Do you want to restrict your users from deploying vApp from OVF? Correct me if i got it wrong.

Opposite actually . Users can export a vApp from the vCloud UI to an OVF onto their desktops. I'm trying to find a way to restrict users from doing this.

Under role rights some right exist around this...  I have not tested in VCD 5.5 to see if the behavior has changed.  But in VCD 5.1 under "All Rights":"Catalog Item" you can "Enable vAppTemplate/Media Download"

Have you check to see if this right cascades down to the direct vApp, (not sure if VMware missed this one or just joined the right)

Just checked to make sure, but the permission doesn't seem to cascade. You can restrict a user from downloading a vApp Template, but they can get around the restriction by just instantiating the vApp and downloading it from the My Cloud tab.

I have tested - yep we have same problem.  I opened a support case with VMware on this.  Might be worth doing it yourself.  (They should see my case, but if not suggest they link them to speed a solution up)

Confirmation feels good!

I opened a case too, hopefully we'll see a quick fix!

Hi Cronistar. Were you able to get a resolution from support on this? I would like to do the same in my environment!

Unfortunately, no. They said they're putting it on the bug list and hope it'll make it to the next release.

In the meantime, there wasn't any fix available, so we're just living with it crossing our fingers.

Ah well! Thanks for letting me know.