6.5.1

n
If you assign a restrictive role to a group, check that the group does not contain the Administrator
user or other users with administrative privileges. Otherwise, you might unintentionally restrict
administrators' privileges in the parts of the inventory hierarchy where you have assigned that group
the restrictive role.
n
Use folders to group objects. For example, to grant modify permission on one set of hosts and view
permission on another set of hosts, place each set of hosts in a folder.
n
Use caution when adding a permission to the root vCenter Server objects. Users with privileges at the
root level have access to global data on vCenter Server, such as roles, custom attributes,
vCenter Server settings.
n
Consider enabling propagation when you assign permissions to an object. Propagation ensures that
new objects in the object hierarchy inherit permissions and are accessible to users.
n
Use the No Access role to mask specific areas of the hierarchy. The No Access role restricts access
for the users or groups with that role.
n
Changes to licenses propagate as follows:
n
To all vCenter Server systems that are linked to the same Platform Services Controller.
n
To Platform Services Controller instances in the same vCenter Single Sign-On domain.
n
License propagation happens even if the user does not have privileges on all vCenter Server
systems.
Required Privileges for Common Tasks
Many tasks require permissions on multiple objects in the inventory. If the user who attempts to perform
the task only has privileges on one object, the task cannot complete successfully.
The following table lists common tasks that require more than one privilege. You can add permissions to
inventory objects by pairing a user with one of the predefined roles or with multiple privileges. If you
expect that you assign a set of privileges multiple times, create custom roles.
If the task that you want to perform is not in this table, the following rules explain where you must assign
permissions to allow particular operations:
n
Any operation that consumes storage space requires the Datastore.Allocate Space privilege on the
target datastore, and the privilege to perform the operation itself. You must have these privileges, for
example, when creating a virtual disk or taking a snapshot.
n
Moving an object in the inventory hierarchy requires appropriate privileges on the object itself, the
source parent object (such as a folder or cluster), and the destination parent object.
n
Each host and cluster has its own implicit resource pool that contains all the resources of that host or
cluster. Deploying a virtual machine directly to a host or cluster requires the Resource.Assign
Virtual Machine to Resource Pool privilege.
vSphere Security
VMware, Inc. 37