Data Protector Virtual Environment integration for VMware HPE Data Protector states:
*****
Specify an operating system user account that has the following VMware vSphere privileges:
The privileges shown in the table are as seen in VMware vSphere 5.5.
Datastore -> Allocate space
Datastore -> Browse datastore
Datastore -> Low level file operations
Datastore -> Remove file
Datastore -> Rename datastore
Folder -> Delete folder
Folder -> Rename folder
Global -> Disable methods
Global -> Enable methods
Global -> Licenses
Host -> Configuration -> Maintenance
Host -> Inventory -> Add standalone host
Network -> Assign network
Resource -> Assign virtual machine to resource pool
Resource -> Remove resource pool
Resource -> Rename resource pool
Sessions -> Validate session
vApp -> Delete
vApp -> Rename
vApp -> Add virtual machine
Virtual machine -> Snapshot Management -> Revert to snapshot
Virtual machine -> Configuration *
Virtual machine -> Interaction -> Answer question
Virtual machine -> Interaction -> Power Off
Virtual machine -> Interaction -> Power On
Virtual machine -> Inventory -> Create new
Virtual machine -> Inventory -> Register
Virtual machine -> Inventory -> Remove
Virtual machine -> Inventory -> Unregister
Virtual machine -> Provisioning *
Virtual machine -> Snapshot Management -> Create snapshot
Virtual machine -> Snapshot Management -> Remove snapshot
*****
It's not specified in which object level those should be set. If there is a role created with this set of priviliges and it's assigned on object level lower than vcenter (single datacenter), descriptor .vmdk file is not backed up and there is no message printed in the session. This can be a problem for granular recovery later on.
At least "Sessions -> Validate session" privlige is needed on Vcenter root object level. This priviliges is effective on Vcenter object only. Change Request has been created for documentation.