Security & Backup

Datto SaaS Protection

Bring your Datto SaaS Protection backup coverage into Dex - list seats, read per-application backup status, and check backup stats across your managed customers.

Dex connects to Datto SaaS Protection through the partner REST API so admins can see Microsoft 365 and Google Workspace backup coverage conversationally - list a customer's seats and their protection state, read per-application backup status for Exchange, OneDrive, SharePoint, Teams, Gmail, and Drive, and check detailed backup statistics. The one write, a bulk seat change, ships disabled and approval-gated because it changes billing and can stop backups. Available as an MSP global app: one shared partner REST API key pair covers every SaaS Protection customer, and each Dex tenant is confined to its own numeric saasCustomerId. Admin-only - Dex Go self-service is off.

Start free →

What Dex does with Datto SaaS Protection

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

List every SaaS Protection customer from the domains roster on the MSP master connection
List a customer's seats and their protection state - filter by seat type such as User, SharedMailbox, SharedDrive, Site, TeamSite, or Team
Answer "which users are not protected" by reading each seat's state
Read per-application backup status and last-backup history for Exchange, OneDrive, SharePoint, Teams, Gmail, and Drive
Check detailed backup statistics for a customer
License, unlicense, or pause up to 100 seats in a bulk seat change - disabled by default, approval required, changes billing and can stop backups
Deploy as an MSP global app - one shared partner REST API key pair, each customer confined to its numeric saasCustomerId

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>List every SaaS Protection customer we manage
>Show me the unprotected user seats for this customer
>What's the last backup status for Exchange and OneDrive on this tenant?
>Show me the detailed backup statistics for this customer
>Which SharedMailbox seats are paused right now?

Policy actions

Every action Dex can take on Datto SaaS Protection is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`datto_saas_list_domains`	List every Datto SaaS Protection customer (MSP master connection only)	—
`datto_saas_list_seats`	List Datto SaaS Protection seats and protection state for this customer	—
`datto_saas_list_applications`	Read Datto SaaS Protection per-application backup status for this customer	—
`datto_saas_get_backup_stats`	Read Datto SaaS Protection detailed backup statistics for this customer	—
`datto_saas_bulk_seat_change`	License, unlicense, or pause up to 100 of this customer's seats - changes billing, and unlicense or pause stops backups	approval

How to configure Datto SaaS Protection

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In the Datto partner portal, go to Admin > Integrations > API Keys and create a REST API key pair.
2
Copy the public key and the secret (private) key for Dex.
3
In Dex, enable the Datto SaaS Protection integration and paste the public key and secret key. Leave saas_customer_id blank on the MSP master connection.
4
Dex validates the key pair with a live read before saving. On the master connection it reads GET /v1/saas/domains to list your customers.
5
For each tenant, look up its numeric saasCustomerId from the domains roster and save it as saas_customer_id on that tenant's own connection to confine Dex to that customer.

Credentials required

public_key: Datto partner REST API public key (treated as secret)
secret_key: Datto partner REST API secret (private) key
saas_customer_id: This tenant's numeric Datto saasCustomerId from GET /v1/saas/domains - leave blank on the MSP master connection

Requirements

•A Datto partner REST API key pair generated under Admin > Integrations > API Keys
•One shared key pair covers every SaaS Protection customer the MSP manages
•Each Dex tenant is confined to its own numeric saasCustomerId - the domains roster stays on the MSP master connection
•Admin-only - Dex Go self-service is off; there is no cryptographic bind from a Dex Go requester to a Datto seat
•Restore is UI-only; Datto BCDR, Direct-to-Cloud, and activity-log reporting are out of scope