vSphere Lifecycle Manager (vLCM) is missing from the vSphere Client UI due to NoPermission exceptions after vCenter Server upgrade

Products

• VMware vCenter Server

Issue/Introduction

After upgrading vCenter Server, the vSphere Lifecycle Manager (vLCM) / Update Manager option is no longer visible in the vSphere Client UI menu. Validation through the vCenter Managed Object Browser (MOB) and Client Plugins section shows the extension as deployed and visible.

However, the following explicit error signature is observed in the /var/log/vmware/vpshere-ui/log/vsphere_client_virgo.log file:

[YYYY-MM-DD]T 16:44:05] [INFO ] vum-ui-registration com.vmware.vise.vim.commons.vcservice.impl.VcServiceImpl Logging out of VC very quickly after login: https://<vCenter FQDN>:443/sdk (guid <System ID>, id 3002591, username null, sessionID null, clientId null)
[YYYY-MM-DDT 16:44:05] [INFO ] vum-ui-registration com.vmware.vise.util.debug.TimeMonitor VcServiceImpl logout: 4 milliseconds
[YYYY-MM-DDT 16:44:05] [WARN ] vum-ui-registration com.vmware.vum.client.registration.RegisterVumUiRemotePlugin Exception while processing plugin registration com.vmware.vim.binding.vim.fault.NoPermission: Permission to perform this operation was denied.
        at jdk.internal.reflect.GeneratedConstructorAccessor298.newInstance(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)

Environment

VMware vCenter Server 9.x

Cause

This issue occurs because the vsphere-ui solution user account lacks the necessary privileges to execute RegisterExtension within vpxd. The account is improperly assigned a Read-only role at the root folder level. This local Read-only assignment overrides the Global Permission required for the vSphere Client plugins to function correctly.

Resolution

• Removing the explicit permission from the root folder prevents conflicts where a local "Read-only" assignment overrides the "Global Permission" needed for the vSphere Client to function correctly.

  1. Access the vSphere Client utilizing Administrator credentials (e.g., [e-mail]).
  2. Navigate to Inventory and select the vCenter Server object at the very top of the hierarchy (the root node).
  3. Select the Permissions tab.
  4. Locate the principal user vsphere-webclient-<UUID> in the listed permissions.
  5. Review the Role column for this user.
  6. If the role is configured as Read-only, select the entry, select the user and click Remove (the 'X' icon).
  7. Refresh the vSphere Client UI to verify that the Lifecycle Manager is now visible.

Additional Information

If the vLCM plugin is entirely missing from the Managed Object Browser (MOB) or the vsphere_client_virgo.log reveals compatibility errors instead of permission denials, refer to the following related documentation regarding the compatibility matrix:

LifeCycle Manager is missing on vSphere UI , Unable to perform the ESXI upgrade