6.5.1

Using Roles to Assign Privileges
A role is a predefined set of privileges. Privileges define rights to perform actions and read properties. For
example, the Virtual Machine Administrator role allows a user to read and change virtual machine
attributes.
When you assign permissions, you pair a user or group with a role and associate that pairing with an
inventory object. A single user or group can have different roles for different objects in the inventory.
For example, assume that you have two resource pools in your inventory, Pool A and Pool B. You can
assign group Sales the Virtual Machine User role on Pool A, and the Read Only role on Pool B. With
these assignments, the users in group Sales can turn on virtual machines in Pool A, but can only view
virtual machines in Pool B.
vCenter Server provides system roles and sample roles by default.
System roles System roles are permanent. You cannot edit the privileges associated with
these roles.
Sample roles VMware provides sample roles for certain frequently performed
combination of tasks. You can clone, modify, or remove these roles.
Note To avoid losing the predefined settings in a sample role, clone the
role first and make modifications to the clone. You cannot reset the sample
to its default settings.
Users can schedule tasks only if they have a role that includes privileges to perform that task at the time
the task is created.
Note Changes to roles and privileges take effect immediately, even if the users involved are logged in.
The exception is searches, where changes take effect after the user has logged out and logged back in.
Custom Roles in vCenter Server and ESXi
You can create custom roles for vCenter Server and all objects that it manages, or for individual hosts.
vCenter Server Custom
Roles (Recommended)
Create custom roles by using the role-editing facilities in the
vSphere Web Client to create privilege sets that match your needs.
ESXi Custom Roles You can create custom roles for individual hosts by using a CLI or the
VMware Host Client. See the vSphere Single Host Management - VMware
Host Client documentation. Custom host roles are not accessible from
vCenter Server.
If you manage ESXi hosts through vCenter Server, do not maintain custom
roles in both the host and vCenter Server. Define roles at the
vCenter Server level.
vSphere Security
VMware, Inc. 33