6.0.3

Procedure
1 Log in to vCenter Server with the vSphere Web Client.
2 Select Home, click Administration, and click Roles.
3 Select a role and click the Edit role action buon.
4 Select or deselect privileges for the role and click OK.
Best Practices for Roles and Permissions
Use best practices for roles and permissions to maximize the security and manageability of your
vCenter Server environment.
VMware recommends the following best practices when conguring roles and permissions in your
vCenter Server environment:
n
Where possible, assign a role to a group rather than individual users to grant privileges to that group.
n
Grant permissions only on the objects where they are needed, and assign privileges only to users or
groups that must have them. Using the minimum number of permissions makes it easier to understand
and manage your permissions structure.
n
If you assign a restrictive role to a group, check that the group does not contain the Administrator user
or other users with administrative privileges. Otherwise, you could unintentionally restrict
administrators' privileges in parts of the inventory hierarchy where you have assigned that group the
restrictive role.
n
Use folders to group objects. For example, if you want to grant modify permission on one set of hosts
and view permission on another set of hosts, place each set of hosts in a folder.
n
Use caution when adding a permission to the root vCenter Server objects. Users with privileges at the
root level have access to global data on vCenter Server, such as roles, custom aributes, vCenter Server
seings.
n
In most cases, enable propagation when you assign permissions to an object. This ensures that when
new objects are inserted in to the inventory hierarchy, they inherit permissions and are accessible to
users.
n
Use the No Access role to mask specic areas of the hierarchy if you do not want for certain users or
groups to have access to the objects in that part of the object hierarchy.
n
Changes to licenses propagate to all vCenter Server systems that are linked to the same
Platform Services Controller or to Platform Services Controllers in the same vCenter Single Sign-On
domain, even if the user does not have privileges on all of the vCenter Server systems.
Required Privileges for Common Tasks
Many tasks require permissions on more than one object in the inventory. You can review the privileges that
are required to perform the tasks and, where applicable, the appropriate sample roles.
The table below lists common tasks that require more than one privilege. You can add permissions to
inventory objects by pairing a user with one of the predened roles, or you can create custom roles with the
set of privileges that you expect to use multiple times.
If the task that you want to perform is not in this table, the following rules can help you determine where
you must assign permissions to allow particular operations:
n
Any operation that consumes storage space, such as creating a virtual disk or taking a snapshot,
requires the Datastore.Allocate Space privilege on the target datastore, as well as the privilege to
perform the operation itself.
vSphere Security
150 VMware, Inc.