A two-way VMware integration
Until now the VMware integration was one-way. The agent collected inventory, snapshots, and change history from vCenter and uploaded it to the Portal. If you wanted to actually do something to a VM — take a snapshot before a patch, revert one after a botched upgrade, power-cycle a hung guest — you logged into vSphere.
This release closes that loop. From the VM modal you can now click Create / Delete / Revert Snapshot and Power On / Off / Reset. The agent picks the action up within a minute, runs it against vCenter, and reports back with the result. The Portal logs who clicked which button, when, and what happened — right alongside the existing change-history feed.
Two things make this safer than dropping a "Run vSphere" button into the UI:
- Nobody gets access by default. No user can run any command until an admin adds a permission rule for them. There's no built-in "administrators can do anything" shortcut. The upgrade seeds a starter rule for the Admin user type so you don't lock yourself out on day one, and that rule shows up in the new Permissions tab as a normal row you can narrow, edit, or delete.
- The local admin stays in charge. When the agent first runs on a customer's machine it asks whether to enable remote management and whether to capture console screenshots. Decline either and that feature is off. Pick neither and the agent stays inventory-only — identical to today's behavior.
The new VM modal
Open any VMware VM and you'll see three new things on the Details card.
- A Power button group in the Power Status row — Power On, Power Off, Reset. Destructive actions ask for confirmation, then queue the command and show a "queued, will execute within a minute" notice.
- An inline + Create Snapshot button above the existing snapshots table, plus per-row Revert and Delete buttons. The Create form is short: Name, Description, Quiesce, Memory.
- A pending-commands badge next to the modal title. Open it to see every queued or in-progress command for this VM, how old it is, and a Cancel link for anything still waiting.
Buttons you don't have permission to use are greyed out from the moment the modal opens, with a tooltip pointing the admin at the Permissions tab.
Permissions tab
The new Permissions tab on the VMware Integrations page is where the rules live. Each rule has four parts, and all four have to match for a command to be allowed:
| Part | What it answers |
|---|---|
| Principal | Who is the rule for? A group, a user type (Admin / User / Company User), or a specific user. |
| Scope | Where in your Portal inventory does the rule apply? Everywhere, certain companies, certain sites, or certain device types. |
| Match (optional) | Which VMs specifically? Match on name, OS, folder, tags, resource pool, network, host, or datastore — with the same operators you already use in Import Mappings (contains, equals, starts with, and so on). |
| Actions | What's the user allowed to do? Any combination of Create / Delete / Revert Snapshot, Power On / Off / Reset, and Capture Screenshot. |
The optional Match layer is what makes this expressive. A few examples of what it unlocks:
- Dev team power-cycles dev VMs. Group: Dev Team. Scope: All. Match: VM name contains "dev". Actions: Power On / Off / Reset.
- DBAs snapshot the Production folder. Group: DBAs. Scope: Database Server device type. Match: vSphere folder = "Production". Actions: Create / Delete / Revert Snapshot.
- Service desk power-cycles one site only. Group: Service Desk. Scope: Birkenhead site. Match: (any VM). Actions: Power On / Off / Reset.
- Console screenshots only on kiosk VMs. Group: Support. Scope: All. Match: VM tag contains "kiosk". Action: Capture Screenshot.
Rules live alongside your other VMware integration settings — nothing to install, nothing extra to maintain.
Daily and on-demand console screenshots
The agent's second opt-in adds a daily console screenshot of every powered-on VM, uploaded alongside the regular inventory sync. The thumbnail shows up on the VM Info dashboard with a Refresh link that grabs a fresh capture on demand — useful for catching a frozen guest, a Windows update prompt, or a console that nobody noticed had thrown up an error.
Powered-off VMs show a placeholder instead. We keep the most recent month or so of captures per VM, then prune older ones automatically.
Sensitive environments can skip this opt-in entirely. When it's off, no screenshots are ever captured or stored, and the Refresh link is greyed out so users can see at a glance that it's been disabled.
Two new Viewpoints
The Portal sidebar gains two new entries for tenants with VMware data:
- VMware Snapshots — one row per snapshot across every live VM. Click a VM name to jump into its modal at the snapshots section. Each row has its own Revert and Delete buttons, and you can multi-select to clean up a batch at once. The same permission rules apply whether you delete from here or from a single VM.
- Virtual Centers — one row per vCenter server you sync from, with version, build, cluster / host / VM / datastore counts, the agent that runs it, and the time of the last sync. Click a row to jump straight to the matched device's VCenter Info dashboard.
Both entries hide automatically on tenants that don't have any VMware data — nothing to clutter the sidebar on companies that don't use the integration.
vCenter privileges — just two built-in roles
The agent only needs as many privileges as the capabilities you turned on. The Settings tab on the integration page now lists the exact grants in a collapsible panel, and the agent prints the same list when it asks for credentials.
For an admin who just wants to ship without cloning custom roles:
- Grant Read-Only at the vCenter root (covers inventory).
- Grant Virtual Machine Power User at the same scope (covers snapshot + power).
- If screenshots are enabled, add the Console Interaction privilege on top.
- Add the Global Settings privilege manually — Read-Only doesn't include it.
The full per-tier privilege list, including the exact privilege names you'll click in the vSphere Roles editor, is in the Custom role for remote operations section of the VMware KB.
How fast does it actually queue?
The agent checks in for new commands once a minute when nothing is going on. The moment someone opens a VM modal or queues a command, the rate doubles for the next half-hour — so an admin who clicks Power Off on a freshly-opened modal usually sees it execute in 15 to 20 seconds, well under the worst-case minute.
The agent now stays running in the background instead of waking up once a day. That means there's a live connection to vCenter waiting whenever you click a button, and the daily inventory sync still happens automatically at a quiet hour. The first time you run it, the agent still offers to schedule itself; nothing to install differently.
Availability
These changes ship with the next IT Portal release. The previous post in this series — vSphere-style dashboards, storage trends, and change history — covers the read-side improvements that landed in 4.6.27 and the Import Mappings work that automatically creates Portal devices for new VMs.
