Skip to main content

LOCAL — vSphere service account

Purpose
Create and use a local vSphere/vCenter read-only service account for tooling integrations (e.g., Flexera, Qualys) with strong security and clear scope.

Steps​

  1. Log in to vSphere/vCenter
    Use an administrator account to access vCenter or the ESXi host directly. (19)

  2. Create local user
    In Users/Roles, create a new user (e.g., PCP-monitoring-RO). Set a strong password and document the purpose (monitoring or integration). (20)

  3. Assign permissions
    Grant the account Global → Read-Only. Select “Propagate to children” so permissions apply to all objects managed by vCenter. (21)

  4. Account usage
    Use this account for integrations (e.g., Flexera, Qualys). Prefer local accounts for tighter control and isolation, especially during vulnerabilities or incidents. (22)

  5. Domain-joined option
    If vCenter is domain-joined, you may use ABB domain accounts; however, local accounts are preferred for control. Avoid direct host access except for root or emergency use. (23)

  6. Security considerations
    Enable Lockdown Mode on hosts and manage permissions through vCenter, not directly on hosts, to comply with hardening guidelines. (24)

Notes​

  • Keep credentials in the approved password vault.
  • Rotate passwords per policy and review permissions at least quarterly.