Avoid service accounts from logging into the vCenter vSphere UI

Products

• VMware vCenter Server

Issue/Introduction

When integrating 3rd-party applications, it is often necessary to create a dedicated service account to allow the external application to authenticate and perform required operations via the vCenter API.

However, administrators may notice that once a user or service account is granted any level of vCenter permissions, even if intended for API-only or application use, that account automatically gains access to the vCenter vSphere Client (UI).

Resolution

Currently, vCenter Server does not provide a built-in mechanism to restrict or disable UI logon capabilities for accounts with assigned permissions. As a result, a service account can log in to the vCenter UI once privileges are applied.

This behavior is by design. vCenter Server does not differentiate between accounts intended for API use and those for interactive use within the vSphere Client. Any account that has been assigned vCenter permissions (global or object-level) can authenticate via both API and UI interfaces.