@Joern_Ravnsbaek, its looks like the missing privilege you need to assign is vApp.Import. Since you are likely using OVF/OVA templates, this privilege is required to deploy a virtual machine from a library template. Try adding this privilege to your AD-ROLE and see if it resolves the issue.
I am sharing this based on my expertise and experience, aiming to provide a clear analysis of the underlying cause of this issue and a reliable approach to resolving it effectively.
Root Cause:
The error message "You do not have permission to create a virtual machine from a library template in the selected resource. Select another location." occurs because the AD-ROLE lacks the necessary privileges to deploy a virtual machine from a Content Library template to the selected compute resource.
The missing privilege is vApp.Import, which is required when deploying OVF/OVA templates from the Content Library. Without this privilege, the system prevents the user from selecting the compute resource for deployment.
Additionally, ensure that the AD-ROLE has the following privileges:
-
Datastore → Allocate space (Required for storage allocation)
-
Resource → Assign virtual machine to resource pool (Required for selecting compute resources)
-
Virtual Machine → Provisioning → Deploy template (Required for deploying templates)
-
Virtual Machine → Provisioning → Clone template (Required for cloning templates)
-
Virtual Machine → Provisioning → Customize guest (Required for guest customization)
Resolution Steps:
-
Grant the missing privilege:
-
Navigate to vCenter Server.
-
Go to Administration → Roles.
-
Edit the AD-ROLE and add the vApp.Import privilege.
-
Verify permissions propagation:
-
Ensure that the AD-Group is assigned to Global Permissions and propagated to child objects.
-
Check if the permissions are correctly applied to Clusters, Resource Pools, Datastores, and Networks.
-
Check access to the source template:
-
If the template is stored in a restricted folder or cluster, users may lack access.
-
Convert the template back to a VM, move it to an accessible location, and then reconvert it to a template.
-
Validate datastore permissions:
-
Test deployment:
Original Message:
Sent: Oct 19, 2021 07:35 AM
From: Joern_Ravnsbaek
Subject: vCenter custom roles needed to create a vm, convert to template and deploy from Content Library
I'm trying to create a new role (AD-ROLE) for the admin team that could do the following:
- upload ISO to Content Libarary
- create a new virtual machine and connect an ISO from Content Library
- convert virtual machine to template on Content Library
- deploy a new vm using the template on Content Library
- be able to view Content Library to see available OVF/OVA and templates
I created a group (AD-Group) and added to Global Permissions with the AD-ROLE and propagated to children.
The current (AD-ROLE) privileges has been configured, but when I deploy from template and try to select the compute resource it get this error:
You do not have permission to create a virtual machine from a library template in the selected resource. Select another location.
What is the missing privilege to be able to select the compute resource ?
Content Library
- Add library item
- Chek in a template
- Check out a template
- Create a subscription for a published library
- Delete library item
- Download files
- Evict library item
- Probe subscription information
- Publish a library item to its subscribers
- Publish a library ito its subscribers
- Read storage
- Sync library item
- Update files
- Update library
- Update library item
- Update local library
- View configuration settings
Datastore
- Allocate space
- Browse datastore
- Low level file operation
Network
Virtual machine
- Change Configuration
- Add existing disk
- Add new disk
- Add or remove device
- Change CPU count
- Chamge Memory
- Edit Inventory
- Create from existing
- Create new
- Interaction
- Answer question
- Backup operation on virtual machine
- Configure CD media
- Configure floppy media
- Connect devices
- Console interaction
- Create screenshot
- Defragment all disks
- Drag and drop
- Guest operation system management by VIX API
- Inject USB HID scan codes
- Install VMware Tools
- Pause or Unpause
- Perform wipe or shrink operations
- Power off
- Power on
- Reset
- Suspend
- privilege.VirtualMachine.Interact.SuspendToMemory.label
- Provisioning
- Clone template
- Clone virtual machine
- Create template from virtual machine
- Customize guest
- Deploy template
- Mark as template
- Mark as virtual machine