--- schema_version: "1" id: dc18bc53ec15b9ba2c7dee78b327a3cf8c195259cafdc5b2dcb0bdf71efdf3ea title: Allow Access to Approved Sites Only collection: tableau version: next locale: en-gb portal_url: https://docs.salesforce.com/tableau/next/en-gb/online/restrict_site_access.md canonical_url: https://help.tableau.com/v0.0/online/en-gb/restrict_site_access.htm source_site: help.tableau.com content_type: documentation content_hash: 9dced21eb63ce44b5fc209a23e511964cd3b2a574f3c423ed08689a0c2e04b4a description: Restrict user access to approved Tableau Cloud sites only using an SSL proxy. --- [Skip to main content](#main-content) # Allow Access to Approved Sites Only Starting in May 2026 (Tableau 2026.2), you can configure your organisation’s network to restrict user access to approved Tableau Cloud sites only. This security feature helps prevent unauthorised data sharing by blocking access to unauthorised sites like personal trial sites or other organisations’ Tableau Cloud sites. **Note:** This topic describes how to control which sites your users can access from your network. To control which locations your users can access sites from, consider [IP filtering](https://help.tableau.com/v0.0/online/en-gb/ip_filtering.htm). ### Benefits of restricting site access Site-specific access is a network-based security control that allows your organisation to enforce which Tableau Cloud sites users can access from your network. When configured, users can only sign in to and interact with Tableau Cloud sites that your organisation has explicitly approved. This approach is particularly important in industries and regions with strict data security requirements, such as financial services, healthcare and public sector organisations. This capability helps organisations: - **Prevent data loss:** Block users from uploading company data to unauthorised Tableau Cloud trial sites or other sites - **Maintain compliance:** Prevent unauthorised use of unapproved Tableau Cloud sites to demonstrate control over where organisational data can be published and shared - **Meet regulatory requirements:** Address strict data security requirements in regulated industries and regions ### How it works Site-specific site access works by using your organisation’s network infrastructure: 1. Your organisation configures an SSL proxy server to intercept HTTPS traffic to Tableau Cloud (`*.online.tableau.com`). 2. The proxy adds the `X-Tableau-Allowed-Sites` header to requests that identify which Tableau Cloud sites are approved for access. 3. Tableau Cloud reads these headers and allows or blocks access based on the approved site list. 4. When a user attempts to access a non-approved site, access is denied. **Important:** Tableau Support can’t assist with configuring or troubleshooting SSL proxies. ### What restricting site access affects When this capability is enabled for your network, the following access is affected: - Access through a web browser - Tableau Desktop connections to Tableau Cloud - Tableau REST API calls - Embedded views ### Before you begin Site-specific access requires coordination between Tableau Cloud cloud administrators and your organisation’s IT admin. Before implementing this feature, make sure you have: - **SSL proxy infrastructure**: An SSL proxy server that supports SSL interception and HTTP header injection - **IT support**: Technical resources to configure the proxy server and maintain header injection - **Site inventory**: A complete list of approved Tableau Cloud site IDs ## Configure organisation-specific site access Implementing site-specific access involves both IT configuration and ongoing Tableau Cloud administration. ### Step 1: Identify approved sites The best way to generate a comprehensive list of site IDs for approved sites is through Tableau Cloud Manager (TCM) and your web browser’s developer tools. 1. Open a web browser and go to the browser’s developer tools. 2. Go to and sign in to [Tableau Cloud Manager](https://cloudmanager.tableau.com/) as a cloud administrator. 3. Back in the browser’s developer tools, on the Network tab, do the following: 1. Look for requests to `https://.cloudmanager.tableau.com/api/v1/tenants//sites`. 2. Go to `sites?maxResults=200`. 3. Inspect the response. The response contains a list of all sites within your tenant, including the site IDs. Site IDs are listed as `siteUUID`. 4. Capture all of the `siteUUID` values in the response to compile the list of sites to include in the `X-Tableau-Allowed-Sites` header. ### Step 2: Work with IT to configure SSL proxy Provide your IT admin with the list of approved sites and work with them to configure the SSL proxy. Configure the SSL proxy to add the following header to requests for `*.online.tableau.com`. The HTTP header value is a comma-separated list of approved site IDs. Up to about 400 site IDs can be listed in the header. - For a single site: `X-Tableau-Allowed-Sites: siteUUID` - For multiple sites: `X-Tableau-Allowed-Sites: siteUUID1,siteUUID2,siteUUID3` **Note:** If your Tableau Cloud site is configured to use a [custom domain](https://help.tableau.com/v0.0/online/en-gb/custom_domain.htm), the IT admin needs to configure the SSL proxy to add the `X-Tableau-Allowed-Sites` header to requests for the custom domain. ### Step 3: Validate traffic routing through proxy After the SSL proxy is configured, the IT admin should validate that all user traffic to your sites are routed through the configured SSL proxy to ensure the HTTP header is applied to every request. ### Step 4: Test the configuration Test the configuration to verify that approved sites are accessible and non-approved sites are blocked. You can test the configuration by: 1. **Verify blocking:** Verify blocking works by going to a site that’s not included in the list of site IDs that were added to the HTTP header. Blocking works when you see an HTTP 403 (Forbidden) response. 2. **Verify allowed access:** Verify access works by going to a site that’s included in the list of site IDs that were added to the HTTP header. Access works when the page loads normally. 3. **Verify backwards compatibility:** Verify backwards compatibility by removing `X-Tableau-Allowed-Sites` HTTP header from your proxy configuration. Navigate to your site. Backwards compatibility works when the page loads normally. ## Troubleshoot
SymptomIssueResolution
Users report unexpected HTTP 403 (Forbidden) errorsUnexpected HTTP 403 (Forbidden) errorsVerify the site IDs in the X-Tableau-Allowed-Sites header matches exactly the sites users are trying to access.
Users can’t access any siteAll sites are inaccessibleCheck that the X-Tableau-Allowed-Sites header contains the correct site IDs, there are no typos or extra white spaces.
X-Tableau-Allowed-Sites doesn’t appear to be workingFeature doesn’t appear to be workingConfirm the SSL proxy is correctly adding the X-Tableau-Allowed-Sites header to requests to *.online.tableau.com.