How to prevent users from adding virtual disks while allowing VM deployment from templates

Products

• VMware vCenter Server

Issue/Introduction

Administrators require a method to restrict users from adding new or existing virtual disks to Virtual Machines (VMs). This restriction must apply to both existing VMs and during new VM creation, without revoking the users' ability to deploy or clone VMs from templates located in the vCenter inventory or a Content Library.

Environment

VMware vCenter Server 

Cause

Standard deployment and configuration roles typically bundle virtual machine hardware modification privileges together. To enforce this specific restriction, a custom role must be configured to omit disk addition privileges while retaining general provisioning rights.

Resolution

1. Log in to the vSphere Client as an administrator.

2. Navigate to Administration > Access Control > Roles.

3. Select an existing role used for VM provisioning and click Clone role action, or click New to create a custom role from scratch.

4. Provide a name for the custom role.

5. In the privileges list, navigate to Virtual Machine > Configuration.

6. Uncheck the Add existing disk permission.

7. Uncheck the Add new disk permission.

8. Ensure all other required provisioning and interaction privileges remain intact.

9. Save the custom role.

10. Assign this custom role to the target users or groups at the appropriate vCenter Server, Datacenter, or Folder level.

Users assigned this custom role will successfully clone or deploy VMs from templates with their baseline disk configurations but will be blocked by permissions if they attempt to attach additional virtual disks.