Course: Tableau Training
Topic: Managing Permissions, Site Roles, User Access, Groups, and Security in Tableau Server and Tableau Cloud.
Course Link: Explore Tableau Training
Demo Link: Register for a Tableau Course Demo
Tableau is a data visualization and business intelligence platform that allows users to create, publish, share, and analyze data through charts, dashboards, reports, and interactive visualizations. In an organization, not every user should have the same level of access to every dashboard or data source. For example, a sales employee may need access to sales dashboards, while an HR employee may need access to employee-related reports.
Tableau provides permissions, site roles, user accounts, and groups to control who can access content and what actions they can perform.
These settings work together to protect organizational information and make collaboration more secure. Read the official Tableau documentation on permissions, roles, and licenses.
Permissions are rules that determine whether users or groups can perform specific actions on Tableau content. Content can include projects, workbooks, views, published data sources, and other supported assets.
The available capabilities vary according to the content type, Tableau deployment, site role, license, and configuration. Granting a capability does not necessarily mean the user can perform the action if their site role or another required setting prevents it.
Suppose a company publishes a workbook called Monthly Sales Dashboard. The administrator wants employees to view the dashboard but does not want them to modify or delete it.
| Capability | Example Setting | Purpose |
|---|---|---|
| View | Allowed | Employees can open the dashboard. |
| Web Edit | Not allowed | Employees cannot edit the workbook through web authoring. |
| Overwrite | Not allowed | Employees cannot replace the published workbook. |
| Delete | Not allowed | Employees cannot delete the workbook. |
This setup helps employees access the information they need while protecting the published report from unauthorized changes.
A site role defines the maximum level of functionality a user can have on a Tableau site. A user's actual access also depends on the permissions assigned to the content and the license associated with the user.
For example, a user with a Viewer site role cannot be given full workbook-publishing capabilities merely by allowing the Publish capability on a project. The site role limits what the user can do.
| Site Role | Typical Responsibilities | Example User |
|---|---|---|
| Server Administrator | Manages Tableau Server configuration, users, sites, and server-wide administration. | IT administrator |
| Site Administrator Creator | Manages a Tableau Cloud site and has broad content and administration capabilities. | BI platform administrator |
| Site Administrator Explorer | Performs site administration with capabilities limited by the applicable Explorer role and license. | Delegated site administrator |
| Creator | Connects to data, creates content, and publishes workbooks and data sources. | Tableau developer |
| Explorer (Can Publish) | Explores content and has limited publishing capabilities where supported. | Business analyst who publishes selected content |
| Explorer | Explores, interacts with, and edits content within the capabilities of the assigned role and permissions. | Reporting analyst |
| Viewer | Views and interacts with published content using available viewer features. | Department employee |
| Unlicensed | Does not have normal sign-in access unless an applicable licensing-on-sign-in arrangement is configured. | User not yet licensed for access |
Important: Exact role names and capabilities differ between Tableau Server and Tableau Cloud and can change by product version. For example, Server Administrator is a Tableau Server role, whereas Cloud Administrator operates at the Tableau Cloud Manager level rather than functioning as an ordinary site role.
A Creator typically develops dashboards, connects to data, builds visualizations, and publishes workbooks or data sources. Creators commonly use Tableau Desktop, Tableau Prep, and supported browser-based authoring features.
Example: A business intelligence developer creates a profit-analysis dashboard and publishes it to the Finance project.
An Explorer generally works with existing published data and content. Depending on the specific Explorer role and permissions, the user may interact with dashboards, create or edit visualizations in the browser, and save supported changes. Explorer (Can Publish) has additional publishing capabilities compared with the standard Explorer role.
Example: A sales analyst filters regional sales results and creates a supported view using a published data source.
A Viewer primarily consumes published content. The user can open authorized dashboards, use supported interactive features, and access certain download or subscription options when available and permitted. A Viewer cannot become a publisher simply because a content permission is granted.
Example: A sales representative opens the monthly revenue dashboard to check performance.
Administrators oversee the platform or site. Their duties may include managing users and groups, assigning site roles, configuring access rules, organizing projects, and monitoring the environment. Server-wide administration and site-level administration are different scopes of responsibility.
User access is the combined result of authentication, licensing, site membership, site role, and content permissions.
Authentication verifies a user's identity. Depending on the organization's configuration, users may sign in using Tableau credentials, single sign-on (SSO), or another supported authentication method.
A user account represents an individual who may be granted access to a Tableau site. Administrators can add users individually or import users through supported administration tools.
A license determines the level of Tableau functionality available to a user. Common license types include Creator, Explorer, and Viewer. The assigned site role must be compatible with the license.
Site membership determines which Tableau site a user belongs to. A user may have different site roles on different sites, subject to the product's licensing and configuration rules.
Content permissions control actions on individual assets or through project-level permission rules. For example, a user may be allowed to view one project but not another.
User signs in
|
v
Authentication is verified
|
v
User has eligible site membership and license
|
v
Site role establishes maximum capabilities
|
v
Content permission rules are evaluated
|
v
Effective access is determined
|
v
User can perform permitted actions| Feature | Permissions | Site Roles | Licenses |
|---|---|---|---|
| Main purpose | Control actions on specific content. | Set the maximum access level within a site. | Determine the licensed level of product functionality. |
| Assigned to | Users or groups in relation to content. | Users on each site. | Users according to the licensing model. |
| Example | Allow a group to view a workbook. | Assign a user the Viewer role. | Assign an appropriate Viewer license. |
| Scope | Projects, workbooks, data sources, views, and supported assets. | Site-level maximum capabilities. | Product functionality and licensing entitlement. |
| Can it work alone? | No. Other access limits still apply. | No. Content permissions also matter. | No. Site membership, role, and permissions also matter. |
Easy way to remember: The license determines the licensed functionality, the site role sets the maximum level of access, and the content permissions determine what the user can do with particular resources.
A group is a collection of Tableau users who share a common access requirement. Groups simplify administration by allowing permission rules to be applied to multiple users at once.
For most organizations, it is easier to manage permissions through groups rather than creating separate permission rules for every user. Read Tableau's guide to managing users and groups.
Tableau permissions are built from individual capabilities. A capability can be set to Allowed, Denied, or Unspecified within a permission rule.
| Setting | Meaning | Example |
|---|---|---|
| Allowed | The rule grants the capability, subject to other access restrictions. | A group is allowed to view a workbook. |
| Denied | The rule explicitly denies the capability and can restrict access even if another applicable rule allows it. | A group is denied permission to download supported data. |
| Unspecified | The rule makes no explicit decision for that capability; the final result depends on other applicable rules and Tableau's permission evaluation. | A group has no explicit rule for workbook editing. |
In Tableau's standard permission evaluation, an explicit denial takes precedence over an allowance from another applicable rule, and an unspecified capability is not granted unless another applicable rule grants it. Site roles and other restrictions still limit the final result.
Permission templates provide predefined combinations of capabilities for common scenarios. Depending on the asset type and product version, templates may include View, Publish, or other role-oriented options. Administrators can customize individual capabilities when the predefined templates do not meet the requirement.
A user's effective permissions are the final permissions that result after Tableau evaluates the user's site role and all relevant permission rules. Checking effective permissions helps administrators understand why an action is allowed or blocked.
Read the official guide to permission capabilities and templates.
Project-level permissions define default access rules for content within a project. They are useful when many workbooks and data sources need a consistent access policy. Project permissions may also apply to nested projects, depending on the project configuration.
Example: A Finance project is configured so that Finance employees can view reports while a designated publishing group can publish approved workbooks.
Content-level permissions apply to a specific asset, such as an individual workbook or data source. They can be useful when one item requires access rules different from the project's general policy, if the project allows individual permissions to be customized.
Example: Most users can view the Finance project, but only the CFO group can access a restricted executive report.
Use locked permissions when consistency and centralized control are important. Use customizable permissions when specific workbooks or data sources require different access rules.
The exact menu names may differ between Tableau Server and Tableau Cloud versions.
Best practice: Before adding a user, determine what work the person needs to perform. Assign the least-privileged role that supports those responsibilities.
Keep group names clear and consistent. Avoid creating duplicate groups with nearly identical purposes.
Remember that configuring a project does not automatically mean every content type has the intended permissions. Review the relevant tabs and test the actual outcome. Read Tableau's detailed permissions guide.
Example: A Viewer who is promoted to a dashboard developer may need a different license and site role. Changing the role alone is not enough if the user lacks publishing permissions on the target project.
Read the official instructions for setting user site roles.
Suppose a company has a dashboard called Executive Revenue Dashboard. Only senior management should be able to view it.
Important: Do not assume that adding a restricted group is sufficient by itself. Review all applicable permission rules and any inherited or project-level settings. Where the data itself is sensitive, consider additional controls such as row-level security rather than relying solely on dashboard visibility.
Requirement: An employee must view a dashboard but must not edit or publish content.
Recommended approach: Assign an appropriate Viewer role and grant View access to the relevant workbook or project. Allow other interaction features only when needed.
Requirement: An analyst needs to build dashboards and publish them to a team project.
Recommended approach: Assign a compatible Creator role and license, then grant the necessary project publishing permissions and access to the required data sources.
Requirement: A manager needs to explore existing dashboards and edit supported content in the browser.
Recommended approach: Consider an Explorer role or Explorer (Can Publish), depending on whether publishing is required. Configure the appropriate workbook and project permissions.
Requirement: Only authorized HR users should access employee reports.
Recommended approach: Create an HR group, configure restrictive project or workbook permissions, review broad access rules, and apply data-level security where required.
Possible reasons:
Solution: Check the site role first, then inspect the relevant workbook and project permissions, including effective permissions.
Least privilege means granting users only the access needed to perform their assigned work. Users should not receive administrative or publishing capabilities merely for convenience.
Example: If an employee only needs to view a monthly sales report, a view-oriented role and the necessary View permissions are usually more appropriate than a role with broad authoring and publishing capabilities.
| Problem | Possible Cause | Suggested Solution |
|---|---|---|
| User cannot sign in | Account, authentication, site membership, or license issue. | Verify account status, authentication configuration, site membership, and licensing. |
| User cannot see a project | View access to the project is missing. | Review project-level permissions and effective access. |
| User can view but cannot publish | Site role or project Publish capability is insufficient. | Verify the user's role, license, and Publish capability. |
| User cannot edit a workbook | Editing capabilities or role restrictions. | Review Web Edit, Save, and other relevant capabilities, as well as role limits. |
| User can access a restricted report | Another group or broad permission rule grants access. | Inspect all applicable rules, including All Users and group memberships. |
| User cannot download data | Download capability, site role, or content configuration restricts the action. | Check the relevant download capability and the maximum capabilities allowed by the role. |
| Permissions appear inconsistent | Inherited project rules, explicit denials, multiple groups, or customized asset permissions. | Review effective permissions and simplify overlapping rules where practical. |
| User loses access after a role change | The new role has fewer maximum capabilities. | Confirm the intended role and recheck content permissions. |
Objective: Create a basic permission structure for a sales dashboard shared by developers, sales employees, and management.
| Group | View Dashboard | Publish Content | Manage Permissions |
|---|---|---|---|
| Sales Developers | Yes, if granted | Yes, if role and project permissions allow | Only if separately authorized |
| Sales Viewers | Yes | No | No |
| Sales Managers | Yes | Only if their role and permissions allow | Only if separately authorized |
| Unauthorized Users | No, if all applicable rules restrict access | No | No |
These are target outcomes for the exercise. Actual access depends on the site's roles, capabilities, and all applicable permission rules.
Answer: Permissions are rules that control whether users or groups can perform actions such as viewing, editing, publishing, downloading, or deleting specific Tableau content.
Answer: A site role defines the maximum capabilities a user can have on a Tableau site. The user's actual access is also determined by content permissions and licensing.
Answer: A Creator generally has capabilities for connecting to data, authoring content, and publishing, subject to permissions. A Viewer primarily accesses and interacts with published content and does not have normal publishing capabilities.
Answer: A role establishes the maximum level of access available to a user, while a permission rule controls actions on a particular content asset or through project-level rules.
Answer: Groups make access management easier because a single permission rule can apply to many users with similar responsibilities.
Answer: It is a permission rule configured at the project level to establish access defaults for content within that project, subject to the project's permission settings.
Answer: It is a permission rule applied directly to a specific asset, such as a workbook or data source, where the project configuration allows it.
Answer: Unspecified means the rule does not explicitly allow or deny the capability. The final outcome depends on other applicable rules and Tableau's permission evaluation.
Answer: In standard Tableau permission evaluation, an explicit denial takes precedence over an allowance from another applicable permission rule. Site roles and other restrictions also affect effective access.
Answer: No. A Viewer site role does not allow normal publishing. The user needs a compatible site role, license, and project permissions.
Answer: The administrator can create or use a department group, grant the necessary access to that group, review all other applicable rules, and verify effective permissions.
Answer: Least privilege means granting only the access required for a user's responsibilities, reducing security risks and unnecessary capabilities.
Answer: Effective permissions are the final capabilities available after Tableau evaluates site roles and applicable permission rules for the user and their groups.
Answer: Check the user's site role and license, then inspect the relevant workbook and project capabilities, publishing configuration, and effective permissions.
Answer: Broad permissions assigned to All Users may unintentionally expose content. Reviewing these rules helps administrators build a clear and controlled access structure.
Permissions, roles, and user access are essential parts of managing a secure Tableau environment. Site roles establish the maximum capabilities available to users, while permissions determine which actions they can perform on specific content. Licenses, group membership, project configuration, and other applicable rules also influence the final result.
By organizing users into groups, applying least-privilege access, configuring project permissions carefully, and checking effective permissions, organizations can share dashboards efficiently while protecting sensitive data.
Continue Learning: Explore Tableau Training | Register for a Tableau Course Demo
