What an IT AMC in Dubai should actually include, and how to compare one

What an IT AMC is, in plain terms

AMC stands for annual maintenance contract. In the Dubai market the term is used for an ongoing IT support agreement: you pay a fixed fee, usually monthly or quarterly, and in return a provider keeps a defined set of computers, servers, network equipment and cloud accounts working, and fixes things when they break. It is the office IT equivalent of a service contract on a lift or an air-conditioning system.

The important word is defined. An AMC is not an open promise to solve any technology problem that ever arises. It covers a named list of users, devices and systems, to an agreed standard, within agreed response times. Everything outside that list is either excluded or billed separately. A contract that pretends to cover everything is either overpriced to absorb the risk, or it will argue with you the first time something expensive breaks.

This guide is written for the person who has to choose between two or three of these contracts and wants to compare them honestly. It explains what each part of an AMC means, which parts actually protect you, and the questions that separate a real support agreement from a cheap one that looks similar on the quote. If you want the figure first, our IT support cost guide explains what moves the monthly price before you speak to anyone.

Listonics sells managed support, so treat this as a view from inside the trade rather than a neutral referee. The test we would apply to our own managed IT support is the same one set out below, and if a rival contract passes it on the points that matter, it is a fair contract.

A last framing point before the detail. An AMC is insurance that you also use every week. The weekly use is the helpdesk and the small fixes. The insurance is the promise that when something serious happens, a known team responds within a known time. Judge a contract on both, because a provider strong on daily helpdesk but weak on the serious day, or the reverse, leaves a gap you will eventually fall into.

Response times are the part that actually protects you

The single most important thing in an AMC is what happens when something is down and your office cannot work. That is what you are really buying. Yet it is the part most often left vague, reduced to a line that says the provider will respond quickly or offer support during business hours. Quickly is not a commitment. It cannot be measured, so it cannot be broken, so it protects nobody.

A real agreement states response times by severity. Severity means how badly the problem hurts the business, not how technically hard it is to fix. A whole office with no internet is critical. One laptop with a slow email client is low. Each severity level should carry two numbers: how fast someone acknowledges the problem and starts work, and when an engineer is physically on site if the issue needs hands on equipment.

Ask what the clock is measured against and when it runs. A fifteen minute acknowledgement during Sunday to Thursday office hours is a different promise from fifteen minutes around the clock. Neither is wrong, but you should know which you are buying, because an outage at eight in the evening before a deadline is exactly when the difference is felt. Our emergency IT support page explains how an out-of-hours critical call should actually run.

Finally, ask what happens when the target is missed. A response time with no consequence is a hope, not a term. Mature contracts record performance against the targets and report it to you, so a pattern of slipping is visible rather than something you only sense. You do not need penalty clauses for a small office, but you do need the numbers written down and measured.

What is covered, and what is quietly left out

Every AMC has a boundary, and the exclusions tell you more than the inclusions. Read the excluded list first. The common and legitimate exclusions are projects, new equipment, major software upgrades, cabling works, and anything caused by a third party outside the provider's control, such as an internet line failure or a cloud vendor outage. These are reasonable. A monthly maintenance fee cannot absorb a structured cabling job or a fleet of new laptops, and you would not want to pay a fee large enough that it could.

What matters is that the boundary is written down, so that when a project comes up it is quoted openly rather than argued about. A provider who lists exclusions clearly is not being mean, they are being honest about what the fee buys. Treat a vague inclusion list and no exclusion list as a warning sign, because it means the argument has only been postponed to the day something costly breaks.

Check how the covered list is counted. Most AMCs are priced per user or per device, so the number has to be defined and kept current as people join and leave. Ask how a new starter is added, how a leaver is removed, and whether the fee changes mid-term when the count moves. Our managed IT services pricing guide walks through the per-user and per-device models and what each tends to suit.

Finally, be clear on where remote work ends and on-site work begins. A good contract includes both, because some faults cannot be fixed down a wire and some providers quietly cap site visits. Ask how many on-site visits are included, and what an extra one costs, so the answer exists before you need it on a bad morning.

Patching, monitoring and the work you never see

A large part of what a good AMC does is invisible, because its purpose is to stop problems rather than react to them. The two pieces of invisible work worth asking about are patching and monitoring. Patching means keeping operating systems and software up to date so that known security holes are closed. Monitoring means watching the equipment and the accounts so that a failing disk or a suspicious sign-in is caught before it becomes an outage.

Ask specifically whether security updates are applied on a schedule and whether that includes the servers and network equipment, not only the laptops. Unpatched firewalls and switches are a common way offices get compromised, because they are easy to forget. The principle behind this is not a vendor opinion. The CIS Critical Security Controls set out continuous vulnerability management and controlled configuration as basic hygiene, and a serious provider will be working to something like that baseline.

Monitoring is only useful if someone acts on it. An alert that lands in an unwatched inbox is theatre. Ask what is monitored, who sees the alerts, and what the provider does when one fires at night. The honest answer for a small office may be that overnight alerts are triaged the next morning unless you pay for round-the-clock cover, and that is fine as long as you know it.

If identity and email run on Microsoft 365, ask how sign-in security is handled, because that is where most real attacks now land. Multi-factor authentication should be on for every account, and Microsoft's own guidance treats multi-factor authentication as a baseline rather than an upgrade. A provider who has left it off across a tenant is not maintaining the thing they are charging you to maintain.

Backup is in the contract, but is it tested

Almost every AMC mentions backup. Far fewer test it. A backup that has never been restored is an assumption, and the day you discover it did not work is always the worst possible day. When you compare contracts, the question is not whether backup is included but how often a restore is actually performed to prove the backup is real.

Ask three things: what is backed up, how far back you can go, and when a test restore was last done. The answers should be specific. For a Microsoft 365 office, note that Microsoft operates the service on a shared responsibility basis and recommends a dedicated backup for your own content, which is why Microsoft itself now offers a backup product for 365 data. The platform keeps the lights on, but recovering a mailbox a manager deleted two months ago is your problem unless something covers it.

For servers and storage on site, ask how the backup is protected from ransomware, because modern attacks try to destroy backups first. A copy that sits on the same network with the same passwords is not a safe copy. The principle of keeping an offline or otherwise isolated copy is central to government ransomware guidance such as the US CISA StopRansomware guide, which is readable and vendor-neutral.

If backup matters to you, and for most offices it is the single thing that would end the business if it failed, consider whether it belongs in the AMC at all or as a dedicated service with its own testing schedule. Our business backup services page sets out what a tested, documented backup regime looks like, separate from day-to-day support.

Who actually turns up, and can you reach them

An AMC is a relationship, not a document, and the relationship is with the people who answer when you call. Ask who those people are. Are the engineers employed by the provider or subcontracted to whoever is free that week? Continuity matters, because an engineer who knows your office fixes faults faster than a stranger reading notes for the first time.

Ask how you raise a problem and how you know it was received. A phone number and a person is worth more to a small office than a ticket portal nobody logs into, though a portal is useful for tracking longer jobs. The point is that there is a defined route and a defined acknowledgement, so a request never falls into a gap. Test it before you sign if you can, by sending a question and seeing how the reply reads.

Language, location and working rhythm matter in Dubai specifically. An engineer who can be on site in your tower within a reasonable time, who understands that building management controls riser access and out-of-hours work, and who can deal with that paperwork, saves you a day of frustration on every job that touches the building fabric. Local knowledge is a real part of the service, not a soft extra.

If you are weighing providers in general rather than just contracts, our guide on how to choose an IT support company covers the questions that reveal how a firm really works, beyond what any quote says.

One more practical test: ask what happens when your usual engineer is on leave. A one-person provider is a single point of failure, and the day they are unreachable is the day something breaks. A small team with shared documentation covers for each other, which is one of the quiet advantages of a provider over an individual freelancer, even when the freelancer is excellent.

Ownership, exit and lock-in

The best time to check how you leave a provider is before you join one. A support contract gives the provider deep access to your systems: administrator passwords, the cloud tenant, the firewall, the backups. If leaving means losing all of that, you are not really a customer, you are a hostage, and the quality of service tends to drift once a provider knows you cannot move.

Ask plainly who owns the administrator accounts and the documentation. The answer should be that you do. The provider holds the keys to do the work, but the office owns its own tenant, its own domain name, its own equipment and its own records. On exit, you should get the passwords, the network documentation and the backup access handed back in an orderly way, within a defined period.

This is not a sign of distrust, it is how any professional arrangement should work, and a confident provider will put it in writing without being pushed. A provider who becomes evasive when you ask about exit is telling you something useful at the only time it is cheap to learn it. An IT audit by an independent party is one way to document exactly what you own before a handover, if a relationship is ending badly.

Read the term and the notice period too. A rolling monthly or annual term with a reasonable notice period is normal. A long lock-in with a large exit cost should be justified by something real, such as hardware the provider financed on your behalf, and if there is no such reason, treat the lock-in as a cost rather than a detail.

The security baseline a contract should already assume

A maintenance contract signed in Dubai today is also, whether it says so or not, a security contract. The offices that get hurt are rarely the targets of anything sophisticated. They are the ones where the basics were never done: no multi-factor authentication, old unpatched equipment, a single administrator account shared by three people, and a backup nobody tested. A good AMC closes those gaps as a matter of routine, not as a chargeable extra you have to think to ask for.

There is a widely used, vendor-neutral way to describe that baseline, and it is worth naming in a contract conversation so both sides mean the same thing. The US NIST Cybersecurity Framework organises security into identify, protect, detect, respond and recover, and it maps cleanly onto what a support provider actually does day to day. You do not need to implement it formally, but a provider who has never heard of it is working from instinct alone.

For a Microsoft-based office, much of the baseline is built into the platform and only needs turning on and maintaining. Microsoft packages the small-business security controls, including device protection and identity rules, into Microsoft 365 Business Premium, and a competent provider will either have you on that or have a reason not to. Ask which security features are enabled in your tenant today, and if the honest answer is that nobody has looked, that is the finding.

None of this should read as a separate security upsell bolted onto the AMC. The point is that maintaining an office in the current threat environment includes these controls, and a contract priced as if the year were 2010 is cheap because it is leaving the work undone. If security is a live concern, our cybersecurity service explains what a proper baseline covers.

Where Dubai's own rules touch the contract

Two local realities shape an AMC in Dubai in ways a generic template will miss. The first is the building. Most offices sit in towers where the owners' association or building management controls the risers, the rooftop and out-of-hours access. Work that touches cabling, internet lines or satellite equipment needs their approval and often a method statement, and the lead time on that paperwork, not the engineering, is usually what sets a date. A local provider builds this into how they plan work. Ask how they handle building approvals, because a firm that has never dealt with a Dubai owners' association will learn on your time.

The second is data and licensing. Where your systems and data physically sit, and who can see them, increasingly matters to regulated tenants and to anyone handling customer records. The UAE has a national framework for data protection, summarised on the government portal's data protection pages, and free zones such as DIFC and ADGM run their own regimes on top. You do not need your support provider to be a lawyer, but you do need them to know where your email and files are hosted and to configure the tenant in line with whatever your zone requires.

This matters most for law firms, clinics, financial advisers and anyone in a regulated free zone, where a casual approach to where data lives can become a compliance problem rather than just an IT one. If that describes you, the questions worth asking a provider are less about speed and more about control: who has access, where it is stored, and how that is documented.

The practical upshot is that a Dubai AMC is partly a local-knowledge service. The engineering is the same anywhere. Knowing how to get a method statement approved in a Business Bay tower, or how a DIFC firm's tenant should be set up, is specific, and it is a fair thing to weigh when the quotes are otherwise close.

A fair way to compare two contracts side by side

Once you understand the parts, comparing two AMCs becomes a matter of lining up the same points rather than the same prices. Put the two quotes next to each other and, for each, write down the same facts in the same order. If one contract leaves a box blank, that blank is the finding.

The comparison that actually matters is not which fee is lower but which promises are real. A contract that is slightly more expensive but names its response times, tests its backups, lists its exclusions and hands back your passwords on exit is cheaper in every way that counts than one that saves a little each month and argues with you the first time something serious breaks.

Pricing itself should be a fixed, predictable figure, not a number that balloons with surprise charges. Projects outside the AMC are fair to bill separately, but they should be quoted in advance as a fixed scope. Across Listonics work, projects run from AED 2,500 to AED 30,000 depending on requirement, and ongoing support is a flat monthly fee, so the two are never confused on an invoice.

When you have compared the substance, the decision is usually clear, and it is rarely the cheapest quote. If you want to talk through a specific contract you have been offered, our IT AMC page explains how our own agreement is structured, and you are welcome to hold it up against anyone else's.

Frequently asked questions

Written by Srinivasan Ramachandran, Founder, Listonics · Published Oct 14, 2026 · Last reviewed October 14, 2026 · 3,514 words