VMware ESXi and vSphere Cluster Management

vSphere Inventory Objects Explained

Learn what vSphere inventory objects are, how datacenters, hosts, VMs, datastores, and folders are organized, and how roles and permissions apply in vCenter Server.

A vSphere object, also called an inventory object, is an item in the vCenter Server inventory that you can select, manage, and target with administrative actions. Examples include a virtual machine, ESXi host, datastore, network, or folder.

The object is not the action performed on it. For example, a virtual machine is an object; powering it on is an action. A datastore is an object; browsing or managing its files is an action. Permissions are associated with the object and determine which users or groups may perform particular actions there.

What Is a vSphere Inventory Object?

The vCenter Server inventory is the hierarchy of managed vSphere entities displayed in the vSphere Client. Each entity in that hierarchy can provide a target for management operations and, where appropriate, a target for permission assignments.

• Object: An inventory item that can be managed and can serve as the target of actions and permissions.
• Permission: An assignment that connects a user or group to a role on a particular inventory object.
• Role: A collection of privileges that defines allowed administrative actions.
• Privilege: One specific allowed action or capability included in a role.
• User: An individual identity that can receive a role through a permission.
• Group: A collection of user identities that can receive a role through one permission assignment.

For example, a virtual machine can be the target of a permission. The permission might assign the Virtual Machine Administrator role to a user. The role contains privileges, such as capabilities for managing that virtual machine. The permission does not turn the user into a different object; it grants the user defined capabilities on the selected object.

Common vSphere Inventory Object Types

Objects as Permission Targets

A vSphere permission has three essential parts:

The role determines which actions the assigned user or group may perform on the target. Permissions can be assigned to objects in the vCenter Server inventory. Therefore, selecting the correct object is essential: assigning a role on a specific virtual machine has a different scope from assigning it on a folder or datacenter.

Roles, Privileges, and Assignments

A privilege is an individual capability, such as a particular configuration or management action. A role groups privileges into a reusable access definition. Built-in roles, such as the highly privileged Administrator role, provide predefined sets of privileges.

A custom role is used when the built-in roles do not match the required access. You define a tailored set of privileges in the custom role, then use a permission assignment to apply that role to a user or group at an inventory object.

1. Select the inventory object that represents the required scope.
2. Choose or create the role containing the required privileges.
3. Assign the role to an individual user or group on that object.

Object selection is the first step both when creating an assignment and when reviewing an existing assignment.

Viewing Object Permissions in the vSphere Client

To review permissions for an inventory object:

1. Select the object in the vSphere inventory, such as a virtual machine, host, datastore, folder, or another managed entity.
2. Open the Manage area for the selected object.
3. Open the Permissions tab.
4. Review the listed users and groups, their assigned roles, and the selected object context.

The Permissions tab shows assignments in the context of the object currently selected. Before interpreting the list, verify that the inventory tree has the intended object selected.

For example, to review access to one virtual machine, select that virtual machine first. Opening Manage and Permissions then shows the assignments associated with that selected VM. Selecting a folder instead shows the permission context for the folder, not the individual VM.

Interpreting a Permissions List

Imagine that the selected inventory object displays these assignments:

Here, root and administrator are individual user identities, while vSphere-Admins is a group. All three principals receive the actions allowed by the Administrator role for that object. Multiple principals can receive the same role on the same object.

A group assignment can provide access to every member of the group. If membership changes, the effective set of users receiving access may change even though the vCenter permission entry remains the same.

Choosing the Correct Permission Target

Choose the object that represents the resource or container needing administration:

• Target a specific virtual machine when access should be limited to that machine.
• Target a folder when the assignment should organize or manage access for grouped inventory items.
• Target a datastore when the required access concerns storage resources.
• Target a host or cluster when administration concerns the physical host or grouped host resources.
• Target a datacenter when the intended scope is a broad infrastructure container.

The selected target determines the scope of the assignment. A permission visible on one object does not automatically appear when you select an unrelated object; review the Permissions tab for the actual object where access is expected.

Troubleshooting Object Permissions

A user cannot perform an expected action

• Confirm that the correct inventory object is selected when reviewing permissions.
• Verify that the user, or one of the user's groups, appears on the Permissions tab.
• Verify that the assigned role contains the privilege required for the action.
• Confirm that the assignment was made at the correct object level.

Permissions on one object are missing on another

Permissions are reviewed in the context of the currently selected inventory object. Select the actual object on which access is expected, then inspect its Manage and Permissions area. Do not assume that a list shown for one object is the list for every object in the inventory.

A group has access but an individual user does not

• Confirm that the user is a member of the group receiving the assignment.
• Check whether the role was assigned to the group rather than directly to the user.
• Verify that the group assignment is on the correct inventory object.

Summary

• A vSphere object is a selectable, manageable item in the vCenter Server inventory.
• Actions are performed on objects; permissions are associated with objects.
• Common objects include datacenters, clusters, ESXi hosts, vApps, resource pools, virtual machines, datastores, networks, and folders.
• A permission connects a user or group, a role, and a target inventory object.
• The role contains privileges that define the allowed actions.
• To review access, select the object, open Manage, and choose Permissions.
• The selected object determines the scope you are reviewing or assigning.

For the broader access-control workflow, continue with vSphere inventory objects and permission targets.