5.5

SRM and vSphere Replication Roles
When you install vSphere Replication with SRM, the vCenter Server administrator role inherits all of the
SRM and vSphere Replication privileges.
If you manually assign an SRM role to a user or user group, or if you assign an SRM role to a user or user
group that is not a vCenter Server administrator, these users do not obtain vSphere Replication privileges.
The SRM roles do not include the privileges of the vSphere Replication roles. For example, the SRM
Recovery Administrator role includes the privilege to run recovery plans, including recovery plans that
contain vSphere Replication protection groups, but it does not include the privilege to configure
vSphere Replication on a virtual machine. The separation of the SRM and vSphere Replication roles allows
you to distribute responsibilities between different users. For example, one user with the VRM
administrator role is responsible for configuring vSphere Replication on virtual machines, and another user
with the SRM Recovery Administrator role is responsible for running recoveries.
In some cases, a user who is not vCenter Server administrator might require the privileges to perform both
SRM and vSphere Replication operations. To assign a combination of SRM and vSphere Replication roles to
a single user, you can add the user to two user groups.
Example: Assign SRM and vSphere Replication Roles to a User
By creating two user groups, you can grant to a user the privileges of both an SRM role and a
vSphere Replication role, without that user being a vCenter Server administrator.
1 Create two user groups.
2 Assign an SRM role to one user group, for example SRM administrator.
3 Assign a vSphere Replication role to the other user group, for example VRM administrator.
4 Add the user to both user groups.
The user has all the privileges of the SRM administrator role and of the VRM administrator role.
Managing Permissions in a Shared Recovery Site Configuration
You can configure SRM to use with a shared recovery site. The vCenter Server administrator on the shared
recovery site must manage permissions so that each customer has sufficient privileges to configure and use
SRM, but no customer has access to resources that belong to another customer.
In the context of a shared recovery site, a customer is the owner of a pair of SRM Server instances.
Customers with adequate permissions must be able to access the shared recovery site to create, test, and run
the recovery plans for their own protected site. The vCenter Server administrator at the shared recovery site
must create a separate user group for each customer. No customer's user accounts can be a member of the
vCenter Server Administrators group. The only supported configuration for a shared recovery site is for one
organization to manage all of the protected sites and the recovery site.
CAUTION Certain SRM roles allow users to run commands on SRM Server, so you should assign these roles
to trusted administrator-level users only. See “SRM Roles Reference,” on page 14 for the list of SRM roles
that run commands on SRM Server.
On a shared recovery site, multiple customers share a single vCenter Server instance. In some cases,
multiple customers can share a single ESXi host on the recovery site. You can map the resources on the
protected sites to shared resources on the shared recovery site. You might share resources on the recovery
site if you do not need to keep all of the customers' virtual machines separate, for example if all of the
customers belong to the same organization.
Chapter 1 SRM Privileges, Roles, and Permissions
VMware, Inc. 11