MSP · Support
L1 vs L2 vs L3 Support: What Each Tier Does, When to Escalate, and What It Should Cost
July 4, 2026 · 7 min read · DigiMason Team
"We need another tech" is rarely the real problem. The real problem is usually that the wrong tier is doing the work — senior engineers resetting passwords while complex incidents wait. Getting the tiers right is the cheapest capacity upgrade there is.
What each tier actually does
| Tier | Owns | Typical tickets | Target resolution |
|---|---|---|---|
| L1 — First response | Intake, triage, known fixes | Password resets, account lockouts, printer/peripheral issues, how-to questions, ticket routing | 60–70% of all tickets, often on first touch |
| L2 — Technical resolution | Diagnosis beyond the runbook | Recurring errors, network/VPN issues, server and M365/Google Workspace problems, software conflicts | 25–30% of tickets |
| L3 — Engineering | Root cause, architecture, vendors | Infrastructure design, escalated incidents, automation, security events, vendor escalations | 5–10% of tickets |
The escalation rules that keep tiers honest
- Time-boxed L1. If a documented fix doesn't resolve it in 15–20 minutes, escalate with notes. L1 heroics are how SLAs die.
- Escalate with evidence. A ticket moves up with symptoms, steps tried, and environment details — or it comes back down.
- Close the loop downward. Every L2/L3 fix that could recur becomes an L1 runbook entry. That's how your 60% first-touch rate becomes 70%.
What tiered support should cost
In-house US numbers are unforgiving: a fully-loaded L1 runs $55–70K/year; L2 $75–95K; L3 easily $110K+. For a 24/7 desk, multiply by shift coverage. This is exactly where outsourced seats change the math:
| Seat | Outsourced monthly (dedicated) | Vs. fully-loaded US cost |
|---|---|---|
| L1 Support Engineer | From $1,500 | ~60–70% lower |
| L2 Support Engineer | $2,200–3,200 | ~55–65% lower |
| L3 Support Engineer | $3,500–6,000 | ~45–60% lower |
| NOC/SOC coverage | Quoted by shift plan | Varies |
Figures are typical ranges, not quotes — final rates depend on stack, shift coverage, and term. Savings estimates compare against US fully-loaded salaries.
Staffing ratios that actually work
For MSPs, a workable starting shape is 3–4 L1 : 1–2 L2 : on-demand L3 per ~1,000 tickets/week, adjusted for after-hours coverage. Two common failure modes: all-L1 desks that escalate everything to the owner, and all-senior desks where $60/hour engineers do $15/hour work.
Outsourcing tiers without losing quality
- Start with L1 volume. It's the highest-volume, best-documented tier — fastest to hand off, fastest to prove.
- Demand PSA-native techs. Seats should arrive trained on ConnectWise, Autotask, NinjaOne, Datto — not learning them on your dime.
- Keep escalation authority in-house at first. Add outsourced L2 once the L1 layer is boring and predictable.
- Measure the same things. First-touch resolution, CSAT, reopen rate — same dashboards for internal and outsourced seats.
FAQ
What's the difference between L1 and L2 support?
L1 resolves known issues using documented fixes and routes everything else; L2 diagnoses problems that have no runbook yet. If it needs investigation, it's L2.
Can L1 support be outsourced safely?
Yes — it's the most commonly outsourced tier because the work is documented and measurable. The risk isn't the tier; it's providers with no training layer or QA. Ask how techs are vetted, who reviews tickets, and what backfill looks like.
How many tickets can one L1 handle?
A trained, dedicated L1 typically handles 20–40 tickets/day depending on mix. DigiMason's desk runs up to 1,000 tickets/week and scales with seats.
Staff your tiers without the hiring cycle
L1 seats from $1,500/month, trained on your PSA and runbooks, with QA and backfill included. Tell us your queue.