VMware ESXi and vSphere Cluster Management

Understanding vSphere Inventory Objects and Permissions

Learn how vSphere inventory objects, users, groups, roles, privileges, and permissions work together in vCenter Server.

VMware vSphere uses an organized inventory to represent the resources managed by vCenter Server. Virtual machines, hosts, datastores, networks, folders, and other items in that inventory are called objects. Permissions are assigned to these objects so that administrators can control who may view or change them.

This lesson explains the vSphere object hierarchy and the relationship between objects, permissions, roles, users, groups, and privileges.

What Is a vSphere Object?

A vSphere object is an inventory item that can be the target of an administrative action. For example, an administrator can power on a virtual machine, place a host in maintenance mode, configure a datastore, or change settings on a folder.

An inventory object is any managed item displayed in the vCenter Server inventory. Objects exist within the vCenter Server inventory hierarchy, which helps administrators organize resources and select the scope of administrative work.

Permissions are attached to inventory objects. A permission controls which identity can perform which actions on the selected object. The identity may be an individual user or a group, and the available actions are determined by the role assigned to that identity.

Common vSphere Inventory Objects

The following object types commonly appear in a vCenter Server inventory. Their exact arrangement can vary depending on the environment and vCenter Server version.

Object type | Purpose in the inventory | Example administrative actions

Datacenter | A major organizational container for hosts, clusters, virtual machines, datastores, and networks | Organize resources, configure datacenter-level access, and manage contained resources

Cluster | A collection of ESX or ESXi hosts managed as a group | Configure cluster services, add or remove hosts, and manage cluster-wide settings

ESX/ESXi host | A physical virtualization server that runs virtual machines | Configure host settings, manage virtual machines, and place the host in maintenance mode

vApp | A container for related virtual machines and applications | Group virtual machines and configure application-oriented startup or shutdown behavior

Resource pool | A logical allocation of compute resources for virtual machines or child pools | Configure CPU and memory shares, limits, and reservations

Virtual machine | A software-defined computer running on an ESX or ESXi host | Power on, power off, reconfigure, snapshot, or migrate the virtual machine

Datastore | Storage presented to hosts for virtual machine files and other data | Browse files, provision virtual disks, and manage datastore settings

Network | A virtual networking object used to connect virtual machines and hosts | Connect virtual adapters, configure networking, and manage network-related settings

Folder | An organizational container for inventory objects | Group objects and provide a convenient administrative scope

These objects can be nested or associated with one another. For example, a datacenter may contain a cluster, the cluster may contain ESXi hosts, and those hosts may run virtual machines that use datastores and networks. A folder can organize objects at several points in the inventory.

Objects and the Permission Model

A permission is an access-control assignment that associates a user or group with a role for a particular inventory object.

A role is a named collection of privileges. A privilege is a specific authorization to perform an action in vSphere, such as changing a virtual machine setting or managing a datastore. The role gathers related privileges into a reusable access profile.

A user is an individual account that can receive a permission assignment. A group is a collection of users that can receive one shared assignment. The selected inventory object is the scope to which the permission applies.

Component | Meaning | Relationship to the permission

User | An individual account | Receives a role assignment directly

Group | A collection of users | Receives one assignment that can apply to all group members

Role | A named collection of privileges | Determines which actions the identity may perform

Privilege | Authorization for one specific vSphere action | Forms part of a role

Inventory object | A managed item such as a VM, host, datastore, or folder | Defines where the assignment applies

Permission | The complete assignment of identity, role, and object scope | Connects the identity and role to the selected object

The permission formula

You can reason about a permission using this model:

user or group + role + inventory object = permission assignment

For example, assigning the Virtual Machine Operator role to the Operations group on a particular virtual machine creates a permission assignment. The role supplies the privileges, the group supplies the identities, and the virtual machine defines the scope.

Where Permissions Can Be Assigned

Permissions can be assigned to inventory objects in vCenter Server. The object selected during assignment is important because it establishes the administrative boundary. A permission assigned to a folder may cover a broader collection of objects than a permission assigned directly to one virtual machine.

Broad scope can be useful when a team manages an entire datacenter, cluster, or folder. Narrow scope is useful when a team should manage only one virtual machine, datastore, network, or resource pool.

vSphere can make permissions available to objects beneath the selected point in the hierarchy according to the permission's propagation or inheritance settings. This lesson does not require memorizing every inheritance rule; the key practice is to select the object that matches the intended boundary and verify the resulting access.

Viewing Permissions for an Inventory Object

To inspect access for an object in the vSphere Client:

1. Select the object in the vCenter Server inventory.
2. Open the object's Manage area.
3. Open the Permissions tab.
4. Review the listed users and groups and the roles assigned to them.

The Permissions tab displays permission entries for the selected object. Each entry identifies an identity, such as a local user, directory user, or directory group, and shows the associated role.

For a practical example, select a virtual machine, open Manage > Permissions, and inspect the list. Each listed role determines the actions available to that identity for the selected virtual machine, subject to the applicable vSphere access rules and scope.

How to Interpret a Permission Listing

Imagine that a virtual machine's permission list contains the following entries:

Identity                         Role
local-admin                     Administrator
directory\vcenter-admins         Administrator
operations\vm-operators          Virtual Machine Operator

The first entry assigns the Administrator role directly to a local administrative user. The second assigns the same high-privilege role to a directory-based administrators group. The third gives the operations group a different role with a narrower set of privileges.

An Administrator role is an example of a high-privilege role that may provide broad management access. Multiple identities can have the same role on one object, but they do not have to be the same type of identity. One entry may be an individual user, while another may be a group.

An individual-user assignment applies specifically to that account. A group-based assignment applies through group membership, allowing access to be managed collectively. If a user belongs to several groups, the user's effective access may be influenced by the assignments associated with those groups and the relevant object scope.

Using Roles and Permissions for Delegation

Access delegation means giving another person or team the ability to perform defined administrative work without giving unrestricted control of the environment.

Prefer groups for shared access

Groups are commonly used because they keep access consistent. Instead of assigning the same role separately to every operations team member, assign the role to an operations group on the relevant inventory object. The group's members then receive access through that group assignment.

When staff change, identity management administrators can update group membership without requiring a separate vSphere permission assignment for every person.

Use custom roles for least privilege

A custom role is a role created with a tailored set of privileges for a specific responsibility. For example, a team that only needs to inspect virtual machines and perform limited power operations should not automatically receive every administrative privilege.

Role creation and permission assignment are related but separate administration tasks:

1. Identify the work the team must perform.
2. Select the privileges required for that work.
3. Create or select an appropriate role.
4. Assign the role to a user or, preferably for a team, a group.
5. Select the inventory object that defines the intended scope.
6. Review the permission listing and test access with an appropriate account.

Comparing broad and narrow scope

Suppose the operations team needs to manage only the virtual machines in one folder. Assigning a limited custom role to the operations group at that folder may match the requirement. Assigning the same role at the datacenter level would be broader and could expose additional resources.

Similarly, assigning a role directly to one virtual machine creates a narrow boundary. Assigning it to a parent folder, cluster, or datacenter can make the assignment applicable to a larger part of the inventory. Always choose the object that matches the intended administrative boundary.

Practical Permission Scenarios

Viewing access on a virtual machine

1. Select a virtual machine from the inventory.
2. Open Manage, then select Permissions.
3. Identify the users and groups listed for the virtual machine.
4. Read the role associated with each identity.
5. Use the role's privileges to determine which actions that identity can perform on the object.

Assigning access through an operations group

Assume an operations team needs to manage a set of virtual machines in a folder. Use the directory-based operations group rather than creating separate assignments for every team member. Assign an appropriate role to the group at the relevant folder or virtual machine scope. Members of the group receive access based on that group assignment.

Administrative identities on one object

A permission list may contain both local administrative users and a directory-based administrators group. If both are assigned the Administrator role on the object, both identities have that role at that scope. This demonstrates that multiple identities can share one role while still being represented by separate permission entries.

Restricting access by object scope

To limit access, create or select a custom role and assign it to a team at a specific virtual machine, folder, or resource scope. Compare that assignment with placing it at a broader inventory level. The narrower object is generally the better choice when the team has responsibility for only a defined subset of resources.

Troubleshooting Permission Problems

A user cannot perform an expected action

• Confirm that the correct inventory object was selected when the permission was assigned.
• Review the object's Manage > Permissions view.
• Verify that the user or one of the user's groups appears in the permission list.
• Verify that the assigned role contains the privilege required for the action.
• Check whether access was intended to be assigned at a different inventory level.

A permission on the wrong object may not cover the resource the user is trying to manage. Conversely, a permission on a parent object may grant access more broadly than intended.

An administrator assigned access to the wrong part of the environment

• Identify the object on which the permission was created.
• Compare that object with the intended datacenter, cluster, folder, virtual machine, network, datastore, or resource-pool scope.
• Remove or adjust the assignment and apply it at the correct object level.

Team members have inconsistent access

• Determine whether permissions were assigned individually instead of through a shared group.
• Review the roles assigned to each individual and group.
• Compare the object scope used for each assignment.
• Standardize the assignment with an appropriate group and role where suitable.

Exam-Relevant Summary

• An object is an inventory item that can be the target of an administrative action.
• Common inventory objects include datacenters, clusters, ESX or ESXi hosts, vApps, resource pools, virtual machines, datastores, networks, and folders.
• A permission links a user or group to a role on a specific inventory object.
• A role is a collection of privileges, and a privilege authorizes a specific action.
• The selected object determines the scope of the permission assignment.
• Permissions for an object are inspected in the vSphere Client through Manage > Permissions.
• Permission listings distinguish individual-user assignments from group-based assignments.
• Groups make shared access easier to maintain, while custom roles support least-privilege delegation.
• When access is incorrect, check the identity, role privileges, selected object, and intended inventory scope.

For related administration tasks, see Assign Permissions, Access Control System, and Add ESXi Host to vCenter Server Inventory.