Security, Permissions, and Certificates
Permissions model
A role is a bundle of privileges; a permission assigns a role to a user or group on an inventory object. The "propagate to children" checkbox controls inheritance down the hierarchy. Global permissions apply across all objects. Effective permission is the union of inherited and direct assignments. vCenter permissions do not grant ESXi host access, which uses its own local users or AD-joined accounts.
Host and VM security
- Lockdown mode and exception users control direct host access.
- Secure Boot, UEFI and TPM support host and VM integrity; vTPM enables guest encryption features and is required for some OS security capabilities.
- VM encryption and vSAN encryption depend on a key management server; vSphere Trust Authority supports a more isolated trust model.
- Core dump encryption protects host crash files.
Certificates
VMCA issues certificates by default. In hybrid mode VMCA signs from an enterprise or third-party root CA; in full custom mode you replace certificates manually. The replacement order matters: VMCA root first, then machine SSL certificates, then solution user certificates (including the STS signing certificate). A wrong order can break SSO authentication.
Traps
Expect distractors that treat a role as a permission, ignore propagation, or assume adding a user to an AD group instantly grants access without a vCenter permission. Certificate questions often hide the dependency between the STS certificate and SSO login. Encrypting a VM without a reachable KMS leaves the VM unbootable.
Rule of thumb
Grant permissions to groups, not users, and only at the highest object where the privilege set is uniform; keep the number of administrators in the SSO domain minimal.