# tableau Guides - Full Documentation [Skip to main content](#main-content) # Add Remaining Users to Tableau Cloud You are in the [Tableau Cloud Manual Migration Guide.](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) This guide describes how to manually migrate Tableau Server deployments with fewer than 100 users to Tableau Cloud. Now that you've migrated over all the content and set up your projects, groups, and permissions, you can add the rest (or all) of your users. This topic describes how to add users within a site. To add or remove users and modify their site roles across multiple sites, cloud administrators can use Tableau Cloud Manager. For more information, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_users.htm). ## Add users As soon as you add users, they will be able to access content. Make sure to follow the procedures in [Configure Permission and Content Access for Migrated Users](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part5.htm) before adding users. We also recommend learning about user site roles before migrating to Tableau Cloud. See [Set Users' Site Roles](https://help.tableau.com/current/online/en-us/users_site_roles.htm). You can add users manually as shown below. If you have a lot of users and want to batch-import them with a CSV file, see [Import Users](https://help.tableau.com/current/online/en-us/users_import.htm). ### Add users manually 1. When you’re signed in to the Tableau Server site, select **Users**. 2. On the Users page, click Add Users, and then click Add Users by Username. ![](/tableau/current/en-us/guides/migration/en-us/Img/users_add_online.png) 3. Select the authentication method that you want imported users to sign in to Tableau Cloud with. If no authentication is configured on the site, imported users will be assigned Tableau with MFA authentication method. **Note:** You can go to the Users page to change users’ authentication type any time after you add them 4. In the **Enter usernames** text box, enter the users’ usernames (in email address format). If you add more than one user, separate each username with a semicolon. For example, _tdavis@example.com; jjohnson@example.com; hwilson@example.com_ 5. Select a site role from the drop-down list, to assign that site role to all users you’re adding. For site role definitions, see [Set Users’ Site Roles](https://help.tableau.com/current/online/en-us/users_site_roles.htm). 6. Click Add Users. If a new user’s username is already associated with an account on tableau.com, the user is prompted to sign in using the existing email address and password for that account. If a new user’s username is not already associated with an account on tableau.com, the user is prompted to provide a first and last name and a password. Until the user provides these values, their entry in the Tableau Server user list shows the email address preceded by a period. For example: `.snguyen@example.com` After the user signs in, the entry is updated to show the full name. For example: `Susan Nguyen` ## Migration workflow This guide is organized according to a step-wise process for migrating to Tableau Cloud: 1. [Plan Your Migration](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part1.htm) 2. [Create and Configure a Tableau Cloud Site](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2.htm) 3. [Migrate Virtual Connections](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2-5.htm) 4. [Migrate Data Sources, Workbooks, and Prep Flows to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part3.htm) 5. [Recreate Refresh Schedules for Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part4.htm) 6. [Configure Permission and Content Access for Migrated Users](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part5.htm) 7. **You are here**: Add Users to Tableau Cloud 8. [End-User Migration Checklist](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part7.htm) [Skip to main content](#main-content) # Appendix - Web Tier with Apache Example Deployment **Note**: Tableau no longer updates the Enterprise Deployment Guide. Although we still recommend the reference architecture described here as a valid deployment model for Tableau Server in AWS, specific configuration procedures may have changed since the last update. Always cross-reference these steps with the latest [Tableau Server Help](https://help.tableau.com/current/server/en-us/get_started_server.htm) documentation to ensure accuracy. This topic provides an end-to-end procedure that describes how to implement web tier in the example AWS reference architecture. The example configuration is composed of the following components: - AWS application load balancer - Apache proxy servers - Mellon authentication module - Okta IdP - SAML authentication **Note**: The example web tier configuration presented in this section includes detailed procedures for deploying third party software and services. We've made a best effort to verify and document the procedures to enable the web tier scenario. However, the third-party software may change or your scenario may differ from the reference architecture described here. Please refer to third-party documentation for authoritative configuration details and support. The Linux examples throughout this section show commands for RHEL-like distributions. Specifically the commands here have been developed with the Amazon Linux 2 distribution. If you are running the Ubuntu distribution, edit the commands accordingly. Deploying the web tier in this example follows a stepwise configuration and verification procedure. The core web tier configuration consists of the following steps to enable HTTP between Tableau and the internet. Apache is run and configured for reverse proxy/load balancing behind the AWS application load balancer: 1. Install Apache 2. Configure reverse proxy to test connectivity to Tableau Server 3. Configure load balancing on proxy 4. Configure AWS application load balancer After the web tier is set up and connectivity with Tableau is verified, configure authentication with an external provider. ## Install Apache Run the following procedure on both EC2 hosts (Proxy 1 and Proxy 2). If you are deploying in AWS according to the reference architecture example then you should have two availability zones and be running a single proxy server in each zone. 1. Install Apache: sudo yum update -y sudo yum install -y httpd 2. Configure to start Apache on reboot: sudo systemctl enable --now httpd 3. Verify that the version of httpd you have installed includes `proxy_hcheck_module`: sudo httpd -M The `proxy_hcheck_module` is required. If your version of httpd does not include this module, then update to a version of httpd that does include it. ## Configure proxy to test connectivity to Tableau Server Run this procedure on one of the proxy hosts (Proxy 1). The purpose of this step is to verify connectivity between the internet to your proxy server to the Tableau Server in the private security group. 1. Create a file called `tableau.conf` and add it to the `/etc/httpd/conf.d` directory. Copy the following code and specify the `ProxyPass` and `ProxyPassReverse` keys with the private IP address of Tableau Server Node 1. **Important**: The configuration shown below is not a secure and should not be used in production. This configuration should only be used during the installation process to verify end-to-end connectivity. For example, if the private IP address of Node 1 is `10.0.30.32`, then the contents of the `tableau.conf` file would be: ProxyPreserveHost On ProxyPass "/" "http://10.0.30.32:80/" ProxyPassReverse "/" "http://10.0.30.32:80/" 2. Restart httpd: sudo systemctl restart httpd ### Verification: Base topology configuration You should be able to access the Tableau Server admin page by browsing to `http://`. If the Tableau Server sign-in page does not load in your browser then follow these troubleshooting steps on the Proxy 1 host: - Stop and then start httpd as a first troubleshooting step. - Double-check the `tableau.conf` file. Verify that the Node 1 private IP is correct. Verify double-quotes and carefully review syntax. - Run the `curl` command on the reverse proxy server with Node 1 private IP address, for example, `curl 10.0.1.90`. If the shell does not return html, or if it returns html for the Apache test web page, then verify protocol/port configuration between the Public and Private security groups. - Run the `curl` command with Proxy 1 private IP address, for example, `curl 10.0.0.163`. If the shell returns the html code for the Apache test web page, then the proxy file is not configured correctly. - Always restart httpd (`sudo systemctl restart httpd`) after any configuration change to the proxy file or to the security groups. - Make sure TSM is running on Node 1. ## Configure load balancing on proxy 1. On the same proxy host (Proxy 1) where you created the `tableau.conf` file, remove the existing Virtual Host configuration and edit the file to include load-balancing logic. For example: ServerAdmin admin@example.com #Load balancing logic. ProxyHCExpr ok234 {%{REQUEST\_STATUS} =~ /^\[234\]/} Header add Set-Cookie "ROUTEID=.%{BALANCER\_WORKER\_ROUTE}e; path=/" env=BALANCER\_ROUTE\_CHANGED #Replace IP addresses below with the IP addresses to the Tableau Servers running the Gateway service. BalancerMember http://10.0.3.40/ route=1 hcmethod=GET hcexpr=ok234 hcuri=/favicon.ico BalancerMember http://10.0.4.151/ route=2 hcmethod=GET hcexpr=ok234 hcuri=/favicon.ico ProxySet stickysession=ROUTEID ProxyPreserveHost On ProxyPass / balancer://tableau/ ProxyPassReverse / balancer://tableau/ 2. Stop and then start httpd: sudo systemctl stop httpd sudo systemctl start httpd 3. Verify the configuration by browsing to the public IP address of Proxy 1. ## Copy configuration to second proxy server 1. Copy the `tableau.conf` file from Proxy 1 and save it to the `/etc/httpd/conf.d` directory on Proxy 2 host. 2. Stop and then start httpd: sudo systemctl stop httpd sudo systemctl start httpd 3. Verify the configuration by browsing to the public IP address of Proxy 2. ## Configure AWS application load balancer Configure the load balancer as an HTTP listener. The procedure here describes how to add a load balancer in AWS. #### Step 1: Create target group A target group is an AWS configuration that defines the EC2 instances running your proxy servers. These are the targets for traffic from the LBS. 1. EC2>Target groups > Create target group 2. On Create page: - Enter a target group name, for example `TG-internal-HTTP` - Target type: Instances - Protocol: HTTP - Port: 80 - VPC: Select your VPC - Under Health checks > Advanced health checks settings > Success codes, append the code list to read: `200,303`. - Click Create 3. Select the target group that you just created, and then click the Targets tab:  - Click Edit. - Select the EC2 instances (or single instance if you are configuring one at a time) that are running proxy application, and then click Add to registered. - Click Save. #### Step 2: Launch load balancer wizard 1. EC2> Load Balancers > Create Load Balancer 2. On "Select load balancer type" page, create an Application Load Balancer. **Note**: The UI that is displayed to configure load balancer is not consistent across AWS datacenters. The procedure below, "Wizard configuration," maps to the AWS configuration wizard that begins with **Step 1 Configure Load Balancer**.  If your datacenter displays all configurations in a single page that includes a **Create load balancer** button at the bottom of the page, then follow the "Single page configuration" procedure below. 1. Configure load balancer page: - Specify name - Scheme: internet-facing (default) - IP address type: ipv4 (default) - Listeners (Listeners and routing): 1. Leave the default HTTP listener 2. Click Add listener and add `HTTPS:443` - VPC: select the VPC where you've installed everything - Availability Zones: - Select the **a** and **b** for your datacenter regions - In each corresponding drop-down selector, select the Public subnet (where your proxy servers reside). - Click: Configure Security Settings 2. Configure Security Settings page - Upload your public SSL certificate. - Click Next: Configure Security Groups. 3. Configure Security Groups page: - Select the Public security group. If the Default security group is selected, then clear that selection. - Click Next: Configure Routing. 4. Configure Routing page - Target group: Existing target group. - Name: Select target group that you created earlier - Click Next: Register Targets. 5. Register Targets page - The two proxy server instances that you configured previously should be displayed. - Click Next: Review. 6. Review page Click Create. Basic configuration - Specify name - Scheme: internet-facing (default) - IP address type: ipv4 (default) Network mapping - VPC: select the VPC where you've installed everything - Mappings: - Select the **a** and **b** (or comparable) Availability Zones for your datacenter regions - In each corresponding drop-down selector, select the Public subnet (where your proxy servers reside). Security groups - Select the Public security group. If the Default security group is selected, then clear that selection. Listeners and routing - Leave the default HTTP listener. For Default action, specify the Target Group that you previously set up. - Click Add listener and add `HTTPS:443`. For Default action, specify the Target Group that you previously set up. Secure listener settings - Upload your public SSL certificate. Click Create load balancer. #### Step 3: Enable stickiness 1. After the load balancer is created, you must enable stickiness on the Target Group. - Open AWS Target Group page (EC2\> Load Balancing\> Target groups), select the target group instance that you just set up. On the Action menu, select Edit attributes. - On the Edit attributes page, select Stickiness, specify a duration of `1 day`, and then Save changes. 2. On load balancer, enable stickiness on the HTTP listener. Select the load balancer you just configured, and then click the Listeners tab: - For HTTP:80, click View/edit rules. On the resulting Rules page, click the edit icon (once at the top of the page, and then again by the rule) to edit the rule. Delete the existing THEN rule and replace it by clicking Add action > Forward to.... In the resulting THEN configuration, specify the same target group you have created. Under Group-level stickiness, enable stickiness and set duration to 1 day. Save the setting and then click Update. #### Step 4: Set idle timeout on load balancer On load balancer, update idle timeout to 400 seconds. Select the load balancer you have configured for this deployment, and then click Actions > Edit attributes. Set Idle timeout to `400` seconds, and then click Save. #### Step 5: Verify LBS connectivity Open AWS Load Balancer page (EC2\> Load Balancers), select the load balancer instance that you just set up. Under Description, copy the DNS name and paste it into a browser to access the Tableau Server sign in page. If you get a 500-level error, then you may need to restart your proxy servers. ## Update DNS with public Tableau URL Use your domain DNS zone name from the AWS Load Balancer description to create a CNAME value in your DNS. Traffic to your URL (tableau.example.com) should be sent to the AWS public DNS name. ## Verify connectivity After your DNS updates are finished, you should be able to navigate to the Tableau Server sign-in page by entering your public URL, for example, `https://tableau.example.com`. ## Example authentication configuration: SAML with external IdP The following example describes how to setup and configure SAML with Okta IdP and Mellon authentication module for a Tableau deployment running in the AWS reference architecture. The example describes how to configure Tableau Server and the Apache proxy servers to use HTTP. Okta will send request to the AWS load balancer over HTTPS, but all internal traffic will travel over HTTP. As you configure for this scenario, be aware of the HTTP vs HTTPS protocols when setting URL strings. This example uses Mellon as a pre-authentication service provider module on the reverse proxy servers. This configuration ensures that only authenticated traffic connects to Tableau Server, which also acts as a service provider with the Okta IdP. Therefore, you must configure two IdP applications: one for the Mellon service provider and one for the Tableau service provider. ### Create Tableau administrator account A common mistake when configuring SAML is to forget to create an administrator account on Tableau Server before enabling SSO. The first step is to create an account on Tableau Server with a Server Administrator role. For the example Okta scenario, the username must be in a valid email address format, for example, user@example.com. You must set a password for this user, but the password will not be used after SAML is configured. ### Configure Okta pre-auth application The end-to-end scenario described in this section requires two Okta applications: - Okta pre-auth application - Okta Tableau Server application Each of these applications are associated with different metadata that you will need to configure on the reverse proxy and Tableau Server, respectively. This procedure describes how to create and configure the Okta pre-auth application. Later in this topic you will create the Okta Tableau Server application. For a free test Okta account with limited users, see the [Okta Developer web page](https://developer.okta.com/signup/). Create a SAML app integration for the Mellon pre-authentication service provider. 1. Open the Okta administration dashboard > Applications \> Create App Integration. 2. On Create a new app integration page, select SAML 2.0 and then click Next. 3. On the General Settings tab, enter an App name, for example `Tableau Pre-Auth`, and then click Next. 4. On the Configure SAML tab: - Single sign on (SSO) URL. The final element of the path in the single sign on URL is referred to as the `MellonEndpointPath` in the `mellon.conf` configuration file that follows later in this procedure. You can specify whatever endpoint you would like. In this example, `sso` is the endpoint. The last element, `postResponse`, is required: `https://tableau.example.com/sso/postResponse`. - Clear the checkbox: Use this for Recipient URL and Destination URL. - Recipient URL: Same as SSO URL, but with HTTP. For example, `http://tableau.example.com/sso/postResponse`. - Destination URL: same as SSO URL, but with HTTP. For example, `http://tableau.example.com/sso/postResponse`. - Audience URI (SP Entity ID). For example, `https://tableau.example.com`. - Name ID format: `EmailAddress` - Application username: `Email` - Attributes Statements: Name = `mail`; Name format = `Unspecified`; Value = `user.email`. Click Next. 5. On the Feedback tab, select: - I'm an Okta customer adding an internal app - This is an internal app that we have created - Click Finish. 6. Create the pre-auth IdP metadata file: - In Okta: Applications \> Applications \> Your new application (e.g., `Tableau Pre-Auth`) > Sign On - Adjacent to SAML Signing Certificates, click View SAML setup instructions. - On the How to Configure SAML 2.0 for Application, page, scroll down to Optional section, Provide the following IDP metadata to your SP provider. - Copy the contents of the XML field and save them in a file called `pre-auth_idp_metadata.xml`. 7. (Optional) Configure multifactor authentication: - In Okta: Applications \> Applications \> Your new application (e.g., `Tableau Pre-Auth`) > Sign On - Under Sign On Policy, click Add Rule. - On the App Sign On Rule, specify a name and the different MFA options. To test functionality, you can leave all options as default. However, under Actions, you must select, Prompt for factor, and then specify how often users must sign in. Click Save. ### Create and assign Okta user 1. In Okta, create a user with the same username that you created in Tableau (user@example.com): Directory \> People \> Add person. 2. After the user is created, assign the new Okta app to that person: Click the user name then assign the application in Assign Application. ## Install Mellon for pre-auth 1. On the EC2 instances that are running the Apache proxy server, run the following commands to install PHP and Mellon modules: sudo yum install httpd php mod\_auth\_mellon 2. Create the `/etc/httpd/mellon` directory ## Configure Mellon as pre-auth module Run this procedure on both proxy servers. You must have a copy of `pre-auth_idp_metadata.xml` file that you created from the Okta configuration. 1. Change directory: cd /etc/httpd/mellon 2. Create the service provider metadata. Run the `mellon_create_metadata.sh` script. You must include the entity ID and the return URL for your organization in the command. The return URL is referred to as the _single sign on URL_ in Okta. The final element of the path in the return URL is referred to as the `MellonEndpointPath` in the `mellon.conf` configuration file that follows later in this procedure. In this example, we specify `sso` as the endpoint path. For example: sudo /usr/libexec/mod\_auth\_mellon/mellon\_create\_metadata.sh https://tableau.example.com "https://tableau.example.com/sso" The script returns the service provider certificate, key, and metadata files. 3. Rename the service provider files in the `mellon` directory for easier readability. We will refer to these files by the following names in the documentation: sudo mv \*.key mellon.key sudo mv \*.cert mellon.cert sudo mv \*.xml sp\_metadata.xml 4. Copy the `pre-auth_idp_metadata.xml` file to the same directory. 5. Create the `mellon.conf` file in the `/etc/httpd/conf.d` directory: sudo nano /etc/httpd/conf.d/mellon.conf 6. Copy the following contents into `mellon.conf`. MellonSPPrivateKeyFile /etc/httpd/mellon/mellon.key MellonSPCertFile /etc/httpd/mellon/mellon.cert MellonSPMetadataFile /etc/httpd/mellon/sp\_metadata.xml MellonIdPMetadataFile /etc/httpd/mellon/pre-auth\_idp\_metadata.xml MellonEndpointPath /sso MellonEnable "info" 7. Add the following contents into the existing `tableau.conf` file: Inside the `` block, add the following content. Update `ServerName` with the public host name in your Entity ID: DocumentRoot /var/www/html ServerName tableau.example.com ServerSignature Off ErrorLog logs/error\_sp.log CustomLog logs/access\_sp.log combined LogLevel info Add the Location block outside of the `` block. Update `MellonCookieDomain` with the top-level domain to preserve cookie information as shown: AuthType Mellon MellonEnable auth Require valid-user MellonCookieDomain example.com The complete `tableau.conf` file should look like the following example: ServerAdmin admin@example.com ProxyHCExpr ok234 {%{REQUEST\_STATUS} =~ /^\[234\]/} Header add Set-Cookie "ROUTEID=.%{BALANCER\_WORKER\_ROUTE}e; path=/" env=BALANCER\_ROUTE\_CHANGED BalancerMember http://10.0.3.36/ route=1 hcmethod=GET hcexpr=ok234 hcuri=/favicon.ico BalancerMember http://10.0.4.15/ route=2 hcmethod=GET hcexpr=ok234 hcuri=/favicon.ico ProxySet stickysession=ROUTEID ProxyPreserveHost On ProxyPass / balancer://tableau/ ProxyPassReverse / balancer://tableau/ DocumentRoot /var/www/html ServerName tableau.example.com ServerSignature Off ErrorLog logs/error\_sp.log CustomLog logs/access\_sp.log combined LogLevel info AuthType Mellon MellonEnable auth Require valid-user MellonCookieDomain example.com 8. Verify the configuration. Run the following command: sudo apachectl configtest If the configuration test returns an error, fix any errors and run configtest again. A successful configuration will return, `Syntax OK`. 9. Restart httpd: sudo systemctl restart httpd ## Create Tableau Server application in Okta 1. In Okta dashboard: Applications \> Applications \> Browse App Catalog 2. In Browse App Integration Catalog, search `Tableau`, select the Tableau Server tile, and then click Add. 3. On Add Tableau Server > General Settings, enter a Label, and then click Next. 4. In Sign-On Options, select SAML 2.0, and then scroll down to Advanced Sign-on Settings: - SAML Entity ID: enter the public URL, for example, https://tableau.example.com. - Application user name format: Email 5. Click the Identity Provider metadata link, to launch a browser. Copy the browser link. This is the link you will use when you configure Tableau in the procedure that follows. 6. Click Done. 7. Assign the new Tableau Server Okta app to your user (user@example.com): Click the user name then assign the application in Assign Application. ### Enable SAML on Tableau Server for IdP Run this procedure on Tableau Server Node 1. 1. Download the Tableau Server application metadata from Okta. Use the link that you saved from the previous procedure: wget https://dev-66144217.okta.com/app/exk1egxgt1fhjkSeS5d7/sso/saml/metadata -O idp\_metadata.xml 2. Copy a TLS certificate and related key file to the Tableau Server. The key file must be an RSA key. For more information about SAML certificate and IdP requirements, see _SAML Requirements_ ([Linux](https://help.tableau.com/current/server-linux/en-us/saml_requ.htm)). To simplify certificate management and deployment, and as a security best practice, we recommend using certificates generated by a major trusted-third party certificate authority (CA). Alternatively, you may generate self-signed certificates or use certificates from a PKI for TLS. If you do not have a TLS certificate, you can generate a self-signed certificate using the embedded procedure below. Generate a self-signed certificate Run this procedure onTableau Server Node 1. 1. Generate signing root certificate authority (CA) key: openssl genrsa -out rootCAKey-saml.pem 2048 2. Create the root CA certificate: openssl req -x509 -sha256 -new -nodes -key rootCAKey-saml.pem -days 3650 -out rootCACert-saml.pem You will be prompted to enter values for the certificate fields. For example: Country Name (2 letter code) \[XX\]:US State or Province Name (full name) \[\]:Washington Locality Name (eg, city) \[Default City\]:Seattle Organization Name (eg, company) \[Default Company Ltd\]:Tableau Organizational Unit Name (eg, section) \[\]:Operations Common Name (eg, your name or your server's hostname) \[\]:tableau.example.com Email Address \[\]:example@tableau.com 3. Create the certificate and related key (`server-saml.csr`and `server-saml.key` in the example below). The subject name for the certificate must match the public host name of the Tableau host. The subject name is set with the `-subj` option with the format `"/CN="`, for example: openssl req -new -nodes -text -out server-saml.csr -keyout server-saml.key -subj "/CN=tableau.example.com" 4. Sign the new certificate with the CA certificate that you created above. The following command also outputs the certificate in the `crt` format: openssl x509 -req -in server-saml.csr -days 3650 -CA rootCACert-saml.pem -CAkey rootCAKey-saml.pem -CAcreateserial -out server-saml.crt 5. Convert the key file to RSA. Tableau requires an RSA key file for SAML. To convert the key, run the following command: openssl rsa -in server-saml.key -out server-saml-rsa.key 3. Configure SAML. Run the following command, specifying your entity ID and return URL, and the paths to the metadata file, certificate file, and key file: tsm authentication saml configure --idp-entity-id "https://tableau.example.com" --idp-return-url "https://tableau.example.com" --idp-metadata idp\_metadata.xml --cert-file "server-saml.crt" --key-file "server-saml-rsa.key" tsm authentication saml enable 4. If your organization is running Tableau Desktop 2021.4 or later, then you must run the following command to enable authentication through the reverse proxy servers. Versions of Tableau Desktop 2021.2.1 - 2021.3 will work without running this command, provided that your pre-authentication module (e.g., Mellon) is configured to allow top-level domain cookie preservation. tsm configuration set -k features.ExternalBrowserOAuth -v false 5. Apply configuration changes: tsm pending-changes apply ## Validate SAML functionality To validate end-to-end SAML functionality, sign-in to Tableau Server with the public URL (e.g., https://tableau.example.com) with the Tableau admin account that you created at the beginning of this procedure. ## Validation troubleshooting **Bad Request**: A common error for this scenario is a "Bad Request" error from Okta. Often this issue occurs when the browser is caching data from previous Okta session. For example, if you manage the Okta applications as an Okta administrator and then attempt to access Tableau using a different Okta-enabled account, session data from the administrator data may cause the "Bad Request" error. If this error persists even after you clear the local browser cache, try validating the Tableau scenario by connecting with a different browser. Another cause of the "Bad Request" error is a typo in one of the many URLs that you enter during the Okta, Mellon, and SAML configuration processes. Check all of these carefully. Often the httpd `error.log` file on the Apache server will specify which URL is causing the error. **Not Found - The requested URL was not found on this server**: This error indicates one of many configuration errors. If the user is authenticated with Okta, and then receives this error, then it's likely that you have uploaded the Okta pre-auth application to Tableau Server when you configured SAML. Verify that you have the Okta Tableau Server application metadata configured on Tableau Server, and not the Okta pre-auth application metadata Other troubleshooting steps: - Review `tableau.conf` carefully for typos or configuration errors - Review the Okta pre-auth application settings. Be sure HTTP vs HTTPS protocols are set as specified in this topic. - Restart httpd on both proxy servers. - Verify that `sudo apachectl configtest` returns “Syntax OK” on both proxy servers. - Verify that the test user is assigned to both applications in Okta. - Verify that stickiess is set on the load balancer and associated target groups ## Configure SSL/TLS from load balancer to Tableau Server Some organizations require end-to-end encryption channel from the client to the back end service. The default reference architecture as described to this point specifies SSL from the client to the load balancer running in the web tier of your organization. To configure SSL from the load balancer to Tableau Server, you must: - Install a valid SSL certificate on both the Tableau and proxy servers. - Configure SSL from the load balancer to the reverse proxy servers. - Configure SSL from the proxy servers to Tableau Server. - You may also configure SSL from Tableau Server to the PostgreSQL instance. The remainder of this topic describes this implementation in the context of the example AWS example reference architecture. ## Example: Configure SSL/TLS in AWS reference architecture This section describes how to configure SSL on Tableau and configure SSL on an Apache proxy server, all running in the example AWS reference architecture. The Linux procedures throughout this example show commands for RHEL-like distributions. Specifically the commands here have been developed with the Amazon Linux 2 distribution. If you are running the Ubuntu distribution, edit the commands accordingly. ### Step 1: Gather certificates and related keys To simplify certificate management and deployment, and as a security best practice, we recommend using certificates generated by a major trusted-third party certificate authority (CA). Alternatively, you may generate self-signed certificates or use certificates from a PKI for TLS. The following procedure how to generate self-signed certificates. If you are using 3rd party certificates as we recommend, then you can skip this procedure. Run this procedure on one of the proxy hosts. After you generate the certificate and associated key, you will share it to the other proxy host and to Tableau Server Node 1. 1. Generate signing root certificate authority (CA) key: `openssl genrsa -out rootCAKey.pem 2048` 2. Create the root CA certificate: `openssl req -x509 -sha256 -new -nodes -key rootCAKey.pem -days 3650 -out rootCACert.pem` You will be prompted to enter values for the certificate fields. For example: Country Name (2 letter code) \[XX\]:US State or Province Name (full name) \[\]:Washington Locality Name (eg, city) \[Default City\]:Seattle Organization Name (eg, company) \[Default Company Ltd\]:Tableau Organizational Unit Name (eg, section) \[\]:Operations Common Name (eg, your name or your server's hostname) \[\]:tableau.example.com Email Address \[\]:example@tableau.com 3. Create the certificate and related key (`serverssl.csr`and `serverssl.key` in the example below). The subject name for the certificate must match the public host name of the Tableau host. The subject name is set with the `-subj` option with the format `"/CN="`, for example: `openssl req -new -nodes -text -out serverssl.csr -keyout serverssl.key -subj "/CN=tableau.example.com"` 4. Sign the new certificate with the CA certificate that you created in step 2. The following command also outputs the certificate in the `crt` format: `openssl x509 -req -in serverssl.csr -days 3650 -CA rootCACert.pem -CAkey rootCAKey.pem -CAcreateserial -out serverssl.crt` ### Step 2: Configure proxy server for SSL Run this procedure on both proxy servers. 1. Install the Apache ssl module: `sudo yum install mod_ssl` 2. Create the `/etc/ssl/private` directory: `sudo mkdir -p /etc/ssl/private` 3. Copy the crt and key files to the following `/etc/ssl/` paths: `sudo cp serverssl.crt /etc/ssl/certs/` `sudo cp serverssl.key /etc/ssl/private/` 4. Update the existing `tableau.conf` with the following updates: - Add the SSL rewrite block: RewriteEngine on RewriteCond %{SERVER\_NAME} =tableau.example.com RewriteRule ^ https://%{SERVER\_NAME}%{REQUEST\_URI} \[END,NE,R=permanent\] - In the SSL rewrite block, update the `RewriteCond` server name: add your public host name, for example, `tableau.example.com` - Change `` to ``. - Wrap the `` and the `` blocks with `` ... ``. - `BalancerMember`: change the protocol from `http` to `https`. - Add `SSL*` elements inside the `` block: SSLEngine on SSLCertificateFile /etc/ssl/certs/serverssl.crt SSLCertificateKeyFile /etc/ssl/private/serverssl.key SSLProxyEngine on SSLProxyVerify none SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off - In the `LogLevel` element: add `ssl:warn`. - Optional: If you have installed and configured an authentication module, then you may have additional elements in the tableau.conf file. For example, the ` ` block will include elements. An example tableau.conf file configured for SSL is shown here: RewriteEngine on RewriteCond %{SERVER\_NAME} =tableau.example.com RewriteRule ^ https://%{SERVER\_NAME}%{REQUEST\_URI} \[END,NE,R=permanent\] ServerAdmin admin@example.com ProxyHCExpr ok234 {%{REQUEST\_STATUS} =~ /^\[234\]/} Header add Set-Cookie "ROUTEID=.%{BALANCER\_WORKER\_ROUTE}e; path=/" env=BALANCER\_ROUTE\_CHANGED BalancerMember https://10.0.3.36/ route=1 hcmethod=GET hcexpr=ok234 hcuri=/favicon.ico BalancerMember https://10.0.4.15/ route=2 hcmethod=GET hcexpr=ok234 hcuri=/favicon.ico ProxySet stickysession=ROUTEID ProxyPreserveHost On ProxyPass / balancer://tableau/ ProxyPassReverse / balancer://tableau/ DocumentRoot /var/www/html ServerName tableau.example.com ServerSignature Off ErrorLog logs/error\_sp.log CustomLog logs/access\_sp.log combined LogLevel info ssl:warn SSLEngine on SSLCertificateFile /etc/ssl/certs/serverssl.crt SSLCertificateKeyFile /etc/ssl/private/serverssl.key SSLProxyEngine on SSLProxyVerify none SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off #If you have configured a pre-auth module (e.g. Mellon) include those elements here. 5. Add index.html file to supress 403 errors: sudo touch /var/www/html/index.html 6. Restart httpd: sudo systemctl restart httpd ### Step 3: Configure Tableau Server for external SSL Copy the serverssl.crt and serverssl.key files from the Proxy 1 host to the initial Tableau Server (Node 1). Run the following commands on Node 1: tsm security external-ssl enable --cert-file serverssl.crt --key-file serverssl.key tsm pending-changes apply ### Step 4: Optional authentication configuration If you have configured an external identity provider for Tableau, then you will likely need to update return URLs in the IdP administrative dashboard. For example, if you are using a Okta pre-auth application, you will need to update the application to use HTTPS protocol for the Recipient URL and the Destination URL. ### Step 5: Configure AWS load balancer for HTTPS If you are deploying with AWS load balancer as documented in this guide, then you reconfigure the AWS load balancer to send HTTPS traffic to the proxy servers: 1. Deregister existing HTTP target group: In Target Groups, select the HTTP target group that has been configured for the load balancer, click Actions, and then click Register and deregister instance. On the Register and deregister targets page, select the instances that are currently configured, click Deregister, and then click Save. 2. Create HTTPS target group: Target groups \> Create target group - Select "Instances" - Enter a target group name, for example `TG-internal-HTTPS` - Select your VPC - Protocol: HTTPS 443 - Under Health checks > Advanced health checks settings > Success codes, append the code list to read: `200,303`. - Click Create. 3. Select the target group that you just created, and then click the Targets tab:  - Click Edit - Select the EC2 instances that are running proxy application, and then click Add to registered. - Click Save. 4. After the target group is created, you must enable stickiness: - Open AWS Target Group page (EC2\> Load Balancing\> Target groups), select the target group instance that you just set up. On the Action menu, select Edit attributes. - On the Edit attributes page, select Stickiness, specify a duration of `1 day`, and then Save changes. 5. On load balancer, update listener rules. Select the load balancer you have configured for this deployment, and then click the Listeners tab. - For HTTP:80, click View/edit rules. On the resulting Rules page, click the edit icon (once at the top of the page, and then again by the rule) to edit the rule. Delete the existing THEN rule and replace it by clicking Add action > Redirect to.... In the resulting THEN configuration, specify `HTTPS` and port `443` and leave the other options to default settings. Save the setting and then click Update. - For HTTP:443, click View/edit rules. On the resulting Rules page, click the edit icon (once at the top of the page, and then again by the rule) to edit the rule. In the THEN configuration, under Forward to... change theTarget group to the HTTPS group that you just created. Under Group-level stickiness, enable stickiness and set duration to 1 day. Save the setting and then click Update. #### Step 6: Verify SSL Verify the configuration by browsing to  https://tableau.example.com. [Skip to main content](#main-content) # Appendix - AWS Deployment Toolbox **Note**: Tableau no longer updates the Enterprise Deployment Guide. Although we still recommend the reference architecture described here as a valid deployment model for Tableau Server in AWS, specific configuration procedures may have changed since the last update. Always cross-reference these steps with the latest [Tableau Server Help](https://help.tableau.com/current/server/en-us/get_started_server.htm) documentation to ensure accuracy. This topic includes tools and alternate deployment options for the reference architecture when deployed in AWS. Specifically, this topic describes how to automate the example AWS deployment that is described throughout the EDG. ## TabDeploy4EDG automated installation script The [TabDeploy4EDG script](https://help.tableau.com/samples/en-us/edg/tabdeploy4edg.txt) automates the implementation of the four-node Tableau deployment that is described in [Part 4 - Installing and Configuring Tableau Server](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm). If you are following the example AWS implementation as described in this Guide, then you may be able to run TabDeploy4EDG. **Requirements.** To run the script, you must prepare and configure the AWS environment according to the example implementation in [Part 3 - Preparing for Tableau Server Enterprise Deployment](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part3.htm): - VPC, subnet, and security groups have been configured as described. IP addresses do not have to match those that are shown in the example implementation. - Four EC2 instances running the latest, updated builds of AWS Linux 2 - PostgreSQL is installed and has been configured as described in [Install, configure, and tar PostgreSQL](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm#Install,) . - A Step 1 tar backup file is on the EC2 instance where PostgreSQL is installed, as described in [Take PostgreSQL Step 1 tar backup](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm#Take). - The EC2 instance that will be running Node 1 of the Tableau Server deployment has been configured to communicate with PostgreSQL as described in [Part 4 - Installing and Configuring Tableau Server](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm#Configur). - You have logged into each EC2 instance with an SSH session from the bastion host. The script takes about 1.5-2 hours to install and configure the four Tableau servers. The script configures Tableau according to the prescribed settings of the reference architecture. The script performs the following actions: - Restores Stage 1 backup of PostgreSQL host if you specify a path to the PostgreSQL host's tar file. - Obliterates existing Tableau installations on all nodes. - Runs `sudo yum update` on all nodes. - Downloads and copies Tableau rpm package to each node. - Downloads and installs dependencies to each node. - Creates `/app/tableau_server` and installs package on all nodes. - Installs Node 1 with a local identity store and configures external repository with PostgreSQL. - Performs bootstrap installation and initial configuration of Node 2- Node 4. - Deletes the bootstrap file and the configuration file for TabDeploy4EDG. - Configures services across the Tableau cluster according to reference architecture specifications. - Validates installation and returns status for each node. **Download and copy the script to the bastion host** 1. Copy the script from the [TabDeploy4EDG samples page](https://help.tableau.com/samples/en-us/edg/tabdeploy4edg.txt) and paste the code into a file called, `TabDeploy4EDG`. 2. Save the file to the home directory on the EC2 host that is serving as the bastion host. 3. Run the following command to change the mode on the file to make it executable: sudo chmod +x TabDeploy4EDG **Run TabDeploy4EDG** TabDeploy4EDG must be run from the bastion host. The script has been written with the assumption that you are running under the context of ssh forward agent as described at [Example: Connect to bastion host in AWS](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part3.htm#Example:). If you are not running with ssh forward agent context, then you will be prompted for passwords throughout the installation process. 1. Create, edit, and save a registration file (`registration.json`). The file must be a properly-formatted json file. Copy and customize the following template: { "zip" : "97403", "country" : "USA", "city" : "Springfield", "last\_name" : "Simpson", "industry" : "Energy", "eula" : "yes", "title" : "Safety Inspection Engineer", "phone" : "5558675309", "company" : "Example", "state" : "OR", "department" : "Engineering", "first\_name" : "Homer", "email" : "homer@example.com" } 2. Run the following command to generate a template configuration file: ./TabDeploy4EDG -g edg.config 3. Open the configuration file to edit: sudo nano edg.config At a minimum, you must add the IP addresses of each EC2 host, a file path to the registration file, and a valid license key. 4. When you are done editing the configuration file, save it, and then close it. 5. To run TabDeploy4EDG, run the following command: ./TabDeploy4EDG -f edg.config ## Example: Automate AWS infrastructure deployment with Terraform This section describes how to configure and run Terraform to deploy the EDG reference architecture in AWS. The example Terraform configuration presented here deploys an AWS VPC with the subnets, security groups, and EC2 instances that are described in [Part 3 - Preparing for Tableau Server Enterprise Deployment](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part3.htm). Sample Terraform templates are available on the Tableau Samples website at [https://help.tableau.com/samples/en-us/edg/edg-terraform.zip](https://help.tableau.com/samples/en-us/edg/edg-terraform.zip). These templates must be configured and customized for your organization. The configuration content provided in this section describes the minimum required template changes you must customize to deploy. ### Goal The Terraform templates and content provided here are intended to provide a working sample that will allow you to deploy EDG quickly in a development test environment. We've made a best effort to test and document the example Terraform deployment. However, using Terraform to deploy and maintain EDG in a production environment will require Terraform expertise that is beyond the scope of this example. Tableau does not provide support for the example Terraform solution documented here. ### End state Follow the procedure in this section to set up a VPC in AWS that is functionally equivalent to the VPC that is specified in [Part 3 - Preparing for Tableau Server Enterprise Deployment](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part3.htm). ![A diagram of an AWS architecture for Tableau Server.](/tableau/current/en-us/guides/enterprise-deployment/en-us/Img/edg-vpc-terraform.png) The sample Terraform templates and supporting content in this section: - Creates a VPC with an elastic IP address, two availability zones, and subnets organization as shown above (IP addresses are different) - Creates the Bastion, Public, Private, and Data security groups. - Sets most ingress and egress rules on the security groups. You will need to edit security groups after Terraform runs. - Creates the following EC2 hosts (each running AWS Linux2): bastion, proxy 1 proxy 2, Tableau node 1, Tableau node 2, Tableau node 3, Tableau node 4. - EC2 hosts for PostgreSQL are not created. You must create the EC2 manually in the Data security group, and then install and configure PostgreSQL as described in [Install, configure, and tar PostgreSQL](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm#Install,) . ### Requirements - AWS account - you must have access to an AWS account that allows you to create VPCs. - If you are running Terraform from a Windows computer, you will need to install AWS CLI. - An available elastic IP address in your AWS account. - A domain that is registered in AWS Route 53. Terraform will create a DNS zone and related SSL certificates in Route 53. Therefore, the profile under which Terraform runs, must also have appropriate permissions in Route 53. ### Before you begin - The command line examples in this procedure are for Terminal with Apple OS. If you are running Terraform on Windows you may need to adapt commands with file paths as appropriate. - A Terraform project is made up of many text configuration files (.tf file extension). You configure Terraform by customizing these files. If you do not have a robust text editor, install Atom or Text++. - If you are sharing the Terraform project with others, we recommend storing the project in Git for change management. ### Step 1 - Prepare environment #### A. Download and install Terraform [https://www.terraform.io/downloads](https://www.terraform.io/downloads) #### B. Generate private-public key pair This is the key that you will use to access AWS and the resulting VPC environment. When you run Terraform, you’ll include the public key. Open Terminal and run the following commands: 1. Create a private key. For example, `my-key.pem`: openssl genrsa -out my-key.pem 1024 2. Create a public key. This key format is not used for Terraform. You will convert it to a ssh key later in this procedure: openssl rsa -in my-key.pem -pubout > my-key.pub 3. Set permissions on the private key: sudo chmod 0600 my-key.pem To set permissions on Windows: - Locate the file in Windows Explorer, right-click on it then select Properties. Navigate to the Security tab and then click Advanced. - Change the owner to you, disable inheritance and delete all permissions. Grant yourself Full control and then click Save. Mark the file as read-only. 4. Create ssh public key. This is the key you’ll copy into Terraform later in the process. ssh-keygen -y -f my-key.pem >my-key-ssh.pub #### C. Download project and add state directory 1. Download and unzip the [EDG Terraform project](https://help.tableau.com/samples/en-us/edg/edg-terraform.zip) and save them to your local computer. After you unzip the download you’ll have a top-level directory, edg-terraform, and a series of subdirectories. 2. Create a directory called `state`, as a peer to the top-level `edg-terraform` directory. ### Step 2: Customize the Terraform templates You must customized the Terraform templates to suit your AWS and EDG environment. The example here provides the minimum template customizations that most organization will need to make. It's likely that your particular environment will require other customizations. This section is organized by template name. Be sure to save all changes before proceeding to _Step 3 - Run Terraform_. #### versions.tf There are three instances of `versions.tf` files where the `required_version` field must match the version of terraform.exe you're using. Check the version of terraform (`terraform.exe -version`) and update each of the following instances: - `edg-terraform\versions.tf` - `edg-terraform\modules\proxy\versions.tf` - `edg-terraform\modules\tableau_instance\versions.tf` #### key-pair.tf 1. Open the public key that you generated in Step 1B and copy the key: less my-key-ssh.pub Windows: Copy the contents of your public key. 2. Copy the public key string into the public\_key argument, for example: resource "aws\_key\_pair" "tableau" { key\_name = "my-key" public\_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQ (truncated example) dZVHambOCw==" Ensure that the `key_name` value is unique in the datacenter or `terraform apply` will fail. #### locals.tf Update `user.owner` to your name or alias. The value you enter here will be used for the "Name" tag in AWS on the resources that Terraform creates. #### providers.tf 1. Add tags per your organization's requirements. For example: default\_tags { tags = { "Application" = "tableau", "Creator" = "alias@example.com", "DeptCode" = "8675309", "Description" = "EDG", "Environment" = "test", "Group" = "itcloud@example.com" } } 2. If using `provider`, comment out the `assume_role` lines: /\* assume\_role { role\_arn = "arn:aws:iam::310946706895:role/terraform-backend" session\_name = "terraform" }\*/ #### elb.tf Under `'resource "aws_lb" "tableau" {'` choose a unique value to use for `name` and `tags.Name`. If another AWS load balancer has the same name in the datacenter, then `terraform apply` will fail. Add `idle_timeout`: resource "aws\_lb" "tableau" { name = "edg-again-alb" load\_balancer\_type = "application" subnets = \[for subnet in aws\_subnet.public : subnet.id\] security\_groups = \[aws\_security\_group.public.id\] drop\_invalid\_header\_fields = true idle\_timeout = 400 tags = { Name = "edg-again-alb" } } #### variables.tf Update root domain name. This name must match the domain that you have registered in Route 53. variable "root\_domain\_name" { default = "example.com" } By default, the subdomain, `tableau`, is specified for the VPC DNS domain name. To change this, update `subdomain`: variable "subdomain" { default = "tableau" } #### modules/tableau\_instance/ec2.tf There are two ec2.tf files in the project. This customization is for the Tableau instance of the ec2.tf in the directory: `modules/tableau_instance/ec2.tf`. - If required, add tags blob: tags = { "Name" : var.ec2\_name, "user.owner" = "ALIAS", "Application" = "tableau", "Creator" = "ALIAS@example.com", "DeptCode" = "8675309", "Description" = "EDG", "Environment" = "test", "Group" = "itcloud@example.com" } } - As needed, optionally update your storage to handle your data requirements: Root volume: root\_block\_device { volume\_size = 100 volume\_type = "gp3" } Application volume: resource "aws\_ebs\_volume" "tableau" { availability\_zone = data.aws\_subnet.tableau.availability\_zone size = 500 type = "gp3" } ### Step 3 - Run Terraform #### A. Initialize Terraform In Terminal, change to the `edg-terraform` directory and run the following command: terraform init If initialization is successful continue to the next step. If initialize failed, follow the instructions in the Terraform output. #### B. Plan Terraform From the same directory, run the plan command: terraform plan This command can be run multiple times. Run as many times as needed to fix errors. When this command runs error free continue to the next step. #### C. Apply Terraform From the same directory run the apply command: terraform apply Terraform will prompt you to verify deployment, type `Yes`. #### Optional: Destroy Terraform You can destroy the entire VPC by running the destroy command: terraform destroy The destroy command will only destroy what it has created. If you have made manual changes to some objects in AWS (i.e., security groups, subnets, etc), then the `destroy` will fail. To exit out of a failing/hanging destroy operation, type `Control + C`. You must then clean up the VPC manually to the state where it was when Terraform originally created it. You can then run the `destroy` command. ### Step 4 - Connect to bastion All command line connection is through the bastion host on TCP 22 (SSH protocol). 1. In AWS create an inbound rule in the bastion security group (**AWS** \> **Security Groups** > **Bastion SG** > **Edit inbound rules**) and create a rule to allow SSH (TCP 22) connections from the IP address or subnet mask where you will be running Terminal commands. Optional: You may find it helpful to allow file copying between the EC2 instances in the Private and Public groups during deployment. Create inbound SSH rules: - Private: create inbound rule to allow SSH from Public - Public: create inbound rule to allow SSH from Private and from Public 2. Use the pem key that you created in Step 1.B to connect to the bastion host: **On Mac terminal:** Run the following commands from the directory where the pem key is stored: ssh-add —apple-use-keychain .pem If you get a warning about private key being accessible by others, then run this command: `chmod 600 ` and then run the `ssh-add` command again. Connect to the bastion host with this command: `ssh -A ec2-user@IPaddress` For example: `ssh -A ec2-user@3.15.12.112`. **On Windows using PuTTY and Pageant:** 1. Create ppk from pem key: Use PuTTY Key Generator. Load the pem key that you created in Step 1.B. After the key imports, click **Save private key**. This creates a ppk file. 2. In PuTTY - open configuration and make the following changes: - Sessions>Host Name: add IP address of bastion host. - Sessions>Port: 22 - Connection>Data>Auto-login username: ec2-user - Connection>SSH>Auth>Allow agent forwarding - Connection>SSH>Auth> For private key, click Browse and select the .ppk file that you just created. 3. Install Pageant and load the ppk into the application. ### Step 5 -Install PostgreSQL The Terraform template does not install PostgreSQL for use as the external repository. However, the associated security group and subnet is created. If you will be installing the external repository on an EC2 instance running PostgreSQL, then you must deploy the EC2 instance as described in [Part 3 - Preparing for Tableau Server Enterprise Deployment](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part3.htm). Then install, configure, and tar-backup PostgreSQL as described in [Part 4 - Installing and Configuring Tableau Server](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm). ### Step 6 - (Optional) Run DeployTab4EDG The TabDeploy4EDG script automates the implementation of the four-node Tableau deployment that is described in Part 4. See [TabDeploy4EDG automated installation script](#EDGSetup). [Skip to main content](#main-content) # Configure Permission and Content Access for Migrated Users You are in the [Tableau Cloud Manual Migration Guide.](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) This guide describes how to manually migrate Tableau Server deployments with fewer than 100 users to Tableau Cloud. Now that you've added your data sources, workbooks, and Prep flows to Tableau Cloud, you're ready to add your users. Before we do that, it's important to understand how Tableau determines who has access to what data. Tableau Cloud allows you to designate who has access to content and allows you to restrict the data access within a data source. We will use content access tools to restrict who has access to a content item, and row level security tools to restrict the data a user can see within a data source. ## Content access Projects, nested projects, and individual content items are all subject to permission rules. You can see how those rules are used in your Tableau Server environment and then recreate them in Tableau Cloud. See [Permissions](https://help.tableau.com/current/online/en-us/permissions.htm). ## Row level security If you have any data sources or workbooks with row level security, your row level security permissions and calculations will need to be updated for Tableau Cloud because user names and group names may change during a conversion. See [Restrict Access at the Data Row Level](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters.htm) and [Create a Data Policy for Row-Level Security](https://help.tableau.com/current/online/en-us/dm_vconn_create_rlspolicy.htm). ## Migration workflow This guide is organized according to a step-wise process for migrating to Tableau Cloud: 1. [Plan Your Migration](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part1.htm) 2. [Create and Configure a Tableau Cloud Site](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2.htm) 3. [Migrate Virtual Connections](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2-5.htm) 4. [Migrate Data Sources, Workbooks, and Prep Flows to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part3.htm) 5. [Recreate Refresh Schedules for Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part4.htm) 6. **You are here**: Configure Permission and Content Access for Migrated Users 7. [Add Remaining Users to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part6.htm) 8. [End-User Migration Checklist](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part7.htm) [Skip to main content](#main-content) # Create and Configure a Tableau Cloud Site You are in the [Tableau Cloud Manual Migration Guide.](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) This guide describes how to manually migrate Tableau Server deployments with fewer than 100 users to Tableau Cloud. The migration process that is described in this guide starts by working with your account manager to transition your Tableau licenses from Server to Cloud. If you would like to test out Tableau Cloud prior to your migration, you're also welcome to [trial Tableau Cloud](https://www.tableau.com/products/trial) at any time. ## Step 1: Work with a Tableau Account Manager to transition licensing The first step in your migration is to work with your Account Manager to transition your licensing from Server to Cloud. After this is done, you have 60 days of access to both products. Most customers with 100 users or less complete this migration process within a week, so there should be ample time to access both products as you transition. You can work with your Account Manager if more time is required. ## Step 2: Create additional Tableau Cloud sites If you've created multiple sites on Tableau Server, you may want to create equivalent sites on Tableau Cloud using [Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm). As a cloud administrator, you can [add sites](https://help.tableau.com/current/online/en-us/cloud_manager_sites.htm) to separate content environments, manage users and licenses, and control permissions. The number of Tableau Cloud sites you can create depends on the Tableau edition you purchased. After creating additional sites, continue with the remaining steps in this topic for each site. ## Step 3: Specify an authentication method The default authentication method will be Username and Password (TableauID). Multi-Factor Authentication is required for TableauID users to ensure secure access to Tableau Cloud. We also support many industry standards Single Sign On options. For more information see [Authentication](https://help.tableau.com/current/online/en-us/security_auth.htm) to determine which authentication method makes the most sense for your organization. ## Step 4: Familiarize yourself with the site Walk through the [site settings](https://help.tableau.com/current/online/en-us/sites_add.htm) and ensure that they are configured appropriately for your organization's needs. ## Step 5: Configure data connectivity The way Tableau Cloud connects to data differs based on where the data are stored. Each method may require different preparation and is laid out below. If you're not sure which option is right for you, please reach out to your account manager. ### Publicly available cloud data Publicly available cloud data includes Google Drive, Dropbox, OneDrive, and Snowflake, for example. If the connection is a database, you may need to enable Tableau Cloud to query it. To enable connectivity, see [Authorize Access to Cloud Data Published to Tableau Cloud](https://help.tableau.com/current/pro/desktop/en-us/publish_tableau_online_ip_authorization.htm). For flat files like Excel and .csv files: we recommend saving these files in a cloud store like Google Drive, Dropbox, or OneDrive. You can then enable direct connectivity to the data from Tableau Cloud. If that is not an option, you will need to configure Tableau Bridge to maintain connectivity to flat files saved locally. ### On-Premises, local files, or private cloud data Local files, private cloud data, and on-premises data might be SQL Server, Oracle, or local Excel files for example. If you have Private data requirements, you will need to install and configure [Tableau Bridge](https://help.tableau.com/current/online/en-us/to_bridge_install.htm). Tableau Bridge provides secure communication between Tableau Cloud and data behind firewalls. Install Bridge behind your firewall on a separate computer that has access to your data. See [About the Bridge Client](https://help.tableau.com/current/online/en-us/to_bridge_client.htm). Optional: For local files (Excel, CSV, etc), you can save them in a cloud store like Google Drive, Dropbox, Onebox instead of using Tableau Bridge. ## Migration workflow This guide is organized according to a step-wise process for migrating to Tableau Cloud: 1. [Plan Your Migration](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part1.htm) 2. **You are here:** Create and Configure Tableau Cloud Site 00 3. [Migrate Virtual Connections](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2-5.htm) 4. [Migrate Data Sources, Workbooks, and Prep Flows to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part3.htm) 5. [Recreate Refresh Schedules for Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part4.htm) 6. [Configure Permission and Content Access for Migrated Users](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part5.htm) 7. [Add Remaining Users to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part6.htm) 8. [End-User Migration Checklist](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part7.htm) [Skip to main content](#main-content) # End-User Migration Checklist You are in the [Tableau Cloud Manual Migration Guide.](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) This guide describes how to manually migrate Tableau Server deployments with fewer than 100 users to Tableau Cloud. Welcome to Tableau Cloud! You're here because your Tableau administrator has recently migrated your Tableau Server environment to [Tableau Cloud](https://online.tableau.com/), Tableau's fully managed analytics platform. As a part of your migration, the following tasks need a few minutes of your time to make sure that you have a smooth transition to Tableau Cloud. If you were using any of the below features on Tableau Server, they will need to be re-created on Tableau Cloud. Review this list to understand what features need to be re-created and follow the steps provided to do so! Work with your Tableau administrator to access both Tableau Server and Tableau Cloud while you migrate these items. - **URL actions**: You'll need to update URL actions that originated on Tableau Server so that they point to Tableau Cloud URLs, or you can use updated field variables. See [URL Actions](https://help.tableau.com/current/pro/desktop/en-us/actions_url.htm). - **Subscriptions**: You'll need to resubscribe to views, workbooks, and flows on the Tableau Cloud site. See [Create a Subscription to a View or Workbook](https://help.tableau.com/current/online/en-us/subscribe_user.htm). - **Custom views**: A custom view is a copy of a view that has your selections and filters applied. You'll need to reapply custom views on your Tableau Cloud site. See [Use Custom Views](https://help.tableau.com/current/pro/desktop/en-us/customview.htm). - **Row-level security**: User and group names can change in a migration. If you used groups and user names in row-level security solutions within Tableau data policies, data sources or workbooks, they will need to be updated following a migration. - **Ask Data lenses**: You'll need to reconfigure Ask Data Lenses on Tableau Cloud. See [Create Lenses that Focus Ask Data for Specific Audiences](https://help.tableau.com/current/pro/desktop/en-us/ask_data_lenses.htm). - **Favorites**: You must recreate your favorites. You can add any type of content to your favorites, except for embedded data sources. See [Mark Favorites](https://help.tableau.com/current/pro/desktop/en-us/favorites.htm). - **Collections**: Collections will need to be re-created by users in Tableau Cloud. - **User account settings**: Update your email settings and user interface options. See [Manage Your Account Settings](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm). - **Saved credentials for data sources**: You must update all data sources and flows that previously included your saved credentials. See [Manage Saved Credentials for Data Connections](https://help.tableau.com/current/pro/desktop/en-us/manage_stored_credentials.htm). - **Webhooks**: You must recreate Webhooks on Tableau Cloud. See [Tableau Webhooks](https://help.tableau.com/current/developer/webhooks/en-us/index.html). - **Embedding solutions**: If Tableau Server views are embedded in any other applications, those solutions will need to be updated to use Tableau Cloud configurations. This includes, but isn't limited to, the URL of the content item, how the web page interacts with the items, and authentication to the visualization. - **Dashboard extensions**: Depending on the use case, dashboard extensions may need to be adapted to the new Tableau Cloud environment. See [Dashboard Extensions](https://help.tableau.com/current/pro/desktop/en-us/dashboard_extensions.htm). Your Tableau administrator may need to [set up dashboard extension support on your Cloud site](https://help.tableau.com/current/online/en-us/dashboard_extensions_server.htm). - **Data Management**: If your organization has Data Management capabilities (either through previously purchased Data Management, or by purchasing Tableau Enterprise), then you must update data quality warnings and field descriptions. See [Virtual Connections and Data Policies](https://help.tableau.com/current/online/en-us/dm_vconn_overview.htm). ## Migration workflow This guide is organized according to a step-wise process for migrating to Tableau Cloud: 1. [Plan Your Migration](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part1.htm) 2. [Create and Configure a Tableau Cloud Site](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2.htm) 3. [Migrate Virtual Connections](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2-5.htm) 4. [Migrate Data Sources, Workbooks, and Prep Flows to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part3.htm) 5. [Recreate Refresh Schedules for Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part4.htm) 6. [Configure Permission and Content Access for Migrated Users](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part5.htm) 7. [Add Remaining Users to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part6.htm) 8. **You are here**: User Migration Checklist [Skip to main content](#main-content) # Tableau Server Enterprise Deployment Guide **Note**: Tableau no longer updates the Enterprise Deployment Guide. Although we still recommend the reference architecture described here as a valid deployment model for Tableau Server in AWS, specific configuration procedures may have changed since the last update. Always cross-reference these steps with the latest [Tableau Server Help](https://help.tableau.com/current/server/en-us/get_started_server.htm) documentation to ensure accuracy. The Tableau Server Enterprise Deployment Guide (EDG) has been developed to provide prescriptive guidance for deploying Tableau Server (on-premises or in the cloud). The Guide provides deployment guidance for enterprise scenarios in context of a reference architecture. We have tested the reference architecture to verify compliance with security, scale, and performance benchmarks, which conform to industry-standard best practices. At a high-level, the core features of an industry standard enterprise deployment consist of a tiered topology where each layer of server application functionality (web gateway tier, application tier, and data tier) is bound and protected by access-controlled subnets. Users accessing the server application from the internet are authenticated at the web tier. Once authenticated, the request is proxied to a protected subnet where the application tier handles the business logic. High-value data is protected by the third subnet: the data tier. Services in the application tier communicate over the protected network to the data tier to service data requests to the backend data sources. In this deployment, security is at the forefront of all design decisions and implementation. However, reliability, performance, and scalability are also priority requirements. Given the distributed and modular design of the reference architecture, reliability and performance scale in a linearly predictable way by strategically co-locating compatible services at each node and adding services at chokepoints. ## Who should read this The EDG has been developed for enterprise IT administrators who may require: - An IT-managed Tableau deployment - Industry compliance enforcement - Industry deployment best practices - Secure deployment by default The EDG is an implementation guide for deploying the enterprise reference architecture. While this version of the EDG includes an example AWS/Linux implementation, the Guide can be used as a resource by experienced enterprise IT administrators to deploy the prescribed reference architecture into any industry standard data center environment. ## Version This version of EDG was developed for the 2021.2.3 version (or later) of Tableau Server. While you may use the EDG as a general reference for deploying older versions of Tableau Server, we recommend that you deploy the reference architecture with Tableau Server 2021.2.3 or later. Some features and options are not available on older versions of Tableau Server. For the most up-to-date features and improvements, we recommend deploying EDG with Tableau Server 2022.1.7 and later. The reference architecture described in this Guide supports the following Tableau clients: Web authoring with compatible browsers, Tableau Mobile, and Tableau Desktop version 2021.2.1 or later. Other Tableau clients (Tableau Prep, Bridge, etc)  have not yet been validated with the reference architecture. ## Highlight features The first version of the Tableau Server reference architecture introduces the following scenarios and features: - Client pre-authentication: Tableau clients (Desktop, Mobile, Web Authoring) authenticate with the corporate authentication provider in the web tier before accessing internal Tableau Server. This process is managed by configuring an authN plug-in on the Tableau Server Independent Gateway acting as reverse proxy server. See [Part 5 - Configuring Web Tier](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part5.htm). - Zero trust deployment: Because all traffic to Tableau Servers is pre-authenticated, the entire Tableau deployment operates in a private subnet that does not require a trusted connection. - External repository: The reference architecture specifies installing the Tableau repository onto an external PostgreSQL database, allowing DBAs to manage, optimize, scale, and back up the repository as a generic database. - Initial node recovery: The EDG introduces a script that automates initial node restoration in the event of a failure. - Tar-based backup and restore: Use familiar tar backups at strategic milestones of the Tableau deployment. In the event of a failure or deployment misconfiguration, you can quickly recover to the previous deployment stage by recovering the associated tar backup. - Performance improvement: Customer and lab validation show a 15-20% performance improvement when running EDG compared to standard deployment. ## Licensing The Tableau Server reference architecture prescribed in this Guide requires a Tableau Advanced Management license to enable Tableau Server External Repository. You may also optionally deploy Tableau Server External File Store, which also requires the Tableau Advanced Management license. See _About Tableau Advanced Management on Tableau Server_ ([Linux](https://help.tableau.com/current/server-linux/en-us/itm_intro.htm)). [Skip to main content](#main-content) # Migrate Data Sources, Workbooks, and Prep Flows to Tableau Cloud You are in the [Tableau Cloud Manual Migration Guide.](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) This guide describes how to manually migrate Tableau Server deployments with fewer than 100 users to Tableau Cloud. For many organizations running a manual migration, it may make sense to have users (or a subset of users) migrate content they are familiar with to the new Tableau Cloud site. The content migration steps described in this topic can be completed by users (with Creator roles) in your organization. ## Before you begin Before you embark on content migration, we want to reinforce the recommendation to do a full inventory and clean up of your existing Tableau Server environment. See [Cleaning house: Does your content give you joy?](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part1.htm#Cleaning) **Keep the Tableau Server lights on!** During your migration process, ensure that all content and business processes remain operational in your Tableau Server system. Do not decommission your Tableau Server environment until you have verified and validated that your content and procedures have been properly migrated to Tableau Cloud. ## Step 1: Create projects for your site with minimum access policy We recommend setting up your new Tableau Cloud site with a minimum access policy. It's important to know that after a user is added to Tableau Cloud they can begin accessing content on the platform. Before you begin, we recommend reviewing [Quick Start: Permissions](https://help.tableau.com/current/online/en-us/qs_permissions.htm) for a refresher course on how permissions interact and inherit in Tableau. If you are familiar with these concepts in the context of Tableau Server, then you're good to go. Tableau Cloud permissions use the same logic as Server. Follow these steps to set up projects with a minimum access policy. 1. Configure [template permissions](https://help.tableau.com/current/online/en-us/permissions_capabilities.htm) on the Default project before creating more projects. 2. Remove permissions for All Users group. Removing All Users ensures that projects are configured with explicit permissions for users who need to access the content. 3. [Create groups](https://help.tableau.com/current/online/en-us/to_add_users_groups.htm). Groups simplify permission management as your organization and/or content scales. For more general project permission guidance, see [Use Projects to Manage Content Access](https://help.tableau.com/current/online/en-us/projects.htm). ## Step 2: Add users with Creator roles After you have configured the minimum access policy, now is the time to add any users who will be migrating content. If you are not relying on users to migrate content, then you can add them later in the process. See [Configure Permission and Content Access for Migrated Users](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part5.htm). Follow these guidelines for adding the creator users: - Review site roles: [Set Users' Site Roles](https://help.tableau.com/current/online/en-us/users_site_roles.htm). - You can [add users manually](https://help.tableau.com/current/online/en-us/sites_addusers.htm) or you can [import them with a CSV file](https://help.tableau.com/current/online/en-us/users_import.htm). - After you've added the users and set their roles, add them to the appropriate groups that you set up in the previous step. ## Step 3: Migrate published data sources If multiple workbooks use a single published data source, you only need to migrate the published data source once. 1. On Tableau Desktop, sign in to your Tableau Server environment, navigate to the workbook(s) that you want to migrate, and click Download. 2. On the Data menu in Tableau Desktop, select the data source, select Create Local Copy, and then save the local copy of the data source. 3. Working from a Sheet, select Data > Replace Data Source. Enter the following options: - Current: The current Local Copy Replacement: the local copy you saved - In the Data pane, right-click the original published data source, and then select Close. 4. Select Server and then click Sign Out. 5. Select the data source in the Data menu and select Publish to Server. 6. In Tableau Desktop, sign in to Tableau Cloud, then publish the data source. 7. If necessary, schedule a refresh of that data source in Tableau Cloud. For more information, see [Recreate Refresh Schedules for Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part4.htm). If the newly published data source is the only data source in the workbook, then follow the next two steps to publish the workbook as well. If the workbook has multiple published data sources, skip to the next step. 1. When Publishing the data source, verify that Update workbook to use the published data source is selected. 2. Select Server > Publish Workbook to publish the workbook to Tableau Cloud. ## Step 4: Migrate workbooks with multiple published data sources Repeat the following process for all published data sources that you would like to migrate to Tableau Cloud. 1. On Tableau Desktop, sign in to your Tableau Server environment, navigate to the published data source that you want to migrate, and click Download. 2. The file will open in Tableau Desktop. On the Data menu in Tableau Desktop, select the data source, select Create Local Copy, and then save the local copy of the data source. 3. In the Data pane, right-click the original published data source, and then select Close. 4. Repeat steps 2-3 for all Published Data Sources in the workbook. 5. Select Server and then click Sign Out. 6. Working from a Sheet, select Data > Replace Data Source. Enter the following options: - Current: The current Local Copy - Replacement: the local copy you saved 7. After all Published Data Sources are replaced, select Select > Publish Workbook to publish the workbook to Tableau Cloud. If the workbook also has an Embedded Data Source requiring Tableau Bridge, those data sources will need to be published separately as during the migration. See [Publish a Data Source](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources.htm). ## Step 5: Migrate workbooks with embedded data sources 1. On Tableau Desktop, sign in to your Tableau Server environment, navigate to the workbook(s) that you want to migrate, and click **Download**. 2. Select **Server** and then click **Sign Out**. 3. Select **Server** and then click **Sign In** to sign into Tableau Cloud. 4. If the embedded data source requires Tableau Bridge for automated refresh and is **file data** (such as .cvs and .xlsx), follow the instructions at [Publish on-premises data (Tableau Cloud only)](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources.htm#publish-onpremises-data-tableau-cloud-only). 5. If the data source does not require Tableau Bridge **or** is not file data, **select Server > Publish Workbook**. ## Step 6: Migrate Tableau Prep flows For all publicly available cloud data, you may need to enable Tableau Cloud to query it. To enable connectivity, see [Authorize Access to Cloud Data Published to Tableau Cloud](https://www.google.com/url?q=https://help.tableau.com/current/pro/desktop/en-us/publish_tableau_online_ip_authorization.htm). Repeat the following procedure for all Tableau Prep flows that you would like to migrate to Tableau Cloud. Run this procedure on a computer that is running [Tableau Prep Builder](https://www.tableau.com/products/prep/download). 1. Sign in to your Tableau Server environment, navigate to the flow that you want to migrate, and click Download. 2. The flow will open in Tableau Prep Builder: 1. If the flow connects to at least one published data source you will be automatically prompted to sign into your server. If you are not automatically prompted, from the top menu select Server > Sign in and sign in to Tableau Server. 2. Navigate from the top menu and select Server. In the Signed into server URL, click Sign Out. 3. If the flow connects to at least one published data source, you will see the following warning: ![](/tableau/current/en-us/guides/migration/en-us/Img/prep-migrate_583x269.png) 4. Click Sign Out. 3. Navigate to the top menu and select Server > Sign in > Quick Connect to Tableau Cloud to sign into Tableau Cloud. 4. If the flow does not contain any published data sources, proceed to the next step. If the flow connects to at least one published data source 1. Open the Connections pane and connect to the new version of the Published Data Source on Tableau Cloud. 2. Drag and drop the new connection to replace the existing Tableau Server Published Data Source input step. 3. Right click on the existing connection in the connections flyout and delete the Tableau Server Published Data Source. 4. Repeat steps for all other connected published data sources in the flow. 5. If your flow outputs to any published data source(s), navigate to the output step(s) and update them to reference the new published data source on Tableau Cloud. - Repeat steps for all other output published data sources in the flow. 6. After all published data sources are replaced, select Server \> Publish Flow or click the Publish button in the top right hand corner to publish the flow to Tableau Cloud. ## Migration workflow This guide is organized according to a step-wise process for migrating to Tableau Cloud: 1. [Plan Your Migration](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part1.htm) 2. [Create and Configure a Tableau Cloud Site](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2.htm) 3. [Migrate Virtual Connections](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2-5.htm) 4. **You are here**: Migrate Data Sources, Workbooks, and Flows to Tableau Cloud 5. [Recreate Refresh Schedules for Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part4.htm) 6. [Configure Permission and Content Access for Migrated Users](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part5.htm) 7. [Add Remaining Users to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part6.htm) 8. [End-User Migration Checklist](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part7.htm) [Skip to main content](#main-content) # Migrate Virtual Connections You are in the [Tableau Cloud Manual Migration Guide.](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) This guide describes how to manually migrate Tableau Server deployments with fewer than 100 users to Tableau Cloud. If your organization relies on virtual connections in Tableau Server, you must migrate those before proceeding. If you do not have virtual connections configured for Tableau Server, skip this procedure. Migrating virtual connections from Tableau Server to Tableau Cloud is a manual process. You must recreate the virtual connection (or the published data source and virtual connection) on your Tableau Cloud site, replace the data source in each workbook with the new virtual connection, and then copy/paste any calculation formulas from the original workbook data source to the updated one. **Step 1: Recreate and test the virtual connection on Tableau Cloud** See [Create a Virtual Connection](https://help.tableau.com/current/online/en-us/dm_vconn_create_conn.htm). **Step 2: Recreate published data sources built with the virtual connection** You will need to recreate all published data sources that use the virtual connections: 1. Follow the procedure at [Use a Virtual Connection](https://help.tableau.com/current/online/en-us/dm_vconn_use.htm). 2. [Create a Published Data Source](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources.htm) in Tableau Cloud so that it exactly mirrors the original Server data source. The following details must match: - All fields in the original data source must exist in the new data source - Field names: case must also match - Measure and dimension must map from original to new fields - Default field settings. See [Edit Default Settings for Fields](https://help.tableau.com/current/pro/desktop/en-us/datafields_fieldproperties.htm). 3. Make note if Tableau Bridge is required for the data source. **Step 3: Update workbooks to replace previous data sources** Run the following procedure from Tableau Desktop for each workbook that you want to migrate to Tableau Cloud: 1. Sign in to Tableau Server, navigate to the workbook that you are migrating, and then download the workbook. 2. Within the workbook select **File > Close**. Do not close Tableau Desktop. 3. Sign out of Tableau Server: **Server > Signed into http://example > Sign out**. You will get a warning about signing out while connected to Tableau Server. Click **OK**. 4. Sign in to Tableau Cloud: **Server > Sign in > Tableau Cloud**. 5. From the Desktop home screen, select the workbook file to open it again. You will receive two _Unable to complete action_ error messages. Close the error messages. When the worksheet opens, it will display the _Worksheet Unavailable_ message. Do not edit the connection from the main window. 6. If you've already created a new published data source skip to Step 8. Otherwise, update the data source by navigating to **Data > New Data Source.** - Navigate to the new virtual connection that you created for this workbook, and then click **Connect**. - Open the original Tableau Server workbook and copy the formulas. Paste the formulas in the updated Cloud workbook. 7. Create a new data source that exactly matches the previous data source. Field names must match exactly. 8. Replace data source: On the Data tab, right-click the data source that you just created, and then click **Replace Data Source**. In **Replace Data Source** specify the correct source in the **Replacement** selector, and then click **OK**. 9. Right-click on the old data source and select **Close**. 10. To publish the data sources: - Separately to Tableau Cloud, select **Publish>Data Source>Data Source Name**. - Embedded in the workbook, select **Publish > Workbook**. ## Migration workflow This guide is organized according to a step-wise process for migrating to Tableau Cloud: 1. [Plan Your Migration](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part1.htm) 2. [Create and Configure a Tableau Cloud Site](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2.htm) 3. **You are here**: Migrate Virtual Connections 4. [Migrate Data Sources, Workbooks, and Prep Flows to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part3.htm#clou) 5. [Recreate Refresh Schedules for Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part4.htm) 6. [Configure Permission and Content Access for Migrated Users](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part5.htm) 7. [Add Remaining Users to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part6.htm) 8. [End-User Migration Checklist](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part7.htm) [Skip to main content](#main-content) # Learning Library Welcome to the Learning Library. Find the name of the step that includes the process you want to learn more about. Scroll down to the next table for additional learning tutorials, videos, whitepapers, and more. [Tableau help](https://help.tableau.com/current/pro/desktop/en-us/default.htm) is also an excellent source of information.
Getting Started Tutorial step Topics to explore

Connect to a sample data source

Drag and drop to take a first look

Focus your results

Explore your data geographically

Drill down into the details

Build a dashboard to show your insights

Share your findings with others
Here are additional learning tutorials, videos, whitepapers, and more. Use these resources to improve your understanding of Tableau Desktop.
What do you want to do? Try this location For this type of content

Learn what things are called in the Tableau Interface

The Tableau Workspace

Labeled images of the Tableau User Interface (UI).

Find more tutorials and follow along using sample data

Build-It-Yourself Exercises

Short how-to type walk throughs about how to create popular chart types, and explain when you might want to use each type, including:

  • Bar charts
  • Text tables
  • Line charts
  • Scatter plots
  • Heat maps
  • Histograms
  • Gantt charts
  • Pie charts
  • Treemaps
  • Box plots
  • Packed bubble charts
  • Maps

Find examples of best practices for data visualization

Visual Best Practices

Best Practices for Effective Dashboards

Best Practices for Telling Great Stories

Best Practices for Designing Accessible Views

Best Practices for Published Data Sources

  • How to create great looking visualizations.

  • How to design effective dashboards that help discover key insights and speed up decision making.

  • How to tell a great story using Tableau story points.

  • How to create visualizations that are accessible by users with visual or physical impairments.

  • How to use published data sources to make your data available for analysis.

Get more context about Tableau products before you start to work

Whitepapers

In-depth discussions about best practices, industry trends, and what’s next in data analysis.

Find online or in-person training

Learn and Training

 Take free online, on-demand training courses or sign up for in-classroom training to deepen your expertise.

Find out about working with Tableau in the context of your system configuration or in combination with other products from other companies

Knowledge Base

Content created in response to support calls, designed to help use Tableau in specific environments or scenarios.
[Skip to main content](#main-content) # Part 1 - Understanding Enterprise Deployment **Note**: Tableau no longer updates the Enterprise Deployment Guide. Although we still recommend the reference architecture described here as a valid deployment model for Tableau Server in AWS, specific configuration procedures may have changed since the last update. Always cross-reference these steps with the latest [Tableau Server Help](https://help.tableau.com/current/server/en-us/get_started_server.htm) documentation to ensure accuracy. Part 1 describes, in more detail, the features and requirements of industry-standard enterprise deployment for which the Tableau Server Enterprise Deployment Guide has been designed. The following network diagram shows a generic datacenter tiered deployment with Tableau Server reference architecture. ## Industry standards and deployment requirements The following are features of industry standard deployments. These are the requirements that the reference architecture has been designed for: - A multi-tiered network design: The network is bound by protected subnets to limit access at each layer: web layer, application layer, and data layer. No single communication is able to pass across subnets, as all communication is terminated at the next subnet. - Ports and protocols blocked by default: Each subnet or security group will block all inbound and outbound ports and protocols by default. Communication is enabled, in part, by opening exceptions in the port or protocol configuration. - Off-box web authentication: User requests from the internet are authenticated by an authentication module on the reverse proxy in the web tier. Therefore, all requests to the application layer are authenticated at the web tier before passing into the protected application layer. - Platform-independent: Solution can be deployed with on-premises server applications or in the cloud. - Technology-agnostic: Solution can be deployed in a virtual machine environment or in containers. May also be deployed on Windows or Linux. However, this initial version of the reference architecture and supporting documentation has been developed for Linux running in AWS. - Highly available: All components in the system are deployed as a cluster and designed to operate in an active/active or active/passive deployment. - Siloed roles: Each server performs a discrete role. This design partitions all servers such that access may be minimized to service-specific administrators. For example, DBAs manage PostgreSQL for Tableau, identity administrators manage authentication module in web tier, network and cloud administrators enable traffic and connectivity. - Linearly scalable: as discrete roles, you can scale each tier service independently according to load profile. - Client support: The reference architecture supports all Tableau clients: Tableau Desktop (versions 2021.2 or later), Tableau Mobile, and Tableau Web Authoring. ## Security measures As stated, a primary feature of industry standard datacenter design is security. - Access: Each tier is bound by a subnet that enforces access control at the network layer using port filtering. Communication access between subnets may also be enforced by the application layer with authenticated services between processes. - Integration: Architecture is designed to plug-in with Identity Provider (IdP) on reverse proxy in the web tier . - Privacy: Traffic into the web tier is encrypted from the client with SSL. Traffic into the internal subnets may optionally be encrypted as well. ## Web proxy tier The web tier is a subnet in the DMZ (also referred to as the perimeter zone) that acts as a security buffer between the internet and the internal subnets where applications are deployed. The web tier hosts reverse proxy servers that do not store any sensitive information. The reverse proxy servers are configured with an AuthN plugin to pre-authenticate client sessions with a trusted IdP, before redirecting the client request to Tableau Server. For more information, see [Pre-authentication with an AuthN module](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part5.htm#Pre-auth). ### Load-balancers The deployment design includes an enterprise load-balancing solution in front of the reverse proxy servers. Load balancers provide important security and performance enhancements, by - Virtualizing the front-end URL for the application tier services - Enforcing SSL encryption - Offloading SSL - Enforcing compression between the client and the web tier services - Protecting against DOS attacks - Providing high-availability **Note**: Tableau Server version 2022.1 includes the Tableau Server Independent Gateway. The Independent Gateway is a standalone instance of the Tableau Gateway process that serves as a Tableau-aware reverse proxy. At the time of release, the Independent Gateway has been validated, but not fully tested in the EDG reference architecture. After full testing is complete the EDG will be updated with Tableau Server Independent Gateway prescriptive guidance. ## Application tier The application tier is in a subnet that runs the core business logic of the server application. The application tier consists of services and processes that are configured across distributed nodes in a cluster. The application tier is only accessible from the web tier and is not directly accessible by users. Performance and reliability are improved by configuring the application processes such that processes with different resource-use profiles (i.e., CPU intensive vs memory intensive) are co-located. ## Data tier The data tier is a subnet that holds valuable data. All traffic to this tier originates from the application tier and is therefore already authenticated. In addition to access requirements at the network layer with port configuration, this layer should include authenticated access and optionally encrypted traffic with the application tier. [Skip to main content](#main-content) # Part 2 - Understanding the Tableau Server Deployment Reference Architecture **Note**: Tableau no longer updates the Enterprise Deployment Guide. Although we still recommend the reference architecture described here as a valid deployment model for Tableau Server in AWS, specific configuration procedures may have changed since the last update. Always cross-reference these steps with the latest [Tableau Server Help](https://help.tableau.com/current/server/en-us/get_started_server.htm) documentation to ensure accuracy. The following image shows the relevant Tableau Server processes and how they are deployed in the reference architecture. This deployment is considered the minimal enterprise-appropriate Tableau Server deployment. The process diagrams in this topic are intended to show the major, defining processes of each node. There are many supporting processes that also run on the nodes that are not shown in the diagrams. For a list of all processes, see the configuration section of this guide, [Part 4 - Installing and Configuring Tableau Server](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm). ## Tableau Server Processes The Tableau Server reference architecture is a four node Tableau Server cluster deployment with external repository on PostgreSQL: - Tableau Server initial node (Node 1): Runs required TSM administrative and licensing services that can only be run on a single node in the cluster. In the enterprise context, the Tableau Server initial node is the primary node in the cluster. This node also runs redundant application services with Node 2. - Tableau Server application nodes (Node 1 and Node 2): The two nodes serve client requests, connect to and query data sources and to the data nodes. - Tableau Server data nodes (Node 3 and Node 4): Two nodes that are dedicated to managing data. - External PostgreSQL: this host runs the Tableau Server Repository process. For HA deployment you must run an additional PostgreSQL host for active/passive redundancy. You can also run PostgreSQL on Amazon RDS. For more information about the differences between running the repository on RDS vs an EC2 instance, see _Tableau Server External Repository_ ([Linux](https://help.tableau.com/current/server-linux/en-us/server_external_repo.htm)). Deploying Tableau Server with an external repository requires a Tableau Advanced Management license. If your organization does not have in-house DBA expertise, you may optionally run the Tableau Server Repository process in the default, internal PostgreSQL configuration. In the default scenario, the Repository is run on a Tableau node with embedded PostgreSQL. In this case, we recommend running the Repository on a dedicated Tableau node, and a passive Repository on an additional dedicated node to support Repository failover. See _Repository Failover_ ([Linux](https://help.tableau.com/current/server-linux/en-us/distrib_ha_failover.htm)). By way of example, the AWS implementation described in this Guide explains how to deploy the external repository on PostgreSQL running on an EC2 instance. - Optional: If your organization uses external storage, you may deploy the Tableau File Store as an external service. This Guide does not include the External File Store in the core deployment scenario. See _Install Tableau Server with External File Store_ ([Linux](https://help.tableau.com/current/server-linux/en-us/server_external_filestore_storage_new_install.htm)). Deploying Tableau Server with an external File Store requires a Tableau Advanced Management license. ### PostgresSQL Repository Tableau Server Repository is a PostgresSQL database that stores server data. This data includes information about Tableau Server users, groups and group assignments, permissions, projects, data sources, and extract metadata and refresh information. ![Data replication is occurring between two PostgreSQL databases, each with the iconic elephant logo.](/tableau/current/en-us/guides/enterprise-deployment/en-us/Img/edg-ref-arch-repo.png) The default PostgresSQL deployment consumes almost 50% of system memory resources. Based on its usage (for production and large production deployments) resource usage can go up. For this reason, we recommend running the Repository process on a computer that is not running any other resource-intensive server components like VizQL, Backgrounder, or Data Engine. Running the Repository process along with any of these components will create IO contentions, resource constraint, and will degrade overall performance of the deployment. ## Node 1: Initial node The initial node runs a small number of important processes and shares the application load with Node 2. The first computer you install Tableau on, the "initial node," has some unique characteristics. Three processes run only on the initial node and cannot be moved to any other node except in a failure situation, the License Service (License Manager), Activation Service, and TSM Controller (Administration Controller). ### Node 1 failover and automated restoration The License, Activation, and TSM Controller services are critical to the health of a Tableau Server deployment. In the event of a Node 1 failure, users will still be able to connect to the Tableau Server deployment, as a properly configured reference architecture will route requests to Node 2. However without these core services, the deployment will be in a critical state of pending failure. See [Initial node automated recovery](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part7.htm#Initial). ## Nodes 1 and 2: Application servers ![Tableau application node processes](/tableau/current/en-us/guides/enterprise-deployment/en-us/Img/edg-ref-arch-appnodes.png) Nodes 1 and 2 run the Tableau Server processes that serve client requests, query data sources, generate visualizations, handle content and administration, and other core Tableau business logic. The application servers do not store user data. **Note**: "Application Server" is a term that also refers to a Tableau Server process that is listed in TSM. The underlying process for "Application Server" is VizPortal. Run in parallel, Node 1 and Node 2 scale to service requests from the load-balancing logic run on the reverse proxy servers. As redundant nodes, should one of these nodes fail, then client requests and servicing are handled by the remaining node. The reference architecture has been designed so that complimentary application processes run on the same computer. This means the processes are not competing for computing resources and creating contention. For example, VizQL, a core processing service on application servers, is highly CPU and memory-bound, VizQL uses almost 60-70% of the CPU and memory on the computer. For this reason, the reference architecture is designed so that no other memory or CPU-bound processes are on the same node as VizQL. Testing shows that the amount of the load or number users doesn’t affect the memory or CPU usage on VizQL nodes. For example, reducing the number of concurrent users in our load test only effects the performance of the dashboard or the visualization loading process, but does not reduce resource utilization. Therefore, based on the available memory and CPU during peak usage, you may consider adding more VizQL processes. As a starting place for typical workbooks, allocate 4 cores per VizQL process. ### Scaling application servers The reference architecture is designed for scale based on a use-based model. As a general starting point, we recommend a minimum of two application servers, each supporting up to 1000 users. As user base increases, plan to add an application server for each additional 1000 users. Monitor usage and performance to tune the user base per host for your organization. ## Nodes 3 and 4: Data servers ![Tableau Server data node processes](/tableau/current/en-us/guides/enterprise-deployment/en-us/Img/edg-ref-arch-data.png) The File Store, Data Engine (Hyper), and Backgrounder processes are co-located on Nodes 3 and 4 for the following reasons: - Extract optimization: Running Backgrounder, Hyper, and File Store on the same node optimizes performance and reliability. During the extraction process, Backgrounder queries the target database, creates the Hyper file on the same node, and then uploads to File Store. By co-locating these processes on the same node the extraction creation workflow does not require copying amounts of data across the network or the nodes. - Complimentary resource balancing: Backgrounder is mainly CPU intensive. Data Engine is a memory-intensive process. Coupling these processes allows maximum resource utilization on each node. - Consolidation of data processes: Since each of these processes are back-end data processes, it makes sense to run them in the most secure data tier. In future versions of the reference architecture, the application and data servers will run in separate tiers. However, due to application dependencies in the Tableau architecture, application and data servers must run in the same tier at this time. ### Scaling data servers As with application servers, planning the resources that are required for Tableau data servers requires use-based modeling. In general, assume each data server can support up to 2000 extract refresh jobs per day. As your extract jobs increase, add additional data servers without the File Store service. Generally, the two-node data server deployment is suitable for deployments that use the local filesystem for the File Store service. Note that adding more application servers does not impact performance or scale on data servers in a linear fashion. In fact, with the exception of some overhead from additional user queries, the impact of adding more application hosts and users is minimal. [Skip to main content](#main-content) # Part 3 - Preparing for Tableau Server Enterprise Deployment **Note**: Tableau no longer updates the Enterprise Deployment Guide. Although we still recommend the reference architecture described here as a valid deployment model for Tableau Server in AWS, specific configuration procedures may have changed since the last update. Always cross-reference these steps with the latest [Tableau Server Help](https://help.tableau.com/current/server/en-us/get_started_server.htm) documentation to ensure accuracy. Part 3 describes the requirements for preparing your infrastructure to deploy the Tableau Server reference architecture. Before you begin, we recommend reviewing, [Part 2 - Understanding the Tableau Server Deployment Reference Architecture](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part2.htm). In addition to requirement descriptions, this topic provides an implementation example of the reference architecture in an AWS environment. The remainder of this Guide builds on the AWS reference architecture example started in this topic. A core principle of the reference architecture is standardization with data center security best practices. Specifically, the architecture is designed to segregate services into protected network subnets. Inter-subnet communication is restricted to specific protocol and port traffic. The following diagram illustrates the reference architecture subnet design for an on-premises deployment or a customer-managed cloud deployment. For an example cloud deployment, see the section below, [Example: Configure subnets and security groups in AWS](#AWSexampe). ## Subnets Create three subnets:  - A web tier - An application tier - A data subnet. ### Firewall/Security group rules The tabs below describe the firewall rules for each tier of the datacenter. For AWS-specific security group rules, see the section later in this topic. The web tier is a public DMZ subnet that will handle inbound HTTPS requests and proxy the requests to the application tier. This design provides a layer of defense from malware that may be targeted at your organization. The web tier blocks access to the application/data tier.
Traffic Type Protocol Port range Source

Inbound

 SSH TCP 22 Bastion subnet (for cloud deployments)
Inbound HTTP TCP 80 Internet (0.0.0.0/0)
Inbound HTTPS TCP 443 Internet (0.0.0.0/0)
Outbound All traffic All All  
The application subnet is where the Tableau Server deployment resides. The application subnet includes the Tableau application servers (Node 1 and Node 2). The Tableau application servers process user requests to the data servers and run core business logic. The application subnet also includes the Tableau data servers (Node 3 and Node 4). All client traffic to the application tier is authenticated at the web tier. Administrative access to the application subnet is authenticated and routed through the bastion host.
Traffic Type Protocol Port range Source

Inbound

 SSH TCP 22 Bastion subnet (for cloud deployments)
Inbound HTTPS TCP 443 Web tier subnet
Outbound All traffic All All  
The data subnet is where the external PostgreSQL database server resides.
Traffic Type Protocol Port range Source

Inbound

 SSH TCP 22 Bastion subnet (for cloud deployments)
Inbound PostgreSQL TCP 5432 Application tier subnet
Outbound All traffic All All  
Most enterprise security teams do not allow direct communication from the on-premises administrative system to the nodes deployed in the cloud. Instead, all administrative SSH traffic to the cloud nodes is proxied through a bastion host (also referred to as a "jump server"). For cloud deployments, we recommend bastion host proxy connection to all resources in the reference architecture. This is an optional configuration for on-premises environments. The bastion host authenticates administrative access and only allows traffic over SSH protocol.
Traffic Type Protocol Port range Source Destination

Inbound

 SSH TCP 22 Admin computer IP address  
Outbound SSH TCP 22   Web tier subnet
Outbound SSH TCP 22   Application tier subnet
## Example: Configure subnets and security groups in AWS This section provides step-by-step procedures to create and configure the VPC and network environment for the Tableau Server reference architecture deployment in AWS. The slides below show the reference architecture in four layers. As you progress through the slides, component elements are layered onto the topology map: 1. VPC subnet topology and EC2 instances: one bastion host, two reverse proxy servers, four Tableau servers, and at least one PostgreSQL server. 2. Protocol flow and internet connectivity. All inbound traffic is managed through the AWS internet gateway. Traffic to the internet is routed through the NAT. 3. Availability zones. The proxy, Tableau Server, and PostgreSQL hosts are evenly deployed across two Availability Zones. 4. Security groups. Four security groups (Public, Private, Data, and Bastion) protect each tier at the protocol level. ![Network diagram of a virtual private cloud with servers, databases, and users.](/tableau/current/en-us/guides/enterprise-deployment/en-us/Img/edg-vpc-sg-1.png) ![Network diagram of a virtual private cloud with servers, databases, and users.](/tableau/current/en-us/guides/enterprise-deployment/en-us/Img/edg-vpc-sg-2.png) ![Network diagram of a virtual private cloud with servers, databases, and users.](/tableau/current/en-us/guides/enterprise-deployment/en-us/Img/edg-vpc-sg-3.png) ![Network diagram of a virtual private cloud with servers, databases, and users.](/tableau/current/en-us/guides/enterprise-deployment/en-us/Img/edg-vpc-sg-4.png) ### AWS Availability Zones and high availability The reference architecture as presented in this Guide specifies a deployment that provides availability through redundancy when any single host fails. However, in the AWS case where the reference architecture is deployed across two Availability Zones, availability is compromised in the very rare case where an Availability Zone fails. ### VPC configuration This section describes how to: - Install and configure the VPC - Configure internet connectivity - Configure subnets - Create and configure security groups ### Configure VPC The procedure in this section maps to the UI in the "classic" VPC Experience. You can toggle the UI to display the classic view by turning off the New VPC Experience in the upper-left corner of the AWS VPC Dashboard. Run VPC wizard to create default Private and Public subnets and default routing and network ACL. 1. Before you configure a VPC, you must create an Elastic IP. Create an allocation using all defaults. 2. Run VPC wizard > "VPC with Public and Private Subnets" 3. Accept most defaults. Except for the following:  - Enter a VPC name. - Specify the Elastic IP Allocation ID. - Specify the following CIDR masks: - Public subnet's IPv4 CIDR: 10.0.1.0/24, rename this subnet to `Public-a`. - Private subnet's IPv4 CIDR: 10.0.30.0/24, rename this subnet to `Private-a`. - Availability Zone: for both subnets, select the a option for the region that you are in. **Note**: For the purposes of this example, we use **a** and **b** to distinguish between Availability Zones in a given AWS datacenter. In AWS, Availability Zone names may not match the examples shown here. For example, some Availability Zones include **c** and **d** zones within a datacenter. 4. Click Create VPC. 5. After VPC is created, create `Public-b`, `Private-b`, `Data`, and `Bastion` subnets. To create a subnet, click Subnets \> Create subnet. - `Public-b`: For Availability Zone, select the b option for the region that you are in. CIDR block: 10.0.2.0/24 - `Private-b`: For Availability Zone, select the b option for the region that you are in. CIDR block: 10.0.31.0/24 - `Data`: For Availability Zone, select the a zone for the region that you are in. CIDR block: 10.0.50.0/24. Optional: If you plan to replicate the external database across a PostgreSQL cluster, then create a Data-b subnet in Availability Zone b with a CIDR block of 10.0.51.0/24. - `Bastion`: For Availability Zone, select either zone. CIDR block: 10.0.0.0/24 6. After the subnets are created, edit the route tables on the Public and the Bastion subnets to use the route table that is configured for the associated internet gateway (IGW). And edit the Private and Data subnets to use the route table that is configured for the network address translator (NAT). - To determine which route table is configured with the IGW or the NAT, click Route Tables in AWS dashboard. Select one of the two route table links to open the property page. Look at the Target value at Routes \> Destination\> 0.0.0.0/0. The Target value differentiates the type of route and will either start with the `igw-` or `nat-` string. - To update route tables, VPC > Subnets \> \[subnet\_name\] > Route table > Edit route table association. ### Configure security groups The VPC wizard creates a single security group that you will not use. Create the following security groups (Security Groups > Create security group). The EC2 hosts will be installed into these groups across two Availability Zones as shown in the slide-diagram above. - Create a new security group: **Private**. This is where all 4 nodes of Tableau Server will be installed. Later in the installation process, the Private security group will be associated with the 10.0.30.0/24 and 10.0.31.0/24 subnets. - Create a new security group: **Public**. This is where proxy servers will be installed. Later in the installation process, the Public security group will be associated with the 10.0.1.0/24 and 10.0.2.0/24 subnets. - Create a new security group: **Data**. This is where the PostgreSQL external Tableau repository will be installed. Later in the installation process, the Data security group will be associated with the 10.0.50.0/24 (and optionally, 10.0.51.0/24) subnet. - Create a new security group: **Bastion**. This is where you'll install the bastion host. Later in the installation process, the Bastion security group will be associated with the 10.0.0.0/24 subnet. #### Specify inbound and outbound rules In AWS, security groups are analogous to firewalls in an on-prem environment. You must specify the traffic type, (eg, https, https, etc), protocol (TCP or UDP), and ports or port range (eg 80, 443, etc) that are allowed to pass in and/or out of the security group. For each protocol you must also specify the destination or source traffic. #### Public security group rules
Inbound rules
Type Protocol Port range Source
HTTP TCP 80 0.0.0.0/0
HTTPS TCP 443 0.0.0.0/0
SSH TCP 22 Bastion security group
Outbound rules
Type Protocol Port range Destination
All traffic All All 0.0.0.0/0
#### Private security group rules The Private security group includes an inbound rule to allow HTTP traffic from the Public security group. Allow HTTP traffic only during the deployment process to verify connectivity. We recommend removing the HTTP inbound rule after you have finished deploying the reverse proxy and configuring SSL to Tableau.
Inbound rules
Type Protocol Port range Source
HTTP TCP 80 Public security group
HTTPS TCP 443 Public security group
PostgreSQL TCP 5432 Data security group
SSH TCP 22 Bastion security group
All traffic All All Private security group
Outbound rule
Type Protocol Port range Destination
All traffic All All 0.0.0.0/0
PostgreSQL TCP 5432 Data security group
SSH TCP 22 Bastion security group
#### Data security group rules
Inbound rules
Type Protocol Port range Source
PostgreSQL TCP 5432 Private security group
SSH TCP 22 Bastion security group
Outbound rules
Type Protocol Port range Destination
All traffic All All 0.0.0.0/0
PostgreSQL TCP 5432 Private security group
SSH TCP 22 Bastion security group
#### Bastion host security group rules
Inbound rules
Type Protocol Port range Source
SSH TCP 22 The IP address and net mask of the computer that you will use to log into AWS (admin computer).
SSH TCP 22 Private security group
SSH TCP 22 Public security group
Outbound rules
Type Protocol Port range Destination
SSH TCP 22 The IP address and net mask of the computer that you will use to log into AWS (admin computer).
SSH TCP 22 Private security group
SSH TCP 22 Public security group
SSH TCP 22 Data security group
HTTPS TCP 443 0.0.0.0/0 (Optional: create this rule if you need to access the internet to download supporting software on the bastion host)
### Enable auto-assign public IP This provides you with an IP address for connecting to the proxy servers and bastion host. For Public and Bastion subnets: 1. Select the subnet 2. Under Actions menu, select "Modify auto-assign IP settings." 3. Click "Enable auto-assign public IPv4 addresses." 4. Click Save. ## Load balancer **Note**: If you are installing into AWS and following the example deployment in this guide, then you should install and configure the AWS load balancer later in the deployment process, as described in [Part 5 - Configuring Web Tier](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part5.htm). For on-premises deployments, work with your network administrators to deploy load balancers to support the web tier of the reference architecture: - A web-facing application load balancer that accepts HTTPS requests from Tableau clients and communicates with the reverse proxy servers. - Reverse proxy:  - We recommend a minimum of two proxy servers for redundancy and to handle client load. - Receives HTTPS traffic from load balancer. - Supports sticky session to Tableau host. - Configure proxy for round robin load balancing to each Tableau Server running the Gateway process. - Handles authentication requests from external IdP. - Forward proxy: Tableau Server requires access to the internet for licensing and map functionality. Depending on your forward proxy environment, you may need to configure forward proxy safelists for Tableau service URLs. See _Communicating with the Internet_ ([Linux](https://help.tableau.com/current/server-linux/en-us/plan_network.htm)). ## Configure host computers ### Minimum recommended hardware The following recommendations are based on our testing of real-world data in the reference architecture. Application servers: - CPU: 8 physical cores (16vCPUs), - RAM: 128 GB (16 GB/physical Core) - Disk space: 100 GB Data servers - CPU: 8 physical cores (16vCPUs), - RAM: 128 GB (16 GB/physical Core) - Disk space: 1 TB. If your deployment will make use of external storage for the Tableau File Store, you will need calculate the appropriate disk space. See _Install Tableau Server with External File Store_ ([Linux](https://help.tableau.com/current/server-linux/en-us/server_external_filestore_storage_new_install.htm)). Proxy servers - CPU: 2 physical cores (4vCPUs), - RAM: 8 GB (4 GB/physical Core) - Disk space: 100 GB External repository database - CPU: 8 physical cores (16vCPUs), - RAM: 128 GB (16 GB/physical Core) - Disk space requirement is dependent on your data load and how that will impact backup. See the section, _Backup and restore processes_, in the topic, _Disk Space Requirements_ ([Linux](https://help.tableau.com/current/server-linux/en-us/requ_diskspace.htm#backup-and-restore-processes)). ### Directory structure The reference architecture recommends installing the Tableau Server package and the data into non-default locations: - Install package to: `/app/tableau_server`: Create this directory path before you install the Tableau Server package, and then specify this path during installation. - Install Tableau data to: `/data/tableau_data`. Do not create this directory before you install Tableau Server. Instead, you must specify the path during installation, and then Tableau Setup will create and permission the path appropriately. See [Run installation package and initialize TSM](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm#Run2) for implementation details. ## Example: Install and prep host computers in AWS This section explains how to install EC2 hosts for each server type in the Tableau Server reference architecture. The reference architecture requires eight hosts: - Four instances for Tableau Server. - Two instances for proxy servers (Apache). - One instance for bastion host. - One or two EC2 PostgreSQL database instances ### Host instance details Install host computers according to the details below. #### Tableau Server - Amazon Linux 2 - Instance Type: m5a.8xlarge - Security group ID: Private - Storage: EBS, 150 GiB, gp2 volume type. If your deployment will make use of external storage for the Tableau File Store, you will need calculate the appropriate disk space. See _Install Tableau Server with External File Store_ ([Linux](https://help.tableau.com/current/server-linux/en-us/server_external_filestore_storage_new_install.htm)). - Network: install two EC2 hosts in each private subnet (10.0.30.0/24 and 10.0.31.0/24). - Copy the latest maintenance release of Tableau Server 2021.2 (or later) rpm package from [Tableau Downloads page](https://www.tableau.com/support/releases/server) to each Tableau host. #### Bastion host - Amazon Linux 2 - Instance Type: t3.micro - Security group ID: Bastion - Storage: EBS, 50 GiB, gp2 volume type - Network: Bastion subnet 10.0.0.0/24 #### Tableau Server Independent Gateway - Amazon Linux 2 - Instance Type: t3.xlarge - Security group ID: Public - Storage: EBS, 100 GiB, gp2 volume type - Network: Install one EC2 instance in each public subnet (10.0.1.0/24 and 10.0.2.0/24) #### PostgreSQL EC2 host - Amazon Linux 2 - Instance Type: r5.4xlarge - Security group ID: Data - Storage: Disk space requirement is dependent on your data load and how that will impact backup. See the section, _Backup and restore processes_, in the topic, _Disk Space Requirements_ ([Linux](https://help.tableau.com/current/server-linux/en-us/requ_diskspace.htm#backup-and-restore-processes)). - Network: Data subnet 10.0.50.0/24. (If you are replicating PostgreSQL in a HA cluster, then install the second host in the 10.0.51.0/24 subnet) ## Verification: VPC connectivity After you have installed the host computers, verify network configuration. Verify connectivity between the hosts by connecting with SSH from the host in the Bastion security group to the hosts in each subnet. ### Example: Connect to bastion host in AWS 1. Set up your admin computer for ssh-agent. This allows you to connect to hosts in AWS without placing your private key file on any EC2 instances. To configure ssh-agent on a Mac, run the following command: `ssh-add -K myPrivateKey.pem` or for latest Mac OS, `ssh-add --apple-use-keychain myPrivateKey.pem` For Windows, see the topic, [Securely Connect to Linux Instances Running in a Private Amazon VPC](https://aws.amazon.com/blogs/security/securely-connect-to-linux-instances-running-in-a-private-amazon-vpc/). 2. Connect to the bastion host by running the following command: `ssh -A ec2-user@` 3. You can then connect to other hosts in the VPC from the bastion host, using the private IP address, for example: `ssh -A ec2-user@10.0.1.93` [Skip to main content](#main-content) # Part 4 - Installing and Configuring Tableau Server **Note**: Tableau no longer updates the Enterprise Deployment Guide. Although we still recommend the reference architecture described here as a valid deployment model for Tableau Server in AWS, specific configuration procedures may have changed since the last update. Always cross-reference these steps with the latest [Tableau Server Help](https://help.tableau.com/current/server/en-us/get_started_server.htm) documentation to ensure accuracy. This topic describes how to finish installing and configuring the baseline Tableau Server deployment. The procedure here continues with the AWS and Linux reference architecture example. The Linux examples throughout the installation procedures show commands for RHEL-like distributions. Specifically the commands here have been developed with the Amazon Linux 2 distribution. If you are running the Ubuntu distribution, edit the commands accordingly. ## Before you begin You must prep and validate your environment as described in [Part 3 - Preparing for Tableau Server Enterprise Deployment](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part3.htm). ## Install, configure, and tar PostgreSQL This PostgreSQL instance hosts the external repository for the Tableau Server deployment. You must install and configure PostgreSQL before you install Tableau. You can run PostgreSQL on Amazon RDS or on an EC2 instance. For more information about the differences between running the repository on RDS vs an EC2 instance, see _Tableau Server External Repository_ ([Linux](https://help.tableau.com/current/server-linux/en-us/server_external_repo.htm)). By way of example, the procedure below shows how to install and configure Postgres on an Amazon EC2 instance. The example shown here is a generic installation and configuration for PostgreSQL in the reference architecture. Your DBA should optimize your PostgreSQL deployment based on the size of your data and performance needs. Requirements: Note that you must be running PostgreSQL 1.6 and you must install the uuid-ossp module. ### PostgreSQL versioning You must install compatible major versions of PostgreSQL for the Tableau Server external repository. Additionally, minor versions must also meet minimum requirements.
Tableau Server versions PostgreSQL minimum compatible versions

2022.3.0 - 2022.3.7

2023.1.0 - 2023.1.4

 13.7
2022.1.17 - 2022.1.19

2022.3.8 - 2022.3.19

2023.1.5 - 2023.1.15

2023.3.0 - 2023.3.8

 13.11
2022.3.20 - 2022.3.x

2023.1.16 - 2023.1.x

2023.3.9 - 2023.3.x

 13.14
2024.0 - 2024.2.8 15.6
2024.2.9 - 2024.2.13

2025.1.0 - 2025.1.6

 15.10
2024.2.14 - 2024.2.16

2025.1.7 - 2025.1.9

15.13

2024.2.17

2025.1.10

2025.3 - 2025.3.5

 15.14
2025.3.6 15.16

2026.2.x - 2026.3.x

 17.7
### Install PostgreSQL This example installation procedure describes how to install PostgreSQL version 13.6. Sign-in to the EC2 host that you created in the previous Part. 1. Run update to apply latest fixes to the Linux OS: `sudo yum update` 2. Create and edit the file, pgdg.repo. in the `/etc/yum.repos.d/` path. Populate the file with the following configuration information: \[pgdg13\] name=PostgreSQL 13 for RHEL/CentOS 7 - x86\_64 baseurl=https://download.postgresql.org/pub/repos/yum/13/redhat/rhel-7-x86\_64 enabled=1 gpgcheck=0 3. Install Posgres 13.6: sudo yum install postgresql13-server-13.6-1PGDG.rhel7.x86\_64 4. Install the uuid-ossp module: sudo yum install postgresql13-contrib-13.6-1PGDG.rhel7.x86\_64 5. Initialize Postgres: sudo /usr/pgsql-13/bin/postgresql-13-setup initdb ### Configure Postgres Finish the base installation by configuring Postgres: 1. Update the pg\_hba configuration file, `/var/lib/pgsql/13/data/pg_hba.conf`, with the following two entries. Each entry must include the mask of the subnets where your Tableau Servers will be running:  `host all all 10.0.30.0/24 password` `host all all 10.0.31.0/24 password` 2. Update the PostgreSQL file, `/var/lib/pgsql/13/data/postgresql.conf`, by adding this line: `listen_addresses = '*'` 3. Configure to start Postgres on reboot: sudo systemctl enable --now postgresql-13 4. Set superuser password: sudo su - postgres psql -c "alter user postgres with password 'StrongPassword'" **Note**: Set a strong password. Do not use `'StrongPassword`' as shown in the example here. exit 5. Restart Postgres: sudo systemctl restart postgresql-13 ## Take PostgreSQL Step 1 tar backup Create a tar back up of the PostgreSQL configuration. Creating a tar snapshot of the current configuration will save you time if you encounter failures as you continue the deployment. We'll refer to this as the "Step 1" back up. On PostgreSQL host: 1. Stop the Postgres database instance: sudo systemctl stop postgresql-13 2. Run the following commands to create the tar backup: sudo su cd /var/lib/pgsql tar -cvf step1.13.bkp.tar 13 exit 3. Start Postgres database: sudo systemctl start postgresql-13 Restore Step 1 Restore to Step 1 if the Tableau Server initial node fails during installation. 1. On the computer running Tableau, run the obliterate script to completely remove Tableau Server from the host: sudo /app/tableau\_server/packages/scripts././tableau-server-obliterate -a -y -y -y -l 2. Restore the PostgreSQL Stage 1 tar. On the computer running Postgres, run the following commands: sudo su systemctl stop postgresql-13 cd /var/lib/pgsql tar -xvf step1.13.bkp.tar systemctl start postgresql-13 exit Resume the installation process of installing the initial node of Tableau Server. ## Before you install If you are deploying Tableau according to the example AWS/Linux implementation described in this Guide, then you may be able to run the automated installation script, TabDeploy4EDG. The TabDeploy4EDG script automates the example installation of the four-node Tableau deployment that is described in procedures that follow. See [Appendix - AWS Deployment Toolbox](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part_app-aws.htm). ## Install initial node of Tableau Server This procedure describes how install the initial node of Tableau Server as defined by the reference architecture. With the exception of the package installation and the initialization of TSM, the procedure here uses the TSM command line whenever possible. In addition to being platform-agnostic, using TSM CLI allows a more seamless installation into virtualized and headless environments. ### Run installation package and initialize TSM Sign in to the Node 1 host server. 1. Run update to apply latest fixes to the Linux OS: sudo yum update 2. Copy the installation package from [Tableau Downloads page](https://www.tableau.com/support/releases/server) to the host computer that will be running Tableau Server. For example, on a computer running Linux RHEL-like operating system, run wget https://downloads.tableau.com/esdalt/2022/tableau-server-.rpm where `` is the release number. 3. Download and install dependencies: sudo yum deplist tableau-server-.rpm | awk '/provider:/ {print $2}' | sort -u | xargs sudo yum -y install 4. Create the `/app/tableau_server` path in the root directory: sudo mkdir -p /app/tableau\_server 5. Run the installation program and specify the `/app/tableau_server` install path. For example, on a Linux RHEL-like operating system, run: sudo rpm -i --prefix /app/tableau\_server tableau-server-.x86\_64.rpm 6. Change to the `/app/tableau_server/packages/scripts./` directory and run the `initialize-tsm` script located there: sudo ./initialize-tsm -d /data/tableau\_data --accepteula 7. After initialization is complete, exit the shell: exit ### Activate and register Tableau Server 1. Sign in to the Node 1 host server. 2. Provide the Tableau Server product key(s) in this step. Run the following command for each license key that you have purchased: tsm licenses activate -k 3. Create a json registration file with the format as shown here: { "zip" : "97403", "country" : "USA", "city" : "Springfield", "last\_name" : "Simpson", "industry" : "Energy", "eula" : "yes", "title" : "Safety Inspection Engineer", "company\_employees" : "100", "phone" : "5558675309", "company" : "Example", "state" : "OR", "opt\_in" : "true", "department" : "Engineering", "first\_name" : "Homer", "email" : "homer@example.com" } 4. After saving changes to the file, pass it with the `--file` option to register Tableau Server: tsm register --file path\_to\_registration\_file.json ### Configure identity store **Note**: If your deployment will use external storage for the Tableau File Store, you need to enable External File Store before you configure the identity store. See _Install Tableau Server with External File Store_ ([Linux](https://help.tableau.com/current/server-linux/en-us/server_external_filestore_storage_new_install.htm)). The default reference architecture uses a local identity store. Configure the initial host with local identity store by passing the `config.json` file with the `tsm settings import` command. Import the `config.json` file according to your operating system: The `config.json` file is included in the scripts. directory path (for example, `scripts.20204.21.0217.1203`), and is formatted to configure the identity store. Run the following command to import the `config.json` file: tsm settings import -f /app/tableau\_server/packages/scripts./config.json ### Configure external Postgres 1. Create an external database json file with the following configuration settings: { "flavor":"generic", "masterUsername":"postgres", "host":"", "port":5432 } 2. After saving changes to the file, pass the file with the following command: tsm topology external-services repository enable -f .json --no-ssl You will be prompted for the Postgres master username password. The option, `--no-ssl`, configures Tableau to use SSL/TLS only when the Postgres server is configured for SSL/TLS. If Postgres is not configured for SSL/TLS, then the connection is not encrypted. [Part 6 - Post-Installation Configuration](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part6.htm) describes how to enable SSL/TLS for the Postgres connection after you have completed the first phase of deployment. 3. Apply the changes. Run this command to apply the changes and restart Tableau Server: tsm pending-changes apply 4. Delete the configuration file that you used in Step 1. ### Finish Node 1 installation 1. After Tableau Server has installed you must initialize the server. Run the following command: tsm initialize --start-server --request-timeout 1800 2. When initialization is finished, you must create a Tableau Server administrator account. Unlike the computer account that you are using to install and manage TSM operating-system components, the Tableau Server administrator account is an application account that used for creating Tableau Server users, projects, and sites. The Tableau Server administrator also applies permissions to Tableau resources. Run the following command to create the initial administrator account. In the following example, the user is called `tableau-admin`: tabcmd initialuser --server http://localhost --username "tableau-admin" Tabcmd will prompt you to set a password for this user. ### Verification: Node 1 configuration 1. Run the following command to verify that TSM services are running: tsm status -v Tableau should return the following: external: Status: RUNNING 'Tableau Server Repository 0' is running (Active Repository). node1: localhost Status: RUNNING 'Tableau Server Gateway 0' is running. 'Tableau Server Application Server 0' is running. 'Tableau Server Interactive Microservice Container 0' is running. 'MessageBus Microservice 0' is running. 'Relationship Query Microservice 0' is running. 'Tableau Server VizQL Server 0' is running. ... All of the services will be listed. 2. Run the following command to verify that Tableau administrative site is running: curl localhost The first few lines should show Vizportal html, similar to this: /./start-administrative-services 8. On Node 1, run the `tsm status` command to monitor TSM state before restarting. In some cases, you will get an error, `Cannot connect to server...`. This error occurs because the tabadmincontroller service has not restarted. Continue to run `tsm status` periodically. If this error does not go away after 10 minutes, run the `start-administrative-services` command again. After a few moments, the `tsm status` command will return a status of DEGRADED, and then ERROR. Do not start TSM until the status, STOPPED is returned. And then run the following command: tsm start Resume the installation process to install Tableau Server on remaining nodes. ## Install Tableau Server on remaining nodes To continue the deployment, copy the Tableau installer to each node. Node configuration overview This section describes the process to configure Nodes 2-4. The sections that follow provide detailed configuration and validation procedures for each step. Installation of Tableau Server Nodes 2-4 requires that you generate, copy, and reference a bootstrap file during node installation. To generate the bootstrap file, you run a TSM command on the initial node. You will then copy the bootstrap file to the target node, where you run it as part of the node initialization. The following json content shows an example of a bootstrap file. (The certificate and crypto-related values have been truncated to make the example file easier to read.) { "initialBootstrapSettings" : { "certificate" : "-----BEGIN CERTIFICATE-----\\r\\...=\\r\\n-----END CERTIFICATE-----", "port" : 8850, "configurationName" : "tabsvc", "clusterId" : "tabsvc-clusterid", "cryptoKeyStore" : "zs7OzgAAAAIAAAABAAAAA...w==", "toksCryptoKeystore" : "LS0tLS1CRUdJTiBUT00tLS0tCjM5MDBh...L", "sessionCookieMaxAge" : 7200, "nodeId" : "node1", "machineAddress" : "ip-10-0-1-93.us-west-1.compute.internal", "cryptoEnabled" : true, "sessionCookieUser" : "tsm-bootstrap-user", "sessionCookieValue" : "eyJjdHkiOiJKV1QiLCJlbmMiOiJBMTI4Q0JDLUhQ...", "sessionCookieName" : "AUTH\_COOKIE" } } The bootstrap file includes connection-based validation to authenticate Node 1 and creates an encrypted channel for the bootstrap process. The bootstrap session is time-limited, and configuring and validating nodes is time consuming. Plan on creating and copying new bootstraps as you configure the nodes. After you run the bootstrap file, you then sign in to the initial Tableau Server node and configure the processes for the new node. When you finish configuring the nodes, you must apply changes and restart the initial node. The new node is configured and started. As you add nodes, the configuration and restart of the deployment will take consecutively longer to complete. The Linux examples throughout the installation procedures show commands for RHEL-like distributions. If you are running the Ubuntu distribution, edit the commands accordingly. 1. Run update to apply latest fixes to the Linux OS: sudo yum update 2. Download and install dependencies: sudo yum deplist tableau-server-.rpm | awk '/provider:/ {print $2}' | sort -u | xargs sudo yum -y install 3. Create the `/app/tableau_server` path in the root directory: sudo mkdir -p /app/tableau\_server 4. Run the installation program and specify the `/app/tableau_server` install path. For example, on a Linux RHEL-like operating system, run: sudo rpm -i --prefix /app/tableau\_server tableau-server-.x86\_64.rpm ## Generate, copy, and use the bootstrap file to initialize TSM The following procedure shows how to generate, copy, and use a bootstrap file when initializing TSM on another node. In this example, the bootstrap file is named `boot.json`. In this example, the host computers are running in AWS, where EC2 hosts are running Amazon Linux 2. 1. Connect to the initial node (Node 1) and run the following command: tsm topology nodes get-bootstrap-file --file boot.json 2. Copy the bootstrap file to Node 2. scp boot.json ec2-user@10.0.31.83:/home/ec2-user/ 3. Connect to Node 2 and switch to the Tableau Server scripts directory: cd /app/tableau\_server/packages/scripts. 4. Run the `initialize-tsm` command and reference the bootstrap file: sudo ./initialize-tsm -d /data/tableau\_data -b /home/ec2-user/boot.json --accepteula 5. After `initialize-tsm` has completed, delete `boot.json`, and then exit or log out of the session. ## Configure processes You must configure the Tableau Server cluster on the node where the Tableau Server Administration Controller (TSM controller) is running. The TSM controller runs on the initial node. ![Process status window showing the real-time status of process running in Tableau Server.](/tableau/current/en-us/guides/enterprise-deployment/en-us/Img/edg-process-config.png) ### Configure Node 2 1. After you have initialized TSM using the bootstrap file on Node 2, sign in to the initial node. 2. On the initial node (`node1`) run the following commands to configure processes on Node 2.: tsm topology set-process -n node2 -pr clustercontroller -c 1 tsm topology set-process -n node2 -pr gateway -c 1 tsm topology set-process -n node2 -pr vizportal -c 1 tsm topology set-process -n node2 -pr vizqlserver -c 2 tsm topology set-process -n node2 -pr cacheserver -c 2 tsm topology set-process -n node2 -pr searchserver -c 1 tsm topology set-process -n node2 -pr dataserver -c 2 tsm topology set-process -n node2 -pr clientfileservice -c 1 tsm topology set-process -n node2 -pr tdsservice -c 1 tsm topology set-process -n node2 -pr collections -c 1 tsm topology set-process -n node2 -pr contentexploration -c 1 If you are installing version 2022.1 or later, add the Index and Search service as well: tsm topology set-process -n node2 -pr indexandsearchserver -c 1 If you are installing version 2023.3 or later, only include the Index and Search service. Do not add the Search and Browse (searchserver) service 3. Review the configuration before you apply it. Run the following command: tsm pending-changes list 4. After you have verified that your changes are in the pending list (there will be other services in the pending list as well), apply the changes: tsm pending-changes apply The changes will require a restart. Configuration and restart will take some time. 5. Verify Node 2 configuration. Run the following command: tsm status -v ### Configure Node 3 Initialize TSM using the bootstrap process on Node 3, and then run the `tsm topology set-process` commands below. There is a Coordination Service warning that will display each time you set a process. You can ignore this warning as you set the processes. 1. After you initialize TSM using the bootstrap file on Node 3, sign in to the initial node (`node1`) and run the following commands to configure processes: tsm topology set-process -n node3 -pr clustercontroller -c 1 tsm topology set-process -n node3 -pr clientfileservice -c 1 tsm topology set-process -n node3 -pr backgrounder -c 4 tsm topology set-process -n node3 -pr filestore -c 1 If you are installing version 2022.1 or later, add the Index and Search service as well: tsm topology set-process -n node3 -pr indexandsearchserver -c 1 2. Review the configuration before you apply it. Run the following command: tsm pending-changes list 3. After you have verified that your changes are in the pending list (the list will include other services that are automatically configured), apply the changes: tsm pending-changes apply --ignore-warnings The changes will require a restart. Configuration and restart will take some time. 4. Verify the configuration by running the following command: tsm status -v ## Deploy coordination service ensemble to Nodes 1-3 For standard reference architecture four-node deployment, run the following procedure: 1. Run the following commands on Node 1: tsm stop tsm topology deploy-coordination-service -n node1,node2,node3 The process includes a restart of TSM, which will take some time. 2. After the coordination service is deployed, start TSM: tsm start ## Take Step 3 tar backups After you have verified the installation, take four tar backups: - PostgreSQL - Tableau initial node (Node 1) - Tableau Node 2 - Tableau Node 3 Create Step 3 tar files 1. On the initial node of Tableau, stop Tableau: tsm stop 2. After TSM has stopped, stop Tableau administrative services on each node. Run the following command on each node, in order (Node 1, Node 2, and then Node 3): sudo /app/tableau\_server/packages/scripts././stop-administrative-services 3. On PostgreSQL host, stop the Postgres database instance: sudo systemctl stop postgresql-12 4. Run the following commands to create the tar backup: sudo su cd /var/lib/pgsql tar -cvf step3.12.bkp.tar 12 exit 5. Verify that Postgres tar file is created with root permissions: sudo ls -al /var/lib/pgsql 6. On the Postgres host, start the Postgres database: sudo systemctl start postgresql-12 7. Create the tar backup on Node 1, Node 2, and Node 3. Run the following commands on each node: - cd /data sudo tar -cvf step3.tableau\_data.bkp.tar tableau\_data - Verify that the Tableau tar file is created with root permissions: ls -al 8. Start Tableau administrative services on each node in order (Node 1, Node 2, and then Node 3): sudo /app/tableau\_server/packages/scripts././start-administrative-services 9. Run the `tsm status` command to monitor TSM state before restarting. In most cases, the command will return a status of DEGRADED, and then ERROR. Wait a few moments and run the command again. If the status of ERROR or DEGRADED is returned, continue waiting. Do not attempt to start TSM until the status, STOPPED is returned. And then run the following command: tsm start Restore Step 3 This process restores the Tableau Node 1, Node 2, and Node 3. It also restores the Postgres instance to Step 3. After you have restored to this step, you can then deploy coordination service, Node 4, and then final node configurations. 1. Stop the tsm service on the initial Tableau host (Node 1): tsm stop 2. After TSM has stopped, stop Tableau administrative services on Node 1, Node 2, and Node 3. Run the following command on each node: sudo /app/tableau\_server/packages/scripts././stop-administrative-services 3. Restore the PostgreSQL Step 3 tar. On the computer running Postgres, run the following commands: sudo su systemctl stop postgresql-12 cd /var/lib/pgsql tar -xvf step3.12.bkp.tar systemctl start postgresql-12 exit 4. Restore the Tableau Step 3 tar on Node 1, Node 2, and Node 3. Run the following commands on each Tableau node: cd /data sudo rm -rf tableau\_data sudo tar -xvf step3.tableau\_data.bkp.tar 5. On the Tableau Node 1 computer, remove the following files: - sudo rm /data/tableau\_data/data/tabsvc/appzookeeper/1/version-2/currentEpoch - sudo rm /data/tableau\_data/data/tabsvc/appzookeeper/1/version-2/acceptedEpoch - sudo rm /data/tableau\_data/data/tabsvc/tabadminagent/0/servicestate.json If the shell returns a "file not found" error, you may need to change the path name to increment the number `` in this section of the path: `.../appzookeeper//version-2/...`. 6. Restart the administrative services on Node 1, Node 2, and Node 3. Run the following commands on each node: sudo /app/tableau\_server/packages/scripts././start-administrative-services sudo su -l tableau -c "systemctl --user daemon-reload" sudo /app/tableau\_server/packages/scripts././start-administrative-services 7. On Node 1, run the `tsm status` command to monitor TSM state before restarting. In some cases, you will get an error, `Cannot connect to server...`. This error occurs because the tabadmincontroller service has not restarted. Continue to run `tsm status` periodically. If this error does not go away after 10 minutes, run the `start-administrative-services` command again. After a few moments, the `tsm status` command will return a status of DEGRADED, and then ERROR. Do not start TSM until the STOPPED status is returned. And then run the following command: `tsm start` Resume the installation process to deploy coordination service on Nodes 1-3. ## Configure Node 4 The process for configuring Node 4 is the same as Node 3. Set the same processes as you set for Node 3, running the same set of commands as shown above, but specifying `node4` in the commands rather than `node3`. As with Node 3 verification, verify the Node 4 configuration by running `tsm status -v`. Before you proceed, wait for the File Store process on Node 4 to finish synchronizing. The File Store service status will return `is synchronizing` until it finishes. When the File Store service status returns `is running` you can proceed. ## Final process configuration and verification The final step to process configuration is to remove redundant processes from Node 1. 1. Connect to the initial node (`node1`). 2. Decommission the file store on Node 1. This will cause a warning about removing the file store from a co-located controller. You can ignore the warning. Run the following command: tsm topology filestore decommission -n node1 3. When file store is decommissioned, run the following command to remove the backgrounder process from Node 1: tsm topology set-process -n node1 -pr backgrounder -c 0 4. Review the configuration before you apply it. Run the following command: tsm pending-changes list 5. After you have verified that your changes are in the pending list, apply the changes: tsm pending-changes apply The changes will require a restart. Configuration and restart will take some time. 6. Verify the configuration: `tsm status -v`. Before you proceed, wait for the File Store process on Node 4 to finish synchronizing. The File Store service status will return `is synchronizing` until it finishes. When the File Store service status returns `is running` you can proceed. ## Perform backup A full recovery of Tableau Server requires a backup portfolio that includes three components: - A backup file of the repository and file store data. This file is generated by the `tsm maintenance backup` command. - A topology and configuration export file. This file is generated by the `tsm settings export` command. - Authentication certificate, key, and keytab files. For a full description of the backup and restore process, see the Tableau Server topic, _Perform a Full Backup and Restore of Tableau Server_ ([Linux](https://help.tableau.com/current/server-linux/en-us/backup_restore.htm)). At this stage of your deployment, all relevant files and assets that are required for a full restoration are included by running the `tsm maintenance backup` and `tsm settings export` commands. 1. Run the following command to export the configuration and topology settings to a file called `ts_settings_backup.json` tsm settings export -f ts\_settings\_backup.json 2. Run the following command to create a backup of the repository and file store data in a file named `ts_backup-.tsbak`. Ignore the warning about the file store not being on the controller node. tsm maintenance backup -f ts\_backup -d --skip-compression Location of backup file: `/data/tableau_data/data/tabsvc/files/backups/` 3. Copy both files and save them on a different storage asset that is not shared by your Tableau Server deployment. [Skip to main content](#main-content) # Part 5 - Configuring Web Tier **Note**: Tableau no longer updates the Enterprise Deployment Guide. Although we still recommend the reference architecture described here as a valid deployment model for Tableau Server in AWS, specific configuration procedures may have changed since the last update. Always cross-reference these steps with the latest [Tableau Server Help](https://help.tableau.com/current/server/en-us/get_started_server.htm) documentation to ensure accuracy. The web tier of the reference architecture should include the following components: - A web-facing application load balancer that accepts HTTPS requests from Tableau clients and communicates with the reverse proxy servers. - Reverse proxy:  - We recommend deploying the Tableau Server Independent Gateway. - We recommend a minimum of two proxy servers for redundancy and to handle client load. - Receives HTTPS traffic from load balancer. - Supports sticky session to Tableau host. - Configure proxy for round robin load balancing to each Tableau Server running the Gateway process. - Handles authentication requests from external IdP. - Forward proxy: Tableau Server requires access to the internet for licensing and map functionality. You must configure forward proxy safelists for Tableau service URLs. See _Communicating with the Internet_ ([Linux](https://help.tableau.com/current/server-linux/en-us/plan_network.htm)). - All client-related traffic may be encrypted over HTTPS: - Client to application load balancer - Application load balancer to reverse proxy servers - Proxy server to Tableau Server - Authentication handler running on reverse proxy to IdP - Tableau Server to IdP ### Tableau Server Independent Gateway Tableau Server version 2022.1 introduced the Tableau Server Independent Gateway. The Independent Gateway is a standalone instance of the Tableau Gateway process that serves as a Tableau-aware reverse proxy. Independent Gateway supports simple round robin load balancing to the backend Tableau Servers. However, Independent Gateway is not intended to serve as the enterprise application load balancer. We recommend running Independent Gateway behind an enterprise-class application load balancer. The Independent Gateway requires an Advanced Management license. ## Authentication and authorization The default reference architecture specifies installing Tableau Server with local authentication configured. In this model, clients must connect to Tableau Server to be authenticated by the native Tableau Server local authentication process. We do not recommend using this authentication method in the reference architecture because the scenario requires that unauthenticated clients communicate into the application tier, which is a security risk. Instead, we recommend configuring an enterprise grade external identity provider coupled with an AuthN module to pre-authenticate all traffic to the application tier. When configured with an external IdP, the native Tableau Server local authentication process is not used. Tableau Server authorizes access to resources in the deployment after the IdP has authenticated the users. ### Pre-authentication with an AuthN module In the example documented in this Guide, SAML SSO is configured, but the pre-authentication process can be configured with most external identity providers and an AuthN module. In the reference architecture the reverse proxy is configured to create a client authentication session with the IdP before proxying those request to Tableau Server. We refer to this process as the _pre-auth_ phase. The reverse proxy will only redirect authenticated client sessions to Tableau Server. Tableau Server will then create a session, verify authentication of the session with the IdP, and then return the client request. The following diagram shows the step-by-step detail of the pre-auth and authentication process with an AuthN module configured. The reverse proxy may be a generic 3rd party solution or the Tableau Server Independent Gateway: ![The steps shown in the above diagram. Step 1: The Tableau client requests a resource on Tableau Server. Step 2: The reverse proxy creates an authentication request with a URL redirection to the identity provider. Step 3: The identity provider sends a login form to the the user. Step 4: The user is prompted and enters credentials. Step 5: The identity provider verifies credentials submitted by the user. Step 6: The identity provider repsonds to the client with the embedded SAML assertion that posts to the reverse proxy service provider. Step 7: The service provider on the proxy validates the assertion, creates a session, and then redirects to the service provider on Tableau Server. Step 8: The service provider on Tableau Server creates the authentication request to the identity provider. Step 9: The identity provider validates the current session. Step 10: The servive provider on Tableau Server validates and creates its own session and sends the response to the user. Step 11: The user connects to Tableau Server for authorization to the specified resource.](/tableau/current/en-us/guides/enterprise-deployment/en-us/Img/pixel-transparent.png) ## Configuration overview This is an overview of the process to configure the web tier. Verify connectivity after each step: 1. Configure two reverse proxies to provide HTTP access to Tableau Server. 2. Configure load balancing logic with sticky sessions on proxy servers to connect to each Tableau Server instance running the Gateway process. 3. Configure application load balancing with sticky sessions at the internet gateway to forward requests to the reverse proxy servers. 4. Configure authentication with an external IdP. You can configure SSO or SAML by installing an authentication handler on the reverse proxy servers. The AuthN module manages the authentication handshake between the external IdP and your Tableau deployment. Tableau will also act as an IdP service provider and authenticate users with the IdP. 5. To authenticate with Tableau Desktop in this deployment, your clients must be running Tableau Desktop 2021.2.1 or later. ## Example web tier configuration with Tableau Server Independent Gateway The remainder of this topic provides an end-to-end procedure that describes how to implement web tier in the example AWS reference architecture using Tableau Server Independent Gateway. For an example configuration using Apache as reverse proxy, see [Appendix - Web Tier with Apache Example Deployment](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part_app-apache.htm). The example configuration is composed of the following components: - AWS application load balancer - Tableau Server Independent Gateway - Mellon authentication module - Okta IdP - SAML authentication **Note**: The example web tier configuration presented in this section includes detailed procedures for deploying third party software and services. We've made a best effort to verify and document the procedures to enable the web tier scenario. However, the third-party software may change or your scenario may differ from the reference architecture described here. Please refer to third-party documentation for authoritative configuration details and support. The Linux examples throughout this section show commands for RHEL-like distributions. Specifically the commands here have been developed with the Amazon Linux 2 distribution. If you are running the Ubuntu distribution, edit the commands accordingly. Deploying the web tier in this example follows a stepwise configuration and verification procedure. The core web tier configuration consists of the following steps to enable HTTP between Tableau and the internet. Independent Gateway is run and configured for reverse proxy/load balancing behind the AWS application load balancer: 1. Prepare environment 2. Install Independent Gateway 3. Configure Independent Gateway Server 4. Configure AWS application load balancer After the web tier is set up and connectivity with Tableau is verified, configure authentication with an external provider. ### Prepare Environment Complete the following tasks before you deploy Independent Gateway. 1. AWS Security group changes. Configure the Public security group to allow inbound Independent Gateway housekeeping traffic (TCP 21319) from the Private security group. 2. Install version 22.1.1 (or later) on four node Tableau Server cluster as documented at [Part 4 - Installing and Configuring Tableau Server](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm). 3. Configure the two proxy EC2 instances in the Public security group as documented at [Configure host computers](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part3.htm#Install). ### Install Independent Gateway Tableau Server Independent Gateway requires an Advanced Management license. Deploying Tableau Server Independent Gateway consists of installing and running the .rpm package and then configuring initial state. The procedure included with this Guide provides prescriptive guidance for deploying into the reference architecture. If your deployment differs from the reference architecture, consult the core Tableau Server documentation, _Install Tableau Server with Independent Gateway_ ([Linux](https://help.tableau.com/current/server-linux/en-us/server_tsig_new_install.htm)). **Important**: Configuring Independent Gateway can be an error prone process. It is very difficult to troubleshoot configuration issues across two instances of Independent Gateway servers. For this reason, we recommend configuring one Independent Gateway server at a time. After you configure the first server and verify functionality, you should then configure the second Independent Gateway server. Although you will configure each Independent Gateway server separately, run this installation procedure on both EC2 instances that you installed into the Public security group:  1. Run update to apply latest fixes to the Linux OS: sudo yum update 2. If Apache is installed, remove it: sudo yum remove httpd 3. Copy the version 2022.1.1 (or later) Independent Gateway installation package from [Tableau Downloads page](https://www.tableau.com/support/releases/server) to the host computer that will be running Tableau Server. For example, on a computer running Linux RHEL-like operating system, run wget https://downloads.tableau.com/esdalt/2022/tableau-server-tsig-.x86\_64.rpm 4. Run the installation program. For example, on a Linux RHEL-like operating system, run: sudo yum install .x86\_64.rpm 5. Change to the `/opt/tableau/tableau_tsig/packages/scripts./` directory and run the `initialize-tsig` script located there. In addition to the `--accepteula` flag, you must include the IP range of the subnets where the Tableau Server deployment is running. Use the `-c` option to specify the IP range. The example below shows the command with the example AWS subnets specified: sudo ./initialize-tsig --accepteula -c "ip 10.0.30.0/24 10.0.31.0/24" 6. After initialization is complete, open the `tsighk-auth.conf` file and copy the authentication secret in the file. You will need to submit this code for each Independent Gateway instance as part of the back-end Tableau Server configuration: sudo less /var/opt/tableau/tableau\_tsig/config/tsighk-auth.conf 7. After you have run the previous steps on the both instances of the Independent Gateway, prepare the `tsig.json` configuration file. The configuration file consists of an "independentGateways" array. The array holds configuration objects that each define connection details for an Independent Gateway instance. Copy the following the JSON and customize it according to your deployment environment. The example here shows a file for a sample AWS reference architecture. The example JSON file below only includes connection information for one Independent Gateway. Later in the process, you will include the connection information for the second Independent Gateway server. Save the file as `tsig.json` for the procedures that follow. { "independentGateways": \[ { "id": "ip-10-0-1-169.ec2.internal", "host": "ip-10-0-1-169.ec2.internal", "port": "21319", "protocol" : "http", "authsecret": "13660-27118-29070-25482-9518-22453" }\] } - `"id"` - The private DNS name of the AWS EC2 instance running Independent Gateway. - `"host"` - same as `"id"`. - `"port"` - The housekeeping port, by default, `"21319"`. - `"protocol"` - The protocol for client traffic. Leave this as `http` for the initial configuration. - `"authsecret"` - The secret that you copied in the previous step. ### Independent Gateway: direct vs relay connection Before proceeding you must decide which connection scheme to configure in your deployment: direct or relay connection. Each option is briefly described here, along with relevant decision data points. **Relay connection**: You can configure Independent Gateway to relay client communication over a single port to the gateway process on Tableau Server. We refer to this as a _relay_ connection: - The relay process results in an extra hop from Independent Gateway to the backend Tableau Server Gateway process. The extra hop degrades performance as compared to the direct connection configuration. - TLS is supported for relay mode. All communication in relay mode is restricted to a single protocol (HTTP or HTTPS) and can therefore be encrypted and authenticated with TLS. **Direct connection**: The Independent Gateway can communicate directly with the back-end Tableau Server processes over multiple ports. We refer to this communication as _direct_ connection: - Because connection is direct to backend Tableau Server, client performance is markedly improved as compared to relay connection option. - Requires opening 16+ ports from Public to Private subnets for direct process communication from Independent Gateway to Tableau Server computers. - TLS is not yet supported on the processes from Independent Gateway to Tableau Server. To run TLS between Tableau Server and Independent Gateway you must configure with a relay connection. The example scenarios in the EDG are configured with relay connection. 1. Copy `tsig.json` to Node 1 of your Tableau Server deployment. 2. On Node 1 run the following commands to enable Independent Gateway. tsm stop tsm configuration set -k gateway.tsig.proxy\_tls\_optional -v none tsm pending-changes apply tsm topology external-services gateway enable -c tsig.json tsm start Since direct connection does not support TLS, we recommend configuring direct connection only if you are able to secure all network traffic by other means. To run TLS between Tableau Server and Independent Gateway you must configure with a relay connection. The example scenarios in the EDG are configured with relay connection. If you are configuring Independent Gateway for direct connection to Tableau Server, you must enable the configuration to trigger communication. After Tableau Server communicates to the Independent Gateway, the protocol targets will be established. You must then retrieve the `proxy_targets.csv` from the Independent Gateway computer and open the corresponding ports from the Public to the Private security groups in AWS. 1. Copy `tsig.json` to Node 1 of your Tableau Server deployment. 2. On Node 1 run the following commands to enable Independent Gateway. tsm stop tsm topology external-services gateway enable -c tsig.json tsm start 3. On Independent Gateway computer run the following command to view the ports that the Tableau Server cluster is using: less /var/opt/tableau/tableau\_tsig/config/httpd/proxy\_targets.csv 4. Configure AWS security groups. Add the TCP ports listed in `proxy_targets.csv` to allow communication from the Public security group to the Private security group. We recommend automating port ingress configuration since the ports may change if the Tableau Server deployment changes. Adding nodes or reconfiguring processes on the Tableau Server deployment will trigger changes to the port access required by Independent Gateway. ### Verification: Base topology configuration You should be able to access the Tableau Server admin page by browsing to `http://`. If the Tableau Server sign-in page does not load, or if Tableau Server doesn't start then follow these troubleshooting steps: Network:  - Verify connectivity between Tableau deployment and Independent Gateway instance by running the following `wget` command from Tableau Server Node1: wget http://:21319, for example: wget http://ip-10-0-1-38:21319 If connection is refused or fails, then verify that the Public security group is configured to allow Independent Gateway housekeeping traffic (TCP 21319) from the Private security group. If security group is configured correctly, then verify you specified the correct IP addresses or IP ranges during the initialization of Independent Gateway. You can view and change this configuration in the `environment.bash` file located at `/etc/opt/tableau/tableau_tsig/environment.bash`. If you make a change to this file then restart the tsig-http service as described below. On the Proxy 1 host: 1. Overwrite the httpd.conf file with the Independent Gateway stub file: cp /var/opt/tableau/tableau\_tsig/config/httpd.conf.stub /var/opt/tableau/tableau\_tsig/config/httpd.conf 2. Restart tsig-httpd as a first troubleshooting step: sudo su - tableau-tsig systemctl --user restart tsig-httpd exit On Tableau Node 1 - Double-check the `tsig.json` file. If you find errors, fix them, and then run `tsm topology external-services gateway update -c tsig.json`. - If running direct connection, verify the TCP ports listed in `proxy_targets.csv` are configured as ingress ports from Public to Private security groups. ### Configure AWS application load balancer Configure the load balancer as an HTTP listener. The procedure here describes how to add a load balancer in AWS. #### Step 1: Create target group A target group is an AWS configuration that defines the EC2 instances running your proxy servers. These are the targets for traffic from the LBS. 1. EC2>Target groups > Create target group 2. On Create page: - Enter a target group name, for example `TG-internal-HTTP` - Target type: Instances - Protocol: HTTP - Port: 80 - VPC: Select your VPC - Under Health checks > Advanced health checks settings > Success codes, append the code list to read: `200,303`. - Click Create 3. Select the target group that you just created, and then click the Targets tab:  - Click Edit. - Select the EC2 instances (or single instance if you are configuring one at a time) that are running proxy application, and then click Add to registered. - Click Save. #### Step 2: Launch load balancer wizard 1. EC2> Load Balancers > Create Load Balancer 2. On "Select load balancer type" page, create an Application Load Balancer. **Note**: The UI that is displayed to configure load balancer is not consistent across AWS datacenters. The procedure below, "Wizard configuration," maps to the AWS configuration wizard that begins with **Step 1 Configure Load Balancer**.  If your datacenter displays all configurations in a single page that includes a **Create load balancer** button at the bottom of the page, then follow the "Single page configuration" procedure below. 1. Configure load balancer page: - Specify name - Scheme: internet-facing (default) - IP address type: ipv4 (default) - Listeners (Listeners and routing): 1. Leave the default HTTP listener 2. Click Add listener and add `HTTPS:443` - VPC: select the VPC where you've installed everything - Availability Zones: - Select the **a** and **b** for your datacenter regions - In each corresponding drop-down selector, select the Public subnet (where your proxy servers reside). - Click: Configure Security Settings 2. Configure Security Settings page - Upload your public SSL certificate. - Click Next: Configure Security Groups. 3. Configure Security Groups page: - Select the Public security group. If the Default security group is selected, then clear that selection. - Click Next: Configure Routing. 4. Configure Routing page - Target group: Existing target group. - Name: Select target group that you created earlier - Click Next: Register Targets. 5. Register Targets page - The two proxy server instances that you configured previously should be displayed. - Click Next: Review. 6. Review page Click Create. Basic configuration - Specify name - Scheme: internet-facing (default) - IP address type: ipv4 (default) Network mapping - VPC: select the VPC where you've installed everything - Mappings: - Select the **a** and **b** (or comparable) Availability Zones for your datacenter regions - In each corresponding drop-down selector, select the Public subnet (where your proxy servers reside). Security groups - Select the Public security group. If the Default security group is selected, then clear that selection. Listeners and routing - Leave the default HTTP listener. For Default action, specify the Target Group that you previously set up. - Click Add listener and add `HTTPS:443`. For Default action, specify the Target Group that you previously set up. Secure listener settings - Upload your public SSL certificate. Click Create load balancer. #### Step 3: Enable stickiness 1. After the load balancer is created, you must enable stickiness on the Target Group. - Open AWS Target Group page (EC2\> Load Balancing\> Target groups), select the target group instance that you just set up. On the Action menu, select Edit attributes. - On the Edit attributes page, select Stickiness, specify a duration of `1 day`, and then Save changes. 2. On load balancer, enable stickiness on the HTTP listener. Select the load balancer you just configured, and then click the Listeners tab: - For HTTP:80, click View/edit rules. On the resulting Rules page, click the edit icon (once at the top of the page, and then again by the rule) to edit the rule. Delete the existing THEN rule and replace it by clicking Add action > Forward to.... In the resulting THEN configuration, specify the same target group you have created. Under Group-level stickiness, enable stickiness and set duration to 1 day. Save the setting and then click Update. #### Step 4: Set idle timeout on load balancer On load balancer, update idle timeout to 400 seconds. Select the load balancer you have configured for this deployment, and then click Actions > Edit attributes. Set Idle timeout to `400` seconds, and then click Save. #### Step 5: Verify LBS connectivity Open AWS Load Balancer page (EC2\> Load Balancers), select the load balancer instance that you just set up. Under Description, copy the DNS name and paste it into a browser to access the Tableau Server sign in page. If you get a 500-level error, then you may need to restart your proxy servers. ### Update DNS with public Tableau URL Use your domain DNS zone name from the AWS Load Balancer description to create a CNAME value in your DNS. Traffic to your URL (tableau.example.com) should be sent to the AWS public DNS name. ### Verify connectivity After your DNS updates are finished, you should be able to navigate to the Tableau Server sign-in page by entering your public URL, for example, `https://tableau.example.com`. ## Example authentication configuration: SAML with external IdP The following example describes how to setup and configure SAML with Okta IdP and Mellon authentication module for a Tableau deployment running in the AWS reference architecture. This example picks up from the previous section and assumes that you are configuring one Independent Gateway at a time. The example describes how to configure Tableau Server and Independent Gateway over HTTP. Okta will send request to the AWS load balancer over HTTPS, but all internal traffic will travel over HTTP. As you configure for this scenario, be aware of the HTTP vs HTTPS protocols when setting URL strings. This example uses Mellon as a pre-authentication service provider module on the Independent Gateway servers. This configuration ensures that only authenticated traffic connects to Tableau Server, which also acts as a service provider with the Okta IdP. Therefore, you must configure two IdP applications: one for the Mellon service provider and one for the Tableau service provider. ### Create Tableau administrator account A common mistake when configuring SAML is to forget to create an administrator account on Tableau Server before enabling SSO. The first step is to create an account on Tableau Server with a Server Administrator role. For the example Okta scenario, the username must be in a valid email address format, for example, user@example.com. You must set a password for this user, but the password will not be used after SAML is configured. ### Configure Okta pre-auth application The end-to-end scenario described in this section requires two Okta applications: - Okta pre-auth application - Okta Tableau Server application Each of these applications are associated with different metadata that you will need to configure on the reverse proxy and Tableau Server, respectively. This procedure describes how to create and configure the Okta pre-auth application. Later in this topic you will create the Okta Tableau Server application. For a free test Okta account with limited users, see the [Okta Developer web page](https://developer.okta.com/signup/). Create a SAML app integration for the Mellon pre-authentication service provider. 1. Open the Okta administration dashboard > Applications \> Create App Integration. 2. On Create a new app integration page, select SAML 2.0 and then click Next. 3. On the General Settings tab, enter an App name, for example `Tableau Pre-Auth`, and then click Next. 4. On the Configure SAML tab: - Single sign on (SSO) URL. The final element of the path in the single sign on URL is referred to as the `MellonEndpointPath` in the `mellon.conf` configuration file that follows later in this procedure. You can specify whatever endpoint you would like. In this example, `sso` is the endpoint. The last element, `postResponse`, is required: `https://tableau.example.com/sso/postResponse`. - Clear the checkbox: Use this for Recipient URL and Destination URL. - Recipient URL: Same as SSO URL, but with HTTP. For example, `http://tableau.example.com/sso/postResponse`. - Destination URL: same as SSO URL, but with HTTP. For example, `http://tableau.example.com/sso/postResponse`. - Audience URI (SP Entity ID). For example, `https://tableau.example.com`. - Name ID format: `EmailAddress` - Application username: `Email` - Attributes Statements: Name = `mail`; Name format = `Unspecified`; Value = `user.email`. Click Next. 5. On the Feedback tab, select: - I'm an Okta customer adding an internal app - This is an internal app that we have created - Click Finish. 6. Create the pre-auth IdP metadata file: - In Okta: Applications \> Applications \> Your new application (e.g., `Tableau Pre-Auth`) > Sign On - Adjacent to SAML Signing Certificates, click View SAML setup instructions. - On the How to Configure SAML 2.0 for Application, page, scroll down to Optional section, Provide the following IDP metadata to your SP provider. - Copy the contents of the XML field and save them in a file called `pre-auth_idp_metadata.xml`. 7. (Optional) Configure multifactor authentication: - In Okta: Applications \> Applications \> Your new application (e.g., `Tableau Pre-Auth`) > Sign On - Under Sign On Policy, click Add Rule. - On the App Sign On Rule, specify a name and the different MFA options. To test functionality, you can leave all options as default. However, under Actions, you must select, Prompt for factor, and then specify how often users must sign in. Click Save. ### Create and assign Okta user 1. In Okta, create a user with the same username that you created in Tableau (user@example.com): Directory \> People \> Add person. 2. After the user is created, assign the new Okta app to that person: Click the user name then assign the application in Assign Application. ### Install Mellon for pre-auth This example uses mod\_auth\_mellon, a popular open source module. Some Linux distributions package obsolete mod\_auth\_mellon versions from an older repository. Those obsolete versions may contain unknown security vulnerabilities or functional problems. If you choose to use mod\_auth\_mellon, check that you are using a current version. The mod\_auth\_mellon module is third-party software. We've made a best effort to verify and document the procedures to enable this scenario. However, third-party software may change or your scenario may differ from the reference architecture described here. Please refer to third-party documentation for authoritative configuration details and support. 1. On the active EC2 instance that is running Independent Gateway, install a current version of the Mellon authentication module. 2. Create the `/etc/mellon` directory: sudo mkdir /etc/mellon ### Configure Mellon as pre-auth module Run this procedure on the first instacee of Independent Gateway. You must have a copy of `pre-auth_idp_metadata.xml` file that you created from the Okta configuration. 1. Change directory: cd /etc/mellon 2. Create the service provider metadata. Run the `mellon_create_metadata.sh` script. You must include the entity ID and the return URL for your organization in the command. The return URL is referred to as the _single sign on URL_ in Okta. The final element of the path in the return URL is referred to as the `MellonEndpointPath` in the `mellon.conf` configuration file that follows later in this procedure. In this example, we specify `sso` as the endpoint path. For example: sudo /usr/libexec/mod\_auth\_mellon/mellon\_create\_metadata.sh https://tableau.example.com "https://tableau.example.com/sso" The script returns the service provider certificate, key, and metadata files. 3. Rename the service provider files in the `mellon` directory for easier readability. We will refer to these files by the following names in the documentation: sudo mv \*.key mellon.key sudo mv \*.cert mellon.cert sudo mv \*.xml sp\_metadata.xml 4. Copy the `pre-auth_idp_metadata.xml` file to the same directory. 5. Change ownership and permissions on all files in `/etc/mellon` directory: sudo chown tableau-tsig mellon.key sudo chown tableau-tsig mellon.cert sudo chown tableau-tsig sp\_metadata.xml sudo chown tableau-tsig pre-auth\_idp\_metadata.xml sudo chmod +r \* mellon.key sudo chmod +r \* mellon.cert sudo chmod +r \* sp\_metadata.xml sudo chmod +r \* pre-auth\_idp\_metadata.xml 6. Create the `/etc/mellon/conf.d` directory: sudo mkdir /etc/mellon/conf.d 7. Create the `global.conf` file in the `/etc/mellon/conf.d` directory. Copy the file contents as shown below, but update `MellonCookieDomain` with your root domain name. For example, if domain name for Tableau is `tableau.example.com`, enter `example.com` for the root domain. AuthType Mellon MellonEnable auth Require valid-user MellonCookieDomain MellonSPPrivateKeyFile /etc/mellon/mellon.key MellonSPCertFile /etc/mellon/mellon.cert MellonSPMetadataFile /etc/mellon/sp\_metadata.xml MellonIdPMetadataFile /etc/mellon/pre-auth\_idp\_metadata.xml MellonEndpointPath /sso MellonEnable Off 8. Create the `mellonmod.conf` file in the `/etc/mellon/conf.d` directory. This file holds a single directive that specifies the location of the `mod_auth_mellon.so` file. The location in the example here is the default location of the file. Verify that the file is in this location, or change the path in this directive to match the actual location of `mod_auth_mellon.so`: LoadModule auth\_mellon\_module /usr/lib64/httpd/modules/mod\_auth\_mellon.so ### Create Tableau Server application in Okta 1. In Okta dashboard: Applications \> Applications \> Browse App Catalog 2. In Browse App Integration Catalog, search `Tableau`, select the Tableau Server tile, and then click Add. 3. On Add Tableau Server > General Settings, enter a Label, and then click Next. 4. In Sign-On Options, select SAML 2.0, and then scroll down to Advanced Sign-on Settings: - SAML Entity ID: enter the public URL, for example, https://tableau.example.com. - Application user name format: Email 5. Click the Identity Provider metadata link, to launch a browser. Copy the browser link. This is the link you will use when you configure Tableau in the procedure that follows. 6. Click Done. 7. Assign the new Tableau Server Okta app to your user (user@example.com): Click the user name then assign the application in Assign Application. ### Set authentication module configuration on Tableau Server Run the following commands on Tableau Server Node 1. These commands specify the file locations for the Mellon configuration files on the remote Independent Gateway computer. Double-check that the file paths specified in these commands map to the paths and file location on the remote Independent Gateway computer. tsm configuration set -k gateway.tsig.authn\_module\_block -v "/etc/mellon/conf.d/mellonmod.conf" --force-keys tsm configuration set -k gateway.tsig.authn\_global\_block -v "/etc/mellon/conf.d/global.conf" --force-keys To reduce downtime, do not apply changes until you have enabled SAML as described in the next section. ### Enable SAML on Tableau Server for IdP Run this procedure on Tableau Server Node 1. 1. Download the Tableau Server application metadata from Okta. Use the link that you saved from the previous procedure: wget https://dev-66144217.okta.com/app/exk1egxgt1fhjkSeS5d7/sso/saml/metadata -O idp\_metadata.xml 2. Copy a TLS certificate and related key file to the Tableau Server. The key file must be an RSA key. For more information about SAML certificate and IdP requirements, see _SAML Requirements_ ([Linux](https://help.tableau.com/current/server-linux/en-us/saml_requ.htm)). To simplify certificate management and deployment, and as a security best practice, we recommend using certificates generated by a major trusted-third party certificate authority (CA). Alternatively, you may generate self-signed certificates or use certificates from a PKI for TLS. If you do not have a TLS certificate, you can generate a self-signed certificate using the embedded procedure below. Generate a self-signed certificate Run this procedure onTableau Server Node 1. 1. Generate signing root certificate authority (CA) key: openssl genrsa -out rootCAKey-saml.pem 2048 2. Create the root CA certificate: openssl req -x509 -sha256 -new -nodes -key rootCAKey-saml.pem -days 3650 -out rootCACert-saml.pem You will be prompted to enter values for the certificate fields. For example: Country Name (2 letter code) \[XX\]:US State or Province Name (full name) \[\]:Washington Locality Name (eg, city) \[Default City\]:Seattle Organization Name (eg, company) \[Default Company Ltd\]:Tableau Organizational Unit Name (eg, section) \[\]:Operations Common Name (eg, your name or your server's hostname) \[\]:tableau.example.com Email Address \[\]:example@tableau.com 3. Create the certificate and related key (`server-saml.csr`and `server-saml.key` in the example below). The subject name for the certificate must match the public host name of the Tableau host. The subject name is set with the `-subj` option with the format `"/CN="`, for example: openssl req -new -nodes -text -out server-saml.csr -keyout server-saml.key -subj "/CN=tableau.example.com" 4. Sign the new certificate with the CA certificate that you created above. The following command also outputs the certificate in the `crt` format: openssl x509 -req -in server-saml.csr -days 3650 -CA rootCACert-saml.pem -CAkey rootCAKey-saml.pem -CAcreateserial -out server-saml.crt 5. Convert the key file to RSA. Tableau requires an RSA key file for SAML. To convert the key, run the following command: openssl rsa -in server-saml.key -out server-saml-rsa.key 3. Configure SAML. Run the following command, specifying your entity ID and return URL, and the paths to the metadata file, certificate file, and key file: tsm authentication saml configure --idp-entity-id "https://tableau.example.com" --idp-return-url "https://tableau.example.com" --idp-metadata idp\_metadata.xml --cert-file "server-saml.crt" --key-file "server-saml-rsa.key" tsm authentication saml enable 4. If your organization is running Tableau Desktop 2021.4 or later, then you must run the following command to enable authentication through the reverse proxy servers. Versions of Tableau Desktop 2021.2.1 - 2021.3 will work without running this command, provided that your pre-authentication module (e.g., Mellon) is configured to allow top-level domain cookie preservation. tsm configuration set -k features.ExternalBrowserOAuth -v false 5. Apply configuration changes: tsm pending-changes apply #### Restart tsig-httpd service As your Tableau Server deployment applies changes, sign back into the Tableau Server Independent Gateway computer and run the following commands to restart the tsig-httpd service: sudo su - tableau-tsig systemctl --user restart tsig-httpd exit ### Validate SAML functionality To validate end-to-end SAML functionality, sign-in to Tableau Server with the public URL (e.g., https://tableau.example.com) with the Tableau admin account that you created at the beginning of this procedure. If TSM doesn't start ("gateway error") or if you get browser errors when you attempt to connect, see [Troubleshooting Tableau Server Independent Gateway](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part7.htm#Troubles). ## Configure authentication module on second instance of Independent Gateway After you have successfully configured the first instance of Independent Gateway, deploy the second instance. The example here is the final process for installing the AWS/Mellon/Okta scenario described in this topic. The procedure assumes that you have already installed Independent Gateway on the second instance as described in this topic previously ([Install Independent Gateway](#Install)). The process for deploying the second Independent Gateway requires the following steps: 1. On the second instance of Independent Gateway: Install the Mellon auth module. Do not configure the Mellon auth module as described earlier in this topic. Instead, you must clone the configuration as described in the subsequent steps. 2. On the configured (first) instance of Independent Gateway: Take a tar copy of the existing Mellon configuration. The tar backup will preserve all directory hierarchy and permissions. Run the following commands: cd /etc sudo tar -cvf mellon.tar mellon Copy `mellon.tar` to the second instance of Independent Gateway. 3. On the second instance of Independent Gateway: Extract ("unzip") the tar file to the second instance in the `/etc` directory. Run the following commands: cd /etc sudo tar -xvf mellon.tar 4. On Node 1 of the Tableau Server deployment: Update the connection file (`tsig.json`) with the connection information from the second Independent Gateway. You will need to retrieve the authentication key as described in this topic previously ([Install Independent Gateway](#Install)). An example connection file (`tsig.json`) is shown here: { "independentGateways": \[ { "id": "ip-10-0-1-169.ec2.internal", "host": "ip-10-0-1-169.ec2.internal", "port": "21319", "protocol" : "http", "authsecret": "13660-27118-29070-25482-9518-22453" }, { "id": "ip-10-0-2-230.ec2.internal", "host": "ip-10-0-2-230.ec2.internal", "port": "21319", "protocol" : "http", "authsecret": "9055-27834-16487-27455-30409-7292" }\] } 5. On Node 1 of the Tableau Server deployment: Run the following commands to update the configuration: tsm stop tsm topology external-services gateway update -c tsig.json tsm start 6. On both instances of Independent Gateway: As Tableau Server is starting, restart the `tsig-httpd` process: sudo su - tableau-tsig systemctl --user restart tsig-httpd exit 7. In AWS EC2>Target groups: Update target group to include the EC2 instance running the second Independent Gateway instance. Select the target group that you just created, and then click the Targets tab:  - Click Edit. - Select the EC2 instance of the second Independent Gateway computer, and then click Add to registered.Click Save. [Skip to main content](#main-content) # Part 6 - Post-Installation Configuration **Note**: Tableau no longer updates the Enterprise Deployment Guide. Although we still recommend the reference architecture described here as a valid deployment model for Tableau Server in AWS, specific configuration procedures may have changed since the last update. Always cross-reference these steps with the latest [Tableau Server Help](https://help.tableau.com/current/server/en-us/get_started_server.htm) documentation to ensure accuracy. ## Configure SSL/TLS from load balancer to Tableau Server Some organizations require end-to-end encryption channel from the client to the back end service. The default reference architecture as described to this point specifies SSL from the client to the load balancer running in the web tier of your organization. This section describes how to configure SSL/TLS for Tableau Server and the Independent Gateway in the example AWS reference architecture. For a configuration example describing how to configure SSL/TLS on Apache in AWS reference architecture, see [Example: Configure SSL/TLS in AWS reference architecture](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part_app-apache.htm#Example:). At this time, TLS is not supported on the backend Tableau Server processes that run in the 8000-9000 range. To enable TLS, you must configure Independent Gateway with a relay connection to the Tableau Server. This procedure describes how to enable and configure TLS on Independent Gateway to Tableau Server, and Tableau Server to Independent Gateway. The procedure encrypts the relay traffic over HTTPS/443 and housekeeping traffic over HTTPS/21319. The Linux procedures throughout this example show commands for RHEL-like distributions. Specifically the commands here have been developed with the Amazon Linux 2 distribution. If you are running the Ubuntu distribution, edit the commands accordingly. The guidance here is prescriptive to the specific AWS example reference architecture as presented in this Guide. Therefore, optional configurations are not included. For full reference documentation, see _Configure TLS on Independent Gateway_ ([Linux](https://help.tableau.com/current/server-linux/en-us/server_tsig_configure_tls.htm)). ### Before you configure TLS Perform the TLS configurations outside of business hours. Configuration requires at least one restart of Tableau Server. If you are running a full four-node reference architecture deployment, then restarting can take a while. - Verify that clients can connect to Tableau Server over HTTP. Configuring TLS with Independent Gateway is a multi-step process and may require troubleshooting. Therefore, we recommend starting with a fully operational Tableau Server deployment before configuring TLS. - Collect TLS/SSL certificates, keys, and related assets. You will need SSL certificates for the Independent Gateways and for Tableau Server. To simplify certificate management and deployment, and as a security best practice, we recommend using certificates generated by a major trusted-third party certificate authority (CA). Alternatively, you may generate self-signed certificates or use certificates from a PKI for TLS. The example configuration in this topic uses the following asset names by way of illustration: - `tsig-ssl.crt`: The TLS/SSL certificate for Independent Gateway. - `tsig-ssl.key`: The private key for `tsig-ssl.crt` on Independent Gateway. - `ts-ssl.crt`: The TLS/SSL certificate for Tableau Server. - `ts-ssl.key`: The private key for `tsig-ssl.crt` on Tableau Server. - `tableau-server-CA.pem`: The root certificate for the CA that generates the certificates for the Tableau Server computers. This certificate is generally not required if you are using certificates from major trusted-third parties. - `rootTSIG-CACert.pem`: The root certificate for the CA that generates the certificates for the Independent Gateway computers. This certificate is generally not required if you are using certificates from major trusted-third parties. - There are other certificates and key file assets required for SAML that are detailed in Part 5 of this Guide. - If your implementation requires the use of a certificate chain file, see the Knowledge Base article, [Configure TLS on Independent Gateway when using a certificate that has a certificate chain](https://kb.tableau.com/articles/HowTo/configure-tls-on-independent-gateway-when-using-intermediate-certificate). - Verify that you have access to IdP. If you are using an IdP for authentication, you will likely need to make changes to the recipient and destination URLs at the IdP after you have configured SSL/TLS. ### Configure Independent Gateway computers for TLS Configuring TLS can be an error prone process. Since troubleshooting across two instances of Independent Gateway can be time consuming, we recommend enabling and configuring TLS on the EDG deployment with just one Independent Gateway. After you have validated that TLS works across the deployment, then configure the second Independent Gateway computer. #### Step 1: Distribute certificates and keys to Independent Gateway computer You can distribute the assets to any arbitrary directory as long as the tsig-httpd user has read access to the files. The paths to these files are referenced in other procedures. We will use the example paths under `/etc/ssl`, as shown below, throughout the topic. 1. Create directory for private key: sudo mkdir -p /etc/ssl/private 2. Copy the certificate and key files to the `/etc/ssl` paths. For example, sudo cp tsig-ssl.crt /etc/ssl/certs/ sudo cp tsig-ssl.key /etc/ssl/private/ 3. (Optional) If you are using a self-signed or PKI certificate for SSL/TLS on Tableau Server, then you must copy the CA root certificate file to the Independent Gateway computer as well. For example, sudo cp tableau-server-CA.pem /etc/ssl/certs/ #### Step 2: Update the environmental variables for TLS You must update port and protocol environmental variables for Independent Gateway configuration. Change these values by updating the file, `/etc/opt/tableau/tableau_tsig/environment.bash`, as follows : TSIG\_HK\_PROTOCOL="https" TSIG\_PORT="443" TSIG\_PROTOCOL="https" #### Step 3: Update the stub configuration file for HK protocol Manually edit the stub configuration file (`/var/opt/tableau/tableau_tsig/config/httpd.conf.stub`) to set TLS-related Apache httpd directives for the housekeeping (HK) protocol. The stub configuration file includes a block of TLS-related directives that are commented out with a `#TLS#` marker. Remove the markers from the directives as shown in the example below. Note that the example shows use of root CA certificate for the SSL certificate used on Tableau Server with the `SSLCACertificateFile` option. #TLS# SSLPassPhraseDialog exec:/path/to/file SSLEngine on #TLS# SSLHonorCipherOrder on #TLS# SSLCompression off SSLCertificateFile /etc/ssl/certs/tsig-ssl.crt SSLCertificateKeyFile /etc/ssl/private/tsig-ssl.key SSLCACertificateFile /etc/ssl/certs/tableau-server-CA.pem #TLS# SSLCARevocationFile /path/to/file These changes will be lost if you re-install Independent Gateway. We recommend making a back-up copy. #### Step 4: Copy stub file and restart the service 1. Copy the file that you updated in the last step, to update httpd.conf with the changes: cp /var/opt/tableau/tableau\_tsig/config/httpd.conf.stub /var/opt/tableau/tableau\_tsig/config/httpd.conf 2. Restart the Independent Gateway service: sudo su - tableau-tsig systemctl --user restart tsig-httpd exit After you restart, the Independent Gateway will be nonoperational until you run the next set of steps on Tableau Server. After you have completed the steps on Tableau Server, Independent Gateway will pick up changes and come online. ### Configure Tableau Server Node 1 for TLS Run these steps on Node 1 of the Tableau Server deployment. #### Step 1: Copy certificates and keys and stop TSM 1. Verify that you have the Tableau Server "external SSL" certificates and keys copied to Node 1. 2. To minimize downtime, we recommend stopping TSM, running the following steps, and then starting TSM after changes have been applied: `tsm stop` #### Step 2: Set certificate assets and enable Independent Gateway configuration 1. Specify the location of certificate and key files for Independent Gateway. These paths reference the location on the Independent Gateway computers. Note that this example assumes the same certificate and key pair are used to protect HTTPS and housekeeping traffic: tsm configuration set -k gateway.tsig.ssl.cert.file\_name -v /etc/ssl/certs/tsig-ssl.crt --force-keys tsm configuration set -k gateway.tsig.ssl.key.file\_name -v /etc/ssl/private/tsig-ssl.key --force-keys 2. Enable TLS for HTTPS and HK protocols for Independent Gateway: tsm configuration set -k gateway.tsig.ssl.enabled -v true --force-keys tsm configuration set -k gateway.tsig.hk.ssl.enabled -v true --force-keys 3. (Optional) If you are using a self-signed or PKI certificate for SSL/TLS on the Independent Gateway, then you must upload the CA root certificate file. The CA root certificate file is the root certificate that was used to generate the certificates for the Independent Gateway computers. For example, tsm security custom-cert add -c rootTSIG-CACert.pem 4. (Optional) If you are using a self-signed or PKI certificate for SSL/TLS on Tableau Server, then you must copy the CA root certificate file to the Independent Gateway `/etc/ssl/certs` directory. The CA root certificate file is the root certificate that was used to generate the certificates for the Tableau Server computers. After you have copied the certificate to the Independent Gateway, you must specify the location of the certificate on Node 1 with the following tsm command. For example, tsm configuration set -k gateway.tsig.ssl.proxy.gateway\_relay\_cluster.cacertificatefile -v /etc/ssl/certs/tableau-server-CA.pem --force-keys 5. (Optional: for testing purposes only) If you are using sharing self-signed or PKI certificates across computers and therefore the subject names on the certificates do not match the computer names, then you must disable certificate verification.  tsm configuration set -k gateway.tsig.ssl.proxy.verify -v optional\_no\_ca --force-keys #### Step 3: Enable "external SSL" for Tableau Server and apply changes 1. Enable and configure "external SSL" on Tableau Server: tsm security external-ssl enable --cert-file ts-ssl.crt --key-file ts-ssl.key 2. Apply changes. tsm pending-changes apply #### Step 4: Update the gateway configuration JSON file and start tsm 1. Update the Independent Gateway configuration file (for example, `tsig.json`) on the Tableau Server side to specify the `https` protocol for the Independent Gateway objects: "protocol" : "https", 2. Remove (or comment-out) the connection information for the second instance of Independent Gateway. Be sure to verify the JSON in an external editor before you save it. After you have configured and validated TLS for the single instance of Independent Gateway, you will update this JSON file with the connection information for the second instance of Independent Gateway. 3. Run the following command to update the Independent Gateway configuration: tsm topology external-services gateway update -c tsig.json 4. Start TSM. tsm start 5. While TSM is starting, sign in to the Independent Gateway instance and restart the `tsig-httpd` service: sudo su - tableau-tsig systemctl --user restart tsig-httpd exit ### Update IdP authentication module URLs to HTTPS If you have configured an external identity provider for Tableau, then you will likely need to update return URLs in the IdP administrative dashboard. For example, if you are using a Okta pre-auth application, you will need to update the application to use HTTPS protocol for the Recipient URL and the Destination URL. ### Configure AWS load balancer for HTTPS If you are deploying with AWS load balancer as documented in this guide, then you reconfigure the AWS load balancer to send HTTPS traffic to the computers running Independent Gateway: 1. Delete existing HTTP target group: In Target Groups, select the HTTP target group that has been configured for the load balancer, click Actions, and then click Delete. 2. Create HTTPS target group: Target groups \> Create target group - Select "Instances" - Enter a target group name, for example `TG-internal-HTTPS` - Select your VPC - Protocol: HTTPS 443 - Under Health checks > Advanced health checks settings > Success codes, append the code list to read: `200,303`. - Click Create. 3. Select the target group that you just created, and then click the Targets tab:  - Click Edit - Select the EC2 instance that is running Tableau Server Independent Gateway that you have configured, and then click Add to registered. - Click Save. 4. After the target group is created, you must enable stickiness: - Open AWS Target Group page (EC2\> Load Balancing\> Target groups), select the target group instance that you just set up. On the Action menu, select Edit attributes. - On the Edit attributes page, select Stickiness, specify a duration of `1 day`, and then Save changes. 5. On load balancer, update listener rules. Select the load balancer you have configured for this deployment, and then click the Listeners tab. - For HTTP:80, click View/edit rules. On the resulting Rules page, click the edit icon (once at the top of the page, and then again by the rule) to edit the rule. Delete the existing THEN rule and replace it by clicking Add action > Redirect to.... In the resulting THEN configuration, specify `HTTPS` and port `443` and leave the other options to default settings. Save the setting and then click Update. - For HTTPS:443, click View/edit rules. On the resulting Rules page, click the edit icon (once at the top of the page, and then again by the rule) to edit the rule. Delete the existing THEN rule and replace it by clicking Add action > Forward to.... Specify the Target group to the HTTPS group that you just created. Under Group-level stickiness, enable stickiness and set duration to 1 day. Save the setting and then click Update. 6. On load balancer, update idle timeout to 400 seconds. Select the load balancer you have configured for this deployment, and then click the Actions > Edit attributes. Set Idle timeout to `400` seconds, and then click Save. ## Validate TLS To validate TLS functionality, sign-in to Tableau Server with the public URL (e.g., https://tableau.example.com) with the Tableau admin account that you created at the beginning of this procedure. If TSM is not starting or you get other errors, see [Troubleshooting Tableau Server Independent Gateway](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part7.htm#Troubles). ## Configure second instance of Independent Gateway for SSL After you have successfully configured the first instance of Independent Gateway, deploy the second instance. The process for deploying the second Independent Gateway requires the following steps: 1. On the configured (first) instance of Independent Gateway: Copy the following files to corresponding locations on the second instance of Independent Gateway: - `/etc/ssl/certs/tsig-ssl.crt` - `/etc/ssl/private/tsig-ssl.key` (You will need to create the `private` directory on the second instance). - `/var/opt/tableau/tableau_tsig/config/httpd.conf.stub` - `/etc/opt/tableau/tableau_tsig/environment.bash` 2. On Node 1 of the Tableau Server deployment: Update the connection file (`tsig.json`) with the connection information from the second Independent Gateway. An example connection file (`tsig.json`) is shown here: { "independentGateways": \[ { "id": "ip-10-0-1-169.ec2.internal", "host": "ip-10-0-1-169.ec2.internal", "port": "21319", "protocol" : "https", "authsecret": "13660-27118-29070-25482-9518-22453" }, { "id": "ip-10-0-2-230.ec2.internal", "host": "ip-10-0-2-230.ec2.internal", "port": "21319", "protocol" : "https", "authsecret": "9055-27834-16487-27455-30409-7292" }\] } 3. On Node 1 of the Tableau Server deployment: Run the following commands to update the configuration: tsm stop tsm topology external-services gateway update -c tsig.json tsm start 4. On both instances of Independent Gateway: As Tableau Server is starting, restart the `tsig-httpd` process on both instances of Independent Gateway: sudo su - tableau-tsig systemctl --user restart tsig-httpd exit 5. In AWS EC2>Target groups: Update target group to include the EC2 instance running the second Independent Gateway instance. Select the target group that you just created, and then click the Targets tab:  - Click Edit. - Select the EC2 instance of the second Independent Gateway computer, and then click Add to registered.Click Save. ## Configure SSL for Postgres You may optionally configure SSL (TLS) for the Postgres connection for the external repository connection on Tableau Server. To simplify certificate management and deployment, and as a security best practice, we recommend using certificates generated by a major trusted-third party certificate authority (CA). Alternatively, you may generate self-signed certificates or use certificates from a PKI for TLS. This procedure describes how to use OpenSSL to generate self-signed certificate on the Postgres host on a RHEL-like Linux distribution in the example AWS reference architecture. After you generate and sign the SSL certificate, you must copy the CA certificate to the Tableau host. **On the host running Postgress:** 1. Generate signing root certificate authority (CA) key: openssl genrsa -out pgsql-rootCAKey.pem 2048 2. Create the root CA certificate: openssl req -x509 -sha256 -new -nodes -key pgsql-rootCAKey.pem -days 3650 -out pgsql-rootCACert.pem You will be prompted to enter values for the certificate fields. For example: Country Name (2 letter code) \[XX\]:US State or Province Name (full name) \[\]:Washington Locality Name (eg, city) \[Default City\]:Seattle Organization Name (eg, company) \[Default Company Ltd\]:Tableau Organizational Unit Name (eg, section) \[\]:Operations Common Name (eg, Postgres server's hostname) \[\]:ip-10-0-1-189.us-west-1.compute.internal Email Address \[\]:example@tableau.com 3. Create the certificate and related key (`server.csr`and `server.key` in the example below) for the Postgres computer. The subject name for the certificate must match the EC2 private DNS name of the Postgres host. The subject name is set with the `-subj` option with the format `"/CN="`, for example: openssl req -new -nodes -text -out server.csr -keyout server.key -subj "/CN=ip-10-0-1-189.us-west-1.compute.internal" 4. Sign the new certificate with the CA certificate that you created in step 2. The following command also outputs the certificate in the `crt` format: openssl x509 -req -in server.csr -days 3650 -CA pgsql-rootCACert.pem -CAkey pgsql-rootCAKey.pem -CAcreateserial -out server.crt 5. Copy the crt and key files to the Postgres `/var/lib/pgsql/13/data/` path: sudo cp server.crt /var/lib/pgsql/13/data/ sudo cp server.key /var/lib/pgsql/13/data/ 6. Switch to root user: sudo su 7. Set permissions on the cer and key files. Run the following commands: cd /var/lib/pgsql/13/data chown postgres.postgres server.crt chown postgres.postgres server.key chmod 0600 server.crt chmod 0600 server.key 8. Update the pg\_haba configuration file, `/var/lib/pgsql/13/data/pg_hba.conf` to specify md5 trust: Change the existing connection statements from `host all all 10.0.30.0/24 password`, and `host all all 10.0.31.0/24 password` to   `host all all 10.0.30.0/24 md5`, and  `host all all 10.0.31.0/24 md5`. 9. Update the postgresql file, `/var/lib/pgsql/13/data/postgresql.conf`, by adding this line: ssl = on 10. Exit root user mode: exit 11. Restart Postgres: sudo systemctl restart postgresql-13 ### Optional: Enable certificate trust validation on Tableau Server for Postgres SSL If you followed the installation procedure in [Part 4 - Installing and Configuring Tableau Server](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm), then Tableau Server is configured with optional SSL for the Postgres connection. This means that configuring SSL on Postgres (as described above) will result in an encrypted connection. If you want to require certificate trust validation for the connection, then you must run the following command on Tableau Server to reconfigure the Postgres host connection: tsm topology external-services repository replace-host -f .json -c CACert.pem Where `.json` is the connection file described in [Configure external Postgres](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm#Configur3). And `CACert.pem` is the CA certificate file for the SSL/TLS certificate used by Postgres. Optional: Verify SSL connectivity To verify SSL connectivity, you must: - Install the Postgres client on Tableau Server Node1. - Copy the root certificate that you created in the previous procedure to the Tableau host. - Connect to Postgres server from Node1 ### Install Postgres client on Node1 This example shows how to install version Postgres 13.4. Install the same version that you are running for the external repository. 1. On Node 1, create and edit the file, pgdg.repo, in the `/etc/yum.repos.d` path. Populate the file with the following configuration information. \[pgdg13\] name=PostgreSQL 13 for RHEL/CentOS 7 - x86\_64 baseurl=https://download.postgresql.org/pub/repos/yum/13/redhat/rhel-7-x86\_64 enabled=1 gpgcheck=0 2. Install the Postgres client: sudo yum install postgresql13-13.4-1PGDG.rhel7.x86\_64 ### Copy root certificate to Node 1 Copy the CA certificate (`pgsql-rootCACert.pem`) to the Tableau host: scp ec2-user@:/home/ec2-user/pgsql-rootCACert.pem /home/ec2-user ### Connect to Postgres host over SSL from Node 1 Run the following command from Node1, specifying the Postgres server host IP address and the root CA certificate: psql "postgresql://postgres@:5432/postgres?sslmode=verify-ca&sslrootcert=pgsql-rootCACert.pem" For example: psql "postgresql://postgres@10.0.1.189:5432/postgres?sslmode=verify-ca&sslrootcert=pgsql-rootCACert.pem" Postgres will prompt you for the password. After successful sign in, the shell will return: psql (13.4) SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off) Type "help" for help. postgres=# ## Configure SMTP and event notifications Tableau Server sends email notifications to admins and users. To enable this, you must configure Tableau Server to send mail to your email server. You must also specify the event types, thresholds, and subscription information you want sent. For the initial configuration of SMTP,and notifications we recommend that you use the configuration file template below to create a json file. You can also set any single configuration key listed below with the syntax described _tsm configuration set_ ([Linux](https://help.tableau.com/current/server-linux/en-us/cli_configuration_tsm.htm#TSMSet)). Run this procedure on Node 1 in your Tableau Server deployment: 1. Copy the following json template to a file. Customize the file with your SMTP configuration options and the subscription and alert notifications for your organization. - To see a list and description of all SMTP options see _SMTP CLI configuration reference_ ([Linux](https://help.tableau.com/current/server-linux/en-us/config_smtp.htm#config_reference)). - To see a list and description of all notification event options, see the CLI section of _Configure Server Event Notification_ ([Linux](https://help.tableau.com/current/server-linux/en-us/email.htm)). { "configKeys": { "svcmonitor.notification.smtp.server": "_SMTP server host name_", "svcmonitor.notification.smtp.send\_account": "_SMTP user name_", "svcmonitor.notification.smtp.port": 443, "svcmonitor.notification.smtp.password": "_SMTP user account password_", "svcmonitor.notification.smtp.ssl\_enabled": true, "svcmonitor.notification.smtp.from\_address": "_From email address_", "svcmonitor.notification.smtp.target\_addresses": "_To email address1,address2_", "svcmonitor.notification.smtp.canonical\_url": "_Tableau Server URL_", "backgrounder.notifications\_enabled": true, "subscriptions.enabled": true, "subscriptions.attachments\_enabled": true, "subscriptions.max\_attachment\_size\_megabytes": 150, "svcmonitor.notification.smtp.enabled": true, "features.DesktopReporting": true, "storage.monitoring.email\_enabled": true, "storage.monitoring.warning\_percent": 20, "storage.monitoring.critical\_percent": 15, "storage.monitoring.email\_interval\_min": 25, "storage.monitoring.record\_history\_enabled": true } } 2. Run the `tsm settings import -f file.json` to pass the json file to Tableau Services Manager. 3. Run the `tsm pending-changes apply` command to apply the changes. 4. Run the `tsm email test-smtp-connection` to view and verify the connection configuration. ## Install PostgreSQL driver To view admin views on Tableau Server, the PostgreSQL driver must be installed on Node1 of the Tableau Server deployment. 1. Go to the [Tableau Driver Download](https://www.tableau.com/support/drivers) page and copy the URL for the PostgreSQL jar file. 2. Run the following procedure on each node of the Tableau deployment: - Create the following file path: `sudo mkdir -p /opt/tableau/tableau_driver/jdbc` - From the new path, download the latest version of the PostgreSQL jar file. For example: `sudo wget https://downloads.tableau.com/drivers/linux/postgresql/postgresql-42.2.22.jar` 4. On the initial node, restart Tableau Server: `tsm restart` ## Configure strong password policy If you are not deploying Tableau Server with an IdP authentication solution, we recommend security hardening the default Tableau password policy. If you are deploying Tableau Server with an IdP, then you must manage password policies with the IdP. The following procedure includes json configuration for setting password policy on Tableau Server. For more information about the options below, see _Local Authentication_ ([Linux](https://help.tableau.com/current/server-linux/en-us/local_auth.htm)). 1. Copy the following json template to a file. Fill in the key values with your password policy configuration. { "configKeys": { "wgserver.localauth.policies.mustcontainletters.enabled": true, "wgserver.localauth.policies.mustcontainuppercase.enabled": true, "wgserver.localauth.policies.mustcontainnumbers.enabled": true, "wgserver.localauth.policies.mustcontainsymbols.enabled": true, "wgserver.localauth.policies.minimumpasswordlength.enabled": true, "wgserver.localauth.policies.minimumpasswordlength.value": 12, "wgserver.localauth.policies.maximumpasswordlength.enabled": false, "wgserver.localauth.policies.maximumpasswordlength.value": 255, "wgserver.localauth.passwordexpiration.enabled": true, "wgserver.localauth.passwordexpiration.days": 90, "wgserver.localauth.ratelimiting.maxbackoff.minutes": 60, "wgserver.localauth.ratelimiting.maxattempts.enabled": false, "wgserver.localauth.ratelimiting.maxattempts.value": 5, "vizportal.password\_reset": true } } 2. Run the `tsm settings import -f file.json` to pass the json file to Tableau Services Manager to configure Tableau Server. 3. Run the `tsm pending-changes apply` command to apply the changes. [Skip to main content](#main-content) # Part 7 - Validation, Tools, and Troubleshooting **Note**: Tableau no longer updates the Enterprise Deployment Guide. Although we still recommend the reference architecture described here as a valid deployment model for Tableau Server in AWS, specific configuration procedures may have changed since the last update. Always cross-reference these steps with the latest [Tableau Server Help](https://help.tableau.com/current/server/en-us/get_started_server.htm) documentation to ensure accuracy. This topic includes post-installation validation steps and troubleshooting guidance. ## Failover system validation After you have configured your deployment, we recommend running simple failover tests to validate system redundancy. We recommend running the following steps to validate failover functionality: 1. Shut down the first instance of Independent Gateway (TSIG1). All inbound traffic should route through the second instance of Independent Gateway (TSIG2). 2. Resart TSIG1 and then shut down TSIG2. All inbound traffic should route through TSIG1. 3. Restart TSIG2. 4. Shut down Tableau Server Node 1. All Vizportal/Application service traffic will fail over to Node 2. **Note** As of September 2022, Node 1 high availability was compromised on certain versions of Tableau Server 2021.4 and later. Client connections will fail if Node 1 is down. This issue has been fixed in these maintenance releases: \- 2021.4.15 and later \- 2022.1.11 and later \- 2023.1.3 and later To ensure your Tableau Server installation using ATR activations will have a 72 hour grace period after initial node failure, install or upgrade to one of these versions. For more details, see [Tableau Server HA using ATR Does Not Have a Grace Period After the Initial Node Failure](https://kb.tableau.com/articles/issue/tableau-server-ha-using-atr-does-not-have-a-grace-period-after-the-initial-node-failure "Tableau KB article on High Availability failure.") in the Tableau Knowledge Base. 5. Restart Node1 and shut down Node 2. All Vizportal/Application service traffic will fail over to Node 1. 6. Restart Node 2. In this context "shutting down" or "restarting" is done by turning off the operating system or virtual machine without attempting a graceful shut down of the application before hand. The goal is to simulate a hardware or virtual machine failure. The minimum validation step for each failover test is to authenticate with a user and perform basic view operations. You may get a "Bad Request" browser error when you attempt to sign-in after a simulated failure. You may see this error even if you clear the cache in the browser. Often this issue occurs when the browser is caching data from previous IdP session. If this error persists even after you clear the local browser cache, validate the Tableau scenario by connecting with a different browser. ## Initial node automated recovery Tableau Server version 2021.2.4 and later include an automated initial node recovery script, `auto-node-recovery`, in the scripts directory (`/app/tableau_server/packages/scripts.`). If there is a problem with the initial node and you have redundant processes on Node 2, there is no guarantee that Tableau Server will continue to run. Tableau Server may continue to run for up to 72 hours after an initial node failure, before the lack of the licensing service impacts other processes. If so, your users may be able to continue to sign in and see and use their content after the initial node fails, but you will not be able to reconfigure Tableau Server because you won't have access to the Administration Controller. Even when configured with redundant processes, it is possible that Tableau Server may not continue to function after the initial node fails. To recover initial node (Node 1) failure: 1. Sign in to Tableau Server Node 2. 2. Change to the scripts directory: cd /app/tableau\_server/packages/scripts. 3. Run the following command to launch the script: sudo ./auto-node-recovery -p node1 -n node2 -k Where `` is a comma-separated (no spaces) list of the license keys for your deployment. If you do not have access to your license keys, visit the [Tableau Customer Portal](http://customer.tableausoftware.com/?_fsi=v45oWMAM) to retrieve them. For example: sudo ./auto-node-recovery -p node1 -n node2 -k TSB4-8675-309F-TW50-9RUS,TSNM-559N-ULL6-22VE-SIEN The auto-node-recovery script will execute about 20 steps to recover services to Node 2. Each step is displayed in the terminal as the script progresses. More detailed status is logged to `/data/tableau_data/logs/app-controller-move.log`. In most environments, the script takes between 35 and 45 minutes to complete. ### Troubleshooting initial node recovery If node recovery fails, you may find running the script interactively to allow or disallow discrete steps in the process useful. For example, if the script fails part way through the process, you can review log file, make changes to the configuration, and then run the script again. By running in interactive mode, you can then skip all the steps until you get to the step that failed. To run in interactive mode, add the `-i` switch to the script argument. ### Rebuilding the failed node After you have run the script, Node 2 will be running all of the services that were formerly on the failed Node 1 host. To add in the 4 node, you need to deploy a fresh Tableau Server host with the bootstrap file and configure it as you did for the original Node 2, as specified in Part 4. See [Configure Node 2](https://help.tableau.com/current/guides/enterprise-deployment/en-us/edg_part4.htm#Configur2). ## switchto Switchto is a script from Tim that makes switching between windows easy. 1. Copy the following code into a file called `switchto` in the home directory on your bastion host. #!/bin/bash #------------------------------------------------------------------- # switchto # # Helper function to simplify SSH into the various AWS hosts when # following the Tableau Server Enterprise Deployment Guide (EDG). # # Place this file on your bastion host and provide your AWS hosts' # internal ip addresses or machine names here. # Example: readonly NODE1="10.0.3.187" # readonly NODE1="" readonly NODE2="" readonly NODE3="" readonly NODE4="" readonly PGSQL="" readonly PROXY1="" readonly PROXY2="" usage() { echo "Usage: switchto.sh \[ node1 | node2 | node3 | node4 | pgsql | proxy1 | proxy2 \]" } ip="" case $1 in node1) ip="$NODE1" ;; node2) ip="$NODE2" ;; node3) ip="$NODE3" ;; node4) ip="$NODE4" ;; pgsql) ip="$PGSQL" ;; proxy1) ip="$PROXY1" ;; proxy2) ip="$PROXY2" ;; ?) usage exit 0 ;; \*) echo "Unkown option $1." usage exit 1 ;; esac if \[\[ -z $ip \]\]; then echo "You must first edit this file to provide the ip addresses of your AWS hosts." exit 1 fi ssh -A ec2-user@$ip 3. Update the IP addresses in the script to map to your EC2 instances and then save the file. 4. Apply permissions to the script file: sudo chmod +x switchto Usage: To switch to a host, run the following command: `./switchto ` For example, to switch to Node 1, run the following command: `./switchto node1` ## Troubleshooting Tableau Server Independent Gateway Configuring Independent Gateway, Okta, Mellon, and SAML on Tableau Server can be an error prone process. The most common root cause of failures is a string error. For example, a trailing slash (`/`) on the Okta URLs specified during configuration may cause a SAML assertion-related mismatch error. This is just one example. There are many opportunities during configuration to input an incorrect string across any of the applications. ### Restart tableau-tsig service Always start (and finish) troubleshooting by restarting the tableau-tsig service on the Independent Gateway computers. Restarting this service is quick and often triggers the updated config to load from the Tableau Server. Run the following commands on the Independent Gateway computer: sudo su - tableau-tsig systemctl --user restart tsig-httpd exit ### Find incorrect strings If you have made a string error (copy/paste mistake, string truncated, etc), take time to walk through each of the settings that you configured: - Okta pre-authentication configuration. Carefully review the URLs that you have set. Look for trailing slashes. Verify HTTP vs HTTPS. - Shell history for SAML configuration on Node 1. Review the `tsm authentication saml configure` command that you ran. Verify that all of the URLs match those that you have configured in Okta. While you are reviewing shell history from Node 1, verify that the `tsm configuration set` commands that specify the Mellon configuration file paths map exactly to the file paths where you copied the files on Independent Gateway. - Mellon configuration on Independent Gateway. Review the shell history to verify that you created the metadata with the same URL string that you have configured in Okta and Tableau SAML. Verify that all the paths that are specified in`/etc/mellon/conf.d/global.conf` are correct and that the `MellonCookieDomain` is set to your root domain, not your Tableau subdomain. ### Search relevant logs If all strings appear to be set correctly, then you should inspect logs for errors. Tableau Server logs errors and events to dozens of different log files. Independent Gateway logs to a set of local files as well. We recommend inspecting these logs in the following order. #### Independent Gateway log files The default location of the Independent Gateway log files are at `/var/opt/tableau/tableau_tsig/logs`. - `access.log`: This log is useful to the extent that it has entries that show connections from the Tableau Server nodes. If you are getting gateway errors (won't start) when you attempt to start TSM, and there are no entries in the `access.log` file, then there is a core connectivity issue. Always verify AWS security group configuration as a first step. Another common issue is a typo in `tsig.json`. If you make an update to tsig.json, run `tsm stop` before running `tsm topology external-services gateway update -c tsig.json`. After tsig.json is updated, run `tsm start`. - `error.log`: Among other entries, this log includes SAML and Mellon errors. #### Tableau Server tabadminagent log file The `tabadminagent` (not `tabadmincontroller`) set of files are the only relevant log files for troubleshooting Independent Gateway-related errors. You must find where Independent Gateway errors have been logged to `tabdminagent`. These errors can be on any node, but they are only on one node. Perform the following steps on each node in the Tableau Server cluster until you find the “independent” string: 1. Locate the tabadminagent log file location on Tableau Server nodes 1-4 in EDG setup: cd /data/tableau\_data/data/tabsvc/logs/tabadminagent 2. Open latest log to read: less tabadminagent\_nodeN.log (replace N with node number) 3. Search for all instances of “Independent” and “independent” - by using the following search string: /ndependent If there are no matches, then go to next node and repeat steps 1-3. 4. When you get a match: `Shift + G` to move to bottom to get last error messages. ### Reload httpd stub file Independent Gateway manages configuration of httpd for Apache. A generic operation that will often fix transient issues is to reload the httpd stub file that seeds the underlying Apache configuration. Run the following commands on both instances of Independent Gateway. 1. Copy the stub file over to httpd.conf: cp /var/opt/tableau/tableau\_tsig/config/httpd.conf.stub /var/opt/tableau/tableau\_tsig/config/httpd.conf 2. Restart the Independent Gateway service: sudo su - tableau-tsig systemctl --user restart tsig-httpd exit ### Delete or move log files Independent Gateway logs all access events. You will need to manage log file storage to avoid filling up disk space. If your disk fills up Independent Gateway will be unable to write access events and the service will fail. The following message will be logged to error.log on Independent Gateway: (28)No space left on device: \[client 10.0.2.209:54332\] AH00646: Error writing to /var/opt/tableau/tableau\_tsig/logs/access.%Y\_%m\_%d\_%H\_%M\_%S.log This failure will result in a status of `DEGRADED` for the `external` node when you run `tsm status -v` on Tableau Node 1. The `external` node in the status output refers to Independent Gateway. To resolve this issue, delete or move the access.log files off the disk. Access.log files are stored at `/var/opt/tableau/tableau_tsig/logs`. After you have cleared the disk, restart tableau-tsig service. ### Browser errors **Bad Request**: A common error for this scenario is a "Bad Request" error from Okta. Often this issue occurs when the browser is caching data from previous Okta session. For example, if you manage the Okta applications as an Okta administrator and then attempt to access Tableau using a different Okta-enabled account, session data from the administrator data may cause the "Bad Request" error. If this error persists even after you clear the local browser cache, try validating the Tableau scenario by connecting with a different browser. Another cause of the "Bad Request" error is a typo in one of the many URLs that you enter during the Okta, Mellon, and SAML configuration processes. Check that you entered all of these without error. Often the `error.log` file on the Independent Gateway server will specify which URL is causing the error. **Not Found - The requested URL was not found on this server**: This error indicates one of many configuration errors. If the user is authenticated with Okta, and then receives this error, then it's likely that you have uploaded the Okta pre-auth application to Tableau Server when you configured SAML. Verify that you have the Okta Tableau Server application metadata configured on Tableau Server, and not the Okta pre-auth application metadata Other troubleshooting steps: - Review the Okta pre-auth application settings. Be sure HTTP vs HTTPS protocols are set as specified in this topic. - Restart tsig-httpd on both Independent Gateway servers. - Verify that `sudo apachectl configtest` returns “Syntax OK” on both Independent Gateways. - Verify that the test user is assigned to both applications in Okta. - Verify that stickiess is set on the load balancer and associated target groups. ### Verify TLS connection from Tableau Server to Independent Gateway Use the `wget` command to verify connectivity and access from Tableau Server to Independent Gateway. Variations of this command can help you understand if certificate issues are causing connection problems. For example run this `wget` command to verify the housekeeping (HK) protocol from Tableau Server: `wget https://ip-10-0-1-38.us-west-1.compute.internal:21319` Construct the URL with the same host address that you included for the host option of the tsig.json file. Specify the `https` protocol, and append the URL with the HK port `21319`. To check connectivity and ignore certificate verification: `wget https://ip-10-0-1-38.us-west-1.compute.internal:21319 --no-check-certificate` To verify root CA cert for TSIG is valid: `wget https://ip-10-0-1-38.us-west-1.compute.internal:21319 --ca-certificate=tsigRootCA.pem` If Tableau is able to communicate, then you may still get content-related errors, but you will not get connection-related errors. If Tableau is unable to connect at all, then start by verifying protocol configuration in the firewall/security groups. For example, the inbound rules for the security group where Independent Gateway resides must allow TCP 21319. [Skip to main content](#main-content) # Plan Your Migration You are in the [Tableau Cloud Manual Migration Guide.](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) This guide describes how to manually migrate Tableau Server deployments with fewer than 100 users to Tableau Cloud. This topic walks you through two important planning tasks you should complete before migrating: your data connectivity strategy and establishing your authentication mechanism. You can find a summarized list of the feature differences in the Tableau Server help topic, _Technical Considerations for Migrating from Tableau Server to Tableau Cloud_ ([Windows](https://help.tableau.com/current/server/en-us/migrate_server_to_cloud_overview.htm) | [Linux](https://help.tableau.com/current/server-linux/en-us/migrate_server_to_cloud_overview.htm)). Run the [Tableau Cloud Migration Technical Readiness Assessment](https://exchange.tableau.com/products/921) to understand if there are any use cases which may need to be adapted before migrating to Tableau Cloud. ## Learn about Tableau Cloud If you are new to Tableau Cloud, we recommend that you learn more about the platform by signing up for a [self-guided course](https://www.tableau.com/learn/training/elearning) online. These courses can serve as an introduction to Tableau Cloud and will give you some context as you plan your migration. If you are familiar with administering Tableau Server today, you'll find that many of your tasks are largely the same in Tableau Cloud. With the move to Tableau Cloud though, tasks related to deploying and managing the software will be handled by Tableau as a managed service. You can leave the upgrades to us. Head to the blog post, [Should I Move My Analytics to Tableau Cloud?](https://www.tableau.com/blog/should-i-move-my-analytics-cloud) for more details. With Tableau Cloud, you will be able to focus more of your energy on ensuring smooth data connectivity, equipping users with best practices and developing an analytics community. For more details about what managing a Tableau Cloud site involves, as well as a bunch of resources to get you started as an administrator, visit the [Tableau Cloud Site Admin](https://www.tableau.com/learn/get-started/online-admin) page. ## Planning your data strategy for Tableau Cloud Tableau Cloud can connect to dozens of data sources, but it's essential that you develop a data connectivity plan before you begin a migration. In this section we'll walk you through the best way to do that, and we'll describe the two ways Tableau Cloud connects to data. The goal at this point is to validate that you can support your current data requirements after your migration to Tableau Cloud. ### Cleaning house: Does your content give you joy? Before you begin to evaluate the various data types and how you'll migrate all of your data sources, workbooks, and projects into Tableau Cloud, we recommend that you use this migration as an opportunity to do some house cleaning. Most organizations running Tableau Server for more than a year or two collect some amount of stale content: workbooks, data sources, projects and flows. We recommend taking these steps before you migrate: - You can use the _Stale Content_ ([Windows](https://help.tableau.com/current/server/en-us/adminview-stale-content.htm) | [Linux](https://help.tableau.com/current/server-linux/en-us/adminview-stale-content.htm)) admin view in Tableau Server to identify content that is no longer in use. It doesn't usually make sense to move ancient, archived content to Tableau Cloud. Let it go! - Like most organizations who have been running Tableau Server for a while, your content hierarchy and permission structure has probably "evolved" organically and probably a bit messily. As you plan the migration, develop a strategy that will optimize project, group, and permissions structures in your new Tableau Cloud site. - If you are a Tableau Data Management customer, use the tools to manage data cleaning, combining, and processing for the pending move. ### Optimize dashboard performance When it comes to performance, a good rule of thumb is that if your dashboards are slow on Tableau Server, they'll likely be slow on Tableau Cloud as well. Before you migrate, address any dashboard performance issues using the steps in [Optimize Workbook Performance](https://help.tableau.com/current/pro/desktop/en-us/performance_tips.htm). Making adjustments before migrating ensures you enjoy the same improved performance on Tableau Cloud. ### Make a list and create a data source strategy After you clean up existing content, it's time to take inventory of your data sources. The goal of this exercise is to determine how you will support users in your organization with the data sources that they are currently using. For each data source: - Cross check it with the Tableau Cloud connector table in the following section. If it's supported, you've got a direct path forward. If it's not in the table... - Cross check it with [Connectivity with Bridge](https://help.tableau.com/current/online/en-us/to_sync_local_data.htm), to determine if your data type is supported by Tableau Bridge. - If the data source is a static file, Tableau Cloud supports uploading Excel or text-based data sources (.xlsx, .csv, .tsv) directly from the browser or Tableau Desktop. The maximum file size you can upload is 1 GB. More likely, your users are connecting to these types of files in a shared, common directory. If this is the case, you can upload these files to a public cloud space such as Google Drive, Dropbox, or OneDrive, for example. Or you can use Bridge. You (or your users) can then configure Tableau Cloud to connect to these spaces for a live data connection. - Run the [Tableau Cloud Migration Technical Readiness Assessment](https://exchange.tableau.com/products/921) to understand if there are any use cases which may need to be adapted before migrating to Tableau Cloud. #### Supported Tableau Cloud connectors The following connectors are supported in Tableau Cloud

Alibaba AnalyticsDB for MySQL‡

Alibaba Data Lake Analytics‡

Amazon Athena‡

Amazon Aurora for MySQL‡

Amazon EMR Hadoop Hive‡

Amazon Redshift‡

Apache Drill‡

Azure Data Lake Storage Gen2‡

Azure Synapse Analytics (SQL Server compatible)

Box‡

Cloudera Hadoop‡

Databricks‡

Datorama by Salesforce‡

Denodo‡

Dremio by Dremio‡

Dropbox*‡

Esri Connector‡

Exasol‡

Google BigQuery*‡

Google Cloud SQL (MySQL compatible)‡§

Google Drive‡

Hortonworks Hadoop Hive

Impala‡

Kyvos‡

MariaDB‡

Microsoft Azure SQL Database‡

Microsoft Azure Synapse Analytics‡

Microsoft SQL Server‡

MongoDB BI Connector‡

MySQL‡

OData‡

OneDrive*‡

Oracle‡

Pivotal Greenplum Database‡

PostgreSQL‡

Presto‡

Qubole Presto‡

Salesforce‡

SAP HANA (for virtual connections only)‡

SharePoint Lists‡

SingleStore (formerly MemSQL)‡

Snowflake‡

Spark SQL‡

Teradata**‡

Vertica‡
\*For more information about using OAuth 2.0 standard for Google BigQuery, OneDrive, and Dropbox connections in Tableau Cloud, see [OAuth Connections](https://help.tableau.com/current/online/en-us/protected_auth.htm). \*\*Teradata web authoring currently doesn’t support query banding functionality. See [Teradata](https://help.tableau.com/current/pro/desktop/en-us/examples_teradata.htm) for details. ‡Supports virtual connections if you have Data Management. See [About Virtual Connections and Data Policies](https://help.tableau.com/current/online/en-us/dm_vconn_overview.htm) in the Tableau Cloud help for details. §Tableau Cloud doesn't support SSL using Google Cloud SQL. ## User accounts and authentication The second essential planning step is to identify the authentication mechanism you would like to use for Tableau Cloud users. The default user account on Tableau Cloud is called TableauID. TableauID requires multi-factor authentication (MFA) to ensure secure access to Tableau Cloud. See [About multi-factor authentication and Tableau Cloud](https://help.tableau.com/current/online/en-us/security_auth.htm#mfa_requirement) in the Tableau Cloud documentation. If your organization uses an identity provider (IdP) to enable authentication, you can probably use that for Tableau Cloud. We support Salesforce authentication and Google OpenID natively. You can also configure SAML for Azure, Okta, OneLogin, AD FS, PingOne, or any IdP that supports standard SAML 2.0 authentication. Before you proceed, review the Tableau Cloud [Authentication](https://help.tableau.com/current/online/en-us/security_auth.htm) options to develop a plan. If your organization manages identities with Azure AD, Okta, or OneLogin, then you can also automatically provision users and groups in Tableau Cloud. See [Automate User Provisioning and Group Synchronization through an External Identity Provider](https://help.tableau.com/current/online/en-us/scim_config_online.htm). ## Migration workflow This guide is organized according to a step-wise process for migrating to Tableau Cloud: 1. **You are here**: Plan Your Migration 2. [Create and Configure a Tableau Cloud Site](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2.htm) 3. [Migrate Virtual Connections](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2-5.htm) 4. [Migrate Data Sources, Workbooks, and Prep Flows to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part3.htm) 5. [Recreate Refresh Schedules for Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part4.htm) 6. [Configure Permission and Content Access for Migrated Users](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part5.htm) 7. [Add Remaining Users to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part6.htm) 8. [End-User Migration Checklist](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part7.htm) [Skip to main content](#main-content) # Recreate Refresh Schedules for Tableau Cloud You are in the [Tableau Cloud Manual Migration Guide.](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) This guide describes how to manually migrate Tableau Server deployments with fewer than 100 users to Tableau Cloud. ## Establish new refresh schedules for extract data sources - For extract Data Sources, navigate to the published or embedded data source in Tableau Cloud. Select Extract Refreshes > New Extract Refresh > Select an extract schedule. For data sources requiring Tableau Bridge, ensure Bridge is configured for the connection before establishing extract refreshes. See [Use Bridge for Private Cloud Data](https://help.tableau.com/current/online/en-us/to_bridge_vpc.htm). ## Establish new refresh schedules for Tableau Prep flows Scheduling flows are available to Data management customers only. - To establish new refresh schedules for Tableau Prep flow, navigate to the flow in Tableau Cloud. Select Scheduled Tasks > New Task > Select and configure the schedule. Do the same for any Linked Tasks. For more information, see [Schedule Flow Tasks](https://help.tableau.com/current/online/en-us/prep_conductor_schedule_flow_task.htm). Custom schedules for flows are not supported in Tableau Cloud. ## Migration workflow This guide is organized according to a step-wise process for migrating to Tableau Cloud: 1. [Plan Your Migration](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part1.htm) 2. [Create and Configure a Tableau Cloud Site](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2.htm) 3. [Migrate Virtual Connections](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2-5.htm) 4. [Migrate Data Sources, Workbooks, and Prep Flows to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part3.htm) 5. **You are here**: Recreate Refresh Schedules for Tableau Cloud 6. [Configure Permission and Content Access for Migrated Users](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part5.htm) 7. [Add Remaining Users to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part6.htm) 8. [End-User Migration Checklist](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part7.htm) [Skip to main content](#main-content) # Step 1: Connect to your data Your manager has asked you to look into the overall sales and profitability for the company and to identify key areas for improvement. You have a bunch of data but you aren't sure where to start. You decide to begin by downloading Tableau Desktop Free Edition. For related resources and videos, see [Connecting to Data with Tableau Desktop](https://www.tableau.com/learn/tutorials/on-demand/connecting-data-tableau-desktop?playlist=509089). ## Open Tableau Desktop and begin The first thing you see after you open Tableau Desktop is the [Start page](https://help.tableau.com/current/pro/desktop/en-us/environment_startpage.htm). Here, you select the connector Tableau needs to access your data. ![The Tableau start page](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Connect1.png) The start page has several options to choose from: **1.** **Tableau icon**. Click ![An icon of the Tableau logo](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Connect2.png) in the upper left corner of any page to toggle between the start page and the authoring workspace. **2.** **Connect pane**. - Connect to data in a file, such as Microsoft Excel, PDF, Spatial files, and more. - Connect to data in a server-based platform such as Google Drive, Amazon Redshift, Oracle, or a published data source in Tableau Cloud or Tableau Server. - Connect to a data source you’ve connected to before. Tableau supports the ability to connect to a wide variety of data stored in a wide variety of places. The Connect pane lists the most common places that you might want to connect to, or click the More links to see more options. For more on connecting to data sources, see the [Learning Library](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-next.htm) for this tutorial. **3.** Quick Start **Accelerators**: pre-built templates you can connect to your own data. **4.** Quick Start **Sample Workbooks**: sample workbooks that come with Tableau Desktop. **5.** **Open**: recently opened workbooks. **6.** **Discover**: additional resources. In the Connect pane, under Saved Data Sources, click **Sample - Superstore** to connect to the sample dataset. Superstore contains information about products, customers, and sales that you can use to identify key areas for improvement within this fictitious retail company. If you need to download the Superstore dataset it can be found on the [Tableau Public Sample Data](https://public.tableau.com/app/learn/sample-data) page, then use the Microsoft Excel connector. ![Sample - Superstore listed under "Saved Data Sources"](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Connect_Superstore.png) After you select **Sample - Superstore**, your screen will look something like this: ![A blank worksheet](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Connect4.png) Learn more: What is Tableau doing with your data? After you connect to your data, Tableau does the following: - Opens a new worksheet. This is a blank slate where you can create your first view. - Displays the data source you are connected to. If you are using multiple data sources, you can see them all listed here. - Adds columns from your data source to the **Data** pane on the left side. Columns are added as fields. - Automatically assigns data types (such as date, number, string, etc.) and roles (dimension or measure) to your data. (We'll talk more about these terms later.) If you want to see more details about your data, you can select the **Data Source** page in the bottom left corner. Here, you can view the first 1,000 rows of your data, and some analysts go nuts: Sort or hide fields, split fields into multiple columns, and rename column headers, all without modifying the original data. What happens in Tableau stays in Tableau; your data is safe. If you navigated to the **Data Source** page to check out the details, just click on the tab for **Sheet 1** to get back to where you started. For more information about the Data Source page, see the [Learning Library](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-next.htm). Learn more: Prepare your own data When you connect to your own data, you might need to do some prep work before connecting to it in Tableau. This is because Tableau makes assumptions about your data so that it can display it properly for you to work with. For more information on preparing your data, see the [Learning Library](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-next.htm). Continue to [Step 2: Drag and drop to take a first look](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-drag.htm). [Skip to main content](#main-content) # Step 2: Drag and drop to take a first look ## Create a view You set out to identify key areas for improvement, but where to start? With four years' worth of data, you decide to drill into the overall sales data to see what you find. Start by creating a simple chart. For related resources and videos, see [Navigating the Workspace in Tableau Desktop](https://www.tableau.com/learn/tutorials/on-demand/navigating-workspace-tableau-desktop?playlist=509089). Learn more: Terms in this section
Term Description
Aggregation vs Granularity

Aggregation is how row-level quantitative data is rolled up to a higher category, such as sum of sales or average profit. Tableau does this automatically so you can break data down to the level of detail that you want to work with.

Granularity means how detailed the data is—for example, dates can have a granularity of days, months, years, etc.
Dimension vs Measure

Dimensions are qualitative data, such as a name or date. By default, Tableau automatically classifies data that contains qualitative or categorical information as a dimension, for example, any field with text or Boolean (true/false) values. These fields generally appear as column headers for rows of data, such as Customer Name or Order Date, and also define the level of granularity that shows in the view.

Measures are quantitative numerical data. By default, Tableau treats any field containing this kind of data as a measure, for example, sales transactions or profit. Data that is classified as a measure can be aggregated based on a given dimension, for example, total sales by region, where sales is the measure, total (or sum) is the aggregation, and region is the dimension.
Continuous vs. Discrete

Continuous fields can contain an infinite number of values. This can be a range of values such as sales within a specific date range or quantities. Continuous fields are colored green in Tableau.

Discrete fields contain a finite number of values such as country, state, or customer name. Discrete fields are colored blue in Tableau.
**More on Dimensions and Measures** in the [Learning Library](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-next.htm). Learn more: Tableau workspace controls and elements In this section, you'll drag fields to the Columns and Rows shelves, and you'll also work with the Marks card. The image below identifies some of the workspace controls and elements that you'll use. ![An overview of workspace elements](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag28.png)
Element Description

A Undo

With Tableau, feel free to experiment with your data. You can always get back to where you started with the Undo button. Use this button to reverse the last action you performed in your workbook.

You can undo an unlimited number of times, back to the last time you opened the workbook, even after you saved your work.

B Data pane

Displays the name of the data source that is included in the view and the available fields. Fields can be grouped based on their source table or by folder.

More on the Data Pane in the Learning Library.

C and D Cards and Shelves

Cards are containers for the different controls that are available in Tableau. Shelves are a type of card control. When you drag fields from the Data pane to the Columns or Rows shelves, the data is added as a column or a row on the axes in your view.

When you drag fields from the Data pane to the Marks card, you can control visual properties like type, color, size, shape, and more. Only the marks in your view are impacted by this action; axes do not change.

More on Cards and Shelves in the Learning Library.

E Show/Hide Cards

Did you accidentally hide a card that you now need? No problem! Just about everything on the Tableau workspace can be turned on or off to provide the maximum amount of room for you to create your visualizations.

To show or hide cards like Pages, Filters or Legends, click the drop-down arrow on the Show/Hide CardsShow/Hide Cards icon button on the toolbar and clear or enable the check mark for the card.

You can even collapse the Data and Analytics pane to the lower left corner of the workspace by clicking the MinimizeMinimize Data and Analytics pane button at the top-right corner of the pane. Click the button again to restore the pane like it was.
1. From the **Data** pane, drag **Order Date** to the **Columns** shelf. **Note:** When you drag Order Date to the **Columns** shelf, Tableau creates a column for each year in your data set. Under each column is an Abc indicator. This indicates that you can drag text or numerical data here, like what you might see in an Excel spreadsheet. If you were to drag Sales to this area, Tableau creates a crosstab (like a spreadsheet) and displays the sales totals for each year. 2. From the **Data** pane, drag **Sales** to the **Rows** shelf. Tableau generates the following chart with sales rolled up as a sum (aggregated). You can see total aggregated sales for each year by order date. ![Line chart that uses Order Date for the Columns Shelf and Sum(Sales) for the Rows shelf](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag1.png) _When you first create a view that includes time (in this case Order Date), Tableau automatically generates a line chart._ This line chart shows that sales look pretty good and seem to be increasing over time. This is good information, but it doesn't really tell you much about which products have the strongest sales and if there are some products that might be performing better than others. Since you just got started, you decide to explore further and see what else you can find out. Learn more: Explore your options To quickly change the chart type, select the drop-down menu on the **Marks** card. For example, for an area chart, you can select **Area**. ![Chart types listed in the Marks menu](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag2.png) Tableau supports many different chart types, referred to as mark types. For more information, see **More on Mark Types** in the [Learning Library](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-next.htm). **Note:** Before you continue the tutorial, make sure your chart type is set back to **Automatic**. Check your work! Watch "Create a view" in action _Click the image to replay it._ **Note**: Details in this gif may not match exactly what's on your screen. ## Refine your view To gain more insight into which products drive overall sales, try adding more data. Start by adding the product categories to look at sales totals in a different way. 1. From the **Data** pane, drag **Category** to the **Columns** shelf and place it to the right of YEAR(Order Date). You might need to expand the Product hierarchy to see the Category field. Your view updates to a bar chart. By adding a second discrete dimension to the view you can categorize your data into discrete chunks instead of looking at your data continuously over time. This creates a bar chart and shows you overall sales for each product category by year. ![A bar chart that has Year(Order Date) and Category on the Columns shelf and Sum(Sales) on the Rows shelf](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag4.png) Learn more: Change your perspective To display the bar chart horizontally instead of vertically, click **Swap Rows and Columns** on the toolbar. **Note:** Undo this action before continuing the Get Started tutorial. ![A bar chart that highlights the Swap Rows and Columns icon](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag7.png) Learn more: Show me the numbers You can view or add data point information to your view. In this example, this information shows exact sales totals by category. To view information about each data point (that is, mark) in your view, hover over one of the bars to reveal a tooltip. The tooltip displays total sales for that category. Here is the tooltip for the Office Supplies category for 2025: ![A tooltip that shows Sales for Office Supplies in 2021](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag5.png) To add data point information as labels to your view, click **Show Mark Labels** on the toolbar. Below, we show the total sales for each category and year. **Note:** Undo this action before continuing the Get Started tutorial. ![A bar chart that highlights the Show Mark Labels icon](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag6.png) Your view is doing a great job showing sales by category—furniture, office supplies, and technology. An interesting insight is revealed! From this view, you can see that sales for furniture is growing faster than sales for office supplies, even though Office Supplies had a really good year in 2025. Perhaps you can recommend that your company focus sales efforts on furniture instead of office supplies? Your company sells a lot of different products in those categories, so you'll need more information before you can make a recommendation. To help answer that question, you decide to look at products by sub-category to see which items are the big sellers. For example, for the Furniture category, you want to see details about bookcases, chairs, furnishings, and tables. Looking at this data might help you gain insights into sales and later on, overall profitability, so add sub-categories to your bar chart. 1. Double-click or drag **Sub-Category** to the **Columns** shelf. **Note:** You can drag and drop or double-click a field to add it to your view, but be careful. Tableau makes assumptions about where to add that data, and it might not be placed where you expect. You can always click Undo to remove the field, or drag it off the area where Tableau placed it to start over. Sub-Category is another discrete field. It creates another header at the bottom of the view, and shows a bar for each sub-category (68 marks) broken down by category and year. ![A bar chart that shows Order Date, Category, and Sub-Category on the Columns shelf and Sum(Sales) on the Rows shelf](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag9.png) Now you are getting somewhere, but this is a lot of data to visually sort through. In the next section, you will learn how you can add color, filters, and more to focus on specific results. Learn more: Use a different view to compare product sales If you want to see how your products contribute to overall sales by category, Tableau gives you another option. If you drag the **Sub-Category** to **Color** on the Marks card, you create a stacked bar chart with additional marks for each sub-category identified by a unique color. Tableau automatically displays a legend card to the right for the Sub-Category values. **Note:** Undo this action before continuing the Get Started tutorial. ![A bar chart that shows Order Date and Category on the Columns shelf, Sum(Sales) on the Rows shelf, and Sub-Category on Color on the Marks card](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag8.png) This quickly shows you the amount of sales that each product contributes to the overall total for each category and year, and it immediately shows the large and small contributors at a glance. Sub-categories are displayed as stacked bars in the order that they are listed in the legend, not according to where they fall on the Sales axis. For example, the above view shows Bookcases at the top of each Furniture bar because Bookcases are listed above Chairs, Furnishings, and Tables in the legend. The sub-categories are displayed in the legend so that you can move them around and examine your data in a way that makes sense to you. Depending on the kind of analysis you want to do, the stacked bar chart might or might not be the chart for you. Check your work! Watch "Refine your view" in action _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. ## Step summary This step was all about getting to know your data and starting to ask questions about your data to gain insights. You learned how to: - Create a chart in a view that works for you. - Add fields to get the right level of detail in your view. Now you're ready to begin focusing on your results to identify more specific areas of concern. In the next section, you will learn how to use filters and colors to help you explore your data visually. Continue to [Step 3: Focus your results](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-focus.htm). [Skip to main content](#main-content) # Step 3: Focus your results You've created a view of product sales broken down by category and sub-category. You are starting to get somewhere, but that is a lot of data to sort through. You need to easily find the interesting data points and focus on specific results. Well, Tableau has some great options for that! Filters and colors are ways you can add more focus to the details that interest you. After you add focus to your data, you can begin to use other Tableau Desktop features to interact with that data. ## Add filters to your view You can use filters to include or exclude values in your view. In this example, you decide to add two simple filters to your worksheet to make it easier to look at product sales by sub-category for a specific year. 1. In the **Data** pane, right-click **Order Date** and select **Show Filter**. 2. Repeat the step above for the **Sub-Category** field. The filters are added to the right side of your view in the order that you selected them. Filters are card types and can be moved around on the canvas by clicking on the filter and dragging it to another location in the view. As you drag the filter, a line appears that shows you where you can drop the filter to move it. **Note**: The Get Started tutorial uses the default position of the filter cards. **More on Filtering** in the Learning Library (in the top menu). ![A bar chart with filters for Sub-Category and Order Date](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag10.png) Check your work! Watch "Apply filters to your view" in action _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. ## Add color to your view Adding filters helps you to sort through all of this data—but wow, that’s a lot of blue! It's time to do something about that. Currently, you are looking at sales totals for your various products. You can see that some products have consistently low sales, and some products might be good candidates for reducing sales efforts for those product lines. But what does overall profitability look like for your different products? Drag **Profit** to color to see what happens. From the **Data** pane, drag **Profit** to **Color** on the Marks card. By dragging profit to color, you now see that you have negative profit in Tables, Bookcases, and even Machines. Another insight is revealed! ![A bar chart with Order Date, Category, and Sub-Category on the Columns shelf; Sum(Sales) on the Rows shelf, and Sum(Profit) on Color on the Marks card](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Dragcolor1.png) **Note:** Tableau automatically added a color legend and assigned a diverging color palette because your data includes both negative and positive values. Learn more: Working with color Adding color visually enhances your view, but it can also make interesting data stand out. Tableau uses a default color palette to assign colors to the products in your view, but you aren't limited to that color palette. You have choices! If you want to use different colors than the ones shown, you can change the colors or color palette at any time. Simply click **Color** on the Marks card, and then click **Edit Colors**. You can select a different color palette in the Edit Colors dialog box that opens. **Note:** The Get Started tutorial uses the default color palette. Depending on the data in your view, the Edit Colors dialog box might show you a diverging color palette versus a categorical color palette. Diverging color palettes look like the image below. Diverging color palettes are generally assigned to continuous fields. ![Diverging color palettes listed in the Edit Colors menu](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Dragcolor2.png) If you're using a legend, it might look like the image below. Categorical color palettes like this one are generally assigned to discrete fields. ![Categorical color palettes listed in the Edit Colors menu](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Drag12.png) Check your work! Watch "Add color to your view" in action _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. ## Find key insights As you've learned, you can explore your data as you build views with Tableau Desktop. Adding filters and colors helps you better visualize your data and can identify problems right away. The next step is to interact with your view so that you can begin drawing conclusions. Looking at your view, you saw that you had some unprofitable products, but now you want to see if these products have been unprofitable year over year. It's time to use your filters to take a closer look. 1. In the view, in the **Sub-Category** filter card, clear all of the check boxes except **Bookcases**, **Machines**, and **Tables**. ![A bar chart with a diverging color palette to show profits and losses for Sub-Categories](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_FocusFilter1.png) Now you can see that, in some years, Bookcases and Machines were profitable. However, recently Machines are unprofitable. While you've made an important discovery, you want to gather more information before proposing any action items to your boss. On a hunch, you decide to break up your view by region: 2. From the **Data** pane, drag **Region** to the **Rows** shelf and place it to the left of Sum(Sales). Tableau creates a view with multiple axes broken down by region. Now you see sales and profitability by product for each region. By adding region to the view and filtering the Sub-Category, you notice that machines in the South are reporting a higher negative profit overall than in your other regions. You've discovered a hidden insight! ![Bar charts that show the profitability of the Machines Sub-Category across each region](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Focus_MachineSpike.png) This view best encapsulates your work so far. Select **All** in the **Sub-Category** filter card (if you changed your filter) to show all sub-categories again, name the worksheet, and add a title. 6. At the bottom-left of the workspace, double-click **Sheet 1** and type **Sales by Product/Region**. You choose to focus your analysis on the South, but you don't want to lose the view you've created. In Tableau Desktop, you can duplicate your worksheet to continue where you left off. 7. In your workbook, right-click the **Sales by Product/Region** sheet and select **Duplicate**. 8. Rename the duplicated sheet to **Sales in the South**. 9. In your new worksheet, from the **Data** pane, drag **Region** to the **Filters** shelf to add it as a filter in the view. 10. In the Filter Region dialog box, clear all check boxes except **South** and then click **OK**. 11. Right click on the **Region** pill on the **Rows** shelf and uncheck **Show Header**. Your view updates to look like the image below. ![A bar chart that shows the profitability of Sub-Category in the South](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_FocusSouth1.png) Now you can focus on sales and profit in the South. You immediately see that machine sales had negative profit in 2022 and again in 2025. This is definitely something to investigate! 4. Save your work by selecting **File** > **Save As**. Give your workbook a name, such as Regional Sales and Profits. Learn more: How Tableau organizes your saved workbooks When you install Tableau, it automatically creates a folder directory for you under **Documents** > **My Documents** > **My Tableau Repository**. My Tableau Repository contains multiple folders for data sources, saved workbooks, geocoding data, and more. **More on saving your workbook as different Tableau file types** in the Learning Library (in the top menu). Check your work! Watch "Find key insights" in action below _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. ## Step summary In this step you used filter and color to make working with your data a bit easier. You also learned about a few fun features that Tableau offers to help you answer key questions about your data. You learned how to: - Apply filters and color to make it easier to focus on the areas of your data that interest you the most. - Interact with your chart using the tools that Tableau provides. - Duplicate worksheets and save your changes to continue exploring your data in different ways without losing your work. Having explored your data in Tableau Desktop, you've identified areas of concern. You know sales and profit in the South are a problem, but you don't yet have a solution. You want to look at other factors that might be contributing to these results. Next, you'll leverage another key feature in Tableau to work with geographic data. Continue to [Step 4: Explore your data geographically](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-explore.htm). [Skip to main content](#main-content) # Step 4: Explore your data geographically You've built a great view that allows you to review sales and profits by product over several years. And after looking at product sales and profitability in the South, you decide to look for trends or patterns in that region. Because you're looking at geographic data (the Region field), you have the option to build a map view. Map views are great for displaying and analyzing this kind of information. Plus, they're just cool! For this example, Tableau has already assigned the proper geographic roles to the Country, State/Province, City, and Postal Code fields. That's because it recognized that each of those fields contained geographic data. You can get to work creating your map view right away. Learn more: Meet geographic roles Tableau recognizes a lot of common geographic data, such as state and city names. When Tableau recognizes this type of data, it automatically assigns fields appropriate geographic roles, so they become geographic fields. Geographic fields have globe icons ![Globe icon that identifies geographic data fields](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Explore16_24x13.png) next to them in the **Data** pane. If a field is assigned a geographic role, Tableau automatically creates a map view when you add the field to **Detail** on the Marks card. More on that later. If Tableau doesn't recognize your data as geographic, you can manually assign a geographic role to each of the relevant fields. There are several geographic roles to choose from: - Airport - Area Code (U.S.) - CBSA/MSA (U.S.) - City - Congressional District (U.S.) - Country/Region - County - NUTS Europe - State/Province - Zip Code/Postcode ![An image of manually assigning geographic roles to fields](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Explore1.png) ## Build a map view Start fresh with a new worksheet. 1. Click the **New worksheet** icon at the bottom of the workspace. ![Highlight of the New worksheet icon](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_explore17.png) Tableau keeps your previous worksheet and creates a new one so that you can continue exploring your data without losing your work. 4. In the **Data** pane, double-click **State/Province** to add it to **Detail** on the Marks card. Now you’ve got a map view! ![a symbol map of Canada and the continental US](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_explore3.png) Learn more: Double-click to add geographic fields You can double-click fields to quickly add them to the view. When you double-click a geographic field, it's automatically added to Detail on the Marks card, and a map view is created with marks for each location listed in the field. Because Tableau already knows that state names are geographic data and because the **State/Province** dimension is assigned the State/Province geographic role, Tableau automatically creates a map view. There is a mark for each of the contiguous 48 US states and the Canadian provinces in your data source. (Sadly, Alaska and Hawaii aren't included in your data source, so they are not mapped.) Notice that the **Country** field is also added to the view. This happens because the geographic fields in Sample - Superstore are part of a hierarchy. Higher levels in the hierarchy can be automatically added as a level of detail. Additionally, generated Latitude and Longitude fields are added to the Columns and Rows shelves. You can think of these as X and Y fields. They're essential any time you want to create a map view, because each location in your data is assigned a latitudinal and longitudinal value. Sometimes these fields are generated by Tableau from geographic fields in your data. Or your data may contain its own latitude and longitude values. You can find resources to learn more about this in the Learning Library. Now, having a cool map focused on the contiguous US and Canada is one thing, but you wanted to see what was happening in the South, remember? 13. Drag **Region** to the **Filters** shelf, and then filter down to the **South** only. The map view zooms in to the South region, and there is a mark for each state (11 total). Now you want to see more detailed data for this region, so you start to drag other fields to the Marks card: 15. Drag the **Sales** measure to **Color** on the Marks card. ![A map of 11 southern US states colored in various shades of blue](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_explore2.png) The view automatically updates to a filled map, and colors each state based on its total sales. Because you're exploring product sales, you want your sales to appear in USD. Click the **Sum(Sales)** field on the **Marks** card, and select **Format**. For Numbers, select **Currency**. Any time you add a continuous measure that contains positive numbers (like Sales) to Color on the Marks card, your filled map is colored blue. Negative values are assigned orange. Sometimes you might not want your map to be blue. Maybe you prefer green, or your data isn’t something that should be represented with the color blue, like wildfires or traffic jams. That would just be confusing! No need to worry, you can change the color palette just like you did before. 20. Click **Color** on the Marks card and select **Edit Colors**. For this example, you want to see which states are doing well, and which states are doing poorly in sales. 22. In the Palette drop-down list, select **Orange-Blue Diverging** and close the dialog. This allows you to see quickly the low performers and the high performers. Your view updates to look like this: ![A map with blue-orange diverging colors based on total sales for the state](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Explore5.png) But wait. There's so much orange! What happened? The data is accurate, and _technically_ you can compare low performers with high performers, but is that really the whole story? Are sales in those orange states really that terrible, or are there simply more people in Florida to buy your products? Maybe you have smaller or fewer stores in the states that appear orange. Or maybe there’s a higher population density in the states that appear blue, so there are just more people to buy your stuff. Either way, there’s no way you want to show this view to your boss because you aren't confident the data is telling a useful story. 29. Click the **Undo** icon ![Left pointing arrow icon.](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Explore22.png) in the toolbar to return to that nice, blue view. There’s still a color problem. Everything looks dandy—that’s the problem! At first glance, it appears that Florida is performing the best. Hovering over its mark reveals a total of 89,474 USD in sales, as compared to South Carolina, for example, which has only 8,482 USD in sales. However, have any of the states in the South been _profitable_? 32. Drag **Profit** to **Color** on the Marks card to see if you can answer this question. ![A map with blue-orange diverging colors based on total profits for the state](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Explore6.png) Now that’s better! Because profit often consists of both positive and negative values, Tableau automatically selects the Orange-Blue Diverging color palette to quickly show the states with negative profit and the states with positive profit. It’s now clear that Tennessee, North Carolina, and Florida have negative profit, even though it appeared they were doing okay—even great—in Sales. But why? You'll answer that in the next step. Check your work! Watch "Build a map view" in action _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. Continue to [Step 5: Drill down into the details](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-drilldown.htm). [Skip to main content](#main-content) # Step 5: Drill down into the details In the last step you discovered that Tennessee, North Carolina, and Florida have negative profit. To find out why, you decide to drill down even further and focus on what's happening in those three states alone. ## Pick up where your map view left off As you saw in the last step, maps are great for visualizing your data broadly. A bar chart will help you get into the nitty-gritty. To do this, you create another worksheet. 1. Double-click **Sheet 3** and name the worksheet **Profit Map**. 2. Right-click **Profit Map** at the bottom of the workspace and select **Duplicate** . Name the new sheet **Negative Profit Bar Chart**. 3. In the Negative Profit Bar Chart worksheet, click **Show Me**, and then select **horizontal bars**. Show Me highlights different chart types based on the data you've added to your view. **Note:** At any time, you can click **Show Me** again to collapse it. ![Highlight of the horizontal bars chart in the Show Me menu](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Explore8.png) You now have a bar chart again—just like that. ![A horizontal bars chart showing profits for states in the South region](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Explore9.png) 7. To select multiple bars on the left, click and drag your cursor across the bars between **Tennessee**, **North Carolina**, and **Florida**. On the tooltip that appears, select **Keep Only** to focus on those three states. ![A blue box showing three bars simultaneously selected](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Explore_click_and_drag.png) **Note:** You can also right-click one of the highlighted bars, and select **Keep Only**. Notice that an _Inclusions_ field for State is added to the **Filters** shelf to indicate that certain states are filtered from the view. The icon with two circles on the field indicates that this field is a set. You can edit this field by right-clicking the field on the **Filters** shelf and selecting, **Edit Filter**. Now you want to look at the data for the cities in these states. 9. On the **Rows** shelf, click the **plus** icon on the **State** field to drill-down to the City level of detail. There’s almost too much information here, so you decide to filter the view down to the cities with the most negative profit by using a Top N Filter. Check your work! Watch steps 1-5 in action _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. ## Create a Top N Filter You can use a Top N Filter in Tableau Desktop to limit the number of marks displayed in your view. In this case, you want to use the Top N Filter to hone in on poor performers. 1. From the Data pane, drag **City** to the **Filters** shelf. 2. In the Filter dialog box, select the **Top** tab, and then do the following: 1. Click **By field**. 2. Click the **Top** drop-down and select **Bottom** to reveal the poorest performers. 3. Type **5** in the text box to show the bottom 5 performers in your data set. Tableau Desktop has already selected a field (Profit) and aggregation (Sum) for the Top N Filter based on the fields in your view. These settings ensure that your view will display only the five poorest performing cities by sum of profit. ![The Top tab of the Filter \[City\] dialog box that is set to By field: Bottom 5](Img/gs_Explore12.png) 6. Click **OK**. You're on to something! But there are six cities in the view, including Jacksonville, North Carolina, which has a positive profit. Why would a city with a positive profit show up in the view when you created a filter that was supposed to filter out profitable cities? Jacksonville, North Carolina is included because City is the lowest level of detail shown in the view. For Tableau Desktop to know the difference between Jacksonville, North Carolina, and Jacksonville, Florida, you need to drill down to the next level of detail in the location hierarchy, which, in this case, is Postal Code. After you add Postal Code, you can exclude Jacksonville in North Carolina without also excluding Jacksonville in Florida. 1. On the **Rows** shelf, click the plus icon on **City** to drill down to the Postal Code level of detail. 2. Right-click the postal code for Jacksonville, North Carolina, **28540**, and then select **Exclude**. Postal Code is added to the **Filters** shelf to indicate that certain members in the Postal Code field have been filtered from the view. Even when you remove the Postal Code field from the view, the filter remains. 4. Drag **Postal Code** off the **Rows** shelf. Your view updates to look like this: ![A bar chart of the five least profitable cities in the South](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Explore14.png) Check your work! Watch steps 1-8 in action _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. Now that you've focused your view to the least profitable cities, you can investigate further to identify the products responsible. ## Identify the troublemakers You decide to break up the view by Sub-Category to identify the products dragging profit down. You know that the Sub-Category field contains information about products sold by location, so you start there. 1. Drag **Sub-Category** to the **Rows** shelf, and place it to the right of City. 2. Drag **Profit** to **Color** on the Marks card to make it easier to see which products have negative profit. 3. In the Data pane, right-click **Order Date** and select **Show Filter**. You can now explore negative profits for each year if you want, and quickly spot the products that are losing money. Machines, tables, and binders don’t seem to be doing well. So what if you stop selling those items in Jacksonville, Concord, Burlington, Knoxville, and Memphis? ![A horizontal bar chart that shows profitability for Sub-Category for the poorest performing cities](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Explore15.png) ## Verify your findings Will eliminating binders, machines, and tables improve profits in Florida, North Carolina, and Tennessee? To find out, you can filter out the problem products to see what happens. 1. Go back to your map view by clicking the **Profit Map** sheet tab. 2. In the Data pane, right-click **Sub-Category** and select **Show Filter**. A filter card for all of the products you offer appears next to the map view. You'll use this filter later. 3. From the Data pane, drag **Profit** and **Profit Ratio** to **Label** on the Marks card. - To format the Profit Ratio as a percentage, right-click **Profit Ratio**, and select **Format**. Then, for **Numbers** in the **Default** section, choose **Percentage** and set the number of decimal places you want displayed on the map. For this map, we'll choose zero decimal places. Then close the format pane. Now you can see the exact profit of each state without having to hover your cursor over them. 4. In the Data pane, right-click **Order Date** and select **Show Filter** to provide some context for the view. A filter card for YEAR(Order Date) appears in the view. You can now view profit for all years or for a combination of years. This might be useful for your presentation. 5. Clear **Binders**, **Machines**, and **Tables** from the list on the Sub-Category filter card in the view. Recall that adding filters to your view lets you include and exclude values to highlight certain parts of your data. As you clear each member, the profit for Tennessee, North Carolina, and Florida improve, until finally, each has a positive profit. ![The result of deselecting Binders, Machines, and Tables from the Sub-Category filter](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_explore-deselect.png) Hey, you made an interesting discovery! Binders, machines, and tables are definitely responsible for the losses in Tennessee, North Carolina, and Florida, but not for the rest of the South. Do you notice how profit actually decreases for some of the other states as you clear items from the filter card? For example, if you toggle **Binders** on the Sub-Category filter card, profit drops by four percent in Arkansas. You can deduce that Binders are actually profitable in Arkansas. You want to share this discovery with the team by walking them through the same steps you took. 11. Select **(All)** on the Sub-Category filter card to include all products again. Learn more: More questions you could ask You found that binders, machines, and tables were responsible for the negative profit in Tennessee, North Carolina, and Florida. What now? You can continue exploring the data by answering the questions below. **Note:** If you use your view to explore these questions, undo any changes before continuing the Get Started tutorial. - How are machine sales in Tennessee, North Carolina, and Florida? Are you selling a lot? If so, how is profit impacted? - What other factors might be contributing to these results? Are retailers in the south selling products at a discount? - What about table and binder sales? - What happens to sales in Jacksonville, Miami, Burlington, Knoxville, and Memphis when you remove either machines, tables, or binders? - But what about bookcases? Remember, in Step 2, we saw that bookcases were very unprofitable in other regions. Digging into those regions might reveal additional solutions. Check your work! Watch "Verify your findings" in action _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. Now you know that machines, tables, and binders are problematic products for your company. In focusing on the South, you see that these products have varying impacts on profit. This might be a worthwhile conversation to have with your boss. Next, you'll assemble the work you've done so far in a dashboard so that you can clearly present your findings. **More on working with maps and geographic roles** in the Learning Library (in the top menu). Continue to [Step 6: Build a dashboard to show your insights](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-build.htm). [Skip to main content](#main-content) # Step 6: Build a dashboard to show your insights You’ve created four worksheets, and they're communicating important information that your boss needs to know. Now you need a way to show the negative profits in Tennessee, North Carolina, and Florida and explain some of the reasons why profits are low. To do this, you can use dashboards to display multiple worksheets at once, and—if you want—make them interact with one another. For related resources and videos, see [Building Dashboards in Tableau Desktop](https://www.tableau.com/node/106947?playlist=509089). ## Set up your dashboard You want to emphasize that certain items sold in certain places are doing poorly. Your bar graph view of profit and your map view demonstrate this point nicely. 1. Click the **New dashboard** button. ![The New Dashboard icon](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Build1.png) 2. In the **Dashboard** pane on the left, you'll see the sheets that you created. Drag **Sales in the South** to your empty dashboard. 3. Drag **Profit Map** to your dashboard, and drop it above the Sales in the South view. Your dashboard will update to look like this: ![A dashboard with the Profit Map and the Sales in the South sheets](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Build2.png) Now you can see both views at once! But sadly, the bar chart is a bit squished, which isn’t helping your boss understand your data. ## Arrange your dashboard It's not easy to see details for each item under **Sub-Category** from your Sales in the South bar chart. Resolving this issue will give you more room to communicate the information you need. 1. On Sales in the South, right-click on a value in the **Category** column header, and clear **Show header**. ![A menu that has Show Header selected](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Build3.png) 2. On Sales in the South, right-click on the header Order Date / Sub-Category and select Hide Field Labels for Columns. ![The menu for column field labels](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_build4.png) You've now hidden unnecessary information from your dashboard while preserving the breakdown of your data. The extra space makes it easier to see data on your dashboard, but let's freshen things up even more. 3. Right-click the **Profit Map** title and select **Hide Title**. The title Profit Map is hidden from the dashboard and even more space is created. 4. Repeat this step for the **Sales in the South** view title. 5. Each time you brought out a sheet, its filters came too. This means there are duplicate filters showing. Select the first **Sub-Category** filter card on the right side of your view, and at the top of the card, click the **Remove** icon ![The Remove From Dashboard icon](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_build5.png). 6. Repeat this step for the second **Sub-Category** filter card and one of the **Year of Order Date** filter cards. 7. Click on the **Profit color legend** and drag it from the right to below Sales in the South. 8. Finally, select the remaining **Year of Order Date** filter, click its drop-down arrow, and then select **Floating**. Move it to the white space in the map view. In this example, it is placed just off the East Coast, in the Atlantic Ocean. Try selecting different years on the Year of Order Date filter. Your data is quickly filtered to show that state performance varies year by year. That's nice, but it could be made even easier to compare. 10. Click the drop-down arrow at the top of the **Year of Order Date** filter, and select **Single Value (Slider)**. Your view updates to look like this: ![A dashboard with the Profit Map and Sales in the South sheets with fewer column headers and filters](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_build6.png) Learn more: Differentiate Floating vs. Tiled objects on a dashboard Objects on a dashboard can be set to either **Tiled** or **Floating**. Tiled items are automatically sized to the zone you drop them in. Floating items can be moved and sized freely from other objects on the dashboard. If you want, you can even have both floating and tiled items on the same dashboard. **More on Arranging your Dashboard** in the Learning Library (in the top menu). Now your dashboard is looking really good! Now, you can easily compare profit and sales by year. But that’s not so different from a couple pictures in a presentation—and you're using Tableau! Let's make your dashboard more engaging. Check your work! Watch "Arrange your dashboard" in action _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. ## Add interactivity Wouldn't it be great if you could view which sub-categories are profitable in specific states? 1. Select **Profit Map** in the dashboard, and click the **Use as filter** icon ![The Use as Filter icon](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_build7.png) in the upper right corner. 2. Select a state within the Southern region of the map. The Sales in the South bar chart automatically updates to show just the sub-category sales in the selected state. You can quickly see which sub-categories are profitable. 3. Click an area of the map other than the colored Southern states to clear your selection. You also want viewers to be able to see the change in profits based on the order date. 5. Select the **Year of Order Date** filter, click its drop-down arrow, and select **Apply to Worksheets** > **All Using This Data Source**. Explore state performance by year with your new, interactive dashboard! Check your work! Watch "Add interactivity" in action Here, we filter Sales in the South to only items sold in North Carolina, and then explore year by year profit. _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. ## Rename and go You show your boss your dashboard, and she loves it. She's named it "Regional Sales and Profit," and you do the same by double-clicking the **Dashboard 1** tab and typing **Regional Sales and Profit**. In her investigations, your boss also finds that the decision to introduce machines in the North Carolina market in 2025 was a _bad idea_. Your boss is glad she has this dashboard to explore, but she also wants you to present a clear action plan to the larger team. She asks you to create a presentation with your findings. Good thing you know about stories in Tableau. Continue to [Step 7: Build a story to present](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-story.htm). [Skip to main content](#main-content) # Step 7: Build a story to present You want to share your findings with the larger team. Together, your team might reevaluate selling machines in North Carolina. Instead of having to guess which key insights your team is interested in and including them in a presentation, you decide to create a story in Tableau. This way, you can walk viewers through your data discovery process, and you have the option to interactively explore your data to answer any questions that come up during your presentation. ## Create your first story point Stories in Tableau are almost like slideshows. Each story point is essentially an independent slide in a presentation. And unlike a dashboard, each story point can show the same viz or dashboard with an independent state. Not sure what that means? Follow along with the directions below and it should become clear. For the presentation, you'll start with an overview. 1. Click the **New story** button. ![New Story icon](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Story1.png) This brings up a blank workspace that reads, "Drag a sheet here." This is where you'll create your first story point. Blank stories look a lot like blank dashboards. And like a dashboard, you can drag worksheets over to present them. In a story, you can also drag dashboards into your presentation. 5. From the **Story** pane on the left, drag the **Sales in the South** worksheet onto your view. 6. Add a caption—maybe "Sales and profit by year"—by editing the text in the gray box above the worksheet. ![The Sales in the South sheet displayed in a story](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Story2.png) This story point is a useful way to acquaint viewers with your data. But you want to tell a story about selling machines in North Carolina, so let's focus on that data. ## Highlight machine sales To bring machines into the picture, you can leverage the Sub-Category filter included in your Sales in the South bar chart. 1. In the **Story** pane, under New story point, click **Duplicate** to duplicate the first story point. Continue working where you left off, but know that your first story point will be exactly as you left it. In this new story point, you can change filters and other interactivity without changing the first story point or the underlying viz. 2. Since you know you’re telling a story about machines, on the Sub-Category filter, clear the selection for **(All)**, then select **Machines**. Now your viewers can quickly identify the sales and profit of machines by year. 3. Add a caption to underscore what your viewers see, for example, "Machine sales and profit by year." ![A story that includes the Sales in the South sheet and is filtered for machines](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Story4.png) You've successfully shifted the focus to machines, but you realize that something seems odd: in this view, you can't single out which state is contributing to the loss. You'll address this in your next story point by introducing your map. Learn more: What's this mini toolbar by your story point caption? The Story toolbar ![Icons that appear when you hover over story point captions](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_story_toolbar.png) shows by the story point caption once you drag your first story point onto the canvas and mouse-over the navigator area. Use it to revert changes, apply updates to a story point, delete a story point, or create a new story point out of the current, customized one. All of the options are available after you make a change to the story point. Otherwise only the delete option is available. Check your work! Watch "Create your first story point" and "Highlight machine sales" in action. _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. ## Make your point The bottom line is that machines in North Carolina lose money for your company. You discovered that in the dashboard you created. Looking at overall sales and profit by year doesn't demonstrate this point alone, but regional profit can. 1. In the **Story** pane, select **Blank** to add a new blank story point. Then, drag your dashboard **Regional Sales and Profit** onto the canvas. This gives viewers a new perspective on your data: Negative profit catches the eye. ![A story that uses the Regional Sales and Profit dashboard](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Story6.png) 3. Add a caption like, "Underperforming items in the South." To narrow your results to just North Carolina, start with a duplicate story point. 1. Select **Duplicate** to create another story point with your Regional Profit dashboard. 2. Select **North Carolina** on the map and notice that the bar chart automatically updates. 3. Select All on the Year of Order Date filter card. 4. Add a caption, for example, "Profit in North Carolina, 2022-2025." Now you can walk viewers through profit changes by year in North Carolina. To do this, you will create four story points: 1. Select **Duplicate** to begin with your Regional Profit dashboard focused on North Carolina. 2. On the Year of Order Date filter, click the right arrow button so that **2022** appears. 3. Add a caption, for example, "Profit in North Carolina, 2022," and then click **Duplicate**. 4. Repeat steps 2 and 3 for years 2023, 2024, and 2025. Now viewers will have an idea of which products were introduced to the North Carolina market when, and how poorly they performed. Check your work! Watch "Make your point" in action. _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. ## Finishing touches On this story point that focuses on data from 2025, you want to describe your findings. Let's add more detail than just a caption. 1. In the left pane, select **Drag to add text** and drag it onto your view. 2. Enter a description for your dashboard that emphasizes the poor performance of machines in North Carolina, for example, "Re-introducing machines to the North Carolina market in 2025 resulted in losing a significant amount of money." For dramatic effect, you can hover over Machines on the Sales in the South bar chart while presenting to show a useful tooltip: the loss of nearly $4,000. ![The Regional Sales and Profit dashboard with a text caption that reads “Introducing machines to the North Carolina market in 2021 resulted in losing a significant amount of money.”](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Story9.png) And now, for the final slide, you drill down into the details. 4. In the **Story** pane, click **Blank**. 5. From the **Story** pane, drag **Negative Profit Bar Chart** to the view. 6. In the **Year of Order Date** filter card, narrow the view down to **2025** only. You can now easily see that the loss of machine profits was solely from Burlington, North Carolina. 7. In the view, right-click the **Burlington** mark (the bar) and select **Annotate** > **Mark**. 8. In the Edit Annotation dialog box that appears, delete the filler text and type: "Machines in Burlington lost nearly $4,000 in 2025." 9. Click **OK**. 10. In the view, click the annotation and drag it to adjust where it appears. 11. Give this story point the caption: "Where are we losing machine profits in North Carolina?" 12. Double-click the **Story 1**tab and rename your story to "Improve Profits in the South". 13. Review your story by selecting **Window** > **Presentation mode**. Learn more: Size to fit. What are those scroll bars doing on the right side or the bottom of your dashboard story point while you're in presentation mode? ![A story that has horizontal and vertical scroll bars](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Story7.png) It seems like your dashboard doesn't fit the presentation well. That's irritating. Press the **Esc** key to exit your presentation, and then select the **Regional Sales and Profit** sheet at the bottom of your workbook. In the left pane under **Dashboard**, change the **Size** drop-down selection to **Fit to Improve Profits in the South**. This will automatically size your dashboard for optimal story viewing. ![The Dashboard pane menu used to change the size of your dashboard](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Story10.png) Select **Fit to Improve Profits in the South** and then enter Presentation mode again. Your dashboard fits nicely. Check your work! Watch "Finishing touches" in action. _Click the image to replay it_ **Note**: Details in this gif may not match exactly what's on your screen. ## After you present Your presentation went very well. The team is convinced that there is work to be done to increase profit in Burlington, North Carolina. And, they're curious to know why machines did so poorly in the first place. Your boss is thrilled—not only have you identified a way to address negative profit, you've got the team asking questions about their data. To keep the lessons fresh in their minds, your boss asks you to email your team a document with your findings. It's a good thing that you know about sharing your visualizations with Tableau Server and Tableau Public. Continue to [Step 8: Share your findings](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-share.htm). [Skip to main content](#main-content) # Step 8: Share your findings You've done a bunch of work—great work—to learn that Burlington, North Carolina needs some fine tuning. Let's share this information with your teammates. **Before you continue**, select an option below: - If you or your company does not use Tableau Cloud or Server, or if you want to learn about a free, alternative sharing option, jump to [Use Tableau Public](#Use_Tableau_Public). **Note:** If you use Tableau Desktop Free Edition and your company doesn't allow publishing content to Tableau Public, you must activate Tableau Desktop with a paid license before you can share or publish your work. - If you or your company uses Tableau Cloud or Tableau Server, and you are familiar with what permissions are assigned to you, jump to [Use Tableau Cloud or Tableau Server](#Use_Tableau_Server). ## Use Tableau Public Your story was a hit. You're going to publish it to Tableau Public so that your team can view it online. **Note:** When you publish to Tableau Public, as the name suggests, these views are publicly accessible. This means that you share your views as well as your underlying data with anyone with access to the internet. When sharing confidential information, consider [Tableau Server](http://www.tableau.com/products/server) or [Tableau Cloud](http://www.tableau.com/products/cloud-bi). 1. Select **Server** > **Tableau Public** > **Save to Tableau Public**. 2. Enter your Tableau Public credentials in the dialog box. ![The Tableau Public login screen](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Share7.png) If you don't have a Tableau Public profile, click **Create one now for free** and follow the prompts. 3. If you see this dialog box, open the Data Source page. Then in the top-right corner, change the **Connection** type from **Live** to **Extract**. ![A Data Extract Required dialogue box that says “An error occurred while attempting to save the workbook”](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Share10.png) Learn more: Why did you have to create an extract? And what's an extract, anyway? Tableau Public does not support live data connections, which is why you must create a data extract before publishing. Data extracts are saved subsets of a data source that you can use to share a snapshot of the data in the workbook, improve performance, or take advantage of Tableau functionality that is not available in the underlying data. **More on working with extracts** in the Learning Library (in the top menu). 4. For the second (and last) time, select **Server** > **Tableau Public** > **Save to Tableau Public**. 5. When your browser opens, review your embedded story. It will look like this: ![A viz of underperforming items in the South that is uploaded to Tableau Public](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Share8.png) 6. Click **Edit Details** to update the title of your viz, add a description, and more. 7. Click **Save**. Your story is now live on the web. 8. To share with colleagues, click **Share** at the bottom of your viz. ![The Share dialogue box in Tableau Public](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Share9.png) 9. How do you want to share your story? 1. Embed on your website: Copy the **Embed Code** and paste it in your web page HTML. 2. Send a link: Copy the **Link** and send the link to your colleagues. 3. Send an email using your default email client by clicking the email icon. 4. Share on Twitter or Facebook by clicking the appropriate icon. After you've completed these steps, [click here](#Congrats,_you_did_it!) to jump to the final section of the tutorial. ## Use Tableau Cloud or Tableau Server Your story was a hit. You're going to publish it to Tableau Server so that your team can view it online. ### Publish to Tableau Cloud or Tableau Server 1. Select **Server** > **Publish Workbook** or click Share ![The Share icon](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/Share_Icon.png) on the toolbar. 2. Click **Tableau Cloud** under **Quick Connect** to connect to Tableau Cloud, or enter the name of the Tableau Server (or IP address) that you want to connect to in the dialog box and click Connect. ![The Share via Tableau Server or Tableau Cloud dialogue box](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_share1.png) 3. In the Name field, enter **Improve Profits in the South**. 4. If you want, enter a description for reference, for example "Suggestions to improve profits in the South" 5. Under **Sheets**, click **Edit**, and then clear all sheets except **Improve Profits in the South**. Learn more: Share more than just your story. If you want, you can share every sheet in your workbook with colleagues on Tableau Server. However, you may want to think about which sheets you'd like to make available to which colleagues. **Note:** Depending on your administrator, your permissions may vary. **More on Tableau Server permissions** in the Learning Library (in the top menu). 6. Click **Publish**. Tableau Server opens in your internet browser. If prompted, enter your server credentials. The Publishing Complete dialog box lets you know that your story is ready to view. ![The Publishing Complete dialogue box](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_share3.png) Great work! You've successfully published your story using Tableau Server. ### Send a link to your work Let's share your work with your teammates so that they can interact with your story online. 1. In Tableau Server, navigate to the Improve Profits in the South story that you published. You will see a screen like this: ![The Improve Profits in the South story that is uploaded to Tableau Server](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Share5.png) _If you had published additional sheets from your workbook, they would be listed alongside Improve Profits in the South._ 2. Click **Improve Profits in the South**. 3. From the menu, select **Share**. ![The Share dialogue box](/tableau/current/en-us/guides/get-started-tutorial/en-us/Img/gs_Share4.png) 4. How do you want to share your story? 1. Embed on your website by copying the **Embed Code** and pasting it in your web page HTML. 2. Send a link by copying the **Link** and sending the link to your colleagues. 3. Send an email by using your default email client: Click the email icon. ## Congratulations, you did it! You used Tableau Desktop to create a view of your product data, map the product sales and profitability by region, build a dashboard around your findings, tell a story to present, and share your findings on the web so that remote team members can take a look. **You're a data rockstar.** Well done! You successfully practiced the Tableau "Data Discovery" method: - Ask a question - Gather data - Structure the data - Explore the data - Share insights That's the basic workflow you'll follow when you work in Tableau, although you might find yourself doing a lot more revising in each stage than you did here. For example, it might take a few revisions to refine your initial question from something general (what's going on with sales?) to something specific (which city in the South is responsible for negative profit?). And your revisions might take you in unexpected directions. That’s great, and that's what we hope will happen—we hope that you'll discover opportunities you didn't know existed when you first looked at your data. If you're ready to jump in and start working with your data, then go forth and explore your data in Tableau! But if you want more information first, check out the Learning Library. Continue to the [Learning Library](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-next.htm). [Skip to main content](#main-content) # Tableau Cloud Manual Migration Guide This guide explains how to manually migrate your Tableau Server deployment to Tableau Cloud. In a nutshell, this guide is useful for administrators who are running a Tableau Server with fewer than 100 users and who are comfortable with a fully manual, self-service migration process. If you have a lot more users and your data requirements are more complex, you may benefit from working with [professional services or an experienced migration partner](https://www.tableau.com/solutions/tableau-migration) to migrate to Tableau Cloud. Further down, this topic includes guidance on how to plan your migration. But first, let's make sure you understand why moving to Tableau Cloud is probably the smart move for your organization. ## Why migration can make sense If you are running a single Tableau Server for a small group of users, then it's almost impossible not to save time and money by moving your operation to Tableau Cloud. The easy win for moving to Tableau Cloud is savings in time, which tends to be in short supply for most of us. And if you are a data scientist or analyst who has found themselves unexpectedly running a Tableau Server installation, migrate and get back to your data! What about bigger organizations? If your organization exceeds 100 users, then you will also undoubtedly benefit from savings of cost and time at scale. Tableau Cloud is built to handle big organizations, but this guide isn't. If you're looking to migrate a bigger organization, check out [Tableau Cloud Migration](https://www.tableau.com/solutions/tableau-migration) where you can learn more about working with professional services or an experienced migration partner. For many organizations, Tableau Cloud will be faster and more reliable, with less bother than whatever you are doing now to keep your Tableau Server humming. You will never need to face another major server upgrade, or even a maintenance release update, which, as you know, is really just an upgrade smuggled in under another name. Tableau Cloud is always running the latest release, with the most up-to-date features. Reliability and performance are baked into the service. After the migration process, your time with Tableau Cloud will be spent managing users and data. That's it. You won't be troubleshooting service errors or combing logs or restarting, and restarting. Work with your account manager to figure out the costs for supporting your users. As you evaluate overall cost, remember that the single metric of per-user licensing expense does not provide an apples to apples comparison between SAAS and self-hosting a server. This comparison is especially impoverished if you are not including the time spent managing Tableau Server, and the capital cost of refreshing or leasing hardware. The annual cost of running a single server in the cloud can be more than $10,000 a year. And of course any analysis must include your staffing cost of maintenance, periodic updates, and troubleshooting. ### Dive deeper - For a quick and relevant evaluation of moving to Tableau Cloud, see the blog post, [Should I Move My Analytics to Tableau Cloud?](https://www.tableau.com/blog/should-i-move-my-analytics-cloud) - For more information about the advantages of moving from on-premises or self-hosted to Tableau Cloud, see GigaOm's research article, [CxO Decision Brief: SaaS Business Intelligence Platforms](https://portal.gigaom.com/report/cxo-decision-brief-saas-business-intelligence-platforms). - For a case-study detailing cost savings and performance improvement in the real world, see [Splunk migration to Tableau Cloud eliminates server admin overhead and drives better dashboard performance](https://www.tableau.com/solutions/customer/splunk-migrates-tableau-cloud-eliminates-server-admin-overhead). ## When migration doesn't make sense The following list describes scenarios where continuing to manage your own instance of Tableau Server instead of migrating can make sense. We’re committed to continually improving Tableau Cloud and will update this list as we release new features to address these gaps. However, it is important that you verify that Tableau Cloud meets your requirements before you decide to migrate. Please be sure to validate your requirements before moving forward with a migration. - **Regulation and data residency:** Your business operates in a space that must comply with a regulatory (such as FedRAMP, PCI, etc.) or data residency requirement that Tableau Cloud does not yet meet. Please [review our list of current compliances](https://compliance.salesforce.com/en/services/tableau-cloud) and check back often to learn when new certifications become available. - **Data sources:** Your organization relies on a data solution that does not work with Tableau Cloud, is not supported by Tableau Bridge, or is otherwise beyond the scope of your ownership to extract in a compatible way. Examples of such data sources include cube data sources, custom connectors, packaged Tableau connector (.taco) files, among others. The next topic, [Plan Your Migration](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part1.htm), walks through the different supported data sources and options available in Tableau Cloud. You can also download the free [Tableau Cloud Migration Technical Readiness Assessment](https://exchange.tableau.com/products/921) to see which data sources you’re currently using and if they are supported on Tableau Cloud. - **Site capacity:** If you have more than 1 terabyte of data, take a look at [Advanced Management for Tableau Cloud](https://help.tableau.com/current/online/en-us/itm_intro.htm). Otherwise, review [Tableau Cloud Site Capacity](https://help.tableau.com/current/online/en-us/to_site_capacity.htm) to optimize any necessary consolidation. The [Tableau Cloud Migration Technical Readiness Assessment](https://exchange.tableau.com/products/921) can help you identify assets that will require consolidation. - **Authentication:** If you require LDAP for an external identity store, Kerberos authentication, or Kerberos delegated authentication. - **Data management:** Tableau Prep Flows are not supported by Tableau Bridge. If you require automated data updates with Tableau Prep Flows for data behind a private network, see [How to Run Tableau Prep Conductor Flows with On-Premises Data in Tableau Cloud](https://kb.tableau.com/articles/howto/how-to-run-tableau-prep-conductor-flows-with-on-premises-data-in-tableau-cloud). Tableau Prep Flows using Python are also not supported by Tableau Bridge. ## Who should read this This guide is written for the person or team of people who will be performing the migration to Tableau Cloud. The guide is designed for Tableau Server installations that have 100 users or less. This guide provides a step-wise, manual process to get your organization from Tableau Server to a fully-functional site in Tableau Cloud in a week or two. After you migrate and create the core administrative functionality (identity/user, site configuration, authentication, data connection, etc) in Tableau Cloud, the bulk of content migration can be shared with the creators at your organization. A "creator" is a user who has a Creator role-based license. Depending on your goals, either you (the admin) or your creators can migrate content. For this reason, we've created a chunk of migration-related content you can point your creators to. Users who migrate content need to have a Creators license and access to [Tableau Desktop](https://www.tableau.com/products/desktop). If the creators will be migrating Tableau Prep flows, then they must also have Tableau Prep Builder installed. ## Post-migration In this guide we will do our best to cover as much of the Tableau Cloud platform as possible, but there are some features that administrators cannot set up on behalf of their end users. Users will need to make some updates to their content after a migration is complete. There are also some features that are better to recreate anew in Tableau Cloud with the benefit of using cloud-native functionality. ### Feature differences in Tableau Cloud As mentioned previously, running Tableau Cloud vs managing your own Tableau Server is much less labor intensive from an administrative perspective. You can find a summarized list of the feature differences in the Tableau Server help topic, _Technical Considerations for Migrating from Tableau Server to Tableau Cloud_ ([Windows](https://help.tableau.com/current/server/en-us/migrate_server_to_cloud_overview.htm) | [Linux](https://help.tableau.com/current/server-linux/en-us/migrate_server_to_cloud_overview.htm)). Below are a few of the most common items. - In Tableau Cloud, as the administrator, you do not have direct access to the _Tableau Server Repository_ ([Windows](https://help.tableau.com/current/server/en-us/server_process_repository.htm) | [Linux](https://help.tableau.com/current/server-linux/en-us/server_process_repository.htm)). Instead, you can use [Admin Insights](https://help.tableau.com/current/online/en-us/adminview_insights_manage.htm) to understand what’s going on in your Tableau environment, including the current licensing state and performance. - Guest access is not available on Tableau Cloud. Instead use [Connected Applications](https://help.tableau.com/current/online/en-us/connected_apps.htm) to broaden access. - While full custom font capability is not supported, a set of Google Fonts are available for use with published content. - Tableau Cloud uses a tenant and site model for administration. Using [Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm), you can create multiple sites on your tenant, similar to how you do on Tableau Server. By default, you can create up to 3 Tableau Cloud sites. This capacity increases depending on the Tableau edition you purchase—up to 10 sites with [Enterprise](https://help.tableau.com/current/online/en-us/to_tab_enterprise_features.htm) and a maximum of 50 sites with [Tableau+](https://help.tableau.com/current/online/en-us/to_tab_plus_features.htm). Run the [Tableau Cloud Migration Technical Readiness Assessment](https://exchange.tableau.com/products/921) to understand if there are any use cases which may need to be adapted before migrating to Tableau Cloud. ### Tasks that need to be completed by end users There are some features that administrators cannot set up on behalf of their end users or that require manual re-configuration. We’ve made a complete list available separately as an [End-User Migration Checklist](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part7.htm) so that you can share it directly with your users, but these tasks include: - Webhooks - Embedding solutions updates - Update REST API scripts - Configuring Analytics Extensions ## Version compatibility  As a general rule, our documentation is based on recent-to-current versions of Tableau Server, but because the process covered in this guide is not a programmatic or automated migration, we don't foresee issues with migrating from older versions of Tableau Server to Tableau Cloud. Strictly speaking, the process in this guide is more "port" than "migration" when it comes to administrative configurations. ## Licensing Tableau Cloud uses Role-Based Subscription licensing. Tableau Server supports Role-Based Subscription licensing and legacy pricing models. If you are on a different (earlier) licensing model, please contact your Tableau account team to convert your licensing to Role-Based Subscription. ## Additional Support After reading through this material you may decide that you'd prefer not to take on a manual migration yourself, and would rather leave it to an expert. If so, please reach out to one of our [experienced migration partners](https://www.tableau.com/solutions/tableau-migration#partners) to learn how they can help you accelerate a migration to Tableau Cloud. ## Migration workflow This guide is organized according to a step-wise process for migrating to Tableau Cloud: 1. [Plan Your Migration](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part1.htm) 2. [Create and Configure a Tableau Cloud Site](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2.htm) 3. [Migrate Virtual Connections](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part2-5.htm) 4. [Migrate Data Sources, Workbooks, and Prep Flows to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part3.htm) 5. [Recreate Refresh Schedules for Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part4.htm) 6. [Configure Permission and Content Access for Migrated Users](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part5.htm) 7. [Add Remaining Users to Tableau Cloud](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part6.htm) 8. [End-User Migration Checklist](https://help.tableau.com/current/guides/migration/en-us/cloud_migration_part7.htm) [Skip to main content](#main-content) # Tutorial: Get Started with Tableau Desktop ##### Learn how to connect to data, create data visualizations, present your findings, and share your insights with others. This tutorial walks you through the features and functions of Tableau Desktop. As you work through this tutorial, you will create multiple vizzes in a Tableau workbook. The steps you'll take and the workbook you'll work in are based on a story about an employee who works at headquarters for a large retail chain. The story unfolds as you step through asking questions about your business and its performance. You'll learn how to connect to data in Tableau Desktop; build, present, and share some useful views; and apply key features along the way. Budget between one and three hours to complete the steps. ## Here's the story... Suppose you are an employee for a large retail chain. Your manager just got the quarterly sales report, and noticed that sales seem better for some products than for others and profit in some areas is not doing as well as she had expected. Your boss is interested in the bottom line: It's your job to look at overall sales and profitability to see if you can find out what's driving these numbers. She has also asked you to identify areas for improvement and present your findings to the team. The team can explore your results and take action to improve sales and profitability for the company's product lines. You'll use Tableau Desktop to build a simple view of your product data, map product sales and profitability by region, build a dashboard of your findings, and then create a story to present. Then, you will share your findings on the web so that remote team members can take a look. Expand **Learn more** sections for background and examples. Give it a try: Learn more: Connecting to data The first time around, follow along with the Sample - Superstore data source. (We'll show you how.) After you've gotten the hang of the core functionality in Tableau Desktop, give these steps a try with your own data. If you need to download the Superstore data set, you can access it from the [Tableau Public Sample Data](https://public.tableau.com/app/learn/sample-data) page.

Steps
Step 1: Connect to your data
Learn all about the Start page and how to connect to your data.

GO TO STEP

Step 2: Drag and drop to take a first look
Get to know the Tableau workspace, learn the language of Tableau, and start examining your data.
GO TO STEP
Step 3: Focus your results
Ask deeper questions and use additional tools to refine your views and gain insights about your data.
GO TO STEP
Step 4: Explore your data geographically
Learn how to plot your data on a map to see if you can spot any trends.
GO TO STEP
Step 5: Drill down into the details
Drill down into the details of your data and learn how to create a Top filter.
GO TO STEP
Step 6: Build a dashboard to show your insights
Learn how to build and format a dashboard to display the visualizations you created.
GO TO STEP
Step 7: Build a story to present
Learn how to build and format a story to present your findings.
GO TO STEP
Step 8: Share your findings
Share your findings with your organization on Tableau Server or Tableau Cloud, or share them with the world on Tableau Public.
GO TO STEP
Learning Library
Now that you're a Data Rockstar, keep learning with these additional resources.

GO TO LIBRARY