VRO - Vcenter Permissions

[Stabz]

Hey,

Since VRO requires an initial connection to the production vCenter to gather inventory and vSphere tags, do you have a list of the permissions required to read this datas?
I would like to apply a "least privilege" approach. I understand that an account with elevated privileges is needed on the recovery-side vCenter, but I believe we can restrict the one on the production side.

I look forward to hearing from you.

[Alec King]

Hi! We discussed this today and we believe that 99% of functionality will work if you grant VRO read-only access to your source vCenter.
This assume you are using standard VMware restore or replica plans - not storage integrations.

Some specific recovery steps would not work - for example "Shutdown Source VM" and the more flexible "VM Power Actions" step would not work, as VRO talks direct to vCenter for those actions.

Please note that VRO would still be able to command VBR to perform actions on your source vCenter - e.g if you run a VRO restore plan and choose a target of Original Location (your source vCenter), VBR will have the required permissions, so restore will proceed. Some steps still would not work, such as VRO renaming the restored VMs, because that again is a direct action VRO takes on vCenter.
However as you are not planning any restores to the source vCenter, this won't affect you.

In short, most essential functionality will work if VRO has read-only access to the source vCenter.

And you may be interested in our upcoming features around 'clean room recovery' and working with imported backups, where no connection to source vCenter (or even source VBR!) is required to build and run VRO plans. Coming later this year!