Console Only Access in 9.5

[Gaprofitt17]

Hi,

Trying to figure something out.  To allow console only access to VM's a colleague is telling me you have to apply this per VM?  Is this true? If not
at what level can I apply this role?

Thanks...