Creating and assigning a role with privileges to create and manage virtual machine to a domain or local user/group

Products

• VMware vCenter Server

Issue/Introduction

This article provides steps to create and assign a role with privileges to create and manage virtual machine to a domain or local user/group.

Environment

• VMware vCenter Server 7.0.x
• VMware vCenter Server 8.0.x

Resolution

To create a role and assign the necessary privileges:

1. Open a vSphere Client connection to the vCenter Server.
2. Click Home > Administration > Roles > Add Role.
3. Give the new role a name, then select these Privileges:

• Datastore
  • Allocate space
  • Browse datastore
• Global
  • Cancel task
• Network
  • Assign network
• Resource
  • Assign virtual machine to resource pool
• Scheduled task
  • Create tasks
  • Modify task
  • Remove task
  • Run task
• Virtual machine
  • Change Configuration
    • Acquire disk lease
    • Add existing disk
    • Add new disk
    • Add or remove device
    • Advanced configuration
    • Change CPU count
    • Change Memory
    • Change Settings
    • Change resource
    • Modify device settings
    • Remove disk
    • Rename
    • Reset guest information
    • Upgrade virtual machine compatibility
  • Edit Inventory
    • Create from existing
    • Create new
    • Move
    • Register
    • Remove
    • Unregister
  • Interaction
    • Answer question
    • Configure CD media
    • Configure floppy media
    • Connect devices
    • Console interaction
    • Guest operating system management by VIX API
    • Install VMware Tools
    • Power off
    • Power on
    • Reset Suspend
  • Snapshot management
    • Create snapshot
    • Remove snapshot
    • Rename snapshot
    • Revert to snapshot

4. Add the permission at the highest level and set to propagate the permissions. Note: The permission must be assigned higher than just a virtual machine folder so that cluster, network, resource pool related privileges can be applied at the appropriate resource. Alternatively, set specific levels within vCenter Server:
   1. Click the Inventory object, then click the Permissions tab.
   2. Click on the plus (+) sign to Add Permissions.
   3. Under User, select the domain the user is located in
      Note: Leaving the Domain entry as (server) shows the vCenter Server's local Windows accounts.
   4. Find the user and assigned the newly created Role
   5. Deselect Propagate to Child Objects.