Was this page helpful?
Yes No

Set Users’ Site Roles

When you add users to a site on Tableau Server, you must apply a site role to them. The site role determines which users or groups can publish, interact with, or only view published content, or who can manage the site’s users and administer the site itself.

Note: Tableau Server site roles do not correspond to user licenses that you purchase from Tableau (if you are using user-based licensing instead of core-based server licensing). Those licenses allow a certain number of users on the server.

In this topic

Who can publish content

Capabilities the site role determines

General capabilities allowed with each site role

Change a user’s site role

Site roles and Active Directory import and synchronization

Who can publish content

The following site roles allow publishing content:

  • Server Administrator (Available in Tableau Server on-premises only)

  • Site Administrator

  • Publisher

  • Viewer (can publish)

  • Unlicensed (can publish)

    Note: A system change is required on computers that Unlicensed (can publish) users will use to publish. For more information, see the corresponding quick fix article.

Users with a site role of Interactor, Viewer, and Unlicensed cannot publish content to the server.

Capabilities the site role determines

The site role is set at the user level (that is, not on content), to cap what a user can do with content site-wide. For example, a person whose site role is Interactor can never publish content from Tableau Desktop, even if a project’s permission rule assigns the Publisher permissions role to a group the user is a member of.

Site roles also determine who can configure the site or server itself. For example only a Site Administrator or Server Administrator can manage users.

General capabilities allowed with each site role

  • Server Administrator (Tableau Server only): The server administrator has full access to all server and site functionality, all content on the server, and all users.

  • Site Administrator: Site administrators can manage groups, projects, workbooks, and data sources (including connection information) for the site. On Tableau Server on-premises, the server administrator determines whether site administrators can add users and assign site roles and site membership. On Tableau Online, site administrators are allowed these capabilities.

    Site administrators also have unrestricted access to the site’s content. A user can be a site administrator on multiple sites.

  • Publisher: Publishers can sign in, browse the server, and interact with the published views. They also can connect to Tableau Server from Tableau Desktop to publish (upload) and download workbooks and data sources. Publishers cannot manage users.

  • Interactor: Interactors can sign in, browse the server, and interact with the published views. They are not allowed to publish to the server.

  • Viewer: Viewers can sign in and see published views on the server but cannot use any interaction features like filtering and sorting. Users with this site role can be allowed only to view and add and view comments.

  • Unlicensed: Unlicensed users cannot sign in to the server. Users are assigned the Unlicensed role in the following circumstances:

    • You import users from a CSV file.

    • The number of available licenses is reached at the time you add or import users.

    • You remove a user who owns content on the site. The user will still own the content but not be able to do anything with it.

  • Viewer (can publish). The user can sign in from Tableau Desktop to publish and download workbooks and data sources, but they cannot interact with content on the server.

  • Unlicensed (can publish). The user can sign in from Tableau Desktop to publish workbooks to the server, but they cannot sign in to Tableau Server directly. In addition, they cannot publish data sources or download them from the server.

See also How Permissions are Evaluated.

Change a user’s site role

By default both server and site administrators can manage user settings. On Tableau Server, server administrators can configure a site to disallow site administrators the ability to manage users.

  1. Sign in to the site, and go to the Users area.

  2. Select the users, and then select Actions > Site Role.

  3. Select the new site role, and then click Change Site Role.

    You can hover the pointer over the information icon to display a matrix that shows the maximum level of general capabilities each site role allows.

Site roles and Active Directory import and synchronization

When you import Active Directory users to a site, you can specify the site role. If a user is not yet a member of any site on the server, the user is added to the site with the assigned role. When you synchronize Active Directory groups, the site role is applied through the Minimum Site Role setting on the Groups - Details page.

If a user already exists in a Tableau Server site, the site role assigned during the import or sync process will be applied if it gives the user more access in a site. Importing or synchronizing users and groups will promote a user's site role, but not demote a user's site role.

If a user already has the ability to publish, that ability is maintained. For example, if a user with the current site role of Unlicensed (can publish) is imported with the new site role of Interactor, that user's site role will be promoted to Publisher on import.

To guarantee a user maintains a site role with equal or greater capabilities in server after an import, the following matrix shows the rules applied for site roles on import. Bold indicates that a site role was promoted to preserve the user's ability to publish.

Note: The Import Site Role row abbreviated headers indicate the site role specified for import. The Current Site Role column headers represent the current user site role. The table values represent the abbreviated resulting site role. A bold site role in the table indicates a site role promotion that preserves the ability to publish.

  • Site Administrator: SA
  • Publisher: P
  • Interactor: I
  • Viewer (can publish): V-P
  • Unlicensed (can publish): U-P
  • Unlicensed: U

  Current Site Role
Import Site Role

SA

P

I

V

V-P

U

U-P

Site Administrator

(SA)

SA SA SA SA SA SA SA

Publisher

(P)

SA P P P P P P

Interactor

(I)

SA P I I P I P

Viewer (can publish)

(V-P)

SA P P V-P V-P V-P V-P

Viewer

(V)

SA P I V V-P V V-P

Unlicensed (can publish)

(U-P)

SA P P V-P V-P U-P U-P

Unlicensed

(U)

SA P I V V-P U U-P