6.7

Understanding Authorization in vSphere
vSphere supports several models with fine-grained control for determining whether a user is allowed to
perform a task. vCenter Single Sign-On uses group membership in a vCenter Single Sign-On group to
decide what you are allowed to do. Your role on an object or your global permission determines whether
you're allowed to perform other tasks in vSphere.
Authorization Overview
vSphere 6.0 and later allows privileged users to give other users permissions to perform tasks. You can
use global permissions, or you can use local vCenter Server permissions to authorize other users for
individual vCenter Server instances.
vCenter Server
Permissions
The permission model for vCenter Server systems relies on assigning
permissions to objects in the object hierarchy. Each permission gives one
user or group a set of privileges, that is, a role for a selected object. For
example, you can select a virtual machine and select Add Permission
assign a role to a group of users in a domain that you select. That role
gives those users the corresponding privileges on the VM.
Global Permissions Global permissions are applied to a global root object that spans solutions.
For example, if both vCenter Server and vRealize Orchestrator are
installed, you can use global permissions. For example, you can give a
group of users Read permissions to all objects in both object hierarchies.
Global permissions are replicated across the vsphere.local domain. Global
permissions do not provide authorization for services managed through
vsphere.local groups. See Global Permissions.
Group Membership in
vCenter Single Sign-On
Groups
Members of a vsphere.local group can perform certain tasks. For example,
you can perform license management if you are a member of the
LicenseService.Administrators group. See the Platform Services Controller
Administration documentation.
ESXi Local Host
Permissions
If you are managing a standalone ESXi host that is not managed by a
vCenter Server system, you can assign one of the predefined roles to
users. See the vSphere Single Host Management - VMware Host Client
documentation.
For managed hosts, assign roles to the ESXi host object in the
vCenter Server inventory.
vSphere Security
VMware, Inc. 19