vCenter "Permission to perform this operation was denied. You do not hold privileges [Cryptographic operations > Encrypt new]" when creating a VM

Products

• VMware vCenter Server

Issue/Introduction

When a user with delegated permissions attempts to create or clone a virtual machine, the operation fails with the following error:

• Permission to perform this operation was denied.
You do not hold privileges "folder group-xxx : [Cryptographic operations > Encrypt new]"

Environment

VMware vCenter Server 7.x and 8.x

vSphere Client

vSphere RBAC environment using custom roles or folder-level permissions

Key Management Server (KMS) 

Cause

The target folder (group-v###) where the new VM is being created has explicit permissions assigned, which overrides inherited privileges from parent objects.

In vSphere’s Role-Based Access Control (RBAC) model:

• Privileges flow downward from parent to child objects.
• When a folder has an explicit permission set, it breaks inheritance from the higher-level (e.g., Datacenter or vCenter root).
• Even if the parent object grants Cryptographic operations → Encrypt new, the user will not have it on the folder unless explicitly re-applied.

 

Resolution

Option 1 – Grant privilege directly on the target folder

1. In vSphere Client, navigate to:
   Menu -> VMs and Templates ->Folder (e.g., group-vXXX)
2. Go to Permissions -> Add Permission.
3. Select the user or group.
4. Assign a role that includes the following privileges:
   • Cryptographic operations -> Encrypt new
   • Add disk, Clone, Decrypt, Encrypt, Manage keys, Recrypt, Register VM
5. Check Propagate to children (if you want subfolders or VMs to inherit).
6. Click OK and retry the operation.

Option 2 – Restore folder inheritance

1. Identify the folder with explicit permissions:
• Menu -> VMs and Templates -> Permissions
2. Remove or adjust the explicit entry that breaks inheritance.
3. Confirm the parent object (Datacenter or root vCenter) includes the necessary cryptographic privileges.
4. Retry the operation after re-login.

Additional Information

1.  vSphere Security Guide - How Permissions Are Applied
   • https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere-supervisor/8-0/understanding-authorization-in-vsphere.html

2. Broadcom KB 1023189 – vCenter Server and ESXi Role and Permission Model
   • https://knowledge.broadcom.com/external/article?legacyId=1023189