6.5.1

Permissions take several forms in the hierarchy:
Managed entities Privileged users can define permissions on managed entities.
n
Clusters
n
Data centers
n
Datastores
n
Datastore clusters
n
Folders
n
Hosts
n
Networks (except vSphere Distributed Switches)
n
Distributed port groups
n
Resource pools
n
Templates
n
Virtual machines
n
vSphere vApps
Global entities You cannot modify permissions on entities that derive permissions from the
root vCenter Server system.
n
Custom fields
n
Licenses
n
Roles
n
Statistics intervals
n
Sessions
Multiple Permission Settings
Objects might have multiple permissions, but only one permission for each user or group. For example,
one permission might specify that Group A has Administrator privileges on an object. Another permission
might specify that Group B might have Virtual Machine Administrator privileges on the same object.
If an object inherits permissions from two parent objects, the permissions on one object are added to the
permissions on the other object. For example, assume that a virtual machine is in a virtual machine folder
and also belongs to a resource pool. That virtual machine inherits all permission settings from both the
virtual machine folder and the resource pool.
Permissions applied on a child object always override permissions that are applied on a parent object.
See Example 2: Child Permissions Overriding Parent Permissions.
vSphere Security
VMware, Inc. 24