---
schema_version: "1"
id: ebf733d88a1360c15dd4870bf8f8005e8cc4ad66532ffddff6c2ad7115f0f54f
title: SAML
collection: tableau
version: current
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/current/en-gb/online/saml.md
canonical_url: https://help.tableau.com/current/online/en-gb/saml.htm
source_site: help.tableau.com
content_type: documentation
content_hash: e3c66a41fd855b2a7bc9d3de8dba66d7391dd12f1dcda28ea1d124b35b4d716f
description: Configure Tableau Cloud to use an external identity provider over SAML 2.0.
---
[Skip to main content](#main-content)

# SAML

SAML (Security Assertion Markup Language) is an XML standard that allows secure web domains to exchange user authentication and authorisation data. You can configure Tableau Cloud or Tableau Cloud Manager (TCM) to use an external identity provider (IdP) to authenticate users over SAML 2.0. No user credentials are stored with Tableau, and using SAML enables you to add Tableau to your organisation’s single sign-on environment.

User authentication through SAML does not apply to permissions and authorisation for Tableau Cloud content, such as data sources and workbooks. It also does not control access to underlying data that workbooks and data sources connect to.

**Note:** Tableau Cloud supports both service provider initiated and IdP initiated SAML in browsers and in the Tableau Mobile app. SAML connections from Tableau Desktop must be service provider initiated.

## Authentication overview

The following image shows the steps to authenticate a user with single sign-on in a typical service provider initiated flow:

![](/tableau/current/en-gb/online/en-gb/Img/saml_about_cloud.png)

1. User navigates to the Tableau Cloud or TCM sign-in page, or clicks a published workbook URL.
2. Tableau starts the authentication process by redirecting the client to the configured IdP.
3. The IdP requests the user’s username and password from the user. After the user submits valid credentials, the IdP authenticates the user.
4. The IdP returns the successful authentication in the form of a SAML Response to the client. The client passes the SAML Response to Tableau Cloud or TCM.
5. Tableau Cloud or TCM verifies that the username in the SAML Response matches a licensed user stored in the Tableau Cloud repository. If a match is verified, then Tableau Cloud or TCM responds to the client with the requested content or information.

## Other articles in this section