6.7

Global Permissions Complement Tag Object Permissions
Global permissions, that is, permissions that are assigned on the root object, complement permissions on
tag objects when the permissions on the tag objects are more restrictive. The vCenter Server permissions
do not affect the tag objects.
For example, assume that you assign the Delete vSphere Tag privilege to user Robin at the root level by
using global permissions. For the tag Production, you do not assign the Delete vSphere Tag privilege to
Robin. In that case, Robin has the privilege for the tag Production because Robin has the global
permission. You cannot restrict privileges unless you modify the global permission.
Table 2‑2. Global Permissions Complement Tag-Level Permissions
Global Permission Tag-Level Permission Effective Permission
Robin has Delete vSphere Tag
privileges
Robin does not have Delete
vSphere Tag privileges for the
tag.
Robin has Delete vSphere Tag privileges.
No tagging privileges assigned Robin does not have Delete
vSphere Tag privileges assigned
for the tag.
Robin does not have Delete vSphere Tag privileges
Tag-Level Permissions Can Extend Global Permissions
You can use tag-level permissions to extend global permissions. That means users can have both a
global permission and a tag-level permission on a tag.
Table 2‑3. Global Permissions Extend Tag-Level Permissions
Global Permission Tag-Level Permission Effective Permission
Lee has Assign or Unassign
vSphere Tag privilege.
Lee has Delete vSphere Tag
privilege.
Lee has the Assign vSphere Tag privilege and the
Delete vSphere Tag privilege for the tag.
No tagging privileges assigned. Lee has Delete vSphere Tag
privilege assigned for the tag.
Lee has the Delete vSphere Tag privilege for the tag.
Using Roles to Assign Privileges
A role is a predefined set of privileges. Privileges define rights to perform actions and read properties. For
example, the Virtual Machine Administrator role allows a user to read and change virtual machine
attributes.
When you assign permissions, you pair a user or group with a role and associate that pairing with an
inventory object. A single user or group can have different roles for different objects in the inventory.
For example, assume that you have two resource pools in your inventory, Pool A and Pool B. You can
assign group Sales the Virtual Machine User role on Pool A, and the Read Only role on Pool B. With
these assignments, the users in group Sales can turn on virtual machines in Pool A, but can only view
virtual machines in Pool B.
vSphere Security
VMware, Inc. 31