Skip to main content
The tool reaches your own vCenter Server through its JSON API, signed in as the vCenter user you save in Neo, so each call is limited twice: by that user’s role in vCenter and by the agent’s permission groups below.
Automatically enabled when you configure VMware vSphere permissions in your agent workflow. No manual toggle needed.

​
What It Does

  • Find a VM by name, IP address, DNS name, UUID or inventory path, or among a client’s folder or resource pool
  • Read a VM’s power state, host, guest OS and IP address, guest disk space, snapshots, open alarms and recent tasks
  • Deploy a VM from a template with a guest customization specification, clone a VM, or create an empty VM
  • Change a VM’s CPU, memory, disks and networks; power it on, off or restart it; take, revert and remove snapshots; move it to another host or datastore; rename it; turn it into a template; delete it
  • Run a program inside a guest through VMware Tools, with a guest account a technician gives for the ticket
  • Read host health, maintenance mode and the VMs on a host; datastore free space and what fills it; triggered alarms, events and performance counters
  • Manage hosts and clusters, datastores, networks, alarms, permissions and vCenter settings, with the access and approvals you choose
The agent calls vCenter’s JSON API through the Vendor API tool, with vsphere as the vendor id. Sandbox scripts can call vSphere too, under the same permissions.

​
Permission Groups

Every group can be Disabled, Read Only or Read/Write. Neo never sends these calls: signing in, out or as someone else, ending another user’s session, and copying a session or its ticket (Neo signs in with the connection’s user and keeps the session to itself); remote console and host service tickets; guest file transfer links and guest sign-in tickets; a vSphere Lifecycle Manager cookie; backing up, restoring or resetting a host’s whole configuration; vSAN’s migrations between standard and distributed switches; applying a cluster’s DRS recommendation, which can power a host; changing a stretched cluster’s layout; vSAN calls that act on hosts or VMs (site maintenance, node evacuation, VM health tests, VIB and firmware installs); configuring a cluster’s HCI setup, applying a host profile’s configuration, and a cluster change that sets vSAN or encryption; turning an alarm or its actions back on; deleting a folder, datacenter, resource pool or vApp with what is inside; an alarm or scheduled task whose action calls a method or runs a script, and running a scheduled task; running a command an extension registered; exporting a host profile or answer file as text, which can carry passwords; and calls through the abstract ManagedEntity type, so each call names the object’s own type. Neo removes the fields vSphere keeps credentials in from every answer.

​
Access Profiles

Every group Read Only. The agent reads, and never changes anything.
Alarms, Events and Tasks is Read/Write without approval. Virtual Machines and Guest Operations are Read/Write with technician approval. Everything else is Read Only.
Every group Read/Write. Guest Operations, Host Firewall and Services, Users, Roles and Permissions, and Licenses, Certificates and Settings require technician approval, and so do the changes below.
Every group Read/Write without approval, except the changes below, which still require technician approval.

​
Safety Controls

These require technician approval under every access profile, whatever the group’s own approval setting:
  • Deleting or unregistering an inventory object (a VM, vApp, host, cluster or network) or encryption keys, uninstalling software, a patch or an agency’s agents, turning off a VM’s fault tolerance, and a VM change that deletes or replaces a disk’s file.
  • In Storage and Datastores, any change that deletes or removes something: a datastore, a file or virtual disk, a vSAN object, disk or file share, a storage policy, or a storage setting such as an iSCSI target.
  • Any change to users, roles, permissions, sessions, host local accounts, lockdown mode or Active Directory membership.
  • Any change to alarms or scheduled tasks other than acknowledging or clearing a triggered alarm.
  • Any change to certificates, encryption keys, key providers or vCenter extensions, and turning encryption on or off or changing the key of a host, cluster, VM or disk, which also needs Licenses, Certificates and Settings enabled.
  • Any change that stores a credential. The guest account in a guest operation is used for that call only, so it does not ask on its own.