> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Datto SaaS Protection

> Connect Datto SaaS Protection to Triggr with a Datto Partner Portal API key, then map your clients to SaaS Protection customers.

Triggr lists protected domains and seats, licenses, unlicenses or pauses backup for seats, and reads backup data in Datto SaaS Protection for Microsoft 365 and Google Workspace.

## Set up Datto SaaS Protection

SaaS Protection uses the same Partner Portal API key as [Datto BCDR](/integrations/datto-bcdr); if you already have one for Triggr, reuse it. Otherwise, you need the Admin or Security Admin role in the Partner Portal.

<Steps>
  <Step title="Create an API key">
    Go to **Admin > Integrations > API Keys** and click Create API Key. Enter an API Key Name such as `Triggr`, leave the vendor and client fields empty, and click Create. Datto allows two keys; you can reuse one with no vendor or client set.
  </Step>

  <Step title="Copy the keys">
    In API Key Management, open the key's three-dot menu, select View keys and copy the public and secret keys.
  </Step>
</Steps>

See Datto's [Using the Datto REST API for SaaS Protection](https://saasprotection.datto.com/help/M365/Content/Other_Administrative_Tasks/using-rest-api-saas-protection.htm).

## Connect it in Triggr

<Steps>
  <Step title="Open the integration">
    Go to **Integrations > Datto SaaS Protection** and click **Configure** on the Base Configuration card.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=bb81acb082055015f91beda7b4876f35" alt="The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button." width="2272" height="330" data-path="images/integrations-common/base-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter the keys">
    Enter the PublicApiKey and SecretApiKey, then click **Save Configuration**.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/datto-saas-protection/configure.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=69747b7371962871bd851900f9d2e5ef" alt="The Datto SaaS Protection configuration window with PublicApiKey and SecretApiKey fields, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1126" data-path="images/datto-saas-protection/configure.png" />
    </Frame>
  </Step>
</Steps>

## Map your clients

On the Client Mapping card, click **Apply 100% Matches**, then choose the SaaS Protection customer in Mapped to for anyone left. Only customers with at least one protected domain are listed.

<Frame caption="The Client Mapping card, shown here for ConnectWise Manage as an example.">
  <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/client-mapping.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=da797e78dc917005df8e55c6b6cb166b" alt="The Client Mapping card with All, Mapped and Unmapped filters, Acme Corp mapped to Acme Corp with a 75% suggested mapping, and Globex unmapped with a Select ConnectWise Manage clients dropdown." width="2272" height="702" data-path="images/integrations-common/client-mapping.png" />
</Frame>

Triggr saves each match as the client's `dattoSaasProtectionId` and `externalSubscriptionId` variables. Pass `{{ ctx.client.dattoSaasProtectionId }}` as `saasCustomerId`, and for Bulk Seat Change also pass `{{ ctx.client.externalSubscriptionId }}` as `externalSubscriptionId`.

Bulk Seat Change takes Datto's JSON body in `requestBody`, with case-sensitive values:

```json theme={null}
{ "seat_type": "User", "action_type": "Unlicense", "ids": ["<remoteId>"] }
```

`seat_type` is `User`, `SharedMailbox`, `Site`, `TeamSite` or `Team` for Microsoft 365, or `User` or `SharedDrive` for Google Workspace. `action_type` is `License`, `Pause` or `Unlicense`, and `ids` are `remoteId` values from Get Seats, up to 100 per request.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Every action fails with an authentication error">
    Check the keys aren't swapped and were pasted in full, and the key hasn't been deactivated or regenerated. A key with a vendor set won't work; create one with the vendor field empty.
  </Accordion>

  <Accordion title="Customers are missing from Mapped to">
    A key with a client set returns only that client's data. A customer appears only once one of its domains is protected; then click Refresh.
  </Accordion>

  <Accordion title="Bulk Seat Change is rejected">
    Check the values and their capitalisation, and that the `ids` and `externalSubscriptionId` belong to the same customer. For Google Workspace, Datto supports seat changes through the API only on Seat Management 2.0.
  </Accordion>

  <Accordion title="You can't create another API key">
    Reuse an existing key with no vendor or client set, or delete one you no longer use. Deleting a key stops every tool that uses it, including Datto BCDR.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.