out of hours.
If a proposal is thin on those and thick on visit frequency, it is a maintenance contract in the older sense of the word.
Compare our AMC tiers on the homepage →
What to check in the contract before you sign
Most disagreements between a business and its IT provider are scope disagreements, and they surface at the worst possible moment — mid-incident, with everyone under pressure. The exclusions clause tells you more about an annual maintenance contract than the inclusions list does. Read it first.
- Response versus resolution — an SLA promising a one-hour response, silent on what happens next, is a promise to answer the phone. Ask what the provider commits to after first contact, and how it differs by priority.
- The exclusions — hardware replacement, software and cloud licences, structured cabling, CCTV and anything classed as "project work" usually sit outside AMC. That is reasonable. Discovering it during an outage is not.
- What counts as a project — an office move, a server replacement, a migration. Agree the boundary in writing, with an indicative rate, before the question arises.
- After-hours, holidays and travel — whether cover extends across evenings, weekends, Ramadan hours and Eid, and what the onsite response window is per site — travel to Jebel Ali, Sharjah or Abu Dhabi is real time, and deserves a real number.
- Ownership of your data — credentials, network diagrams, asset registers and monitoring history should be yours, exportable, on the day the contract ends. A provider who resists this is quietly describing the cost of ever leaving them.
- Notice and renewal — automatic renewal paired with a long notice window is the most common reason businesses stay with a provider they have outgrown.
- VAT — services in the UAE carry 5% VAT. Make sure competing quotes are being compared on the same inclusive or exclusive basis.
Still weighing AMC against full managed IT? The plain-English comparison →
Our three AMC tiers, and how businesses land in them
We run three tiers. Sizing is by headcount and complexity together, not headcount alone — thirty staff with an on-premise file server, a firewall, a CCTV system and a warehouse is a materially different job from thirty staff who live entirely inside Microsoft 365.
- Essential — best for 5–15 employees — one site visit per month, remote support in business hours, Microsoft 365 tenant administration, endpoint patching, an annual security review, and customer portal plus knowledge base access.
- Professional — best for 15–50 employees — two site visits per week, 24/7 remote support with a one-hour critical SLA, Microsoft 365 with Defender for Business, Veeam backup with verified restore tests, a quarterly security and posture review, asset inventory and lifecycle planning, priority queue and a dedicated engineer.
- Enterprise — best for 50+ employees — five site visits per week or a resident engineer, a dedicated account manager, Microsoft 365 E3/E5 administration, compliance and audit support with vCIO time, a 30-minute critical SLA on a 24/7 basis, monthly executive review, and custom SLA terms where you need them.
Every tier includes the customer portal, so ticket history, SLA performance and your asset register are things you can look at rather than things we report. Tier moves happen at renewal — we would rather move a client up when the business has genuinely grown than sell the largest tier on day one.
How IT AMC pricing works in Dubai
Three pricing models are in common use across the UAE market. Per-user pricing is clearest for businesses whose work lives in Microsoft 365 and whose device count tracks headcount. Per-device pricing suits environments with a lot of unattended hardware — point-of-sale terminals, cameras, kiosks, servers — where users are a poor proxy for workload. A flat annual fee suits stable estates where neither number moves much, and it is the model most often described as a classic AMC.
What actually moves the number: user and device counts, number of sites, how much still runs on-premise, whether you need genuine after-hours cover, and — often underestimated — the condition of the environment at handover. An undocumented network that has "evolved" for six years costs more to take on in year one, because someone has to do the archaeology before they can do the maintenance.
Be careful with the cheapest quote. An unusually low AMC price almost always means visits are the product and everything substantive is chargeable on top. Two questions expose it quickly: what proportion of a comparable client's work fell outside contract last year, and what does an out-of-scope hour cost?
We quote after looking at the estate, not from a headcount over the phone. If you would rather start with something smaller and fixed-scope, our Cyber Posture Assessment is published at AED 7,500 — two weeks, and a written report of where you actually stand.
See what the Cyber Posture Assessment covers →
The first 90 days of an AMC
Onboarding is where an annual maintenance contract is won or lost. A provider who starts answering tickets on day one without doing the groundwork is guessing for the rest of the term. Our sequence, roughly:
- Weeks 1–2 — discovery — every device, server, switch, firewall, licence, subscription and domain recorded. Administrative credentials collected and moved into managed storage, so nobody is emailing passwords six months from now.
- Weeks 2–4 — instrumentation — patch policies set, and backup jobs verified by performing an actual restore rather than trusting a green tick.
- Weeks 3–6 — the obvious remediation — MFA gaps, unsupported operating systems, expired warranties, firewall firmware years behind. Most estates we inherit have several of these, and they are cheap to close early.
- Weeks 6–12 — documentation and rhythm — network diagram, runbooks, escalation list, then the first quarterly review with a costed plan for the year ahead.
By the end you should be able to hand a new IT manager a folder and have them understand your environment in an afternoon. That is also the test of whether a provider is building an asset for you or a dependency on them.