Minimum vCenter Server Privileges for Managing Full Clones and Instant Clones

An administrator must have certain vCenter Server privileges to manage full clones and instant clones.

Horizon administrators need to create a custom role in vCenter Server and select the following privileges to manage full clones. The following table lists the minimum vCenter Server privileges to perform basic operations in vCenter Server.

Table 1. Full Clone Privileges

Task	Privilege Group on vCenter Server for Full Clones
Create a folder Delete a folder	Folder
Allocation space	Datastore
Configuration Add or remove a device Advanced Modify device settings Interaction Power Off Power On Reset Suspend Perform wipe or shrink operations Inventory Create new Create from existing Remove Provisioning Customize Deploy template Read customization specifications Clone template Clone virtual machine	Virtual Machine
Assign virtual machine to a resource pool	Resource
Act as vCenter Server (required even if you do not use View Storage Accelerator)	Global
(All – if you are using Virtual SAN datastores of Virtual Volumes)	Profile Driven Storage
Implement View Storage Accelerator to enable ESXi host caching: Configure advanced settings.	Host

Table 2. Instant Clone Privileges

Task	Privilege Group on vCenter Server for Instant Clones
Create a folder Delete a folder	Folder
Allocation space Browse datastore	Datastore
Configuration Add or remove a device Advanced Modify device settings Change CPU count Change memory Change settings Change resource Configure Host USB device Configure raw device Configure mangedby Display connection settings Extend virtual disk Query fault tolerance compatibility Query unknown files Reload from path Remove disk Rename Reset guest information Set annotation Toggle disk change tracking Toggle fork parent Upgrade virtual machine compatibility Interaction Power Off Power On Reset Suspend Perform wipe or shrink operations Connect Devices Inventory Create new Create from existing Remove Move Register Unregister Snapshot management Create snapshot Remove snapshot Rename snapshot Revert snapshot Provisioning Customize Deploy template Read customization specifications Clone template Clone virtual machine Allow disk access	Virtual Machine
Assign virtual machine to a resource pool	Resource
Act as vCenter Server Enable methods Disable methods Manage custom attributes Set custom attributes	Global
Inventory: modify cluster Implement View Storage Accelerator: Configure advanced settings	Host
Assign	Network
(All – if you are using Virtual SAN datastores of Virtual Volumes)	Profile Driven Storage
Use vTPM with instant clones: Clone Decrypt Direct access Encrypt Manage KMS Migrate Register Host	Cryptographic operations