Was this page helpful?
Yes No
Tableau Help > Tableau Server on Windows Help > 

Set Users’ Site Roles

When you add users to a site on Tableau Server, you must apply a site role to them. The site role determines which users or groups can publish, interact with, or only view published content, or who can manage the site’s users and administer the site itself.

Note: Tableau Server site roles do not correspond to user licenses that you purchase from Tableau (if you are using user-based licensing instead of core-based server licensing). Those licenses allow a certain number of users on the server.

In this article

Who can publish content

Capabilities the site role determines

General capabilities allowed with each site role

Change a user’s site role

Site roles and Active Directory import and synchronization

Who can publish content

The following site roles allow publishing content:

  • Server Administrator (Tableau Server only)

  • Site Administrator

  • Publisher

Users with a site role of Interactor, Viewer, and Unlicensed cannot publish content to the server.

Capabilities the site role determines

The site role is set at the user level (that is, not on content), to cap what a user can do with content site-wide. For example, a person whose site role is Interactor can never publish content from Tableau Desktop, even if a project’s permission rule assigns the Publisher permissions role to a group the user is a member of.

Site roles also determine who can configure the site or server itself. For example only a Site Administrator or Server Administrator can manage users.

General capabilities allowed with each site role

  • Server Administrator (Tableau Server only): The server administrator has full access to all server and site functionality, all content on the server, and all users.

  • Site Administrator: Site administrators can manage groups, projects, workbooks, and data sources (including connection information) for the site.

    On Tableau Server, server administrators can determine whether to not allow site administrators to manage users and assign site roles and site membership. By default on Tableau Server, and always on Tableau Online, site administrators are allowed these capabilities.

    Site administrators also have unrestricted access to the site’s content. A user can be a site administrator on multiple sites.

  • Publisher: Publishers can sign in, browse the server, and interact with the published views. They also can connect to Tableau Server from Tableau Desktop to publish (upload) and download workbooks and data sources. Publishers cannot manage users.

  • Interactor: Interactors can sign in, browse the server, and interact with the published views. They are not allowed to publish to the server.

  • Viewer: Viewers can sign in and see published views on the server but cannot use any interaction features like filtering and sorting. Users with this site role can be allowed only to view and add and view comments.

  • Unlicensed: Unlicensed users cannot sign in to the server. Users are assigned the Unlicensed role in the following circumstances:

    • You import users from a CSV file.

    • The number of available licenses is reached at the time you add or import users.

    • You remove a user who owns content on the site. The user will still own the content but not be able to do anything with it.

See also How Permissions are Evaluated.

Change a user’s site role

By default both server and site administrators can manage user settings. On Tableau Server, server administrators can configure a site to disallow site administrators the ability to manage users.

  1. Sign in to the site, and go to the Users area.

  2. Select the users, and then select Actions > Site Role.

  3. Select the new site role, and then click Change Site Role.

    You can hover the pointer over the information icon to display a matrix that shows the maximum level of general capabilities each site role allows.

Site roles and Active Directory import and synchronization

When you import Active Directory users to a site, you can specify the site role. If a user is not yet a member of any site on the server, the user is added to the site with the assigned role. When you synchronize Active Directory groups, the site role is applied through the Minimum Site Role setting on the Groups - Details page.

If a user already exists in a Tableau Server site, the site role assigned during the import or sync process will be applied if it gives the user more access in a site. Importing or synchronizing users and groups will promote a user's site role, but not demote a user's site role.

If a user already has the ability to publish, that ability is maintained.

To guarantee a user maintains a site role with equal or greater capabilities in server after an import, the following matrix shows the rules applied for site roles on import.

Note: The Import Site Role row abbreviated headers indicate the site role specified for import. The Current Site Role column headers represent the current user site role. The table values represent the abbreviated resulting site role.

  • Site Administrator: SA
  • Publisher: P
  • Interactor: I
  • Unlicensed: U

  Current Site Role
Import Site Role

SA

P

I

V

U

Site Administrator

(SA)

SA SA SA SA SA

Publisher

(P)

SA P P P P

Interactor

(I)

SA P I I I

Viewer

(V)

SA P I V V

Unlicensed

(U)

SA P I V U