4 of 4 people found this helpful
I spent hours to test the publishing permissions at parent and child level. Here is my conclusions from Publisher perspective:
1. An user can publish to a child project only if all the following 3 conditions are met:
- Site role = publisher
- Publisher permission at parent project level
- Publisher permission at child project level
In other words, publisher permissions at parent project level does not mean the user can publisher to child project. On the other side, users who have child project publisher permission w/o parent project level can't publish to child or parent project for sure: During publishing, the parent project name will not show up w/o publisher permission to parent project. When parent project does not show, publisher can't see child project at all.
2. Let's say user A has site role as publisher, publisher permission at parent project level, and publisher permission at child project level. User A decides to publish to child project (although User A can also publish to parent project). Parent project has group 1 Interactor for workbooks but child project has group 2 Interactor for workbooks. Where the new workbook permissions default from during publishing process? The default workbook permissions will come from child project only - which means workbook permission will be group 2 Interactor. I guess that this is what it means "If you set permissions at the child level, those settings take precedence over permissions set at the parent level." However as we all know that publisher can change default permissoin during and after publishing.
I will try to document all my test results at my blog site @Enterprise Tableau later on
Thank you so much for your time on this. I'm the tech writer for this area, so I can update the Permissions in Project Hierarchies help article as well. I did a bunch of testing myself, and I think I had so many variations of experiments and results, I might've lost track of what I did and didn't try, arg. :-\ Mark, did you get the same results whether the project hierarchy was locked or not?
K'lila Nooning, I'm sorry for the confusion!
Sr. Tech Writer at Tableau
Jill Carlsen, Good question. Technically same for locked projects. It means that an user can publish to a child project only if all the following 3 conditions are true for both locked and unlocked projects: Site role = publisher, and Publisher permission at parent project level and Publisher permission at child project level.
For locked project, it is much simpler to understand/implement. Since only top project permissions can be locked. When it is locked, all child projects follow the same permissions. So the publisher permissions will always be the same between top and all child projects (for locked project).
For unlocked project, the fact that you will have to give users publisher permission at both child AND parent project for them to be able to publish to child project is a big functionality challenge. Why?
- A lot extra work. Let's say you have a parent project called worldwide_sales, child projects as APAC_sales, EMEA_sales and AMR_sales. You have 4 publisher groups : APAC-publishers, EMEA-publishers, AMR-publishers, and WW-CentralTeam-publishers. APAC-publishers has to have publisher permission to APAC_sales and worldwide_sales, similar for EMEA_sales and AMR_sales, which is extra work. This becomes a lot of harder if APAC_sales has different project leaders (than parent project leaders) who will not have privileges to add APAC_sales to worldwide_sales as publisher : APAC_sales project leader will have to inform/request worldwide_sales to change permissions.....
- For above example, if you want WW-CentralTeam-publishers to be able to publish to parent project worldwide_sales, how to avoid other 3 groups not to publish to worldwide_sales?