Datto RMM
Connect Datto RMM so the AI can run your scripts, including on-prem Active Directory work, from a ticket.
The Datto RMM integration connects Uniportal to your Datto RMM account, so the AI can see your managed devices and run the scripts you've built in Datto RMM as part of working a ticket.
Why on-prem Active Directory goes through your RMM
Cloud tools can't reach a customer's on-prem Active Directory. The domain controller sits behind the customer's firewall, and there's no API for Uniportal to call from outside. Your RMM agent is already running on that domain controller, with the local access it needs to manage AD, and you already trust it with that.
So instead of opening a port or installing yet another agent, Uniportal uses the RMM you already have. You write the script in Datto RMM, the way you'd script any AD task today. Uniportal runs it through Datto RMM when a ticket calls for it. The script does the AD work on the domain controller, and the AI never needs direct access to AD.
That split also keeps you in control of what's possible. The AI can only run the scripts you've built, with the inputs those scripts accept. If you haven't written a script that deletes users, the AI can't delete users.
Don't want to write the basics yourself?
The Uniportal Runner is a feature of this integration. You add one script to Datto RMM, once. It lets Uniportal run its own managed scripts for common tasks like creating a user or resetting a password. Those scripts are written and maintained by Uniportal, not by the AI. You can use it alongside your own scripts.
Prerequisites
- A Datto RMM user who can enable API access and generate API keys, which means access to Setup in Datto RMM.
- Admin/Owner role in your Uniportal tenant.
- Your customers already exist as companies in Uniportal, so you have something to map Datto RMM sites to. Companies come from Microsoft 365 or Google Workspace.
Setup
Turn on API access in Datto RMM
In Datto RMM, go to Setup > Global Settings > Access Control and turn on Enable API Access.
It's off by default, and while it's off, the user page has no API section at all. If you're looking for Generate API Keys in the next step and it isn't there, this is why.
Generate API keys
- Go to Setup > Users and open the user Uniportal will connect as.
- In the user's Security section, set:
- Component level: Super (5)
- Security Levels: administrator
- Default security level: administrator
- Click Generate API Keys.
- Copy the API URL, API Key, and API Secret Key.
The secret is shown only once. Copy it before you leave the screen, or you'll have to generate a new set of keys.
Both settings cap what Uniportal can do, and neither fails loudly when it's too low.
- Component level decides which components the user can run. Super (5) is the highest level, so it covers any component you build, whatever level you give it. Set it lower and the AI can't run your AD scripts at all.
- Security level decides which sites and devices the user can see. administrator covers every site. A site the security level doesn't cover is invisible to the AI, not an error.
Which components actually run is still up to you: the AI can only run the ones you've built, and only when a Skill and the tool's Mode allow it.
Connect Datto RMM in Uniportal
- In the Uniportal dashboard, go to Integrations and select Datto RMM.
- Enter the API URL, API Key, and API Secret Key from the previous step.
- Click Connect now.
Uniportal checks the credentials against Datto RMM before storing anything, so a typo fails here instead of on the first ticket.
Map sites to companies
From the Datto RMM integration page, map each Datto RMM site to the matching company in Uniportal.
Mapping is what lets the AI find the right device. When a ticket comes in from Dunder Mifflin asking for a new AD account, the AI already knows which Datto RMM site is theirs, and so which domain controller to run the script on, instead of searching every site you manage. A Skill that says "run this on the customer's domain controller" depends on it.
Control access to Datto RMM tools
Connecting Datto RMM adds its tools to the Agent Tools page. Set a Mode on each one, and use custom roles under Team & Roles to decide which technicians can use them. Running a script on a domain controller deserves more caution than looking up a device, so it's worth setting those separately.
Running AD workflows with scripts and Skills
The integration gives the AI the ability to run a script. A Skill tells it which script to run, when, and with what inputs. Put the two together and you get a repeatable AD workflow the AI can carry out from a ticket.
Build the script in Datto RMM
Create a component in Datto RMM for one AD task, taking the details it needs as input variables. Common ones:
- Create new AD user: first name, last name, username, OU, and groups.
- Reset password: username and the new password, with "must change at next logon" set.
- Enable account: username.
Keep each script to a single task. A script that only enables an account is easy to approve at a glance. One that takes an "action" parameter and does five different things is not.
Write a Skill that uses it
Write a Skill for the situation, say, "a manager requests a new AD account for a new hire." The instructions tell the AI what to check first, which Datto RMM component to run, which device to run it on (the customer's domain controller), what inputs to pass, and when to stop and ask a human.
The script handles the how. The Skill handles the judgment: confirming Michael Scott actually approved the new hire, picking the right OU for Scranton, and not resetting a password for someone who only emailed from a personal address.
You can write the Skill yourself or ask the AI Assistant to draft it from your notes.
Test it on a real ticket
Run it against a test ticket and a test account before trusting it with a customer. Check the job output in Datto RMM, not just the AI's summary, so you know the script did what the AI says it did.
Troubleshooting
Generate API Keys is missing from the user page
API access is turned off. Enable it under Setup > Global Settings > Access Control, then go back to the user.
Connection fails with credentials that look right
Check the API URL. Copy it from the Generate API Keys screen, not from your browser's address bar. The address bar shows the Datto RMM web interface host, which is a different host from the API. The API URL looks like https://vidal-api.centrastage.net, with -api in the name.
Some sites or devices are missing
The API user's security level doesn't cover them. Uniportal only sees what that level allows. Set the user's Security Levels and Default security level to administrator, then update the credentials in Uniportal if you generated new keys.
A script won't run
Check the API user's Component level. If it's below the level assigned to your component, Datto RMM won't let the user run it. Set it to Super (5).