[Datto SaaS Protection] List every Microsoft 365 and Google Workspace domain the partner protects — the ENTRY POINT for this connector, and the only place its identifiers come from. Each domain carries a saasCustomerId and an externalSubscriptionId. Those are two DIFFERENT values: the customer id is a number identifying the protected customer, the subscription id is a string identifying their Datto subscription. dattosaas_list_seats and dattosaas_list_applications need the customer id; dattosaas_bulk_seat_change needs BOTH, and passing them in the wrong order is the most common failure on this connector. Start here before calling anything else. Takes no arguments and returns every domain in one response — there is no pagination on this endpoint.

[Datto SaaS Protection] Change the backup licensing state of up to 100 seats in ONE call: License them, Unlicense them, or Pause them. DESTRUCTIVE AND BILLABLE — read this before calling. Unlicense STOPS future backups for those people and puts data Datto has already captured on its deletion path for unlicensed seats, and licence counts are what Datto bills the partner on, so any change here alters both protection and cost. There is no undo beyond re-licensing, which does not bring back data already purged. Requires BOTH identifiers from dattosaas_list_domains, and they are different values that sit next to each other: saasCustomerId is the customer number and externalSubscriptionId is the subscription string — swapping them is the most common mistake on this connector. The ids argument takes remoteId values from dattosaas_list_seats (nothing else is accepted), at most 100 per call. seatType and actionType are CASE-SENSITIVE and are rejected locally if misspelled. actionType has no default on purpose: always state it explicitly. Always list the seats first and confirm you are acting on the intended customer and the intended people.

[Datto SaaS Protection] List the protected seats for one customer — the end users, shared mailboxes, sites, team sites and teams Datto is backing up — with each seat's name, type and licensing state. Every seat carries a remoteId, which is the ONLY identifier dattosaas_bulk_seat_change accepts; unlike the applications read, remoteId is included here by default. Requires a saasCustomerId from dattosaas_list_domains. Read this before any seat change so you are acting on current ids and can see what each seat's state is now. Paginated: the response wraps items alongside a pagination object carrying totalPages.

[Datto SaaS Protection] Read backup status per protected application for one customer — Exchange, OneDrive, SharePoint, Teams, Gmail, Drive and so on — with each application's last backup result and time. This is the tool that answers "is this customer's Microsoft 365 actually being backed up, and did it succeed?". Requires a saasCustomerId from dattosaas_list_domains. Two things worth knowing: daysUntil is a LOOK-AHEAD window in days (Datto defaults to 10 and caps it at 30, and larger values are clamped), and remoteId values are OMITTED unless you pass includeRemoteId=true — without them the results cannot be fed to dattosaas_bulk_seat_change, which accepts nothing else.