Datto Continuity Setup

Connect Datto Continuity to let Junto inspect BCDR appliance inventory and backup health, SaaS Protection customers, seats, and application backup history, and Direct-to-Cloud asset status. The agent can also license, unlicense, or pause SaaS Protection seats and change Direct-to-Cloud bandwidth settings with approval.

Datto Continuity is a separate integration from Datto RMM and uses its own API keys. Junto supports one Datto Continuity configuration per organization. Connect your partner account once, then map Datto organizations, SaaS Protection customers, and unassigned BCDR devices to Junto companies so the agent can retrieve each customer's data.

Prerequisites

• A Junto Admin or Owner account
• A Datto partner account with access to the Datto REST API for the BCDR, SaaS Protection, and Direct-to-Cloud products you want to connect
• A Datto REST API public key and secret key pair
• Customer companies in Junto, imported from your PSA, to map to Datto resources

Step 1: Create Datto REST API Keys

1. Sign in to the Datto Partner Portal with an account that can manage API access.
2. Generate a REST API key pair. Datto displays a public key and a secret key.
3. Copy both values and store them securely. Junto labels the secret key as the Private key.

If your key is restricted to a single Datto organization, Junto only sees that organization's appliances and assets. Use a partner-level key when you want to map several customers.

Step 2: Configure in Junto

1. Go to Settings > Integrations > Datto Continuity.

2. Click Add configuration.

3. Complete the form:

   Field	What to enter
   Public key	The public key from Step 1
   Private key	The secret key from Step 1
   Active	Leave enabled to make the integration available to the agent

4. Click Create configuration. The button shows Saved and the dialog closes. Junto encrypts both keys when stored and never displays them again; the configuration card shows only the last four characters of the public key.

5. Click Test connection on the Continuity API connection card. A successful test reports Connection successful and shows how many BCDR devices, SaaS customers, and direct-to-cloud assets Junto can see.

Saving the configuration does not test the credentials; run Test connection separately. The test performs read-only discovery across all three products and does not change anything in Datto. Add configuration is disabled once a configuration exists.

Step 3: Map Companies

Datto Continuity mappings are explicit. Junto never infers which customer owns a resource from its name, so an unmapped company cannot use the customer-specific tools.

1. Click Map companies on the active configuration.

2. In the Map Datto Continuity companies dialog, use Search Datto resources and the Resource type filter to find each resource. Three resource types are listed:

   Resource type	What it covers
   BCDR / direct-to-cloud organization	A Datto organization. Mapping it gives the company access to that organization's BCDR appliances and Direct-to-Cloud assets.
   SaaS Backup customer	A SaaS Protection customer. SaaS customers are mapped separately from organizations, even when they belong to the same customer.
   Unassigned BCDR device	A BCDR appliance that is not assigned to any Datto organization, identified by serial number.

3. For each resource, choose the Junto company that owns it, or leave it as Not mapped.

4. Click Save mappings and confirm Mappings saved appears.

You can also click Run auto-map. Auto-map matches Datto organizations to Junto companies by name; exact matches are applied automatically and similar names are presented for review. SaaS customers and unassigned devices always stay manual.

A Junto company can own several Datto resources, but each resource belongs to only one company. Saving includes every resource, including those hidden by the current search or type filter. Mappings can only be saved while the configuration is Active.

If a saved resource is marked Unavailable in the current inventory, it no longer appears in Datto discovery; choose Not mapped for it before saving. If a mapped company is marked unavailable, select another company or Not mapped. If an unassigned BCDR device is later assigned to a Datto organization in Datto, its serial-number mapping stops applying; map the organization instead.

What the Agent Can Do

Capability	What Junto can do	Risk level
BCDR appliance inventory	List BCDR appliances with serial number, organization, model, service plan, warranty expiration, last seen date, agent and share counts, alert counts, and local and offsite storage usage	Low
BCDR backup health	Read one appliance's protected assets, including local and offsite snapshot times, backup results, screenshot verification, and paused or archived state	Low
SaaS Protection customers	List SaaS Protection customers with domain, subscription, product type, retention type, seats used, and recent backup statistics	Low
SaaS Protection seats	List a customer's seats with name, type, state, billing indicator, and date added, optionally filtered by seat type	Low
SaaS backup health	Read a customer's summary and application backup windows for Exchange, OneDrive, SharePoint, and Teams where available	Low
Direct-to-Cloud inventory	List Direct-to-Cloud assets with hostname, organization, status, backup state, last backup, recent backup results, screenshot result, and last check-in	Low
Direct-to-Cloud asset detail	Inspect one asset's customer, hostname, check-in, backup and screenshot history, and subscription	Low
Change SaaS Protection seats	License, unlicense, or pause up to 100 seats of one type in one customer's subscription	High
Set Direct-to-Cloud bandwidth	Change one asset's pause-while-metered setting, maximum bandwidth, or maximum throttled bandwidth	High

All write actions require technician approval before execution. Read-only tools do not require approval. Seat and bandwidth changes are never eligible for auto-approval, and requesting one requires the Manager role or higher; a request from a lower-level member is routed to a member with that role for approval instead.

Scope and Reporting

• Customer context: In a company-bound chat or runbook, every tool is limited to that company's mapped organizations, SaaS customers, and unassigned devices. In an organization-wide Explore chat, reads cover everything the API key can see. Seat and bandwidth changes always require one mapped company.
• Where tools are available: Read tools are available in Explore chat and in runbooks. Seat and bandwidth changes are available only in Explore chat; runbooks and other unattended runs cannot request them.
• Separate products: BCDR appliances are identified by serial number, Direct-to-Cloud assets by asset ID, and SaaS Protection customers by their own customer ID. The agent uses the exact identifiers returned by inventory and will not guess them or match seats by display name.
• Hidden appliances: BCDR inventory excludes hidden appliances unless you ask for them. A hidden appliance is not necessarily retired or healthy.
• Backup status: A stale backup date or a missing recent backup does not by itself prove a failed job, and an unknown screenshot or verification result is reported as unknown, not as a failure. SaaS backup history covers roughly the last ten days, and its summary counts describe different windows than the per-application history.
• SaaS counts: Recent-backup counts are protected services, not users or failed jobs. A blank billing indicator on a seat means unknown, not free.
• Result limits: Lists are returned in pages. Ask for more results when a list is incomplete, and use the Datto portal when you need an exhaustive review.
• Read-only areas: The integration does not start backups, run restores, change retention, or modify BCDR appliances. Bandwidth settings are not visible in Direct-to-Cloud reads, so a bandwidth change can only be verified in the Datto portal.

Seat and Bandwidth Changes

Before requesting a change, the agent reads the current inventory and presents the company, customer or asset, the exact seats or settings selected, and the consequences for approval. Licensing a seat can affect billing and protection, unlicensing removes licensed protection, and pausing interrupts backups. Bandwidth limits or a metered-network pause can delay backups. No resume action is available; the agent will not substitute License to imply a resume.

An approval is valid for 15 minutes and is used once. If the company mapping, credentials, or the selected seats' state change after approval, the agent stops and requests fresh approval.

A submitted seat change is accepted, not completed: Datto applies it asynchronously. Ask Junto to list the seats again to confirm the new state. A bandwidth change returns the requested settings; confirm them in the Datto portal. Changes are sent once. If a change times out or its outcome is unclear, check the current state in Datto before requesting it again, because the first request may already have been applied.

Example requests:

• "List Acme's BCDR appliances and flag any with open alerts."
• "Check backup health for the appliance with serial D0123456 and tell me which assets are paused."
• "Show Acme's SaaS Protection backup history for Exchange and SharePoint."
• "Which SaaS Protection seats for Acme are unlicensed?"
• "List Acme's Direct-to-Cloud assets that have not checked in this week."
• "Pause the SaaS Protection seat for jsmith@acme.com, then confirm its state."
• "Set the Direct-to-Cloud asset ACME-LT-07 to pause backups on metered connections."

Managing the Connection

• Update credentials: Click Edit, enter the replacement Public key and Private key, and click Update configuration. Leave a field blank to keep its stored value. Changing either key clears all company mappings, because the new key may belong to a different Datto account with overlapping IDs. Test the connection and map companies again after rotating keys.
• Pause the integration: Click Edit, turn off Active, and click Update configuration. The configuration and mappings remain saved, the agent loses access, and Map companies is disabled until you reactivate.
• Remove the integration: Click Disconnect, then Disconnect configuration. This removes the stored keys and all Datto Continuity company mappings from Junto. Existing Datto backups and licenses stay unchanged.

Troubleshooting

• Connection fails: Recheck the public and secret keys. Confirm the key pair has not been revoked in Datto and that it has access to the BCDR, SaaS Protection, and Direct-to-Cloud products you expect. A key restricted to one Datto organization only returns that organization's resources.
• Rate limit reached: Datto limits REST API requests per hour for each partner organization. Wait for the quota to reset before retrying reads.
• Cannot add a second configuration: Datto Continuity supports one configuration per organization. Edit the existing configuration to change keys.
• Map companies is disabled: The configuration must be Active. Click Edit, turn on Active, and save.
• Mapping cannot be saved: A selected resource may no longer exist in Datto, or another administrator may have changed mappings at the same time. Close and reopen the mapping dialog to refresh the list, then save again.
• The agent says a company is not mapped: Open Map companies and assign at least one Datto resource to that Junto company. SaaS Protection customers must be mapped separately from BCDR and Direct-to-Cloud organizations.
• A resource is reported as outside the company's mappings: The appliance, asset, or SaaS customer belongs to a different Datto organization or customer than the one mapped. Check the mapping, or use an organization-wide Explore chat for cross-customer inventory.
• An unassigned device disappeared from a company: The appliance was assigned to a Datto organization. Map that organization to the company instead of the device serial.
• A seat or bandwidth change was not confirmed: The request was sent once and may already have been applied. List the seats again or check the Datto portal before requesting another approval.
• Bandwidth settings do not appear in asset detail: Datto does not expose bandwidth settings through reads. Verify them in the Datto portal.