STIGQter STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The vCenter Server must separate authentication and authorization for administrators.

DISA Rule

SV-258963r961863_rule

Vulnerability Number

V-258963

Group Title

SRG-APP-000516

Rule Version

VCSA-80-000298

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To add groups from an identity provider to the local SSO Administrators group, as an example, do the following:

From the vSphere Client, go to Administration >> Single Sign On >> Groups.

Select the Administrators group and click "Edit".

In the "Add Members" section, select the identity source and type the name of the target user/group in the search bar.

Select the target user/group to add them and click "Save".

Note: A new SSO group or groups can be created as needed and used to provide authorization to vCenter.

To remove identity provider users/groups from a role, do the following:

From the vSphere Client, go to Administration >> Access Control >> Global Permissions.

Select the offending user/group and click "Delete".

Note: If permissions are assigned on a specific object, then the role must be updated where it is assigned (for example, at the cluster level).

Check Contents

From the vSphere Client, go to Administration >> Access Control >> Roles.

View the Administrator role and any other role providing administrative access to vCenter to verify the users and/or groups assigned to it by clicking on "Usage".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-VIPermission | Sort Role | Select Role,Principal,Entity,Propagate,IsGroup | FT -Auto

If any user or group is directly assigned a role with administrative access to vCenter that is from an identity provider, this is a finding.

Note: Users and/or groups assigned to roles should be from the "VSPHERE.LOCAL" identity source.

Vulnerability Number

V-258963

Documentable

False

Rule Version

VCSA-80-000298

Severity Override Guidance

From the vSphere Client, go to Administration >> Access Control >> Roles.

View the Administrator role and any other role providing administrative access to vCenter to verify the users and/or groups assigned to it by clicking on "Usage".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-VIPermission | Sort Role | Select Role,Principal,Entity,Propagate,IsGroup | FT -Auto

If any user or group is directly assigned a role with administrative access to vCenter that is from an identity provider, this is a finding.

Note: Users and/or groups assigned to roles should be from the "VSPHERE.LOCAL" identity source.

Check Content Reference

M

Target Key

5573