Unlike vSphere Replication, SRM cannot enable protection on individual VMs. All the VMs that are hosted on the datastores in a datastore group are protected. The protection is enabled at the datastore group level because with array-based replication, the LUNs backing the datastores are replicated. The array doesn't know which VMs are hosted on the datastore. It just replicates the LUN block by block. So, at the SRM layer, the protection is enabled at the datastore level. In a way, a protection group is nothing but a software construct to which datastore groups are added, which in turn includes all the VMs stored on them in the protection group.

When creating a protection group, you will have to choose the datastore groups that will be included. Keep in mind that you cannot individually select the datastores in a datastore group. If it were ever allowed, then you will have VMs with not all of their files protected. Let's assume that you have a virtual machine...