Tableau Cloud permissions: are your controls keeping up?

TL;DR: Tableau Cloud access often spreads through site roles, nested projects and item-level overrides, leaving sensitive dashboards visible to users who do not need them, according to Oleria Security. The governance gap is that reviewers can see current permissions but not whether access is actually used, so least privilege cannot be validated with confidence.

Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “Identity security & governance for Tableau Cloud”.

Key questions

Q: What breaks when Tableau Cloud permissions are reviewed without usage data?

A: Static permission review misses the difference between assigned privilege and exercised privilege.

Q: Why do nested projects and item overrides make analytics access hard to govern?

A: Because the final access decision is computed across multiple layers, not stored in one place.

Q: How should security teams handle Tableau tokens used by scripts and extraction jobs?

A: Treat them as non-human credentials with ownership, rotation and offboarding requirements.

Practitioner guidance

• Map effective Tableau permissions across the full hierarchy Unroll site roles, nested projects and item-level overrides so reviewers can see the final view, export and edit rights for each user and group.
• Overlay audit activity on access reviews Use Tableau audit history to confirm whether powerful roles such as Creator or Publisher are actually exercised before renewing them in certification.
• Inventory and rotate Tableau automation tokens Track personal access tokens and Connected App credentials used by scripts or extraction jobs, then apply rotation and ownership review to each one.

Bottom line: Tableau Cloud governance fails when site roles, project inheritance and item overrides are reviewed separately instead of as one effective access model.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →