VMM 2012 Self Service Users and VLAN tagging

In Hyper-V you normally keep all the VHD files together in a central folder that normal users have no access to. It's a different way of securing the system; complete separation of hosts from users. Because of that users who will be creating and modifying VMs have to have some kind of administrative access to the Hosts, and that either covers the whole machine (as is common for IT type staff) or through a role in VMM (through either SSP or Administrative Delegation).

An example configuration might be that you have QA VMs for testing. The QA users need to be able to create a new VMs based on a simple base server, do their testing, and either save the machine for more extensive testing or scrub it.

You create a Role for the QA Group, making it a SSP User Role. Then create a VM template, basically a syspreped VM, which can be made from an existing VM by cloning it them making a template from the clone (the templating process destroys the source VM). You then assign the template to the QA group. QA Users can now create VMs based on this template, the new VMs will belong to QA and the QA users will be allowed full access to them (or limited access, depends on the settings in the SSP User Role you setup).

You can also assign ownership of existing VMs to that user group, which can then have access to the VM through SSP (again subject to the restrictions imposed by the User Role granting that group access).

In this example the QA users need no rights to the VHD files, no rights on the Host machines, and only limited rights in AD & VMM. This would not allows them to use the VMM Admin Console, but that is meant for Admins, not Users.

Alternatively, you can delegate administrative control of certain machines to particular users. If there is a QA testings Host, and they will not be running their VMs on the "main" cluster; you can delegate administrative control of that Host (through a Host Group) to the QA Users. This would allows users of the QA group to use the VMM Admin Console and have full administrative control of that particular host group. The same sort of delegation can be applies to Libraries, allowing for a QA library separate from the "main" library.

I'm sure this is all as clear as mud to someone who hasn't used it extensively; feel free to ask as many questions as you want to help clear this up.
_{(Full Disclosure: I work for a MS Gold Partner, we build these sorts of systems)}

We use it, and yes, it is a little slow. It's definitely slower than VMM 2008 R2 was. 15 seconds between moving screens is definitely longer than what we see here, so maybe you've got something else going on. I'm hoping it gets sped up when SP1 releases.