Was this page helpful?
Yes No
Tableau Help > Tableau Server on Windows Help > 

Tableau Server on Windows now includes Tableau Services Manager (TSM), which replaces the Configuration Utility and the command line tool. If you need help for an earlier version of Tableau Server, see the Tableau Help page.

Set Users’ Site Roles

When you add users to a site on Tableau Server or Tableau Online, independent of their license type, you must apply a site role to them. The site role signifies the maximum level of access a user can have on the site. Along with content permissions, the site role determines who can publish, interact with, or only view published content, or who can manage the site’s users and administer the site itself.

How user licenses, site roles, and content permissions work together

The intersection of a user’s license type, site role, and content permissions determines the level of access a user has on the Tableau site.

  1. The license type is associated with the user. The site role you want to assign to the user determines the license type they will require.

    In a multi-site environment on Tableau Server, a user’s license applies to all sites the user is a member of.

  2. The site role is also set at the user level. In a multi-site environment, you assign site roles on each site. For example, the same user can have the Site Administrator Creator site role on one site, and Viewer site role on another site.

    The site role defines the maximum capabilities the user has to work with content on the site, or manage users or the site itself.

  3. Whether the site role’s maximum capabilities are available to the user depends on the permissions set on the content resources (projects, data sources, workbooks).

For example, say User A has the following access on a site:

  • Creator license
  • Explorer site role
  • Publisher permissions on a project

In this scenario, even though the license allows connecting to and creating new data sources in the web editing environment or Tableau Desktop, and the content resources allow publishing, the site role denies publishing new content on that site.

Similarly, if User A’s site role and license are both Creator, the user can connect to and save (publish) new data sources only in projects on which permissions settings grant those capabilities.

For more information, see Content Permissions and Ownership.

Change a user’s site role

  1. Sign in to the site as a server or site administrator, and go to the Users area.

    If you are a site administrator and do not see the Users area, check with your server administrator on whether they have denied user management capabilities to site administrators.

  2. Select the users, and then select Actions > Site Role.

  3. Select the new site role, and then click Change Site Role.

    Select the new site role.

    You can hover the pointer over the information icon to display a matrix that shows the maximum level of general capabilities each site role allows. For more information, continue to General capabilities allowed with each site role.

General capabilities allowed with each site role

The following table lists the license types as of version 2018.1, the highest level of site role allowed with each, how each site role maps to its pre-2018.1 equivalent; and summarizes the maximum capabilities each site role allows. If you want more specific information about which capability can be allowed on each site role for each content type, see

Notes

  • This information focuses on site roles and is more generalized. For a list of common specific tasks available per license role, see the matrix on the For Teams & Organizations tab on the Tableau pricing page.

  • This information describes site roles as of version 2018.1. To learn more about how core-based licensing relates to user-based licensing, how licenses transfer, or other specific licensing transition scenarios, start with the following topics:

    Migrate from Core-Based to User-Based Licensing

    Troubleshoot Licensing

Tableau site roles as of version 2018.1

Site role name as of version 2018.1 Previous site role name Maximum capabilities this site role allows

Site roles that use a Creator license

—Users with these site roles have access to Tableau clients such as Tableau Prep, Tableau Desktop, Tableau Bridge, and Tableau Mobile.

Server Administrator

Server Administrator

Available on Tableau Server only; not applicable to Tableau Online.

This site role always occupies the highest license available between Creator and Explorer. It allows unrestricted access to the configuration settings for the Tableau Server browser environment, all sites on the server, users and groups, and all content assets, such as projects, data sources (including connection information), and workbooks.

Connect to Tableau published data sources or external data, from the browser, Tableau Desktop, or Tableau Prep; create and publish new data sources; author and publish workbooks.

Site Administrator Creator

--

This is the highest level of access for Tableau Online.

Unrestricted access to content as described above, but at the site level. Connect to Tableau or external data in the browser, Tableau Desktop, or Tableau Prep; create new data sources; build and publish content.

On Tableau Server, server administrators can determine whether or not to allow site administrators to manage users and assign site roles and site membership. By default, on Tableau Server, and always on Tableau Online, site administrators are allowed these capabilities.

Creator

--

This is similar to the former Publisher site role, but allows new features. This site role offers non-administrators the maximum level of content access.

Connect to Tableau or external data in the browser, build and publish data sources and workbooks, have access to Dashboard Starters, and use interaction features on published views. Can also connect to data from Tableau Prep or Tableau Desktop, publish (upload/save) and download workbooks and data sources.

Site roles that use an Explorer license

—Users with these site roles can access the server from the browser or Tableau Mobile.

Server Administrator

N/A

Tableau Server only; not applicable to Tableau Online.

If Explorer is the highest license type available when a new server administrator user is created, the user’s site role is Server Administrator; however, the user will not have the connecting and publishing capabilities that come only with the Creator license.

Site Administrator Explorer

Site Administrator

Same access to site and user configuration as Site Administrator Creator, but cannot connect to external data from the web editing environment.

Can connect to Tableau published data sources to create new workbooks, and edit and save existing workbooks.

Explorer (Can Publish)

Publisher

Can publish new content from Tableau Desktop, browse and interact with published views, use all interaction features.

In the web editing environment, can edit and save existing workbooks, and save new standalone data sources from data connections embedded in workbooks, but cannot connect to external data and create new data sources.

Explorer

Interactor

Can browse and interact with published views. Can subscribe to content, create data driven alerts, connect to Tableau published data sources and open workbooks in the web authoring environment for ad-hoc queries, but they cannot save their work.

Read Only

Viewer

This site role is available only in version 2018.1, for transitioning users to the user-based Viewer (or other) license and site role. Users with this site role will become unlicensed when you upgrade to version 2018.2 or later.

In 2018.1 versions, Read Only users can see and subscribe to published views others have created. Cannot use other interaction features or save custom views.

Site roles that use a Viewer license

Viewer

N/A

Can see published and custom views others have created; can use most interaction features, such as subscribing to views, downloading as images, and downloading summary data. Cannot connect to data; create, edit, or publish content; or set data alerts.

For a list of specific capabilities, see the Viewer column in the matrix on the Tableau pricing page.

Note: Although the Viewer site role existed in previous versions, the new Viewer site role has additional capabilities.

Unlicensed

Unlicensed

Unlicensed users cannot sign in to Tableau Server or Tableau Online. Users are assigned the Unlicensed role in the following circumstances:

  • You import users from a CSV file.

  • The number of available licenses is reached at the time you add or import users.

  • You remove a user who owns content on the site. The user will still own the content but not be able to do anything with it.

Who can publish content

The following site roles allow the specified level of publishing access.

  • Server Administrator (Tableau Server only); Site Administrator Creator; and Creator allow full connecting and publishing access.

    This includes connecting to data and publishing new workbooks and new data sources from Tableau Desktop and the web editing environment. The site roles also allow editing and saving existing published workbooks, or publishing updates to existing data sources.

  • Explorer (Can Publish) and Site Administrator Explorer have limited publishing capabilities, as described in General capabilities allowed with each site role.

  • Explorer, Viewer, Read Only, and Unlicensed do not allow publishing.

Site roles and Active Directory import and synchronization

When you import Active Directory users to a site, you can specify the site role. If a user is not yet a member of any site on the server, the user is added to the site with the assigned role. When you synchronize Active Directory groups, the site role is applied through the Minimum Site Role setting on the Groups - Details page.

If a user already exists in a Tableau Server site, the site role assigned during the import or sync process will be applied if it gives the user more access in a site. Importing or synchronizing AD users and groups can promote a user's site role, but does not demote a user's site role.

If a user already has the ability to publish, that ability is maintained.

The matrix below shows the rules applied for site roles on import.

Note: The Import Site Role row abbreviated headers indicate the site role specified for import. The Current Site Role column headers represent the current user site role. The table values represent the abbreviated resulting site role.

  • Site Administrator: SA
  • Site Administrator Creator: SC
  • Site Administrator Explorer: SE
  • Creator: C
  • Explorer: E
  • Explorer (Can Publish): EP
  • Viewer: V
  • Unlicensed: U

  Current Site Role
Import Site Role

SC

C

SE

EP

E

V

U

Site Administrator Creator

(SC)

SC SC SC SC SC SC SC

Site Administrator Explorer

(SE)

SE SE SE SE SE SE SE

Creator

(C)

SC C SE C C C C

Explorer (Can Publish)

(EP)

SC C SE EP EP EP EP

Explorer

(E)

SE C SE EP E E E

Viewer

(V)

SE C SE EP E V V

Unlicensed

(U)

SE C SE EP E V U