6.0.3

Table 4‑3. Global Permissions Extend Tag-Level Permissions
Global Permission Tag-Level Permission Effective Permission
Lee has Assign or Unassign
vSphere Tag privilege.
Lee has Delete vSphere Tag
privilege.
Lee has the Assign vSphere Tag privilege and the
Delete vSphere Tag privilege for the tag.
No tagging privileges assigned. Lee has Delete vSphere Tag
privilege assigned for the tag.
Lee has the Delete vSphere Tag privilege for the
tag.
Using Roles to Assign Privileges
A role is a predened set of privileges. Privileges dene rights to perform actions and read properties. For
example, the Virtual Machine Administrator role consists of read properties and of a set of rights to perform
actions. The role allows a user to read and change virtual machine aributes.
When you assign permissions, you pair a user or group with a role and associate that pairing with an
inventory object. A single user or group can have dierent roles for dierent objects in the inventory.
For example, if you have two resource pools in your inventory, Pool A and Pool B, you can assign a
particular user the Virtual Machine User role on Pool A and the Read Only role on Pool B. These
assignments allow that user to turn on virtual machines in Pool A, but to only view virtual machines in Pool
B.
vCenter Server provides system roles and sample roles by default:
System roles
System roles are permanent. You cannot edit the privileges associated with
these roles.
Sample roles
VMware provides sample roles for certain frequently performed
combination of tasks. You can clone, modify or remove these roles.
N To avoid losing the predened seings in a sample role, clone the role
rst and make modications to the clone. You cannot reset the sample to its
default seings.
Users can schedule only tasks if they have a role that includes privileges to perform that task at the time the
tasks are created.
N Changes to roles and privileges take eect immediately, even if the users involved are logged in. The
exception is searches, where changes take eect after the user has logged out and logged back in.
Custom Roles in vCenter Server and ESXi
You can create custom roles for vCenter Server and all object it manages, or for individual hosts.
vCenter Server Custom
Roles (Recommended)
Create custom roles by using the role-editing facilities in the
vSphere Web Client to create privilege sets that match your needs.
ESXi Custom Roles
You can create custom roles for individual hosts by using a CLI or the
vSphere Client. See the vSphere Administration with the vSphere Client
documentation. Custom host roles are not accessible from vCenter Server.
If you manage ESXi hosts through vCenter Server, maintaining custom roles
in both the host and vCenter Server can result in confusion and misuse. In
most cases, dening vCenter Server roles is recommended.
Chapter 4 vSphere Permissions and User Management Tasks
VMware, Inc. 147