This message was deleted.

you can create a custom role and create a folder and then stick the VM's in the folder and then assign the permissions at the folder level

Perfect, that's exactly what I was looking for, and assumed.

must have Vcenter connected up to ldap identity source tho to be able to add AD users/groups 🙂

if moving vm's into folders, be sure you check your backup software. i have veeam target certain folders for certain jobs