Allowing specific user accounts to manage specific virtual machines

Products

• VMware vCenter Server

Issue/Introduction

In vSphere Client, while operations for hosts and virtual machines are typically performed by administrators, certain requirements may necessitate granting minimal permissions to non-administrator accounts to allow them to manage specific virtual machines only.

This document provides a configuration example for the scenario described above.

Prerequisites:   

• A non-administrator user account must be created to assign permissions for specific virtual machines.
• The user account will be restricted to only the following actions for the designated virtual machines:
  • Opening a Web Console connection
  • Power On
  • Power Off

Environment

• VMware vCenter Server
• VMware vSphere ESXi

Resolution

 Steps to create a user account and roles to achieve the prerequisites:

1. Create a user account:
   1. Login to vSphere Client by administrator account. 
   2. Choose Administration > Single Sign-On > Users and Groups 
   3. At Users and Groups menu, choose "Domain" to vsphere.local
   4. Click ADD icon and create a user account (e.g. Username : testuser1)
   5. The created user "testuser1" account is listed in Users and Groups menu.
      
2. Create a role:
   1. Login to vSphere Client by administrator account.  
   2. Choose Administration > Access Control > Roles
   3. Click NEW and create a role with the following privileges:
         - Role name: VMInteractionUserRole 　　　　
         - Roles : "Power on", "Power off", and "Console interaction" under Virtual machine >  Interaction
      　Note:"Role name" is a sample and can be replaced with any other unique name.
   4. After creating the new role, the assigned privileges can be confirmed by selecting it in the role list:
      
3. Assign the role to the user account:
   
   1. Choose the target VM in the inventory, right click and select Add Permission
      
4. Select the user account and the role created by the above steps, then click OK.
   
5. Login to vSphere Client by [email protected] account.
6. Confirm only Power On, Power Off and Web Console connection are allowed to the target VM. 

Additional Information

Limitations:

• Logs and Events Visibility: It is currently not possible to configure a custom role that grants VM power/console access while completely restricting a user's ability to view logs, tasks, or events for that VM.
• System-Defined Privileges: When any role is assigned to an inventory object, vCenter automatically appends hidden base privileges (System.Anonymous, System.View, and System.Read). These privileges are required for the user to view the object in the inventory hierarchy and inherently grant visibility into the object's state, including its tasks and events history.