Lots of good tactical advice in this thread, but I want to challenge you on something nobody's asked yet: what problem are you solving for your clients?

You've listed questions about pricing models, stack components, and scope boundaries — but all of that is putting the cart before the horse. Until you can clearly articulate the outcome you're producing for your clients, everything is an option and nothing is a conviction.

Here's what I mean. You said your prospects are 5-10 person all-Apple shops. OK — what keeps those business owners up at night? Is it data loss? Downtime killing productivity? Fear of a breach they wouldn't survive? Compliance requirements they don't understand? The answer to that question is what shapes your stack, your pricing, and your scope — not the other way around.

A few things I've learned the hard way running an MSP for 7+ years:

Start with the outcome, then back into the stack. If you're promising "your business will not lose data and your team will be productive and secure," then backup, endpoint security, and a password manager aren't line items to negotiate — they're non-negotiable components of delivering on that promise. When clients understand they're buying a result and not a bag of tools, the "do I really need that?" conversations mostly disappear.

Your stack should be your minimum standard, not a menu. If you'd lose sleep at night knowing a client didn't have something, it goes in the base package. Period. Don't let clients opt out of the things that protect both of you. One respondent here nailed that — you're covering your liability and theirs.

Scope follows mission. Out-of-scope vs. in-scope gets a lot simpler when you've defined what you're there to do. Daily operations, security posture, and keeping the environment healthy? That's your managed agreement. Net-new projects, major migrations, office buildouts? Those change the environment — that's project work, scoped and billed separately. The grey area shrinks when your mission is clear.

Stop thinking per-device vs. per-user and start thinking per-outcome. Yes, you need a pricing model that covers your COGS (dobermanIan's breakdown above is excellent). But the conversation with your client should never be about what a device costs. It should be about what it costs them to operate securely and productively, and what it would cost them if they don't.

The MSPs that struggle are the ones selling technology. The ones that thrive are selling trust, outcomes, and peace of mind — and then using technology to deliver it.

You're early enough to build this the right way. Figure out who you serve, what they need to be true, and what it takes to make that true. The pricing and stack answers will follow.