Recently, we learned about Tableau Server and its ability to allow for centralized sharing, security, and automation. But as consultants, we always need to ask the burning question: Why? Why does someone choose to use Server over another platform like Tableau Cloud?
In most cases, the reason is because the user needs total control over their infrastructure, customization, and data governance. So in this blog, we will be going over best practices for configuring permissions in Tableau Server so that the way users interact with content; such as projects, workbooks, and data sources; are in total control.
Step 1: Understand Site Roles vs. User Permissions
- A given user's Site Role (e.g., Viewer, Explorer, Creator) will determine the ceiling of their capabilities across the entire site.
- For example, if a user has a Viewer Site Role, granting them Web Edit permissions, will do nothing.
Step 2: Implement a Closed Permissions Model
- An open model means that permissions defaults to giving users broad access and instead requires you to remember to restrict sensitive content. A closed model, on the other hand, will default to no access, meaning sensitive content will remain private unless explicitly shared.
- To achieve a true closed model, make sure to set permissions for All Users to None on all top-level projects.
- In Tableau Server, a Deny will always override an Allow, which could potentially lead to troubleshooting bottlenecks. Instead, leave baseline permissions as Unspecified (which defaults to no access) and use explicit Allow rules only for authorized groups.
Step 3: Manage Access via Groups
- Depending on your organizational context and needs, create groups based on business roles, data access tiers, or departments and assign permissions to those groups rather than named individuals.
- When an employee transfers departments or leaves the organization, updating their group membership will automatically adjust their access, avoiding manual labor and permission inconsistencies.
Step 4: Build Project Architecture
- Set your projects to Locked (or Locked to Parent for nested folders). You should never leave them as Customizable, which lets authors create unpredictable permissions on individual workbooks.
- Instead of giving leads full Server or Site Administrator access, make them Project Leaders inside their own locked projects. This lets them manage user access locally while maintaining the locked project structure.
By adopting a closed model and managing access through groups within locked projects, you can take full advantage of Tableau Server’s centralized control. Think of these best practices as your foundation: once they're in place, you can confidently adapt and fine-tune permissions to match whatever unique workflows your business requires.