While still in Virtual Machine, scroll down and click Move, Register, and Unregister.

Scroll down on the right to see more Virtual machine permissions. On the right, click Change Configuration to enable all Configuration permissions. On the right, enable Assign virtual machine to resource pool, and Migrate powered on virtual machine.

For Virtual SAN, enable Profile-driven storage and everything under it.

While still in Host, scroll down to the Inventory section and click Modify cluster.

Then scroll down on the right to see more Host settings. On the right, in the Configuration section, enable Advanced Settings.

While still in Global, enable Manage custom attributes, and Set custom attribute.

On the right, enable Act as vCenter Server, Disable Methods, and Enable Methods, and then scroll down on the right to see more Global permissions. On the right, enable Create folder, and Delete folder. On the right, enable Allocate space, and Browse datastore.

While still in Cryptographic operations, scroll down and enable Migrate and Register host.

Scroll down on the right to see more Cryptographic operations permissions. On the right, enable Clone, Decrypt, Direct Access, Encrypt, and Manage KMS.

If you are using vTPM, then on the left, click Cryptographic operations.

In the Roles node, click NEW to add a Role.

In vSphere Web Client, click the hamburger menu icon and then click Administration.

See the Product Interoperability Matrix for supported vCenter versions. See Privileges Required for the vCenter Server User With Instant Clones at VMware Docs. This role has all permissions needed for both full clones and instant clones.

Permissions will be delegated where needed. Make sure the password does not expire.

This account can also be used by Instant Clones to create computer accounts in Active Directory. Create an account in Active Directory that VMware Horizon will use to login to vCenter.

2020 Aug 14 – updated entire article for Horizon 2006 (aka Horizon 8).

2021 Jan 8 – updated entire article for Horizon 2012 (8.1).

2021 Sep 30 – Horizon Console – added step to disable CORS for Horizon 2106 and newer to fix HTML Access.

This post applies to all VMware Horizon versions 2006 (aka 8.0) and newer.

Vmware horizon servers