Tableau Cloud and Server Security: Site roles, permissions, tokens, embedding and hardening

Tableau sits on top of the organisation's most curated data, so an over-permissive project, a user filter that can be removed by downloading the workbook, or a leaked personal access token or connected app secret can hand out exactly the figures attackers and competitors want. Tableau comes in two forms with different responsibilities: Tableau Cloud, where Salesforce runs the platform and MFA is mandatory, and Tableau Server, where you also own the operating system, TLS, network placement and the TSM configuration. This guide explains how identity, site roles and permissions combine, how to protect administrators, how personal access tokens and connected apps work as non-human credentials, which row-level security option to choose, what the Activity Log and server logs record, and a hardening baseline for both deployment models. It is written for Tableau site and server administrators, analytics engineers who embed Tableau, and the security engineers who review them. Settings are from Tableau's current documentation; check them against your version.

This is an independent guide from NHI Mgmt Group, based on Tableau's public documentation as of November 2026. It is not sponsored or reviewed by Tableau. Product features change, so confirm settings against Tableau's current documentation.

Key takeaways

• Site role caps, permissions grant. A site role sets the most a user can do on a site; permission rules on projects and content then allow or deny each capability, and Unspecified means denied.
• Lock projects and clean up All Users. Tableau recommends setting permissions at project level, assigning them to groups and removing the default All Users rule, and locked projects stop content owners from loosening access.
• PATs and connected app secrets are long-lived credentials. A PAT lasts up to a year if used every 15 days, and connected app secrets do not expire until deleted, so both need owners, vaulting and rotation.
• User filters are not a security boundary on their own. Tableau warns that users who can save or download content can remove a user filter and see all rows; server-enforced data policies or database row-level security avoid that.
• Tableau Server is your infrastructure. Tableau's hardening checklist covers TLS versions, internal repository SSL, firewalling, session limits, regenerating internal tokens and disabling the Guest account, none of which happen by default.

How identity and access work in Tableau

Authentication

Tableau Cloud supports Tableau with MFA (TableauID credentials plus an authenticator app or security key), Google, Salesforce and generic OIDC single sign-on, and SAML. According to Tableau's documentation, MFA has been required for all Tableau Cloud access since 1 February 2022, either through the identity provider (the recommended route) or through Tableau with MFA. Each user is assigned one authentication type, and Tableau recommends dedicating at least one site administrator account to Tableau with MFA so the site stays reachable if the identity provider fails. Since Tableau 2024.3 a site can have multiple authentication configurations.

Tableau Server supports local accounts, Active Directory or LDAP, Kerberos, Windows automatic logon (SSPI), SAML, OpenID Connect, mutual SSL, trusted authentication and connected apps. Tableau's built-in MFA option is documented for Tableau Cloud; on Server, plan for MFA to come from the identity provider through SAML or OIDC. See the MFA Guide.

Site roles, licences and permissions

Tableau's site role documentation describes a site role as the maximum access a user can have on a site; licence level and content permissions decide what they can actually do. A user can hold different site roles on different sites.

Permission rules set capabilities such as View, Download Full Data, Web Edit and Delete to Allowed or Denied for a user or group. Tableau's permissions documentation notes that Unspecified is not neutral: a capability is granted only when explicitly allowed. Project-level rules act as defaults for content and nested projects, and each content type (workbooks, data sources, flows and others) has its own tab. A project's asset permissions are either Locked, where only the project owner, project leaders and administrators change permissions, or Customizable, where content owners can change permissions on their own assets. Tableau recommends project-level rules, group-based assignment and removing the default All Users rule.

Admin roles and privileged access

• Tableau Cloud Manager and Cloud Administrators: Tableau Cloud Manager holds a separate Cloud Administrator role that manages sites and tenant-level settings and retrieves tenant events. Treat it as the top privileged role.
• Server administrators and TSM: on Tableau Server, server administrators manage all sites, and TSM administrators control the platform configuration. Restrict TSM access to the platform team and protect the server host as you would any critical application server.
• Site administrators: limit both site administrator roles to a small, named group with SSO and MFA, plus the one Tableau with MFA fallback account, monitored for any use.
• Project leaders: project leaders can change permissions in locked projects. Grant the role to groups that own a business area, not to individuals by convenience.
• Ownership changes: Tableau notes that overwriting content makes the overwriting user the new owner. Watch for ownership changes on sensitive workbooks and data sources.
• Leavers: set departing users to Unlicensed, transfer content ownership and revoke their PATs. Tableau automatically revokes a user's PATs when the authentication method changes, but not simply because someone leaves the identity provider.

Integrations, API tokens and service accounts

Tableau has three main non-human credentials: personal access tokens for REST API and client automation, connected app secrets for embedding and API access, and the database credentials stored in published data sources. Each acts with real user rights.

Personal access tokens

Tableau's PAT documentation states that the secret is shown once and hashed before storage, that administrators cannot create PATs for users, and that a PAT session has the same access as its owner. Concurrent sessions with one PAT are not allowed. On Tableau Server the expiry can be changed with the refresh_token.absolute_expiry_in_seconds TSM setting, while Tableau Cloud allows expiry and creation limits from the UI. From version 2021.1, server administrator PATs can be used to impersonate other users through the REST API, but only after tsm authentication pat-impersonation enable is applied; once enabled, every server administrator PAT, including existing ones, can impersonate. Leave impersonation off unless an approved integration needs it, and know that Tableau provides a REST call to bulk-revoke server administrator tokens. Run automation under a dedicated service user with the lowest site role that works, never under a site administrator's personal PAT. See the SaaS API Token Security Guide.

Connected apps for embedding

Direct trust connected apps let your application sign a JWT with a shared secret, and Tableau trusts that token to sign the named user in. Tableau's documentation requires HS256, aud set to "tableau", a jti, an exp no more than 10 minutes ahead, and scopes in the scp claim, such as tableau:views:embed, tableau:views:embed_authoring and tableau:content:read. Because whoever holds the secret can mint a token for any user in the site within the app's scopes, the secret is effectively a site-wide impersonation key. Keep it in a secrets manager on the server side only, request the narrowest scopes, restrict the app to one project where possible, set the domain allowlist (it defaults to all domains), and use the second secret slot to rotate without downtime. New connected apps start disabled; enable them only after review. Tableau Server also supports connected apps that trust an external authorisation server (EAS) through OAuth 2.0, which moves token signing to your identity provider. See the JWT Security Guide.

Row-level security

Tableau's row-level security overview describes four options and a recommended order.

Tableau's guidance is to use database row-level security where the organisation already has it, a data policy where Data Management is licensed, and otherwise a dynamic filter, while making sure permissions prevent users from saving or downloading the content and removing the filter. In practice that means denying Download Full Data, Web Edit and Save on workbooks that rely on user filters. See the Data Access Governance Guide.

Logging and detection

Tableau Cloud Activity Log

The Activity Log records tenant events (changes made in Tableau Cloud Manager, such as site role assignments) and site events (sign-in successes and failures, permission changes and content interactions) as JSON. Tableau's documentation states that the default edition offers it through the Tableau Cloud Manager REST API with about one day of latency and 14 days of retention, while Advanced Management, Tableau Enterprise and Tableau+ deliver it in under 15 minutes, keep up to 365 days through the API and can write to a customer-owned Amazon S3 bucket. With the default edition, collect the log daily or lose it after two weeks. See the SaaS Audit Log Retention and Licensing Guide.

Tableau Server logs

On Tableau Server, PAT activity is logged by the Application Server (vizportal) service; filter for RefreshTokenService or OAuthController. Logs show a token GUID, not the secret, and distinguish token sessions from interactive sign-ins. Forward vizportal, gateway and authentication logs to your SIEM.

What to alert on

• Changes to site authentication settings, connected apps and their secrets.
• New site administrators, project leader grants and changes to the All Users group rule.
• PAT use from unusual networks, or a burst of REST API calls downloading many workbooks or data sources.
• Use of the Tableau with MFA fallback administrator account.
• Permission changes on locked projects holding sensitive data.

Metrics

• Site administrators: count per site, kept to the agreed small number.
• Personal PATs with administrator rights: PATs owned by site or server administrators, trending to zero for automation.
• Connected app secret age: days since last rotation for each enabled app, within policy.
• Customizable projects with sensitive data: target zero; sensitive projects locked.
• User-filtered workbooks with download allowed: target zero.

Hardening baseline

Both deployment models

1. Authentication: SSO through SAML or OIDC with MFA at the identity provider; one monitored fallback administrator.
2. Permissions: remove the All Users rule, create group-based project rules, lock projects that hold sensitive data, and review effective permissions on them.
3. Tokens and apps: inventory PATs and connected apps, move automation to dedicated service users, set domain allowlists and project scope, and rotate secrets.
4. Row-level security: move sensitive dashboards to database row-level security or data policies, or deny save and download where user filters remain.
5. Logging: collect the Activity Log (Cloud) or server logs (Server) into the SIEM with retention that meets your audit needs.

Tableau Server additions from Tableau's hardening checklist

1. Stay current: security fixes ship in versions and maintenance releases, not separate patches.
2. TLS: use a trusted certificate with at least a 2048-bit key, disable SSLv2, SSLv3, TLS 1.0 and TLS 1.1 through ssl.protocols, and enable internal SSL to the repository, which is off by default.
3. Network placement: do not expose Tableau Server directly to the internet or a DMZ; use a reverse proxy, enable host firewalls on every node and segregate inter-node traffic.
4. Service account: change the Run As User from Network Service to a dedicated least-privilege account where needed, and restrict access to the Tableau data directory.
5. Secrets and services: run tsm security regenerate-internal-tokens after installation, keep JMX disabled and restrict file-based data sources with native_api.allowed_paths.
6. Sessions and headers: set wgserver.session.apply_lifetime_limit to true with lifetime and idle limits (defaults 1,440 and 240 minutes), enable HSTS with gateway.http.hsts and set gateway.http.referrer_policy to same-origin.
7. Guest account: clear "Enable Guest account" at server and site level; Tableau notes it is on by default with core-based licensing.
8. Directory and mail: encrypt LDAP or use Kerberos for Active Directory, and require TLS for SMTP notifications.

Apply Server changes in a test environment first, record the previous TSM values with tsm configuration get, apply with tsm pending-changes apply, and roll back by restoring the recorded values if clients break. A small team on Tableau Cloud can concentrate on authentication, permissions, tokens and Activity Log collection; a large Tableau Server estate also needs platform hardening, change control on TSM and regular access reviews per site.

Common misconfigurations

• All Users rule left in place: the default group rule grants basic access to everyone on every new project.
• Customizable projects for sensitive data: content owners loosening permissions on finance or HR workbooks without the project leader knowing.
• User filters with download allowed: row-level security that any user can remove by downloading or saving a copy, as Tableau's own documentation warns.
• Automation on an administrator's PAT: scripts running with a site administrator's personal token that keeps working for a year and dies or leaks with that person.
• Connected app secrets in front-end code: a secret that can mint tokens for any user placed where browsers can read it, with the domain allowlist left at all domains.
• Guest account and old TLS on Server: the Guest account still enabled and TLS 1.0 or 1.1 still accepted on an internet-reachable server.

Framework mapping

Practitioner checklist

• Confirm SSO with MFA for every site and keep one monitored Tableau with MFA fallback administrator.
• List site administrators and project leaders per site and remove anyone without a current need.
• Remove the All Users permission rule and lock projects that hold sensitive data.
• Inventory PATs and move automation from personal administrator tokens to dedicated service users.
• Review each connected app for scopes, project restriction, domain allowlist and secret rotation date.
• Check every workbook that relies on user filters and deny save and full data download, or move it to a data policy or database row-level security.
• Collect the Activity Log or Tableau Server logs into the SIEM before the retention window closes.
• On Tableau Server, work through Tableau's hardening checklist: TLS versions, internal SSL, firewalling, session limits, token regeneration and the Guest account.

Standards and references

• Tableau: Security Hardening Checklist
• Tableau: Personal Access Tokens
• Tableau: Configure Connected Apps with Direct Trust
• Tableau: Permissions
• Tableau: Set Users' Site Roles
• Tableau: Overview of Row-Level Security Options
• Tableau: Activity Log
• Tableau: Authentication in Tableau Cloud

Related NHI Mgmt Group resources: SaaS API Token Security Guide · JWT Security Guide · Data Access Governance Guide · Least Privilege Techniques Guide · HSTS and HSTS Preload