The following steps outline how to create a vCenter role for Horizon Composer and grant the permissions. If examples are needed, refer to the screenshots for this process found in Chapter 2, Implementing Horizon Connection Server. The process of creating a vCenter role is the same in this case; all that is changed is the role name, vCenter permissions granted, and the target AD account:

1. In vSphere Web Client, navigate to Home | Administration | Roles, click the green + sign, and then enter a role name such as Horizon Composer.
2. From within the Create Role window, expand each privilege group listed in the table provided previously in this section and check the required privilege items. All listed privileges must be checked in order for Horizon Composer to function properly. Click on OK when finished with creating the role.
3. In the vSphere Web Client, click the following in order, Home | Hosts and Clusters, the vCenter Server at the top level of the inventory, the Manage tab, the Permissions section, and finally the green + sign. This will open the Add Permission window used in the next step.
4. In the Add Permission window, click on the Add... button to open the Select Users/Groups window.
5. In the Domain: drop-down menu, select the AD domain that contains the Horizon Composer user. In our example, the domain is named VJASON.
6. In the Users and Groups list, select the Horizon Composer service account. For our sample environment, we will search for and select the account named svc-horizoncomp. Once selected, click on the Add button. Click on OK to close the Select Users/Groups window.
7. In the Add Permission window | Assigned Role drop-down menu, select the Horizon Composer role we created in step 2, and then click OK to close the window and complete the action.

Horizon Composer now has sufficient permissions on the vCenter Server to deploy and manage linked-clone virtual desktops and Windows RDS servers.