I am running a private cloud Hyper-V cluster, managed by SC VMM 2012 R2, with App Controller 2012 R2 providing the web-based front end for VM self-service users.
I need to be able to grant my self-service users the rights to mount and unmount ISO images from the library on the VMs they administer. However, they must NOT be allowed to create and delete their VMs.
Unfortunately, it seems that the only way to give them the capability to do this is to grant them both "deploy" and "remove" permissions to their SSU role. However, if I do this, it obviously gives them the ability to also create new VMs and, even worse, to delete their own VMs!!!
This very course level of granulation is completely unacceptable in my organisation. It is one thing to be able to mount/unmount an ISO on your own VM, but an entirely different thing altogether to be able to create and delete VMs.
Please can anyone advise whether:
1. There is any workaround to provide just the permissions I need to my users without the deploy/remove VM rights also?
2. Do the Microsoft developers acknowledge the issue and need for a better level of granularity in SSU VM permissions and whether there are any plans to address it in future rollouts or fixes?
Thanks,
Henann
