Hello! In this article, we'll cover how to monitor Datto SaaS Protection (Microsoft 365 and Google Workspace backups) in Backup Radar using the API integration.

Backup Radar connects to the Datto REST API and pulls in a daily backup status for each of your SaaS Protection customers and applications (Exchange, OneDrive, SharePoint, Teams, Gmail, Google Drive and more).

Note: The Datto SaaS Protection integration is currently in beta / limited release. If you don't see the Datto SaaS Protection tile in Backup Radar, contact support to request access.

This integration is separate from the Datto BCDR and Datto Endpoint Backup V2 integrations. Set each one up separately if you use more than one Datto product.

Who can set this up: Backup Radar administrators, and standard users who have been granted access to integrations.

What you'll need

• Access to the Datto partner portal (portal.dattobackup.com) with permission to manage API keys.
• A Datto REST API Public Key and Secret Key. These are the same type of keys used by the Datto BCDR integration. If you already have keys for BCDR, you can reuse them.
• Access to Backup Radar with permission to manage integrations.

Step 1: Get your API keys from Datto

1. Sign in to the Datto partner portal at portal.dattobackup.com.
2. Go to Integrations > API (https://portal.dattobackup.com/integrations/api).
3. Create a new API key, or use an existing one.
4. Copy the Public Key and Secret Key. Store the secret key somewhere safe.

Tip: If you regenerate a key that's already used by your Datto BCDR integration in Backup Radar, update it there too.

Step 2: Add the integration in Backup Radar

1. In Backup Radar, go to Integration > Backup Integrations.
2. Under Available, open the Datto tile and select Datto SaaS Protection.
3. Fill in the form:
   • Enabled — leave this on.
   • Profile Name — a name to identify this connection (for example, "Datto SaaS Protection").
   • Public Key — the public key from Step 1.
   • Secret Key — the secret key from Step 1.
4. Click Save. Backup Radar checks the keys with Datto before saving. If they're rejected, you'll see an error — double-check that both keys were copied correctly and that the key is still active in the Datto portal.

Once saved, the integration moves to the Connected section and Backup Radar runs the first import. Your secret key is stored securely and isn't displayed in plain text after saving.

Step 3: Import and map your clients

1. Open the integration and select Import Clients to pull in your Datto SaaS Protection organizations.
2. Map each Datto organization to the matching company in Backup Radar. For more detail, see Mapping clients to their backups.

Step 4: Activate your backups

After the first sync, your backups appear in Backup Radar. Activate them the same way you would for any other integration:

• Templates accounts: see Activating your backups.
• Backup Plans accounts: see Adding a Backup Plan.

How your backups appear in Backup Radar

The Datto SaaS Protection API reports a summary per application for each customer, not per user or mailbox. Backup Radar shows the same level of detail you see in the overview in the SaaS Protection portal.

Job names

Any other application type shows with the name Datto uses for it.

How the status is set

Each daily result reflects the status Datto reports for that application, plus how many of the backed-up services (users, mailboxes, sites, and so on) had a backup without issues:

The 90% threshold matches how the SaaS Protection portal grades backup health.

How often it syncs

Backup Radar checks Datto every hour. On each check, it updates the results for today and the previous 2 days, so a status that changes after the fact is picked up. On the first sync, Backup Radar imports the history Datto has available (up to 10 days).

Datto reports rolling 24-hour windows rather than individual backup times, so each window is recorded against the UTC date it started on.

Frequently Asked Questions

Why can't I see which user or mailbox failed? The Datto SaaS Protection API only provides a summary per application (for example, "70 of 71 services backed up"). It doesn't say which user, mailbox or site had the issue. To find it, open the customer in the SaaS Protection portal.

Why is a whole application showing a warning when only one mailbox had an issue? If at least 90% of services backed up without issues, Backup Radar marks the application as a Warning. Below 90%, it's a Failure. Check the result note for the exact counts.

Can I use the same API keys as my Datto BCDR integration? Yes. SaaS Protection uses the same Datto REST API and the same keys. You still need to add the SaaS Protection integration separately in Backup Radar.

Why can't I see the Datto SaaS Protection tile? The integration is in beta / limited release. Contact support to request access.

My keys won't save. What should I check? Make sure you copied both the public and secret key in full, and that the key hasn't been deleted or regenerated in the Datto portal.

My clients imported, but no backups are showing. What should I do? Allow time for the first sync to complete (it runs hourly). Applications that have no backup history in Datto won't create results. If backups still don't appear after a day, submit a support ticket and include your Backup Radar account name.

I'm already monitoring Datto SaaS Protection by email. Should I switch? Yes, once the API integration is running and your backups are activated, turn off the Datto SaaS Protection email reports to your Backup Radar mailbox (see Integrating with Datto SaaS Protection Emails) and retire the old email-based backups, so you don't monitor the same customers twice.

Is this the same as the Datto BCDR or Endpoint Backup integration? No. Datto BCDR (SIRIS/ALTO) and Datto Endpoint Backup V2 each have their own integration. Set up each one separately.