VMware ESXi and vSphere Cluster Management

Create a Custom Role in VMware vSphere

Learn how to create a least-privilege custom role in vCenter Server using the vSphere Web Client, assign it safely, and test a VM Creator example.

A custom vSphere role is a named collection of privileges designed for a specific job function. This lesson shows how to create a least-privilege role in vCenter Server for delegated virtual machine creation, then assign and test it safely.

The exact labels and navigation may vary slightly between vSphere versions, but the role-design principles remain the same.

Prerequisites

• Basic knowledge of vSphere and vCenter Server navigation.
• Familiarity with the vCenter inventory hierarchy.
• A user or group in the configured identity source.
• An understanding of authentication versus authorization.
• Basic knowledge of virtual machines, datastores, virtual networks, and resource pools.

Understand roles, privileges, and permissions

vCenter Server is the centralized management platform where vSphere inventory, roles, and permissions are administered. The vSphere Web Client is its web-based administrative interface.

A role defines what actions are allowed, but it does not grant access by itself. The role becomes effective only after it is assigned to a user or group on an inventory object.

An inventory object is a managed vSphere object such as a folder, datacenter, cluster, resource pool, datastore, network, or virtual machine. A permission connects the role to one of these objects.

Why create a custom role?

vCenter Server includes built-in system roles and sample roles. Those roles are useful for common responsibilities, but they may not match every operational task. For example, a person who provisions VMs may not need broad administrator access.

A custom role is a reusable privilege set tailored to a job function or delegated task. It can help you separate VM deployment from unrelated administrative operations.

Least privilege means granting only the minimum access required for a defined task. Fewer privileges reduce the chance of accidental changes and limit the impact if an account is misused or compromised.

Plan the role before creating it

Write down the intended workflow and its boundaries first. For a VM creation role, answer questions such as:

• Which user or group will perform the task?
• Which VM folder may contain new VMs?
• Which datastores may hold VM files and virtual disks?
• Which virtual networks may be assigned?
• Which cluster, host, or resource pool may receive the VM?
• Will the operator only create VMs, or also edit, power on, or reconfigure existing VMs?

Choose a descriptive role name

Use a name that describes the task rather than the person’s general status. VM-Creator is clearer than Operator because it communicates the intended responsibility.

Where useful, include the task, scope, and environment in the name. Examples include:

• VM-Creator for a general VM provisioning function.
• VM-Creator-Development for a role intended for development inventory.
• VM-Creator-ClusterA-Production when the role is tied to a specific operational boundary.

Open role management in the vSphere Web Client

1. Sign in to the vSphere Web Client with an account authorized to manage vCenter roles.
2. Open the vCenter administration area.
3. Open the Roles section. This view lists existing system, sample, and custom roles.
4. Start the workflow by selecting the control used to create a role, such as Create Role.

The role-management view is for defining the privilege set. It is separate from the permissions view used later to assign the role to a user or group.

Create the custom role

1. In the Create Role workflow, enter a descriptive name, such as VM-Creator.
2. Expand the hierarchical privilege tree.
3. Select only the privileges required by the planned workflow.
4. Review the selected categories and remove anything unrelated to VM creation.
5. Save the role.
6. Return to the Roles list and confirm that the new role appears.

Saving the role does not assign it to anyone. Creation and assignment are two separate administrative operations.

Worked example: create a VM-Creator role

Assume a delegated user must create virtual machines without receiving broad administrator access. The example role supports VM provisioning with storage, networking, compute placement, hardware configuration, interaction, and inventory creation.

Privilege names and grouping can differ between vSphere releases. Use the privilege tree presented by your vSphere Web Client and verify each selected privilege against the operation it supports.

Assign the role to a user or group

The new role must be assigned through vCenter permissions before it becomes effective.

1. Open the inventory object where the delegated access should begin, such as a VM folder, datacenter, cluster, resource pool, datastore, or network.
2. Open the permissions management view for that object.
3. Add the intended user or group.
4. Select the VM-Creator custom role.
5. Choose whether permission inheritance should apply to child objects.
6. Save the permission assignment.

Permission inheritance is the application of a permission from a parent inventory object to its child objects when inheritance is enabled. Inheritance can simplify administration, but it can also grant access more broadly than intended.

Use the narrowest suitable assignment scope. A VM-folder assignment may cover creation of the VM object, but the principal also needs access to every supporting object involved in the workflow, including the target datastore, network, and resource pool. A role assigned only to a VM folder does not automatically provide access to an unrelated datastore or network.

Verify the role and test the workflow

1. Confirm that VM-Creator is visible in the Roles list.
2. Confirm that the intended user or group has a permission assignment using that role.
3. Check the assignment object and inheritance setting.
4. Sign in with a non-administrator test account that represents the delegated user.
5. Attempt to create a VM using the approved folder, datastore, network, and resource pool.
6. Confirm that the VM can be configured with the required memory, disks, and virtual devices.
7. Record any denied operation and identify the specific missing privilege.
8. Add only that privilege, then repeat the test.

Testing with a non-administrator account is essential. An administrator account can hide missing privileges because it already has broad access.

Troubleshoot common failures

The role exists, but the user cannot create a VM

• Confirm that the role was assigned to the correct user or group.
• Check that the assignment covers the target VM folder or other required inventory object.
• Review whether inheritance is enabled and applies to the target object.
• Verify access to the selected folder, datastore, network, and resource pool.

The user cannot select a datastore

• Verify that the datastore is visible to the user.
• Confirm that Datastore > Allocate space is selected.
• Check that the role is assigned on the required datastore or an appropriate parent object, not only on the VM folder.

The user cannot connect the VM to a network

• Confirm Network > Assign network.
• Verify that the user or group has access to the intended network or port group.

The user cannot place the VM in the resource pool

• Confirm Resource > Assign virtual machine to resource pool.
• Review permissions on the destination resource pool and relevant parent objects, such as the cluster or host.

The wizard fails while configuring memory, disks, or devices

• Compare the failed operation with the selected virtual machine configuration privileges.
• Check Virtual machine > Configuration > Add new disk, Add or remove device, and Memory as applicable.
• Add only the specific missing privilege and retest the same operation.

Maintain and document the role

Roles should be reviewed when workflows, VM hardware requirements, vSphere versions, or organizational duties change. A role that was minimal for one process may become too broad or too limited after those changes.

Document at least:

• The role name and operational purpose.
• The approved privileges and the reason for each one.
• The users or groups assigned to the role.
• The target inventory objects and inheritance settings.
• The test account and workflow used for validation.
• The date and owner of the most recent review.

For a user who currently has a general administrator-like role only to deploy VMs, identify the exact creation tasks, replace the broad assignment with a narrowly scoped VM-Creator role, test the complete workflow, and add privileges only when a required operation fails.

Exam-relevant notes

• A role is a collection of privileges; it does not grant access until assigned through a permission.
• Permissions combine a principal, a role, and an inventory object or scope.
• Least privilege means selecting only the privileges required for the defined task.
• Inheritance can extend a parent permission to child inventory objects.
• A VM creation workflow can require access to supporting objects such as datastores, networks, and resource pools, not just the VM folder.
• Creating a role and assigning a role are separate steps.

Summary

To create a secure custom vSphere role, define the operational task, select the smallest required privilege set in the Roles section of the vSphere Web Client, save and verify the role, then assign it at the narrowest suitable inventory scope. For VM creation, include storage allocation, network assignment, resource-pool placement, required VM configuration and interaction privileges, and VM inventory creation. Finally, test with a non-administrator account and maintain documentation as the environment changes.

For the next permission-management task, see Create a Custom Role in VMware vSphere.