6.0.3

Figure 4‑4. Example 2: Child Permissions Overriding Parent Permissions
VM A
VM B
VM Folder
group B + role 2
user 1 has privileges
of role 1 only
user 1 has privileges
of role 2 only
group A + role 1
Example 3: User Role Overriding Group Role
This example illustrates how the role assigned directly to an individual user overrides the privileges
associated with a role assigned to a group.
In this example, permissions are dened on the same object. One permission associates a group with a role,
the other permission associates an individual user with a role. The user is a member of the group.
n
Role 1 can power on virtual machines.
n
Group A is granted Role 1 on VM Folder.
n
User 1 is granted No Access role on VM Folder.
User 1, who belongs to group A, logs on. The No Access role granted to User 1 on VM Folder overrides the
role assigned to the group. User 1 has no access to VM Folder or VMs A and B.
Figure 4‑5. Example 3: User Permissions Overriding Group Permissions
VM A
VM B
VM Folder
user 1 + no access
user 1 has no access to the folder
or the virtual machines
group A + role 1
Managing Permissions for vCenter Components
A permission is set on an object in the vCenter object hierarchy. Each permission associates the object with a
group or user and the group's or user's access roles. For example, you can select a virtual machine object,
add one permission that gives the ReadOnly role to Group 1, and add a second permission that gives the
Administrator role to User 2.
By assigning a dierent role to a group of users on dierent objects, you control the tasks that those users
can perform in your vSphere environment. For example, to allow a group to congure memory for the host,
select that host and add a permission that grants a role to that group that includes the
Host..Memory  privilege.
Chapter 4 vSphere Permissions and User Management Tasks
VMware, Inc. 141