...
An administrator can belong to an enterprise that is not included in their own scope, which means that they cannot manage some elements of this enterprise, eg. they cannot create users. But an administrator will usually have access to the Apps library, which is determined by their Apps library privileges, allowed datacenters, and datacenter scope. And the administrator will have access be able to templates, which is determined by their enterprise being listed in the template’s scope, or access to specs, which is determined by their enterprise being administer templates and specs when their enterprise is the owner of the specresource. To share resources and manage shared resources, such as VM templates and VApp specs, with enterprises in their child scopes, an administrator will need access to the resources owner enterprise and the “Allow user to switch enterprises” privilege.
Related pages: