Ok this is not a great solution IMHO. I believe this functionality needs to be split out.
The solution for me was granting Deploy (from template), local admin, remote connection, remove, shut down, start, and stop. Deploy allows mounting of the iso and remove allows unmounting. Remove also allows vms to be deleted if they are off!!!
I can see the thinking here...self-service tenants with the capability to deploy new vms should also be able to remove them (within their tenant group and fabric space). However, one size does NOT fit all. These functions need to be split out for
additional fine grain control.
ex: I would love to allow certain application personnel to mount ISOs but NOT to delete vms.
