6.7

VMware recommends the following best practices when configuring roles and permissions in your
vCenter Server environment:
n
Where possible, assign a role to a group rather than individual users.
n
Grant permissions only on the objects where they are needed, and assign privileges only to users or
groups that must have them. Use the minimum number of permissions to make it easier to
understand and manage your permissions structure.
n
If you assign a restrictive role to a group, check that the group does not contain the Administrator
user or other users with administrative privileges. Otherwise, you might unintentionally restrict
administrators' privileges in the parts of the inventory hierarchy where you have assigned that group
the restrictive role.
n
Use folders to group objects. For example, to grant modify permission on one set of hosts and view
permission on another set of hosts, place each set of hosts in a folder.
n
Use caution when adding a permission to the root vCenter Server objects. Users with privileges at the
root level have access to global data on vCenter Server, such as roles, custom attributes,
vCenter Server settings.
n
Consider enabling propagation when you assign permissions to an object. Propagation ensures that
new objects in the object hierarchy inherit permissions. For example, you can assign a permission to
a virtual machine folder and enable propagation to ensure the permission applies to all VMs in the
folder.
n
Use the No Access role to mask specific areas of the hierarchy. The No Access role restricts access
for the users or groups with that role.
n
Changes to licenses propagate as follows:
n
To all vCenter Server systems that are linked to the same Platform Services Controller.
n
To Platform Services Controller instances in the same vCenter Single Sign-On domain.
n
License propagation happens even if the user does not have privileges on all vCenter Server
systems.
Required Privileges for Common Tasks
Many tasks require permissions on multiple objects in the inventory. If the user who attempts to perform
the task only has privileges on one object, the task cannot complete successfully.
The following table lists common tasks that require more than one privilege. You can add permissions to
inventory objects by pairing a user with one of the predefined roles or with multiple privileges. If you
expect that you assign a set of privileges multiple times, create custom roles.
If the task that you want to perform is not in this table, the following rules explain where you must assign
permissions to allow particular operations:
n
Any operation that consumes storage space requires the Datastore.Allocate Space privilege on the
target datastore, and the privilege to perform the operation itself. You must have these privileges, for
example, when creating a virtual disk or taking a snapshot.
vSphere Security
VMware, Inc. 35