Tableau Permissions

Overview

Permissions, (sometimes referred to as user rights), are applied to Tableau objects: Projects, Workbooks, Data Sources, Ask Data Lenses, and Worksheets, (depending on how the workbook tabs are configured).

To see the Permission capabilities of an object, click on the three dots … under the Actions column and select permissions.

Different types of objects have different permission capabilities.

• The screenshot below shows the Explore menu displaying Top Level Projects objects, and how to view the permissions of the Student_01 project.

• In the example below of permissions for the Student_01 project, there is a row for each user or group assigned to this project. A permission rule is set up for each user or group.

• Project permissions only have two capabilities: View and Publish (Save).

• There is a template setting which automatically assigns the settings for each capability, or you can custom set the values for each capability individually.

• There are three permission evaluation settings, a green checkmark granting access, a red X denying access, and a blank (light grey) box stating that no permission rules are applied.

• For a project, the only capabilities are the eye icon to view the project, and the save icon to publish changes to the project. See the screenshot of Project Permission Capabilities below.

• Workbooks display more permission capabilities than projects since more can be done with them.
  See the Workbook Permission Capabilities screenshot below

• For a workbook, there are 16 capabilities. See the Tableau help link for Workbook Permission capabilities

Effective Permissions

The capabilities granted a user may be unclear because of membership in multiple groups and the interplay of site roles and ownership with permission rules. The Effective Permissions panel shows how Tableau resolves the multiple factors to arrive at the effective permissions granted to a user.

Example Scenario: Students Orange Belt group vs. All Users group

Sometimes you think you have set permissions up correctly, but the user still cannot do what they need. That might be due to conflicting permission settings among groups, etc. Viewing a user’s Effective Permissions shows what the end result is.

In the screenshot below, Student_01 is a member of the Students Orange Belt group, which has Publish permissions to this project. The X in the view column below the Effective Permissions heading for the Student_01 user indicates that this user cannot see the Student_01 project. This is because user Student_01 is also a member of the All Users group, a group which has been denied access to this project. Tableau treats the most restrictive group permissions for a user as the user’s effective permissions.

Common Problems with Permissions

Conflicting Permissions from Different Groups

One of the most common problems is when a user is a member of one group granting them permission to a resource, but they are also a member of another group that denies them permission to the resource.

In this scenario, members of the All Users group permissions is Denied, so access to the Project and all sub-projects is denied. Even though the Students group has been granted viewer permissions, the All Users group permissions restriction takes precedence. So the permissions for members of the Students group all show a red x. A user’s group permissions is subject to the most restrictive group they are members of.

In the scenario above, the only way to override the All Users group permission of Denied is to add the individual user to the permission rather than a Group.
An individual user’s permissions will override Group permissions

In the scenario below, if the All Users group permissions template is changed to None, then it is no longer more restrictive, and the Students group now can view the resource.

No Permission to the Datasource

Another common problem is when a user has permissions for the Project, Workbook, and View, but no permission to the datasource.

In the scenario below, User_01 has Publish permission to the User_10 Project, but not to the _Sales_Invoice data source.

The result is they can open the workbook, but not see the data. If you read the fine print, it says the user does not have permission to access the datasource.

There are multiple ways the permissions might be applied to the datasource, so troubleshooting this can be challenging.

Project Permissions: Locked or Customizable

In the previous scenario, the permissions on the parent project were set to Customizable, so different permissions could be applied to the datasource within the project.

In the screenshot below the Project level for the datasources in the project show Student_01 has view and save permissions. But notice at the top that the project permissions are set to Customizable

In the screenshot below, the permissions for the _Sales_Invoice datasource in the screenshot below shows Student_01 is Denied access to this datasource. This overrides the default permissions on the parent project the datasource is stored in.

If the permissions configuration on the parent project is set to Locked, this overrides the customized permissions on the individual datasource.

Worksheet permissions

There are two conditions required to assign individual worksheet permissions

The workbook’s parent project must allow customizable permissions.

Hide Tabs

The workbook configuration must be set to hide tabs. Note the first screenshot below states the permissions are inherited from the workbook because Tabbed view is on / Show Tabs.

The screenshots below show how to change the Tabbed views setting to Hide Tabs

Then you have the option to change permissions per worksheet

Troubleshooting Permissions

Understanding the relationships between Locked vs Customizable, and Group Level permissions restrictions are key to troubleshooting permissions problems.

The general troubleshooting steps are:

1. Check Effective Permissions

2. Verify all the Groups the user is a member of, and if the individual user ID has any assigned permissions, which overrides group permissions.

2. Check the group & user permissions for the Worksheet, Workbook, Datasource, and Projects related to the issue. Remember that a group with more restrictive permissions overrides a group with access permissions.

• Are the permissions for the project(s) set to Locked or Customizable?

• If Customizable, then check the individual datasource, workbook, worksheet permissions.
  

3. Check permissions of all the components: Project, Workbook, DataSource.

Tableau Help Page Links

• Configure Projects, Groups, and Permissions for Managed Self-Service - Tableau

• Quick Start: Permissions - Tableau

• Permissions - Tableau

• Effective permissions - Tableau

• Manage Permissions with Projects - Tableau

• Permissions, Site Roles, and Licenses - Tableau