--- title: 'VCF Add-ons Explained' url: 'https://dirk-janalken.nl/blog/vcf-add-ons-explained' markdown: 'https://dirk-janalken.nl/blog/vcf-add-ons-explained.md' date: '2026-07-23' description: 'As a technologist working with VCF day to day, I keep running into the the question what the addons for VCF look like and what they offer in functionality. The core platform gets you a long way, but there''s a whole layer of "advanced services" sitting on top that''s easy to gloss over until you actu…' taxonomy: tag: - VCF - VCF9.1 - release - addons - Broadcom - VMware archives_month: - jul_2026 archives_year: - '2026' --- # [VCF Add-ons Explained](https://dirk-janalken.nl/blog/vcf-add-ons-explained) 23rd Jul 2026 [VCF](https://dirk-janalken.nl/tag:VCF#body-wrapper) [VCF9.1](https://dirk-janalken.nl/tag:VCF9.1#body-wrapper) [release](https://dirk-janalken.nl/tag:release#body-wrapper) [addons](https://dirk-janalken.nl/tag:addons#body-wrapper) [Broadcom](https://dirk-janalken.nl/tag:Broadcom#body-wrapper) [VMware](https://dirk-janalken.nl/tag:VMware#body-wrapper) As a technologist working with VCF day to day, I keep running into the the question what the addons for VCF look like and what they offer in functionality. The core platform gets you a long way, but there's a whole layer of "advanced services" sitting on top that's easy to gloss over until you actually need one of them. I wanted to write down what each add-on actually does, because the naming alone does not tell you much and the documentation is spread across a handful of separate product pages. # The Context VCF 9 ships as a fleet-level platform with two main interfaces, or consoles, VCF Operations and VCF Automation, and a set of core services underneath: vSphere, vSAN, NSX, VKS, and the operations/automation layers themselves. That core is licensed as a single SKU. Add-ons sit on top of that and are purchased separately. Broadcom [lists seven](https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vcf-9-0-and-later/9-1/vcf-advanced-services.html) of them in the current advanced services catalogue, and a few more show up once you dig into the feature comparison white paper as subcategories. I'll go through them in the order I think most environments will actually run into them. ## Advanced Cyber Compliance (ACC) This is the one I'd call the "catch-all security and compliance" add-on, and it shows up more than any of the others once you start reading VCF 9.1 release notes. ACC his these four core functions: - Continuous compliance enforcement, configuration drift gets caught and corrected in real time instead of during a periodic scan - Automated ransomware and data recovery, including the sovereign on-premises recovery path introduced in 9.1 - Confidential computing support - VPC policy-based connectivity, which is what actually powers the VPC Communities feature I covered in my [VCF 9.1 post](https://dirk-janalken.nl/blog/vcf-9-1-is-here) Worth noting: without ACC, VCF Operations' Configuration Drift Management and Compliance Management with remediation simply aren't available, they're gated behind this add-on rather than being core functionality. If you have to comply to certain regulation frameworks this might be a very interesting add-on for your VCF enviroment. One thing worth being precise about: ACC isn't a separate product positioned next to Protection and Recovery, it actually bundles Protection and Recovery underneath it as the engine behind its ransomware/cyber recovery pillar. ACC's landing page lists Protection and Recovery 9.1 explicitly as one of its included components, alongside VMware Salt (the compliance/config engine), Confidential Computing, and VMware Cloud Director Availability for VCD environments. ## Protection and Recovery (formerly VMware Live Recovery) Protection and Recovery is the dedicated cyber and disaster resiliency engine — think Site Recovery Manager and Live Cyber/Site Recovery unified under one roof, with policy-based protection, immutable backups, isolated recovery environments, and behavioral ransomware analytics. It's worth knowing the naming history here: this was branded VMware Live Recovery until it got folded into the advanced services catalogue under the "Protection and Recovery" name, so if you find older blog posts or docs referencing Live Recovery, that's the same product. Here's the part I got too loose on originally: Protection and Recovery is both a standalone add-on in its own right, licensable on vSphere Foundation for straightforward site recovery and replication, and the underlying engine that ACC uses for its cyber recovery capability on VCF. If you only need DR replication with RPOs down to a minute and don't care about the compliance and confidential computing side of things, you can license Protection and Recovery on its own, including on vSphere Foundation where ACC isn't available at all. If you're running VCF and license ACC instead, you already get Protection and Recovery's cyber recovery engine as part of that bundle, layered with the isolated clean room workflow, EDR-based restore validation, and CrowdStrike Falcon integration, so there's no need to separately buy Protection and Recovery on top of ACC for that use case. For VCF Automation environments specifically, Protection and Recovery adds VM replication between a pair of Supervisors across two region quotas within the same organization. Practically: think of Protection and Recovery as the DR/replication engine, and ACC as that same engine wrapped in a compliance and platform-security package that's only available if you're on full VCF. ## VMware Data Services Manager (DSM) DSM is database-as-a-service for VCF. It gives you enterprise-hardened data services — high availability, performance, backup, monitoring — as a purpose-built layer rather than something you bolt on yourself with scripts and cron jobs. If your platform team keeps getting asked to stand up Postgres or MySQL instances for application teams and you're doing it manually today, this is the add-on that turns that into a catalog item. Worth calling out specifically: Microsoft SQL Server support went GA with DSM 9.1, after being a technical preview in 9.0. It sits alongside Postgres and MySQL as a fully supported engine now, provisioned through the same policy-driven model. In practice that means production SQL Server deployments get a three-node Always On availability group at provisioning time, with a single-VM option for test/dev, no manual cluster setup involved. It also integrates with Active Directory for authentication, registers instances in DNS automatically, and ships with the SQL Server Agent so DBAs keep their usual maintenance scheduling. For DBAs the day-to-day experience stays familiar — SSMS, PowerShell, SQLCMD, Windows auth all work as expected — while the platform team gets SQL Server governed the same way as every other database on the platform, instead of it being the one engine that always needed special handling. ## vDefend This is NSX's security add-on: built-in zone and application microsegmentation, threat detection and response, lateral security, ransomware and APT protection, and zero trust enforcement across the VCF estate. Worth being precise here, because this one trips people up: the Distributed Firewall itself is not something you get for free with core VCF. To actually turn on DFW rules, you need a vDefend Firewall license (or vDefend Firewall with Advanced Threat Prevention) on top of your VCF license, added in NSX Manager. Core VCF gets you the networking and segmentation building blocks like security groups, tagging, and grouping, but enforcing policy through the DFW is gated behind vDefend. If you're planning a microsegmentation project, don't assume DFW is already covered by your VCF entitlement, check that vDefend licensing is actually in place first. ## Avi Load Balancer Avi deserves a callout of its own because of the timing involved. VCF has always shipped some native load balancing capability for infrastructure components and the vSphere Supervisor, but Broadcom's clear direction is that Avi is the load balancer going forward — local and global load balancing, Kubernetes ingress, web app and API security, and application analytics, all deeply integrated with the private cloud layer. Here's the part worth flagging if you haven't seen it: customers currently relying on native VCF load balancing can keep using it, but only until **May 30, 2027**, and only if they've already purchased the required Avi licenses. If general-purpose or advanced load balancing is part of your design, don't wait until that date is close — get Avi licensing sorted now rather than discovering the cutoff during a renewal conversation. ## Tanzu Platform & Tanzu Data Intelligence Two related add-ons under one roof in the catalogue. Tanzu Platform is aimed at closing the gap between idea-to-code and code-to-production by integrating the tools developers and IT operations already use. Tanzu Data Intelligence is the data-focused counterpart — storing, processing, querying and analysing data at scale in real time. If your organisation is trying to build an actual internal developer platform on top of VCF rather than just handing out VMs or K8s clusters, this ## Network Observability Not to be confused with VCF Operations for Networks, which ships as part of the core platform and already gives you flow analytics, application discovery, and physical/virtual fabric visibility. Network Observability by Broadcom is the extended add-on that reaches further — end-to-end visibility into the network overlay, underlay, and applications hosted in public or hybrid cloud, not just on-prem. The pitch is fewer internal resource hours spent chasing problems and faster resolution when something does go wrong. Worth it if your footprint extends meaningfully into public cloud and you need one view across both. ## Additional Storage Capacity (vSAN) The quieter one in the list, but worth mentioning since it's technically its own line item in the advanced services catalogue: additional vSAN storage capacity beyond what's included with core VCF. Straightforward, but easy to miss when you're sizing licensing against actual capacity needs. ## A Note on VCF vs vSphere Foundation Most of these add-ons are available on both VCF and vSphere Foundation, which is worth knowing if you're running the smaller platform and assumed add-ons were a VCF-only conversation. ACC, Avi, and Tanzu are available on both. Data Services Manager, vDefend, and Network Observability are VCF-only in the current comparison table. If you're on vSphere Foundation and one of those three is what you actually need, that's a driver toward the full VCF SKU on its own. # My thoughts None of these add-ons are things you need on day one, and that's rather the point. They offer extra functionality you might not need at the start, but during the Private Cloud Journey you will need them at some point. A few things I'd keep in mind when deciding what to add: - If compliance or ransomware recovery is a live concern, ACC is the first place to look, and it quietly gates functionality (drift management, compliance remediation) that looks like it should be core but isn't - DFW itself is another one of those quiet gates: don't assume microsegmentation is covered by core VCF, the actual firewall enforcement needs a vDefend license on top - If you're running native VCF load balancing today, put the May 30, 2027 Avi cutoff on your calendar now, not later. For more info check [this KB](https://knowledge.broadcom.com/external/article/439411/nsx-load-balancer-to-vmware-avi-load-bal.html) - DSM, vDefend, and Network Observability are VCF-only, so take that into account during the vSphere Foundation vs. VCF licensing discussion - Protection and Recovery isn't just adjacent to ACC, it's literally the engine ACC uses for cyber recovery on VCF. Buy it standalone for plain DR (VCF or VVF), or get it bundled inside ACC if you need the compliance and clean-room workflow around it too During the designing phase of your VCF environment, keep these add-ons in mind. You don't have to start using them on day 1 of your VCF journey, but putting things on the roadmap is definitely worth it. --- ## Navigation - Parent: [Home](https://dirk-janalken.nl/index.md) - Previous: [VMware Explore 2026 recap](https://dirk-janalken.nl/blog/vmware-explore-2026-recap.md) - Next: [VCF 9.1 is here!](https://dirk-janalken.nl/blog/vcf-9-1-is-here.md)