Securing VMware vSphere - Mastering VMware vSphere 5.5 - page 470

Datacenter Controls the ability to create, delete, move, and rename datacenters inside vCen-
ter Server. The privilege for working with an IP pool is also found in the Datacenter category.
Datastore Controls who can access i les stored on an ESXi attached volume. These privi-
leges need to be assigned at the parent object of the ESXi host itself—for instance, a data-
center, an ESXi cluster, or a folder that contains ESXi hosts.
Datastore Cluster Controls who is permitted to coni gure a datastore cluster (used with
proi le-based storage and Storage DRS).
Distributed Switch Controls who can create, delete, or modify distributed virtual switches.
ESX Agent Manager Controls the ability to view, coni gure, or modify ESX host agents.
Extension Controls the ability to register, update, or unregister extensions in vCenter
Server. An example of an extension is vSphere Update Manager (VUM).
Folder Controls the creation, deletion, and general manipulation of folders in the vCenter
Server hierarchy.
Global Includes the ability to manage vCenter Server license settings and server settings
such as SNMP and SMTP.
Host Controls what users can do with ESXi hosts in the inventory. This includes tasks such
as adding and removing ESXi hosts from the inventory, changing the host's memory coni gu-
ration, and changing the i rewall settings.
Host Proi le Controls creating, editing, deleting, and viewing host proi les.
Network Controls the coni guration or removal of networks from the vCenter Server
inventory.
Performance Controls the ability of users to modify the intervals at which the performance
chart information is displayed on the Performance tab of an object.
Permissions Controls who has the ability to modify the permissions assigned to a role and
who can manipulate a role/user combination for a particular object.
Proi le-Driven Storage Controls who can view and update proi le-driven storage.
Resource Controls resource pool manipulation, including creating, deleting, or renaming
the pool; also controls migration by using vMotion and applying DRS recommendations.
Scheduled Task Controls the coni guration of tasks and the ability to run a task that is
scheduled inside vCenter Server.
Sessions Controls the ability to view and disconnect vSphere Client sessions connected to
vCenter Server and to send a global message to connected vSphere Client users.
Storage Views Controls changing the server coni guration and looking at storage views.
Tasks Controls the ability to create or update tasks.
VRMPolicy Controls settings around virtual rights management (VRM). VRM centers on
the management of security policies and access controls for VMs.