Connect Datto SaaS Protection to Conduit

This walkthrough connects Datto SaaS Protection (Microsoft 365 / Google Workspace backup) to Conduit. SaaS Protection authenticates with a Public Key / Secret Key pair sent as HTTP Basic auth, plus an optional Region that tells Conduit which Datto API cluster your tenancy lives on.

Caution

This connection recently changed from a single API key to a public/secret key pair. If you connected SaaS Protection back when the form had one “API Key” field, your stored credential no longer matches what the tools expect — disconnect and reconnect with the key pair described below.

Menu labels can change

The Datto steps below reflect the SaaS Protection API-key flow at time of writing; menu labels can shift between releases. If a label differs, see Datto’s SaaS Protection REST API guide.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Datto SaaS Protection administrator login.
• To know your region — whether your SaaS Protection tenancy is served from Datto’s US or EU cluster. If you’re unsure, US is the default; if your portal and data residency are European, pick EU.

Step 1 — Create an API key pair in SaaS Protection

1. Sign in to the Datto SaaS Protection portal as an administrator.
2. Create (or locate) your REST API keys following Datto’s SaaS Protection REST API guide. Expected: a Public Key and a Secret Key.
3. Copy both values. Note which clients the key can access — a key scoped to specific clients limits what Conduit’s tools can see.

Caution

Copy the secret key now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the secret key, regenerate the pair in the portal first; the exposed pair becomes useless immediately.

Step 2 — Connect Datto SaaS Protection in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Datto SaaS Protection in the catalog (under BCDR) and click Connect. Expected: a credential form with three fields.
3. Fill the fields:
   • Public Key (required) — from Step 1.
   • Secret Key (required) — from Step 1.
   • Region (optional) — pick eu if your tenancy is on Datto’s EU cluster; otherwise leave it as us (the default).
4. Click Connect. Expected: Conduit validates the key pair against the Datto API for your selected region immediately and shows a green Connected status. A bad pair — or the right pair on the wrong region — is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this SaaS Protection connection. (For per-technician keys, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only SaaS Protection tool, such as listing clients or backup status. You should get real data back, and the call appears in your audit log with the correct user, vendor (datto-saas-protection), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “SaaS Protection rejected the key pair (HTTP 401). The error is generic — common causes: (1) bad key pair, (2) wrong region (you selected ‘us/eu’)…”	Datto returns the same 401 for both problems, so check both: re-copy the public/secret pair from the portal, and confirm the region matches where your tenancy actually lives.
Connect fails with “SaaS Protection key lacks scope. Verify the key has access to all clients or the targeted client.”	The pair authenticated but is scoped too narrowly. Widen the key’s client access in the SaaS Protection portal.
Connect fails with “SaaS Protection returned HTTP NNN: …”	Datto’s API responded with an unexpected status — often a transient outage or maintenance. Retry after a few minutes.
Tool calls fail on a connection created before the key-pair change	Older connections stored a single API key, which the tools no longer accept. Disconnect and reconnect with the Public Key / Secret Key pair.
Tool calls return 403 “no credentials for vendor”	SaaS Protection isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a key pair.
Need to rotate the keys	Regenerate the pair in the SaaS Protection portal, then update the credential at /org/catalog.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.