How can an administrator exclude Encryption rights from a support engineer?

The 'Virtual Machine Power User' role does not include cryptographic privileges by default and is scoped to VM operations, making it an inappropriate base for a support engineer needing broader administrative access.

The 'No Cryptography Administrator' role in vSphere is specifically designed to grant broad administrative access while explicitly excluding Cryptographic operations privileges. Cloning this role ensures the support engineer inherits all necessary admin capabilities without any encryption-related rights. This is the direct, purpose-built solution VMware provides for this exact use case.

Cloning 'Virtual Machine Power User' and assigning it directly does not remove encryption rights because that role never had them - it does not address the requirement of granting admin-level access without cryptography.

Cloning the full 'Administrator' role and assigning it gives the support engineer all privileges including Cryptographic operations, which directly contradicts the requirement to exclude encryption rights.