VMware Cloud Foundation ComponentsWhat’s Included and What’s Not

VMware Cloud Foundation (VCF) is Broadcom’s flagship private cloud platform—the full-stack software-defined data centre (SDDC) offering that bundles compute, storage, networking, management, and automation into a single integrated subscription. Since the Broadcom acquisition, VCF has become the strategic product direction for the entire VMware portfolio: new features, new versions (vSphere 9, NSX 9), and new innovation are delivered through VCF first, with standalone products either deprecated or frozen at older versions.

For CIOs and IT procurement leaders, understanding exactly what VCF includes—and critically, what it does not include—is essential for accurate budgeting and informed negotiation. Broadcom’s bundled licensing model means that organisations are paying for components they may never deploy, while other capabilities they genuinely need require additional paid add-ons on top of the VCF subscription. This guide provides a definitive component-by-component breakdown.

What Is VMware Cloud Foundation?

VMware Cloud Foundation is an integrated platform that combines VMware’s core infrastructure technologies into a single, lifecycle-managed stack. Rather than purchasing vSphere, vSAN, NSX, and management tools as separate products with separate licences (the pre-Broadcom model), VCF delivers all of these as a unified subscription with a single licence key and centralised lifecycle management through SDDC Manager.

VCF is architecturally structured around two constructs: a management domain (dedicated infrastructure running vCenter, NSX Manager, SDDC Manager, and Aria components) and one or more workload domains (where actual application VMs and containers run). This separation ensures that management infrastructure is isolated from application workloads—a best practice for resilience and security, but one that requires dedicated hardware resources that do not run customer workloads.

The management domain typically requires a minimum of 4 hosts (3 for the cluster plus 1 for redundancy), and these hosts must be fully licensed with VCF even though they run only management VMs. For smaller environments, this overhead is significant—in a 12-host deployment, one-third of your licensed capacity is consumed by VCF’s own management infrastructure.

The VCF Licensing Model: Per-Core, Not Per-Socket

VCF uses a per-core subscription model, fundamentally different from VMware’s legacy per-socket licensing that many organisations are accustomed to. Understanding the mechanics is critical.

All physical cores must be licensed. Every physical CPU core in every host running VCF must be covered by a VCF subscription. This includes cores in the management domain hosts (which run no customer workloads) and all workload domain hosts.

16-core minimum per CPU. If a CPU has fewer than 16 physical cores, you still pay for 16. A dual-socket server with two 8-core CPUs (16 physical cores) requires 32 core licences (16 per CPU minimum × 2 CPUs). This minimum disproportionately affects older or lower-end server hardware.

BIOS-disabled cores still count. If cores are disabled in BIOS to reduce licensing cost, they still count toward the licence requirement under VCF’s terms. This closes a workaround that some organisations used under the legacy per-socket model.

vSAN storage entitlement: 1 TiB per core. VCF includes a vSAN storage entitlement of 1 TiB of usable capacity per licensed core. For a 20-server environment with 1,280 licensed cores, this provides 1,280 TiB (1.25 PiB) of vSAN storage entitlement. If your storage requirements exceed this entitlement, additional vSAN capacity is available as a paid add-on priced per TiB.

Subscription terms: 1, 3, or 5 years. Multi-year commitments reduce the effective annual cost but increase lock-in. There are no perpetual licence options—VCF is subscription-only.

What Is Included in VCF: The Seven Core Components

VCF bundles seven major technology components into the base subscription. Every component is fully licensed and available for deployment from day one.

1. VMware vSphere (ESXi + vCenter)

The hypervisor layer. VCF includes vSphere at the Enterprise Plus equivalent level, providing all hypervisor features: vMotion (live migration), Storage vMotion, DRS (Distributed Resource Scheduler), vSphere HA (High Availability), Fault Tolerance, Distributed Virtual Switch (vDS), Host Profiles, and Auto Deploy. vCenter Server is included for centralised management.

VCF 9 includes vSphere 9, which is available only through VCF—it cannot be purchased as a standalone product. Organisations that want vSphere 9 features must adopt either VCF or VVF (vSphere Foundation). Standalone vSphere remains frozen at version 8.x.

2. VMware vSAN

The software-defined storage layer. VCF includes vSAN with 1 TiB per licensed core of usable storage entitlement, supporting both vSAN Original Storage Architecture (OSA) and the newer Express Storage Architecture (ESA). vSAN provides hyperconverged storage using local server disks, eliminating the need for external SAN or NAS storage arrays (though VCF also supports external storage via NFS and Fibre Channel for workload domains).

vSAN ESA, the latest architecture, delivers improved performance and storage efficiency with a simplified single-tier design (NVMe drives only), native RAID-5/6 erasure coding with RAID-1 performance, and improved compression and deduplication. vSAN ESA requires NVMe-compatible drives; organisations with older SAS/SATA drives must use vSAN OSA or refresh their storage hardware.

3. VMware NSX (VCF Networking)

The software-defined networking and security layer. NSX in VCF provides distributed switching and routing, overlay networking (VXLAN/Geneve), micro-segmentation through the distributed firewall, gateway firewalling, NAT, VPN, DHCP, DNS, and load balancing at basic L4 level. This is a substantial networking platform that replaces many functions traditionally provided by physical network hardware.

The NSX included in VCF covers the core networking and distributed firewall capabilities. It does not include advanced threat prevention (IDS/IPS, malware detection, behavioural analysis)—these are part of vDefend, a separate paid add-on. This distinction is critical: NSX distributed firewall (basic stateful firewall rules) is included; vDefend Advanced Threat Prevention (ATP) with AI-driven threat detection is not.

4. VCF Operations (formerly Aria Operations)

The monitoring, capacity planning, and operational intelligence layer. VCF Operations provides performance monitoring across compute, storage, and networking; capacity management and forecasting; cost analysis; configuration compliance; and operational dashboards. It also includes VCF Operations for Logs (centralised log collection and analysis) and VCF Operations for Networks (network visibility, path analysis, and troubleshooting).

In VCF 9, VCF Operations is not merely an operational convenience—it is a licensing requirement. VCF 9 uses a new licensing model where VCF Operations must be deployed and operational to generate licence usage files that validate your entitlement. Failure to submit these usage files can degrade management features and suspend updates and support. This is a significant change from previous versions where Aria was optional.

5. VCF Automation (formerly Aria Automation)

The infrastructure-as-code and self-service provisioning layer. VCF Automation provides multi-cloud automation, infrastructure-as-code templates, self-service catalogues, approval workflows, and policy-based governance. It enables organisations to offer cloud-like self-service provisioning to development teams while maintaining IT governance and cost control.

VCF Automation is included in VCF but not in VVF (vSphere Foundation)—making it one of the key differentiators between the two offerings.

6. SDDC Manager

The lifecycle management and orchestration layer. SDDC Manager is the control plane of VCF, responsible for automated deployment of workload domains, coordinated firmware and software upgrades across all components (ESXi, vCenter, NSX, vSAN), host commissioning and decommissioning, certificate management, and password rotation. It is the component that transforms VCF from a collection of VMware products into an integrated platform.

SDDC Manager is exclusive to VCF—it is not available in VVF or standalone vSphere. It represents significant operational value for organisations managing large VMware environments, automating update workflows that would otherwise require extensive manual coordination.

7. vSphere Kubernetes Service (VKS)

The container orchestration layer. VCF includes vSphere Kubernetes Service, which enables deployment and management of Kubernetes clusters directly on the vSphere infrastructure. VKS integrates Kubernetes with vSphere’s networking, storage, and security capabilities, allowing organisations to run containerised workloads alongside traditional VMs on the same infrastructure without deploying a separate Kubernetes platform.

What Is NOT Included: The Paid Add-Ons

This is where VCF budgeting becomes complicated. Several capabilities that many organisations consider essential are not included in the base VCF subscription and must be purchased separately as add-ons. Each add-on is priced per core, on top of the base VCF subscription.

VCF vs VVF: What the Cheaper Option Does Not Include

VMware vSphere Foundation (VVF) is the lower-cost alternative to VCF, also licensed per core. Understanding the differences is essential for determining whether VCF’s premium is justified.

The critical differentiators are NSX, VCF Automation, and SDDC Manager. If your organisation does not require software-defined networking (because you use Cisco ACI, physical firewalls, or standard VLAN-based networking), does not need self-service automation, and does not require automated lifecycle management across the stack, then VVF provides the core virtualisation and storage capabilities at a significantly lower per-core cost.

However, VVF’s vSAN entitlement of 0.25 TiB/core is substantially lower than VCF’s 1 TiB/core. For a 1,280-core environment, VVF provides 320 TiB of vSAN entitlement versus VCF’s 1,280 TiB. If your storage requirements exceed VVF’s entitlement, the cost of vSAN add-on capacity can erode or eliminate the savings from choosing VVF over VCF.

Cost Modelling: What VCF Actually Costs

VCF pricing is not publicly listed—it is custom-quoted by Broadcom. However, based on market intelligence and published reference points, we can model representative costs.

The add-on cost layer is the most frequently underestimated element of VCF budgeting. Organisations that model only the base VCF subscription and then discover they need Avi for WAF compliance, vDefend ATP for their security requirements, and Live Recovery for DR automation can see their actual annual spend increase by 40–50% above the base subscription.

The most expensive mistake in VCF procurement is budgeting for the base subscription while assuming that “everything is included.” It is not. Model the add-ons you will actually need from day one, negotiate them as part of the initial deal, and secure contractual pricing for add-ons you may need later. Adding add-ons mid-contract invariably costs more than including them in the original negotiation.

The Oracle Licensing Dimension

For organisations running Oracle Database on VCF infrastructure, the component architecture creates a specific licensing consideration. VCF’s vSAN-based hyperconverged model means Oracle workloads run on the same VMware clusters as all other workloads. Oracle does not recognise VMware as “hard partitioning,” meaning every physical core in every cluster capable of running Oracle workloads must be licensed—not just the cores actually running Oracle VMs.

In a VCF environment with 20 hosts and 1,280 cores, if Oracle Database runs on any workload domain without physical isolation, the theoretical Oracle licensing exposure covers all 1,280 cores. At Oracle Database Enterprise Edition list pricing ($47,500 per Processor licence for 2 cores), this represents an exposure of over $30 million. Even with standard discounts, the Oracle licensing risk on a non-isolated VCF environment can exceed the VCF subscription cost by an order of magnitude.

This is not a VCF-specific problem—it exists on any VMware deployment—but VCF’s architecture, which encourages consolidated workload domains and shared infrastructure, can make the exposure worse if Oracle workloads are not deliberately isolated. See our Oracle on VMware licensing guide and case study on a Broadcom audit triggering Oracle exposure for detailed analysis and mitigation strategies.

The Management Domain: Hidden Infrastructure Cost

VCF requires a dedicated management domain to run its control plane components: vCenter, NSX Manager, SDDC Manager, VCF Operations, VCF Automation, and associated services. This management domain requires a minimum of 4 ESXi hosts in a production configuration (3-node cluster plus a witness/fourth host for resilience).

These management domain hosts must be fully licensed with VCF at the same per-core rate as your workload domain hosts, but they run zero customer workloads. They exist solely to support VCF’s management stack.

For a 20-host environment where 4 hosts are dedicated to the management domain, 20% of your licensed infrastructure runs no customer workloads. For a 12-host environment, this rises to 33%. The management domain overhead is a genuine cost that must be factored into TCO calculations, particularly for smaller deployments where the ratio of management to workload infrastructure is unfavourable.

VVF, by contrast, has no management domain requirement. vCenter manages the environment directly without SDDC Manager, and there is no dedicated management cluster. This is one of VVF’s practical advantages for smaller deployments.

Negotiation Strategies for VCF Procurement

Negotiate Add-Ons in the Initial Deal

If you know you will need Avi, vDefend, or Live Recovery, include them in the initial VCF negotiation rather than adding them later. The larger combined deal size qualifies for deeper discounts, and Broadcom is more flexible on add-on pricing when they are part of a new VCF commitment versus a mid-contract expansion. Organisations that purchase VCF base now and add Avi or vDefend six months later typically pay 20–40% more per core for the add-ons than those who negotiated them upfront.

Challenge the 16-Core Minimum

For organisations with older or specialised hardware that has fewer than 16 cores per CPU, the 16-core minimum inflates the licence count. While Broadcom is unlikely to waive this minimum, you can use it as a negotiation lever: “we are paying for 32 cores per server when we only have 24 physical cores—this 33% premium needs to be reflected in the per-core rate.” Legitimate per-core rate reductions of 10–20% are achievable when the 16-core minimum significantly inflates your effective licence count.

Model VVF + Add-Ons Against VCF

Before accepting a VCF quote, model the cost of VVF (lower per-core rate) plus any individual add-ons you actually need. If you do not need NSX, VCF Automation, or SDDC Manager, VVF may be 30–50% cheaper for equivalent compute and storage capability. Present this analysis to Broadcom to force a competitive comparison between their own products.

Negotiate the vSAN Entitlement Separately

If your storage requirements are well below the 1 TiB/core entitlement, you are overpaying for vSAN capacity you will never use. Conversely, if you need more than 1 TiB/core, the add-on cost can be substantial. Negotiate vSAN entitlement terms explicitly: can the included entitlement be pooled across workload domains? What is the per-TiB rate for capacity above the entitlement? Is there a discount for pre-committing to add-on TiB at the time of the initial purchase?

Leverage Competitive Alternatives

A credible evaluation of Proxmox VE, Microsoft Azure Stack HCI, or Nutanix gives you maximum negotiation leverage. Broadcom’s pricing flexibility increases dramatically when the customer has a documented, costed migration plan to an alternative platform. Even if you intend to stay on VMware, the existence of a credible Plan B forces Broadcom to compete on price.

Time for Broadcom’s Fiscal Year End

Broadcom’s (Salesforce fiscal year for VMware division) fiscal year end drives deal-closing pressure. Align your VCF procurement with quarter-end and year-end periods for maximum discount flexibility. Begin the evaluation 3–4 months before your target signing date to allow time for competitive evaluation, technical validation, and negotiation.

Frequently Asked Questions