To create and configure a new VM Apps Organization so that team members can log in with Active Directory accounts and finish tenant configuration, follow these seven steps in order:

Ordered Steps

1. Log into the Provider Management portal.

2. Enable the Classic Tenant Creation feature flag.

3. Create the new Organization for VM Apps.

4. Launch the Organization portal.

5. Configure Access Control for the Organization.

6. Assign Organizational level roles.

7. Log out of the Organization portal.

In VMware Cloud Foundation (VCF) 9.0 , the initial setup of a multi-tenant environment requires administrative actions at both the Provider and Organization levels. The process begins in the Provider Management portal , where the global administrator must first Enable the Classic Tenant Creation feature flag . VCF 9.0 is " AllApps-first " by default; this flag is a prerequisite to expose the legacy workflows needed to Create the new Organization for VM Apps .

Once the organization is created, the focus shifts to identity management. The administrator must Launch the Organization portal to handle tenant-specific settings. To meet the requirement of using Active Directory accounts, the administrator must Configure Access Control for the Organization, which involves integrating the tenant with the corporate Identity Provider (IdP) or LDAP source. After the directory is synchronized, the administrator Assigns Organizational level roles to the relevant Active Directory users or groups, granting them the permissions necessary to complete the mirroring of their production deployment. Finally, the administrator must Log out of the Organization portal to refresh the session and allow the newly authorized team members to sign in with their own credentials.

In VMware Cloud Foundation 9.0, the VCF Operations orchestrator (formerly vRealize Orchestrator) utilizes a specific object-oriented hierarchy to facilitate infrastructure automation. Workflows are the primary administrative unit, representing a logical sequence of automated steps. Within these, Actions serve as reusable, modular functions—often written in JavaScript—that act as building blocks across multiple workflows to reduce code duplication. For custom logic, Scriptable tasks provide a " blank canvas " allowing developers to execute polyglot scripts (Node.js, Python, or PowerShell) directly within a workflow ' s schema.

To manage environment-wide variables and reusable assets, the orchestrator uses Configuration Elements and Resource Elements. Configuration Elements store persistent constants (like API endpoints or global timeout values) shared across the server, while Resource Elements allow the import of external files (such as XML, text, or binary files) for use during execution. Modern scripting requirements are handled by Environments, which define the specific runtime dependencies and external libraries (like boto3 for Python) needed for complex integrations. Finally, the Workflow Token is a critical operational object created during every execution; it stores the specific state, inputs, and outputs of a single run, serving as the primary source for audit trails and troubleshooting failed automation tasks. Together, these components allow for the deep extensibility required to integrate VCF with third-party ITSM and CMDB platforms.

Virtual Private Clouds (VPCs) in VCF 9.0 represent a significant evolution in multi-tenant networking. A VPC is a logically isolated network partition that exists within a shared physical infrastructure, specifically a Supervisor cluster . This construct allows multiple distinct organizations to coexist on the same compute hardware while maintaining complete separation of their network traffic, IP address spaces, and security policies. Each VPC acts as a " mini-datacenter " for the tenant, providing automated services such as routing, DHCP, NAT, and distributed firewalls without the tenant ever needing to see or interact with the underlying NSX Tier-0 or Tier-1 gateway architecture. This " abstraction " is the key to scaling VCF 9.0 deployments, as it allows the provider to maximize host utilization across many small tenants while giving each tenant the " look and feel " of a dedicated, private networking environment. It effectively removes the complexity of manual VLAN or segment management that characterized older private cloud architectures.

The Terraform provider for VCF Automation is the specific tool designed to allow Infrastructure-as-Code (IaC) workflows to interact with the VCF 9.0 API surface. In VCF 9.0, the provider has been expanded to support the newer Organization and Region-based architecture. By utilizing this provider, developers can declare Content Libraries , Cloud Zones , and Flavor/Image Mappings within their HCL (HashiCorp Configuration Language) files. While specific RBAC roles (like Organization Administrator) are necessary for the credentials used by the Terraform runner, the solution itself is the provider that translates Terraform commands into the correct REST API calls for the VCF Automation engine. This enables a consistent developer experience where infrastructure configuration is versioned in Git and applied programmatically, aligning with modern DevOps practices supported by the VCF 9.0 platform.

Velero is the industry-standard and VMware-supported service integrated into VCF 9.0 for the backup and restoration of Kubernetes-based workloads, specifically vSphere Pods and persistent volumes. Within the VCF Automation framework, Velero is often deployed as part of the Supervisor services or within TKG clusters to provide data protection for stateful applications. It captures the state of the Kubernetes API objects (such as Pod specs and Secrets) and triggers snapshots of the underlying vSphere storage (via the Cloud Native Storage/CNS driver) to ensure that workloads can be recovered in the event of a cluster failure or accidental deletion. While other services like ArgoCD handle continuous delivery and VKS handles cluster lifecycle, only Velero is dedicated to the operational task of disaster recovery and migration of containerized resources within the vSphere Supervisor environment.

VCF Automation 9.0 utilizes an Event Broker Service (EBS) to trigger extensibility workflows during the lifecycle of a deployment. For a DNS integration to function correctly and reliably, the event subscription must be " scoped " to prevent it from firing when essential metadata is missing. In this scenario, the administrator has mapped the user input hostname to a custom property of the virtual machine. By adding the condition event.data.customproperties[ ' hostname ' ] != null to the subscription, the platform evaluates the payload before invoking the Operations Orchestrator workflow. If the consumer leaves the hostname field empty (assuming it is not marked as mandatory in the blueprint), the condition will evaluate to false, and the DNS creation workflow will not be triggered, preventing " empty " or invalid records from being sent to the DNS provider. This logic must be applied to both the creation and deletion subscriptions to maintain parity throughout the VM ' s lifecycle. Using the customproperties array within the event.data payload is the standard method for referencing blueprint-specific inputs within the VCF 9.0 extensibility framework.

To automate the export or backup of Blueprints (Cloud Templates) in VCF 9.0, the Event Broker Service (EBS) is the required mechanism. While Velero (Option A) is used for backing up vSphere Pods and ArgoCD (Option C) is for continuous delivery, neither is designed to " listen " for internal automation metadata changes. By creating an Event Broker Subscription mapped to the " Blueprint Released " or " Template Version Created " topic, the administrator can trigger an action every time a developer finalizes a new version of their infrastructure code. This triggered action (typically an ABX or Orchestrator task) can then programmatically retrieve the YAML definition of the blueprint via the VCF Automation API and push it to an external third-party storage solution or a secondary Git repository for long-term archival and backup. This ensures that the organization maintains a complete, off-appliance history of its infrastructure designs, satisfying auditing and disaster recovery requirements.

VCF 9.0 introduces enhanced security requirements for Operations Orchestrator integration, specifically regarding the execution of custom extensibility logic. A common cause for a workflow failing to trigger, even when the provisioning process itself is successful, is that the workflow is not signed . By default, VCF 9.0 Automation enforces a security policy that requires all custom workflows to be digitally signed by a trusted certificate before the Event Broker Service (EBS) will execute them. This prevents unauthorized or malicious scripts from running within the management plane of the private cloud. If the workflow is not signed, the EBS will silently ignore the trigger or log a security violation in the background, while the main VM provisioning—which is a separate process—continues to completion. The administrator must import the developer certificate into the Orchestrator and sign the workflow package to authorize its execution in the production environment.