Administrative and Operational Tasks
Access control and day-to-day operations
vSphere permissions combine three elements: a user or group, a role (a set of privileges), and an inventory object. Permissions propagate downward from the object where they are assigned, never upward. Assign roles to SSO groups rather than individuals, and use the minimum privileges required. Built-in roles range from Read-Only to Administrator; custom roles clone and adjust privileges. Tags and categories organize objects across folders; alarms trigger on conditions and can send SNMP traps or run scripts; scheduled tasks handle recurring maintenance.
Lifecycle and protection
Use host profiles or vSphere Lifecycle Manager to keep hosts compliant. Back up the VCSA with the VAMI file-based backup and store it off-appliance; vCenter HA protects availability but is not a backup. Use content libraries for templates and ISOs. Snapshots are for short rollback windows, not backups-they grow, degrade performance, and complicate consolidation. Monitor capacity and alarms, review logs, and rotate certificates before expiry. For change management, test in non-production and record baseline metrics.
Traps
Do not grant Administrator at the root to solve a permission problem. Do not assume a permission assigned at a VM applies to its datastore. Do not confuse alarms with scheduled tasks. Do not rely on snapshots as a disaster-recovery strategy. Do not forget that vCenter HA failover does not restore deleted objects.
Worked example: An auditor needs read-only access to all VMs in a datacenter. Create an SSO group, assign the Read-Only role to the group at the datacenter object, and verify propagation to clusters, hosts, and VMs. Do not assign the role at each VM; that creates drift and missed objects.
Rule of thumb: Least privilege, group-based roles, propagate from the highest object that makes sense, and back up vCenter separately from HA.