6.1

Configuration Tasks for Self-Service Workflows and Unmanaged
Machines
You must run some configuration workflows to enable self-service features and management of virtual
machines that have not yet been added to a View pod.
1 Set access rights for delegated administrators on the GuestCredentialConfiguration and
SelfServicePoolConfiguration configuration elements in the View folder. See “Best Practices for
Managing Workflow Permissions,” on page 22.
2 Run the Add Guest Credential workflow, in the Configuration/Horizon Registration Configuration
folder, before using any of the workflows for registering unmanaged machines.
Unmanaged machines are virtual machines that are managed by a vCenter instance that has not been
added to View. That is, if you log in to View Administrator, and go to View Configuration > Servers >
vCenter Servers, you will not see the vCenter Server instance in the list.
You must register an unmanaged machine with a View Connection Server instance before you can add
the virtual machine to a manual desktop pool. To run the Add Guest Credential workflow, you must
have local or domain administrator credentials for the virtual machine.
3 Run the Manage Delegated Administrator Configuration for Registration workflow, in the
Configuration/Horizon Registration Configuration folder, to allow the specified delegated
administrator to use the guest credentials and access the datacenter or virtual machine folder that
contains the unmanaged virtual machine.
4 Run the appropriate Manage Self Service Pool Configuration workflow to specify which desktop and
application pools will be available for self-service workflows in the Workflows/vCAC folder.
n
For Horizon Air desktop pools, the Manage Self Service Pool Configuration workflow is located in
the Configuration/Horizon Air Configuration/Self Service Pool Configuration folder,
n
For desktop and application pools provided through a Horizon pod or federation, the Manage Self
Service Pool Configuration workflow is located in the Configuration/Self Service Pool
Configuration folder,
Best Practices for Managing Workflow Permissions
You can use Orchestrator to limit which personas can see and interact with the workflows. Ideally, only the
administrator interacts with workflows in vRealize Orchestrator. Delegated administrators and end users
should interact with the workflows through the vSphere Web Client or through vRealize Automation.
The Horizon vRealize Orchestrator plug-in installs a number of workflows that are organized into
directories in the vRealize Orchestrator UI. The API access and Business logic folders are not intended to
be modified because their contents form the building blocks of the other executable workflows. To prevent
unauthorized customization of workflows, as a best practice, for certain folders, remove edit permissions for
all users except the administrator.
IMPORTANT The suggested permission settings listed in this topic are required only if you want to hide the
CoreModules folder and the configuration elements inside the View folder from delegated administrators and
end users.
In the Workflows view, you can set the following access rights:
n
On the root folder in the left pane, set the access rights so that delegated administrators have only View
and Execute permissions.
n
On the Configuration folder and CoreModules folder, set the access rights so that delegated
administrators have no permissions, and therefore cannot even see the folders. This restriction will
override the permissions set at the root folder.
Using the Horizon vRealize Orchestrator Plug-In
22 VMware, Inc.