VCF SSO is not compatible with vCenter Enhanced Linked Mode and the new normal is vCenter Grouping/Linking in VCF 9 . Before you can configure VCF Single Sign-On and Grouping, you must deactivate ELM on all vCenter Servers participating in the shared SSO domain.
The cmsso-util break-elm utility safely detaches a vCenter Server from an existing ELM topology and removes the vCenter from the shared SSO domain, creates a new, standalone SSO domain for that vCenter. During this it rewrites service registrations, updates certificates and identity services
Although ELM provides a unified view of these constructs across multiple vCenters, tags and categories, Custom roles and permissions, attributes and metadata are actually stored locally on each vCenter so its not lost during the deactivation .
The break-elm workflow is supported only on vCenter 9.0 and later so ensure your vCenter in on v9 and perform a offline snapshot of all the vCenters in ELM.
SSH into any vCenter appliance, then run
cmsso-util break-elm –mode pre-check –password ‘!password!’
Deactivate Enhanced Link Mode using execute
cmsso-util break-elm –mode execute –password ‘!password!’
The vCenter becomes a standalone SSO domain and replication agreements are fully removed.
Tags, roles, and permissions remain intact locally
Reconfigure identity sources such as AD/LDAP under the new SSO domain.
References
Deactivate Enhanced Link Mode from vCenter
Deactivating Enhanced Linked Mode (ELM) in vCenter 9.0 (VVF)