It would probably be helpful to review the following Help articles within Protect:
Help > Contents> Quick Start Information> Quick Start Info for Virtual Machines> Notes About Virtual Machines
Help > Contents> Installation and Setup> Using Machine Groups> Adding Virtual Machines to a Machine Group> Adding Virtual Machines Hosted by a Server
From the first article I mentioned this snippet may be helpful:
When deploying patches to an offline virtual machine that is hosted on a server, the following VMware server permissions are required in order to manage snapshots and to change the power state of the machine during the deployment process:
-VirtualMachine.State.CreateSnapshot
-VirtualMachine.State.RemoveSnapshot
-VirtualMachine.Interact.PowerOn
-VirtualMachine.Interact.PowerOff
-VirtualMachine.Interact.DeviceConnection (to disable/enable the network card)
Also (in reply to Ben) you do need to set browse credentials. You can do this once you click to "add machine to group" for one of the hosted VM's. It will then appear in the lower section of the machine group, and you can right click and choose to set credentials.