AppAssure vCenter Permissions for Exporting Virtual Standby VMs
In working recently with AppAssure in exporting VMs for Virtual Standby purposes, I found a lack of documentation in AppAssure or on the net surrounding permissions required in vCenter to export VMs as Virtual Standbys.
I wanted to share with you guys what permissions so far I have found to work with AppAssure in performing the export process with vCenter.
Create a user
The first thing I did was create a non privileged domain user to assign permissions to in vCenter to perform the export. I have seen cases where admins use the SSO administrator and other domain admin accounts to do this. This is not necessary. If you want to follow the model of least privilege access, it is best to create a normal domain user to assign permissions.
Permissions Errors
If you create a user and assign permissions in vCenter and you don’t have the permissions you need to run the export task, you will receive the following error message:
Cannot execute an export taskException chain:
Permission to perform this operation was denied.Cannot execute an export taskOne or more errors occurred.
Replay.Core.Contracts.Export.ExportException: Cannot execute an export task ---> System.Web.Services.Protocols.SoapException: Permission to perform this operation was denied.
Role and permissions
The first thing you will want to do is create a role to assign permissions to. Then we can add our domain user to this role which assumes the permissions of the role. I created a role called AppAssure_VirtualStandby and assigned the following permissions to it:
The final shot is the last set of permissions under Virtual Machines. This one can probably be paired down as I simply chose to give this role all virtual machine permissions which the export most likely doesn’t need all. However, your mileage may vary here.
After you setup the above role, simply go into your vCenter server permissions and assign your domain user to the role you created above.
Final Thoughts
If you like me were not successful in finding good documentation on the permissions AppAssure needed for the export or Virtual Standby process, hopefully the above notes will help you save some of the time that I burned trying to figure this out!
