u/Over_Needleworker888

Holla,
We currently have approximately 50% of our VMware infrastructure licensed through VCF subscriptions, while the remaining 50% is covered by older perpetual esxi licenses.

The perpetual licenses are still valid, but SnS/support has expired. I’m trying to determine the cleanest and most compliant way to operate this mixed environment (ideally to separate).

Would it be possible to deploy a separate vCenter to manage the clusters using the perpetual licenses, while keeping the VCF-licensed clusters under the VCF management and licensing model?

TL;DR: I need to create another vCenter instance to manage clusters with perpetual licenses, but I'm not sure if that's legal.

Heyo,
I’m looking into vCenter integration with Microsoft Entra ID and I want to confirm the security implications. My concern is this.. if vCenter is configured to use Entra ID, and a vCenter Administrator role is assigned to an Entra group, does that mean an Entra Global Admin could effectively get vCenter admin access just by adding themselves or someone else into that group?

So in practice Entra Global Admin can manage users/groups in Entra. vCenter trusts Entra for authentication. A synced Entra group is mapped to Administrator in vCenter.

Would that mean the real control point becomes Entra group membership, not vCenter itself?
I’m mainly trying to understand whether this is considered normal design, or whether it should be treated as a separation-of-duties risk and avoided with stricter RBAC / PIM / approval around privileged group membership.

How are you handling this in production?

Thanks!!