Permissions for vSphere Custom User Accounts

System

• Anonymous

• Read

• View

Acknowledge alarm

Required for vCenter 6.0 or later, to enable suppression of actions on triggered alarms.

Set alarm status

Required for vCenter 6.0 or later, to change the status of a configured alarm for an event.

Add Disk

Direct Access

Encrypt

Allocate space

Required to allocate space for a virtual machine, snapshot, clone, or virtual disk.

Browse datastore

Required to browse files on a datastore. Used to locate VM files on disk and verify that files exist.

Configure datastore

Required to configure a datastore.

Low level file operations

Required to perform read, write, delete, or rename operations for the datastore. Used to read virtual machine configuration files.

Remove datastore

(deprecated) Required to remove a datastore. The user or group privilege must be set for both the object and its parent object.

Rename datastore

Required to change the name of a datastore.

Remove file

(deprecated; use Low level file operations) Required to delete files in the datastore.

Update virtual machine files

Required to update virtual machine file paths on a datastore after a datastore resignature operation.

Register extension

Required to register a plug-in.

Unregister extension

Required to unregister a plug-in.

Update extension

Required to update a plug-in.

Cancel task

Required to cancel a running or queued task; used to cancel a relocation task if a restore job is killed.

Diagnostics

Required to get lists of diagnostic files, log headers, binary files, or diagnostic bundles. For security, limit this privilege to the vCenter Server Administrator role.

Disable methods

Required to disable specific operations on vCenter entities.

Enable methods

Required to enable specific operations on vCenter entities.

Licenses

Required to view installed licenses and to add or remove licenses.

Log event

Required to enable logging of user-defined events against a managed entity.

Manage custom attributes

Required to add, remove, or rename custom field definitions.

Set custom attribute

Required to view, create, or remove custom attributes for a managed entity.

Advanced settings

For live file recovery, Commvault software increases the NFS heartbeat timeout and the Max failures setting for additional resilience when mounting the datastore on the ESX server.

Connection

Required to change the connection status of a host (connected or disconnected). Used to confirm whether the ESX host is connected within the vCenter inventory.

Network configuration

Required to modify network, firewall or vMotion network settings. Used to configure destination network.

(Virtual Labs)

Storage partition configuration

Required for management of VMFS datastores and diagnostic partitions. This privilege enables users to scan for new storage devices and manage iSCSI. Used to rescan and check for new VMFS partitions and HBAs, and to refresh the datastore list when mounting a datastore to the ESX server during IntelliSnap operations.

System Management

Used to download VM configuration files directly from an ESX host. (If files cannot be downloaded directly, they are accessed through the vCenter.)

Assign network

Required to assign a network to a virtual machine. Used to create a virtual machine on a network.

Profile-driven storage update

Required to create and update storage capabilities and virtual machine storage profiles.

Profile-driven storage view

Required to view storage capabilities and storage profiles.

Assign vApp to resource pool

Required to assign a vApp to a resource pool during restores.

Assign virtual machine to resource pool

Required to assign a virtual machine to a resource pool. Required when registering a virtual machine to a resource pool during backups or when restoring to a resource pool.

(VM Archiving)

Migrate powered on virtual machine

Required to use vMotion to migrate a powered on virtual machine to a different resource pool or host.

Migrate powered off virtual machine ("Migrate" in vSphere 4.1)

Required to use vMotion to migrate a powered off virtual machine to a different resource pool or host.

Import

Required to import a vApp into vSphere.

vApp application configuration

Required to modify vApp application properties; used when reconfiguring an existing File Recovery Enabler for Linux.

vApp instance configuration

Required to modify a vApp instance; used when reconfiguring an existing File Recovery Enabler for Linux.

Acquire Disk lease (formerly "Disk lease")

Required to perform disk lease operations for a virtual machine.

Add existing disk

Required to add an existing virtual disk to a virtual machine.

Add new disk

Required to create a new virtual disk to add to a virtual machine.

Add or remove device

Required to add or remove any non-disk device. Used to add a SCSI controller or to restore non-disk device configuration.

Advanced configuration (formerly "Advanced")

Required to add or modify advanced parameters in a virtual machine configuration file.

Change CPU count

Required to change the number of virtual CPUs during restores.

Change Memory (formerly "Memory")

Required to change the amount of memory allocated to a virtual machine.

Change resource

Required to change the resource configuration of a set of virtual machine nodes in a given resource pool.

Change Settings (formerly "Settings")

Required to change general virtual machine settings.

Change Swapfile placement (formerly "Swapfile placement")

Required to change the swapfile placement policy for a virtual machine.

Configure Host USB device (formerly "Host USB device")

Required to attach a host-based USB device to a virtual machine.

Configure managedBy

Marks a virtual machine as being managed by Commvault during a restore.

Configure Raw device (formerly "Raw device")

Required to add or remove a raw disk mapping or SCSI pass through device (overrides other privileges for modifying raw devices, including connection states).

Display connection settings (not in vSphere 4.1)

Required to configure virtual machine remote console options.

Extend virtual disk

Required to expand the size of a virtual disk.

Modify device settings

Required to change the properties of an existing device.

Reload from path

Required to change a virtual machine configuration path while preserving the identity of the virtual machine; used during failover and failback operations.

Remove disk

Required to remove a virtual disk.

Rename

Required to rename a virtual machine or modify notes for a virtual machine.

Reset guest information

Required to edit the guest operating system information for a virtual machine.

Set annotation (not in vSphere 4.1)

Required to add or edit a virtual machine annotation. Used to set up a backup server annotation that records last backup times for target VMs in vSphere.

Toggle Disk change tracking (formerly "Disk change tracking")

Required to enable or disable change tracking for virtual machine disks.

Unlock virtual machine (only required for vCenter 6.0 or earlier versions)

Required to decrypt a virtual machine.

Upgrade virtual machine compatibility ("Upgrade virtual hardware" in vSphere 4.1)

Required to upgrade a virtual machine's compatibility version (virtual hardware version).

Create new

Required to create and allocate resources for a virtual machine.

Create from existing

Required to create a virtual machine, by cloning an existing virtual machine or by deploying from a template.

Move

Required to relocate a virtual machine in the hierarchy. The privilege must be set for both the source and the destination.

(VM Archiving)

Register

Required to add an existing virtual machine to a vCenter Server or host inventory. Required for IntelliSnap backups with metadata collection enabled, and to register a restored VM with the vCenter or host.

Remove

Required to delete a virtual machine and remove the underlying files from disk. The user or group privilege must be set for both the object and its parent object. Required for IntelliSnap backups with metadata collection enabled.

Unregister

Required to unregister a virtual machine from a vCenter Server or host inventory. The user or group privilege must be set for both the object and its parent object. Required for IntelliSnap backups with metadata collection enabled, and to unregister a VM so that it can be registered to a different location.

Guest Operation Modifications

Required to perform virtual machine guest operations that modify the guest operating system, such as transferring a file to the virtual machine or restoring files to a target VM that does not have a file system agent installed.

Guest Operation Program Execution

Required to perform virtual machine guest operations that execute a program in the virtual machine, such as a restore command.

Guest Operation Queries

Required to perform virtual machine guest operations that query the guest operating system, such as listing files in the guest operating system. Used when the target VM does not have a file system agent installed.

Connect devices (formerly "Device connection")

Required to change the connected state of virtual machine devices that can be disconnected.

Power Off

Required to power off the guest operating system of a powered on virtual machine. Used when restoring data to VMDKs.

(VM Archiving)

Power On

Required to power on a powered off virtual machine or resume a suspended virtual machine.

Reset

Required to reset a virtual machine and reboot the guest operating system.

Suspend

Required to suspend a powered on virtual machine and put the guest in standby mode.

Allow disk access

Required to open a disk on a virtual machine for random read and write access. Used for remote disk mounting and restoring data.

Allow read-only disk access

Required to open a disk on a virtual machine for random read access; used for remote disk mounting.

Allow virtual machine download

Required for read operations on files associated with a virtual machine, including vmx, disks, logs, and NVRAM.

Clone template

Required to clone a template.

Clone virtual machine

Required to clone an existing virtual machine and allocate resources. Used to create a linked clone from a source VM snapshot during backup.

Customize guest (formerly "Customize")

Required to customize a virtual machine's guest operating system without moving the virtual machine.

Deploy template

Required to deploy a virtual machine from a template.

Mark as template

Required to mark an existing powered off virtual machine as a template. Used to restore a virtual machine template.

Mark as virtual machine

Required to mark an existing template as a virtual machine.

Modify customization specification

Required to create, modify, or delete customization specifications.

Promote disks

Required to promote operations on virtual machine disks.

Read customization specifications

Required to read a customization specification.

Create snapshot

Required to create a snapshot from a virtual machine's current state.

Remove Snapshot

Required to remove a snapshot from the snapshot history.

Rename Snapshot

Required to change the name or description of a snapshot.

Revert to snapshot

Required to set a virtual machine to the state it was in for a specified snapshot.

Assign or Unassgn vSphere Tag

Required to change the assignment of a tag for an object in the vCenter Server inventory.

Create vSphere Tag

Required to create a tag for a restored VM.

Create vSphere Tag Category

Required to create a tag category.

Edit vSphere Tag

Required to edit a tag.

Edit vSphere Tag Category

Required to edit a tag category.

Modify UsedBy Field For Category

Required to modify the UsedBy field for a tag category.

Modify UsedBy Field For Tag

Required to modify the UsedBy field for a tag.