Tableau Next has a multi-layered access control structure powered by flexible Salesforce permission sets, Data 360 governance policies, and sharing settings on each Tableau Next asset.
Required Editions
| View supported editions. |
Foundational Access - Licenses and Permissions
Licenses grant access to Data 360 and Tableau Next. Permissions grant access to data spaces and their contents.
A Salesforce Administrator can Assign a User a Tableau Next Permission Set. Choose the best Tableau Next Permission Sets and Licenses based on a user’s needed capabilities.
Tableau Next Licenses
Licenses control users’ potential access.
Tableau Next Creator, Tableau Next Creator (Legacy)
These licenses contain everything in Tableau Next, including assigning permission sets to users, tracking license usage, and viewing metadata for all assets Tableau Next.
Tableau Next Consumer, Tableau Next Consumer (Legacy)
These licenses include view access to Tableau Next assets, as well as creating and following metrics.
Tableau Next Limited Consumer
This license includes view access to assets in Tableau Next Apps for Salesforce.
Tableau Next Included App
This license includes manage access to template framework templates and apps, and view access to assets created from templates.
Tableau Next Permission Sets
Permission sets (standard or custom) control baseline functional capabilities such as access to Concierge, asset editing, and personal orgs.
Tableau Unmetered Admin or Tableau Next Admin
Included license: Tableau Next Creator or Tableau Next Creator (Legacy)
Users with these permission sets can configure Tableau Next and manage users. In addition, they can manage workspaces and assets, including managing sharing for all assets.
- Access Tableau Next Studio
- Use Tableau Agent
- Configure Tableau Next and manage users
- Manage sharing for all assets, and manage Analytics Groups
- Manage all assets (workspaces, dashboards, visualizations)
- View and list assets in the Marketplace
- Own and manage Personal Orgs
- View, explore, and follow metrics
- Access Slack entry points to Tableau Next assets
Tableau Unmetered Platform Analyst or Tableau Next Platform Analyst
Included license: Tableau Next Creator or Tableau Next Creator (Legacy)
Users with these permission sets can manage workspaces they own or that are shared with them.
- Access Tableau Next Studio
- Use Tableau Agent
- Manage and share owned assets (workspaces, dashboards, visualizations)
- View the Marketplace
- Own a Personal Org
- Share snapshots
- View, explore, and follow metrics
- Access Slack entry points to Tableau Next assets
Tableau Unmetered Self-Service Analyst or Tableau Next Self-Service Analyst
Included license: Tableau Next Creator or Tableau Next Creator (Legacy)
Users with these permission sets can edit assets in their Personal Org and view assets in production.
- Access Tableau Next Studio
- Use Tableau Agent
- View assets (workspaces, dashboards, visualizations)
- Share snapshots
- Own a Personal Org
- View, explore, and follow metrics
- Access Slack entry points to Tableau Next assets
Tableau Unmetered Self-Service Consumer or Tableau Next Self-Service Consumer
Included license: Tableau Next Creator or Tableau Next Creator (Legacy)
Users with these permission sets can browse, view, and interact with assets in production.
- Access the Tableau Next home page
- Browse metrics and dashboards
- Use Tableau Agent
- View assets (workspaces, dashboards, visualizations)
- Share snapshots
- View, explore, and follow metrics
- Access Slack entry points to Tableau Next assets
Tableau Unmetered Consumer or Tableau Next Consumer
Included license: Tableau Next Consumer (Unmetered) or Tableau Next Consumer (Legacy)
Users with these permission sets can view assets in on the Tableau Next home page.
- Access the Tableau Next home page
- Use Tableau Agent
- View assets (workspaces, dashboards, visualizations)
- Share snapshots
- View, explore, and follow metrics
- Access Slack entry points to Tableau Next assets
Tableau Next Limited Consumer
Included license: Tableau Next Limited Consumer
Users with this permission set can’t access Tableau Next Home or Studio. They can only view embedded assets in Tableau Next Apps for Salesforce.
- View assets in Tableau Next Apps for Salesforce (also known as Included Apps)
- Share snapshots
- Access Slack entry points to Tableau Next assets
- Access unmetered Analytical Insights
Tableau Included App Manager
Included license: Tableau Next Included App
Users with this permission set can’t access Tableau Next Home or Studio. They can only manage pre-packaged (templated) Tableau Next Apps for Salesforce (Included Apps).
- Create, update, and manage app templates, and apps from templates, analytics, data, and other assets
- Access unmetered Analytical Insights
Data Visibility - Policies
Policies allow and deny access to Data 360 objects (like DLOs, DMOs, and CIs) and records and also mask fields within data spaces. They can be widely applied with minimal data preparation and are implemented differently than security in Tableau or CRM Analytics.
In Tableau, data security is generally managed with record-level security inherited from the data source, either through a manually-defined entitlement table or by pass-through authentication.
In CRM Analytics, data security is defined independently on each dataset, either through sharing inheritance or a security predicate driven by augments, calculated fields, and hierarchy flattening in data prep.
A Data 360 administrator can define policies in Data Governance in Data 360.
Data 360 Policies in Tableau Next
Data 360 controls data access centrally, through policies defined in Data Governance. In contrast, CRM Analytics defines data access at the dataset level and record-level security in Tableau is driven by the data source.
Object-level and record-level policies
Record-level security (RLS) is more restrictive than object-level security (OLS). If any RLS is defined on an object, all access to that object will require explicitly defined RLS policies.
Policy evaluation
Rather than the binary “true or false” predicate evaluation in CRM Analytics or an entitlement table in Tableau, Data 360 policies are evaluated in layers.
- Deny
- Policies that deny access to data are applied first. Restrict data access to records and fields with classifications, tags, and user attributes. Masking and allow policies can’t override a deny policy.
Users with View All Records or Modify All Records permission
A user with one of these powerful permissions can see object and field metadata, even if a deny policy restricts their access to the data in that object or field. This allows them to interact with the objects and fields in semantic models, visualizations, metrics, and other places without seeing the contents.
- Mask
- Policies that mask fields are applied next. A masking policy obfuscates the value in a specific field. Masking policies can’t override a deny policy.
- Allow
- Policies that allow access are applied last. Grant data access to objects and records with classifications, tags, and user attributes, including hierarchies. Allow policies can’t override a deny or masking policy.
Metadata policy criteria
Data 360 uses metadata in the form of Data Tags and Classifications as criteria for policies. This allows for flexible, scalable security such as “Deny access to all fields tagged as PII.” Data governance also supports logic using explicit field value comparisons, similar to CRM Analytics and Tableau security.
Data structure considerations
Data 360 can evaluate policies against separate tables and data sources with joins built into policy criteria. CRM Analytics requires that data used for security predicate evaluation is present in the dataset. When designing your governance plan for Tableau Next, think of policy criteria (including metadata and user attributes, hierarchies, and entitlements) as the record-level filters applied to the data, rather than being part of the data that is being filtered. No need to determine grain, flatten multi-layer relationship tables, and build complex join and augment structures in data prep.
Data Source Record-Level Security
Configure record-level security differently depending on the data source.
Data 360 DMO or DLO
Define policies in Data 360 to control record-level access.
Zero Copy DLO
Data source connections return records based on the access of the authentication user defined in the connection. The DLO doesn’t apply security based on the logged-in user by default. To control record-level access, define policies based on user attributes in Data 360.
If you’ve already configured an entitlement table for your external data source, don’t despair! You can define record-level security with an entitlement table.
Tableau Published Data Source (PDS)
A PDS is a direct connection, it isn’t represented as a DLO in Data 360. Data access isn’t configured through data governance. For users configured in Tableau Cloud, record-level security is inherited from the PDS.
Allow Policy Patterns in Tableau Next
Policy criteria can be layered and mixed to achieve your desired data visibility results. Here are some common policy structures.
Define an allow policy with the following selections in Data Governance.
- Resource: Record
- Action: Allow access
- Apply To Object: Select object...
Choose when the policy’s action (in this case, allowing access) should occur.
Criteria within a policy can be linked together in logical groups to build complex access patterns. Add a group to Take Action On Records which meet any condition (OR) for a set of criteria that each grants access, or Records which meet all conditions (AND) for a set of criteria that all must be true to grant access.
Record ownership
Data 360 doesn’t have automatic record owner visibility. If a DLO or DMO has a field containing the record owner’s Salesforce User Id, this condition tests if the user is the record’s owner.
Field Name Object_Name > Owner Id Is Equal To User > User Id
This is equivalent to 'ObjectOwnerId' == "$User.Id" in a CRM Analytics security predicate.
This is similar to using the USERNAME() fuction to filter extracted rows in Tableau.
Record ownership must be included at the root DMO or DLO level. Filtering on user data joined to an object in the semantic layer shouldn’t be used in place of a security feature.
Working with Salesforce hierarchies
Before role, manager, or territory hierarchies in Salesforce can be used in policies, they need to be connected to a Data 360 data source. Set up a Salesforce CRM Connector to the org where the target hierarchy resides then add a new hierarchy with the steps in Ingest Hierarchical Data.
Role hierarchy
After ingesting the Salesforce role hierarchy, this condition tests if the user is hierarchically above the record’s owner.
Field Name Object_Name > Owner Is Hierarchally Above In Role_Hierarchy > User
This is equivalent to 'ObjectOwner.Roles.Roles' == "$User.UserRoleId" in a CRM Analytics security predicate.
RLS with Entitlement Tables
To control record-level security for zero-copy DLOs, connect an entitlement table that describes user-level record access and define an allow policy with it. Upload a CSV file and create a filtered join in the policy.
Entitlement table structure
An entitlement table in Data Governance needs one row for each record-user association, using the 15-character record and user IDs. For example
| accountId | userId |
|---|---|
| 001aa000000AAA1 | 005aa000000Usr1 |
| 001aa000000AAA1 | 005aa000000Usr2 |
| 001aa000000AAA1 | 005aa000000Usr3 |
| 001aa000000BBB2 | 005aa000000Usr1 |
| 001aa000000BBB2 | 005aa000000Usr3 |
| 001aa000000CCC3 | 005aa000000Usr2 |
- Users 1 and 3 can see data associated with Accounts 1 and 2.
- User 2 can see data associated with Account 1 and 3.
Upload a CSV to a data stream
Follow the steps in Ingest Data by Uploading a File to create your entitlement table in Data 360.
Use a join in a policy
Add a join block to the policy criteria and choose the DLO holding the entitlement table. Specify the Entitlement Table > Object Id as the first field and the Object > Object Id as the second field.
Add a filter to return records only if the user is associated with the record in the entitlement table.
Entitlement Table > User Id Is Equal To User > User Id
Asset Access - Sharing
Sharing an asset within Tableau Next grants another user visibility and capabilities related to that asset. Sharing doesn’t override policy-based restrictions.
An asset owner can Manage Access to Assets in Tableau Next. Users with the Tableau Unmetered Admin or Tableau Next Admin permission set can manage sharing for all Tableau Next assets.
| Action | Viewer | Editor | Owner |
|---|---|---|---|
| View and interact |
 |
|
|
| See who has access |
|
|
|
| Modify and save |
|
|
|
| Share |
|
||
| Delete |
|