Permissions for vSphere Custom User Accounts

You can create a separate user account in vSphere for backup and restore operations.

When you create a user account, the following system permissions are automatically added to the account:

Category

Permission

System

  • Anonymous

  • Read

  • View

If you are creating a user account other than administrator, you can assign permissions to the role that is associated with the user account. The following tables show which vCenter permissions are required (√) for each Commvault role or component.

The vCenter user account must have permissions on the vCenter, datacenter, ESX server, resource pool, VM folder, and virtual machine levels for any virtual machines to be backed up and restored. The backup for a virtual machine fails if the user does not have permission on the vCenter, datacenter, and ESX server where the virtual machine resides. When you assign a user and role for a specific entity, select the option to propagate permissions to child objects, so that operations for virtual machines that use those entities are successful.

To ensure that backups and restores are successful, use the vSphere Client or Web Client to assign user permissions on each required entity.

To hide resources from a user, you can assign a "No access" user role to the entity.

To enable restores, assign both backup and restore permissions for the type of restore (from streaming or IntelliSnap backups).

By default, the following tables display settings for vSphere 7.0, but differences for earlier versions of vSphere are noted. Settings that are not available in vSphere 4.1 might be needed for features that require vSphere 5.0 or a more recent version.

When using VM File Recovery Plug-In, VM Provisioning, or Live Mount, assign permissions that are required for backups or restores and permissions for using that feature.

Live Recovery operations that use a Linux access node require the same permissions as IntelliSnap operations.

Disclaimer

The guidance in this topic is derived from information in vSphere Security: ESXi 6.0 and vCenter Server 6.0 and is updated through vSphere 7.0. For detailed and current information about vSphere privileges and permissions, refer to the appropriate VMware documentation. Commvault is not responsible for, and does not validate or confirm, the correctness or accuracy of any information provided here. All content in this section is provided "AS IS" and is not warranted by Commvault in any way.

Alarms Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Acknowledge alarm

Required for vCenter 6.0 or later, to enable suppression of actions on triggered alarms.

tick

tick

Set alarm status

Required for vCenter 6.0 or later, to change the status of a configured alarm for an event.

tick

tick

Cryptographic Operations Permissions

To back up and restore virtual machines using VMware VM-level encryption, the user account for the vCenter virtualization client must have the following permissions:

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Add Disk

tick

tick

tick

tick

tick

tick

Direct Access

tick

tick

Encrypt

tick

tick

tick

tick

tick

tick

Datastore Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Allocate space

Required to allocate space for a virtual machine, snapshot, clone, or virtual disk.

tick

tick

tick

tick

tick

Browse datastore

Required to browse files on a datastore. Used to locate VM files on disk and verify that files exist.

tick

tick

tick

tick

tick

Configure datastore

Required to configure a datastore.

tick

tick

tick

Low level file operations

Required to perform read, write, delete, or rename operations for the datastore. Used to read virtual machine configuration files.

tick

tick

tick

tick

tick

Remove datastore

(deprecated) Required to remove a datastore. The user or group privilege must be set for both the object and its parent object.

tick

tick

tick

Rename datastore

Required to change the name of a datastore.

tick

tick

Remove file

(deprecated; use Low level file operations) Required to delete files in the datastore.

tick

Update virtual machine files

Required to update virtual machine file paths on a datastore after a datastore resignature operation.

tick

tick

tick

Extension Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Register extension

Required to register a plug-in.

tick

tick

tick

Unregister extension

Required to unregister a plug-in.

tick

Update extension

Required to update a plug-in.

tick

Global Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Cancel task

Required to cancel a running or queued task; used to cancel a relocation task if a restore job is killed.

tick

tick

Diagnostics

Required to get lists of diagnostic files, log headers, binary files, or diagnostic bundles. For security, limit this privilege to the vCenter Server Administrator role.

tick

Disable methods

Required to disable specific operations on vCenter entities.

tick

tick

tick

tick

Enable methods

Required to enable specific operations on vCenter entities.

tick

tick

tick

tick

Licenses

Required to view installed licenses and to add or remove licenses.

tick

tick

tick

tick

Log event

Required to enable logging of user-defined events against a managed entity.

tick

Manage custom attributes

Required to add, remove, or rename custom field definitions.

tick

tick

tick

tick

Set custom attribute

Required to view, create, or remove custom attributes for a managed entity.

tick

tick

tick

tick

tick

Host - Configuration Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Advanced settings

For live file recovery, Commvault software increases the NFS heartbeat timeout and the Max failures setting for additional resilience when mounting the datastore on the ESX server.

tick

tick

Connection

Required to change the connection status of a host (connected or disconnected). Used to confirm whether the ESX host is connected within the vCenter inventory.

tick

tick

Network configuration

Required to modify network, firewall or vMotion network settings. Used to configure destination network.

tick (Virtual Labs)

Storage partition configuration

Required for management of VMFS datastores and diagnostic partitions. This privilege enables users to scan for new storage devices and manage iSCSI. Used to rescan and check for new VMFS partitions and HBAs, and to refresh the datastore list when mounting a datastore to the ESX server during IntelliSnap operations.

tick

tick

System Management

Used to download VM configuration files directly from an ESX host. (If files cannot be downloaded directly, they are accessed through the vCenter.)

tick

tick

tick

tick

Host - Inventory Permission

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Modify cluster

Required to perform full VM restore operations, restores of DRS settings (during in-place full VM restores), and periodic replication operations.

tick

tick

Network Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Assign network

Required to assign a network to a virtual machine. Used to create a virtual machine on a network.

tick

tick

tick

VM storage policies Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Update VM storage policies

Required to create and update storage capabilities and virtual machine storage policies.

tick

tick

View VM storage policies

Required to view storage capabilities and storage policies.

tick

tick

Resource Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Assign vApp to resource pool

Required to assign a vApp to a resource pool during restores.

tick

tick

Assign virtual machine to resource pool

Required to assign a virtual machine to a resource pool. Required when registering a virtual machine to a resource pool during backups or when restoring to a resource pool.

tick (VM Archiving)

tick

tick

tick

tick

Migrate powered on virtual machine

Required to use vMotion to migrate a powered on virtual machine to a different resource pool or host.

tick

tick

Migrate powered off virtual machine ("Migrate" in vSphere 4.1)

Required to use vMotion to migrate a powered off virtual machine to a different resource pool or host.

tick

tick

tick

vApp Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Import

Required to import a vApp into vSphere.

tick

tick

tick

vApp application configuration

Required to modify vApp application properties; used when reconfiguring an existing Linux access node.

tick

tick

tick

vApp instance configuration

Required to modify a vApp instance; used when reconfiguring an existing Linux access node.

tick

tick

tick

Virtual machine - Change Configuration Permissions

This category was formerly called "Virtual machine - Configuration."

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Acquire Disk lease (formerly "Disk lease")

Required to perform disk lease operations for a virtual machine.

tick

tick

tick

tick

Add existing disk

Required to add an existing virtual disk to a virtual machine.

tick

tick

tick

tick

tick

Add new disk

Required to create a new virtual disk to add to a virtual machine.

tick

tick

tick

tick

tick

Add or remove device

Required to add or remove any non-disk device. Used to add a SCSI controller or to restore non-disk device configuration.

tick

tick

tick

tick

tick

Advanced configuration (formerly "Advanced")

Required to add or modify advanced parameters in a virtual machine configuration file.

tick

tick

tick

tick

Change CPU count

Required to change the number of virtual CPUs during restores.

tick

tick

tick

Change Memory (formerly "Memory")

Required to change the amount of memory allocated to a virtual machine.

tick

tick

tick

Change resource

Required to change the resource configuration of a set of virtual machine nodes in a given resource pool.

tick

tick

tick

tick

tick

Change Settings (formerly "Settings")

Required to change general virtual machine settings.

tick

tick

tick

tick

tick

Change Swapfile placement (formerly "Swapfile placement")

Required to change the swapfile placement policy for a virtual machine.

tick

tick

tick

Configure Host USB device (formerly "Host USB device")

Required to attach a host-based USB device to a virtual machine.

tick

tick

Configure managedBy

Marks a virtual machine as being managed by Commvault during a restore.

tick

tick

Configure Raw device (formerly "Raw device")

Required to add or remove a raw disk mapping or SCSI pass through device (overrides other privileges for modifying raw devices, including connection states).

tick

tick

tick

Display connection settings (not in vSphere 4.1)

Required to configure virtual machine remote console options.

tick

Extend virtual disk

Required to expand the size of a virtual disk.

tick

tick

tick

Modify device settings

Required to change the properties of an existing device.

tick

tick

tick

Reload from path

Required to change a virtual machine configuration path while preserving the identity of the virtual machine; used during failover and failback operations.

tick

tick

tick

Remove disk

Required to remove a virtual disk.

tick

tick

tick

tick

tick

Rename

Required to rename a virtual machine or modify notes for a virtual machine.

tick

tick

tick

tick

tick

Reset guest information

Required to edit the guest operating system information for a virtual machine.

tick

tick

tick

Set annotation (not in vSphere 4.1)

Required to add or edit a virtual machine annotation. Used to set up a backup server annotation that records last backup times for target VMs in vSphere.

tick

tick

tick

tick

tick

Toggle Disk change tracking (formerly "Disk change tracking")

Required to enable or disable change tracking for virtual machine disks.

tick

tick

tick

tick

Unlock virtual machine (only required for vCenter 6.0 or earlier versions)

Required to decrypt a virtual machine.

tick

Upgrade virtual machine compatibility ("Upgrade virtual hardware" in vSphere 4.1)

Required to upgrade a virtual machine's compatibility version (virtual hardware version).

tick

tick

tick

Virtual Machine - Edit Inventory Permissions

This category was formerly called "Virtual Machine - Inventory."

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Create new

Required to create and allocate resources for a virtual machine.

tick

tick

tick

Create from existing

Required to create a virtual machine, by cloning an existing virtual machine or by deploying from a template.

tick

Move

Required to relocate a virtual machine in the hierarchy. The privilege must be set for both the source and the destination.

tick (VM Archiving)

tick

Register

Required to add an existing virtual machine to a vCenter Server or host inventory. Required for IntelliSnap backups with metadata collection enabled, and to register a restored VM with the vCenter or host.

tick

tick

tick

Remove

Required to delete a virtual machine and remove the underlying files from disk. The user or group privilege must be set for both the object and its parent object. Required for IntelliSnap backups with metadata collection enabled.

tick

tick

tick

tick

tick

Unregister

Required to unregister a virtual machine from a vCenter Server or host inventory. The user or group privilege must be set for both the object and its parent object. Required for IntelliSnap backups with metadata collection enabled, and to unregister a VM so that it can be registered to a different location.

tick

tick

tick

Virtual Machine - Guest Operations Permissions (Not in vSphere 4.1)

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Guest Operation Modifications

Required to perform virtual machine guest operations that modify the guest operating system, such as transferring a file to the virtual machine or restoring files to a target VM that does not have a file system agent installed.

tick

tick

tick

Guest Operation Program Execution

Required to perform virtual machine guest operations that execute a program in the virtual machine, such as a restore command.

tick

tick

tick

Guest Operation Queries

Required to perform virtual machine guest operations that query the guest operating system, such as listing files in the guest operating system. Used when the target VM does not have a file system agent installed.

tick

tick

tick

Virtual Machine - Interaction Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Connect devices (formerly "Device connection")

Required to change the connected state of virtual machine devices that can be disconnected.

tick

tick

tick

Power Off

Required to power off the guest operating system of a powered on virtual machine. Used when restoring data to VMDKs.

tick (VM Archiving)

tick

tick

tick

tick

Power On

Required to power on a powered off virtual machine or resume a suspended virtual machine.

tick

tick

tick

tick

Reset

Required to reset a virtual machine and reboot the guest operating system.

tick

Suspend

Required to suspend a powered on virtual machine and put the guest in standby mode.

tick

Virtual Machine - Provisioning Permissions

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Allow disk access

Required to open a disk on a virtual machine for random read and write access. Used for remote disk mounting and restoring data.

tick

tick

tick

Allow read-only disk access

Required to open a disk on a virtual machine for random read access; used for remote disk mounting.

tick

tick

tick

tick

tick

Allow virtual machine download

Required for read operations on files associated with a virtual machine, including vmx, disks, logs, and NVRAM.

tick

tick

tick

tick

tick

Clone template

Required to clone a template.

tick

Clone virtual machine

Required to clone an existing virtual machine and allocate resources. Used to create a linked clone from a source VM snapshot during backup.

tick

tick

tick

tick

tick

Customize guest (formerly "Customize")

Required to customize a virtual machine's guest operating system without moving the virtual machine.

tick

Deploy template

Required to deploy a virtual machine from a template.

tick

Mark as template

Required to mark an existing powered off virtual machine as a template. Used to restore a virtual machine template.

tick

tick

Mark as virtual machine

Required to mark an existing template as a virtual machine.

tick

Modify customization specification

Required to create, modify, or delete customization specifications.

tick

Promote disks

Required to promote operations on virtual machine disks.

tick

Read customization specifications

Required to read a customization specification.

tick

Virtual machine - Snapshot management Permissions ("Virtual machine - State" in vSphere 4.1)

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Create snapshot

Required to create a snapshot from a virtual machine's current state.

tick

tick

tick

tick

tick

Remove Snapshot

Required to remove a snapshot from the snapshot history.

tick

tick

tick

tick

tick

Rename Snapshot

Required to change the name or description of a snapshot.

tick

Revert to snapshot

Required to set a virtual machine to the state it was in for a specified snapshot.

tick

tick

tick

vSphere Tagging Permissions

Required for vCenter 6.5 or later, to restore tags as part of a full VM restore.

Permissions

Streaming

IntelliSnap and Live Recovery

Streaming and IntelliSnap

VM Lifecycle Management Provisioning

Live Mount

Backups and VM Archiving

Restores and Live Sync

Backups

Restores and Live Sync

Deploy Linux access node

VM File Recovery Plug-In

Assign or Unassgn vSphere Tag

Required to change the assignment of a tag for an object in the vCenter Server inventory.

tick

tick

Create vSphere Tag

Required to create a tag for a restored VM.

tick

tick

Create vSphere Tag Category

Required to create a tag category.

tick

tick

Edit vSphere Tag

Required to edit a tag.

tick

tick

Edit vSphere Tag Category

Required to edit a tag category.

tick

tick

Modify UsedBy Field For Category

Required to modify the UsedBy field for a tag category.

tick

tick

Modify UsedBy Field For Tag

Required to modify the UsedBy field for a tag.

tick

tick

Loading...