I am trying to set up permissions in vCenter 6.0 by setting up groups and limiting access to folders by groups. These permissions work in the VMs and Templates view, in the Datastores view and Networks view. However, those permissions don't seem to work in the Host and Clusters view.
If I want a user to be able to create a VM, I need to enable propagate on the cluster to allow 'Allocate resources to Virtual Machine'. This, however, opens up ALL of the VMs to the users at the Hosts and Clusters view, even those that they specifically have No Access set under VMs and Templates views. Without the propagate permission, users can't create a VM in the cluster, even though that permission is enabled on each host.
I don't want to use Resource Pools to organize and secure VMs, as that's not the purpose of the the Resource Pools.
Any ideas what I am missing here?