[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Managing vSphere permissions\n============================\n\nSome tasks in vSphere require users to have certain permissions in order to\ncomplete successfully. When you create a private cloud, VMware Engine\nperforms an [initial setup of vSphere permissions](/vmware-engine/docs/concepts-permission-model)\nfor your ease of management. This document provides you with guidance on further\nmanaging permissions in vSphere.\n\nBefore you begin\n----------------\n\nTo manage vSphere permissions for your private cloud, you must first\n[elevate your privileges](/vmware-engine/docs/private-clouds/howto-elevate-privilege). Elevating your privileges\nthrough VMware Engine gives you the ability to perform administrative functions\nin vSphere.\n\nManaging vCenter user groups\n----------------------------\n\nUsers in the `Cloud-Owner-Group` group can administer various parts of the\nvSphere environment in the private cloud. The `Cloud-Owner-Group` group is\nautomatically given `Cloud-Owner-Role` privileges, and the `CloudOwner` user\nis added as a member of this group.\n\nGoogle creates additional groups with limited privileges for ease of management.\nYou can add any user to these pre-created groups, and this process assigns the\ncorresponding privileges to the user.\n\nFor a full list of pre-created vCenter user groups and their associated vCenter\nprivileges, see\n[Private cloud VMware vCenter permission model](/vmware-engine/docs/concepts-permission-model).\n\n### Granting management permission to individual users\n\nTo grant an individual user permissions to manage the private cloud, create a\nuser account and add it to the appropriate groups:\n\n- `Cloud-Owner-Group`\n- `Cloud-Global-Cluster-Admin-Group`\n- `Cloud-Global-Storage-Admin-Group`\n- `Cloud-Global-Network-Admin-Group`\n- `Cloud-Global-VM-Admin-Group`\n\n| **Warning:** Users added to the **Administrators** group are removed automatically. The **Administrators** group must contain only service accounts.\n\n### Creating new user groups\n\nYou can create additional user groups to enable access control for vCenter\nusers. However, new user groups must have permissions that are lower than\n`Cloud-Owner-Role`. Groups with permissions higher than `Cloud-Owner-Role`\nare automatically reset to `Cloud-Owner-Role`.\n\nWhat's next\n-----------\n\n- Learn how to [set up vCenter identity sources](/vmware-engine/docs/vmware-platform/howto-identity-sources).\n- Learn about the [private cloud vSphere permission model](/vmware-engine/docs/concepts-permission-model)."]]
