# Configuring Global Permissions

**URL:** <https://forum.ansible.com/t/configuring-global-permissions/10645>\
**Category:** Get Help\
**Tags:** vmware, collections\
**Created:** [November 2, 2024, 7:40pm UTC](https://forum.ansible.com/t/configuring-global-permissions/10645 "2024-11-02T19:40:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sigbjornl](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@sigbjornl](https://forum.ansible.com/u/sigbjornl)\
**Post date:** [November 2, 2024, 7:40pm UTC](https://forum.ansible.com/t/configuring-global-permissions/10645/1 "2024-11-02T19:40:53Z")

</div>

We’re looking for a way to configure Global Permissions in vCenter. I found the community.vmware.vmware\_object\_role\_permission module, however it does not seem to be able to configure Global Permissions.

Does a module for configuring Global Permissions exist?

---

<div class="post-metadata">

**Author:** ![jiholland](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jiholland/32/11273_2.png) [@jiholland](https://forum.ansible.com/u/jiholland)\
**Post date:** [November 3, 2024, 7:15am UTC](https://forum.ansible.com/t/configuring-global-permissions/10645/2 "2024-11-03T07:15:29Z")

</div>

I do not think that is possible:

> <https://github.com/ansible-collections/community.vmware/issues/437>
>
> \##### SUMMARY
> 
> There are existing modules for managing permissions at the vCen…ter and lower levels, but this module does not appear to support Global Permissions as seen in the vCenter HTML5 interface. Using Code Capture in vCenter does not show any API requests for managing them, but online research has shown some Powershell modules that connect to the MOB of vCenter to add Global Permissions.
> A new module that can replicate this action of managing Global Permissions would help make this feature complete, as with larger linked-mode vCenter installs, adding permissions as Global rather than at each vCenter is beneficial
> 
> \##### ISSUE TYPE
> \- Feature Idea
> 
> \##### COMPONENT NAME
> 
> Expand vmware\_object\_role\_permission or create a new module
> 
> \##### ADDITIONAL INFORMATION
> 
> 
> 
> \`\`\`yaml
> 
> \`\`\`

---

<div class="post-metadata">

**Author:** ![mariolenz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mariolenz/32/108_2.png) [@mariolenz](https://forum.ansible.com/u/mariolenz)\
**Post date:** [November 3, 2024, 1:28pm UTC](https://forum.ansible.com/t/configuring-global-permissions/10645/3 "2024-11-03T13:28:06Z")

</div>

ATM this isn’t possible. There are two PRs trying to implement this:

- [adds vCenter global permissions module](https://github.com/ansible-collections/community.vmware/pull/1434)
- [add vcenter\_global\_permissions module](https://github.com/ansible-collections/community.vmware/pull/1701)

The problem is that there’s no official API to do this. At least, I didn’t find one yet.

Those two PRs use the MOB to implement this, but I’m doubtful that this is a good approach.

---

<div class="post-metadata">

**Author:** ![sigbjornl](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@sigbjornl](https://forum.ansible.com/u/sigbjornl)\
**Post date:** [November 4, 2024, 9:48am UTC](https://forum.ansible.com/t/configuring-global-permissions/10645/4 "2024-11-04T09:48:44Z")

</div>

Thank you for the replies. I understand the issue. Configuring permissions on the vCenter top level might be a better way to go for now.

It seem like using “object\_name: rootFolder” will configure vCenter top level permissions using the existing community.vmware.vmware\_object\_role\_permission module?

---

<div class="post-metadata">

**Author:** ![mariolenz](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mariolenz/32/108_2.png) [@mariolenz](https://forum.ansible.com/u/mariolenz)\
**Post date:** [October 13, 2025, 4:46pm UTC](https://forum.ansible.com/t/configuring-global-permissions/10645/5 "2025-10-13T16:46:07Z")

</div>

It looks like VMware / Broadcom improved the SDKs ([VMware Cloud Foundation Evolution: Unpacking PowerCLI, Software Development Kit, and API Enhancements](https://www.vmware.com/explore/video-library/video/6377279380112)) a lot. So maybe we can find a better way to implement this than talking to the MOB. Implementing stuff using MOB feels somewhat fragile to me.

I’ve asked [here](https://williamlam.com/2025/04/quick-tip-listing-vsphere-global-permissions-using-powershell.html#comment-77269) if this would be possible.