SeatReaper reads every Datto SaaS Protection customer and its seats: who is backed up, the seat type, and whether the seat is billed. It never changes seats, licenses or backups.
Create API keys
- Sign in to the Datto Partner Portal.
- Open Admin > Integrations > API Keys and create a key pair.
- Copy the public key and the secret key. Keep the secret key somewhere safe; you need it again to change the connection.
Deleting the key pair in the Partner Portal stops SeatReaper's access at once.
Connect
An owner opens Settings > Integrations > Datto SaaS Protection, pastes both keys, and chooses Connect Datto SaaS Protection. SeatReaper lists your customers to check the keys, saves them encrypted, and runs the first sync. After that it syncs every day with your other connections, and Sync now checks at any time.
How customers are linked to clients
Each SaaS Protection customer is linked to:
- the client whose Microsoft 365 users sign in with the customer's domain (for example harbordental.com), when exactly one client does, otherwise
- the client with the same name, ignoring capitals, punctuation and endings like Inc or LLC.
For customers that did not match, owners and techs pick the client under SaaS Protection customers on the Integrations page. A picked link is kept on every sync; choose Automatic to go back.
What SeatReaper does with it
- People who left: a Microsoft 365 user who is blocked, or has not signed in for the inactivity threshold, is flagged while they still have a billed backup seat, even after their Microsoft 365 licenses are gone. One item lists every tool still billing for them. See What SeatReaper flags.
- People no longer in Microsoft 365: a billed user seat for an address on the client's Microsoft 365 domains that matches no Microsoft 365 user.
- Offboarding: the person's backup seat is ticked for you when you offboard them, and confirmed once the seat is gone or no longer billed.
- Prices: set your monthly cost per user seat in the price book.
Only user seats count. Shared mailboxes, sites and Teams are listed on the client page but never flagged.
Disconnect
An owner chooses Disconnect on the card. SeatReaper deletes the customers and seats it synced and stops reading. Delete the key pair in the Partner Portal to revoke access completely.
In compliance reports
On Growth and Pro, Backup status in the compliance evidence reports shows how many licensed Microsoft 365 users have a Datto SaaS Protection seat and lists those without one. The Access review lists blocked accounts that still hold a seat.