6.1

n
Place all of the user's placeholder virtual machines in this folder, so that they can inherit its
permissions.
n
Do not assign permissions to access this folder to other users.
n
Assign dedicated resource pools, datastores, and networks to each user, and configure the permissions
in the same way as for folders.
CAUTION A deployment in which you isolate user resources still assumes trust between the vSphere sites.
Even though you can isolate user resources, you cannot isolate the users themselves. This is not a suitable
deployment if you must keep all users completely separate.
Viewing Tasks and Events in a Shared Recovery Site Configuration
In the Recent Tasks panel of the vSphere Client, users who have permissions to view an object can see tasks
that other users start on that object. All users can see all of the tasks that other users perform on a shared
resource. For example, all users can see the tasks that run on a shared host, datacenter, or the vCenter Server
root folder.
Events that all of the instances of Site Recovery Manager Server generate on a shared recovery site have
identical permissions. All users who can see events from one instance of Site Recovery Manager Server can
see events from all Site Recovery Manager Server instances that are running on the shared recovery site.
Assign Site Recovery Manager Roles and Permissions
During installation of Site Recovery Manager, users with the vCenter Server administrator role are granted
the administrator role on Site Recovery Manager. At this time, only vCenter Server administrators can log in
to Site Recovery Manager, unless they explicitly grant access to other users.
To allow other users to access Site Recovery Manager, vCenter Server administrators must grant them
permissions in the Site Recovery Manager interface in the vSphere Web Client. You assign site-wide
permission assignments on a per-site basis. You must add corresponding permissions on both sites.
Site Recovery Manager requires permissions on vCenter Server objects as well as on Site Recovery Manager
objects. To configure permissions on the remote vCenter Server installation, start another instance of the
vSphere Web Client. You can change Site Recovery Manager permissions from the same
vSphere Web Client instance on both sites after you connect the protected and recovery sites.
Site Recovery Manager augments vCenter Server roles and permissions with additional permissions that
allow detailed control over Site Recovery Manager specific tasks and operations. For information about the
permissions that each Site Recovery Manager role includes, see “Site Recovery Manager Roles Reference,”
on page 17.
You can assign more granular permissions to users by assigning them permissions on specific
Site Recovery Manager objects, including individual array managers, protection groups, and recovery plans.
You can also allow users to access specific groups of protections groups, recovery plans, and array managers
by assigning permissions to protection group and recovery plan folders, and to all of the array managers for
a site.
Procedure
1 In the vSphere Web Client, select the objects on which to assign permissions.
Option Description
Assign site-wide permissions
Click Site Recovery > Sites, and select a site.
Assign permissions to an individual
protection group
Click Site Recovery, expand Inventories, click Protection Groups, and
select a protection group.
Chapter 1 Site Recovery Manager Privileges, Roles, and Permissions
VMware, Inc. 15