VMware vRealize Automation 7.x User Roles

Roles consist of a set of privileges that can be associated with users to determine what tasks they can perform. Based on their responsibilities, individuals might have one or more roles associated with their user account.

All user roles are assigned within the context of a specific tenant. However, some roles in the default tenant can manage system-wide configuration that applies to multiple tenants.

System-Wide Roles and Responsibilities
Role	Responsibilities	How Assigned
System Administrator	■ Create tenants. ■ Configure tenant identity stores. ■ Assign IaaS administrator role. ■ Assign tenant administrator role. ■ Configure system default branding. ■ Configure system default notification providers. ■ Monitor system event logs, not including IaaS logs. ■ Configure the vRealize Orchestrator server for use with XaaS. ■ Create and manage (view, edit, and delete) reservations across tenants if also a fabric administrator.	Built-in administrator credentials are specified when configuring single sign-on.
IaaS Administrator	■ Configure IaaS features, global properties. ■ Create and manage fabric groups. ■ Create and manage endpoints. ■ Manage endpoint credentials. ■ Configure proxy agents. ■ Manage Amazon AWS instance types. ■ Monitor IaaS-specific logs. ■ Create and manage (view, edit, and delete) reservations across tenants if also a fabric administrator.	The system administrator designates the IaaS administrator when configuring a tenant.

Tenant Roles and Responsibilities
Role	Responsibilities	How Assigned
Tenant administrator	■ Customize tenant branding. ■ Manage tenant identity stores. ■ Manage user and group roles. ■ Create custom groups. ■ Manage notification providers. ■ Enable notification scenarios for tenant users. ■ Configure vRealize Orchestrator servers, plug-ins and workflows for XaaS. ■ Create and manage catalog services. ■ Manage catalog items. ■ Manage actions. ■ Create and manage entitlements. ■ Create and manage approval policies. ■ Monitor tenant machines and send reclamation requests.	The system administrator designates a tenant administrator when creating a tenant. Tenant administrators can assign the role to other users in their tenant at any time from the Administration tab.
Fabric Administrator	■ Manage property groups. ■ Manage compute resources. ■ Manage network profiles. ■ Manage Amazon EBS volumes and key pairs. ■ Manage machine prefixes. ■ Manage property dictionary. ■ Create and manage reservations and reservation policies in their own tenant. ■ If this role is added to a user with IaaS administrator or system administrator privileges, the user can create and manage reservations and reservation policies in any tenant.	The IaaS administrator designates the fabric administrator when creating or editing fabric groups.
Application architect	■ Assemble and manage composite blueprints.	Tenant administrators can assign this role to users in their tenant at any time from the Administrationtab.
Infrastructure Architect	■ Create and manage infrastructure blueprint components. ■ Assemble and manage composite blueprints.	Tenant administrators can assign this role to users in their tenant at any time from the Administrationtab.
XaaS architect	■ Define custom resource types. ■ Create and publish XaaS blueprints. ■ Create and manage resource mappings. ■ Create and publish resource actions.	Tenant administrators can assign this role to users in their tenant at any time from the Administrationtab.
Software Architect	■ Create and manage software blueprint components. ■ Assemble and manage composite blueprints.	Tenant administrators can assign this role to users in their tenant at any time from the Administrationtab.
Catalog Administrator	■ Create and manage catalog services. ■ Manage catalog items. ■ Assign icons to actions.	Tenant administrators can assign this role to users in their tenant at any time from the Administrationtab.
Business group manager	■ Add and delete users within their business group. ■ Assign support user roles to users in their business group. ■ Create and manage entitlements for their business group. ■ Request and manage items on behalf of a user in their business group. ■ Monitor resource usage in a business group. ■ Change machine owner.	The tenant administrator designates the business group manager when creating or editing business groups.
Approval administrator	■ Create and manage approval policies.	Tenant administrators can assign this role to users in their tenant at any time from the Administrationtab.
Approver	■ Approve service catalog requests, including provisioning requests or any resource actions.	The tenant administrator or approval administrator creates approval policies and designates the approvers for each policy.
Support user	■ Request and manage items on behalf of other users in their business group. ■ Change machine owner.	The tenant administrator designates the support user when creating or editing business groups.
Business user	■ Request catalog items from the service catalog. ■ Manage their provisioned resources.	The tenant administrator designates the business users who can consume IT services when creating or editing business groups.

Info Source:-

http://pubs.vmware.com/vra-70/index.jsp#com.vmware.vrealize.automation.doc/GUID-135436AC-CF31-44A1-A358-61D2B68183AE.html