Partner-managed, organization-managed accounts
IMPORTANT This article does not apply to Backupify customers.
Before becoming a Datto SaaS Protection partner, you need to be aware of the requirements for adding and managing Datto SaaS Protection accounts. The requirements depend on whether you or your organization will manage the SaaS Protection organization.
MSP-managed account
When setting up a new Datto SaaS Protection account for a organization, you indicate whether the account will be managed by you (the partner) or by your organization. If you will be managing the account, you should have super administrator account credentials for the organization's Google Workspace suite. The super administrator account should provide you with privileges for all the organization's users, services, and sites that the organization would like backed up.
The super administrator account credentials allow you to authorize the API scopes SaaS Protection requires to access the organization's Google Workspace services. These API scopes provide SaaS Protection with the permissions to backup and restore Google Workspace data for the organization's Gmail, Calendar, Contacts, Drive, and Shared Drives applications.
If you don't have the super administrator account credentials when adding a new organization, you can provide the email address of the appropriate organization staff member who will authorize and create the account.
Organization-managed account
When setting up a new Datto SaaS Protection account for a organization that will be managed by the organization, the organization will authorize and create the account. Because the organization will be managing the account, you won't have access to the organization's Google Workspace data.
Google Workspace permissions
While performing the procedure to add a new organization, the specific permissions you are approving are listed for your review. The following summarizes the permissions provided to Datto SaaS Protection.
| Permission | Description |
|---|---|
| See, edit, create, and delete all of your Google Drive files | Allows SaaS Protection to backup and restore user files. |
| See, edit, create, and delete all your Google Sheets spreadsheets | Allows SaaS Protection to backup and restore user files. |
| Read, compose, send, and permanently delete all your email from Gmail | Allows SaaS Protection to backup and restore email in mailboxes. This does NOT allow SaaS Protection to send mail from these mailboxes. |
| See, edit, share, and permanently delete all the calendars you can access using Google Calendar | Allows SaaS Protection to backup and restore calendars. |
| See, edit, download, and permanently delete your contacts | Allows SaaS Protection to backup and restore user contacts. |
| See and download contact info automatically saved in your "Other contacts" | Allows SaaS Protection to backup and restore user contacts. |
| Manage the alias settings of users on your domain | Allows SaaS Protection to backup content associated with an alias. |
| Manage the calendar settings of users on your domain | Allows SaaS Protection to backup and restore calendars. |
| Manage your domain settings | Allows SaaS Protection to read relevant domain settings. |
| Manage groups on your domain | Allows SaaS Protection to backup and restore information about groups. |
| Manage the organizational structure and policies of users on your domain | Allows SaaS Protection to identify and backup information about Organizational Units. |
| Manage the provisioning of users on your domain | This allows SaaS Protection to read data in your organization’s directory, including users, groups, permissions, and applications for SaaS Protection’s seat management system. |
| View groups on your domain | Allows SaaS Protection to backup and restore information about groups. |
| View organization units on your domain | Allows SaaS Protection to identify and backup information about Organizational Units. |
| See info about users on your domain | Allows SaaS Protection to read data in your organization’s directory, including users, groups, permissions, and applications for SaaS Protection’s seat management system. |
| View usage reports for your Google Workspace domain | Allows SaaS Protection to read data in your organization’s directory, including users, groups, permissions, and applications for SaaS Protection’s seat management system. |
| Upload messages to any Google group in your domain | This allows SaaS Protection to enable group management features for protection. |
| View and manage the settings of a Google Workspace group | This allows SaaS Protection to read data in your organization’s directory, including users, groups, permissions, and applications for SaaS Protection’s seat management system. |
| View and manage Google Workspace licenses for your domain | Allows SaaS Protection to read data in your organization’s directory, including users, groups, permissions, and applications for SaaS Protection’s seat management system. |
| Manage email messages of users on your domain | Allows SaaS Protection to perform backups and restores of email in mailboxes. This does NOT allow SaaS Protection to send mail from these mailboxes. |
| See your primary Google Account email address | This allows SaaS Protection to read data in your organization’s directory, including users, groups, permissions, and applications for SaaS Protection’s seat management system. |
| See your personal info, including any personal info you've made publicly available | SaaS Protection does not currently make use of this permission but may require it for future features. |
| Manage your sites | Allows SaaS Protection to backup and restore the directory structure of protected accounts. |
| View your installed application's licensing information | Allows SaaS Protection to read data in your organization’s directory, including users, groups, permissions, and applications for SaaS Protection’s seat management system. |
| View your basic profile info, including your age range and language | SaaS Protection does not currently make use of this permission but may require it for future features. |
| See and download all of your Google Account email addresses | Allows SaaS Protection to have the appropriate levels of access to mailboxes for backups and restores. |
