13 Replies Latest reply on Feb 3, 2019 10:31 PM by Iwona Wiktorowska

    Remove ability to download workbook for owner?

    John Hobby

      I'm sure I'm missing a 'simple' piece of the permissions around the server, somewhere.  I'm using Tableau Server 10.2.


      Issue:  I created a group and assigned it to a specific project.  This works - so far.



      Problem:  A user has a Publisher site role, so they are allowed to connect to a published extract in order to create a new workbook and save it back to that project.  However, I set the group permission to DENY the ability to download - this should deny them from downloading a book they create, right?  At least, that was my understanding.  As you can see below, the download is available on a workbook they created online.  This downloads it and opens it in Tableau Desktop - this is what I need to prevent.  Users should be able to create new books online only, not download them.



      What am I missing?




        • 1. Re: Remove ability to download workbook for owner?
          Damien Lesage



          Owners have specific rights on their content you can't remove. The action includes:

          • Download
          • Delete
          • Refresh Extract
          • Change Owner
          • Set permissions if not locked to the project


          Actually, I found in the documentation that owners get full access to theirs content (How Permissions are Evaluated).


          We would like to remove these rights too, so I am interested in an answer if any solution exists.



          • 2. Re: Remove ability to download workbook for owner?
            John Hobby

            yeah, I kind of figured as much.  I really want to have the download ability for owners who create content online removed.  There won't be a need for our users who create content online to download their books, they should only be allowed online usage.


            Hopefully, someone else can help clear up a better way to get this accomplished.  I need to have users have the ability to create books online, but NOT be able to download them.



            • 3. Re: Remove ability to download workbook for owner?
              Glen Robinson

              Hi John

              A content owner of a Workbook or Published Data Source has 'full rights' of that object.

              AFAIK, there is no way to restrict this.

              The only option is to change the ownership of that object to another account, so that that the publisher only has 'normal' rights. Using a unlicensed account is a good option, so that only admins are able to download.

              This can only be done after something has been published, though.

              By querying the repository, you could build a dashboard showing workbooks where the ownership is not correctly set, and manually change them.

              Or, you can use the REST API to script this process, so that it can be done on a schedule.

              Hope this helps


              2 of 2 people found this helpful
              • 5. Re: Remove ability to download workbook for owner?
                John Hobby

                So, I need to bring the back up to see if there is anyone else that can help shed light on preventing workbooks from being downloaded off our TS.


                It seems that the 'deny' permission shown below for the download workbook / save as is being over-ridden by some other permission.  I have had users who are able to see a download workbook option


                I have had users that appear to be able to dl a book by using the 'download' icon next to the workbook name (the box with the down arrow).


                I need this feature to work when the permissions are explicitly set to deny this ... how do I go about removing this?  If the permissions won't work like expected, then can I do something to 'hide' or 'remove' this icon ?

                • 6. Re: Remove ability to download workbook for owner?
                  Glen Robinson

                  Hi John

                  I have just checked on Tableau 2018.1 and this appears to be working as expected.

                  Can you confirm that the users who are able to  download arent admins, project leaders, or content owners?

                  Also, what version of Tableau Server are you running? As it could be a bug in that version

                  All the best


                  • 7. Re: Remove ability to download workbook for owner?
                    John Hobby

                    Hey Glen,


                    I'm running TS 10.4.  The users are not set to admins or project leaders and I'm the only owner of all the data sources.  All users are set with custom permissions based on groups.  The snapshot above with the permission settings is what we have been rolling out for our 'publisher' group.  We do not use the default project leader permission group.

                    Our users should be able to connect to a DS, build a report and save it to a certain project.  Once they do that, they become the owner of that workbook - not the DS.  Without them being the owner of the book, they are not able to 'save'.  Thus, if i was to change all workbooks created to a 'generic' owner - they would not be able to modify their books anymore.


                    • 8. Re: Remove ability to download workbook for owner?
                      Glen Robinson

                      Hi John

                      Sorry, not sure that I follow what you are saying...

                      Are you saying that the user who builds a workbook, is able to download THAT workbook? If so, this is expected behavior as they are the owner of that workbook. However, for other workbooks in that project, they should have the permissions specified (as above)


                      • 9. Re: Remove ability to download workbook for owner?
                        John Hobby

                        Hey Glen

                        Maybe I didn't fully qualify that earlier       So, we do not want to allow users to use desktop to work with our data.   Our environment is setup to be fully web based, meaning that everything is only done on the server through web edit.  But, yes, a user who connects to a data source online by using the web editor to create reports / books then becomes the owner of that book.  The permission that denies the ability to download is what I'm confused about - regardless if it is a owner or view.  The other permissions work fine when they deal with other book on the server that other users have created using the web editor.


                        • 10. Re: Remove ability to download workbook for owner?
                          Jusran Mawardi

                          I hope the Tableau Server team read this issue.


                          I also have the same problem, somehow it doesn't work because the publisher is the owner. The worst is, in my case, my publisher user only create a blank dashboard to download the datasource (in csv/crosstab) and create the report in excel.


                          I hope there is also a permission setting in datasource whether user can download detail data or not.


                          still lookin for the solution

                          • 11. Re: Remove ability to download workbook for owner?
                            David Hetherington

                            Is this still being worked? or at least discussed.  We have users who we are happy to see and use,save, publish  the data, but it needs to be locked in the environment for security reasons.  It seems crazy that there is no way to let someone be publisher but prevent them from downloading data (at least from an admin perspective).  We might have to look at other solutions because management of this is to cumbersome.  I would hate to go that way.  Any luck from others out there navigating this issue.




                            • 12. Re: Remove ability to download workbook for owner?
                              Donna Coles

                              Agreed it can be a real minefield at times.  Other things to test/check

                              1) the permissions set against the published datasource itself - can the datasource be downloaded

                              2) the credentials of workbook and datasource.  If embedded credentials are used, then it might be the viewer is connecting to data based on the permissions of the owner Permissions Reference - Tableau , and if so, it might be that those credentials allowing download too....


                              These are just other thoughts for now - haven't tested any of this thoroughly myself or had to deal with the issues associated to this.


                              • 13. Re: Remove ability to download workbook for owner?
                                Iwona Wiktorowska

                                Is the option to show views as tabs disabled? In that case the workbook level settings would not propagate to the views and the download button will still be visible.