Outsourced Support for Datto RMM

Separate the service and its working queue

Choose infrastructure monitoring and remediation, end-user requests or a defined allocation of engineering work. Then specify the actual working queue. Ask whether staff will work directly in your PSA and which remote-control features are included in the purchase.

For example, Benchmark365's Help Desk FAQ describes staff working in its own systems, with integrations carrying information to the buyer. Uptime's reviewed Datto RMM example belongs to its NOC Partner Portal. Kaseya's Help Desk terms name Datto RMM/VSA examples and separately required software subscriptions; that statement does not qualify its different NOC purchase.

Published service choices

These exact purchases name Datto RMM at service level. Use their dated descriptions as starting points, then confirm the current product version, permitted actions and ticket workflow. They are not a service-quality ranking or a completed integration test.

NOC purchases (6)

Help Desk purchases (5)

Name the active security level

Datto's security-level documentation ↗ (external website) distinguishes device visibility, feature permissions and remote-control tools. One security level is active at a time. Assigning another level does not combine its permissions with the active level; the operator can switch between assigned levels.

Identify the default level and every other level the supplier's operators can select. A narrow default is insufficient to describe their total available access if a broader assigned level can be activated. The Administrator level grants full account access and cannot be edited, so obtain the proposed scoped level instead of treating that built-in role as a customizable starting point.

Visibility has a practical consequence for NOC work: the documentation says dashboards are hidden from users who have only device access rather than full-site access, even with the global dashboard View permission enabled. Agree which queue or view the operator will actually use. A missing dashboard should lead to a defined workflow decision, rather than an unplanned grant of wider client access.

Define both ends of a remote session

The Web Remote documentation ↗ (external website) separates the technician's browser from the device being controlled. Sessions can be initiated from several browser platforms; controlled endpoints are Windows or macOS devices with a Managed Agent. A technician using Linux does not make a Linux endpoint controllable through that feature.

For macOS, Datto lists Accessibility, Full Disk Access and Screen Recording permissions for AEM Agent. Confirm approved OS versions, the required consent and the owner of a blocked connection. A service naming Datto RMM does not by itself accept every operating system or authorize a change to those permissions.

The same documentation notes that Web Remote and Splashtop need an active display for headless-device takeover, while describing RDP as a separate option. For unattended servers, name the intended connection method and its permission boundary in the scope. Screen control, chat, file transfer, PowerShell and component execution should each have an explicit allowed, approval-required or excluded status.

Separate Autotask permissions

If the workflow uses Autotask, its Web Remote companion documentation ↗ (external website) describes two different identities: an integration API user configured for Datto RMM and the operator's own permitted access. The companion requires account integration, the relevant Datto RMM tool permission and the operator's Advanced Datto RMM Integration access in Autotask.

The Web Remote Autotask Search toggle limits searching and viewing search results. The documentation also describes other paths to link a ticket from Autotask and to create a ticket from Web Remote when that search toggle is off. A search restriction alone therefore does not define all permitted ticket-writing actions. Have the proposed access cover creation, linking, updates and time entries separately.

Search results are scoped to the Autotask company linked to the remote device's Datto RMM site. Identify that company mapping before the trial and confirm the receiving queue, note audience and ticket owner. The Autotask Help Desk guide covers those PSA duties in more detail. Obtain the supplier's accepted workflow alongside the maker's feature description.

Keep activity history within its window

Datto's Activity Log documentation ↗ (external website) states 180-day retention. It describes device and user events, including Web Remote screen control, file transfer and PowerShell activity. Session start and end events are separate, and activity details are available through the Datto RMM API.

Agree who can retrieve the permitted history and preserve the references needed for handover before that window expires. Treat activity events, PSA ticket history, session output and any recordings as separate deliverables with their own retention and access rules. The event list does not supply a promise of a complete screen video or command transcript. Use the exit access and handover guide to assign those obligations alongside account and integration revocation.

Try five bounded cases

Example pilot cases. Agree the scope and expected results before running them.

1. One permitted site and one excluded site: the operator uses the named active level and the intended device or dashboard view; any ability to switch to another assigned level is reviewed explicitly.
2. A blocked remote session: the receiver identifies the endpoint, Agent and consent constraint, then hands the case to the authorized owner without an improvised workaround.
3. Autotask search disabled: the approved creation, linking and update boundaries are checked separately from search visibility, using authorized sample tickets.
4. A device-to-company mapping case: the ticket belongs to the intended Autotask company, with the agreed note audience and receiving owner.
5. A history handover: the operator finds the relevant start/end events and supplies the permitted references through the agreed route; missing output stays an open obligation.

Keep the first attempt and any correction in the existing NOC pilot log or Help Desk pilot log. Use the integration worksheet for the active level, site mapping, actions, error owner and revocation path. Add the chosen service, software fees, coverage and retained MSP work to the quote worksheet.