topic Minimum SnapCenter Permissions in ONTAP Discussions

Minimum SnapCenter Permissions

TMADOCTHOMAS — Wed, 04 Jun 2025 09:39:41 GMT

For years we've used a custom role for SnapCenter permissions on our iSCSI and NFS SVMs, based on the following article:

https://community.netapp.com/t5/Data-Backup-and-Recovery/SnapCenter-Custom-Account-ONTAP/m-p/156197#M12840

This has worked well. Now I'm testing to add the new snapshot locking feature in OnTAP 9.12.1 so I can lock the three most recent snapshots from deletion. In testing, my custom role is generating "Insufficient privileges" alerts, stating the custom account "does not have write access to this resource". The specific failed task was "Set SnapLock Expiration Time Failed".

I found the following KB article and added the two additional actions listed to the role, but got the same error. Any suggestions? I really want to implement this, but this permission issue is turning into a blocker.

https://kb.netapp.com/onprem/ontap/dp/SnapLock/Unable_to_set_retention_at_file_level

Re: Minimum SnapCenter Permissions

TMADOCTHOMAS — Tue, 09 Apr 2024 14:16:04 GMT

For anyone watching this thread, I have a case open and will hopefully have an answer from NetApp Support soon.

Re: Minimum SnapCenter Permissions

TMADOCTHOMAS — Tue, 30 Apr 2024 19:34:01 GMT

From what we discovered in the case, the rule doesn't work in 9.12.1 but should work in later versions. We are postponing implementation of this feature until we decide to upgrade.

Re: Minimum SnapCenter Permissions

isc-dario — Wed, 01 May 2024 08:05:55 GMT

Are you speaking of the general "Minimum Privileges" feature which doesn't work with 9.12.1 or just the new Snaplock feature?

Re: Minimum SnapCenter Permissions

TMADOCTHOMAS — Wed, 01 May 2024 12:53:37 GMT

The feature itself works, it's just the tweaking of minimum permissions that doesn't work in 9.12.1.

Re: Minimum SnapCenter Permissions

isc-dario — Wed, 01 May 2024 14:41:11 GMT

Have you tried the minimum permissions before enabling the Snaplock feature?

Re: Minimum SnapCenter Permissions

TMADOCTHOMAS — Wed, 01 May 2024 14:53:28 GMT

No, however it was weird that the NetApp technician who worked with me was able to make it work in 9.13.1 and above without changes to the rules. Meaning there wasn't actually a rule change to make, although I thought there was and tried a few that I thought would work when it initially failed. Apparently something behind the scenes was tweaked in 9.13.1 and above. At any rate, I'll revisit when we upgrade later this fall.