VMware ESXi and vSphere Cluster Management

Create a Custom Role in VMware vSphere

Learn how to create and assign a least-privilege custom VMware vSphere role for virtual machine provisioning in vCenter Server.

A vSphere role is a reusable collection of privileges. A privilege authorizes one specific action, such as assigning a network or allocating datastore space. A permission connects a user or group, a role, and an inventory object.

This distinction is important: creating a role does not grant access to anyone. Access is granted only after the role is assigned through a permission on an appropriate vCenter Server inventory object.

What vSphere Roles Are Used For

vCenter Server is the centralized management platform where vSphere inventory, authorization, roles, privileges, and permissions are administered. The vSphere Client is its web-based management interface.

Built-in system roles and sample roles are useful starting points, but they may be too broad or may not match a particular delegation requirement. A custom role lets you define task-specific access, such as allowing a provisioning team to create virtual machines without giving that team broad administrator privileges.

Concept — What it controls — Example

Privilege — Authorization for one action — Datastore > Allocate space

Role — A named set of privileges — VM Creator

Permission — Assigns a user or group a role on an inventory object — Provisioning group receives VM Creator on a VM folder

Inventory scope — The object where access applies — Datacenter, folder, cluster, host, resource pool, datastore, network, or virtual machine

Inheritance — Propagates a permission from a parent object to child objects when enabled — A folder permission can apply to virtual machines in that folder

Design the Role According to Least Privilege

Least privilege means granting only the access required to perform a defined task. Unnecessary privileges increase the security and operational risk of the environment. They can allow accidental changes, make audits more difficult, and expand the effect of a compromised account.

Start with the exact workflow rather than selecting a familiar broad role. List each action the assignee must perform, identify the object involved, and select only the privileges that support those actions. A clear role name should identify both the purpose and, when useful, the intended scope.

  • VM Creator - Development
  • VM Operator - Production
  • Datastore Viewer
  • Network Assignment - Test

Keep separate roles when development and production workflows need different access. Do not use one large role simply because it is easier to assign.

Plan a Virtual Machine Creator Role

This example delegates basic virtual machine provisioning to a team. The workflow may require the team to create a VM inventory object, choose a network, allocate datastore capacity, place the VM in a resource pool, configure virtual hardware, and perform approved VM interaction tasks.

The exact privilege set depends on the provisioning method and local configuration. Templates, content libraries, storage policies, distributed switches, encryption, target folders, and other features may require additional privileges. Treat the list below as a planning baseline, then validate it in the target environment.

Provisioning task — Privilege category — Privilege — Why it is needed — Scope considerations

Allocate virtual disk files on a datastore — Datastore — Allocate space — Allows use of datastore capacity for VM files and disks — The permission must apply to the intended datastore.

Connect a virtual NIC to a network — Network — Assign network — Allows assignment of a virtual NIC to the selected network or port group — The permission must apply to the target network object.

Place the VM in a resource pool — Resource — Assign virtual machine to resource pool — Allows the VM to be placed in the selected resource pool — The permission must apply to the intended resource pool or parent scope.

Create the VM inventory object — Virtual machine > Inventory — Create new — Allows creation of a new VM object — Assign access where the VM will be created, such as the target VM folder or datacenter.

Add or remove virtual hardware — Virtual machine > Configuration — Add new disk and Add or remove device — Allows the approved hardware changes required by provisioning — Review whether each hardware operation is actually needed.

Adjust VM memory — Virtual machine > Configuration — Memory — Allows the requested memory configuration — Limit the role if memory changes should not be delegated after creation.

Perform necessary VM interaction actions — Virtual machine > Interaction — Required interaction privileges — Supports the lifecycle actions included in the workflow — Selecting the entire Interaction category is broader than strict least privilege; review each action and remove unnecessary access.

Create the Custom Role in the vSphere Client

  1. Sign in to the vSphere Client with an account that can manage roles.
  2. Open the vCenter Server administration area.
  3. Open the Roles management view.
  4. Start the Create Role workflow.
  5. Enter a descriptive name, such as VM Creator - Development.
  6. Expand the privilege categories and select only the privileges planned for the workflow.
  7. Under Datastore, select Allocate space.
  8. Under Network, select Assign network.
  9. Under Resource, select Assign virtual machine to resource pool.
  10. Under Virtual machine > Configuration, select Add new disk, Add or remove device, and Memory if those operations are required.
  11. Under Virtual machine > Interaction, select only the interaction actions required by the approved VM lifecycle. Avoid granting the entire category unless the broader access is intentional and documented.
  12. Under Virtual machine > Inventory, select Create new.
  13. Save the role.
  14. Return to the role list and confirm that the new role appears with the expected name.

Assign the Role After It Is Created

Creating a custom role only defines a reusable permission set. It does not assign that set to a user or group. You must create a permission for the appropriate identity.

  1. Open the inventory object where the access is needed.
  2. Open its permissions or access-management view.
  3. Add the intended vCenter Server user or group.
  4. Select the custom role.
  5. Choose whether permission inheritance should propagate to child objects.
  6. Save the permission and verify the resulting assignment.

The assignment scope may be a datacenter, folder, cluster, host, resource pool, datastore, network, or virtual machine. For the VM Creator example, the target VM folder or datacenter may be appropriate only when inherited access also reaches the required resource pool, datastore, and network. In other environments, assign supporting permissions directly to those objects or their carefully selected parent scopes.

Avoid assigning a permission at a higher inventory level than necessary. A datacenter-level assignment with inheritance can expose many folders, clusters, datastores, networks, and virtual machines. Use the smallest scope that supports the complete workflow.

For more information about the assignment phase, see Assign Permissions and the vSphere access control system.

Validate the VM Creator Role

Test the role with a dedicated non-administrative account or test group before using it in production. Testing should verify both successful tasks and denied tasks.

  1. Sign in with the dedicated test identity.
  2. Attempt to create a virtual machine in the intended VM folder.
  3. Select an allowed resource pool, datastore, and network.
  4. Verify that the expected disk, device, memory, and other hardware settings can be applied.
  5. Perform the VM interaction actions included in the role.
  6. Attempt an unrelated administrative action and confirm that it is denied.

If a task succeeds only because the test identity has another inherited permission, the test does not accurately validate the custom role. Review all group memberships and permissions affecting the account.

Common VM Creation Failures

Observed error or symptom — Likely missing privilege or permission — Object where access is needed — Resolution

Cannot create the VM — Virtual machine > Inventory > Create new; missing assignment; wrong folder; or inheritance does not reach the target — VM folder or datacenter — Verify the role privilege and the permission scope.

Cannot select a datastore — Datastore > Allocate space or no permission on the selected datastore — Intended datastore — Add the allocation privilege and assign appropriate access on the datastore.

Cannot select a network — Network > Assign network or the permission does not apply to the target network — Network or distributed port group — Grant network assignment capability at the appropriate network scope.

Cannot select a resource pool — Resource > Assign virtual machine to resource pool or no access to the target pool — Resource pool or parent scope — Add the resource assignment privilege and confirm the target scope.

Cannot modify requested virtual hardware — The applicable Virtual machine > Configuration privilege is absent — Target VM and related inventory scope — Grant only the specific configuration privilege required.

Can create a VM but cannot perform an expected interaction — Required Virtual machine > Interaction privilege is absent — Target virtual machine and its permission scope — Identify the exact lifecycle action and add only its required privilege.

Troubleshoot a Role That Still Fails

The user can sign in but cannot create a virtual machine

  • Confirm that the role contains Virtual machine > Inventory > Create new.
  • Confirm that the role is assigned to the user or one of the user’s groups.
  • Check that the permission is assigned to the correct VM folder or datacenter.
  • Confirm that inheritance reaches the target location, or add a narrowly scoped permission at the required object.

The user cannot use storage, networking, or compute placement

  • For storage, verify Datastore > Allocate space and access to the intended datastore.
  • For networking, verify Network > Assign network and access to the target network or distributed port group.
  • For compute placement, verify Resource > Assign virtual machine to resource pool and access to the intended resource pool.

The workflow uses additional vSphere features

A role that works for a direct VM creation workflow may not work for templates, content libraries, storage policies, distributed networking, encryption, or other components. Review the task error and identify every inventory object involved. Add narrowly scoped access only for the missing operation, then repeat the non-administrative test.

Also check for explicit permissions, group membership, and assignments at different inventory levels. The effective access may differ from the role definition because multiple permissions apply to the same user and object.

Maintain and Document the Role

Authorization is an ongoing configuration, not a one-time task. Review the role whenever the provisioning workflow, vSphere version, inventory layout, or connected environment components change.

  • Record the role name and purpose.
  • Document every selected privilege and why it is needed.
  • Document the assigned users or groups.
  • Record the inventory assignment scope and inheritance setting.
  • Remove privileges that are no longer required.
  • Retest expected and prohibited operations after changes.
  • Review whether the role should be split into separate development, test, and production roles.

A well-designed VM Creator role contains the minimum access needed to provision VMs in a defined scope. The role definition, permission assignment, object scope, and inheritance setting must all be correct for least-privilege delegation to work.

To continue building related skills, see Create a Resource Pool, Add Virtual Hardware to a VM, and Create Standard Switches.