4.1

Site Recovery Manager Roles and Permissions
SRM uses vCenter roles and permissions but includes additional ones that allow fine-grained control over
SRM-specific tasks and operations.
SRM and vCenter
use the same authorization model. The set of permissions applied to or inherited by an object
determine the operations that are allowed on the object and the list of roles that can perform those operations.
To manage roles and permissions, you must log in to vCenter as an administrator.
NOTE To configure SRM, you must have vCenter permissions and SRM permissions. SRM-specific roles do
not include vCenter privileges. Without vCenter privileges, you do not have adequate permissions to perform
all SRM operations. In addition,vCenter roles do not provide any SRM privileges. Ensure that SRM users have
vCenter and SRM specific roles as appropriate.
For more information about vCenter roles and
permissions, see Managing Users, Groups, Roles, and Permissions
in the vSphere Client Help.
Site Recovery Manager Roles
SRM adds the following roles to the ones already defined on the vCenter Server:
n
Protection Groups Administrator—Set up and modify protection groups.
n
Protection SRM Administrator—Pair the protected and recovery sites, and configure inventory mappings.
n
Protection Virtual Machine Administrator—Set up and modify the protection characteristics of a protected
virtual machine.
n
Recovery Datacenter Administrator—View available datastores and customize recovered virtual
machines.
n
Recovery Host Administrator—Configure virtual machine components during recovery. If the recovery
host is a cluster, this permission must be assigned for the cluster object itself and for every host in the
cluster.
n
Recovery Inventory Administrator—View customization specifications for the recovery site.
n
Recovery Plans Administrator—Reconfigure protected and recovered virtual machines. Also grants the
ability to set up and run recovery.
n
Recovery SRM Administrator—Configure arrays and create protection profiles.
n
Recovery Virtual Machine Administrator—Create virtual at the recovery site machines and add them to
the resource pool. Also grants the ability to reconfigure and customize the recovery virtual machines when
a recovery plan is run.
SRM Administrative Tasks and Required Privileges
Some SRM administrative tasks are performed at the protected site, some at the recovery site, and some at both
sites. Specific privileges are required at each site. To perform all SRM administrative tasks at the protected and
recovery sites, you must be a vSphere administrator or have specific permissions.
You do not need to propagate the permissions to child objects, unless specified.
You must have the following permissions at the protected site:
n
Read-only at the vCenter root.
n
Read-only at the datacenter inventory object.
n
Protection Virtual Machine Administrator role at the virtual machine level (propagate).
Chapter 1 Administering VMware vCenter Site Recovery Manager
VMware, Inc. 17