VMware ESXi and vSphere Cluster Management
vCenter Single Sign-On Deployment Modes: Basic, High Availability, and Multi-Site Linked Mode
Learn how to choose basic, same-site, or multi-site vCenter SSO deployment modes based on scale, high availability, geography, replication, and Linked Mode requirements.
vCenter Single Sign-On (SSO) is the authentication service used by vCenter Server components. It validates administrator identities and supports access to vCenter services. SSO deployment planning determines how many SSO nodes exist and where those nodes are placed.
An SSO node is an installed instance of the vCenter SSO service. In a single-node design, one node provides the SSO service. In a multi-node design, the nodes use replication to synchronize SSO information. They are therefore part of one shared SSO deployment rather than unrelated standalone services.
The appropriate topology depends on the number of vCenter Server systems, inventory scale, availability requirements, physical locations, and whether administrators need Linked Mode. A deployment mode describes the SSO topology; it is not the same thing as the ordinary workflow used to install vCenter Server.
Overview of the Three Deployment Modes
The three deployment choices are:
- Basic deployment mode: one SSO node.
- Multiple SSO instances at the same location: a primary SSO instance and one or more additional nodes at one physical site.
- Multiple SSO instances in multiple locations: participating SSO nodes distributed across geographically separated sites.
Multiple-node modes depend on replication. Replication synchronizes SSO information among the participating nodes. In a same-site design, this relationship supports SSO high availability. In a multi-site design, it supports shared administration for geographically distributed vCenter Server deployments, including Linked Mode requirements.
Basic Deployment Mode
Basic deployment mode contains one SSO node. It is the common choice for a single vCenter Server environment that does not require an additional SSO node for service redundancy.
The planning scale cited for this mode is up to 1,000 hosts and 10,000 virtual machines. These figures are planning guidance for selecting the mode; they do not by themselves determine every sizing or performance decision.
When to use basic mode
- There is one vCenter Server environment.
- The inventory is within the stated planning scale.
- SSO high availability is not a requirement.
- A simple deployment and administration model is preferred.
- vCenter Server is being deployed as a vCenter Server Appliance for a single environment.
Basic mode is associated with the vCenter Simple Install workflow. The single-node design reduces infrastructure and replication planning. Its trade-off is equally important: there is no additional SSO node to provide SSO service redundancy.
Multiple SSO Instances at the Same Location
A same-site topology contains one primary SSO instance and one or more additional SSO nodes at the same physical location. The primary instance is the initial SSO instance in the topology. Additional nodes extend that topology rather than creating independent authentication islands.
The nodes replicate SSO information between one another. This shared-data relationship is the foundation of the design's high-availability objective. If continued SSO availability within one physical location is important, multiple local nodes are more appropriate than basic mode.
Advantages and planning considerations
- Improves SSO service resilience within one site.
- Provides multiple SSO nodes instead of relying on only one node.
- Supports an environment with one primary node and one or more local peers.
- Requires additional infrastructure compared with basic mode.
- Requires planning for replication and the operational relationship among the nodes.
This design is appropriate when the organization needs SSO high availability at a single site, even if it operates only one primary vCenter environment.
Multiple SSO Instances in Multiple Locations
A multi-location topology places participating SSO nodes in geographically separated locations. The nodes replicate SSO information across those locations, creating a shared SSO relationship for the distributed deployment.
The principal use case is a geographically distributed vCenter Server deployment. This mode is needed when distributed vCenter Servers must be administered through Linked Mode. Linked Mode is a vCenter administration arrangement that allows administrators to manage geographically distributed vCenter Server systems through a coordinated administrative experience.
Multi-site planning requirements
- Determine which SSO nodes belong at each participating location.
- Evaluate inter-site connectivity before placing nodes across sites.
- Confirm that replication can operate reliably between locations.
- Plan for the added operational complexity of multi-site administration.
- Verify that the topology matches the Linked Mode requirement rather than treating each site as an unrelated SSO installation.
Geographic separation alone does not automatically make a multi-site design necessary. The requirement is strongest when vCenter Server systems are distributed and must be administered through Linked Mode.
Comparison of vCenter SSO Deployment Modes
| Deployment mode | Number and placement of SSO nodes | Primary use case | High availability characteristic | Geographic scope | Linked Mode relevance | Notable planning guidance |
|---|---|---|---|---|---|---|
| Basic deployment mode | One SSO node | One vCenter Server environment | No additional SSO node for service redundancy | One location | Not the primary reason to select this mode | Suitable within the stated scale of up to 1,000 hosts and 10,000 virtual machines; associated with vCenter Server Appliance and vCenter Simple Install use cases |
| Multiple instances in the same location | One primary SSO instance plus one or more additional local SSO nodes | SSO high availability within one physical site | Multiple nodes improve SSO service availability at the site | One physical location | Not the defining use case | Plan infrastructure, node relationships, and replication |
| Multiple instances in multiple locations | Participating SSO nodes distributed across separate locations | Geographically distributed vCenter Server deployments | Supports a distributed SSO topology through replicated information | Multiple geographic locations | Needed when distributed vCenter Servers require Linked Mode administration | Evaluate inter-site connectivity and replication reliability |
Replication Relationships
Replication is the synchronization of SSO information among SSO nodes. It is not an optional concept to ignore after installing multiple nodes. The nodes must be planned as participants in a shared-data relationship.
Replication serves two related purposes:
- In a same-site topology, it supports the high-availability goal by maintaining SSO information among local nodes.
- In a multi-site topology, it supports shared administration across distributed vCenter Server systems and the Linked Mode requirement.
When assessing a multi-node design, ask where replication will occur, whether the network between nodes is dependable, and whether the chosen topology solves a real availability or distributed-administration requirement.
Deployment Mode Selection Matrix
| Requirement | Recommended deployment mode | Selection rationale |
|---|---|---|
| Single vCenter Server within 1,000 hosts and 10,000 virtual machines | Basic deployment mode | One SSO node is usually sufficient when no SSO high-availability requirement exists and the environment is within the stated planning scale. |
| vCenter Server Appliance deployment | Basic deployment mode | The appliance use case is associated with the single-node SSO deployment option and the vCenter Simple Install workflow. |
| Same-site SSO high availability | Multiple SSO instances in the same location | Use a primary SSO instance plus one or more local additional nodes so SSO information is replicated and the topology supports improved availability. |
| Geographically dispersed vCenter Servers requiring Linked Mode | Multiple SSO instances in multiple locations | Use participating SSO nodes across the locations and plan reliable replication between them. |
How to Choose a Topology
- Count the vCenter Server environments. A single environment with no special availability requirement often points to basic mode. Distributed vCenter Server systems require closer examination of the multi-site option.
- Check the inventory scale. For a single vCenter Server environment, compare the expected inventory with the basic-mode planning scale of 1,000 hosts and 10,000 virtual machines.
- Identify the SSO availability requirement. If losing the only SSO node is unacceptable at one site, select multiple SSO instances at that site.
- Identify geographic distribution. If vCenter Server systems operate in separate locations, evaluate a multi-location topology.
- Check for Linked Mode. When distributed vCenter Servers must be administered through Linked Mode, use the multi-location design and include replication planning.
- Compare complexity with benefit. Additional nodes improve resilience or support distribution, but they add infrastructure and replication planning. Do not select a complex topology without a matching requirement.
Practical Examples
Single-site, modestly sized virtual infrastructure
An organization has one vCenter Server managing 450 hosts and 4,500 virtual machines. The environment is within the basic-mode planning scale and has no SSO high-availability requirement.
Recommendation: Basic deployment mode. One SSO node minimizes deployment and administration complexity.
Single data center requiring authentication-service resilience
An organization has one primary vCenter environment, but loss of its only SSO node is unacceptable.
Recommendation: Multiple SSO instances in the same location. Deploy a primary SSO instance and one or more local additional nodes, with SSO information replication between them.
Two geographically separated vCenter environments
vCenter Server systems operate in different locations, and administrators need Linked Mode administration.
Recommendation: Multiple SSO instances in multiple locations. Place participating nodes across the locations and evaluate the connectivity and replication reliability required by the design.
vCenter Server Appliance installation
An administrator is deploying vCenter Server as an appliance for one environment.
Recommendation: Basic deployment mode. This appliance use case is associated with the single-node SSO deployment option.
Common Planning Problems and Troubleshooting
Only one SSO node is deployed, but redundancy is expected
Likely cause: Basic mode was selected even though the business requires SSO high availability.
Guidance: Reassess the topology. Use multiple SSO instances at the same location when continued SSO availability within one site is required.
Linked Mode is required across sites, but SSO exists at only one site
Likely cause: The SSO topology does not match the geographically distributed administrative requirement.
Guidance: Plan the multi-location deployment mode, including participating nodes and SSO information replication between locations.
Multiple SSO nodes were installed as independent services
Likely cause: The replication relationship was omitted from the design.
Guidance: Treat the nodes as members of one replicated SSO deployment. Replication is fundamental to both same-site high availability and multi-site shared administration.
A complex multi-node topology is proposed for a small single-vCenter environment
Likely cause: The proposed complexity exceeds the actual scale and operational requirements.
Guidance: Re-evaluate whether the environment needs SSO high availability or multi-site Linked Mode. If not, basic mode may be sufficient within the stated planning scale.
Related Planning Concepts
An identity source is an authentication directory or other source used by SSO. Identity-source planning is related to authentication design, but it does not change the fundamental distinction among basic, same-site, and multi-site SSO deployment modes.
Before selecting a topology, understand the vCenter Server role, centralized authentication, high-availability fundamentals, inventory concepts such as hosts and virtual machines, geographically distributed data centers, and the Linked Mode concept.
Exam-Relevant Notes
- Basic deployment mode has one SSO node.
- The stated basic-mode planning scale is up to 1,000 hosts and 10,000 virtual machines.
- Basic mode is associated with a single vCenter Server Appliance deployment and the vCenter Simple Install workflow.
- Same-site multi-node mode uses a primary SSO instance and additional nodes to support high availability within one location.
- Multi-site mode uses replicated SSO nodes across locations for geographically distributed vCenter Server deployments.
- Linked Mode across geographically separated vCenter Server systems is a key reason to choose the multi-location mode.
- Replication synchronizes SSO information and is central to every multi-node topology.
For the complete lesson topic, see vCenter SSO deployment modes.