Privileges

Every privilege by group, with the built-in roles that hold it and the API operations that check it.

System

Privilege	Description	Built-in roles
`System.Anonymous`	Implicit privilege of every principal, including unauthenticated ones	Administrator, Read-only, Virtual machine power user, Virtual machine user, Backup operator, Tenant administrator, Tenant user, Tenant service principal
`System.View`	See an object exists in the inventory tree	Administrator, Read-only, Virtual machine power user, Virtual machine user, Backup operator, Tenant administrator, Tenant user, Tenant service principal
`System.Read`	Read all properties of an object	Administrator, Read-only, Virtual machine power user, Virtual machine user, Backup operator, Tenant administrator, Tenant user, Tenant service principal

Global

Privilege	Description	Built-in roles
`Global.Settings`	Change control-plane settings	Administrator
`Global.Licenses`	Manage licences	Administrator
`Global.ManageCustomFields`	Create and delete custom field definitions	Administrator
`Global.SetCustomField`	Set custom field values	Administrator
`Global.LogEvent`	Post user-defined events	Administrator, Backup operator
`Global.CancelTask`	Cancel tasks of other users	Administrator
`Global.Diagnostics`	Download diagnostic bundles and logs	Administrator

Alarm

Privilege	Description	Built-in roles
`Alarm.Create`	Create alarms	Administrator
`Alarm.Edit`	Edit alarms	Administrator
`Alarm.Delete`	Delete alarms	Administrator
`Alarm.Acknowledge`	Acknowledge triggered alarms	Administrator
`Alarm.SetStatus`	Reset triggered alarms to green	Administrator

ScheduledTask

Privilege	Description	Built-in roles
`ScheduledTask.Create`	Create scheduled tasks	Administrator
`ScheduledTask.Delete`	Delete scheduled tasks	Administrator
`ScheduledTask.Edit`	Edit scheduled tasks	Administrator
`ScheduledTask.Run`	Run scheduled tasks immediately	Administrator

Authorization

Privilege	Description	Built-in roles
`Authorization.ModifyPermissions`	Assign roles on objects	Administrator
`Authorization.ModifyRoles`	Create, edit and delete roles	Administrator
`Authorization.ReassignRolePermissions`	Reassign permissions of a role	Administrator

Sessions

Privilege	Description	Built-in roles
`Sessions.ValidateSession`	Validate sessions	Administrator
`Sessions.TerminateSession`	Terminate other users' sessions	Administrator
`Sessions.GlobalMessage`	Set the message of the day	Administrator

Datacenter

Privilege	Description	Built-in roles
`Datacenter.Create`	Create datacenters	Administrator
`Datacenter.Delete`	Delete datacenters	Administrator
`Datacenter.Rename`	Rename datacenters	Administrator
`Datacenter.Move`	Move datacenters	Administrator

Folder

Privilege	Description	Built-in roles
`Folder.Create`	Create folders	Administrator
`Folder.Delete`	Delete folders	Administrator
`Folder.Rename`	Rename folders	Administrator
`Folder.Move`	Move folders	Administrator

Host

Privilege	Description	Built-in roles
`Host.Inventory.AddStandaloneHost`	Add standalone hosts	Administrator
`Host.Inventory.AddHostToCluster`	Add hosts to clusters	Administrator
`Host.Inventory.RemoveHostFromCluster`	Remove hosts from clusters	Administrator
`Host.Inventory.CreateCluster`	Create clusters	Administrator
`Host.Inventory.EditCluster`	Edit clusters	Administrator
`Host.Inventory.DeleteCluster`	Delete clusters	Administrator
`Host.Inventory.MoveHost`	Move hosts	Administrator
`Host.Config.Maintenance`	Enter and exit maintenance mode	Administrator
`Host.Config.Connection`	Disconnect and reconnect hosts	Administrator
`Host.Config.Network`	Configure host networking	Administrator
`Host.Config.Storage`	Configure host storage	Administrator
`Host.Config.Settings`	Configure host settings	Administrator
`Host.Local.ManageUserGroups`	Manage local host accounts	Administrator

Resource

Privilege	Description	Built-in roles
`Resource.AssignVMToPool`	Assign VMs to resource pools	Administrator, Virtual machine user, Backup operator, Tenant administrator, Tenant service principal
`Resource.CreatePool`	Create resource pools	Administrator
`Resource.DeletePool`	Delete resource pools	Administrator
`Resource.EditPool`	Edit resource pools	Administrator
`Resource.MovePool`	Move resource pools	Administrator
`Resource.ColdMigrate`	Cold-migrate VMs	Administrator
`Resource.HotMigrate`	Live-migrate VMs	Administrator
`Resource.ApplyRecommendation`	Apply scheduler recommendations	Administrator

Datastore

Privilege	Description	Built-in roles
`Datastore.Browse`	Browse datastores	Administrator, Virtual machine user, Backup operator
`Datastore.FileManagement`	Manage files on datastores	Administrator, Backup operator
`Datastore.AllocateSpace`	Allocate space on datastores	Administrator, Backup operator
`Datastore.Delete`	Remove datastores	Administrator
`Datastore.Rename`	Rename datastores	Administrator
`Datastore.Config`	Configure datastores	Administrator

Network

Privilege	Description	Built-in roles
`Network.Assign`	Assign networks to VMs	Administrator, Virtual machine user, Backup operator
`Network.Config`	Configure networks	Administrator
`Network.Delete`	Delete networks	Administrator
`Network.Move`	Move networks	Administrator

DVSwitch

Privilege	Description	Built-in roles
`DVSwitch.Create`	Create distributed switches	Administrator
`DVSwitch.Modify`	Modify distributed switches	Administrator
`DVSwitch.Delete`	Delete distributed switches	Administrator

DVPortgroup

Privilege	Description	Built-in roles
`DVPortgroup.Create`	Create distributed port groups	Administrator
`DVPortgroup.Modify`	Modify distributed port groups	Administrator
`DVPortgroup.Delete`	Delete distributed port groups	Administrator

VirtualMachine

Privilege	Description	Built-in roles
`VirtualMachine.Inventory.Create`	Create VMs	Administrator, Virtual machine user, Backup operator, Tenant administrator, Tenant service principal
`VirtualMachine.Inventory.CreateFromExisting`	Clone VMs	Administrator, Virtual machine user
`VirtualMachine.Inventory.Register`	Register VMs	Administrator, Virtual machine user, Backup operator
`VirtualMachine.Inventory.Unregister`	Unregister VMs	Administrator, Virtual machine user
`VirtualMachine.Inventory.Delete`	Delete VMs	Administrator, Tenant administrator, Tenant service principal
`VirtualMachine.Inventory.Move`	Move VMs	Administrator, Virtual machine user
`VirtualMachine.Config.AddExistingDisk`	Add existing disks	Administrator, Virtual machine user, Backup operator
`VirtualMachine.Config.AddNewDisk`	Add new disks	Administrator, Virtual machine user, Backup operator
`VirtualMachine.Config.AddRemoveDevice`	Add or remove devices	Administrator, Virtual machine user
`VirtualMachine.Config.AdvancedConfig`	Change advanced settings	Administrator, Virtual machine user
`VirtualMachine.Config.Annotation`	Change notes	Administrator, Virtual machine user, Tenant administrator, Tenant service principal
`VirtualMachine.Config.CPUCount`	Change CPU count	Administrator, Virtual machine power user, Virtual machine user, Tenant administrator, Tenant service principal
`VirtualMachine.Config.Memory`	Change memory	Administrator, Virtual machine power user, Virtual machine user, Tenant administrator, Tenant service principal
`VirtualMachine.Config.EditDevice`	Edit devices	Administrator, Virtual machine user
`VirtualMachine.Config.RemoveDisk`	Remove disks	Administrator, Virtual machine user
`VirtualMachine.Config.Rename`	Rename VMs	Administrator, Virtual machine user, Tenant administrator, Tenant service principal
`VirtualMachine.Config.Resource`	Change resource allocation	Administrator, Virtual machine user
`VirtualMachine.Config.Settings`	Change settings	Administrator, Virtual machine user, Tenant administrator, Tenant service principal
`VirtualMachine.Config.ChangeTracking`	Toggle changed-block tracking	Administrator, Virtual machine user, Backup operator
`VirtualMachine.Config.DiskLease`	Acquire disk leases (backup)	Administrator, Virtual machine user, Backup operator
`VirtualMachine.Interact.PowerOn`	Power on	Administrator, Virtual machine power user, Virtual machine user, Backup operator, Tenant administrator, Tenant user, Tenant service principal
`VirtualMachine.Interact.PowerOff`	Power off	Administrator, Virtual machine power user, Virtual machine user, Backup operator, Tenant administrator, Tenant user, Tenant service principal
`VirtualMachine.Interact.Suspend`	Suspend	Administrator, Virtual machine power user, Virtual machine user
`VirtualMachine.Interact.Reset`	Reset	Administrator, Virtual machine power user, Virtual machine user, Tenant administrator, Tenant user, Tenant service principal
`VirtualMachine.Interact.Pause`	Pause	Administrator, Virtual machine power user, Virtual machine user
`VirtualMachine.Interact.ConsoleInteract`	Open the console	Administrator, Virtual machine power user, Virtual machine user, Tenant administrator, Tenant user, Tenant service principal
`VirtualMachine.Interact.DeviceConnection`	Connect devices	Administrator, Virtual machine power user, Virtual machine user
`VirtualMachine.Interact.SetCDMedia`	Change CD media	Administrator, Virtual machine power user, Virtual machine user
`VirtualMachine.Interact.ToolsInstall`	Install the guest agent	Administrator, Virtual machine power user, Virtual machine user
`VirtualMachine.Interact.GuestControl`	Run guest operations	Administrator, Virtual machine power user, Virtual machine user
`VirtualMachine.GuestOperations.Query`	Query the guest through its agent (processes, environment, read files)	Administrator
`VirtualMachine.GuestOperations.Modify`	Modify the guest through its agent (write files)	Administrator
`VirtualMachine.GuestOperations.Execute`	Run programs in the guest through its agent	Administrator
`VirtualMachine.Interact.AnswerQuestion`	Answer VM questions	Administrator, Virtual machine power user, Virtual machine user
`VirtualMachine.State.CreateSnapshot`	Create snapshots	Administrator, Virtual machine power user, Virtual machine user, Backup operator, Tenant administrator, Tenant user, Tenant service principal
`VirtualMachine.State.RemoveSnapshot`	Remove snapshots	Administrator, Virtual machine power user, Virtual machine user, Backup operator, Tenant administrator, Tenant user, Tenant service principal
`VirtualMachine.State.RenameSnapshot`	Rename snapshots	Administrator, Virtual machine power user, Virtual machine user, Tenant administrator, Tenant user, Tenant service principal
`VirtualMachine.State.RevertToSnapshot`	Revert to snapshots	Administrator, Virtual machine power user, Virtual machine user, Tenant administrator, Tenant user, Tenant service principal
`VirtualMachine.Provisioning.Clone`	Clone VMs	Administrator, Virtual machine user
`VirtualMachine.Provisioning.CloneTemplate`	Clone templates	Administrator, Virtual machine user
`VirtualMachine.Provisioning.CreateTemplateFromVM`	Create templates	Administrator, Virtual machine user
`VirtualMachine.Provisioning.DeployTemplate`	Deploy from templates	Administrator, Virtual machine user
`VirtualMachine.Provisioning.MarkAsTemplate`	Mark as template	Administrator, Virtual machine user
`VirtualMachine.Provisioning.MarkAsVM`	Mark as VM	Administrator, Virtual machine user
`VirtualMachine.Provisioning.Customize`	Customise guest	Administrator, Virtual machine user, Tenant administrator, Tenant service principal
`VirtualMachine.Provisioning.DiskRandomAccess`	Random disk access (backup)	Administrator, Virtual machine user, Backup operator
`VirtualMachine.Provisioning.DiskRandomRead`	Random disk read (backup)	Administrator, Virtual machine user, Backup operator
`VirtualMachine.Provisioning.GetVmFiles`	Download VM files	Administrator, Virtual machine user, Backup operator
`VirtualMachine.Provisioning.PutVmFiles`	Upload VM files	Administrator, Virtual machine user
`VirtualMachine.Provisioning.ReadCustSpecs`	Read customisation specs	Administrator, Virtual machine user
`VirtualMachine.Provisioning.ModifyCustSpecs`	Create and delete customisation specs	Administrator, Virtual machine user

VApp

Privilege	Description	Built-in roles	API operations
`VApp.Import`	Import vApps and OVF/OVA	Administrator
`VApp.Export`	Export vApps and OVF/OVA	Administrator

InventoryService

Privilege	Description	Built-in roles
`InventoryService.Tagging.CreateCategory`	Create tag categories	Administrator
`InventoryService.Tagging.EditCategory`	Edit tag categories	Administrator
`InventoryService.Tagging.DeleteCategory`	Delete tag categories	Administrator
`InventoryService.Tagging.CreateTag`	Create tags	Administrator
`InventoryService.Tagging.EditTag`	Edit tags	Administrator
`InventoryService.Tagging.DeleteTag`	Delete tags	Administrator
`InventoryService.Tagging.AttachTag`	Attach and detach tags	Administrator

ContentLibrary

Privilege	Description	Built-in roles
`ContentLibrary.CreateLocalLibrary`	Create local content libraries	Administrator
`ContentLibrary.DeleteLocalLibrary`	Delete local content libraries	Administrator
`ContentLibrary.UpdateLibrary`	Update content library metadata	Administrator
`ContentLibrary.AddLibraryItem`	Add items to a content library	Administrator
`ContentLibrary.DeleteLibraryItem`	Delete content library items	Administrator
`ContentLibrary.ReadStorage`	Read content library storage backing	Administrator
`ContentLibrary.UpdateSession`	Create and complete content library update sessions	Administrator

Kyvernon.Webhook

Privilege	Description	Built-in roles	API operations
`Kyvernon.Webhook.Manage`	Create and delete webhook subscriptions	Administrator, Tenant service principal

Kyvernon.Usage

Privilege	Description	Built-in roles	API operations
`Kyvernon.Usage.Read`	Read the usage ledger (chargeback and billing data)	Administrator, Tenant administrator, Tenant service principal

Kyvernon.Identity

Privilege	Description	Built-in roles
`Kyvernon.Identity.ManageUsers`	Create, edit and delete local users and local groups	Administrator
`Kyvernon.Identity.ManagePolicy`	Read and change the password policy and the account lockout policy	Administrator
`Kyvernon.Identity.BreakGlass`	Use the break-glass account	Administrator

Kyvernon.Tenant

Privilege	Description	Built-in roles
`Kyvernon.Tenant.Create`	Create tenants (service principal of a self-service portal)	Administrator, Tenant service principal
`Kyvernon.Tenant.Read`	Read tenants, their quotas, servers and usage	Administrator, Tenant service principal
`Kyvernon.Tenant.Suspend`	Suspend tenants	Administrator, Tenant service principal
`Kyvernon.Tenant.Resume`	Resume suspended tenants	Administrator, Tenant service principal
`Kyvernon.Tenant.Close`	Close tenants (their VMs are destroyed after the grace period)	Administrator, Tenant service principal
`Kyvernon.Tenant.SetQuota`	Change tenant quotas	Administrator, Tenant service principal
`Kyvernon.Tenant.Impersonate`	Act inside a tenant on its behalf (console tickets of tenant servers)	Administrator, Tenant service principal
`Kyvernon.Tenant.ManageUsers`	Create and remove the users and API tokens of a tenant (on the tenant's folder)	Administrator, Tenant administrator, Tenant service principal

Kyvernon.Plan

Privilege	Description	Built-in roles	API operations
`Kyvernon.Plan.Manage`	Create, change and delete VM plans	Administrator

Kyvernon.Catalogue

Privilege	Description	Built-in roles	API operations
`Kyvernon.Catalogue.Manage`	Mark images for the self-service catalogue	Administrator

Kyvernon.Firewall

Privilege	Description	Built-in roles
`Kyvernon.Firewall.Read`	Read firewall groups, services, policies, rules, effective rules, counters and realization	Administrator, Tenant administrator, Tenant user, Tenant service principal
`Kyvernon.Firewall.ManageGroups`	Create, change and delete firewall groups and services in the scope where held	Administrator, Tenant administrator, Tenant service principal
`Kyvernon.Firewall.ManagePolicies`	Create, change, delete and reorder Environment and Application firewall policies and rules; open ports; apply templates	Administrator, Tenant administrator, Tenant service principal
`Kyvernon.Firewall.SetProfile`	Choose a selectable firewall profile for a VM or vNIC	Administrator, Tenant administrator, Tenant service principal
`Kyvernon.Firewall.ManageProvider`	Emergency and Infrastructure firewall policies, shared groups, profiles, settings and the firewall mode of a vNIC	Administrator
`Kyvernon.Firewall.ReadLogs`	Read firewall log records and monitor reports	Administrator, Tenant administrator, Tenant service principal
`Kyvernon.Firewall.Bypass`	Enable an emergency firewall bypass rule	Administrator