Unable to select Networks when creating VM from Template after logging into vCenter as Domain user

Products

• VMware vCenter Server

Issue/Introduction

When deploying a Virtual Machine from a Template or OVF after logging into vCenter as a Domain User, the following behavior occurs:

• The "Select Network" page in the deployment wizard is empty or shows no available networks.
• The domain user has been assigned Global permissions on the Distributed Virtual Switch (DVS) as well as the “Propagate to children” option is enabled.
• Despite this, the user cannot view or select any port groups.

Environment

VMware vCenter 7.X

VMware vCenter 8.X

Cause

This occurs because the relationship between distributed switch and portgroup is not a direct parent-child relationship. Therefore, permissions set on the DVS do not propagate to its associated port groups—even if “Propagate to children” is selected.

For the DVS from https://vcsa_fqdn/mob/?moid=dvs-####

For the Distributed port group from https://vcsa_fqdn/mob/?moid=dvportgroup-####

Both the DVS and its port groups are independent children of the Network Folder. 

Resolution

The Distributed Port Group requires explicit permission with "Propagate to children" enabled for the particular domain user. Once that is completed, the domain user can select the required portgroup when deploying OVF templates.

1. Navigate to vCenter Networking, expand the Datacenter and locate the Distributed Virtual Switch (DVS).
2. Expand the DVS to see the list of Distributed Port Groups. 
3. Right-click the specific Port Group you want the domain user to access and select "Add Permission".
4. In the User/Group field, search for and select the domain user or group. Ensure that you check the box for "Propagate to children".
5. Click OK to save the changes and verify the inheritance by deploying VM from OVF template again.