3 Replies Latest reply on Mar 7, 2018 12:27 PM by AB Commendatore

    Understanding Tableau server permissions

    Mark Wu

      Tableau server permissions are very robust and very confusing. Please read my blog SCALING TABLEAU (7/10) – UNDERSTAND SERVER PERMISSIONS - Silicon Valley Enterprise Tableau User Group  that explains how Tableau server permission works at all level (site, project, workbook, data sources, user and groups). The blog dives into web editing permissions and various controls how you can set different permissions for different scenarios. The blog also dives into data source permissions - what is the recommended approach and why. Your key takeaways are:

      • Permission groups, not users
      • Lock project permissions if possible
      • For owner managed projects, permission workbooks, not views
      • Assign project leaders
      • Plan your permissions
      • Use published data sources and ‘Embedded password’ when publish workbook
      • Apply additional row level security
      • Test permissions out
      • Continual reviews

       

      Please see the attached slides for my presentation at July 2017 Tableau server admin virtual user group meeting.

        • 1. Re: Understanding Tableau server permissions
          AB Commendatore

          Great post! It certainly condenses a lot of permissions information into one place and is really easy to follow! Especially like the Best Practices section. Well done!

           

          Wanted to also take a moment to point out some Tableau documentation on the same subject for anyone looking for the source material:

           

          Content Access and Ownership

          Set Default Permissions at the Project Level

          How Permissions are Evaluated

          1 of 1 people found this helpful
          • 2. Re: Understanding Tableau server permissions
            donna.peak.2

            Hi,

             

            I have my permissions set by group at the project level.  I have some people in the group that need to be able to download and others that do not.  I am running into a problem because I cannot remove them from the All Users group so, in order to allow my small group to download I have to allow download for all users or it won't work.  I made myself just a user for the workbook because I had read that user permissions override.  My permissions do reflect what I want to happen for just me but that is not what is happening when I log in.  I have attached what I am doing.

            • 3. Re: Understanding Tableau server permissions
              AB Commendatore

              Hi Donna,

               

              The first thing to understand is how permissions are evaluated. The image below comes from How Permissions are Evaluated section of the Tableau Server help guide:

               

               

               

              In reviewing your document, users in the All Users group are explicitly denied download access, which is why no one can download. In order to remove that restriction from the group of users who are permitted to download, but maintain the restriction for those who are not permitted to download, you will need to add another group where Download is explicitly Allowed. To keep things simple, set all other permissions to Inherit and the permissions from the All Users group will be used instead.

               

              Then you will need to remove, or set to None, all permissions set at the Project level. Project level permissions override Group level permissions. So setting Download to Allow at the Project level will give all users the ability to Download. More information on how permissions work, cascade, and tips for configuring are included in the How Permissions are Evaluated section linked above and the  Configure Projects, Groups, and Permissions for Managed Self-Service section of the Tableau Server help guide.

               

              I think these resources should help you to conceptualize your plan and create the groups you need to manage content permission as desired.

               

              Hope this helps!
              AB