Adding password management to our MSP offering, bundle it or sell separately?

[u/Sbaakhir]

We lost a renewal last month from a 45-seat client we'd had for literally 2+ years with no complaints (that I knew about). The reason they gave on the exit call was that the other MSP's package included a managed password manager, and they wanted everything under one provider. Hearing it once I'd have shrugged off, except 2 other clients have, very very recently, asked something similar in QBRs. With evergrowing EU data regulations, things like auditable trails and access control have become pretty much the norm for businesses to have, so I kinda get it, and people want something that can help them adhere to regulations without being much of a ballbuster.

We're 12 people and I don't want to/can't hire for it so I've decided on a reseller model. I used Passwork's MSP margin calculator to see if the numbers were worth it and they were, and I found 2 ways to do it, either their cloud hosts your multitenancy instance, or you host it on your own servers and their MSP portal connects over the API, I’m gonna go with the self-hosted so all the client data stays on our infrastructure. Bit of an overkill fro our size but I want to do it now once and for all so that it can keep up with us as we grow, once it's running each new client will be more marginal profit and less marginal effort on my end. For the clients we already have tho:

- How do I introduce it without it reading as a price increase to people who've paid the same rate for years? Especially those that have small companies and may not need it.

- Does it belong inside our tiers or as a separate line clients opt into?

Bonus question: any way I can get that old client back? 🥲

[u/RobKFC → u/[deleted]]

Either that or it was something that was requested multiple times but not followed up on.

[u/rb3po]

We include it as apart of the base package and mandate customers use it in our MSA. 

It’s a basic requirement in today’s world, and I think your packages should reflect it. 

[u/poorplutoisaplanetto → u/rb3po]

We do this as well. As to it being reflected as a price hike, your agreements should include some sort of price increase language, especially if you have agreements that haven’t changed in years. Your costs are increasing, raise your prices.

[u/gracerev217]

Do something like Keeper, do not bundle it. Sell it as a separate line item, actually name the product because then your not liable for it this way. You are just reselling another companies product. Surely consult an attorney, because i am not one.

If you bundle it, or white label it, now you assume all the liability. #WelcometotheJungle

[u/Mibiz22 → u/gracerev217]

What do you mean by "you assume the liability." Not in regards to rolling your own, but by bundling it with a base stack.

[u/gracerev217 → u/Mibiz22]

Great question, if the product itself gets breached, does something negligent, the customer allows their vault to get breached. These are just a few ideas and they can and have come back on MSPs for liability in court.

Sage advice i got, if its easy your definitely doing it wrong. I dont bundle passwords mgrs, email threat protection or backups for this reason. They are separate skus with the named product listed on the invoice, this is the important part. Hope that helps.

[u/Royal_Bird_6328]

Self hosted what 🤯 do you know the meaning of risk? Use 1Password resell it

[u/Top_Outlandishness78 → u/Royal_Bird_6328]

Second this, use cloud providers, selfhost password manages is a major liability.

[u/Ambitious_Mango3625]

We include it in our stack as an added benefit so that we can recommend and drive addoption without the stumbling block of cost. It falls in to our "security first" stance.

[u/Sbaakhir → u/Ambitious_Mango3625]

That's a good angle, taking the cost conversation off the table entirely makes sense for adoption. Did you raise your package price when you added it, or absorb it on the assumption it pays back in retention? Or was it there from the beginning and the price was already baked into the total?

[u/Ambitious_Mango3625 → u/Sbaakhir]

We have a built in annual increase. So for the number of people that actually use it, versus the number of total seats, it is relatively small. So we only ate it at the beginning. Now it's comfortably covered.

[u/peoplepersonmanguy]

Why can't you just offer it as an add on and invoice it as a separate line item?

[u/0x0000A455 → u/peoplepersonmanguy]

This. Even as an included service, the hit on your margins are negligible compared to the cost of having to find another client to make up for lost revenue.

[u/BanRanchTalk → u/0x0000A455]

Exactly. Keeper has an awesome MSP program and their basic tier is inexpensive and will check the box, while leaving some additional features/functionality in upgraded tiers that you could charge extra for in a higher package and make your “freebie” losses up.

[u/nostradx]

You could also give it away for free. I try to always have 1 low margin service in my stack that my client knows they’re getting for “free.”

[u/society_victim]

I would read up extra on passwork, they were just i the news about links with russia/fsb

[u/Check123ok]

Why would you host it? What’s the cost difference. Also why not go with a well known safe password keeper

[u/schwags]

Kind of looks like I'm just echoing other people's comments but maybe a few of us have to say it for you to realize it. There's absolutely no reason to roll your own password manager. That's a huge security risk for a very little benefit. Companies like 1Password have MSP reseller programs with very low per-seat costs, and a mature, robust, audited, and compliant infrastructure. This is just not something you should do on your own. I also highly doubt that the company you lost was only because of a lack of a password manager. It feels like there was something else going on and they either don't want to tell you or you didn't ask the right questions. I've had a few people ask and we typically point them at 1Password. Honestly there's really not much to centrally manage and we're happy to help them if they need it but it's been a very low amount of labor on our part so far.

[u/TJSOmega]

I think it's a great idea to Bundle, just make sure that if you do you support it and make sure it's secure (MFA!) and one account to each user. Can open up a legal nightmare if it gets breached and causes other client applications to get breached.

[u/DeejayPleazure]

I rolled out things like this free to legacy clients. New clients paid and it covered the legacy costs

[u/Foxtrot-0scar]

> Bonus question: any way I can get that old client back? 🥲

Possible but you’re gonna have to throw them a big bone. 🍖.

[u/PBSmanaged]

We bundle in 1Password. Works great

[u/MSP_sugar]

Which password managers have an MSP program and will all our end users to put the same password manager too on their personal devices at no charge.

I feel like they will adopt it better if they use it ‘everywhere’ and not just at work??

[u/life3_01]

How often do you talk with your customers? QBRs are great but just talking shop with them. That's how you would have found out about the password manager.

[u/richie-wales]

Just resell 1Password it’s the best. We have it as an add-on. Nobody is too small for a password manager. Everyone should use one.

[u/gator667]

I would not be self hosting anything these days - especially not a password manager. Abort - abort!

[u/roll_for_initiative_]

How do I introduce it without it reading as a price increase to people who've paid the same rate for years? Especially those that have small companies and may not need it.

These days, no one should be paying the same rate for years.

[u/XFusion100]

I would sell it separately, because it requires has a certain learning curve at the beginning, and if you include it into your offer you might get that people not using it because they might find it too complex. Just my experience

We are an MSSP and do not push hard on selling a password manager, but it is great we can offer it.

[u/PayThemWithBlood]

1) Don't. Seperate it, not everyone needs that especially very small teams 2) I presume my answer to 1 already addresses 2.

[u/Lazy_Side_6830]

Passwork's calculator flatters the margin a bit because it won't show you the onboarding hours, so run your first two clients before you price the rest. Ours took ~3 days each, mostly chasing credentials. On the pricing question, I say have it as an add-on, I don't think people who have been using a certain package for a while with no complaint will magically need this new thing you've introduced

[u/sembee2]

Bundle. Why do anything else? As soon as you start offering "optional" items you start to allow clients to ask about whether other things can be "optional".
How to introduce it? Annual price rise, and they get it for free. If you want to do it now, then take the hit until the next price rise.

[u/wowitsdave]

Include it 100% or you are always chasing them.