4 Replies Latest reply on Mar 1, 2018 5:13 PM by Mark Wu

    10.5 Project Permission Hierarchy

    K'lila Nooning

      When I read "If you set permissions at the child level, those settings take precedence over permissions set at the parent level." in Permissions in Project Hierarchies I thought that meant that if someone had permissions in a child project they would take precedence over the parent. However, an analyst who had permissions to the child project was unable to access it because they did not have permission to the parent project. Am I misinterpreting something? When I add a new user to the child project will I be required to add them to all parent projects as well?

       

      Thank you

        • 1. Re: 10.5 Project Permission Hierarchy
          Mark Wu

          I spent hours to test the publishing permissions at parent and child level. Here is my conclusions from Publisher perspective:

           

          1. An user can  publish to a child project only if all the following 3 conditions are met:

          • Site role = publisher
          • Publisher permission at parent project level
          • Publisher permission at child project level

          In other words, publisher permissions at parent project level does not mean the user can publisher to child project. On the other side, users who have child project publisher permission w/o parent project level can't publish to child or parent project for sure: During publishing, the parent project name will not show up w/o publisher permission to parent project. When parent project does not show, publisher can't see child project at all.

           

          2. Let's say user A has site role as publisher,  publisher permission at parent project level, and publisher permission at child project level. User A decides to publish to child project (although User A can also publish to parent project). Parent project has group 1 Interactor for workbooks but child project has group 2 Interactor for workbooks. Where the new workbook permissions default from during publishing process? The default workbook permissions will come from child project only  - which means workbook permission will be group 2 Interactor. I guess that this is what it means "If you set permissions at the child level, those settings take precedence over permissions set at the parent level." However as we all know that publisher can change default permissoin during and after publishing.

           

          I will try to document all my test results at my blog site @Enterprise Tableau later on

          4 of 4 people found this helpful
          • 2. Re: 10.5 Project Permission Hierarchy
            Jill Carlsen

            Hi Mark,

            Thank you so much for your time on this. I'm the tech writer for this area, so I can update the Permissions in Project Hierarchies help article as well. I did a bunch of testing myself, and I think I had so many variations of experiments and results, I might've lost track of what I did and didn't try, arg. :-\ Mark, did you get the same results whether the project hierarchy was locked or not?

             

            K'lila Nooning, I'm sorry for the confusion!

             

            Jill

            Sr. Tech Writer at Tableau

            • 3. Re: 10.5 Project Permission Hierarchy
              Mark Wu

              Jill Carlsen, Good question. Technically same for locked projects. It means that an user can publish to a child project only if all the following 3 conditions are true for both locked and unlocked projects: Site role = publisher, and Publisher permission at parent project level and Publisher permission at child project level.

               

              For locked project, it is much simpler to understand/implement. Since only top project permissions can be locked. When it is locked, all child projects follow the same permissions. So the publisher permissions will always be the same between top and all child projects (for locked project).


              For unlocked project, the fact that you will have to give users publisher permission at both child AND parent project for them to be able to publish to child project is a big functionality challenge. Why?

              1. A lot extra work. Let's say you have a parent project called worldwide_sales, child projects as APAC_sales, EMEA_sales and AMR_sales. You have 4 publisher groups : APAC-publishers, EMEA-publishers, AMR-publishers, and WW-CentralTeam-publishers. APAC-publishers has to have publisher permission to APAC_sales and worldwide_sales, similar for  EMEA_sales and AMR_sales, which is extra work. This becomes a lot of harder if APAC_sales has different project leaders (than parent project leaders) who will not have privileges to add APAC_sales to worldwide_sales as publisher : APAC_sales project leader will have to inform/request worldwide_sales to change permissions..... 
              2. For above example, if you want WW-CentralTeam-publishers to be able to publish to parent project  worldwide_sales, how to avoid other 3 groups not to publish to worldwide_sales?
              • 4. Re: 10.5 Project Permission Hierarchy
                Mark Wu

                Pls vote the IDEA https://community.tableau.com/ideas/8490

                Allow publisher permission to child project only w/o publisher permission at parent project