Was this page helpful?
Yes No

Permissions Reference

Tableau Server on Windows now includes Tableau Services Manager (TSM), which replaces the Configuration Utility and the command line tool. If you need help for an earlier version of Tableau Server, see the Tableau Help page.

This article lists the user and content settings that make up a given user’s ability to access published data sources and workbook on a given site on Tableau Server.

Site and permissions roles that allow full content access

The following list describes roughly who gets full access to content and the scope of that access:

  • Server administrators (Tableau Server only) are allowed all capabilities on all content published to the server. 

  • Site administrators are allowed all capabilities on content published to the site they administer.

    Users with the Site Administrator Creator site role can also publish or save new content from any Tableau client that supports publishing functionality. For example, Tableau Desktop, the web authoring environment.

  • In groups to which you apply the Project Leader role, users with the appropriate site roles are allowed all capabilities on content in the project.

    To learn more about Project Leader permissions, see Project-level administration.

  • Publishers become the owners of content they publish, and, by default, they are allowed all capabilities on that content. If they publish to a locked project hierarchy, they cannot set permissions on their content after publishing, unless they also are the top-level project owner or leader.

Capabilities available for each content type

The following table shows how permissions apply to content and describes each capability.

Permission Applies to… When allowed, users can…

View

workbooks

data sources

views

projects

Open the item on Tableau Server.

Note: When a workbook is configured to show sheets as tabs, all views use the workbook permissions, even if different permissions are specified on an individual view.

Web Edit

workbooks

views

Edit views in workbooks. For information, see Set Web Edit, Save, and Download Access on Content.

Save

workbooks

data sources

views

projects

Overwrite the content asset on the server.

When allowed, the user can re-publish a workbook or data source from Tableau Desktop or save it in web authoring, thereby becoming the owner and gaining access to all permissions. Subsequently, the original owner’s access to the workbook is determined by that user’s group permissions, and by any further permissions the new owner might set.

This capability also determines the user’s or group’s ability to overwrite a workbook after editing it on the server.

The All Users group has special treatment:

When a user publishes to a project on which the All Users group has permissions, the Save capability for the All Users group is changed from Allowed to Unspecified. This is to help protect an owner’s content from being overwritten by another user. You can manually modify this capability if you want to allow users to overwrite other users’ published content.

Download Workbook/
Save As

workbooks

Download a Tableau packaged workbook (.twbx) from the server.

Save an edited workbook as a new workbook on the server.

Download Data Source

data sources

Download the data source from the server.

Delete

workbooks

data sources

views

Delete the content resource.

Filter

workbooks

views

Modify filters in the view, keep only filters, and exclude data.

Add Comments

workbooks

views

Add comments to views in a workbook.

View Comments

workbooks

views

View the comments associated with the views in a workbook.

Download Summary Data

workbooks

views

View the aggregated data in a view, or in the user’s selection within the view, and download that data as a text file in .csv format.

Download Full Data

workbooks

views

View the underlying data behind each row in a view, as restricted by any marks the user has selected, and download the data as a text file in .csv format.

Download Image/PDF

workbooks

views

Download each view as to PNG or PDF format.

Share Customized

workbooks

views

Users can save customizations they’ve made to a view using the interaction features (such as filters). They can then share their custom view for others to see.

Customization in this way does not change the view’s default state or its underlying data.

Move

workbooks

Move workbooks between projects.

For more information, see Required access level for moving content.

Set Permissions

workbooks

data sources

views

Specify permissions for the content asset. Views in a workbook take permissions set at the workbook level.

Connect

data sources

Connect to a published data source from Tableau Desktop or the web editing environment.

See also: How data access is evaluated for workbooks that connect to Tableau data sources 

Project Leader

projects

Set permissions for all content assets in a project, individual assets, or the project itself. Can lock project permissions, change content owner, move content, and run refresh schedules.

Full project leader capabilities are available only with some site roles. For more information, see Project-level administration.

How data access is evaluated for workbooks that connect to Tableau data sources

When a Tableau Desktop user publishes a workbook that connects to a data source published to the server (a Tableau data source), the user can set the data authentication type to Embed password or Prompt users. In this specific publishing case, data authentication refers to the workbook’s connection to the Tableau data source. This is independent of the authentication set in the published data source’s connections to the underlying data.

When a user subsequently opens the workbook on the server, the workbook-specific data authentication is evaluated along with the Connect capability, set in permissions rules. Whether the user can see the data in the workbook is determined as follows:

  • When the workbook publisher selects the Embedded password option, they effectively embed their own Connect permissions, allowing anyone who can view the workbook to see the data it connects to. How the viewer’s Connect capability is set on the data source does not affect this outcome.

  • When the publisher selects the Prompt users option, viewers who are allowed the Connect capability are on the data source are prompted for their credentials. Users who are denied the Connect capability are denied access the data.

The following table summarizes the two bullet points above.

Workbook Data source authentication Connect capability Resulting access to data in the workbook

Embedded password

Embedded password or Prompt user

Allowed or Denied

Allowed through the workbook publisher’s Connect capability set on the data source

Prompt user

Embedded password

Allowed

Allowed through the viewer’s Connect capability

Denied

Denied

Prompt user

Allowed

Viewer is prompted for database credentials

Denied

Denied

See also

Permissions in Project Hierarchies—describes how permissions are applied in project hierarchies.