Datto SaaS Protection: connect, sync backup coverage, map customers
5 min read · Updated Jul 17, 2026
Datto SaaS Protection backs up your customers' Microsoft 365 and Google Workspace data. Current reads that backup estate — how many seats each customer has, how many are actually protected, and whether the last backup succeeded — and hangs it off the company record so it lands in your executive and CIO business reviews. It is a read-only feed for the value story: Current never changes anything in Datto.
Create your Datto API keys
SCREENSHOT — coming soon
The Datto SaaS Protection card on the Integrations page, before connecting.
SaaS Protection shares the Datto Partner API (api.datto.com) with Datto BCDR, so one Partner Portal key pair can read both. You generate the keys once, as a Partner Portal administrator.
- 1Open the Datto Partner PortalGo to Admin → Integrations → API Keys. You need administrator credentials — the key inherits that admin's access.
- 2Create an API keyPress Create API Key. Datto generates a Public key and a Secret key. Use View keys to display them, and copy both — the Secret key is the half you can't get back later.
- 3Paste them into CurrentOpen Integrations from the left sidebar (it sits under Admin, so Tenant Admins have the link), find the Datto SaaS Protection tile, press Manage, and paste the Public API Key and Secret API Key.
- 4Test the connectionCurrent validates the keys live against the Datto API before storing anything — it reads your customer list and reports how many customers it can see. A bad key is rejected on the spot, not three days later.
Note
The keys are stored server-side and never shown again
Current keeps the key pair out of the browser entirely — it travels once, on connect, and is never echoed back. Use Test to re-check the stored keys any time, and paste a new pair to rotate them. Because it's the same key family as Datto BCDR, the same pair can power both cards.
What Current syncs, and how often
The scheduled sync runs every 6 hours; "Sync now" in the Manage sheet covers the impatient path. For each SaaS Protection customer, Current reads the customer roster (domains), the per-seat inventory, and the protected applications, and rolls them up into one coverage row.
| Data set | What it gives you | Where it lands |
|---|---|---|
| Customer roster | Every SaaS Protection customer, its domain, its subscription id, and whether it's Microsoft 365 or Google Workspace | The customer-mapping list on the card |
| Seat counts | Active, paused, and archived seat counts, plus licensed-vs-protected coverage (how many seats actually have a backup) | Company record + executive / CIO business reviews |
| Backup health | The most recent successful backup time and its status across the customer's applications (Exchange, OneDrive, SharePoint, Teams / Google equivalents) | Company record + business review packs |
Read-only — Current can never change a seat
Heads up
The one write in the Datto API is walled off in code
The entire Datto Partner API has exactly one write endpoint — a bulk seat change that can pause or unlicense live, billed Microsoft 365 seats. Current does not use it, ever. The connector's request layer carries an allowlist of the three read endpoints (customer list, seats, applications) and throws on anything else, so the seat-change endpoint is unreachable in code — not merely hidden in the UI. Connecting Datto SaaS Protection to Current cannot change, pause, or remove a single seat.
Mapping SaaS customers to your companies
Datto identifies each customer by a SaaS customer id, which won't line up with your Current company book on its own. Current auto-matches where it safely can, and the Manage sheet's mapping section is where you handle the rest.
- ＋Auto-match by name — when a SaaS customer's name resolves to exactly one Current company (lowercased, with Inc/LLC/Ltd/Corp/Group and punctuation stripped), Current links them automatically. An ambiguous name that matches two companies is never auto-linked.
- ＋Unmatched — SaaS customers with no company yet. Press Map to pick the right Current company by hand, or leave it; an unmapped customer still syncs, it just doesn't surface on a company record until it's mapped.
- ＋A manual mapping always wins — once you map (or unlink) a customer by hand, the auto-matcher never overwrites your choice.
Tip
Coverage only shows on mapped companies
Seat and backup data appears on a company record only once its SaaS customer is mapped. If a company shows no SaaS Protection data, check the Unmatched list first.
When something goes wrong
| What you see | What it means |
|---|---|
| Card shows Error, message mentions 401 or 403 | Datto rejected the keys. The Public or Secret key is wrong, or the administrator behind them lost Partner Portal access. Generate a fresh key pair and paste it in again. |
| Message mentions a subscription tier (402) | That account isn't licensed for the SaaS Protection API. The rest of the sync keeps working. |
| No customers found | A customer only appears through the API once it's associated with your Partner Portal account. Confirm the customer is set up in SaaS Protection. |
| A company shows no backup coverage | Its SaaS customer isn't mapped, or the customer has no seats under protection yet. Check the Unmatched list on the card. |
Note
Disconnecting keeps your data
Disconnect stops the sync; everything already pulled stays exactly where it is. The stored keys are kept too, so reconnecting just resumes. Connecting, syncing, mapping, and disconnecting are Tenant Admin actions; anyone on the team can see the connection status.
Was this helpful?