Cryptographic operations privileges control who can perform which type of cryptographic operation on which type of object.

You can set this privilege at different levels in the hierarchy. For example, if you set a privilege at the folder level, you can propagate the privilege to one or more objects within the folder. The object listed in the Required On column must have the privilege set, either directly or inherited.

Table 1. Cryptographic Operations Privileges

Privilege Name

Description

Required On

Cryptographic operations > Direct Access

Allows users access to encrypted resources. For example, users can export virtual machines, have NFC access to virtual machines, and so on.

Virtual machine, host, or datastore

Cryptographic operations > Add disk

Allows users to add a disk to an encrypted virtual machine.

Virtual machine

Cryptographic operations > Clone

Allows users to clone an encrypted virtual machine.

Virtual machine

Cryptographic operations > Decrypt

Allows users to decrypt a virtual machine or disk.

Virtual machine

Cryptographic operations > Encrypt

Allows users to encrypt a virtual machine or a virtual machine disk.

Virtual machine

Cryptographic operations > Encrypt new

Allows users to encrypt a virtual machine during virtual machine creation or a disk during disk creation.

Virtual machine folder

Cryptographic operations > Manage encryption policies

Allows users to manage virtual machine storage policies with encryption IO filters. By default, virtual machines that use the Encryption storage policy do not use other storage policies.

vCenter Server root folder

Cryptographic operations > Manage key servers

Allows users to manage the Key Management Server for the vCenter Server system. Management tasks include adding and removing KMS instances, and establishing a trust relationship with the KMS.

vCenter Server system.

Cryptographic operations > Manage keys

Allows users to perform key management operations. These operations are not supported from the vSphere Web Client but can be performed by using crypto-util or the API.

vCenter Server root folder

Cryptographic operations > Migrate

Allows users to migrate an encrypted virtual machine to a different ESXi host. Supports migration with or without vMotion and storage vMotion. Does not support migration to a different vCenter Server instance.

Virtual machine

Cryptographic operations > Recrypt

Allows users to recrypt virtual machines or disks with a different key. This privilege is required for both deep and shallow recrypt operations.

Virtual machine

Cryptographic operations > Register VM

Allows users to register an encrypted virtual machine with an ESXi host.

Virtual machine folder

Cryptographic operations > Register host

Allows users to enable encryption on a host. You can enable encryption on a host explicitly, or the virtual machine creation process can enable it.

Host folder for standalone hosts, cluster for hosts in cluster