IT support for recruitment agencies is judged on a single question that no other sector asks in quite the same way: can a consultant reach the right candidate, from the right record, before a competitor does, and can the pay run still go out on Friday if everything else is on fire. Speed and payroll are the two things a recruitment business cannot lose, so IT support for recruitment is measured against both, and almost every technology decision below traces back to one of them.
This guide is written for UK recruitment and staffing businesses of roughly 10 to 250 people — perm, temp, contract, executive search and RPO — and for the finance directors and operations managers who own the technology budget. It covers what IT support for recruitment agencies actually has to deliver: the CRM and applicant tracking stack, Microsoft 365 licensing that reflects a split between fee earners and back office, email deliverability treated as a revenue system rather than a mail setting, identity control for a workforce that churns, and the statutory clocks that the software has to carry.
Every legal and published figure below was read off source on 22 August 2026: the Conduct of Employment Agencies and Employment Businesses Regulations 2003 and the Agency Workers Regulations 2010 on legislation.gov.uk, HMRC’s umbrella company guidance and policy costing, the REC’s Recruitment Industry Status Report, the DSIT Cyber Security Breaches Survey 2025/26, Microsoft’s published UK price list and Exchange Online service limits, and NCSC’s Cyber Essentials scheme. Where a number is modelled rather than read off a page it is labelled modelled and the working is shown.
The worked example throughout is a 60-person UK recruitment agency — 42 consultants across perm and temp desks, 18 in finance, payroll, compliance and marketing, with around 450 contractors on assignment at any time. Sector guides for neighbouring industries sit alongside this one: IT support for accountancy firms and IT support for construction companies answer the same questions for different estates. What we deliver day to day sits on our managed IT services page.
Table of contents
- Why IT Support for Recruitment Agencies Is Its Own Discipline
- The Recruitment CRM and ATS: What IT Support for Recruitment Has to Own
- Microsoft 365 Licensing for a Recruitment Agency, Costed
- Email Deliverability Is a Revenue System in IT Support for Recruitment
- Identity, Access and the Consultant Who Leaves With the Database
- What Cybersecurity Means Inside IT Support for Recruitment
- Payroll and Pay-Run Continuity for Temporary Desks
- The Compliance Clocks IT Support for Recruitment Has to Carry
- Candidate Data, Retention and the Right to Be Forgotten
- AI Screening, CV Parsing and the DUAA Line
- Right to Work, Umbrella Chains and Supply-Chain Evidence
- Devices, Telephony and the Hybrid Recruitment Desk
- Backup, Recovery and What the CRM Vendor Does Not Do
- What IT Support for Recruitment Agencies Should Cost and Cover
- A Buyer’s Scorecard for IT Support for Recruitment
- Frequently Asked Questions About IT Support for Recruitment
- References and Further Reading
Why IT Support for Recruitment Agencies Is Its Own Discipline
Most providers design for a business with one system of record, one office and a predictable working week. A staffing business has three systems of record, a workforce that is mostly not employed by it, and a weekly deadline that cannot move, and IT support for recruitment has to hold all three at once. That is why generic IT support for recruitment agencies so often arrives competent and still wrong.
IT support for recruitment starts at the desk, not the server
A consultant’s productive day is measured in conversations. Every second of latency between a name coming to mind and that name appearing on screen is billable time lost. IT support for recruitment has to treat CRM responsiveness, search speed and click-to-dial as production systems, not as line-of-business applications that someone else supports.
IT support for recruitment covers three systems of record
A recruitment business runs a CRM for clients, an ATS for candidates — usually the same product wearing two hats — and a pay-and-bill engine for timesheets, invoices and payroll. Add a job-board aggregator, a background-checking service and an accounting package and the integration map is the estate. IT support for recruitment agencies that ignores the middle office ends up supporting the least important third of the business.
The people IT support for recruitment protects are not on the payroll
Four hundred and fifty contractors on assignment means 450 identities that need right-to-work evidence, timesheet access and payment details, and almost none of them are employees. Joiner-mover-leaver processes built for staff do not describe this population at all, which is one reason IT support for recruitment needs a separate identity model for workers.
The sector’s own numbers set the scale
The REC’s Recruitment Industry Status Report 2024/25 puts the UK recruitment industry’s contribution at £40.6 billion of gross value added in 2024 — 1.6% of the UK’s total — with temporary and contract placements accounting for 76.7% of that GVA and around 872,000 temporary or contract workers on assignment on any given day. HMRC’s own umbrella company costing counts approximately 30,000 agencies engaging temporary workers, which is the market IT support for recruitment agencies serves.
Cash flow makes downtime unusually expensive
The same REC report records that 35% of recruitment firms experienced bad debt in the past year, against 29% across sectors. In a business already carrying contractor wages before the client pays, a pay-and-bill outage is not an inconvenience; it converts directly into a funding problem. Good IT support for recruitment agencies is priced against that, not against a headcount, which is why generic managed IT services packages rarely fit a staffing business without adjustment.
The Recruitment CRM and ATS: What IT Support for Recruitment Has to Own
The CRM is the business. Every other system can be replaced over a weekend; the database of relationships cannot. Yet in most agencies the CRM is bought by the sales director, configured by the vendor and then left outside the scope of IT support for recruitment altogether, with nobody holding the integration, the exports or the exit. That gap is the first thing IT support for recruitment agencies should close.
CRM, ATS and middle office are three jobs for IT support for recruitment
Bullhorn, Vincere, JobAdder, Access Recruitment and Dynamics-based products such as Mercury all straddle CRM and ATS. Pay and bill is often a separate engine, sometimes from the same vendor and sometimes not. The practical question for IT support for recruitment is which product is the master for a candidate record, which is the master for a timesheet, and what happens when they disagree.
Microsoft 365 integration is most of the work in IT support for recruitment
Email sync, calendar sync, click-to-dial, document generation and mailbox-based activity logging are where CRM projects succeed or fail. A consultant who has to copy an email into the CRM by hand will not do it, and the record decays. IT support for recruitment agencies should test sync latency, permissions scope and what happens to sync when a mailbox is put on litigation hold.
Data ownership, export and exit belong in the contract
Ask three questions before signing: can we export every field, including notes and attachments, without a professional-services charge; what format is the export; and how long after termination does read access survive. Agencies routinely discover that the answer to the third is thirty days. A clean answer to all three is one of the cheapest pieces of insurance IT support for recruitment can buy.
Single sign-on should not be an upgrade
If SAML or OIDC sign-on sits behind an enterprise tier, price the tier anyway. Without it, leaver revocation inside IT support for recruitment depends on someone remembering the CRM, and the CRM is the one system a departing consultant most wants to keep. Federated sign-on also puts Conditional Access in front of the candidate database, which is the single highest-value control on this list.
Licence hygiene is a real cost line
Per-seat CRM licences are commonly £70 to £150 per user per month, so a handful of unreclaimed seats after a leaver wave outweighs the entire Microsoft 365 bill. Reconciling CRM seats against the HR leaver list every month is a five-minute job that no vendor will do for you, and it belongs in the scope of IT support for recruitment agencies.
| Integration point | What breaks when it fails | Who owns it | Test to run quarterly |
|---|---|---|---|
| Mailbox and calendar sync | Activity history stops recording; handover becomes impossible | IT partner with CRM vendor | Send, wait, confirm the item appears on the record |
| Job board and aggregator posting | Adverts stop going live; applications stop arriving | Marketing with IT partner | Post a test advert to each board and withdraw it |
| CV parsing and enrichment | Records arrive empty; search recall collapses | CRM vendor | Parse ten varied CVs and score the field fill rate |
| Timesheet capture to pay and bill | The pay run misses; contractors are not paid | Finance with IT partner | Dry-run a pay cycle in a sandbox |
| Accounting and invoice export | Invoices are late; debtor days rise | Finance | Reconcile one week of invoices line by line |
| Single sign-on and provisioning | Leavers keep access to the database | IT partner | Disable a test account and confirm CRM lockout |
| Telephony and click-to-dial | Call volume drops; call notes stop | IT partner | Place a call from a record and check the log |
Microsoft 365 Licensing for a Recruitment Agency, Costed
Licensing is where a recruitment business quietly decides how much security it is buying, usually without framing it that way, and it is the first real test of IT support for recruitment. The Microsoft 365 Business plans are not interchangeable, and the gaps between them are security gaps. Microsoft’s published UK list prices, read on 22 August 2026, are Microsoft 365 Business Basic at £5.40, Microsoft 365 Apps for business at £9.80, Microsoft 365 Business Standard with Copilot at £18.10 and Microsoft 365 Business Premium with Copilot at £24.60 per user per month on an annual subscription, excluding VAT.
The four SKUs answer four different questions
Basic gives cloud services with no desktop apps. Apps for business gives desktop apps with no cloud management worth the name. Standard gives both. Premium adds Entra ID Plan 1, Intune, Defender for Business, Defender for Office 365 Plan 1 and Purview information protection, which is everything IT support for recruitment relies on — which is to say, everything the rest of this guide relies on.
Three licence shapes for the same 60 people
Modelled on the worked example: all 60 people on Business Premium costs 60 × £24.60 × 12 = £17,712.00 a year. Premium for the 18 back-office and leadership users with Standard for the 42 consultants costs £14,436.00, or 81.50% of the first shape. Premium for the 18 with Basic for the 42 costs £8,035.20 — 45.37%, an apparent saving of £9,676.80 or 54.63%.
The saving removes protection from the exposed 70%
The 42 consultants are 70.00% of the headcount and they are the people who open unsolicited attachments from strangers all day. Downgrading them removes Conditional Access, device compliance and Safe Attachments from precisely the population under attack. Where IT support for recruitment agencies is asked to cut licence cost, this is the wrong place, and saying so is part of the job.
Copilot changed the comparison in 2026
The Standard and Premium SKUs are now sold with Copilot bundled at the prices above, which narrows the gap between them in perceived value while leaving the security gap exactly where it was. Quote the SKU names as Microsoft prints them, because “Business Standard” and “Business Standard with Copilot” are no longer interchangeable on a purchase order.
Frontline SKUs rarely fit a recruitment desk
F-series licences suit shift workers with shared devices and no persistent desktop, a shape IT support for recruitment rarely meets. A recruitment consultant is a heavy mailbox user with a large personal file set, so frontline licensing usually costs more in workarounds than it saves. Note that Microsoft publishes F1 and F3 prices in US dollars, so they cannot be dropped into a sterling comparison without a conversion assumption.
| Licence shape (60 users) | Composition | Annual cost ex VAT | Share of all-Premium | Consultants protected by Defender and Intune |
|---|---|---|---|---|
| All Business Premium | 60 × £24.60 | £17,712.00 | 100.00% | 42 of 42 |
| Premium back office, Standard desks | 18 × £24.60 + 42 × £18.10 | £14,436.00 | 81.50% | 0 of 42 |
| Premium back office, Basic desks | 18 × £24.60 + 42 × £5.40 | £8,035.20 | 45.37% | 0 of 42 |
| Difference, all-Premium to Basic desks | Modelled | £9,676.80 | 54.63% | Loses 42 |
Email Deliverability Is a Revenue System in IT Support for Recruitment
No other sector sends as much cold, high-volume, personally addressed email as recruitment does, and no other sector suffers as much when it silently stops arriving. Deliverability is not a mail-server setting here; it is the top of the funnel, and IT support for recruitment owns it. Treating it as infrastructure is one of the clearest markers of competent IT support for recruitment agencies.
The 10,000 recipient ceiling IT support for recruitment plans around
Exchange Online applies a recipient rate limit of 10,000 recipients per day per mailbox, a recipient limit customisable up to 1,000 addresses in a single message, and a message rate limit of 30 messages per minute per user. Encrypted messages cap at about 200 recipients. Those are hard service limits, not throttles IT support for recruitment can negotiate, and CRM-driven campaigns hit them without warning.
TERRL is the tenant limit that actually bites
Microsoft’s Tenant External Recipient Rate Limit caps the whole tenant, not the mailbox, at 500 × (purchased email licences ^ 0.7) + 9,500 external recipients in a rolling 24 hours. Modelled on the worked example: 60 licences gives 60^0.7 = 17.5673, so the tenant ceiling is 18,283 external recipients a day. The 60 mailboxes could theoretically address 600,000; the tenant allows 3.05% of that.
What the tenant ceiling means per consultant
Modelled: 18,283 external recipients shared across 42 consultants is 435.33 each per day, or 304.73 if spread across all 60 users. That is generous for one-to-one outreach and nowhere near enough for a mailshot. The design conclusion is simple, and IT support for recruitment agencies should state it in writing: bulk sending leaves the mailbox and moves to a dedicated platform.
SPF, DKIM and DMARC are now entry requirements
Three of the rules IT support for recruitment now has to meet arrived from the mailbox providers themselves. Google and Yahoo’s bulk sender rules and Microsoft’s own high-volume sender requirements, in force for Outlook.com since 5 May 2025, all apply above 5,000 messages a day and all require SPF, DKIM and a DMARC policy of at least p=none with alignment. Non-compliant mail is routed to junk first and rejected later. Recruitment mail volumes cross that threshold easily.
One-click unsubscribe and the 0.3% spam rate
Bulk marketing mail must carry RFC 8058 one-click unsubscribe headers and honour them within two days, and all three providers enforce a spam-complaint threshold of 0.3%, recommending you stay under 0.1%. A recruitment database full of stale consented candidates is exactly the shape that breaches this, which makes list hygiene a deliverability control rather than a marketing preference.
Sales automation is where IT support for recruitment gets called in
The 30-messages-per-minute ceiling is per user, and CRM sequences send as the user. A consultant queueing 200 personalised messages in a sequencer will be throttled, retried and eventually flagged. IT support for recruitment has to review the sending architecture of every automation the sales team buys, before it is switched on rather than after deliverability collapses.
Identity, Access and the Consultant Who Leaves With the Database
Every recruitment leader has either lived through this or knows someone who has: a biller resigns, and within a month a competitor is calling their clients from a list that looks familiar. This is a technology control problem for IT support for recruitment long before it is a litigation problem, and it is where IT support for recruitment agencies earns its fee.
The Conditional Access baseline for IT support for recruitment
Multi-factor authentication for every user with no exclusions, a block on legacy authentication, sign-in risk policies, compliant-device requirements for access to the CRM, and named-location controls for administrative accounts. Our guide to Microsoft Conditional Access policies walks the same baseline through a professional-services firm; the policy set transfers almost unchanged.
Export controls matter more than access controls
Nobody steals a database by looking at it. They export a saved search to CSV, forward attachments to a personal mailbox, or sync a document library to a personal device. Restrict bulk export in the CRM to named roles, log every export with row counts, alert on volume, and disable personal-device sync. This is the single highest-value thing IT support for recruitment can configure.
Insider risk and data loss prevention in practice
Inside IT support for recruitment, Purview data loss prevention policies can block or warn on candidate personal data leaving by mail, and insider risk policies can raise the monitoring level for a user in a notice period. That last trigger — resignation as a risk signal — is unusually valuable in recruitment because the population at risk is known in advance rather than discovered afterwards.
Joiners, movers and leavers: the weekly cadence of IT support for recruitment
Consultant churn in this sector is high, so the leaver process cannot be a favour someone does on their last afternoon. It needs to be a scripted sequence: disable sign-in, revoke sessions and refresh tokens, convert the mailbox to shared, reassign CRM record ownership, reclaim licences, and archive the device. IT support for recruitment agencies should be able to run that inside an hour of being told.
Privileged accounts inside the CRM
CRM administrator rights are usually held by two or three people who also carry a sales target, which is a standing issue for IT support for recruitment. Separate the admin identity from the daily identity, put it behind privileged identity management with approval and time limits, and review the list quarterly. The same discipline that applies to tenant global admins applies to the system that holds every client relationship you own.
What Cybersecurity Means Inside IT Support for Recruitment
The DSIT Cyber Security Breaches Survey 2025/26, published on 30 April 2026, found 43% of UK businesses identified a breach or attack in the previous twelve months, with phishing the most common type at 38% and by far the most disruptive. Only 25% of businesses hold a formal incident response plan, 47% carry some form of cyber insurance and 5% adhere to Cyber Essentials.
Recruiters open attachments from strangers for a living
Every other sector trains staff not to open unexpected documents from unknown senders. A recruitment consultant’s job description is to do exactly that, several dozen times a day, at speed, from addresses they have never seen. No amount of awareness training reverses that job description, and IT support for recruitment has to design around it, which is why Safe Attachments detonation and Safe Links rewriting are not optional for this sector.
Business email compromise sits on the payment chain
A staffing business moves contractor wages weekly and issues client invoices continuously, so it has two payment conversations a fraudster can join. The classic attack is a change-of-bank-details email from a compromised or lookalike domain, timed to the pay run. Controls here are procedural as much as technical, and IT support for recruitment should insist on all three: callback verification on a number already held, dual approval, and no bank changes accepted by email alone.
Candidate-side fraud is a growing surface
Fake candidates with real documents, AI-assisted interview impersonation and CVs seeded with malicious macros all target the same intake process. Verification at onboarding rather than at placement, video identity checks, and treating every inbound document as untrusted until it has been through detonation are the practical answers.
Job boards, portals and reused credentials
Consultants hold logins to a dozen job boards, client vendor management systems and background-check portals, most of which sit outside single sign-on. A password manager rolled out by IT support for recruitment, with enforced generation, unique credentials per portal and MFA wherever the portal supports it, closes the reuse path that a single boardside breach otherwise opens into your CRM.
Where the national numbers land for IT support for recruitment
Modelled from the survey’s own figures: phishing at 38% is 88.37% of the 43% headline breach rate, so almost the entire problem is inbound mail. Formal incident response planning at 25% covers only 58.14% of the breached rate, and Cyber Essentials at 5% covers 11.63% of it. The controls are lagging the attack by a wide, measurable margin.
Cyber Essentials is the floor, not the ceiling
The NCSC scheme’s five technical controls — firewalls, secure configuration, security update management, user access control and malware protection — are the minimum any agency bidding for public-sector or enterprise contracts will be asked to evidence. Our guide to Cyber Essentials certification covers the assessment in detail; Cyber Essentials Plus adds independent technical testing on top.
Payroll and Pay-Run Continuity for Temporary Desks
An agency with 450 contractors on assignment is, functionally, a payroll bureau with a sales floor attached. Friday is a hard deadline that cannot be renegotiated with 450 people, so pay-run continuity is the sharpest test of IT support for recruitment, and the systems behind it deserve continuity planning of a kind most SMEs never do. This is the part of IT support for recruitment agencies that gets tested in public.
The pay cycle is a chain, and every link needs IT support for recruitment
Timesheet capture, approval by the client contact, rate and margin calculation, invoice generation, BACS submission and payslip delivery are six separate system interactions in one week. A failure at any point produces the same visible outcome. IT support for recruitment should map the chain, name the owner of each link, and rehearse the manual fallback for each.
Timesheet capture fails on the client side
Most missed timesheets are not an agency systems problem; they are a client manager who did not approve on time. Automated reminders, mobile approval, and an escalation list that reaches a second approver are cheap to build and remove most of the Friday panic. IT support for recruitment should treat client-side approval as part of the supported estate, not somebody else’s problem.
Bank detail changes need a control, not a policy
A written policy that says “verify changes by phone” is not a control. A control is a workflow that will not release a payment to a changed account until a second person has confirmed it against a number held before the change request arrived, with the confirmation logged. IT support for recruitment should build it into the pay-and-bill system rather than into a document nobody reads under deadline.
Recovery objectives should be set by the pay calendar
A recovery time objective of 24 hours is meaningless on a Thursday afternoon and generous on a Monday morning. Set objectives per system against the point in the week they matter most. IT support for recruitment agencies that quotes one blanket RTO for the whole estate has not understood the business it is quoting for.
Rehearse the pay run, not the restore
Restoring a database proves the backup works. Running a pay cycle end to end in a sandbox proves the business works. Do the second one at least annually, with finance and payroll in the room, and write down how long it actually took.
| System | Worst moment to lose it | Suggested RTO | Suggested RPO | Manual fallback |
|---|---|---|---|---|
| Pay and bill engine | Thursday afternoon | 4 hours | 15 minutes | Last week’s values, corrected next cycle |
| Timesheet portal | Wednesday to Friday | 4 hours | 1 hour | Emailed timesheet template with approval reply |
| CRM and ATS | Monday to Wednesday | 8 hours | 1 hour | Read-only export held offline |
| Microsoft 365 mail | Any time | 2 hours | Near zero | Mobile access, out-of-band contact list |
| Telephony | Monday morning | 2 hours | Not applicable | Divert to mobiles, published fallback numbers |
| Compliance document store | Onboarding day | 24 hours | 4 hours | Hold new starts until evidence is retrievable |
The Compliance Clocks IT Support for Recruitment Has to Carry
Recruitment is one of the most heavily clocked sectors in the UK economy, and almost every clock lands on a system rather than a person, which makes it work for IT support for recruitment. Any provider quoting for IT support for recruitment agencies should be able to name these deadlines and point at the system that meets each one.
Regulation 29 and the two-working-day rule
The Conduct of Employment Agencies and Employment Businesses Regulations 2003 require records showing compliance to be kept for at least one year from creation, and for work-seeker records at least one year after services were last provided. Records may be electronic, but they must be readily accessible and capable of delivery within two business days of a request. That is a retrieval requirement, and retrieval is a capability IT support for recruitment has to build.
PAYE records for three years
HMRC requires PAYE records to be kept for at least three years from the end of the tax year they relate to, covering payments to employees, deductions made and reports and payments to HMRC. Where full records are not kept, HMRC may estimate what is owed and charge a penalty of up to £3,000. For an agency running weekly payroll, three years is a very large amount of transactional data.
Subject access in one month
A data subject access request must be answered without undue delay and within one calendar month, extendable by two further months for complex or numerous requests. In a CRM with mailbox sync, a candidate’s personal data is spread across records, notes, attachments and thousands of emails. IT support for recruitment agencies should have the search tooling proven before the first request arrives, not after.
Twelve weeks under the Agency Workers Regulations
Regulation 7 of the Agency Workers Regulations 2010 gives agency workers equal treatment rights after 12 continuous calendar weeks in the same role with the same hirer, counting any week in which they work at all, with breaks of up to six weeks generally preserving continuity. The clock is per worker, per role, per hirer — an arithmetic problem the pay-and-bill system has to own.
Fourteen weeks and eight weeks on transfer fees
Regulation 10 restricts transfer fees charged to hirers, requiring the hirer be offered an extended period of hire as an alternative, and making the charge unenforceable after the later of 8 weeks from the last day the worker supplied services or 14 weeks from the first day of supply, discounting any gap over 42 days. Systems that cannot compute those dates cannot invoice safely.
The clocks IT support for recruitment must put on one scale
Modelled against the longest of them: subject access at 30 days is 2.74% of the three-year PAYE period, the 12-week agency worker qualifying period is 7.67%, the 14-week transfer window is 8.95% and the one-year Conduct Regulations minimum is 33.33%. IT support for recruitment needs a retention design that satisfies all five simultaneously, which means retention rules per data class, not per folder.
| Obligation | Source | Period | System that must satisfy it |
|---|---|---|---|
| Work-seeker and hirer records | Conduct Regulations 2003, reg 29 | 1 year after last service, retrievable in 2 business days | CRM plus document store with search |
| PAYE and payroll records | HMRC employer guidance | 3 years from end of tax year | Pay and bill engine, backed up immutably |
| Subject access request | UK GDPR | 1 month, extendable by 2 | eDiscovery across mail, CRM and files |
| Agency worker equal treatment | AWR 2010, reg 7 | 12 continuous calendar weeks | Assignment tracking in pay and bill |
| Transfer fee enforceability | Conduct Regulations 2003, reg 10 | Later of 8 weeks from last supply or 14 from first | Placement history with date arithmetic |
| Right to work evidence | Home Office employer guidance | Held for the engagement plus 2 years | Compliance document store with expiry alerts |
Candidate Data, Retention and the Right to Be Forgotten
A recruitment CRM is one of the largest concentrations of personal data an SME will ever operate, assembled largely from people who never became customers. That asymmetry — enormous data holdings, minimal commercial relationship — is what makes retention the sharpest data protection question in the sector, and a standing duty for IT support for recruitment.
IT support for recruitment has to make retention rules actually run
A policy that says candidate records are deleted after two years of inactivity is worth nothing unless something executes it. Retention labels in Microsoft Purview, scheduled CRM purge jobs and documented exceptions for records under a statutory clock are the mechanism. IT support for recruitment agencies should be able to show the last run log, not the policy document.
Shadow copies are where erasure requests fail
A candidate asks to be erased. The CRM record goes, and their CV survives in an attachment in three consultants’ mailboxes, a shared drive folder, a spreadsheet exported for a client shortlist and a personal OneDrive. Erasure that only touches the CRM is not erasure, and IT support for recruitment should say so plainly. Preventing shadow copies is easier than hunting them, which brings the conversation back to export controls.
The spreadsheet problem is a permissions problem
Consultants export shortlists because sharing from inside the CRM is awkward. Fix the awkwardness — client portals, shareable shortlist links, guest access with expiry — and the exports mostly stop. Blocking exports without giving people a supported way to do the underlying job simply moves the data somewhere less visible.
Lawful basis shapes the architecture
Whether you rely on legitimate interests or consent for candidate marketing changes what the system must record: the basis, the date, the source of the data and the opt-out state, all retrievable per record. Getting this into the data model early is far cheaper than retrofitting it during a complaint.
Messaging apps are part of the record
Consultants negotiate on WhatsApp because candidates answer there. That makes those conversations business records subject to the same access, retention and disclosure duties as email. Either bring the channel into a compliant, archived platform or prohibit it credibly; pretending it does not happen is the option that fails an audit.
AI Screening, CV Parsing and the DUAA Line
Almost every applicant tracking system now offers scoring, ranking or auto-rejection, and the legal position changed under the Data (Use and Access) Act 2025, whose automated decision-making provisions commenced on 5 February 2026. Recruitment is the textbook example the regulators reach for, so this is not a theoretical section for IT support for recruitment.
Auto-rejection by score is a significant decision
The test has two limbs: the decision must be significant, and it must be solely automated. A job rejection is the canonical significant decision. If a candidate is rejected because a score fell below a threshold and no human meaningfully intervened, the Article 22C safeguards apply in full. An ATS configured to auto-reject at a score is inside the regime by default.
The four safeguards are build items, not policy statements
Article 22C requires that the individual is informed the decision was automated, can make representations, can obtain human intervention, and can contest the decision. Each is a feature: a disclosure in the rejection message, an intake route for representations, a review queue with a human who is allowed to overrule, and a logged contest workflow. Our guide to automated decision-making under the DUAA covers the full test.
Meaningful human involvement has to be evidenced
A reviewer who rubber-stamps 400 rejections an hour is not meaningful involvement, and the audit trail will show it. Record who reviewed, when, how long they spent and what they changed. The evidence pack matters more than the policy, because a complaint tests what happened rather than what was intended.
Special category data hides in CVs
CVs routinely disclose health, religion, trade union membership and ethnic origin without being asked to. Article 22B keeps significant decisions based on special category data close to the old, stricter regime, so a model trained on raw CV text is a harder problem than a model scoring structured fields. Parsing that strips or ring-fences these fields is a genuine engineering requirement, and IT support for recruitment should confirm the vendor does it.
Parsing quality is a data quality problem for IT support for recruitment
CV parsing uses natural language processing to turn an unstructured document into fields, and the fill rate directly determines search recall. Measure it: run twenty varied CVs through the parser, count populated fields, and hold the vendor to the number. Poor parsing does not announce itself; it just quietly shrinks the searchable database that IT support for recruitment is supposed to be protecting.
Right to Work, Umbrella Chains and Supply-Chain Evidence
From 6 April 2026 the labour supply chain became an information system with legal consequences attached. Two duties in particular decide what an agency’s compliance software, and therefore IT support for recruitment, has to do, and both are evidence problems before they are legal ones.
The penalties that set the stakes
Civil penalties for employing someone without the right to work tripled on 13 February 2024 to a maximum of £45,000 per worker for a first breach and £60,000 per worker for a repeat breach. A compliant check history provides a statutory excuse. That excuse lives or dies on whether the evidence can be produced years later, which makes it a records-management question.
Digital identity checks and where IT support for recruitment stores the evidence
Manual checks, Home Office online checks and certified identity service provider checks all produce different artefacts, and all of them need to be stored against the worker record with the check date, the document expiry and the person who performed it. Expiry alerting is the part IT support for recruitment most often misses, because a valid check that lapsed mid-assignment is no excuse at all.
Umbrella companies and joint liability from April 2026
New rules effective 6 April 2026, legislated through the Finance Bill 2025-26, move responsibility for accounting for PAYE and Class 1 National Insurance on umbrella-supplied workers to the agency that supplies the worker, or to the end client where there is no agency. HMRC’s guidance is blunt: “If we find an umbrella company has not paid the correct amount of PAYE to us, we’ll recover it from you.”
What that costs, in HMRC’s own numbers
HMRC’s costing puts the one-off administrative burden on business at £9.9 million and the continuing annual cost at £21.7 million, against a population it describes as approximately 30,000 agencies and 400 umbrella companies covering around 700,000 workers. Modelled across those 30,000 agencies alone, that is £330.00 each once and £723.33 a year — about 1.61% of a single first-breach right-to-work penalty.
Off-payroll determinations still have to travel
Where the off-payroll working rules apply, an agency that receives a status determination statement must pass it down to the next agency in the chain, and the first agency in the chain can find liability transferred back to it if HMRC cannot collect from parties below. Determinations are documents that must be stored, versioned and provably delivered — again, a systems duty landing on IT support for recruitment.
GLAA-regulated sectors add a licence on top
Agencies supplying labour into agriculture, horticulture, shellfish gathering and associated processing and packaging need a GLAA licence; operating as an unlicensed gangmaster carries a maximum of ten years’ imprisonment and an unlimited fine. If your desks touch those sectors, licence status and worker records belong in the same compliance store as everything above.
Devices, Telephony and the Hybrid Recruitment Desk
Recruitment went hybrid faster than most sectors and kept a stronger office culture than most, and IT support for recruitment inherits both, which produces an unusually mixed estate: desk-bound dual-screen setups, laptops that travel, and mobiles that are the primary device for half of all candidate contact.
The mobile is the real terminal IT support for recruitment must cover
Candidates answer texts and WhatsApp messages far more reliably than email, so the consultant’s phone carries client and candidate personal data whether it is managed or not. App protection policies that separate work data inside the app, without taking control of a personal handset, are usually the right compromise and are included with Business Premium.
Managed devices are the price of Conditional Access
Requiring a compliant device for CRM access only works if devices are enrolled and evaluated. Intune enrolment, a baseline compliance policy covering encryption, patch level and screen lock, and automatic remediation are the minimum. Without them, the Conditional Access policies described earlier degrade into an MFA prompt.
Telephony is a production system inside IT support for recruitment
Call volume is a leading indicator of revenue in this business, so a phone outage costs more than an equivalent length of email downtime. Cloud telephony with click-to-dial, call recording where lawful, mobile failover and published fallback numbers should be in scope for IT support for recruitment agencies rather than treated as a separate vendor’s problem.
Desk churn is constant and cheap to get wrong
Teams grow and shrink with the market, and desks move monthly. Keeping a small buffer of pre-built, pre-enrolled laptops and a documented desk build removes a recurring week of lost productivity, and it is cheap for IT support for recruitment to hold. This is unglamorous work and it is where a good partner is quietly noticed.
Recording, consent and storage
Call recording for training or dispute resolution creates a personal data store that needs its own retention rule, access control and subject access route. Decide the retention period deliberately, apply it automatically, and make sure the recordings are searchable by worker and client, because that is how they will be requested.
Backup, Recovery and What the CRM Vendor Does Not Do
Two assumptions cause most of the data loss in this sector: that Microsoft backs up Microsoft 365, and that the CRM vendor’s backup is yours to restore from. Neither is safe, both are cheap for IT support for recruitment to fix, and both are worth stating plainly.
Microsoft 365 backup is a separate line in IT support for recruitment
Retention policies and the recycle bin are not backup. A malicious or mistaken bulk deletion, a compromised account purging a mailbox, or a ransomware event that encrypts synced files all need a separate, immutable copy with its own credentials. Budget it as a line item; it is small next to the licence cost modelled earlier.
The CRM vendor’s RPO is probably not yours
Ask what the vendor’s recovery point objective is, whether restores are tenant-wide or record-level, how long a restore takes, and what it costs. Tenant-wide-only restore is a serious operational limitation: it means recovering yesterday’s deleted client record costs everyone a day of work. Independent CRM backup exists for the major products and is worth pricing into IT support for recruitment.
Test restores against a named record
A backup report that says success proves the job ran. Restoring a specific candidate record, a specific mailbox item and a specific timesheet week proves the backup is useful. Do all three annually and record the elapsed time, because the elapsed time is what your recovery objectives are actually made of.
Immutability is the ransomware control IT support for recruitment must prove
If backups can be deleted with the same credentials that administer the systems, they will be deleted in a serious incident. Immutable or air-gapped copies with separate administrative identities are the difference between an incident and a closure. This is now a standard cyber insurance question as well as a technical one.
Exit backups protect the relationship, not just the data
Take a full export of the CRM before any migration, renewal negotiation or vendor dispute, and keep it somewhere the vendor does not control. It costs almost nothing and changes the balance of every conversation that follows.
What IT Support for Recruitment Agencies Should Cost and Cover
Pricing for IT support for recruitment is usually per user per month, which is fine as a billing mechanism and misleading as a scope definition. The question worth asking is not the rate; it is what sits inside it.
Per-user pricing for IT support for recruitment, and what falls outside it
Typical UK managed service pricing for a business of this size runs on a per-user monthly rate with the licence cost passed through separately. What commonly sits outside: CRM administration, project work, out-of-hours cover, third-party vendor liaison and security incident response beyond triage. Our breakdown of IT outsourcing cost in the UK compares in-house, managed and co-managed shapes.
The service level has to know what Friday means
A generic four-hour response target is inadequate for a pay run and excessive for a printer. Insist on priority definitions that name the pay cycle explicitly, with a defined escalation path that reaches a human with authority, and hold IT support for recruitment to it. Our guide to what a managed IT services SLA should include sets out the clauses worth arguing over.
Vendor liaison is most of the real work in IT support for recruitment
When the CRM is slow, the problem is rarely the network and the vendor rarely agrees. Someone has to hold the ticket, gather evidence and keep pushing. Make explicit whether that someone is your provider, because informal expectations here are the most common source of dissatisfaction with IT support for recruitment agencies.
Co-managed IT support for recruitment suits larger agencies
Above roughly 100 people, many agencies keep an internal systems or CRM manager and buy infrastructure, security and service desk externally. The split works well provided the boundary is written down at the level of named systems rather than described as “strategy versus operations”.
Contract terms worth insisting on
A defined offboarding assistance period, documentation ownership, no lock-in on tenant administrative credentials, and a change-freeze clause around month-end and the pay cycle. If you are moving provider, our guide to switching IT support providers covers the handover in detail.
| Capability | Usually inside a per-user fee | Usually extra | Why it matters in recruitment |
|---|---|---|---|
| Service desk and device support | Yes | Out-of-hours | Desk downtime is billable time |
| Identity and Conditional Access | Yes | Initial design project | Controls access to the candidate database |
| Email deliverability and DMARC | Monitoring | Remediation project | Directly affects outreach reaching inboxes |
| CRM administration | Rarely | Yes, or vendor | The system that matters most is often unowned |
| Microsoft 365 and CRM backup | Sometimes | Usually per user | Vendor retention is not backup |
| Security incident response | Triage only | Full response retainer | Only 25% of UK businesses have a plan at all |
| Compliance evidence and reporting | Rarely | Yes | Regulation 29 requires two-day retrieval |
A Buyer's Scorecard for IT Support for Recruitment
Use this to score an incumbent or a bidder for IT support for recruitment out of 100. It is weighted towards the things that are specific to staffing rather than the things every provider claims. The pass mark is 70, and any section scoring under half its weight is a fail regardless of the total.
How to score IT support for recruitment
Ask for evidence rather than assertion in every section: a policy export, a log, a test result, a named reference in the sector. Score each section on how much of the evidence they can produce inside a week. A provider who scores well on paper and cannot produce artefacts has told you what you needed to know.
The six sections and their weights
CRM and integration ownership carries 25 points because it is the system the business runs on. Identity and data-exfiltration control carries 20, security operations 20, pay-run continuity 15, compliance and records 10, and commercial terms 10. That distribution reflects where losses actually occur rather than where providers of IT support for recruitment prefer to compete.
Hard fails that override the total score
No independent Microsoft 365 backup, no MFA on all users, no documented leaver process that includes the CRM, no immutable backup copy, or no willingness to name the pay cycle in the SLA. Any one of these should stop the conversation regardless of a strong score elsewhere.
Run it as a structured exercise
Send the six sections in advance, score independently with one person from operations and one from finance, then compare. Divergence between those two scores is usually the most informative thing the exercise tells you about IT support for recruitment.
Re-score IT support for recruitment annually
The estate changes, the threat picture changes and the statutory clocks change — the umbrella rules that took effect in April 2026 are the obvious recent example. An annual re-score against the same six sections turns IT support for recruitment agencies from a purchase into a managed relationship.
| Section | Weight | Minimum to pass the section | Evidence to request |
|---|---|---|---|
| CRM, ATS and integration ownership | 25 | 13 | Integration map and last quarterly test results |
| Identity and export control | 20 | 10 | Conditional Access policy export, export alert log |
| Security operations | 20 | 10 | Incident response plan, last tabletop exercise |
| Pay-run continuity | 15 | 8 | RTO and RPO per system, last restore test |
| Compliance and records retrieval | 10 | 5 | A two-day retrieval demonstration |
| Commercial terms and exit | 10 | 5 | Draft contract with offboarding clause |
| Total | 100 | Pass mark 70 | Any section under half its weight is a fail |
Frequently Asked Questions About IT Support for Recruitment
How much does IT support for recruitment agencies cost in the UK?
Managed support is normally priced per user per month with Microsoft licences passed through separately. For the 60-person example above, licences alone range from £8,035.20 to £17,712.00 a year depending on the shape chosen. Get the scope boundaries for IT support for recruitment in writing before comparing rates, because scope varies far more between providers than price does.
Do we need Business Premium for every consultant?
If consultants access the CRM and open candidate attachments — which is the job — then yes, in practice. The Standard and Basic shapes save 18.50% and 54.63% respectively while removing device management, Conditional Access enforcement and Defender protection from the 70.00% of the workforce most exposed to phishing.
Can our CRM vendor provide IT support for recruitment instead?
Vendors support their product; they do not support your identity, devices, mail flow, backups or the six other systems in the chain. The two roles are complementary. What matters is that someone is contractually responsible for the space between them, which is where most of the value in IT support for recruitment actually sits.
What happens to candidate data when a consultant leaves?
Sessions and tokens should be revoked immediately, the mailbox converted to shared, CRM record ownership reassigned, and any export activity in the preceding 90 days reviewed. If IT support for recruitment cannot complete the leaver process within an hour of notification, it is not a process; it is an intention.
Does the April 2026 umbrella change affect our systems?
Yes. Responsibility for PAYE on umbrella-supplied workers now sits with the agency, and HMRC recovers shortfalls from the agency. That turns supplier evidence into a records-management requirement: what you asked for, when, what you received and where it is stored, retrievable years later.
Is Cyber Essentials worth certifying for a recruitment agency?
For most agencies bidding for public sector or large enterprise contracts it is effectively mandatory, and only 5% of UK businesses hold it, so it is also a genuine differentiator. The five controls are a sensible baseline for IT support for recruitment in their own right, and the assessment usually surfaces two or three gaps worth knowing about.
References and Further Reading
The Conduct of Employment Agencies and Employment Businesses Regulations 2003, regulation 29
The Conduct of Employment Agencies and Employment Businesses Regulations 2003, regulation 10
The Agency Workers Regulations 2010, regulation 7
PAYE rules for labour supply chains that include umbrella companies from 6 April 2026
Umbrella company market: changes to Income Tax rules to tackle non-compliance
Off-payroll working rules for agencies
PAYE and payroll for employers: keeping records
Right to work checks: an employer’s guide
Illegal working penalties: codes of practice for employers
Cyber Security Breaches Survey 2025/2026
REC Recruitment Industry Status Report 2024/25
Introducing Exchange Online Tenant Outbound Email Limits
Compare Microsoft 365 Business plans and pricing
Outlook’s new requirements for high-volume senders
Cyber Essentials overview, NCSC