Minimum required permissions in vCenter/VMware

Where a vSphere administrator wants to follow the principle of least privilege, create a vCenter user and assign it a role containing only these privileges.

Datastore, required for provisioning

• Datastore.AllocateSpace
• Datastore.Browse
• Datastore.Config
• Datastore.FileManagement
• Datastore.UpdateVirtualMachineFiles
• Datastore.UpdateVirtualMachineMetadata

Folder, required for provisioning

• Folder.Create
• Folder.Delete
• Folder.Move
• Folder.Rename

Network, required for provisioning

• Network.Assign

Resource, required for provisioning

• Resource.ApplyRecommendation
• Resource.AssignVMToPool
• Resource.QueryVMotion

vApp, required for provisioning and managing virtual machines

• VApp.ApplicationConfig
• VApp.AssignResourcePool
• VApp.AssignVApp
• VApp.AssignVM
• VApp.Clone
• VApp.Create
• VApp.Delete
• VApp.Export
• VApp.ExtractOvfEnvironment
• VApp.Import
• VApp.InstanceConfig
• VApp.ManagedByConfig
• VApp.Move
• VApp.PowerOff
• VApp.PowerOn
• VApp.Rename
• VApp.ResourceConfig
• VApp.Suspend
• VApp.Unregister

Virtual machine configuration, required for provisioning and management

• VirtualMachine.Config.AddExistingDisk
• VirtualMachine.Config.AddNewDisk
• VirtualMachine.Config.AddRemoveDevice
• VirtualMachine.Config.AdvancedConfig
• VirtualMachine.Config.Annotation
• VirtualMachine.Config.ChangeTracking
• VirtualMachine.Config.CPUCount
• VirtualMachine.Config.DiskExtend
• VirtualMachine.Config.DiskLease
• VirtualMachine.Config.EditDevice
• VirtualMachine.Config.HostUSBDevice
• VirtualMachine.Config.ManagedBy
• VirtualMachine.Config.Memory
• VirtualMachine.Config.MksControl
• VirtualMachine.Config.QueryFTCompatibility
• VirtualMachine.Config.QueryUnownedFiles
• VirtualMachine.Config.RawDevice
• VirtualMachine.Config.ReloadFromPath
• VirtualMachine.Config.RemoveDisk
• VirtualMachine.Config.Rename
• VirtualMachine.Config.ResetGuestInfo
• VirtualMachine.Config.Resource
• VirtualMachine.Config.Settings
• VirtualMachine.Config.SwapPlacement
• VirtualMachine.Config.Unlock
• VirtualMachine.Config.UpgradeVirtualHardware

Guest operations, required for interacting with a virtual machine

• VirtualMachine.GuestOperations.Execute
• VirtualMachine.GuestOperations.Modify
• VirtualMachine.GuestOperations.Query

Virtual machine interaction, required for power and console operations

• VirtualMachine.Interact.ConsoleInteract
• VirtualMachine.Interact.DeviceConnection
• VirtualMachine.Interact.PowerOff
• VirtualMachine.Interact.PowerOn
• VirtualMachine.Interact.Reset
• VirtualMachine.Interact.SetCDMedia
• VirtualMachine.Interact.SetFloppyMedia

Inventory, required for creating and managing virtual machines

• VirtualMachine.Inventory.Create
• VirtualMachine.Inventory.CreateFromExisting
• VirtualMachine.Inventory.Delete
• VirtualMachine.Inventory.Move
• VirtualMachine.Inventory.Register
• VirtualMachine.Inventory.Unregister

Provisioning, required for deployment and customization

• VirtualMachine.Provisioning.Clone
• VirtualMachine.Provisioning.CloneTemplate
• VirtualMachine.Provisioning.CreateTemplateFromVM
• VirtualMachine.Provisioning.Customize
• VirtualMachine.Provisioning.DeployTemplate
• VirtualMachine.Provisioning.DiskRandomAccess
• VirtualMachine.Provisioning.DiskRandomRead
• VirtualMachine.Provisioning.GetVmFiles
• VirtualMachine.Provisioning.MarkAsTemplate
• VirtualMachine.Provisioning.MarkAsVM
• VirtualMachine.Provisioning.ModifyCustSpecs
• VirtualMachine.Provisioning.PromoteDisks
• VirtualMachine.Provisioning.PutVmFiles
• VirtualMachine.Provisioning.ReadCustSpecs

Snapshot management

• VirtualMachine.State.CreateSnapshot
• VirtualMachine.State.RemoveSnapshot
• VirtualMachine.State.RenameSnapshot
• VirtualMachine.State.RevertToSnapshot