VMware VDP Required Permissions

In some environments you might have to reduce the permissions given to the vSphere Data Protection (VDP) Backup User to as few as possible. The documentation provided by VMware is a little bit ambiguous on that topic. The permissions given in that post are at least required for the following purposes:

• VDP backup user (The user that the appliances uses to talk to the vCenter Server)
• Configure and Add Backup/Restore Jobs
• See the vSphere Data Protection button in the vSphere Web Client

Required permissions for vSphere Data Protection

This permissions are required for the vSphere Data Protection to work. You have to set that permissions to the vCenter object. Please note that you should not give different users permissions to backup different Virtual Machines. When you edit a Backup Job which contains VMs that are not visible to you, the Virtual Machine gets removed from the backup job.

Powershell Script to Create a Role

This small PowerCLI Script creates a Role named VDP-Backup with the required permissions. You have to be connected to the vCenter Server. (Check this post if you are new to PowerCLI):

New-VIRole -Name VDP-Backup -Privilege (Get-VIPrivilege -Id System.Anonymous,
System.View,
System.Read,
Global.LogEvent,
Global.CancelTask,
Global.Settings,
Folder.Create,
Datastore.Rename,
Datastore.Move,
Datastore.Delete,
Datastore.Browse,
Datastore.DeleteFile,
Datastore.FileManagement,
Datastore.AllocateSpace,
Network.Config,
Network.Assign,
VirtualMachine.Inventory.Create,
VirtualMachine.Inventory.Register,
VirtualMachine.Inventory.Delete,
VirtualMachine.Inventory.Unregister,
VirtualMachine.Interact.PowerOn,
VirtualMachine.Interact.PowerOff,
VirtualMachine.Interact.Reset,
VirtualMachine.Config.Rename,
VirtualMachine.Config.AddExistingDisk,
VirtualMachine.Config.AddNewDisk,
VirtualMachine.Config.RemoveDisk,
VirtualMachine.Config.RawDevice,
VirtualMachine.Config.HostUSBDevice,
VirtualMachine.Config.CPUCount,
VirtualMachine.Config.Memory,
VirtualMachine.Config.AddRemoveDevice,
VirtualMachine.Config.EditDevice,
VirtualMachine.Config.Settings,
VirtualMachine.Config.Resource,
VirtualMachine.Config.UpgradeVirtualHardware,
VirtualMachine.Config.ResetGuestInfo,
VirtualMachine.Config.AdvancedConfig,
VirtualMachine.Config.DiskLease,
VirtualMachine.Config.SwapPlacement,
VirtualMachine.Config.DiskExtend,
VirtualMachine.Config.ChangeTracking,
VirtualMachine.Config.ReloadFromPath,
VirtualMachine.State.CreateSnapshot,
VirtualMachine.State.RevertToSnapshot,
VirtualMachine.State.RemoveSnapshot,
VirtualMachine.Provisioning.MarkAsTemplate,
VirtualMachine.Provisioning.DiskRandomRead,
VirtualMachine.Provisioning.GetVmFiles,
Resource.AssignVMToPool,
Task.Create,
Task.Update,
Sessions.ValidateSession)