---
title: "Step 3. Assign Permissions on Infrastructure Inventory Objects"
description: "To view and work with virtual infrastructure objects in Veeam ONE, the user must have appropriate permissions on these objects set in the VMware vSphere or VMware Cloud Director inventory."
canonical: "https://helpcenter.veeam.com/docs/one/userguide/assign_permissions.html"
breadcrumb: "User Guide > Multi-Tenant Monitoring and Reporting > Configuring Access for Users with Restricted Permissions > Step 3. Assign Permissions on Infrastructure Inventory Objects"
dateModified: "2026-10-23"
---

# Step 3. Assign Permissions on Infrastructure Inventory Objects

To view and work with virtual infrastructure objects in Veeam ONE, the user must have appropriate permissions on these objects set in the VMware vSphere or VMware Cloud Director inventory.

## VMware vSphere Permissions {#vsphere_permissions}

Connect to vCenter Server or standalone host with vSphere Client and assign permissions on objects to which the user must have access.

The following table shows minimal required privileges on VMware vSphere inventory objects.

<table style="width:100%;" class="Blue_Table">
  <tr style="vertical-align:top">
    <th style="width:30%;">
      <p>VI Inventory Object</p>
    </th>
    <th>
      <p>VMware vSphere Privilege</p>
    </th>
  </tr>
  <tr style="vertical-align:middle">
    <td>
      <p class="Table_Text_Bold"><span class="Table_Text_Bold">vCenter Server (root)</span><br/><span class="Table_Text_Bold">Data Center</span><br/><span class="Table_Text_Bold">Cluster</span><br/><span class="Table_Text_Bold">Host</span><br/><span class="Table_Text_Bold">Resource Pool/vApp</span><br/><span class="Table_Text_Bold">Datastore Cluster</span><br/><span class="Table_Text_Bold">Datastore</span></p>
    </td>
    <td>
      <p>Read-only</p>
    </td>
  </tr>
  <tr style="vertical-align:middle">
    <td>
      <p class="Table_Text_Bold"><span class="Table_Text_Bold">Virtual Machine</span></p>
    </td>
    <td>
      <ul>
        <li class="Table_List">Read-only</li>
        <li class="Table_List">Virtual machine.Interaction.Answer question<span style="font-size:7pt; vertical-align:super;">1</span></li>
        <li class="Table_List">Virtual machine.Interaction.Console interaction<span style="font-size:7pt; vertical-align:super;">1</span></li>
      </ul>
    </td>
  </tr>
</table>

^1^ Required to access VM console in Veeam ONE Client

::: note

If you assign permissions to container objects (such as hosts, resource pools or vApps), consider enabling propagation. In this case, all new child objects that may be added to the container in future will become available to the user.

:::

## VMware Cloud Director Permissions

Connect to VMware Cloud Director and assign permissions on objects to which the user must have access.

The following table shows minimal required roles for VMware Cloud Director inventory objects.

<table style="width:100%;" class="Blue_Table">
  <tr style="vertical-align:top">
    <th style="width:30%;">
      <p>VI Inventory Object</p>
    </th>
    <th>
      <p>VMware Cloud Director Role</p>
    </th>
  </tr>
  <tr style="vertical-align:middle">
    <td>
      <p class="Table_Text_Bold"><span class="Table_Text_Bold">vCloud Director (root)</span></p>
    </td>
    <td>
      <p>System Administrator</p>
    </td>
  </tr>
  <tr style="vertical-align:middle">
    <td>
      <p class="Table_Text_Bold"><span class="Table_Text_Bold">Organization</span></p>
    </td>
    <td>
      <p>Console access only</p>
    </td>
  </tr>
</table>