# tableau Tableau Cloud (online) - Full Documentation [Skip to main content](#main-content) # About Tableau Advanced Management on Tableau Cloud **Important:** As of September 16, 2024, Advanced Management is no longer available as an independent add-on option. Advanced Management capabilities are only available if you previously purchased Advanced Management, or if you purchase certain license editions: Tableau Enterprise, Tableau Cloud+, or Tableau+ Bundle (available for Tableau Cloud), or Tableau Enterprise or Tableau Server+ (available for Tableau Server). Tableau Advanced Management is a collection of features designed to provide enhanced security, manageability, and scalability capabilities for your Tableau Cloud deployment. ## Advanced Management Licensing Advanced Management is licensed on a per deployment basis in Tableau Cloud as part of Tableau Enterprise, Tableau Cloud+, or Tableau+ Bundle. - Advanced Management can only be used with a Tableau Cloud deployment. For more information on how to purchase Advanced Management for an existing Tableau Cloud deployment, contact your account manager. - If Advanced Management is removed or deactivated for your deployment, you will no longer be able to use the features associated with Advanced Management. ## Feature table The following table lists the features that are included with Advanced Management:

Feature	Description	Requirements to use the feature
Content Migration Tool	The Content Migration Tool provides an easy way to copy or migrate content between Tableau projects in your Tableau Cloud deployment. For more information, see About Tableau Content Migration Tool.	The Content Migration Tool must be installed on a version of Microsoft Windows that supports .NET 4.6.1 (Windows 7 or later, Windows Server 2008R2 or later).
Activity Log	The Activity Log records tenant and site-level events for further auditing and analysis. Depending on the event you want to review, log data is accessed using the Tableau Cloud Manager (TCM) REST API or Amazon Simple Storage Service (S3). The data is updated in less than 15 minutes and has up to 365 days of retention. For more information, see Activity Log.	TCM REST API: Requires a Tableau user with a Cloud Administrator role and a client capable of making API calls. For more information, see TCM REST API Overview. Amazon S3: Requires an Amazon Web Services (AWS) account, Amazon S3 bucket to receive data, and an AWS Key Management Service key. For more information, see Set Up Activity Log.
Admin Insights data retention	Admin Insights data sources retain up to 365 days of site data. For more information, see Use Admin Insights to Create Custom Views.
Customer-Managed Encryption Keys	Customer-Managed Encryption Keys give you an extra level of security by allowing you to encrypt your site data extracts with a customer managed site-specific key. For more information, see Customer-Managed Encryption Keys.
Increased Site Capacity	With Advanced Management you get the following capacity increases for your licensed sites: Storage of up to 5 Terabytes (TB) Suggested file size of 25 Gigabytes (GB) For more information on site capacity, see Tableau Cloud Capacity.

## Other articles in this section [Skip to main content](#main-content) # About Data Connect As of September 2025, Tableau Data Connect is no longer available for new deployments. We recommend that existing customers migrate their Data Connect deployment to [Private Connect](https://help.tableau.com/current/online/en-us/private_connect_migrate_from_bridge.htm) or [Tableau Bridge](https://help.tableau.com/current/online/en-us/data_fresh_sync_section.htm). Data Connect will be retired in the future. Data Connect allows Tableau Cloud users to access data sources on your private network or cloud service. Data Connect operates as a shared responsibility model. With this model, customers supply the physical or virtual compute resources, and Tableau hosts and manages the Data Connect Kubernetes cluster on those resources. In your environment, the Data Connect Kubernetes cluster oversees a set of containers. The containers support the runtime environment that consists of one or more Bridge clients. The Bridge client is the program that runs tasks and enables secure communication across the firewall between your organization. Data Connect services include: - Cluster monitoring and troubleshooting: Tableau monitors the health and usage of the Bridge client. Telemetry data are collected to ensure resources are used in the most effective and efficient manner. - Cluster maintenance: Upgrades are automatically deployed and the cluster operation and maintenance is owned and fully performed by Tableau. Data Connect automatically optimizes the deployment for your workload based on needs and available compute pool. - Alert monitoring: Incident management is provided continuously to quickly resolve issues to limit business impact. ## Connector support Data Connect supports the same Connectors that Tableau Bridge for Linux supports. For a full review of connectivity options please refer to [Connectivity with Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm). ## Environment support Data Connect currently supports on-premise and VCP environments: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). Data Connect nodes are compatible with a single Tableau Cloud Site. Nodes must be installed in the same network as the data. Therefore customers should plan for at least three nodes per private network to maintain availability of the service. Data Connect nodes must be dedicated to Data Connect. You cannot deploy any other containers to the Tableau-owned cluster. And you cannot use an existing cluster for Data Connect. ## Architecture The Data Connect architecture consists of three main components and responsibility boundaries. While there's some overlap, Tableau is primarily responsible for the application and orchestration layers and customers are responsible for the infrastructure (compute, OS, networking, and storage) and where it's located. ![](/tableau/next/en-us/online/en-us/Img/data_connect_setup_579x566.png) 1. Tableau Cloud communicates with the Kubernetes orchestration service to deploy, monitor and manage the Kubernetes orchestration. 2. When you initialize Data Connect, a secure connection is established with the orchestration provider service over port 443. 3. After the service is configured, a Kubernetes cluster deploys a container(s) with Bridge client(s). These Bridge clients will be responsible for executing Tableau workloads. 4. Tableau Cloud users sign in to Tableau Cloud to interact with the Data Connect service. 5. On setup, Bridge clients initialize a connection with Tableau Cloud using HTTPS. After successful connection, Bridge clients initiate a secure, bidirectional communication to your Tableau Cloud environment using a WebSocket (wss://) connection. 6. Queries initiated from Tableau Cloud are run against your database to support end user analysis. ## Security See [Data Connect Security](https://help.tableau.com/v0.0/online/en-us/data_connect_security.htm). ## Data Connect components ![](/tableau/next/en-us/online/en-us/Img/data_connect_object_relationship.png) The primary component of the Data Connect solution is a cluster. The cluster is a Kubernetes cluster that is made up of one or more nodes. Each Kubernetes node hosts at least one container, which in turn, hosts the Bridge client. The Bridge client performs live and extract queries. A pool is a logical grouping of networking rules that specify which clusters should complete specific queries. In the context of deployment planning, a pool hosts a collection of endpoints (domains or IP addresses) for the purposes of load balancing. Domains include private cloud data, relational data, file data, etc. To allow a cluster to access and refresh data sources, each pool is assigned to a cluster. To distribute load, you can add multiple pools to a cluster. ## Deployment overview ![](/tableau/next/en-us/online/en-us/Img/data_connect_admin-tasks.png) To get started, run a script on each of your Linux servers. This script configures a Tableau-managed Kubernetes cluster in your environment. The Kubernetes cluster is managed by Tableau. After Kubernetes is configured, you deploy a Docker container to the cluster. Tableau will then deploy and remotely manage the Bridge client within the container. After this configuration with Tableau is established, you will then map connections to your private network data sources. For more information about deploying Data Connect, download the whitepaper, [Accessing Your Private Network Data with Tableau Cloud - Best Practices for Data Connect and Tableau Bridge](https://www.tableau.com/learn/whitepapers/tableau-bridge-data-connect-best-practices-guide). ## Database connectivity Queries are managed from the Bridge client in the cluster. Your data is transmitted directly from the Bridge client to Tableau Cloud. Data Connect doesn't require external network access, firewall holes, or remote machine access. ![](/tableau/next/en-us/online/en-us/Img/data_connect_query_data_flow.png) 1. The Bridge client establishes a persistent connection to the Tableau Cloud Data Connect service using secure WebSockets (wss://). The client then waits for a request from Tableau Cloud. 2. - For data sources with live connections or virtual connections, Tableau Cloud initiates a query to the Bridge client. - For data sources with extract connection that use refresh schedules, the client receives the refresh schedule request and contacts Tableau Cloud using a secure connection (https://) for the data source (.tds) files. 3. The Bridge client connects to the private network data using the credentials included in the job request. 4. The database returns the results of the query. 5. The Bridge client receives the payload and returns it to the Data Connect service. [Skip to main content](#main-content) # About Data Management **Important:** As of September 16, 2024, Data Management is no longer available as an independent add-on option. Data Management capabilities are only available if you previously purchased Data Management, or if you purchase certain license editions: Tableau Enterprise, Tableau Cloud+, or Tableau+ Bundle (available for Tableau Cloud), or Tableau Enterprise or Tableau Server+ (available for Tableau Server). Data Management is a collection of features and capabilities that helps customers manage Tableau content and data assets in their Tableau Server or Tableau Cloud environment. Starting in Tableau Server 2019.1 and Tableau Cloud 2019.3, Tableau Prep Conductor is available to schedule and monitor flows. Starting in Tableau 2019.3, Tableau Catalog is included in Data Management, making a variety of additional features available to you in the data management space. You can use Tableau Catalog to discover data, curate data assets, communicate data quality, perform impact analysis, and trace the lineage of data used in Tableau content. Starting in Tableau 2021.4, more governance and security features are added to Data Management: virtual connections and data policies. Using the virtual connection editor, you can create: - Virtual connections that provide a sharable central access point to data. - Data policies to apply row-level security at the connection level. ## Data Management Features The following table lists the features for Data Management, including Tableau Catalog, Tableau Prep Conductor, Virtual Connections, and Data Policies. ### Tableau Catalog

Feature	Description
Permissions on metadata	Tableau Catalog enables you to control who can see and manage external assets and what metadata is shown through lineage by setting permissions.
Expanded connect experience - data discovery	Whether you author in the web or in Tableau Desktop, you can now search for and connect to the specific databases and tables used by published data sources and workbooks on your Tableau Server or Tableau Cloud site.
Expanded search	Tableau Catalog expands search to include results based on columns, databases, and tables.
Tag external assets	You can categorize items on Tableau Server and Tableau Cloud with tags, helping users to filter external assets (databases, files, tables, and columns).
Certify databases and tables	Help users find trusted data that meets the standards you set by certifying databases and tables.
Set data quality warnings	You can set warnings to alert users to data quality issues, such as stale or deprecated data.
Lineage and impact analysis	The Lineage tool traces the source of your data. You can use it to analyze the impact of changes to your data, identify which users might be impacted, and email owners of a workbook, data source, or flow, or contacts for a database or table, about data-related updates.
Data Details	Enable users to better understand a published visualization by seeing information about the data used.
Add descriptions to assets	Help users find the data they're looking for by adding descriptions to databases, tables, and columns.
Developer resources	Tableau REST API Metadata Methods	Programmatically add, update, and remove external assets; and add additional metadata to Tableau content and external assets like descriptions.
	Tableau Metadata API	Programmatically query metadata from the content published to Tableau Server or Tableau Cloud. Programmatically update certain metadata using the metadata methods in the Tableau Server REST API. (Note: Tableau Cloud requires Data Management to access the Metadata API, but Tableau Server does not. This requirement started with Tableau Cloud October 2026. If you were using the Metadata API without Data Management at that time, you can continue doing so until June 2027.)
	GraphiQL	Explore and test queries against the Metadata API schema using an interactive in-browser tool called GraphiQL. (Note: Tableau Cloud requires Data Management to access GraphiQL, but Tableau Server does not. This requirement started with Tableau Cloud October 2026. If you were using the Metadata API without Data Management at that time, you can continue doing so until June 2027.)

### Tableau Prep Conductor | Feature | Description | | --- | --- | | Schedule Flow Tasks in the [Tableau Cloud](https://help.tableau.com/current/online/en-us/prep_conductor_online_schedule_flow_task.htm) or [Tableau Server](https://help.tableau.com/current/server/en-us/prep_conductor_schedule_flow_task.htm) help. | You can create scheduled flow tasks to run a flow at a specific time or on a recurring basis. | | [Monitor Flow Health and Performance](https://help.tableau.com/v0.0/online/en-us/prep_conductor_monitor_flow.htm) | Set up email notifications at the site or server level when flows fail, view and resume suspended flow tasks, and view errors and alerts. | | [Administrative Views for Flows](https://help.tableau.com/v0.0/online/en-us/prep_conductor_admin_views.htm) | Use Administrative Views to monitor the activities related to flows, performance history, and the disk space used at the server or site level. | | Tableau REST API - [flow methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_flow.htm) | Programmatically schedule flows. | ### Virtual connections and data policies | Feature | Description | | --- | --- | | [Create a Virtual Connection](https://help.tableau.com/v0.0/online/en-us/dm_vconn_create_conn.htm) | A Tableau content type that enables you to create a shareable re-usable connection to curated data. | | [Create a Data Policy for Row-Level Security](https://help.tableau.com/v0.0/online/en-us/dm_vconn_create_rlspolicy.htm) | Use the virtual connection editor to create data policies with policy conditions that apply row-level security to the data at the connection level. | | [Test Row-Level Security with Preview as User](https://help.tableau.com/v0.0/online/en-us/dm_vconn_test_preview.htm) | Test the data policy with Preview as user to ensure that users can see only their data. | | [Schedule Extract Refreshes for a Virtual Connection](https://help.tableau.com/v0.0/online/en-us/dm_vconn_extract.htm) | Create an extract refresh schedule for the tables in your connection, ensuring that the data is fresh for any content that uses that virtual connection. | ## Other articles in this section [Skip to main content](#main-content) # About Data Policies Use a data policy when you want to apply row-level security to one or more tables in the connection. Data policies apply to both live and extract connections. A data policy has three main components: ![An example of the three components of a data policy](/tableau/next/en-us/online/en-us/Img/ipa_vconns_policy_components.png) 1. The tables it applies to, called policy tables. These are the tables that are filtered. 2. The mapped columns that define the relationships between tables (for example, between entitlement and fact tables) and between table columns and policy columns. A policy column is the column used to filter data. 3. The policy condition, which is an expression that is evaluated for every row at query time. When TRUE, the row is shown in the query. To get started, click ![Create New Policy button](/tableau/next/en-us/online/en-us/Img/ipa_Create_New_Policy_btn.png). [Read full topic](https://help.tableau.com/current/online/en-us/dm_vconn_create_rlspolicy.htm) ## Related tasks [About the Virtual Connection Editor](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_about_editor.htm) [Add Tables to the Connection](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_add_tables.htm) [Create and Test Data Policies](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_create_data_policy.htm) Not finding what you need? Go online to see [all Tableau help](https://www.tableau.com/support/help) [Skip to main content](#main-content) # Extract Upgrade to .hyper Format In Tableau version 2018, we introduced the `.hyper` format for Tableau extracts to replace the old `.tde` format. The `.hyper` format has been the standard format used by Tableau to create extracts since 2018, and the large majority of extracts are now `.hyper` files. Beginning in early 2023, Tableau discontinued support for the `.tde` format on Tableau Cloud and Tableau Public. For more details about this deprecation, see this [Tableau Community post](https://community.tableau.com/s/feed/0D54T00001BHiGwSAL). ## Discontinuation of support for .tde files Beginning in 2023, the `.tde` format for Tableau extracts was deprecated. This format was replaced by the `.hyper` format in 2018 but continued to be valid for uploaded files until March 2023. - This change took place for Tableau Cloud and Tableau Public as of March 2023. - Beginning with version 2023.1.0 of Tableau Server, the uploading of `.tde` format files is disabled. - 2024.2 is the last version of Tableau Desktop that supports any .tde-based workbooks, data sources, or bookmarks. Versions 2024.3 and beyond only support .hyper format. ## Manually upgrade your .tde extract using Tableau Desktop If you manage extracts locally, you can manually upgrade your `.tde` extract to a `.hyper` extract using Tableau Desktop. **Note**: This functionality is only available in Tableau Desktop versions 2024.2 and older. 1. In Tableau Desktop, open a workbook that uses a `.tde` extract. 2. Select the extract data source from the Data menu and then select Extract \> Upgrade. 3. Select File \> Save, which saves the workbook and also completes the extract upgrade. [Skip to main content](#main-content) # About Multi-fact Relationship Data Models Multi-fact relationships let you build data sources with more than one _base table_. Using multiple base tables in your data model allows you to perform multi-fact analysis in Tableau. By establishing _trees_ of tables, rooted in a base table, you can model data structures with different conceptual domains and use their shared characteristics to connect them. This type of analysis is often referred to as multi-fact analysis, conformed dimensions, or shared dimensions. In Tableau, we call this a multi-fact relationship data model because you use relationships to build it. A multi-fact relationship data model always contains multiple base tables. Base tables are the left-most tables in the data model. For guidance on how to determine which tables to use as base tables, see [When to Use a Multi-fact Relationship Model](https://help.tableau.com/v0.0/online/en-us/datasource_mfr_when_to_use.htm). ![a multiple base table model with one tree highlighted](/tableau/next/en-us/online/en-us/Img/mfr_build_highlightedtree.png) A multiple base table data model with one base table's tree highlighted. ## Levels of relatedness Data models with multiple base tables have a lot of flexibility to how pieces of data can relate—or not relate—to each other. **Note**: Relatedness at any level is only relevant in data models with multiple base tables. Prior to multi-fact relationship data models, either everything was related (within a single data source) or nothing was (blending across multiple data sources). **Relatedness in the data model** Tables are related, unrelated, or shared based on the structure of the data model. In a data source, the relatedness of tables is a constant. As a brief overview: - _Related tables_ are in the same tree. - Prior to 2024.2, all data sources were single base table data sources consisting of a single tree, and in a single base table data source all tables are related. - _Unrelated tables_ are in different trees. Base tables are always unrelated to each other. Tables that are downstream of exactly one base table are also unrelated to tables in other trees. - _Shared tables_ have multiple incoming relationships and belong to more than one tree. - Tables downstream from a table with multiple incoming relationships are also considered shared. **Relatedness during analysis** Fields can be related, unrelated, not yet related, ambiguously related, or they can act as stitching fields. The relatedness among a group of fields is determined on a sheet-by-sheet basis based on the structure of the data model, what fields are actively in use (that is, on the shelves as pills), and if those fields are dimensions or measures. ![a simple viz with two unrelated fields, one on rows and one on columns, and an unrelated tooltip showing](/tableau/next/en-us/online/en-us/Img/mfr_unrelatedtooltip_example.png) To make a visualization with fields from multiple tables, Tableau has to perform joins behind the scenes to compute the values. The type of join used depends on the [relatedness of the fields](#fieldlevel). As a brief overview: - When _related fields_ are used in a viz, dimensions are inner joined and measure values are broken down by the dimensions. - It's a little more complicated than that—additional joins might be needed behind the scenes to ensure that [no measure values are dropped](https://www.tableau.com/blog/relationships-tableau-data-model). But in a dimension-only viz, related dimensions are inner joined and that's the main concept here. - This is the same behavior as single-base table models. - When _unrelated fields_ ![](/tableau/next/en-us/online/en-us/Img/mfr_icon_unrelated.png "unrelated icon") are used in a viz, dimensions are cross joined. Measure values are table scoped (that is, aggregated locally to a single value for their entire table) and repeated. - It's also possible for fields to be _not yet related_ or _ambiguously_ related, which means that for the combination of active fields, there is more than one way for the relationships between their tables to be resolved. If Tableau encounters uncertainty, it treats the fields as unrelated. - When fields are _stitched_ ![](/tableau/next/en-us/online/en-us/Img/MFR_icon_related.png "stitching icon") based on a shared field, dimensions are outer joined. Measure values are aggregated at the level of whatever dimension they can be broken down by and might be repeated. - _Stitching dimensions_ are similar to [linking fields in data blending](https://help.tableau.com/current/pro/desktop/en-us/multiple_connections.htm#define-blend-relationships-for-blending). Results are calculated for each pair of related fields, then the unrelated values are stitched together across the shared values of the dimension shared between them. All of these concepts and definitions are discussed in more detail later in this topic. An aside on dimensions and measures In Tableau, _measures_ are _aggregations_—they're aggregated up to the _granularity_ set by the _dimensions_ in the view. The value of a measure therefore depends on the context of the dimensions. For example, "number of cereal boxes" depends on if we mean the total inventory or the number of boxes per brand. _Dimensions_ are usually categorical fields, such as country or brand. In Tableau, dimensions set the granularity, or the _level of detail_, of the view. We typically want to group our data into marks by some combination of categories. What dimensions we use to build the view determines how many marks we have. When a measure is used without dimensions, it's said to be _table scoped_. This means its value is the fully aggregated value for the entire table. As soon as we use a dimension such as brand in the viz, the measure is broken down more granularly. The total number of cereal boxes is now per brand. _Aggregation_ refers to how the data is combined. Tableau's default aggregation is SUM. You can change the aggregation to other options, including: average, median, count distinct, minimum, and so on. _Granularity_ refers to how detailed or broken down the measure is—which is controlled by the dimensions. Unless the granularity of the measure is row level (aka disaggregated), its value must be aggregated. #### Example ![a table of values for number of boxes of cereal, across five brands and three sizes of boxes](/tableau/next/en-us/online/en-us/Img/mfr_ex_cereal_rawdata.png) What's the value of "number of boxes of cereal?" Well, it depends on the aggregation type and the granularity as set by the dimensions. - Aggregations: - Sum (or total) - Average - Granularity: - Table scoped / fully aggregated (the blue bars in the example) - Broken down by the **Brand** dimension (the colored bars in the example) ![A dashboard with four vizzes, one for the summed table scoped number of boxes (54), one with the average table scoped number of boxes (6), and then versions of those two broken down by the five brands](/tableau/next/en-us/online/en-us/Img/mfr_ex_cereal.png) ## Field-level relatedness indicators There are several visual clues that can help you understand the degree of relatedness for fields you're using in an analysis. ### Relatedness indicators on a worksheet - **Unrelated icon**: Tableau uses an unrelated icon ![unrelated icon](/tableau/next/en-us/online/en-us/Img/mfr_icon_unrelated.png) to indicate not everything in the view is related. If you see an unrelated icon on a pill in the view or in the Data pane, you can hover over the icon [to get more information](https://help.tableau.com/current/pro/desktop/en-us/mfr_relatedness_messages.htm). - The related icon ![](/tableau/next/en-us/online/en-us/Img/MFR_icon_related.png "stitching icon") indicates that field is stitching together unrelated fields. - **Light gray field names**: Field names are displayed in light gray text in the Data pane when they're not related to _any_ fields in use on shelves. You can still use these fields for analysis in that viz, but unrelated fields are [evaluated differently](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm#joinsbyrelatedness) in analysis than fields that are related. On hover, these fields also display an unrelated icon. ![the data pane, with one entire table grayed out, and two fields with the slashed eye icon for hidden fields](/tableau/next/en-us/online/en-us/Img/mfr_gray_datapane.png) **Note**: In previous versions of Tableau, light gray field names indicated that the fields were hidden and Show hidden fields was selected. Hidden fields, when shown, are now indicated with a clickable eye icon ![hidden field icon](/tableau/next/en-us/online/en-us/Img/mfr_icon_hidden.png). ### Relatedness warning dialog When unrelated fields are used together in a viz, Tableau shows a warning dialog to let you know that the fields aren't related. This warning appears each time you add an unrelated field to prevent accidental cross joins that might impact performance. - If you want to use unrelated fields without stitching, click Add to continue adding the field to the viz. - If you want to stitch unrelated fields, a best practice is to bring out the stitching field before an otherwise unrelated field. The dialog won't show if the stitching field is already in use. See [How joins are used for each level of relatedness](#joinsbyrelatedness) for more information about how stitching prevents cross joins. ![the relatedness warning dialog showing a warning for unrelated dimensions](/tableau/next/en-us/online/en-us/Img/mfr_unrelated_dialog_simple_v2.png) When multiple fields are being added or are already present in the view, the Details area appears in the dialog. Expand it to see more information about the relatedness of all the fields in use and identify where the unrelatedness issue is coming from. ![the relatedness warning dialog with a message for both unrelated dimensions and measures, and with the Details area expanded](/tableau/next/en-us/online/en-us/Img/mfr_unrelated_dialog_details_v2.png) To stop the warning message from appearing at all, select the option Don't show this again. You can always re-enable these warning messages again by turning them back on: - In Tableau Desktop, open the Help menu > Settings and Performance > Reset Ignored Messages. - In a browser, clear your cached data. For example in Chrome, open the **3 dots menu** > **Delete Browsing Data...** > Choose "**Cached images and files**" > **Delete data**. ## Table-level relatedness in the data model In a data model with multiple base tables, each base table defines a set of tables that are related and form a conceptual _tree_. These trees must be connected by at least one shared table to ensure the overall data source is a single entity. What might previously have been two data sources that could be blended using linking fields can now be a single data source with two trees, connected by the shared tables that contain those common fields. ![two data models, one made of two distinct data sources, one of the two data sources superimposed on the tables they have in common to form a single data source](/tableau/next/en-us/online/en-us/Img/mfr_blending_comparison.png) > [!TIP] > > How tables are related in the data model impacts how their fields can be related in the analysis. It can be helpful to use the [View Data Model](https://help.tableau.com/current/pro/desktop/en-us/viewdatamodel.htm) dialog during analysis to see how a table fits into the overall data model. Let's walk through what tables are related, unrelated, or shared using this example data source. There are two trees, one established by base Table A and one by base Table B. ### Unrelated tables Base tables are fundamentally unrelated. Similarly, any tables that exist solely in a single tree are unrelated to tables in other trees.

Table A and Table X are unrelated	Table B and Table X are unrelated

### Related tables Tables in the same tree are considered related.

Table A and Table S are related	Table B and Table S are related (through Table A)

### Shared tables Shared tables have multiple incoming relationships. These tables belong to multiple trees and are shared across them. Table S and Table T are shared. ![A data model where tables S and T both have multiple incoming relationships. They both belong to base table A's tree and base table X's tree. ](/tableau/next/en-us/online/en-us/Img/mfr_relatedness_tables_shared.png) ## Field-level relatedness in the analysis Relatedness between fields is determined on a sheet-by-sheet basis based on the [structure of the data model](https://help.tableau.com/current/pro/desktop/en-us/viewdatamodel.htm), what fields are actively in use (that is, what fields are in the viz as pills on shelves), and if those fields are dimensions or measures. How field relatedness impact the results of a viz is covered in [the next section](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm#joinsbyrelatedness). Let's walk through some scenarios using the same example data source. Each field's name indicates which table it is from, such as FieldB from Table B. Fields can be dimensions or measures unless otherwise noted. ### Related fields At a high level, fields are related when Tableau can clearly determine how to evaluate them together based on a relationship path within a single tree. For example, FieldB (from Table B) and FieldS (from Table S) are related. ![FieldB and FieldS are related](/tableau/next/en-us/online/en-us/Img/mfr_relatedness_tables_related2.png) ### Unrelated fields At a high level, fields are unrelated in any case when they're not related. This could be because the fields are from unrelated tables, such as using fields from two base tables. In this case, fields from different base tables are fundamentally unrelated. For example, FieldA and FieldX are unrelated. ![FieldA and FieldX are unrelated](/tableau/next/en-us/online/en-us/Img/mfr_relatedness_tables_unrelatedbase.png) Or fields can be treated as unrelated for a point in time—such as in ambiguous or not yet related cases. For the most part, you can rely on [relatedness indicators](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_relatedness_messages.htm) to alert you when fields are unrelated in the context of a viz. ### Stitching dimension Stitching is how Tableau evaluates fields from unrelated tables in a multi-fact data model during analysis. In a viz, using a dimension from a shared table stitches together otherwise unrelated fields and allows them to be evaluated simultaneously in the same viz. Think of this as juxtaposing results from two trees together based on a dimension they share. For example, if a viz is built with FieldA and FieldX, these two fields are unrelated. Adding DimensionS introduces a stitching field. - FieldA and DimensionS are evaluated together. - FieldX and DimensionS are evaluated together. - Those intermediate results are brought together based on the values of DimensionS. - FieldA and FieldX are now stitched. ![unrelated base tables A and X stitched together by their shared table S](/tableau/next/en-us/online/en-us/Img/mfr_relatedness_fields_stitching.png) **Tip**: A best practice is to use a stitching field in the viz before bringing out an unrelated field. For example, drag out DimensionS first, or FieldA then DimensionS then FieldX, instead of FieldA then FieldX then DimensionS. Adding the stitching field first ensures that Tableau is always aware of how to evaluate the relationships and avoids potential performance issues from evaluating unrelated dimensions together with cross joins. Stitching requires a dimension from a shared table to be active in the viz. Fields placed on the Filters shelf or on the Tooltip property of the Marks card aren't considered active for the purposes of stitching. ### Not yet related fields Fields can also have multiple ways they could be related but aren't yet. This happens when there's more than one possible relationship between two shared tables (or downstream shared tables). Consider FieldS and FieldT. Their tables are related to each other both through the tree defined by base Table A and through the tree defined by base Table X. In a viz with just FieldS and FieldT, there's no information about which tree should be used to relate them. Without additional information Tableau can't evaluate whether to relate these fields through Base Table A's tree or Base Table B's tree. FieldS and FieldT are treated as unrelated although there are multiple _potential_ relationships. ![Under-related ambiguous fields S and T](/tableau/next/en-us/online/en-us/Img/mfr_relatedness_fields_not-yet_hyporelated.png) These could-be-but-aren't-yet-related fields are evaluated as unrelated because Tableau can't clearly determine their relationship path. Unlike truly unrelated fields which can only be stitched, not yet related fields can be resolved and the fields can be directly related. ### Ambiguously related fields Fields can also be ambiguously related. This happens when there is more than one active possible relationship between shared tables (or downstream shared tables). Unlike not yet related fields, which can be thought of as hypo-related or under related, ambiguously related fields are hyper-related or over related. Consider FieldS and FieldT. Their tables are related to each other both through the tree defined by base Table A and through the tree defined by base Table X. In a viz with FieldA, FieldX, FieldS, and FieldT, there's too much information to decide which tree should be used to relate them. Without trimming the information, Tableau can't evaluate whether to relate these fields through Base Table A's tree or Base Table B's tree. FieldS and FieldT are treated as unrelated although there are multiple _active_ relationships. ![](/tableau/next/en-us/online/en-us/Img/mfr_relatedness_fields_ambiguous_hyperrelated.png "over related") These ambiguously related fields are evaluated as unrelated because Tableau can't clearly determine their relationship path. Unlike truly unrelated fields which can only be stitched, ambiguously related fields can be resolved and the fields can be directly related. ### Ambiguous measure from a shared table When a dimension is used from a shared table, it stitches together fields from its unrelated upstream tables. Measure can't stitch, however, and the value of a measure depends on its related dimensions. In a viz with DimensionA and DimensionX, these two dimensions are unrelated. If MeasureS is brought out from Table S, it is unrelated to the combination DimensionA and DimensionX together. Although it could be related to either one independently, it can't be simultaneously related to both of them in the same viz. ![unrelated base tables A and X stitched together by their shared table S](/tableau/next/en-us/online/en-us/Img/mfr_relatedness_fields_stitching.png) A shared measure can be considered a type of ambiguity or over relatedness and is resolved the same way. ### Resolve unclear relationships between fields Whenever there is uncertainty about how to relate fields, Tableau won't make an arbitrary decision and instead treats them as unrelated. It's often better to relate these fields by clarifying the uncertainty around which tree to use. Resolving not yet related fields is done by adding a field to establish which tree to use. Resolving ambiguously related fields is done by removing fields to establish which tree to use. _Example:_ **Resolving not yet related**: add a field - In a viz of FieldS and FieldT, adding a field from Table A, B, or C to the viz makes Base Table A's tree active and resolves the desired path between FieldS and FieldT. - Alternatively, using a field from Table X resolves the desired path between FieldS and FieldT to Base Table X's tree. **Resolving ambiguously related**: remove a field or fields - In a viz of FieldA, FieldX, FieldS, and FieldT, removing FieldX makes only Base Table A's tree active and resolves the desired path between FieldS and FieldT. - Alternatively, removing FieldA resolves the desired path between FieldS and FieldT through Base Table X's tree. **Resolving a shared measure**: remove a field or fields - In a viz of DimensionA, DimensionX, and MeasureS, removing DimensionX makes only Base Table A's tree active and resolves the desired path between DimensionA and MeasureS. - Alternatively, removing DimensionA resolves the desired path between DimensionX and MeasureS through Base Table X's tree.

Not yet related	Ambiguously related	Relatedness resolved to a single tree
		Related through base Table A	Related through base Table X

Resolving uncertainty is similar to using a FIXED Level of Detail (LOD) expression. In a FIXED LOD expression, you tell Tableau what level of detail to aggregate to by defining the dimension declaration. Uncertainty is resolved by changing the structure of the viz to make only one tree active, thus telling Tableau what relationship paths it can consider to perform the analysis. ### Stitching vs resolving uncertainty Both stitching and resolving uncertainty are ways of dealing with unrelatedness, but they have different outcomes:

Stitching	Resolving uncertainty
Unrelated FieldA and FieldX stitched by DimensionS	FieldS and FieldT evaluated through the tree defined by base Table A
Juxtaposes unrelated fields based on shared attributes	Narrows down which relationship path to use when there are multiple options (ambiguity or a shared measure), or establishes a relationship path when there wasn't one (not yet related).
Uses multiple base table logic to calculate results	Uses single base table logic to calculate results
Analysis involves unrelated tables	Analysis involves shared tables

## How joins are used for each level of relatedness After the field-level relatedness has been determined, Tableau has to evaluate the results to create the actual visualization. The queries used to calculate the values shown in a viz rely on joins. Whether fields are related, unrelated, or stitched has a different impact on what joins are performed. Remember, ambiguously related and not yet related fields are treated as unrelated in this context. To explain relatedness and joins, this section covers tables and their fields, plus the values in those fields. Consider the following data model with two base tables, Classes and Clubs, and a shared table, Students. ![A data model with two base tables, classes and clubs, and a shared table, students](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_model.png)

Classes

Clubs

Students

view data for the classes table, showing the values for three fields

Fields:

Class, a dimension with values of Nesting Basics, Advanced Songs, Flying for Fledglings, and Alarm Calls 101
Length, a measure
Student, a dimension used to relate to the Student table

Fields:

Club, a dimension with values of Photography, Travel, Juggling, Art, and First Aid
Dues, a measure
Student, a dimension used to relate to the Student table

Fields:

Bus Rider, a dimension with values of yes or no
Student, a dimension with values of Finch, Cardinal, Sparrow, Robin, and Jay. Used to relate to the other two tables
Age, a measure

This very simple model illustrates how the high-level join logic is calculated for multi-fact relationship data models. For more information about the basics of joins used in single base table data models built on relationships, see [How Analysis Works for Multi-table Data Sources that Use Relationships](https://help.tableau.com/current/pro/desktop/en-us/datasource_multitable_analysis_overview.htm). Should this example be a data model with multiple base tables? For this three table data model, it might be tempting to set it up as a single base table model, as Classes-Students-Clubs or Clubs-Students-Classes, or with Students as a base table. As a rule, multi-fact relationship data models are intended for specific kinds of data schemas or analysis scenarios. If your data model [has characteristics that are best suited to a multi-fact relationship data model](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_when_to_use.htm), set it up that way to keep your base tables conceptually unrelated. However, if your data doesn't require this type of structure, a single base table model can be simpler to use. ![alternative data model structures for the classes-clubs-students example model](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_model_versions.png) Models that could be built for these three tables: (1) Classes and Clubs as base tables with Students as a shared table, (2) linearly, starting with either Classes or Clubs, and (3) Students as a single base table with Classes and Clubs as downstream tables. In this particular instance, there's nothing about these tables, the data, or the model that truly requires multiple base tables. We're using this model as an example to keep it simple so the focus can be on the join logic. Or you could imagine that there's another related table, Rooms, that we're simply ignoring to avoid over complicating the discussion. ![a version of the classes-clubs-students model with an additional shared table, rooms](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_model_withroom.png) As a best practice, however, only use a multi-fact relationship model when your data requires it. ### Related dimensions use inner joins Related dimensions are inner joined. Inner joins drop any dimension values that aren't shared across both tables. - Tableau uses additional logic to ensure measure values aren't lost. This section uses only dimensions to demonstrate the basics of how Tableau applies inner joins to related dimensions. The following example shows how related dimensions only return rows that are present in the data. No students are in the Alarm Calls 101 class, so it's not present in the results. Cardinal and Jay aren't in any classes, so they're not present in the results. ![A viz showing an inner join of Class and Student, with two rows for Finch (Advanced Songs, Nesting Basics), two rows for Robin (Flying for Fledgelings, Nesting Basics), and two rows for Sparrow (Advanced Songs, Nesting Basics)](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_relateddims_innerjoin.png) ### Unrelated dimensions use cross joins Unrelated dimensions—on their own, without a stitching dimension—are cross joined. In a cross join, every value from one dimension is combined with every value from the other dimension, even if a resulting combination doesn't actually exist in the data. In this example, the cross join adds a row for each possible combination of Class and Club. ![A viz showing a cross join of Class and Club with rows for every combination of Advanced Songs/Alarm Calls 101/Flying for Fledglings/Nesting Basics with Art/First Aid/Juggling/Photography. There is an unrelated icon shown on both dimension pills on the Rows shelf](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_unrelateddims_crossjoin.png) It's important to recognize when a cross join is occurring in your analysis. Although there's a row for Advanced Songs + First Aid in the results table for the cross join, no students are actually in this combination of activities (we'll see proof of this in the stitching example in the next section). Why is it important to recognize that not all cross join results are based in the data? Imagine you were trying to build a schedule for classes and clubs so there were no conflicts for any students. There aren't any students in Advanced Songs and First Aid, so you could ignore this result and schedule that class and club simultaneously. The cross join doesn't represent combinations of values that actually exist in the data. Additionally, cross joins when there is high cardinality (a large number of unique values) can impact performance. Imagine cross joining every phone number with every email address in your contacts. That would be a huge explosion of combinations and a potentially costly operation. ### Stitched dimensions use outer joins Unrelated dimensions—in the presence of a stitching dimension—are outer joined. In this example, both the Classes table and Clubs table are related to the shared Students table but not to each other, so the fields Class and Club are unrelated. Adding the Student dimension lets Tableau know which values from Class and which values from Club should be juxtaposed in the analysis. We call this outer join behavior _stitching_. ![A viz showing the results of an outer join of the Student-Class inner join and the Student-Club inner join. There is an unrelated icon on the Class and Club pills on the Rows shelf. A pill for Student is on the Color property of the Marks card and does not have an unrelated icon. Not all combinations of classes and clubs are represented, and there are rows for students and clubs without a class](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_stitched_outerjoin.png) Stitching is similar to data blending in that there are intermediate results that are brought back together for the overall results. Unlike blending, however, stitching is an outer join, not a left join, and doesn't drop values from either side. There's no concept of primary or secondary data sources when it's all one data source, so both of the unrelated fields are given equal precedence. #### Intermediate results are outer joined What goes into the outer join for stitched fields? An intermediate inner join is computed for the stitching field and each of the unrelated fields in turn, then those intermediate results are outer joined based on the values of the stitching dimension. **Example** An inner join for Student and Class... ![A results table for three values of students and three values of classes](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_stitched_inner1.png) ...and an inner join for Student and Club... ![A results table for four values of students and five values of clubs](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_stitched_inner2.png) ...are then outer joined on Student. ![A results table for four values of students, three values of classes, and five values of clubs](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_stitched_outerjoin.png) ### Additional joins to retain measures In addition to the join logic for dimensions, measures can introduce additional joins. When relationships were first introduced in Tableau, one of the [core principles was that measure values aren't lost](https://www.tableau.com/blog/relationships-tableau-data-model). This is also maintained in multi-fact relationship data models. The essential details are: - Measure values are broken down only by related dimensions. - Measure values repeat for unrelated dimensions. - Dimension values that would be dropped in dimension-only vizzes may be returned if there are relevant measure values associated with them. **Note**: Remember that measures are aggregations—they're computed at the level of detail (the granularity) set by the combination of dimensions in the viz. This is referred to as a measure being _broken down_ by a dimension. When a measure is used without any dimensions, it is said to be _table scoped_. This means the measure's value is the fully aggregated value. As soon as we use a dimension in the viz, the measure is broken down more granularly based on the dimension values. The value of a measure in an analysis therefore depends on the context of the dimensions. #### Related measures Consider the subset of dimension values that are returned for an inner join on the related dimensions **Student** and **Class.** There are _three_ student values, Finch, Robin, and Sparrow; and _three_ class values, Advanced Songs, Nesting Basics, and Flying for Fledgelings. ![a results table for an inner join between student and class](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_inner_student_class.png) If we add the **Length** measure from the Class table, we see that all _four_ classes are shown and there's a null for Student. Every class **Length** is displayed, at the level of **Class**. ![A null value appears for student even though dimensions are inner joined](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_related_measurefrombase.png) If we instead add the **Age** measure from the Student table, we see that all _five_ students are shown and there are two nulls for Class. The results preserve every student, even if they're not in a class. Every student **Age** is displayed, at the level of **Student**. ![A null value appears for classes even though the dimensions are inner joined](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_related_measurefromshared.png) #### Unrelated measures Measure values are repeated for unrelated dimension values. If we look at the **Length** measure from the Classes table and the unrelated **Club** dimension, the measure is table scoped and repeated across all the dimension values of **Club**. ![a table scoped measure repeated across unrelated dimension values](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_unrelateddim-measure.png) In the presence of a stitching dimension, measures can be both broken down and repeated. Here, the measure **Age** is from the Students table and is broken down to the level of student. Each time a student is repeated based on the dimensions for **Class** and **Club**, the **Age** value is repeated. ![](/tableau/next/en-us/online/en-us/Img/mfr_ex_birds_unrelateddims_sharedmeasure.png) ## Troubleshooting ### Considerations when working with multi-fact relationship data models **Per table extract filters** All extract filters for a multi-fact relationship data model extract are per-table (not pervasive). Because of this, filtering results may be different between live and extract connection. **Row level calculations** Row level calculations can only refer to fields which share the same upstream base table. That is, row level calculations can't be performed across trees. **Combined Fields** All fields in a combined field must share an upstream table. That is, you can't create a combined field using fields that are in different trees. **Sets** Sets can only be created with a definition that involves fields that share the same upstream base table. However, in a viz, the option to Add to Set may be available from a mark when that mark is defined by fields unrelated to the fields used to define the set. If you choose Add to Set, Tableau will add only the related fields to the set definition. This is different from the behavior for Add to Set in single base table data sources, when Add to Set adds everything that defines the mark. **Validate INCLUDE level of detail expressions** INCLUDE LOD expressions can't be evaluated across unrelated fields. Because relatedness between fields is evaluated on a sheet-by-sheet basis, it's possible to have a valid LOD expression in the Data pane or calculation editor that becomes invalid in the context of a specific viz (in the presence of an unrelated dimension). When this happens, the LOD pill will turn red. You can update the LOD expression to remove unrelated field conflicts, change the structure of the viz, or remove the LOD expression from the viz. **Updating Published Data Sources** As a best practice, create a copy of an existing published data source if you plan to modify it to become a multi-fact relationship data model when not all of its connected workbooks need the new data model. Don't update the existing version of the data source unless all its workbooks need the new tables. Publish the modified data source as a new data source and create new workbooks from it. This will prevent the existing workbooks from being converted to use VDS instead of data server when they don't need the functionality, preventing the potential for a performance hit. ### Resolved issues

Resolved Issue

Fixed as of

Extracts

Local data source (in a workbook): Attempting to extract a multi-fact relationship data source will give a "No such table" error.

Published data source: Extracting a published multi-fact relationship data source appears to succeed, but field values can be swapped.

Tableau Cloud: Resolved as of mid July updates. This also applies to public.tableau.com.
Tableau Desktop: Resolved as of maintenance release 2024.2.1 released July 24th, 2024
Tableau Server: Resolved as of maintenance release 2024.2.1 released July 24th, 2024

If you still see these issues in Tableau Desktop or Tableau Server, upgrade to a version from July 24th, 2024 or later.

EXCLUDE Level of Detail expressions

Only INCLUDE LODs should be validated in the presence of unrelated fields. However, EXCLUDE LODs may also be incorrectly marked as not valid in the same conditions.

Nested user calculations

Nested user calculations are not available in published data sources with a multi-fact relationship data model.

### Known issues **Relatedness indicators with multiple Marks cards** When a viz is built with multiple measures on the Rows shelf or on the Columns shelf, each measure gets its own Marks card. The logic used to determine relatedness indicators (the unrelated icon, the text in tooltips, and the relatedness warning dialog) may not give expected results depending on which Marks card is open. The viz itself, however, is correctly computed based on the relatedness of each pair of fields. There is a planned fix for this behavior. **BatchQueryProcessor** BatchQueryProcessor must be enabled to support multi-fact relationship data models. This is expected behavior with no currently planned fix. **Tableau Pulse** Tableau Pulse may not work with multi-fact relationship data models. You may be prevented from creating a metric definition, or any metrics that are created may be blank. This is not expected behavior but there is no currently planned fix yet. **Changing dimensions with a parameter** Tableau lets you [swap fields using a parameter](https://help.tableau.com/current/pro/desktop/en-us/parameters_swap.htm). However, with multi-fact relationships, swapping dimensions with a parameter will fail silently. The parameter and its calculation can be created, and the parameter control can be shown, but the field won't change when the parameter does. This is due to when dimensions are evaluated for relatedness and when parameters are evaluated in the order of operations. [Skip to main content](#main-content) # About Tableau Catalog > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. Data is increasing in volume, formats, and importance leading to more complex environments. With the rapid pace that data changes, it can be hard to keep track of that data and how it's being used in such complex environments. At the same time, more users need to access more of that data in more places, and it's difficult for users to find the right data. Ultimately, this causes a lack of trust in the data because people question whether they're using the right source or if the source is up to date. Tableau Catalog integrates features like lineage, impact analysis, data dictionary, data quality warnings, and search into your Tableau applications, helping solve these problems differently from a stand-alone catalog. It focuses on both IT and the end user so that everyone using Tableau Server or Tableau Cloud has more trust in and visibility into the data, while also enabling more discoverability. Tableau Catalog builds a catalog out of the Tableau content being used by your organization, enabling comprehensive functionality like the following: - **Impact analysis and lineage**. - You can see the workbooks and other Tableau content that depend on particular columns or fields from tables or data sources you manage. When you need to make changes to your data, you can notify the impacted Tableau authors using email. - As a workbook author, you can use lineage to trace the fields that your workbook depends on. - As a user, when you use a Tableau visualization, you can see where the data came from that was used to create the view. - **Curation and trust**. As a data steward, you can add helpful metadata, like descriptions and certification, so that users find the right data. You can set data quality warnings, view data details on the Data Details pane, certify assets, and remove assets from the catalog. - **Data discovery**. In Tableau Desktop or Tableau web authoring, you can use Tableau Catalog to search for databases, tables, data sources, and virtual connections to analyze in Tableau and connect to them from the search results. Starting in 2019.3, Tableau Catalog is available as part of Data Management for Tableau Server and Tableau Cloud. When the product key is active and enabled, the catalog features described above are integrated into the product you're using, so you can work with the data where you find it. ## How Tableau Catalog works Tableau Catalog discovers and indexes all the content on your site—workbooks, data sources, sheets, virtual connections, and flows—to gather metadata about the content. From the metadata, external assets (databases, tables, and other objects) are identified. Knowing the relationships between the content and the external assets enables Tableau to display the lineage of the content and external assets. Tableau Catalog also enables users to connect to external assets using Tableau Server or Tableau Cloud. Users on your site can publish or delete content, can attach data quality warnings or certifications, or do anything else that changes the content or its metadata on the site, and Tableau Catalog will update its information accordingly. For information about how you can use Tableau Catalog to support data governance in your organization, see [Governance in Tableau](https://help.tableau.com/current/blueprint/en-us/bp_governance_in_tableau.htm) in the Tableau Blueprint Help. ## Key Tableau Catalog terms - Metadata - Information about the data. - Tableau content - Content created in Tableau such as workbooks, data sources, virtual connections, and flows. - External assets - Databases (including data files) and tables (including table-like objects) used by Tableau content, published to Tableau Server or Tableau Cloud. ## License Tableau Catalog Tableau Catalog is licensed through Data Management. For information about how Data Management licensing works, see [License Data Management](https://help.tableau.com/v0.0/online/en-us/dm_license.htm). ## Enable Tableau Catalog After Tableau Server or Tableau Cloud is licensed with Data Management capabilities, you can enable Tableau Catalog by doing one of the following tasks: - **For Tableau Cloud**, no action is necessary unless your site was upgraded from Standard. Tableau Catalog is on by default, configured to use derived permissions, and ready to use. If your site was upgraded from Standard, a site admin must first turn on Catalog. For more information, see [Enable Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_enable.htm). For more information about derived permissions, see the [Permissions on metadata](https://help.tableau.com/v0.0/online/en-us/dm_perms_assets.htm#perms) topic. - **For Tableau Server**, the Server admin must first enable the Tableau Metadata API using the `tsm maintenance metadata-services` command. For more information, see [Enable Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_enable.htm). After the Metadata API is enabled, Tableau Catalog is on by default, configured to use derived permissions, and ready to use. For more information about derived permissions, see the [Permissions on metadata](https://help.tableau.com/v0.0/online/en-us/dm_perms_assets.htm#perms) topic. ## Features and functionality To learn more about the features you can use with Tableau Catalog, see the following Help articles: ### Data discovery - In the Connect pane on Tableau Desktop, under Search for Data select Tableau Server to [connect to data using Tableau Server or Tableau Cloud](https://help.tableau.com/current/pro/desktop/en-us/examples_tableauserver.htm). When Tableau Catalog is enabled, in addition to searching for published data sources to connect to, you can now search for and connect to the specific databases, tables, and objects used by published data sources and workbooks on your Tableau Server or your Tableau Cloud site. - [Search](https://help.tableau.com/current/pro/desktop/en-us/search.htm) is expanded to include results based on columns, databases, tables, and other objects when Tableau Catalog is enabled. - If you author in the web, in addition to published data sources, you can also [connect to databases and tables](https://help.tableau.com/current/pro/desktop/en-us/getstarted_web_authoring.htm#tableau-catalog-users-create-workbooks-from-external-assets). - If you use Tableau Prep on the web, you can [create new flows based on external assets](https://help.tableau.com/current/prep/en-us/prep_startflow.htm#start-a-new-flow), such as databases and tables. - If you [connect to Salesforce Data Cloud](https://help.tableau.com/current/pro/desktop/en-us/examples_data_cloud.htm), you'll see support for native Data Cloud objects built into Tableau Catalog. Data Lake Objects (DLOs), Data Model Objects (DMOs), and calculated insights appear distinct in search, connect, and lineage pages, which makes discovering, connecting to, and reusing them simpler. ### Curation and trust - [Certify your data assets](https://help.tableau.com/current/online/en-us/datasource_certified.htm) to help users find trusted and recommended data. - Set [data quality warnings](https://help.tableau.com/current/online/en-us/dm_dqw.htm) to alert users to data quality issues, such as stale or deprecated data. - Add [sensitivity labels](https://help.tableau.com/current/online/en-us/dm_labels_sensitivity.htm) to warn users about data that needs to be handled with care. - Add [custom labels](https://help.tableau.com/current/online/en-us/dm_labels_custom_categories.htm) to classify data in ways that suit the needs of your organization - [Manage data labels](https://help.tableau.com/current/online/en-us/dm_labels_manage.htm) to extend the label names and categories available to users. - Categorize items on Tableau Server and Tableau Cloud using [tags](https://help.tableau.com/current/pro/desktop/en-us/tags.htm) to help users filter external assets. - Better understand published visualizations by using the [Data Details](https://help.tableau.com/current/pro/desktop/en-us/data_explore_analyze_interact.htm#use-data-details-to-see-visualization-information) tab to see information about the data used. - [Add descriptions](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm#add-or-edit-descriptions) to databases, tables, and columns to help users find the data they're looking for. ### Lineage and impact analysis - Use [lineage](https://help.tableau.com/current/online/en-us/dm_lineage.htm) to trace the source of your data and to analyze the impact of changes to your data and identify which users might be impacted. - [Email owners](https://help.tableau.com/current/online/en-us/dm_lineage.htm#email) of a workbook, data source, or flow about data-related updates. Do the same with database, table, or object contacts. ### Developer resources You can use metadata methods in the Tableau REST API to programmatically update certain metadata. For more information about the metadata methods, see [Metadata Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_metadata.htm) in the Tableau Server REST API. In addition to the REST API, you can use the [Tableau Metadata API](https://help.tableau.com/current/api/metadata_api/en-us/index.html) to programmatically query metadata from the content published to Tableau Server or Tableau Cloud. The Metadata API is fast and flexible and is best when you are looking to find out specific information about the relationship between metadata and its structures. Explore and test queries against the Metadata API using an interactive in-browser tool called [GraphiQL](https://help.tableau.com/current/api/metadata_api/en-us/docs/meta_api_start.html#explore-the-metadata-api-schema-using-graphiql). (Note: Tableau Cloud requires Data Management to access the Metadata API and GraphiQL, but Tableau Server does not. This requirement started with Tableau Cloud October 2026. If you were using the Metadata API without Data Management at that time, you can continue doing so until June 2027.) [Skip to main content](#main-content) # About Tableau Cloud+ Edition Tableau Cloud+ edition is available exclusively for Tableau Cloud. It is tailored for wall-to-wall adoption of AI-powered, self-service analytics. It encompasses premium features tailored for larger or more complex deployments like Release Preview and a 50 site limit, premium AI functionality like Tableau Agent, and Premier Success for Tableau Cloud. **Note:** Tableau Cloud+ edition is also available as part of the Tableau+ Bundle, which includes Tableau Next. For more information about Tableau+ Bundle, see [About Tableau+ Bundle](https://help.tableau.com/v0.0/online/en-us/to_tab_plus_features.htm) . For a comparison of license editions, see the [Pricing page](https://www.tableau.com/pricing) on the Tableau.com site. ## Tableau Cloud+ Licensing Tableau Cloud+ edition is sold on a per-User basis, with Users differentiated by role - Creators, Explorers, and Viewers. Tableau Cloud+ edition provides a unique package of product capabilities for use by each User. Select AI features in Tableau Cloud+ edition of Tableau Cloud can be used in conjunction with the [Audit Trail](https://help.salesforce.com/s/articleView?id=release-notes.rn_einstein_audit_trail_intro.htm&release=248&type=5) feature in Data 360. Flex credits used by Data 360 are available through Salesforce Foundations and are shared across all Salesforce products. For more information on Data 360 billing, see [Billing Considerations for Audit and Feedback](https://help.salesforce.com/s/articleView?id=ai.generative_ai_audit_feedback_usage_types.htm&type=5) in the Salesforce Help. Starting in July 2026, Tableau Cloud+ customers can purchase Capacity-based Viewer Blocks alongside Tableau Cloud+. Capacity-based Viewer Blocks replace the per-user Viewer license. Capacity-based licensing provides unlimited Viewer user accounts and defines capacity based on concurrent usage rather than named users. Creators and Explorers continue to be licensed per user. A deployment can use either capacity-based or role-based Viewer licensing, but not both. For more information, see [Capacity-based license model](https://help.tableau.com/v0.0/online/en-us/license_product_keys.htm#capacity) ## Tableau Cloud+ Feature Table The following table lists the features that are included with Tableau Cloud+. Feature availability below is for the Creator. There are differences in available functionality between Creator, Explorer, and Viewer. For information about configuring Tableau Cloud+ features, see [Getting Started with Tableau Cloud+ Edition](https://help.tableau.com/v0.0/online/en-us/to_tab_cloud_plus_get-started.htm).

Feature	Description
Tableau Authoring	Use Tableau Desktop or Tableau web authoring on Tableau Cloud to create, collaborate, and share insights about your data. Tableau provides you a way to identify and solve problems, or highlight key findings in a visual and easily understandable way.
Tableau Prep	Tableau Prep is a data preparation tool for cleaning, shaping, and combining data for analysis.
eLearning	Role-based training Tableau Learning Paths provide a clear track to proficiency with the most up-to-date Tableau training content. Assessments help you evaluate where you are in your learning path and give you confidence in your new skills. Accelerate the onboarding process for new employees and help more experienced users get the most out of Tableau capabilities. This feature is available for Creator and Explorer licenses. This feature is not available with Capacity-based Viewer Blocks licensing.
Tableau Pulse	Tableau Pulse provides insights about your data as a digest sent to subscribed members of an organization. These digests of Pulse insights can surface trends, outliers, and other changes, keeping you up to date on the data relevant to your work. Enhanced Q&A (Discover) is a premium feature in Tableau Pulse. For information about setting Pulse up, see Set Up Your Site for Tableau Pulse
Tableau Agent in Tableau in Prep Tableau Agent in Tableau in Catalog	Tableau Agent is an intelligent assistant that accelerates time to insight in Tableau Prep and Catalog. For information about configuring your Tableau Cloud site for AI in Tableau, see Turn On AI in Your Tableau Cloud Site.
Tableau Agent in Tableau Cloud Web Authoring	Tableau Agent in Tableau Cloud web authoring is an intelligent assistant that accelerates time to insight with automated data analysis. For information about enabling Tableau Agent in Tableau Cloud web authoring, see Turn On AI in Your Tableau Cloud Site.
Private Connect	Private Connect for AWS (Amazon Web Services) allows cloud administrators to create secure, private, and dedicated connections between Tableau Cloud and AWS-hosted data providers. These private connections are provisioned on top of AWS PrivateLink, using private IP address space, meaning that data traffic doesn't traverse the public internet. The private and secure nature of private connections addresses a key requirement of restricting data traffic to private networks. Not included by default in Tableau Cloud+, but available for purchase separately.
Data Management	Data Management is a collection of features and functionality that helps customers manage Tableau content and data assets in their Tableau Cloud environment. One Resource Block Node is included.
Advanced Management	Advanced Management is a collection of features designed to provide enhanced security, manageability, and scalability capabilities for Tableau Cloud.
Use Tableau Cloud Manager	Tableau Cloud Manager (TCM) provides administrators with a centralized management interface for overseeing their organization's Tableau Cloud sites. With TCM, cloud administrators can create and edit sites, manage users, and monitor license consumption across multiple sites in their tenant, all from a single location. Cloud administrators can manage up to 50 sites with a Tableau Cloud+ license.
Data 360 (Formerly Data Cloud)	Salesforce Data 360 makes all Salesforce data natively available in Tableau, allowing you to unify enterprise data, harness the power of metadata, and drive AI results from that data.
External KMS for Extract Encryption	External key management empowers organizations to encrypt their extracts using keys controlled in their own AWS Key Management Service (KMS). This enhances security, helps meet compliance requirements, and provides greater data sovereignty by allowing customers direct control over their encryption keys.
Premier Success	The Premier Success Plan helps you start strong, grow your business, and get more value from Salesforce with expert guidance and expedited support.
About Tableau Release Preview	Release preview allows cloud administrators to create and maintain Tableau Cloud sites that receive major release updates before other production environments are upgraded.
On-demand Access for Embedding Workflows	On-demand access allows customers to provide visualization access to external users without requiring each user to have a named Viewer license. Users are authenticated but do not need to be added as users in Tableau Cloud. This feature is available when Tableau Cloud is licensed with the capacity-based model, Capacity-based Viewer Blocks. Not available with role-based Viewer licensing.
Tableau Knowledge	Tableau Knowledge equips AI agents with essential business context by connecting trusted Tableau Cloud content and business knowledge into live knowledge graphs to deliver accurate, explainable answers.

## Other articles in this section [Skip to main content](#main-content) # About Tableau Content Migration Tool This set of articles guides you through setting up, using, and maintaining the Tableau Content Migration Tool. **Note**: The Tableau Content Migration Tool is not recommended for migrations when moving from Tableau Server to Tableau Cloud. To migrate from Tableau Server to Tableau Cloud, use the [Tableau Migration SDK](https://help.tableau.com/current/api/migration_sdk/en-us/index.html). For Tableau Content Migration Tool recommended use cases, see [Tableau Content Migration Tool Use Cases](https://help.tableau.com/v0.0/online/en-us/cmt-use-cases.htm#cmt-use-cases) ## What is Content Migration Tool? The Content Migration Tool provides an easy way to copy or migrate content between projects. The Content Migration Tool user interface walks you through the steps necessary to build a "migration plan" that you can use once or as a template for multiple migrations. **Note:** If you have a Tableau Server deployment, you can migrate content between projects on a Tableau Server installation and a Tableau Cloud site. Both deployments must have a valid Advanced Management license. Before migrating content, we recommend reviewing the [Content Governance](https://help.tableau.com/current/blueprint/en-us/bp_governance_in_tableau.htm#content-governance-in-tableau) section in Tableau Blueprint. ## Help and Support If you have problems that you cannot solve with this documentation, contact [Tableau Technical Support](http://www.tableau.com/support/request). ## Other articles in this section [Skip to main content](#main-content) # About Tableau Enterprise Tableau Enterprise is our advanced software package to help you explore and manage data faster with Tableau Cloud. It also makes it easier to purchase the capabilities needed by organizations that require advanced data and deployment management options. ## Tableau Enterprise Licensing As of March 2026, Tableau Enterprise is sold in the following models: - **Tableau Server or Tableau Cloud Role-Based Edition** The role-based edition is sold on a per-User role-based licensing model, including Creators, Explorers, and Viewers. This model is structured around the specific roles within an organization, each requiring different levels of functionality. With Tableau Enterprise, each role-based license includes Data Management, Advanced Management, and eLearning for Creators and Explorers. Available for Tableau Server or Tableau Cloud. - **Tableau Server Core Edition** The core edition is capacity-based and sold in 8-core increments, and bundles Advanced Management and Data Management into the license. Available only for Tableau Server. Starting in July 2026, Tableau Enterprise customers can purchase Capacity-based Viewer Blocks alongside Tableau Enterprise. Capacity-based Viewer Blocks replace the per-user Viewer license. Capacity-based licensing provides unlimited Viewer user accounts and defines capacity based on concurrent usage rather than named users. Creators and Explorers continue to be licensed per user. A deployment can use either capacity-based or role-based Viewer licensing, but not both. For more information, see [Capacity-based license model](https://help.tableau.com/v0.0/online/en-us/license_product_keys.htm#capacity). ## Tableau Enterprise Feature Table The following table lists the features that are included with the Tableau Enterprise license edition. Feature availability below is noted for Creator. There are differences in available functionality between Creator, Explorer, and Viewer.

Feature	Description
Tableau Authoring	Use Tableau Desktop or Tableau web authoring on Tableau Cloud to create, collaborate, and share insights about your data. Tableau provides you a way to identify and solve problems, or highlight key findings in a visual and easily understandable way.
Tableau Prep	Tableau Prep is a data preparation tool for cleaning, shaping, and combining data for analysis.
eLearning	Role-based training Tableau Learning Paths provide a clear track to proficiency with the most up-to-date Tableau training content. Assessments help you evaluate where you are in your learning path and give you confidence in your new skills. Accelerate the onboarding process for new employees and help more experienced users get the most out of Tableau capabilities.
Tableau Pulse Release Notes (Tableau Cloud only)	Tableau Pulse provides insights about your data as a digest sent to subscribed members of an organization. These digests of Pulse insights can surface trends, outliers, and other changes, keeping you up to date on the data relevant to your work. For information about setting Pulse up, see Set Up Your Site for Tableau Pulse
About Data Management	Data Management is a collection of features and capabilities that helps customers manage Tableau content and data assets in their Tableau Cloud environment. One Resource Block Node is included with Tableau Enterprise.
About Tableau Advanced Management on Tableau Cloud	Advanced Management is a collection of features and capabilities designed to provide enhanced security, manageability, and scalability for Tableau Cloud.
Use Tableau Cloud Manager	Tableau Cloud Manager (TCM) provides administrators with a centralized management interface for overseeing their organization's Tableau Cloud sites. With TCM, cloud administrators can create and edit sites, manage users, and monitor license consumption across multiple sites in their tenant, all from a single location. Cloud administrators can manage up to 10 sites with an Enterprise license.
About Data Connect	Data Connect allows seamless access to data across on-premises and private cloud environments in Tableau Cloud without significant increases in IT overhead. Not included by default in Tableau Enterprise, but available for purchase separately.
Private Connect	Private Connect for AWS (Amazon Web Services) allows cloud administrators to create secure, private, and dedicated connections between Tableau Cloud and AWS-hosted data providers. These private connections are provisioned on top of AWS PrivateLink, using private IP address space, meaning that data traffic doesn't traverse the public internet. The private and secure nature of private connections addresses a key requirement of restricting data traffic to private networks. Not included by default in Tableau Enterprise, but available for purchase separately.
External KMS for Extract Encryption	External key management empowers organizations to encrypt their extracts using keys controlled in their own AWS Key Management Service (KMS). This enhances security, helps meet compliance requirements, and provides greater data sovereignty by allowing customers direct control over their encryption keys.

[Skip to main content](#main-content) # About Tableau Knowledge Tableau Knowledge is an enterprise knowledge management solution that helps AI agents understand your organization's data and business context. It connects trusted Tableau Cloud content and business knowledge into live knowledge graphs, giving agents context so they consistently provide accurate and explainable answers. This intelligent network of knowledge and assets enables agents to understand not only what your data contains, but also what it means to your business. For example, Tableau Knowledge can help an agent interpret revenue, profit, or regional definitions according to the business logic your organization has established, rather than making assumptions. **Note:** Tableau Knowledge is currently available in English only. ## Licensing and roles Tableau Knowledge is available for Tableau+ licenses on Tableau Cloud. Your Tableau Cloud site role determines the actions that you can perform: | Task | Required Tableau Cloud site role | | --- | --- | | Create, change, or delete a knowledge graph | Tableau Cloud Site Administrator Creator, Tableau Cloud Site Administrator Explorer, and Tableau Cloud Creator | | Query a knowledge graph as a user or through an agent | Tableau Cloud Explorer or Tableau Cloud Viewer | ## Key concepts To better understand Tableau Knowledge, become familiar with these common terms: | Term | Description | | --- | --- | | Knowledge graph | A connected representation of Tableau Cloud assets, business knowledge, and their relationships. | | Node | An item in the graph, such as a field, table, workbook, dashboard, data source, metric, document, or business preference. | | Relationship | A connection between graph nodes, such as a field belonging to a data source or a workbook containing a worksheet. | | Business preference | A natural-language instruction that provides organization-specific business rules, terminology, or guidance for agents. | | Default knowledge graph | The knowledge graph that an agent queries when it does not specify a graph. | | Graph health | An indication of the completeness and quality of a knowledge graph. | ## Benefits of Tableau Knowledge Tableau Knowledge provides visibility across your organization’s knowledge, allowing you to optimize it for agent consumption. AI Agents that consume this knowledge provide detailed, accurate answers to your questions. Tableau Knowledge helps you and AI agents to: - Use consistent business definitions. Add business preferences that define terms and business rules for the whole knowledge graph. Connected agents can use this shared context consistently. - Ground answers in trusted content. Agents use trusted business definitions and calculations from semantic models, metadata, relationships, and business preferences in the knowledge graph, rather than relying only on raw data. - Understand the context behind the answers. Tableau Knowledge helps agents use relevant data assets and business definitions when responding to questions. - Improve graph quality. The Tableau Knowledge Graph Quality Scorecard and related improvements identify opportunities to improve the knowledge graph, such as missing descriptions, owners, certifications, and connections between assets. - Maintain governance. Tableau Knowledge works with Tableau Cloud access controls to help protect access to Tableau content. ## Tableau Knowledge users Tableau Knowledge supports the people who manage organizational knowledge and the AI agents that use it. ### Creators Tableau Creators build and maintain knowledge graphs. They select Tableau Cloud content, upload supporting documents, add business preferences, and address recommendations for strengthening the graph. For example, a creator can: - Create a knowledge graph. - Add Tableau Cloud content to a knowledge graph. - Upload a glossary or other supporting document. - Add a business preference that applies to the entire graph. - Review graph health and optimization suggestions. - Set the default knowledge graph for the site. Knowledge graph managers can also use the Tableau Agent for Knowledge to ask questions about a knowledge graph and identify ways to improve it. ### AI agents and their users AI agents including Tableau Agent for Knowledge in Tableau Cloud and any agent running over MCP query Tableau Knowledge graphs to answer questions for users. When used as a consumer, an agent reads from the knowledge graph. It retrieves relevant business context including: assets, metadata, relationships, and business preferences to ground its responses in your organization's data and terminology. ## How Tableau Knowledge works A knowledge graph represents the network of knowledge across your business—it connects enterprise data, business definitions, and context to show how they relate to each other. When you create a knowledge graph it is automatically generated based on the selected sources and inferred relationships. The knowledge graph is presented in two ways: - **Graph View**—each entity type is represented as a node connected to all nodes it is related to. - **Explorer View**—each entity type is represented in a hierarchical tree where related nodes are represented as nested nodes. Both views have the same functionality. The only difference is the presentation. Note that the nodes that appear in the knowledge graph are only the nodes that you are permitted to see. When you connect Tableau Cloud content to Tableau Knowledge, the knowledge graph represents the included assets and their relationships. The graph is generated live once you select the data to include. When you create a knowledge graph, Tableau Knowledge automatically infers relationships between sources and includes them in the graph. You can also add any Tableau asset such as workbooks and published data sources (PDS) and business preferences to provide more guidance about how your organization defines and uses its data. For example, a graph can connect a revenue field to its published data source, related workbook, and a business preference that explains how your organization defines revenue. ### Default knowledge graph When you use an agent to query Tableau Knowledge without specifying a graph, Tableau Knowledge refers to the default knowledge graph. The same concept applies to the Tableau Agent for Knowledge. If you don’t specify a graph in your question, the Agent answers your questions from what it knows about the default graph. In the home page dashboard, the specified graph (default or other) is indicated. All metrics and reporting correspond to the indicated knowledge graph. ### Entity types Tableau Knowledge graph nodes can be of any of these Tableau Cloud entity types: - Published data sources - Workbooks - Dashboards - Sheets - Business preferences - Embedded data sources ### Business preferences Business preferences are natural-language instructions that explain organization-specific logic, terminology, and how your organization uses data. They help agents interpret information consistently. For example, a business preference might define how to answer the question when asked about the best performing or largest accounts. In this case you could add a preference to instruct the Tableau Agent to use the accounts with the highest total\_amount. Business preferences apply globally across the entire knowledge graph. The business preference can be in the form of simple instructions in natural language or an uploaded document. If you use a document, each preference must be in its own paragraph, one business preference per paragraph. Supported document formats are: - PDF (`.pdf`) - Microsoft Word (`.docx`) - Plain text (`.txt`) - Markdown (`.md`) - Comma-separated values (`.csv`) **Note:** If you added business preferences to a Tableau core workbook which is part of a Tableau Knowledge graph, the preferences are ingested as business preferences and associated with the workbook node. These preferences take precedence over the global business preferences and cannot be edited inside the knowledge graph. For more information about business preferences, see [Improve response quality for Dashboard Q&A](https://help.tableau.com/current/pro/desktop/en-us/dashboard-narratives.htm#improve-response-quality-for-dashboard-qa). ### Knowledge graph quality scorecard and suggestions Tableau Knowledge provides a health score and recommended actions to help you evaluate and strengthen a knowledge graph. Suggestions can identify issues such as: - Assets without descriptions - Assets without owners or certifications - Disconnected assets - Incomplete business context Use these suggestions to determine where additional documentation, context, or governance can improve the quality of agent responses. The higher the score on the scorecard the more agent ready your graph is. ### Tableau Agent for Knowledge Get insights on your knowledge graph quality, ask questions about any knowledge graph, or get help with managing knowledge graphs by starting a conversation with the Tableau Agent for Knowledge. You can do this on any screen or in the dedicated Chat Menu. Remember to specify the knowledge graph you want to ask about; if you don’t, Tableau Agent for Knowledge uses the default knowledge graph to derive its answers. To get started, ask a question in the chat window or choose a suggested question. ## Example use case Peter, a Tableau data analyst, receives a question from Mary in Sales: “What NQLs did my org create?” While working on the Sales Pipeline Overview dashboard Peter queries the Tableau Agent. Tableau Agent queries the default knowledge graph and identifies the relevant Leads field, regional sales dashboard, and business context. It also identifies that NQL refers to new leads based on the business preferences provided in the graph. It can then provide an answer that is based on the organization’s Tableau Cloud content and terminology, rather than a generic interpretation of the question. The Agent supplies the correct answer and Peter sends Mary the response. ## See also - [Tableau Cloud Help](https://help.tableau.com/current/online/en-us/tableau-online-home.htm) - [Tableau Cloud: Tableau MCP Server](https://tableau.github.io/tableau-mcp/docs/intro) - [Salesforce Help: Tableau](https://help.salesforce.com/s/articleView?id=analytics.tableau.htm&type=5) ## Other articles in this section [Skip to main content](#main-content) # About Tableau Pulse With Tableau Pulse, users receive personalized data insights about metrics that they follow. These insights are sent directly to users in email, Slack, and Microsoft Teams digests, giving them access to the data they need in the tools they already use. If users want to learn more about their data, they can open the metric details page on Tableau Cloud or in Tableau Mobile. On that page, users can engage in guided data analysis to understand what is driving changes to their data. Tableau Pulse is available for Tableau Cloud. To get a site ready for Tableau Pulse, a site administrator must first turn on the site setting for Tableau Pulse and make sure that there's appropriate data to work with. Then, users can create metric definitions, which specify the core metadata for metrics. Users create metrics based on these definitions by adjusting filter and time options to scope the data in ways that are useful for different groups of followers. The articles in this section help you get started with Tableau Pulse, whether you're a Tableau administrator setting up your site, a Creator defining the metadata that metrics are based on, a Viewer exploring existing metrics, or a developer embedding metrics. | Article | Audience | About | | --- | --- | --- | | [Tableau Pulse Release Notes](https://help.tableau.com/v0.0/online/en-us/pulse_intro.htm) | Creators, Explorers, and Viewers | Feature announcements for Tableau Pulse releases | | [Set Up Your Site for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm) | Site Administrators | Settings, permissions, and requirements for Tableau Pulse | | [Create Metrics with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm) | Creators, Site Administrator Explorers, and Explorers (can publish) | How to create metric definitions and metrics | | [Set Up Your Data for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_data_source_requirements.htm) | Creators, Site Administrator Explorers, and Explorers (can publish) | Data source requirements for creating metric definitions | | [Explore Metrics with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm) | Creators, Explorers, and Viewers | The types of analysis you can do with metrics | | [Follow Metrics and Manage Followers in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_manage_followers.htm) | Creators, Explorers, and Viewers | How to follow metrics and add others as followers | | [Set Manual Goals and Thresholds with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_goals.htm) | Creators, Explorers, and Viewers | Goals and thresholds that let you track metric performance | | [Ask Questions and Discover Insights in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm) | Creators, Explorers, and Viewers | Insights from Tableau Agent in Pulse and Ask Q&A | | [The Insights Platform and Insight Types in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_insights_platform_insight_types.htm) | Creators, Explorers, and Viewers | The insight types in Tableau Pulse and how the Insights platform works | | [Get Tableau Pulse Alerts](https://help.tableau.com/v0.0/online/en-us/pulse_alerts.htm) | Creators, Explorers, and Viewers | Alerts about unfavorable changes for the metrics that you follow | | [Work with Tableau Pulse Metrics and Dashboards](https://help.tableau.com/v0.0/online/en-us/pulse_dashboard.htm) | Creators, Site Administrator Explorers, and Explorers (can publish) | The Pulse dashboard object and recommended metrics for dashboards | | [Premium Tableau Pulse Capabilities](https://help.tableau.com/v0.0/online/en-us/pulse_capabilities.htm) | Creators, Explorers, and Viewers | Tableau Pulse capabilities available for Tableau+ users | | [Tableau Pulse REST API Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_pulse.htm) | Developers | The API methods to create metrics, get metric details, generate insights, and more | | [Embed Tableau Pulse](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_pulse.html) | Developers | The Tableau Embedding API web component for embedding metrics in a web page | | [Set Up the Pulse for Salesforce App](https://help.tableau.com/v0.0/online/en-us/pulse_salesforce.htm) | Salesforce customers | The Pulse app that Salesforce customers can purchase (no longer for sale) | | [Configure a Tableau Pulse Lightning Web Component](https://help.tableau.com/v0.0/online/en-us/lwc_tableau_pulse.htm) | Salesforce customers | The Tableau Pulse Lightning web component for Salesforce Lightning pages | | [Interact with Data on Tableau Mobile](https://help.tableau.com/current/mobile/mobile-user/en-us/tableau_mobile_interact.htm) | Creators, Explorers, and Viewers | Tableau Pulse on Tableau Mobile | ## Other articles in this section [Skip to main content](#main-content) # About Tableau Release Preview Starting in April 2025, [cloud administrators](https://help.tableau.com/current/online/en-us/cloud_manager_admin.htm) can create release preview sites to assess the functional changes in Tableau Cloud major releases before they are applied to production environments. This topic outlines scenarios where creating a release preview site is beneficial, such as for integration testing, compliance, and release readiness. It also provides detailed instructions on how to create a release preview site using Tableau Cloud Manager (TCM). **Note:** Release preview is available only for Tableau+ customers. For more information, see [About Tableau+ Bundle](https://help.tableau.com/v0.0/online/en-us/to_tab_plus_features.htm) . ## Getting started A release preview site allows administrators and authorized users to assess new features and functional changes ahead of production upgrades in Tableau Cloud. These sites are hosted in dedicated limited-release preview environments and are updated separately from standard Tableau Cloud sites. Each preview site you create counts against the 50 sites granted to you as part of your Tableau+ edition. Consider creating a release preview site for these scenarios: - **Integration testing:** Test your unique configurations and integrations with the upcoming release. This helps you prepare for changes and make any necessary adjustments before they are applied to production sites. - **Compliance:** Make sure that your organization's analytics practices and procedures comply with regulatory standards and internal policies, such as GxP and SOX. - **Release readiness:** Understand what’s new and how it works to develop communication, training, and adoption plans for your end-users. ## Release communication Cloud and site administrators of release preview sites will receive in-product notifications within the preview site two weeks before the release and after the update is complete. Notifications include the tentative release schedule and link to Tableau Cloud Help documentation. Release deployment to release preview sites is separate from the standard Tableau release process. Release preview sites will be updated with major releases at least two weeks ahead of standard Tableau Cloud sites. For more information about Tableau Cloud maintenance communication and release cadence, see [Tableau Cloud System Maintenance](https://help.tableau.com/v0.0/online/en-us/to_maintenance_schedule.htm). ## Create a release preview site Similar to other sites in your tenant, cloud administrators can create a release preview site through Tableau Cloud Manager (TCM). To create a release preview site, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. On the Sites page, select New Site. 3. In the New Site dialog, go to Site location, and select a location with a “Release Preview” prefix from the dropdown menu. For example, `Release Preview - US West - Oregon`. ![](/tableau/next/en-us/online/en-us/Img/release_preview_site_location.png) 4. Complete the remaining fields in the dialog, and then select Create. For more information about managing sites in TCM, see [Add, Rename, Delete, or Activate Sites](https://help.tableau.com/v0.0/online/en-us/cloud_manager_sites.htm). ## Explore feature changes with Tableau Release Navigator You can use the Tableau Release Navigator dashboard to explore changes deployed to release preview sites. The included features are visible in the dashboard until the changes are applied to production environments. ![](/tableau/next/en-us/online/en-us/Img/release_preview_navigator.png) To see features included in release preview sites, follow these steps: 1. Go to [Tableau Cloud Release Notes](https://help.tableau.com/v0.0/online/en-us/whatsnew_online.htm) and scroll down to the Tableau Release Navigator dashboard. Keep in mind that the embedded table might look different depending on your browser's zoom level. For a better viewing experience, you can see the full dashboard on [Tableau Public](https://public.tableau.com/app/profile/tableau.core.product.marketing/viz/ReleaseNavigator-V21/FeaturesInVersionDash). 2. Find \[Release Preview\] at the beginning of each item’s description to see the features available on your preview site. Release preview updates are at the top of the dashboard. 3. To access feature-specific documentation, select or hover over the feature. A tooltip will appear with a link to the Tableau Cloud Help topic. **Note:** Release preview links use a temporary URL, such as `https://help.tableau.com/**release-preview**/online/en-us/`. These topics describe upcoming features and are subject to change. See the current version of Tableau Help for final feature details after production upgrades. For example: `https://help.tableau.com/**current**/online/en-us/`. [Skip to main content](#main-content) # About Tableau+ Bundle Tableau+ Bundle is a comprehensive package tailored for wall-to-wall adoption of self-service agentic analytics in Tableau Cloud and Tableau Next. It encompasses premium features tailored for larger or more complex deployments like premium AI functionality with Tableau Agent, a 50 site limit, Release Preview and Premier Success for Tableau Cloud. With Tableau+ Bundle, customers also get access to the world's first agentic analytics platform, [Tableau Next](https://help.salesforce.com/s/articleView?id=analytics.tua.htm&type=5 "link to Tableau Next documentation on the Salesforce H&T site"). ## Tableau+ Bundle Licensing Tableau+ Bundle is sold on a per-User basis, with Users differentiated by Tableau Cloud role - Creators, Explorers, and Viewers. Tableau+ Bundle provides a unique package of product capabilities for use by each User. Each Creator also receives a Creator role license in Tableau Next. Every Explorer and Viewer receives a Consumer role license in Tableau Next. Select AI features in the Tableau+ Bundle edition of Tableau Cloud can be used in conjunction with the [Audit Trail](https://help.salesforce.com/s/articleView?id=release-notes.rn_einstein_audit_trail_intro.htm&release=248&type=5) feature in Data 360. Each Tableau+ Bundle deployment includes a set quantity of credits. These may be Data Services Credits or Flex Credits, depending on the license your organization purchased. For more information on Data 360, see [Billing Considerations for Audit and Feedback](https://help.salesforce.com/s/articleView?id=ai.generative_ai_audit_feedback_usage_types.htm&type=5) in the Salesforce Help. Starting in July 2026, Tableau+ Bundle customers can purchase Capacity-based Viewer Blocks alongside Tableau+ Bundle. Capacity-based Viewer Blocks replace the per-user Viewer license. Capacity-based licensing provides unlimited Viewer user accounts and defines capacity based on concurrent usage rather than named users. Creators and Explorers continue to be licensed per user. A deployment can use either capacity-based or role-based Viewer licensing, but not both. For more information, see [Capacity-based license model](https://help.tableau.com/v0.0/online/en-us/license_product_keys.htm#capacity). ## Tableau+ Bundle Feature Table The following table lists the features that are included with Tableau+ Bundle license edition. Feature availability below is for the Creator. There are differences in available functionality between Creator, Explorer, and Viewer. For information about configuring Tableau+ Bundle features, see [Getting Started with Tableau+ Bundle](https://help.tableau.com/v0.0/online/en-us/to_tab_plus_get-started.htm).

Feature	Description
Tableau Next	Tableau Next, enabled by Data 360 and the Salesforce platform, is a composable, AI-analytics platform with semantic AI adding context and meaning to your data analytic insights.
Tableau Authoring	Use Tableau Desktop or Tableau web authoring on Tableau Cloud to create, collaborate, and share insights about your data. Tableau provides you a way to identify and solve problems, or highlight key findings in a visual and easily understandable way.
Tableau Prep	Tableau Prep is a data preparation tool for cleaning, shaping, and combining data for analysis.
eLearning	Role-based training Tableau Learning Paths provide a clear track to proficiency with the most up-to-date Tableau training content. Assessments help you evaluate where you are in your learning path and give you confidence in your new skills. Accelerate the onboarding process for new employees and help more experienced users get the most out of Tableau capabilities. This feature is available for Creator and Explorer licenses. This feature is not available with Capacity-based Viewer Blocks licensing.
Tableau Pulse	Tableau Pulse provides insights about your data as a digest sent to subscribed members of an organization. These digests of Pulse insights can surface trends, outliers, and other changes, keeping you up to date on the data relevant to your work. Tableau Agent in Pulse is a premium feature in Tableau Pulse. For information about setting Pulse up, see Set Up Your Site for Tableau Pulse
Tableau Agent in Tableau in Prep Tableau Agent in Tableau in Catalog	Tableau Agent is an intelligent assistant that accelerates time to insight in Tableau Prep and Catalog. For information about configuring your Tableau Cloud site for AI in Tableau, see Turn On AI in Your Tableau Cloud Site.
Tableau Agent in Tableau Cloud Web Authoring	Tableau Agent in Tableau Cloud web authoring is an intelligent assistant that accelerates time to insight with automated data analysis. For information about enabling Tableau Agent in Tableau Cloud web authoring, see Turn On AI in Your Tableau Cloud Site.
Private Connect	Private Connect for AWS (Amazon Web Services) allows cloud administrators to create secure, private, and dedicated connections between Tableau Cloud and AWS-hosted data providers. These private connections are provisioned on top of AWS PrivateLink, using private IP address space, meaning that data traffic doesn't traverse the public internet. The private and secure nature of private connections addresses a key requirement of restricting data traffic to private networks. Not included by default in the Tableau+ Bundle, but available for purchase separately.
Data Management	Data Management is a collection of features and functionality that helps customers manage Tableau content and data assets in their Tableau Cloud environment. One Resource Block Node is included.
Advanced Management	Advanced Management is a collection of features designed to provide enhanced security, manageability, and scalability capabilities for Tableau Cloud.
Use Tableau Cloud Manager	Tableau Cloud Manager (TCM) provides administrators with a centralized management interface for overseeing their organization's Tableau Cloud sites. With TCM, cloud administrators can create and edit sites, manage users, and monitor license consumption across multiple sites in their tenant, all from a single location. Cloud administrators can manage up to 50 sites with a Tableau+ Bundle license.
Data 360 (Formerly Data Cloud)	Salesforce Data 360 makes all Salesforce data natively available in Tableau, allowing you to unify enterprise data, harness the power of metadata, and drive AI results from that data.
External KMS for Extract Encryption	External key management empowers organizations to encrypt their extracts using keys controlled in their own AWS Key Management Service (KMS). This enhances security, helps meet compliance requirements, and provides greater data sovereignty by allowing customers direct control over their encryption keys.
Premier Success	The Premier Success Plan helps you start strong, grow your business, and get more value from Salesforce with expert guidance and expedited support.
About Tableau Release Preview	Release preview allows cloud administrators to create and maintain Tableau Cloud sites that receive major release updates before other production environments are upgraded.
On-demand Access for Embedding Workflows	On-demand access allows customers to provide visualization access to external users without requiring each user to have a named Viewer license. Users are authenticated but do not need to be added as users in Tableau Cloud. This feature is available when Tableau Cloud is licensed with the capacity-based model, Capacity-based Viewer Blocks. Not available with role-based Viewer licensing.
Tableau Knowledge	Tableau Knowledge equips AI agents with essential business context by connecting trusted Tableau Cloud content and business knowledge into live knowledge graphs to deliver accurate, explainable answers.

As of September 16, 2025, the Tableau+ Bundle no longer includes Data Connect. Customers who previously purchased Data Connect Add-on SKUs can continue using them, but Data Connect is no longer available for net-new purchases. We recommend that all customers use Tableau Bridge (see [Use Tableau Bridge](https://help.tableau.com/v0.0/online/en-us/data_fresh_sync_section.htm)) or Private Connect (see [Migrate from Tableau Bridge to Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_migrate_from_bridge.htm)) as alternatives. For more details, see [Tableau Data Connect Retirement](https://help.salesforce.com/s/articleView?id=005167106&type=1) in the Knowledge Base. ## Other articles in this section [Skip to main content](#main-content) # About the Bridge Client This topic describes the Bridge client and requirements for running and using it. In most cases, the site admin is responsible for installing and managing the client. **Note**: Support for single use refresh tokens (sometimes called one-time use refresh tokens, rolling refresh tokens, or refresh token rotation) for OAuth connections was added in Tableau Cloud with the 2025.2 (Summer 2025) release and added in Tableau Server with the 2025.3 release if the IDP of the data source provider supports it. These are not yet supported on Tableau Bridge connections to Tableau Cloud. If you use the external OAuth configuration for the connection, please see the [OAuth Configuration and Usage documentation](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth Config docs") in GitHub for more information. ## Client overview for Linux and Windows - The Bridge client is required to enable connectivity between Tableau Cloud and private network data. - The connected client option must be enabled for the site to allow Tableau Bridge clients to run unattended and, if enabled, support multi-factor authentication with Tableau authentication. - Client sessions are managed by refresh tokens which are generated after a successful sign-in to Tableau Cloud from the Bridge client. If the refresh token has not been used in 14 days, then it expires. After the refresh token has expired, a new sign-in to Tableau Cloud is required. If a refresh token is being used regularly, their expiration period depends on when a site was activated. Refresh tokens generated on sites activated in June 2023 (Tableau 2023.2) or later expire after 180 days. Refresh tokens generated on all other sites expire after one year. - For Windows, only one client can be installed on a machine. For Linux, only one client can be installed per container within a cluster. - The appropriate database drivers must be installed on the machine where the client is running. - For extract connections, the user signed in to Tableau Cloud from the client must have a Creator, Explorer (Can Publish), or one of the two types of site admin role: Site Administrator Creator or Site Administrator Explorer. If the user is not a site admin, he or she must be the content owner. - For live connections, the user signed in to Tableau Cloud from the client must have one of the two types of site admin roles: Site Administrator Creator or Site Administrator Explorer. - To maintain live connections, the databases that the Tableau content connect to _can't_ be accessible from the public internet. ### About the Linux Bridge Client You can deploy the Tableau Bridge client within a container on Linux. To use Bridge on Linux you must create a customized Docker image, install the RPM package, and then run Bridge from inside the container image. See [Install Bridge for Linux for Containers](https://help.tableau.com/v0.0/online/en-us/to_bridge_linux_install.htm). ### About the Windows Bridge Client When the client is running, it's accessible from the Windows system tray on the machine where it is installed. ![A Tableau Bridge connection to an online data source.](/tableau/next/en-us/online/en-us/Img/bridge_client_overview.png) The client is comprised of the following parts: 1. **Client name**, which is also the name of the machine where the client is installed. 2. **Connection status** indicates whether the client is connected to Tableau Cloud. 3. **Site**: The Tableau Cloud site that the client is registered to. 4. **Settings menu**, which contains options to disable error reports and unlink the client from a site. 5. **Data sources**: By default, this area displays a list of live queries that are being load balanced (or pooled) by clients across the site. This list can also contain data sources that have been assigned to this specific client using Bridge (legacy) schedules. **Note:** This list does not show data sources or virtual connections that are refreshed with the Bridge refresh schedules. To see data sources or virtual connections refreshed with Bridge refresh schedules, go to the Jobs page and filter on Bridge Refreshes. 6. **Pooling status**: This shows whether the data source is part of the client pool. - Live: A Live status indicates the data source has a live connection and is part of the pool of clients. **Note:** Virtual connections with live connections do not show in this list. - Blank: A blank status indicates the client is not part of the pool. This is because the data source is using Bridge (legacy) schedules. 7. **Legacy options**: These options display on hover to edit or view connection information, go to the schedule, and run a manual refresh on hover for data sources that use Bridge (legacy) schedules. 8. **Client mode** indicates if the client is running as a Windows application or service. For more information, see the section below. ### Windows Requirements for extract connections - To refresh extracts, the client can run as a Windows service or as an application. - If the client is set to run as an application, it completes refreshes only when the machine is powered on, and the Windows user is logged on and running Bridge. If the machine is turned off, if the user logs off of Windows, or if the user exits the client, updates for the data sources or virtual connections running on that client (either through the pool or manually) will not be able to reach Tableau Cloud, and the data sources or virtual connections won't get refreshed until the user signs in again. During this time, the content owner will receive refresh failure notification emails from Tableau Cloud. For more information, see [Stop Keeping Data Fresh Through Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_signout_unlink.htm). - To ensure refreshes of file-based data sources complete without any issues, a client that has been set up to run as a service must reference the full UNC path of the source file and not the mapped drive path. For example, use "\\\\filesrv\\Data\\file.csv" instead of "C:\\Data\\file.csv". For a client that has been set up to run as an application, we strongly recommend that the client also references the full UNC path. For more information, see [Change the file path for a data source](https://help.tableau.com/v0.0/online/en-us/to_sync_client_settings.htm#file-path). ### Windows Requirements for live connections - To run live queries, the client can run as a Windows service or as a Windows application. - Each Tableau Cloud site can have multiple clients that maintain live connections. Those clients can also be used to refresh extracts. - If the client is set up to run as an application, live queries can only occur when the computer is on and the Windows user is logged on and running Bridge. If the computer is turned off, if the user logs off of Windows, or if the user exits the client, updates to the data sources or virtual connections will not be able to reach Tableau Cloud, and the content can't be kept up to date. ### Application versus Service mode A client can operate in one of two modes: Application or Service. The mode the client can run depends on the Windows user account it's running under, the Tableau Cloud site settings that the client is registered to, and general data freshness needs. - **Application:** When the client is set to run in Application mode, it runs as a Windows _application_. In this mode, the client can facilitate live queries and scheduled refreshes for content that connects to private network data while the dedicated user is logged on to Windows. If the dedicated user logs off Windows, the client cannot maintain live queries and refresh extracts on a schedule. - **Service:** When the client is set to run in Service mode, it runs as a Windows _service_. In this mode, the client runs continuously even if the user is logged out of Windows. The Windows user account must be a member of the local Administrators group to run the client in service mode. The account must also be able to log on as a user and cache the credentials. This mode is recommended for pooled clients that load balance live queries and scheduled refreshes. Service mode is the default mode. Mode guidelines

	Extract connection with scheduled refresh	Live connection
Application mode	Quickly set up and validate that the client is keeping content up to date. Have more control over when the client is performing data freshness tasks. Doesn't require the user to be a local admin on the machine. Requires the user to be logged on to Windows.
Service mode	Set up the client once — if the machine has to restart, the client reconnects to Tableau Cloud automatically. Requires the Windows user account to be a member of the local Administrators group on the machine. In addition, to refresh file-based data sources, the account must have domain access to the network shared drive where the file data is hosted. Doesn't require the user to be logged on to Windows.
	Recommended for load balancing refreshes. For more information, see Configure Pools.	Recommended for load balancing live queries. For more information, see Configure Pools.

### Windows Client requirements In order to run and use the client, a certain set of requirements must be met as well as some additional requirements that are unique to the data freshness task. ### Core requirements - Microsoft Windows 10 or later, 64-bit - Windows Server 2016, Windows Server 2019, Windows Server 2022 **Note**: Windows Server 2025 is not yet supported. For more information, see the Product Knowledge Article, [Tableau Server Is Not Compatible With Windows Server 2025](https://help.salesforce.com/s/articleView?id=004811287&type=1). - Tableau recommends installing the Bridge client on a dedicated computer behind your firewall. - The computer on which the client is running must be on the same Windows domain and have access to the underlying database specified in the data source or virtual connection. - Both the computer and the Windows user account must have access to the underlying data specified in the data source or virtual connection. - Tableau Cloud's _connected clients_ option must remain enabled to allow the client to run unattended and, if enabled, support multi-factor authentication with Tableau authentication. For more information about the connected clients option, see [Connected client requirement for Tableau Bridge](https://help.tableau.com/v0.0/online/en-us/to_connected_clients.htm#bridge). For more information, see [Pooling capacity](https://help.tableau.com/v0.0/online/en-us/to_bridge_scale.htm#Pooling). ### Additional requirements for Service mode - To run the client in **Service** mode, the Windows user account running Bridge must be a member of the local Administrators group on the machine. The user doesn't need to be logged on to Windows, but the machine must be powered on with Windows running. - When using the client in Service mode and connecting to file data hosted on a network shared drive, it's required that the account have domain access to the network shared drive. ## Repair a client running in Service mode Occasionally something causes content connections to stop functioning normally. When this happens, an alert appears, and it usually provides information that direct you toward the cause of the problem. However, if Tableau Cloud cannot provide troubleshooting information in the alert, and if you run Tableau Bridge as a service, you can use the Repair command to try to reset connections. To help repair a client in Service mode, in the Windows system tray, right-click the Bridge icon and select Repair. This stops and restarts the service, which can be enough to resolve the issue. ## Temporary files The Bridge temporary files are located in the `C:\Users\\AppData\Local\Temp` folder. Temporary files are periodically removed when connected to Tableau Cloud or after you close the client. - After a refresh, the `TEMP_*` files are removed. - The `hyper_` files are deleted after the Bridge client is closed. - The TableauTemp folder isn’t removed due to system requirements. The `cleanUpTempDirOnStartUp` client setting determines whether to remove the temp files when the Bridge client starts. When set to false, the temp files are not removed. [Skip to main content](#main-content) # About the Flow Workspace After you publish your flow you can schedule tasks or linked tasks (version 2021.3 and later) in Tableau Cloud to automatically run your flows on a regular basis to keep your output data fresh. You can also run your flows manually at any time (no Data Management required). Tableau Prep Conductor leverages much of the same functionality for managing flows that you might see when managing workbooks or data sources from Tableau Desktop in Tableau Cloud. For example, just like extract refreshes, scheduled flow tasks and on-demand flow runs are queued as background tasks. But when it comes to working with flows, there are a few differences. ## Flow Overview page The flow Overview page is the main landing page where you can view data about your flow and schedule, monitor, and maintain the flow. If you don't have the Data Management, you will have different options. Open the flow Overview page by clicking on a flow in your list. You can navigate there from Content > Explore > All Flows or by opening the project that contains your flows. ![The Tableau Prep Flow Overview page.](/tableau/next/en-us/online/en-us/Img/prep_parameters_flow_overview.png) 1. The header lists the name of the flow, the flow owner and the date that the flow was last modified. Starting in version 2020.4, click Edit to edit existing flows. Add a flow to your favorites, or from the More actions![The More Options menu option represented by 3 dots.](/tableau/next/en-us/online/en-us/Img/prep_server_rmoremenu.png)menu you can also edit, run, download the flow, set permissions, change the flow owner, restore previous flow versions, and more. 2. View and edit the flow description and set tags to help others find the flows they are looking for. 3. View the output steps for a flow along with any parameters applied to the flow (version 2021.4 and later), the status of the last update, any schedule the output is assigned to, and any errors from the last flow run. You can also click the Run ![The Run Flow button shown as a right facing arrow point in a circle.](/tableau/next/en-us/online/en-us/Img/prep_server_run_button.png)button to run all output steps or individual output steps on-demand.

Parameters	If the flow includes user parameters, the parameter value last run in the flow is shown and you can see all generated outputs in the Output column. When the flow is run, you'll be prompted to enter the parameter values. System parameters (version 2023.2 and later) are automatically generated at flow run time and the type of system parameter is shown in the Parameters column. To see the last system parameter value applied to the flow, edit the flow. For more information about using parameters in flows, see Create and Use Parameters in Flows in the Tableau Prep help.
Status	After a flow has run successfully, outputs that are data sources become links that you can click to open the Data Source page to view more information about the data source or edit the flow input connection.
Schedule	In the Schedule field, view the scheduled tasks that the output step is assigned to. A flow output can be assigned to one or more tasks. If no schedule has been assigned yet, click Create new task to add the output step to a schedule. To immediately run the flow to update a specific output step, click the Runbutton on the left-hand side of the row.
Errors	If the flow has errors, the flow run will fail. Connectivity errors can be resolved directly by navigating to the Connections tab for the flow and editing the input connections. To resolve any other flow errors, edit the flow then republish it and try running the flow again. If you are using an earlier version of Tableau Prep Builder, from the More actionsmenu, you can also download and open the flow in Tableau Prep Builder, then republish it and try running the flow again.

4. View an image of the flow. ### Flow Overview page without the Data Management If you don't have the Data Management installed on your server, you can still publish flows to Tableau Cloud, but you will see fewer options to manage your flow. ![Tableau Prep connections.](/tableau/next/en-us/online/en-us/Img/prep_webauth_no_dm_addon.png) ## Flow Connections page View both the input and output locations for a flow, connection types, authentication settings, input and output steps and any connectivity errors. You can set authentication settings when publishing a flow. For more information, see [Publish a Flow](https://help.tableau.com/current/prep/en-us/prep_conductor_publish_flow.htm). For database input types, click the More actions![The More Options menu option represented by 3 dots.](/tableau/next/en-us/online/en-us/Img/prep_server_rmoremenu.png) menu for an input connection to edit the connection and change the server name, port, user name and password. ![A table of connection types and their sources in Tableau Prep.](/tableau/next/en-us/online/en-us/Img/prep_serverconnections.png) ## Flow Scheduled Tasks page (Data Management required) View any schedules that the flow is assigned to, the outputs that are included in those schedules, and any parameters applied to the flow (version 2021.4 and later). As an administrator, you can click the schedule link to open the Schedules page and see a list of flows that are assigned to that schedule. For more information about assigning flows to a schedule, see Schedule Flow Tasks in the [Tableau Cloud](https://help.tableau.com/current/online/en-us/prep_conductor_online_schedule_flow_task.htm) or [Tableau Server](https://help.tableau.com/current/server/en-us/prep_conductor_schedule_flow_task.htm) help. To view the outputs on a schedule or the tasks assigned to a linked task (version 2021.3 and later), click the links in the Schedule type column. You can also add new tasks or manage existing ones from this page. To take action on an existing task, select the check box on a task card then click the Actions drop-down menu to run, edit, or delete the task. If a flow task fails to run after 5 consecutive attempts, the flow is automatically suspended. You can see that status on the Overview tab as well as this tab. You can resume suspended tasks from this menu. For more information about suspended flow tasks, see [View and resolve errors](https://help.tableau.com/v0.0/online/en-us/prep_conductor_monitor_flow.htm#View_Errors). **Note**: The Scheduled Tasks page for flows was redesigned in version 2021.3. Your view may look different depending on your server version. ![The Flow page with the Scheduled Tasks tab selected](/tableau/next/en-us/online/en-us/Img/prep_parameters_scheduled_tasks.png) ## Schedules page On the Schedules page, you can view the flows assigned to a schedule and the details about the flow runs. If the schedule includes linked tasks (version 2021.3 and later) the number of flows included in the linked tasks is shown. You can run the schedule on-demand and run all flows assigned to it. You can also select one or more flows, then use the Actions menu to change the flow schedule or priority, delete selected flows from the schedule or resume suspended flows. ![A table that shows flow details, including priority, status, last run, next scheduled run, and errors.](/tableau/next/en-us/online/en-us/Img/prep_server_schedules_page.png) ## Flow Run History (Data Management required) See, search, and sort through a list of historical runs for a flow. This page also includes details about the flow run such as run type, parameter values applied to flows included in each flow run (version 2021.4 and later), duration and number of rows that were generated. If the flow output has an error, hover over the error to view the messages. If applicable, click the Go to Connections link in the error message to navigate to the Connections page to fix connectivity errors. You can also edit the flow directly to fix any errors, or click Download the flow to download and fix flow errors in Tableau Prep Builder, then republish the flow to continue to manage it using Tableau Prep Conductor. **Note**: The run history for a flow will persist unless the flow is deleted. ![The Run History tab is chosen, and the Errors column displays a message about the errors.](/tableau/next/en-us/online/en-us/Img/prep_parameters_run_history.png) ## Flow Revision History If you need to revert a flow to a previous version, from the More actions![The More Options menu option represented by 3 dots.](/tableau/next/en-us/online/en-us/Img/prep_server_rmoremenu.png) menu for the flow, select Revision History. On the Revision History dialog, select the flow version from the list that you want to revert to. ![A table of Revision History with the option to restore a revision.](/tableau/next/en-us/online/en-us/Img/prep_server_revisionhistory.png) ## Who can do this Server Administrators can activate Data Management license keys. Server administrators can enable Tableau Prep Conductor. Creators can create, edit, and run flows manually. If the Data Management is installed, creators can run flows on a schedule. [Skip to main content](#main-content) # About the Virtual Connection Editor Centralize and manage data access for your organization using these features: - **Virtual connections** – Reusable, managed data access points. - **Data policies** – Use to set row-level security. - **Centralized extracts** – Reuse the same extract multiple times. Use the virtual connection editor to create virtual connections and data policies. The following diagram shows the process: ![Diagram outlines the process of creating a virtual connection and data policy](/tableau/next/en-us/online/en-us/Img/dm_vconn_workflow_diagram.png) To get started, select a database, if required. Then, select and drag a table to the Tables tab. [Read full topic](https://help.tableau.com/current/online/en-us/dm_vconn_overview.htm) ## Related tasks [Add Tables to the Connection](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_add_tables.htm) [About Data Policies](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_about_data_policy.htm) [Create and Test Data Policies](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_create_data_policy.htm) Not finding what you need? Go online to see [all Tableau help](https://www.tableau.com/support/help) [Skip to main content](#main-content) # About Virtual Connections and Data Policies Virtual connections are a Tableau content type, along with data sources, workbooks, and flows, to help you see and understand your data. Virtual connections provide a central access point to data. Another key feature introduced with virtual connections is data policies, which support row-level security at the connection level, rather than the workbook or data source level. Row-level security data policies are applied to any workbook, data source, or flow that uses the virtual connection. A virtual connection can access multiple tables across several databases. Virtual connections let you manage extracting the data and the security in one place, at the connection level. ![Diagram shows how virtual connections centrally manage the connection and security](/tableau/next/en-us/online/en-us/Img/dm_vconn_diagram_centralized.png) For information about row-level security options, see an [Overview of Row-Level Security Options in Tableau](https://help.tableau.com/v0.0/online/en-us/rls_options_overview.htm). Not every virtual connection has an associated data policy. You can also use a virtual connection simply as a central place to manage connection credentials. ## Key terms - Virtual connection. A sharable resource that provides a central access point to data. - Connection. The server name, database, and credentials you use to access data. A virtual connection has one or more connections. Each connection accesses one database or file. - Virtual connection table. A table in a virtual connection. - Data policy. A policy that's applied to one or more tables in a virtual connection to filter data for users. For example, use a data policy to apply row-level security to tables in a virtual connection. - Policy table. A fact or data table in a data policy that is filtered. - Policy column. A column that's used to filter the data in the policy tables. A policy column can be in a policy table or in an entitlement table. - Entitlement table. A table that includes both a policy column you can use to filter policy tables and another column you can relate (map) to a column in a policy table. - Policy condition. An expression or calculation that is evaluated for every row at query time. If the policy condition is TRUE, then the row is shown in the query. ## License virtual connections and data policies Virtual connections and data policies are licensed through Data Management. For information about how Data Management licensing works, see [License Data Management](https://help.tableau.com/v0.0/online/en-us/dm_license.htm). ## Enable virtual connections and data policies Virtual connections and data policies are automatically enabled on Tableau Server and Tableau Cloud with Data Management. ## Permissions Permissions for virtual connections work much like the permissions for other Tableau content. After you publish a virtual connection, anyone can view the connection. However, only the connection creator and administrators can access data using the connection, until the connection creator explicitly grants more permissions. When you create a virtual connection, you must set the permissions for the Connect capability to enable other users to connect to data using the virtual connection. The Connect capability allows you to share a virtual connection and allows users to query it. With connect permissions, a user can view the tables in a virtual connection and create content using the tables. For more information, see [Set permissions on a virtual connection](https://help.tableau.com/v0.0/online/en-us/dm_vconn_publish_save.htm#set-perms). ### Permissions vs. data policies Permissions define what a person can or can't do with a piece of content in Tableau. Permissions are made up of capabilities—the ability to do things like view content, web edit, download data sources, or delete content. Permission rules define which capabilities are allowed or denied for a user or group on a piece of content. The interplay between license level, site role, and potentially multiple permission rules factor into the final determination of what a person can or can't do—their effective permissions. See [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm) for details. Data policies filter the data in a virtual connection, making sure that people see only the data they're supposed to see. A data policy is applied and filters the data when it's viewed in the Tableau content (for example, a workbook or flow). The policy condition in a data policy is a calculation or expression that defines access to the data. User functions are often used to limit access to users or groups. Access can be based on the user name, the group a user belongs to, or a region value. See [Create a Data Policy for Row-Level Security](https://help.tableau.com/v0.0/online/en-us/dm_vconn_create_rlspolicy.htm) for details. Both permissions and data policies govern access. Simply put, permissions determine which _content_ you can see, access, use, or create; data policies determine which _data_ you can see. #### How permissions and data policies work together Tableau permissions are applied to Tableau content first. People can only do the things they have the capabilities to do with Tableau content—data policies don't override Tableau permissions. After permissions are evaluated, the data policy is applied to determine which data in the virtual connection the person can see based on the policy condition. The following example describes the effects of permissions and data policies on a virtual connection that contains salary data: - The virtual connection is in the HR project, which is restricted to Tableau users in the HR group. Anyone outside the HR group can't see content in the HR project, which means they can't browse to, connect to, or view the virtual connection. - The virtual connection has Connect permissions granted only to members of the HR Business Partners group. All others in the HR group can see that the virtual connection exists, but they can't view the data it contains. When they view a workbook that uses that virtual connection, they can't see any data. - The virtual connection also contains a data policy that filters the salary data based on the individual user, so HR Business Partners can see only rows that pertain to employees in their business unit. When they view a workbook that uses that virtual connection, they see data only for their business unit. ## Features and functionality For the manager of data, virtual connections provide: - **Securely managed service accounts.** If you use a 'service account' model, now instead of having to share that service account information with any user who wants to access that data, you can give the service account credentials to the few analysts who are empowered to create virtual connections. - **Agile physical database management.** You must make database changes (for example, a field is added or table name is changed) only one time in the virtual connection, rather than in every piece of content where the data is used. - **Reduced data proliferation.** By centrally managing extract refresh schedules, refreshes are scheduled once, ensuring that anyone who accesses the data from that virtual connection is seeing fresh data. - **Centralized row-level security.** You can create data policies that apply row-level security to both Tableau extracts and live queries at the connection level. The data policies are applied to any workbook, data source, or flow that uses the virtual connection. **Note:** Data policies are valid for flow input data, but not for flow output data. Users with access to flow output data will see all of the data, and not only a subset of it that pertains only to them. As the user of data, you benefit from virtual connections knowing that you have: - **Appropriate access** to only the data you should see, because row-level security is already applied to the data. - **Flexibility** to use data that's been curated and secured. The virtual connection stores and shares the connection information. All you have to do is create a data source with a data model specific to your needs. - **Trust** that data is fresh because the extract refresh schedule has already been set. - The ability to **share** content freely, assured that you won't put security at risk because data policies are always enforced. ## Virtual connection editor workflow The virtual connection editor enables you to create: - Virtual connections, which are a Tableau content type that provides a sharable central access point to data. - Data policies that support row-level security at the connection level. After you create a virtual connection and its associated data policies, you can publish it and set the permissions to share with other users. You can also schedule extract refreshes so that all content that uses the virtual connection is accessing fresh data. The following diagram shows the workflow to create a virtual connection. At any time during the process, you can publish or save a draft of your connection, but the connection must be published before you can schedule extract refreshes or use (or edit) a virtual connection. You must also set permissions before others can use the connection. ![Workflow diagram for creating a virtual connection](/tableau/next/en-us/online/en-us/Img/dm_vconn_workflow_diagram.png) Click a step in the process to go to that help topic. ## Next step The first step is to [Create a Virtual Connection](https://help.tableau.com/v0.0/online/en-us/dm_vconn_create_conn.htm). ## Other articles in this section [Skip to main content](#main-content) # Access Scopes for Connected Apps Beginning in June 2022, using Tableau connected apps, you can programmatically call and access the Tableau REST API through your custom application on behalf of Tableau Cloud users. Access to the REST API is enabled by a JSON Web Token (JWT) defined as part of the initial Sign In request. The JWT must contain scopes that define the REST API methods that are available to your custom application and its users through the connected app. Authorize access to the REST API using connected apps to: - Enhance efficiency—using a JWT as a bearer token enables a simplified impersonation with one request to the Sign In endpoint instead of two requests - Extend and automate complex Tableau integrations and backend queries—such as dynamic content retrieval and advanced filtering ## Scope actions Connected apps use scopes that grant access to content or administrative actions through the [REST API methods that support JWT authorization](#scopes) (below). A scope is a colon-separated string that starts with the namespace `tableau`, followed by the Tableau resource that access is being granted to, such as `datasources`, and ends with the action that is allowed on the resource, such as `update`. The action a scope can take include: - `create` - `read` - `run` - `update` - `download` - `delete` For example, a scope that allows your custom application to call the [Update Data Source](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_data_sources.htm#update_data_source) method looks like: `tableau:datasources:update` ## Scope types The type of scope you use depends on the content or administrative action that you want to enable. Scopes generally fall into one of the following types: content read, individual, wildcard, and cross-category. - **Content read scope:** The content read scope, `tableau:content:read`, enables supported GET methods for Tableau content. When you use this scope, you enable actions across REST API categories. More specifically, using this scope you enable GET methods for data sources, metrics, views, workbooks, projects, and sites. Starting in Tableau Cloud October 2023, you also specify this scope in a JWT that will be used to create a credentials token for use with the [Metadata API](https://help.tableau.com/current/api/metadata_api/en-us/docs/meta_api_auth.html). Starting in Tableau Cloud February 2025, you also specify this scope in a JWT that will be used to create a credentials token for use with the [VizQL Data Service](https://help.tableau.com/current/api/vizql-data-service/en-us/index.html). **Note:** To enable GET methods for administrative actions, like users and groups, you can use their individual scopes. - **Individual scopes:** To enable supported content and administrative actions, you can use their individual scopes. An individual scope is generally associated with a single method and REST API category. Examples: - To enable publish or update a data source action, you can use the individual `tableau:datasources:create` or `tableau:datasources:update` scope, respectively. - For administrative actions like add or remove users, you can use the individual `tableau:users:create` or `tableau:users:delete` scope, respectively. **Note:** There are some individual scopes that can enable actions across REST API categories. For example, `tableau:views:download` enables actions in the view data and workbooks REST API categories. - **[Wildcard (\*) scopes:](#wildcard)** For certain scopes, you can replace the action with the wildcard character (\*) to enable supported actions within a specific REST API category. Examples: - You can use the `tableau:projects:*` wildcard scope to enable the create, delete, update actions in the projects REST API category. - You can use the `tableau:users:*` wildcard scope to enable the get/list, add, delete, update actions in the users REST API category. - You can use the `tableau:tasks:*` wildcard scope to enable the get/list, add, delete, update and run actions of extract and subscriptions REST API categories. In addition, this scope enables update data source (if an extract) and update workbook. - **[Cross-category scopes:](#cross)** In addition to the content read scope, there are a few additional scopes that, if used, enable supported actions across different REST API categories. Examples: - If using the `tableau:tasks:run` scope, you enable actions in the data sources and workbooks REST API categories. - Again, if using the `tableau:views:download` scope, you enable actions in the view data and workbook REST API categories. - If using permissions scopes like `tableau:permissions:update` or `tableau:permissions:delete`, you enable actions in the data sources, workbooks, and projects REST API categories. ## Summary of how to authorize REST API access The following list summarizes the steps to request access to the REST API through a JWT: 1. **Create a connected app** using one of the following methods: - [Configure Connected Apps with Direct Trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_direct.htm) - [Configure Connected Apps with OAuth 2.0 Trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_eas.htm) 2. **Generate a valid JWT**—at runtime your custom application will generate a valid JWT, configured with the scopes you have included 3. **Make a [Sign In](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#sign_in) request**—your custom application will make a Sign In request using the JWT to return a Tableau credentials token and site ID (LUID) 4. **Use the Tableau access token in subsequent requests**—in subsequent REST API calls, use 1) the Tableau credentials token as the [`X-Tableau-Auth`](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm#using_auth_token) header value and 2) the site ID (LUID) in the request URI ### Example For example, suppose you create a connected app using direct trust. Using direct trust, your custom application that calls the REST API generates a valid JWT using the client ID and client secret generated by the connected app. **Scopes in the JWT** To successfully authorize access to the REST API, the JWT must also contain the scopes that define the REST API capabilities. For example, to enable various data source-related methods, you might include the following scopes in the JWT: `"tableau:content:read","tableau:datasources:create","tableau:datasources:update","tableau:datasources:download","tableau:tasks:run"` Or `"tableau:content:read","tableau:datasources:*","tableau:tasks:run"` **Note:** Scope values must be passed as a list type. **Sign In Request URI** To make a call to the REST API, your custom application must first make a Sign In request to generate a Tableau credentials token. ``` POST https://us-west-2b.online.tableau.com/api/3.16/auth/signin ``` **Request body** To authorize REST API access using a JWT, the Sign In request body must contain the valid JWT like the example below. ``` ``` **Response body** The Sign In request produces the following response body, which includes the Tableau credentials token. ``` ``` After the Tableau credentials token is generated, add it to the header of all subsequent REST API requests. **Header** X-Tableau-Auth:12ab34cd56ef78ab90cd12ef34ab56cd All subsequent REST API requests using the Tableau access token are then bounded by the scopes in the JWT. ## REST API methods that support JWT authorization Scopes for connected apps grants your custom application access to Tableau REST API capabilities on users' behalf ### How to find scopes You can find the required scope for a JWT-supported method in its properties block in the [Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api.htm) Help. If a scope is not listed in the method’s properties block, access to that method can’t be controlled by a JWT. For example, a scope that allows you to call the [Query Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#query_site) method in the Tableau REST API is `tableau:sites:read`. **Notes:** - Both the [Sign In](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#sign_in) and [Sign Out](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#sign_out) methods are supported by JWT authorization but do not require scopes to use beginning in June 2023 (Tableau 2023.2). - For scopes supported by the Embedding API v3, see one of the following: - [Configure Connected Apps with Direct Trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_direct.htm) - [Configure Connected Apps with OAuth 2.0 Trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_eas.htm) - Starting in December 2025, listed scopes also support REST API authorization through unified access tokens (UATs). This means connected apps and UAT scopes are the same. ### Type of scopes #### About wildcard (\*) scopes Wildcard scopes use the wildcard character (\*) instead of a specific action, to enable multiple supported actions within a specific Tableau REST API category. #### Examples

Scope	Methods enabled
`tableau:datasources:*`	Enables create, update, and update connection data source methods.
`tableau:metrics:*`	Enables query, update, and delete metrics actions.
`tableau:workbooks:*`	Enables publish, update, download, and preview image workbook actions.
`tableau:groups:*`	Enables create, query, update, and delete groups actions.
`tableau:projects:*`	Enables create, delete, and update projects methods.
`tableau:users:*`	Enables get/list, add, delete, and update users methods.
`tableau:tasks:` Note:* This scope is also cross-category.	Enables get/list, add, delete, update and run methods for extracts and subscription tasks. Enables update methods for data sources for workbooks.

#### About cross-category scopes Cross-category scopes enable multiple supported actions across multiple Tableau REST API categories. #### Examples

Scope	Methods enabled
`tableau:content:read`	Enables read/list methods for Tableau content, including data sources, metrics, views, workbooks, projects, and sites.
`tableau:tasks:run`	Enables run methods for data sources, workbooks, and extracts.
`tableau:views:download`	Enables download methods for view data and workbooks.
`tableau:tasks:` Note:* This scope is also wildcard.	Enables get/list, add, delete, update and run methods for extracts and subscription tasks. Enables update methods for data sources for workbooks.

## Troubleshoot scopes ### 401001 - signin error If you encounter error 401001, the **Sign In** response body is appended with one of the following additional connected apps-specific error codes: 16, 10084, or 10085. For example, in the following response body, "10084” is the connected apps error code you can use to help troubleshoot issues with signing in to Tableau Cloud using a JWT for REST API authorization. "summary": "Signin Error", "detail": "Error signing in to Tableau Cloud (10084)" To help resolve the issue, refer to the description of the applicable error code and its potential causes. - **16: Could not find user**—this error can occur because the incorrect "`sub`" (user name) was specified - **10084: Could not parse access token**—this error can occur for the following reasons: - JWT is invalid or there was an unexpected problem - Incorrect "`aud`" (audience) was specified - For direct trust, there was a problem with signing the secret - **10085: Could not fetch secret to verify signature for client ID**—this error can occur for the following reasons: - Incorrect client ID in "`iss`" specified - For direct trust, incorrect "`kid`" (secret ID) was specified - For OAuth 2.0 trust, unable to fetch keys from the JWKSource ### 401002 - unauthorized access error If you encounter error 401002 and have confirmed that you have the appropriate permissions to make the request, ensure the scope included in the JWT is correct and matches the request you're trying to make. For a list of endpoints and supported scopes, see the [REST API methods that support JWT authorization](#scopes) section above. [Skip to main content](#main-content) # Access Sites from Connected Clients By default, Tableau Cloud allows users to access their sites directly from a Tableau _client_. It allows this access after the user provides credentials the first time they sign-in from the client. A client in this case is a Tableau application or service that can exchange information with Tableau Cloud. Examples of Tableau clients include Tableau Desktop, Tableau Prep Builder, Tableau Bridge, and Tableau Mobile. Tableau Cloud establishes a _connected client_ by creating a secure refresh token that uniquely identifies a user when the user signs in from the client. ### Connected client requirement for Tableau Bridge The default _connected client_ option must remain enabled for the site to allow Tableau Bridge clients to run unattended and, if enabled, support multi-factor authentication with Tableau authentication. If connected clients are disabled for the site, Bridge can only support Tableau user name and password authentication. **Note:** If multi-factor authentication (MFA) is enabled with Tableau authentication, Bridge clients must be running Tableau Bridge version 2021.1 and later. For more information about Tableau with MFA, see [About multi-factor authentication and Tableau Cloud](https://help.tableau.com/current/online/en-us/security_auth.htm#mfa_requirement). ## About refresh token expiration The connected client sessions are managed by refresh tokens. A refresh token is generated after a successful sign-in to Tableau Cloud from the connected client. If the refresh token has not been used in 14 days, then it expires. After the refresh token has expired, a new sign-in to Tableau Cloud from the connected client is required. If a refresh token is being used regularly, their expiration period depends on when a site was activated. Refresh tokens generated on sites activated in June 2023 (Tableau 2023.2) or later expire after 180 days. Refresh tokens generated on all other sites expire after one year. After a refresh token has expired, the user must sign in from the connected client to reestablish an authenticated connection to Tableau Cloud. ## Opt out of allowing connected clients Site admins can turn off this functionality, to require users to sign in explicitly each time they visit Tableau Cloud. Opting out of allowing connected clients is recommended if SAML is enabled on your site, and you want to ensure that users do not have access to Tableau Cloud when they are removed from the IdP’s SAML directory. 1. Sign in to Tableau Cloud with your site admin credentials. 2. Select Settings, and then select the Authentication tab. 3. Under Connected clients, clear the Let clients automatically connect to this Tableau Cloud site check box. If you opt out of connected clients, keep the following points in mind: - Some clients provide a Remember Me check box, which users can select to remember their user name. Users always need to provide their password. - For sites configured for single sign-on using SAML authentication, users have direct access to the site after they sign in the first time. They can do this if they do not sign out explicitly by selecting the Sign Out link. ## Remove a user’s connected clients Site admins can remove connected clients (refresh tokens) associated with a particular user, for example, if the user is no longer a member of the site or is seeing a message about exceeding the maximum number of clients in their account. 1. Select Users, and on the Site Users page, select the link on the user's display name. 2. On the user's page, select the Settings tab. 3. In the Connected clients section, remove the appropriate clients. Users also can go to their own My Account Settings page to remove specific clients. ## Monitor refresh token usage If you have Tableau Cloud with Advanced Management, you can use Activity Log to monitor refresh token usage. Events in the Activity Log that capture refresh token usage include, but not limited to: issue token, redeem token, and revoke token. For more information about these events, see [Activity Log Site Event Type Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_schema.htm). ## See also [Sign In to Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_signin.htm) [OAuth Connections](https://help.tableau.com/v0.0/online/en-us/protected_auth.htm) [Skip to main content](#main-content) # Access Tableau Content in Google Workspace The Tableau add-on for Google Workspace provides secure access to your Tableau content from within Google Docs, Google Slides, and Google Sheets. You can embed Tableau views and Pulse metrics as images in your documents and presentations, import live data from Tableau Cloud into Google Sheets, and export data from Google Sheets to Tableau Cloud for analysis. For the Tableau add-on to be available in Google Workspace, your Google Workspace admin must add the Tableau add-on to an allow list. For information about installing the Tableau add-on as an admin, see [Set Up the Tableau Add-on for Google Workspace](https://help.tableau.com/current/online/en-us/gworkspace_set_up.htm). ## Minimum requirements

Feature	Tableau Cloud	Tableau Server minimum version
Embed Tableau images in Google Docs and Slides	Supported	2023.1 or later
Use custom views with Google Sheets	Supported	2024.3 or later (REST API 3.24)
Import data into Google Sheets	Supported	2026.1 or later. The Import button appears only when a connection is established with Tableau Cloud or Tableau Server version 2026.1 or higher.
Publish to Tableau Cloud from Google Sheets	Supported	Not supported on Tableau Server.

**Tableau Server version requirement**: The Tableau add-on requires Tableau Server 2024.3 or later for its primary functions. **Specific features within Google Sheets have higher version dependencies:** **Data import**: This feature uses the VDS API and is only compatible with Tableau Server 2026.1 or later. **Publish to Tableau Cloud**: This feature relies on the Explore in Tableau API, which is only available on Tableau Cloud and not supported on Tableau Server. ## Use the Tableau add-on in Google Docs and Google Slides Use the Tableau Add-on to embed Tableau views and Pulse metrics as image snapshots directly in your Google Docs and Google Slides. You can locate assets using a direct URL or by browsing your Tableau site. If your underlying data updates, you can refresh these images to current. ### Insert Tableau images 1. Open a Google Doc or Google Slide and click the Tableau icon in the right side panel. 2. Select your Tableau site from the dropdown menu. 3. Use one of these techniques to find the Tableau content you want to embed: - URL: Input the direct link for a Pulse metric or Tableau view to generate a preview within the add-on. - Search Views: Enter the name of a view to search your site and select the appropriate result for a preview. - Search Pulse Metrics: Look up a specific Pulse metric to preview its current trendline before embedding. 4. Preview the content, then select the slide or document tab where you want to insert the image. 5. Select Insert. The image adds to your document. ![Tableau add-on in Google workspace to embed Tableau images.](/tableau/next/en-us/online/en-us/Img/gworkspace_embedimages.png) ### Refresh Tableau images Images embedded from Tableau are static snapshots. You can refresh these images to ensure they represent the most current data as your underlying source changes. 1. To refresh all Tableau images in your file, select All. 2. To refresh only certain images, select Some. 3. Check the boxes next to the images you want to update and click Refresh. The Tableau add-on logs the outcome of every refresh as a comment in the file, providing an audit trail. This trail identifies the user who started the refresh, when it occurred, and the status of each image. If your mages don't update properly, consult the Troubleshooting section for solutions to common problems. ### View Smartchips and PreviewLinks (Tableau Cloud only) When you paste a URL linking to a Tableau view or Pulse metric into a Google Doc or Google Slide, it automatically expands into a rich preview that includes a thumbnail image and metadata about the view or metric. In Google Docs, URLs unfurl as Smartchips — interactive inline previews you can hover over to see more detail. In Google Slides, URLs unfurl as PreviewLinks. Slides prompts you to replace the URL with a title. This is a one-time replacement — if the view title or metric value changes later, the link title won’t update automatically. ## Use the Tableau add-on in Google Sheets The integration for Google Sheets supports two-way data flow: it allows you to pull information from Tableau views or published data sources into your spreadsheets and also enables the publication of Google Sheets data back to Tableau Cloud. ![Tableau add-on extension in google sheets to import and export data.](/tableau/next/en-us/online/en-us/Img/gworkspace_import.png) ### Import data from Tableau You can import data from a Tableau Published Data Source or from a specific worksheet or view. The experience differs depending on which you choose — Published Data Sources offer a full query builder with field selection and aggregation controls, while worksheet and view imports bring in the data as-is with no additional filtering. 1. Open a Google Sheet and click the Tableau icon in the right side panel. 2. Select your Tableau site from the dropdown menu. 3. Select a data source type. #### Import from a worksheet or view 1. Search for a view by name or paste a Tableau URL directly into the URL field. 2. Select a result to see a preview of the data. 3. Specify which rows to import. Imports are limited to 5 million cells. If the amount of data you've selected exceeds this amount, the data will be truncated at 5 million cells. ![Rows to import dropdown menu in the Tableau-add on Google Workspace extension.](/tableau/next/en-us/online/en-us/Img/gworkspace_rowstoimport.png) 1. Select the dropdown arrow under Rows to import and specify which rows to import. - Autofit to capacity: Imports rows until the import reaches the 5 million cell limit. - First N rows: Imports the first number of rows, determined by the number you enter into the Number of rows field. - Last N rows: Imports the last number of rows, determined by the number you enter into the Number of rows field. 2. Select Import Data from Tableau. The full data from that sheet is written as a table into your Sheet. Field selection and aggregation aren’t available for worksheet and view imports. **Note:** If you select a dashboard, only the first sheet is available for import. To import a specific sheet within a dashboard, navigate to that worksheet directly instead of selecting the dashboard. #### Import from a published data source 1. Make sure that the published data source you want to import is tagged with 'GoogleSheets.' Only data sources with this tag will appear in the dropdown list. For more info on tagging data sources, see [Use Tags.](https://help.tableau.com/current/pro/desktop/en-us/tags.htm) 2. Select the dropdown arrow to see the data sources available to import. ![Import from a Tableau data source dropdown in the Tableau add-on for Google Workspace.](/tableau/next/en-us/online/en-us/Img/gworkspace_importdatasource.png) 3. Select the data source to import and select Build new query. 4. Select the fields you want to import using the field selector. 5. Use Select All or Select None to manage your selection quickly. 6. Select Disaggregate Data if you need row-level unaggregated data. (optional). **Note**: Disaggregating a large data source may take a while or cause a timeout. After an aggregation is applied, field-level disaggregation is no longer available. 7. Modify field characteristics and aggregation (optional). 8. Select Configure Import. 9. Review your import preview and then select Import Data from Tableau. **Note:** Currently, when you import data from a published data source with a large number of fields, you might see this warning: "The list has been truncated to fit the Google add-on card limit." Google Workspace panels can only display a limited number of items at one time. If your data source contains a large number of dimensions and measures (typically 50 or more), the full list can't be displayed. To resolve this issue, create a smaller version of the published data source that includes only the fields you need for your Google Sheets imports. #### Import from a URL 1. Paste a Tableau URL into the search box and select Search. 2. Preview content and then select Import Data from Tableau. 3. Select OK. ### Refresh Tableau data 1. Select Update Data from the Tableau add-on menu. 2. Check the boxes of the ones you wish to refresh. 3. Select your refresh behavior. You can choose to insert refreshed data into a new sheet, or to overwrite existing data. ![Data refresh options in the Tableau add-on for Google Workspace.](/tableau/next/en-us/online/en-us/Img/gworkspace_datarefresh.png) 4. Select Refresh Data. The Tableau add-on logs the outcome of every refresh as a comment in the file, providing an audit trail. This trail identifies the user who started the refresh, when it occurred, and the status of each refresh. If your data doesn't update properly, consult the Troubleshooting section for solutions to common problems. ### Configure data import Imports are limited to 5 million cells. If the amount of data you've selected exceeds this amount, the data will be truncated at 5 million cells. If you’re working with large data sets, consider these approaches to stay within the limit: - Filter data in Tableau before importing by applying filters at the data source level to reduce row count. - Select fewer fields in the query editor. - Use aggregation instead of row-level data to reduce cell count. #### Data aggregation By default, the Tableau add-on applies aggregations to measure fields (such as SUM or AVG) based on your selections in the field picker. If you need row-level data, select disaggregation before finalizing your field selections. #### Refreshing data in chunks To handle significant data volumes, the Tableau add-on is designed to refresh data in incremental segments rather than through one large request. This chunking method prevents API timeouts and ensures the reliable delivery of extensive data sets. You can monitor the progress of this operation through the indicator shown in the worksheet comments. **Note**: Individual queries are subject to Google’s timeout limits. If a query takes longer than 30 seconds to run, a notification appears and the process continues in the background. ### Export Google Sheets data to Tableau Cloud You can publish data from a Google Sheet to your Tableau Cloud site. The Tableau add-on uses the Explore in Tableau API to open a Tableau Cloud web authoring session pre-loaded with your Sheet data. 1. Open a Google Sheet and select the Tableau add-on from the right side panel. 2. Select your Tableau Cloud site from the dropdown menu. 3. Select Export Data and select the sheets you want to publish. 4. Select Export to Tableau Cloud. ![Export Data dialog for the Tableau add-on in Google Workspace.](/tableau/next/en-us/online/en-us/Img/gworkspace_export.png) This launches into the Tableau Web Authoring experience using the Google Sheet data as a Tableau published data source. 1. Select Publish to export the data source on to the Tableau Cloud site. Note: Pivot tables, merged cells, and images from Google Sheets aren't compatible with Tableau Cloud. If your sheet contains incompatible content, you won't be able to export it until the content is removed. ### Share Tableau content When you share a Google Doc, Slide, or Sheet that contains Tableau content, the Tableau images or data are shared as part of the document — just like any other content. However, Tableau permissions aren’t shared along with the document. Each user who wants to refresh Tableau images or re-import data must have the appropriate permissions on the relevant data source or view. Refresh activity in Docs and Slides is logged as comments on the document. Each refresh comment records the user who triggered it, the timestamp, and the status of each image refresh. This provides an audit trail for understanding when data was last updated and by whom. ## Troubleshoot data connections I'm not seeing all of my data If you're not seeing all of your data, your query may have exceeded the 5 million cell limit. To successfully pull in your entire data set, try reducing the amount of data imported using the following methods: - Apply Tableau filters to limit the imported data volume. - Decrease the number of fields selected for the import. - Use aggregation to condense the information before you begin the import process. The import is taking a long time or seems stuck Large imports are imported in chunks, which can take time for large data sets. If your refresh is running in the background, you can track the status of your refresh in the comments section of your file. I can't refresh my data If you're trying to refresh Tableau content that was shared with you, make sure you have the appropriate permissions to access the data in Tableau. The underlying Tableau data permissions always apply, regardless of whether the Google document has been shared. I can't find my published data source in the Tableau add-on Published Data Sources must be tagged with "GoogleSheets" in Tableau to appear in the add-on's data source list. I can only see one sheet of data when connecting my dashboard The app can only retrieve data from the first sheet of data within a dashboard. To import data from a specific sheet within a dashboard, we recommend that you go to that worksheet within the workbook and import from there. I can't find my custom views If you want to access a custom view, you need to select the Import from a URL functionality. I can't see my Smartchips or PreviewLinks Smartchips (Google Docs) and PreviewLinks (Google Slides) are only available for Tableau Cloud. They aren't supported for Tableau Server due to a Google Workspace platform limitation that requires a global URL allowlist. If you're using Tableau Cloud and still not seeing smart content, make sure you're pasting a supported Tableau URL. I can't modify the aggregation of my fields After you've selected the disaggregation button, the import will be rendered at the row level of detail. To aggregate the row-level data, unselect the Disaggregation button before finalizing your field selections and running the import. I can't publish my Google Sheets data The ability to publish data from Google Sheets to Tableau is only available on Tableau Cloud. This functionality isn't available for Tableau Server. I can't import my Tableau Custom View Custom view support requires Tableau Server REST API version 3.23 or later. Fields are missing from my published data source Currently, when you import data from a published data source with a large number of fields, your data may be truncated to fit the Google add-on card limit. Google Workspace panels can only display a limited number of items at one time. If your data source contains a large number of dimensions and measures (typically 50 or more), the full list can't be displayed. To resolve this issue, create a smaller version of the published data source that includes only the fields you need for your Google Sheets imports. I can't export one of my Google Sheets Pivot tables, merged cells, and images from Google Sheets aren't compatible with Tableau Cloud. If your sheet contains incompatible content, it will be grayed out in the export dialog and you won't be able to export it. Remove any pivot tables, merged cells, or images from the Google Sheet and try again. [Skip to main content](#main-content) # Access Tableau Content in Microsoft 365 The Tableau app for Microsoft 365 is available in Teams, Word, and PowerPoint. With the Teams app, you can interact with views (visualizations) and metrics and share them in messages, channels, and meetings. With the Word and PowerPoint add-ins, you can add image snapshots of views and metrics to your documents and slides and refresh those snapshots to keep them up to date. With the Excel add-in, you can export data from Tableau views and published data sources into a worksheet, refresh it on demand, and publish Excel data back to Tableau Cloud. For the Tableau app to be available in Microsoft 365, your admin must deploy it and connect it to your Tableau site. For information about installing the Tableau app as an admin, see [Set Up the Tableau App for Microsoft 365](https://help.tableau.com/v0.0/online/en-us/teams_set_up.htm). Note: If you've set the language in Tableau or Microsoft 365 to a Tableau-supported language other than English (US), you might see text in English that isn't localized. ## Use the Teams app If your admin didn’t pre-install the app for you but has deployed it for your organization, you can install the app yourself. To learn how, see [Add an app to Microsoft Teams](https://support.microsoft.com/en-us/office/add-an-app-to-microsoft-teams-b2217706-f7ed-4e64-8e96-c413afd02f77) in the Microsoft Teams documentation. The Teams app has three tabs: Tableau, Pulse, and Configuration. The Tableau tab shows the views that you’ve added as favorites. The Pulse tab shows the metrics that you follow and a summary of insights about those metrics. Be aware that the Pulse tab appears only for Tableau Cloud sites. The Configuration tab lets you set the site that Microsoft Teams checks when you search for content and, if you’re a Tableau admin, add and remove site configs. If you don’t have any favorite views or followed metrics, you won’t see any content in the app. Sign in to your Tableau site directly to add views as favorites and to follow metrics. For more information, see [Mark Favorites](https://help.tableau.com/current/pro/desktop/en-us/favorites.htm) and [Follow Metrics](https://help.tableau.com/current/online/en-us/pulse_explore_metrics.htm#follow-metrics). Though it's possible to add other types of content as favorites, none of your favorite content besides views appears in the Tableau app. If you want to see all of the views in a workbook, add each individual view to your favorites. ### Explore content in Teams On the Tableau or Pulse tab, click on the card for a view or metric to open the full interactive version. The interactive view or metric allows you to see more details about the data and filter the data based on different dimensions or time ranges. #### Search for content If you know the name of a view or metric, you can search for it in the Tableau app. You can also enter the URL to a view in the search bar to access specific content or custom views. 1. On the Tableau or Pulse tab, select the search icon. ![Tableau app search entry point](/tableau/next/en-us/online/en-us/Img/teams_app_search.png) 2. Enter the name of the view or metric. 3. Select the open button next to the view or metric name to go to the interactive version. #### Follow a metric Each metric represents a unique set of filters. When you filter an existing metric, you create a new metric if one doesn’t already exist with those filters. Follow the new metric to see it on your Pulse tab and in your insight summary. 1. On a metric, select the follow (subscribe to this metric) icon. ![Follow icon on a metric](/tableau/next/en-us/online/en-us/Img/teams_app_follow.png) You can unfollow the metric by selecting the button again. #### Share content 1. On a view or a metric, select the share icon. ![Share icon](/tableau/next/en-us/online/en-us/Img/teams_app_share.png) 2. Select the person, group chat, or channel to share with. 3. Select Share. #### Switch sites 1. On the Tableau or Pulse tab, select the site name from the breadcrumb menu. If more than one site is connected to the Tableau app, you see a list of sites. ![Site switch options](/tableau/next/en-us/online/en-us/Img/teams_app_switch_site.png) 2. Select the site that you want to switch to. ### Add Tableau content to channels and meetings #### Pin content in a channel tab 1. In the channel where you want to pin Tableau content, select the + icon to add a tab. ![Add a channel tab options](/tableau/next/en-us/online/en-us/Img/teams_app_channel_tab.png) 2. From the list of apps, select the Tableau app. 3. Select the content to pin. To pin a custom view, select the search button and enter the view URL. You can pin one view and up to five metrics per tab. To pin more Tableau content, add a second tab. ![Tableau views and metrics to pin](/tableau/next/en-us/online/en-us/Img/teams_app_pin_content.png) 4. Select Save. 5. Optionally, to rename the tab, select the dropdown menu on the tab, then select Rename. ![Rename option for the Tableau tab](/tableau/next/en-us/online/en-us/Img/teams_app_rename_tab.png) #### Add Tableau content to a meeting You must first create a meeting and then add Tableau content. You can't add third-party apps during the creation of a meeting. 1. In the Calendar app, find the meeting that you want to add Tableau content to, then select Edit. 2. Select More options. 3. From the toolbar, select Apps. 4. From the list of apps, select the Tableau app. 5. Select the content to pin. 6. Select Save. 7. Save the changes to the meeting. 8. After you start the meeting, select the Tableau tab. This opens the Tableau content in a side panel, which is visible to only you. 9. On the side panel, select the share to stage button. This makes the content visible to others in the meeting. Be aware that the content that you share appears to others as you see it, similar to how screen sharing works. If there's row-level security on the data, everyone in the meeting sees your view of the data. ### Share Tableau content in messages If you know the URL for a view or metric, you can quickly share that content by pasting the URL into a message. The Tableau message extension turns the link into a card that shows the content title and a thumbnail, with a button to open the full interactive view or metric. If you don’t know the URL of the content that you want to send, you can search for content to share. 1. On a message, select the + (Actions and apps) icon. 2. Select the Tableau app. 3. Search your Tableau site for the view or metric that you want to share. 4. Select the view or metric. It takes a moment to generate the card for this content. ![Metric card in a Teams message](/tableau/next/en-us/online/en-us/Img/teams_app_metric.png) 5. Send the message. ### Receive Tableau Pulse digests and alerts If you follow metrics in Tableau Pulse, you receive digests about those metrics along with any alerts for those metrics. These digests and alerts are sent in chat messages from the Tableau app, and these messages also appear on the Activity tab in the Tableau app. You configure your Tableau Pulse digests on your Tableau Cloud site, not in the Teams app. The configuration from your Tableau site carries over to all channels where you receive digests. - To sort the metrics in a digest, see [Customize your home page and digests](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#Grouping). - To adjust the frequency of the digest, to show only favorite metrics in a digest, or to turn off the digest, see [Manage your Tableau Pulse digest](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#manage-digest). - To turn off alerts for specific metrics, see [Turn off alerts for a metric](https://help.tableau.com/v0.0/online/en-us/pulse_alerts.htm#turn-off). The digest contains up to 10 of the metrics that you follow. If you follow more than 10 metrics, go to the Pulse tab in the Tableau app to see all of your metrics. ## Use the Word and PowerPoint add-ins The Tableau add-in appears on the Home tab in Microsoft Word and PowerPoint. To learn how to access an add-in, see [Start using your Office Add-in](https://support.microsoft.com/en-us/office/start-using-your-office-add-in-82e665c4-6700-4b56-a3f3-ef5441996862) in the Microsoft documentation. Note that for the Tableau app to be available for you to use, your Microsoft 365 admin must first deploy it and connect it to a Tableau site. ### Add a visualization or metric to documents and slides With the Tableau add-in, you can add an image snapshot of a visualization or metric to your documents and slides. Note that Tableau Pulse metrics are available only for Tableau Cloud. These images show the time at which they were added and the user who added them, and the image links to the content in Tableau Cloud or Tableau Server. The image is the same for all users, so if there’s row-level security applied to the data, the image shows the view of the data that’s specific to the user who added the image. If other users open the image link in Tableau Cloud or Tableau Server, those users see the interactive view or metric with their credentials applied. 1. From the Home tab, select the Tableau add-in. 2. Select Insert Viz Image or Insert Pulse Image. ![Insert viz or metric options for Microsoft 365 add-in](/tableau/next/en-us/online/en-us/Img/microsoft_365_add_in.png) 3. Either search for the name of the view or metric that you want to add, or select from your favorite views or followed metrics. 4. On the preview of the view or metric, select Insert Image. If you have the Tableau site URL of the content that you want to add, you can instead choose Insert Content from URL. #### Use a custom view to show filtered data To add a filtered view of the data, insert a custom view. 1. Open the view in Tableau Server or Tableau Cloud. 2. Filter the view to show the data that you want to include in the snapshot, then create a custom view. For more information, see [Use Custom Views](https://help.tableau.com/current/server/en-us/customview.htm). 3. Open the Tableau add-in in Word or PowerPoint. 4. Select Insert Content from URL, then paste in the URL for the custom view. ### Refresh a visualization or metric The image is a snapshot taken at the time that you add it. If the image no longer represents the latest data, refresh it. 1. From the Home tab, select the Tableau add-in. 2. Select Refresh Data. The Tableau add-in identifies all of the Tableau images in your document or slides. 3. Select the content that you want to refresh, then select Refresh Selected. ## Use the Excel add-in The Tableau add-in for Microsoft Excel lets you move data between Tableau and your workbooks. You can pull data from Tableau views and published data sources into a worksheet, refresh it on demand, and publish Excel data back to Tableau Cloud. The add-in appears on the Home tab in Microsoft Excel and opens in a task pane, the same way the Word and PowerPoint add-ins do. Note: Importing data into Excel and publishing Excel data are supported on Tableau Cloud. Publishing to Tableau Cloud from Excel is not supported on Tableau Server. To get started, select the Tableau add-in on the Home tab, choose your Tableau site, and then choose whether to import data from Tableau or export your Excel data to Tableau Cloud. ### Import data from Tableau 1. Open Excel and select the Tableau add-in on the Home tab to open the task pane. 2. Choose your Tableau site. 3. Choose a data source type. There are two import paths: **Published data source imports** offer a full query builder with field selection and aggregation controls **Tableau View and URL imports** bring in the data as-is with no additional filtering. #### From a worksheet or view 1. Search by name or paste a URL. 2. Preview the data. 3. Choose which rows to import. Imports are subject to standard Excel worksheet limits. Data beyond that limit is truncated. For more information about Excel worksheet limits, see [Excel specifications and limits.](https://support.microsoft.com/en-us/excel/excel-specifications-and-limits) Row options include: - Autofit to capacity — fills up to the standard Excel worksheet limits. - First N rows - Last N rows **Note**: Dashboards only expose their first sheet for import. To import a specific worksheet, navigate directly to that worksheet instead. #### From a URL 1. Paste the URL and select Search. 2. Preview the data, then select Import Data from Tableau. 3. Select OK to confirm. #### From a published data source 1. Confirm the source is tagged `Excel`. Only tagged sources appear. 2. Pick the source and select Build new query. 3. Choose fields with the field selector (Select All or Select None). 4. Optionally, select Disaggregate Data for row-level detail. This may take a while or cause a timeout, and once aggregation is applied, disaggregation is no longer available. 5. Adjust field types and aggregation as needed. 6. Select Configure Import. 7. Preview, then select Import Data from Tableau. Large field sets may trigger a truncation warning. If this happens, create a smaller published data source that contains only the fields you need. #### Manage large imports Because the standard Excel limits apply broadly, filter your fields in Tableau, trim fields, or use aggregation instead of row-level detail to stay within the limits. Measures receive default aggregations based on your selections in the field picker, unless you choose disaggregation first. Large data sets are refreshed in incremental segments rather than through one large request, which avoids timeouts; progress is visible in the task pane. If a query takes longer than 30 seconds to run, a notification appears and the process continues in the background. ### Refresh data - Choose Update Data from the add-in menu. - Select the items to refresh. - Select a destination for refreshed data. You can choose to Refresh in a new sheet, or to Refresh in current sheet, which overwrites your data. - Select Refresh Data. The outcome of each refresh (user, timestamp, and status) is shown in the add-in task pane. ### Export Excel data to Tableau Cloud Exporting Excel data to Tableau Cloud relies on the Explore in Tableau API to preload a web authoring session with your worksheet data. 1. Open the add-in in Excel. 2. Choose your Tableau Cloud site. 3. Select Export Data 4. Select the sheets to export and then select Export to Tableau Cloud. 5. To complete the export process, review the data within Tableau Cloud by selecting View Data on Tableau Cloud. 6. From Tableau Cloud, select Publish to save your new workbook. **Note**: PivotTables, merged cells, and images from Excel aren't compatible with Tableau Cloud. Incompatible content is grayed out and blocks export until you remove it. #### Sharing considerations Sharing a workbook that contains embedded Tableau content doesn't carry over Tableau permissions. Each user who wants to refresh Tableau images or re-import data must have the appropriate permissions on the relevant data source or view. The underlying Tableau data permissions always apply, regardless of whether the workbook has been shared. [Skip to main content](#main-content) # Activate Tableau using Login-based License Management Login-based license management is the preferred license management and activation option for Creator roles within Tableau Cloud, and is enabled by default on your site. Login-based license management allows authorized users to activate and unlock Tableau Desktop and/or Tableau Prep Builder by signing in to Tableau Cloud. Login-based license management eliminates the need to distribute and manage product keys for Tableau Desktop and Tableau Prep Builder. You only need one Tableau Cloud site to authorize an individual Tableau Desktop or Tableau Prep Builder. You can assign Creator roles to users who use Tableau Desktop, and Tableau Prep Builder for license activation and centralized license management. In addition, login-based license management gives you more visibility into license usage. You can use administrative views on Tableau Cloud to see the assignment and use of Creator seats in one place. Administrative views provide information about who is using your Creator licenses, and shows the most recent license lease and version of both Tableau Desktop and Tableau Prep Builder, which helps you to monitor your Tableau deployments. The following Tableau products support login-based license management: - Tableau Cloud - Tableau Server - Tableau Desktop - Tableau Prep Builder ## How login-based license management works When login-based license management is in use, Tableau Desktop or Tableau Prep Builder periodically contacts Tableau Cloud in order to verify that the user is a Creator and to obtain an authorization to run. Tableau Cloud contacts the Tableau-hosted authorization-to-run (ATR) service to verify that the Tableau Desktop client is allowed activation. The ATR service verifies and manages the license and the length of the authorization window. The diagrams below show the communication process between the client, Tableau Cloud, and the licensing service. Tableau uses common ports (80 and 443) to make internet requests. In most cases, the computer where Tableau Desktop or Tableau Prep Builder is installed and the network it is running on are already configured to allow the necessary access. For more information about the ports used by Tableau, see [Internet Access Requirements](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_proxy.htm). #### Login-based license management with Tableau Cloud ![A diagram showing the communication process between the licent and licensing components for login-based license management with Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/virtual_desktop_online_lblm.png) 1. You install Tableau Desktop or Tableau Prep Builder and select **Activate with your credentials**. You sign into your Tableau Cloud site. 2. Tableau Cloud verifies that you are a Creator. If not, you get an error. If yes, Tableau Cloud communicates with the ATR service. 3. The ATR service returns an ATR lease to Tableau Cloud. 4. Tableau Cloud provides an ATR lease to Tableau Desktop or Tableau Prep Builder to finalize activation. ## Use login-based license management To use login-based license management, you need to install Tableau Desktop and use it with Tableau Cloud. ### Step 1: Enable login-based license management Login-based license management is enabled by default for Tableau Cloud and Tableau Desktop. To use login-based license management, you need to install Tableau Desktop and activate it with Tableau Cloud. If you're activating Tableau Desktop, skip to [Step 3: Activate Tableau Desktop](#Step_3). Change login-based license management settings on Tableau Desktop or Tableau Prep Builder at install To change login-based license management settings at the command line, you can run the installer .exe file from your computer's command line as an administrator. If you need to extract the .msi files, follow the instructions to [Extract and run the Windows (MSI) installer](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_automate.htm#msi). To use a duration length other than the default of 14 days/1209600 seconds, include the `ATRREQUESTEDDURATIONSECONDS` switch. For example: `tableauDesktop-64bit-2024-2-0.exe /quiet /norestart ACCEPTEULA=1 ATRREQUESTEDDURATIONSECONDS=43200` You must run the command from the directory where the .exe file is located or specify a full path to the location of the .exe file on the computer. Do not run the setup program from a shared directory on your network. Instead, download the .exe file to a directory on the computer where you're installing. The following example shows the Windows installer command that disables login-based license management: `tableauDesktop-64bit-2024-2-0.exe /quiet /norestart ACCEPTEULA=1 LBLM=disabled` or `tableauPrepBuilder-64bit-2024-2-0.exe /quiet /norestart ACCEPTEULA=1 LBLM=disabled` To set the default URL for the Tableau Server you want users to use for activation when using login-based license management, add the `ACTIVATIONSERVER` or `WorkGroupServer` option. To update the exe: `tableauDesktop-64bit-2024-2-0.exe /quiet /norestart ACCEPTEULA=1 ACTIVATIONSERVER=http://` To update the registry: `reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\Tableau 2024.2\Settings /f /v WorkGroupServer /d https://` **Note:** The `ACTIVATIONSERVER` option is only intended for first time activation. If you have previously signed-in to this version of Tableau, you use the `WorkGroupServer` (Windows) or `WorkgroupServer` (macOS) option. For example, if you are using Tableau Desktop on Windows and have previously signed-in successfully, you would use the `WorkGroupServer` option to specify an activation server. On Tableau Desktop on macOS, you would use the `WorkgroupServer` option. On macOS, this option is case sensitive and uses a lowercase "g". Change login-based license management settings on Tableau Desktop by editing the registry If Tableau Desktop is already installed, you can change login-based license management settings by editing the Windows registry. To turn off login-based license management: `reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR /f /v LBLM /d disabled` To make login-based license management the only login option: `reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR /f /v LBLM /d required` Or, you can enable, disable, or require login-based license management by editing the registry directly: 1. As an administrator on the computer running Tableau Desktop, make a backup of the registry file before you make any changes to it. 2. Edit the registry, and in `HKEY_LOCAL_MACHINE\SOFTWARE\Tableau`, find the hive named ATR and modify the LBLM value to reflect the desired setting: 1. Name: LBLM. 2. Data: enabled, disabled, or required. 3. Restart Tableau so the changes take effect. Change login-based license management settings on Tableau Desktop on macOS To change login-based license management settings on macOS, run the following commands in a terminal window to update the preferences file, and then install or restart Tableau Desktop. To turn off login-based license management: `sudo defaults write /Library/Preferences/com.tableau.ATR LBLM "disabled"` To make login-based license management the only login option: `sudo defaults write /Library/Preferences/com.tableau.ATR LBLM "required"` To set the default URL for the Tableau Server you want user to use for activation when using login-based license management on macOS. First time activation: `sudo defaults write /Library/Preferences/com.tableau.ATR LBLM "required"` Subsequent activations: `sudo defaults write /Library/Preferences/com.tableau.Tableau- Settings.WorkgroupServer "https://"` **Note:** On Tableau Desktop on macOS, you would use the `WorkgroupServer` option. On macOS, this option is case sensitive and uses a lowercase "g". #### Login-based license management settings You use the following settings to change login-based license management, set the ATR duration, and set the activation server URL.

Setting	Value	Description
`LBLM`	enabled, disabled, or required	Set to `enabled` (the default), the licensing screens will present the two options for activation (product key, or credentials). Set to `disabled`, login-based license management will not appear on the licensing screens. Set to `required`, login-based license management is the only way to activate the Tableau Desktop (when the licensing screen appears, it will offer only the credentials option for activation). Note: When `LBLM` is set to enabled or required, reporting is also enabled.
`ATRREQUESTEDDURATIONSECONDS`	1209600	Sets the authorization to run (ATR) duration (in seconds), which is the length of time that an instance of Tableau Desktop and Tableau Prep Builder is authorized to run. The default is 1209600 seconds (14 days). Do not use commas as separators in the value.
`ACTIVATIONSERVER`	http://<tableau_online_site_url>	For first time activation, sets the default URL for the Tableau Cloud site you want users to use for activation.
`WorkGroupServer` (Windows) `WorkgroupServer` (macOS)	http://<tableau_server_url>	For updates to the Windows registry or macOS plist, sets the default URL for the Tableau Server you want users to use for activation. Note: On Tableau Desktop on macOS, you would use the WorkgroupServer option. On macOS, this option is case sensitive and uses a lowercase "g".
`REPORTINGFREQUENCYSECONDS`	3600	Sets the default (in seconds) for how often the login-based license management report is sent to Tableau Server or Tableau Cloud. The minimum setting is 60 seconds, and the default is 3600 seconds (one hour). Change this setting to reduce the load on Tableau Server or to reduce network traffic. No matter what the authorization-to-run (ATR) lease duration is set to, `REPORTINGFREQUENCYSECONDS` sets the time interval that the Tableau Desktop or Tableau Prep Builder client report login-based license management activations back to Tableau Server or Tableau Cloud.

Additional configuration for virtual deployments Tableau Desktop and Tableau Prep Builder periodically contact Tableau Cloud or Tableau Server to verify that Tableau is authorized to run, based on its license. Tableau Cloud or Tableau Server then contacts the ATR service to verify the license and the length of the authorization window. When configuring a virtual (non-persistent) deployment of Tableau Desktop or Tableau Prep Builder, the duration time should be set to one of the lower values such as 4 or 8 hours in order to avoid an over-use activation error message. After the virtual machine (VM) is returned, the ATR service will handle the activation monitoring. The following flags should be used on a source image prior to publishing Tableau Desktop to end users. Each end user will be activating the software by logging into Tableau Server or Tableau Cloud with each new VM delivered. No product keys need to be entered if the end user is a Tableau Creator on Tableau Server or Tableau Cloud. If you are using login-based license management for Tableau Desktop or Tableau Prep Builder on a VM, you may get an error message that your license information has changed whenever you launch a new VM for Tableau Desktop or Tableau Prep Builder. This error forces a restart, which then asks you to activate Tableau Desktop again. This error occurs because the ATR service sends a new token that doesn’t match the license cache. #### Microsoft Windows To prevent the error from occurring on Microsoft Windows, you can use the `SYNCHRONOUSLICENSECHECK` and `SILENTLYREGISTERUSER` options with the Windows installer. For example: `tableau-setup-std-tableau-2024 SYNCHRONOUSLICENSECHECK="true" SILENTLYREGISTERUSER="true" ATRREQUESTEDDURATIONSECONDS=14400` or `tableauDesktop-64bit-2024-2-0.exe /quiet /norestart ACCEPTEULA=1 ATRREQUESTEDDURATIONSECONDS=14400 ACTIVATIONSERVER=http:// SYNCHRONOUSLICENSECHECK="true" SILENTLYREGISTERUSER="true"` If Tableau Prep Builder and Tableau Desktop are being delivered on one Virtual Desktop, `ATRREQUESTEDDURATIONSECONDS` only needs to be set during Tableau Desktop installation. However, if you plan to install Tableau Prep Builder as a stand-alone, you'll need to set `ATRREQUESTEDDURATIONSECONDS` during Tableau Prep Builder installation. Or, you can edit the following registry keys on the source image: `Reg key path: HKLM\SOFTWARE\Tableau\\Settings\` `Reg key (String value, need to set to true to make that feature enabled)` `SynchronousLicenseCheck` `SilentlyRegisterUser` #### macOS To prevent the error from occurring on macOS, run the following command to set the `LicenseCache.Desktop` flag to `'false'`. `sudo defaults write ~/Library/Preferences/com.tableau.Tableau-.plist LicenseCache.Desktop false` ### (Optional) Step 2: Change the authorization to run (ATR) duration The login-based license management default settings for the authorization to run (ATR) duration are appropriate for most environments, but you can change these default settings if needed. Login-based license management uses the default authorization to run (ATR) duration of 1209600 seconds (14 days), which is the length of time that an instance of Tableau Desktop and Tableau Prep Builder is authorized to run. This means that after the initial authorization, you could use Tableau without any network connection for 14 days before the activation expired. The default duration value for login-based license management is not appropriate for delivering a non-persistent VM delivery solution to end users. The ATR duration should be lowered to 4 or 12 hours depending on VM use. When a new VM is delivered to an end user, a new authority to run token will be created. When the VM is returned, this token is also returned and is able to be used on the new VM authorization to run request. **Note:** Login-based license management uses the following hierarchy when determining ATR duration. 1. **ATR Service** – Establishes the minimum (4 hours/14400 seconds) and maximum (90 days/7776000 seconds) ATR durations applicable to all users/installations. It specifies the default ATR duration (14 days/1209600 seconds) if nothing is specified by Tableau Server or Tableau Desktop. 2. **Tableau Desktop** – Can optionally specify the ATR duration (`ATRREQUESTEDDURATIONSECONDS`) for the computer on which it is installed. If necessary, you can change the default ATR duration (14 days/1209600 seconds) to a setting within the ATR Service minimum (4 hours/14400 seconds) and maximum (90 days/7776000 seconds). This local ATR duration overrides any durations set by the ATR Service or Tableau Server. However, this default ATR duration cannot be more than the maximum ATR duration set on Tableau Server. Change the ATR duration on Tableau Desktop by editing the registry To use a duration length other than the default of 14 days/1209600 seconds, update the `ATRRequestedDurationSeconds` registry setting. For example: 1. As an administrator on the computer running Tableau Desktop, make a backup of the registry file before you make any changes to it. 2. Edit the registry, and in `HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR`, update the ATRRequestedDurationSeconds as follows (0 uses the default setting): 1. Name: Find the string value named `ATRRequestedDurationSeconds`. 2. Data: Update the number of seconds the duration should last. For example, add 43200 to set a duration of 12 hours. 3. Restart Tableau so that the changes take effect. Change the ATR duration on Tableau Desktop on macOS To use a duration length other than the default of 14 days/1209600 seconds, include the `ATRRequestedDurationSeconds` preferences setting. For example: `sudo defaults write /Library/Preferences/com.tableau.ATR ATRRequestedDurationSeconds -string "43200"` ### Step 3: Activate Tableau Desktop 1. Run Tableau Desktop setup. 2. The Activate Tableau screen will include the Activate by signing in to a server option. ![Tableau license activation window.](/tableau/next/en-us/online/en-us/Img/license_lblm.png) 3. Click Activate by signing in to a server and then click the Tableau Cloud link. When prompted, enter valid credentials to sign in to a Tableau Cloud site as a user with a Creator role subscription, and then click OK. ## View login-based license usage You can view login-based license usage for Tableau Cloud or Tableau Server. The report shows users, hosts, user role, product, version, activations, Creator seats in use, Creator seats not in use, and when a Creator seat was last used. You can view data for the past 30 days up to a maximum of 183 days. To view the Login-based license management License Usage administrative view: 1. In Tableau Cloud or Tableau Server, in the navigation pane, click Site Status. ![Site Status page that displays a list of dashboards that monitor site activity.](/tableau/next/en-us/online/en-us/Img/lblm.png) 2. On the Site Status page, click Login-based License Usage. 3. Optional. On the report screen, you can change the time window to show when seats were last used, filter on actions, filter on user name, and sort by columns. ![Example of a login-based license management usage report.](/tableau/next/en-us/online/en-us/Img/lblm_usage_report.png) ## Troubleshooting You may encounter one of the following error messages while using login-based license management. Use the information below to resolve the issue. If login-based license management is available as an activation option on Tableau Desktop, but not enabled on your Tableau Cloud site, the following error message may be displayed: _Login-based license management is not enabled on the server you connected to. Select a different server to connect to, use a product key to activate your license, or start a trial to begin working immediately._ Contact your administrator and/or Tableau account manager to ensure that your Tableau Cloud site is enabled for login-based license management. ### Login-based license management is not enabled on Tableau Desktop If login-based license management is not enabled on Tableau Desktop, you will not have the option to activate Tableau using your credentials. If the login-based license management option has been turned off during installation or with an update, see [Step 1: Enable login-based license management](#Step_1). ### Product key expiration date doesn't change after purchasing a year subscription After purchasing a renewal of Tableau Cloud, it might appear that your Tableau Desktop license is going to expire. This is not the case. In Manage Product Keys, the expiration date for new Tableau Cloud subscriptions is not updated until two weeks before the previous Site expiration date. ### You do not have a Creator license When attempting to activate from Tableau Desktop, the following error message may be displayed: _You do not have a Creator license. Contact your administrator to obtain one._ This error is displayed if you have not been assigned a Creator role. If you belong to multiple sites on Tableau Cloud or Tableau Server, you need to sign in to the site where you have the Creator role when using login-based license management. Otherwise you'll get this error. To verify that the product key you have activated on the server includes Creator licenses, open the TSM web UI and click Configuration, and then click Licensing. ### You have activated the maximum number of computers When attempting to activate from Tableau Desktop, the following error message may be displayed: _You have activated Tableau the maximum number of times allowed under your account. You must wait for the license activation on another computer to expire before you can activate Tableau again._ This error is displayed when you activated Tableau from multiple computers with the same Creator user credentials and exceeded the maximum number of activations. You must wait until the authorization-to-run (ATR) token expires on one of the existing computers before attempting to activate a new computer. If you are using non-persistent virtual machines (VMs), you can shorten the ATR duration to prevent this error from occurring again. #### To shorten the ATR token duration for maximum activation If you encounter this maximum use error when using a non-persistent virtual deployment, it is possible to shorten the ATR duration to 4 hours (14400) seconds to avoid the error in the future. The following steps shorten the lease on a computer previously activated with login-based license management that will no longer be used, in order to free up a seat to be activated on a new computer: 1. Open a Command Prompt as an administrator on a Tableau Desktop computer that will no longer be used. 2. Navigate to the Tableau binaries (\\bin) directory, using the following command. Windows: `cd Program Files\Tableau\Tableau \bin` Mac: `cd /Applications/Tableau\ Desktop\ .app/Contents/MacOS` 3. Run the following command to set the duration to 4 hours, in seconds (e.g., 14400). Windows: `atrdiag.exe -setDuration 14400` Mac: `sudo ./atrdiag -setDuration 14400` 4. Delete the previous ATR token using the following command: Windows: `atrdiag.exe -deleteAllATRs` Mac: `./atrdiag -deleteAllATRs` 5. Next, overwrite the existing ATR token. Open Tableau Desktop. Tableau displays the “License has Changed” message. Click Exit to automatically close and reopen Tableau Desktop. 6. In the registration dialog box, click Activate, and then reactivate Tableau Desktop through Tableau Server using login-based license management, which will overwrite the existing token. 7. Close Tableau Desktop and wait for the ATR duration to elapse (e.g., 4 hours) so that the ATR token expires and frees-up a user seat. Do not open Tableau Desktop before the ATR duration has elapsed. Check to make sure the ATR duration has elapsed. The ATR token TTL End should show a date and time in the future (e.g., 4 hours from now). Windows: `atrdiag.exe` Mac: `./atrdiag` 8. After the ATR token expires and you can successfully sign in to Tableau Server on a new computer. #### To return your computer to an unlicensed state 1. Open a Command Prompt as an administrator. 2. Navigate to the Tableau binaries (\\bin) directory, using the following command: `cd Program Files\Tableau\Tableau \bin` 3. Run the following command: Windows: `atrdiag.exe –deleteAllATRs` Mac: `./atrdiag.exe –deleteAllATRs` **Note:** This removes only the ATR token from the computer. It does not free-up any of the user seats. The user seat is only freed-up after the deleted ATR token expires. ### Your Tableau credentials are invalid When attempting to activate from Tableau Desktop, the following error message may be displayed: _Your Tableau credentials are invalid. Contact your administrator to reset your account._ This error is displayed when your Tableau license is not recognized. Contact your administrator. ### Your computer’s clock is not synchronized to the current time When attempting to activate from Tableau Desktop, the following error message may be displayed: _Your computer’s clock is not synchronized to the current time. Synchronize your computer’s clock to the current time and then try to activate Tableau._ This error is displayed when your computer's clock is not synchronized with the current time. Synchronize your computer’s clock with a time server on the internet or enable automatic time synchronization. [Skip to main content](#main-content) # Activity Log > [!TIP] > > **Important:** Between March 16 and March 31, 2026, the Activity Log feature in Tableau Cloud migrated to Hyperforce. For details on required policy updates and new folder structures, see [About the Hyperforce migration](https://help.tableau.com/v0.0/online/en-us/activity_log_setup.htm#hyperforce-migration). Tableau Cloud records event logs for tenant and site activity as JSON text files. Your license edition determines how you can access the logs, how often they update, and how long data is retained. For more information, see [Event update frequency and data retention](#update-frequency-and-data-retention). Use these logs to: - **View and analyze event data:** Access detailed event data for Tableau Cloud, capturing compliance information and tracking activities on your tenants and sites. All events include a timestamp and the ID of the actor, and if relevant, the ID of the affected content. - **Audit permissions changes:** Track and audit permissions changes, such as adding or removing users from a group, moving content between projects, and explicitly changing content permissions. This is essential for implementing robust controls for compliance purposes. - **Supplement Admin Insights:** Enhance the information provided by Admin Insights and Admin Views to track site activity and usage metrics. You can integrate Activity Log data with monitoring tools, such as Splunk or Amazon EventBridge to query log fields and answer questions like the last 10 actions taken by a user, who last performed an event on content, and what the last action on content was. Activity Log data can also be imported to cloud data warehouses for analysis, such as Snowflake, Data Bridge, Google BigQuery. If you have a Tableau Enterprise or Tableau+ license, you can also access entity snapshots through the Tableau Cloud Manager REST API. These are a separate data type that captures the full state of your site's content, users, and relationships at a point in time. Entity snapshots aren't available through the Activity Log S3 integration. For more information, see [Use Entity Snapshots](https://help.tableau.com/v0.0/online/en-us/activity_log_entity_snapshots.htm). ## Accessing Activity Log events Before you jump into Activity Log, it's important to understand the different event types in Tableau Cloud and how to access them. ### Tenant events Tenant events record changes that occur within Tableau Cloud Manager (TCM). These events include activities like assigning user site roles, changing site role capacity limits, and monitoring license consumption across sites. Users with a Cloud Administrator role can get tenant events using the platform data methods in the TCM REST API. For more information, see [Platform Data](https://help.tableau.com/current/api/cloud-manager/en-us/docs/platform_data.html) in TCM REST API Reference. For a full list of tenant events, see [Activity Log Tenant Event Type Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_tenant_schema.htm). ### Site events Site events record changes that occur within Tableau sites. These events include activities like login successes and failures, permission changes, and user interactions with content. You can get site events in two ways: - **TCM REST API:** Use the platform data methods. You must be a Cloud Administrator to use this API. For more information, see [Platform Data](https://help.tableau.com/current/api/cloud-manager/en-us/docs/platform_data.html) in TCM REST API Reference. - **Amazon S3:** Configure the Activity Log to send log data to an Amazon Simple Storage Service (S3) bucket for analysis. For more information, see [Set Up Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_setup.htm). For a full list of site events, see [Activity Log Site Event Type Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_schema.htm). ## Event update frequency and data retention Depending on your license edition, there are different values for log update frequency and data retention.

	Tableau (default)	Advanced Management, Tableau Enterprise, and Tableau+

Access method	Tableau Cloud Manager REST API	Tableau Cloud Manager REST API Customer-managed Amazon S3 bucket

Update frequency	1 day*	Less than 15 minutes

Data retention	14 days	365 days Data retention for TCM REST API platform data methods started on December 2, 2025. If you upgrade from a Tableau license edition to an Enterprise or Tableau+ license, you'll get access to up to 365 days of historical data. Data retention for Amazon S3 is determined based on the S3 Lifecycle configuration of your bucket. For more information, see Setting an S3 Lifecycle configuration on a bucket in AWS Help.

**\*Note:** Logs are batched daily and typically arrive a few hours past midnight for the previous day's activity. The availability time is based on the local time zone of your site's pod. For example, a site hosted on prod-useast-a would see logs become available based on Eastern Time. ## Other articles in this section [Skip to main content](#main-content) # Activity Log Site Event Type Reference This topic describes the Activity Log site event types and attributes. For information about tenant events, see [Activity Log Tenant Event Type Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_tenant_schema.htm). ## Event type details The following content describes site event types and attributes in Activity Log. Use the alphabetically sorted list of event types on the right, or **ctrl/cmd-f** to go directly to keywords you have in mind. **Note:** Timestamps for events are recorded in ISO 8601 UTC. ## Common attributes The table contains common attributes for all Activity Log site events. For event-specific attributes, review the individual event tables in this topic.

Attribute Name	Type	Description
actorUserId	integer	ID of the user who performed the action that initiated the event
actorUserLuid	string	LUID of the user who performed the action that initiated the event
eventOutcome	string	Represents the final outcome of the operation. Possible values are: success: The attempted operation completed successfully. unauthorized: The initiating user wasn't authorized to perform the operation. client_error: The operation failed due to a cause attributable to the client/caller. For example, invalid API request parameters, client connection timeout, or throttling. internal_error: The operation failed due to an unexpected internal error. Note: The eventOutcome attribute isn't used by all Activity Log events at this time. The value will be null for unsupported events, such as login or access events. To audit login request success or failure, use the login_authentication event and `status` attribute.
eventOutcomeReason	string	Provides additional details about the event outcome
eventProcessedTime	string	Timestamp of when the event was available in Activity Log. This attribute applies to events written after the Hyperforce migration in March 2026. To see the timestamp for when the event occurred, use the `eventTime` attribute.
eventTime	string	Timestamp when the event occurred
initiatingUserId	integer	ID of the initiating user. This value is usually the same as `actorUserId` and differs only for delegated authentication, such as trusted tickets or impersonation. During impersonation, it's the ID of the administrative user who initiated the session. When the session has no initiating user, or no session exists, `initiatingUserId` uses the value of `actorUserId`.
initiatingUserLuid	string	LUID of the initiating user. For impersonation, it's the LUID of the administrative user who initiated impersonation. For standard login, the value is the same as `actorUserLuid`.
licensingRoleName	string	Name of the user's licensing role when the event occurred
siteLuid	string	LUID of the Tableau site where the event occurred
siteRoleId	integer	The user's site role ID. The value 0 = SiteAdministratorExplorer, 1 = SupportUser, 2 = ExplorerCanPublish, 3 = Explorer, 7 = Guest, 8 = Unlicensed, 9 = Viewer, 10 = Creator, and 11 = SiteAdministratorCreator.
systemAdminLevel	integer	Indicates if the user is a system administrator. The value 10 = System Admin and 0 = Not a system admin.

## add\_delete\_group\_to\_group\_set The `add_delete_group_to_group_set` event is logged when a group is added or deleted from a group set.

Attribute Name	Type	Description
groupId	integer	The ID of the group
groupLuid	string	The LUID of the group
groupSetId	integer	The ID of the group set
groupSetLuid	string	The LUID of the group set
groupSetOperation	string	Group Set operation, either add or delete user to a group set
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## add\_delete\_user\_to\_group The `add_delete_user_to_group` event is logged when a user is added or removed from a group.

Attribute Name	Type	Description
groupId	integer	The ID of the group
groupLuid	string	The LUID of the group
groupOperation	string	Group operation, either add or delete user to a group
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
userId	integer	The ID of the user
userLuid	string	The LUID of the user

## activity\_log\_settings\_change The `activity_log_settings_change` event occurs when an administrator changes the Activity Log settings.

Attribute Name	Type	Description
errorCode	string	Error code generated when altering Activity Log settings
newAwsAccountNumber	string	New AWS account number where Activity Log events will be received
newKmsKeyArn	string	New AWS Key Management Service (KMS) single-region key for the Amazon S3 bucket
newS3BucketName	string	New AWS S3 bucket where Activity Log events will be received
oldAwsAccountNumber	string	Previous AWS account number where Activity Log events were received
oldKmsKeyArn	string	Previous AWS Key Management Service (KMS) single-region key for the Amazon S3 bucket
oldS3BucketName	string	Previous AWS S3 Bucket where Activity Log events were received
operationType	string	The type of operation, either create, update, or delete.
platform	string	The platform where changes are recorded, such as Tableau Cloud.
platformVersion	string	The version of the platform, such as 2024.3.0.

## archive\_content The `archive_content` event occurs when content is permanently deleted from a site using the recycle bin.

Attribute Name	Type	Description
contentId	integer	The ID of the archived content
contentLuid	string	The LUID of the archived content
contentName	string	The name of the archived content
contentType	string	The type of content archived
isError	bool	Indicates if the audit scenario was completed successfully or failed with an error

## background\_job The `background_job` event logs information about jobs run as background tasks. For each job, an event is created to record its various states, including initiation time, queueing, start time, and success or failure. **Note:** Only partial data for this event type is available through the API. To see the full event logs, configure Activity Log to send log data to your Amazon S3 bucket for analysis. For more information, see [Set Up Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_setup.htm).

Attribute Name	Type	Description
args	string	Arguments of the job
duration	long	Duration of the job
eventInitiatedTime	string	Start time of the job
eventState	string	State of the job
isRunNow	bool	Indicates whether the job was initiated manually, by clicking the "Run Now" option on the site or using REST API, or if it was triggered by a schedule. Note: Starting in April 2024, jobs triggered by a schedule (`False`) include data for all attributes listed in the table. Attributes for jobs initiated manually (`True`) are under active development, and tentatively scheduled for inclusion in a future release.
jobId	integer	ID of the job
jobLuid	string	LUID of the job
jobType	string	Identifies the background job type associated with the event Note: Starting in April 2024, only the `IncrementExtracts`, `RefreshExtracts`, and `RefreshExtractsViaBridge` jobs include data for all attributes listed in the table. Attributes for other job types are under active development, and tentatively scheduled for inclusion in a future release.
notes	string	Notes of the job
objLuid	string	Some tasks are specific to a particular workbook or data source. In such cases, the object_luid is the primary key of the relevant item, in either the workbooks or data sources tables, as indicated by obj_type.
objName	string	Name of the associated object. Used in conjunction with obj_luid, as described there.
objOwnerLuid	string	A foreign key reference to the user who owns the job target object
objOwnerName	string	Name of the user who owns the job target object
objRepositoryUrl	string	Uniquely identifies a workbook or data source and is used when referencing the object in a URL. The value is derived from the ASCII characters in the workbook or data source name.
objRevision	string	The revision number. Starts with 1.0 and increments by 0.1 with each republication.
objSize	integer	The number of bytes used in storing the job target object information
objType	string	Either a workbook or data source. Used in conjunction with obj_luid.
podName	string	Name of the Tableau pod that handled the job
projectLuid	string	A foreign key reference to the project in which the job target object exists
projectName	string	Name of the project that contains the job target object
projectOwnerEmail	string	Email address of the user who owns the project containing the job target object
projectOwnerLuid	string	A foreign key reference to the user who owns the project containing the job target object
scheduleLuid	string	Schedule LUID of the task; may be null if the job was manually started
scheduleName	sring	Schedule name of the task; may be null if the job was manually started
siteId	integer	ID of the site
siteName	string	Name of the Tableau site
taskId	integer	ID of the task; may be null if the job was manually started.
taskLuid	string	LUID of the task; may be null if the job was manually started.
timeZone	integer	Time zone of the job

## bridge\_client\_register The `bridge_client_register` event occurs when registering a Tableau Bridge event.

Attribute Name	Type	Description
agentName	string	Name of the Bridge client associated with the event
deviceId	string	Device ID generated by the Bridge client
poolId	string	ID of the pool assigned to the Bridge client
siteId	string	ID of the site the Bridge client is registered to
timeZoneId	string	Time zone from which the Bridge client is registered
userName	string	Name of the user who registered the Bridge client

## bridge\_client\_status The `bridge_client_status` event records the connection status and metadata for a Tableau Bridge client. Use this event to monitor the health, version, and pool assignments of Bridge clients on your site. This event occurs when: - The client disconnects. A status check occurs every 30 seconds. If the client doesn't respond, the system logs a disconnection. - The client reconnects. - The client remains connected for 24 hours.

Attribute Name	Type	Description
bridgeClientComputerName	string	Name of the computer where the Bridge client is installed
bridgeClientConnectionStatus	string	Connection status of the Bridge client. Either `Connected` or `Disconnected`.
bridgeClientDeviceLuid	string	LUID of the Bridge client computer
bridgeClientLastConnectedTime	string	Date and time of the last successful Bridge client connection
bridgeClientOperationSystem	string	Operating system running on the Bridge client computer. Either `Windows` or `Linux`.
bridgeClientOwnerLuid	string	LUID of the user who registered the Bridge client
bridgeClientOwnerName	string	Name of the user who registered the Bridge client
bridgeClientVersion	string	Version of the Tableau Bridge client software
poolLuid	string	LUID of the pool that the Bridge client was assigned to when its connection status changed
siteId	string	ID of the site where the Bridge client is registered
siteName	string	Name of the site where the Bridge client is registered

## bridge\_job The `bridge_job` event tracks jobs executed by Tableau bridge clients.

Attribute Name	Type	Description
bridgeClientComputerName	string	Name of the Bridge client computer
bridgeClientDeviceLuid	string	Device LUID of the Bridge client host computer
bridgeClientOwnerLuid	string	LUID of the user who created the Bridge client
bridgeClientOwnerName	string	Name of the user who created the Bridge client
bridgeClientVersion	string	Version of the Bridge client installed on the computer
duration	long	The amount of time it took the job to run, in milliseconds.
eventState	string	State of the job
jobId	integer	ID of the job
jobLuid	string	LUID of the job
jobType	string	The type of job
notes	string	Notes about the job
objLuid	string	Unique ID of the object. It functions as the primary key in workbook or data source tables, as indicated by the `objType` field.
objName	string	The name of the associated object (workbook or data source). Used with `objLuid` to uniquely identify the object.
objRepositoryUrl	string	A unique name for the associated object (workbook or data source), derived from the ASCII characters in the name, which can be used in URLs to refer to it.
objRevision	string	The revision number. Starts with 1.0 and increments by 0.1 with each republication.
objType	string	The type of object. Either a workbook or data source. Used with `objLuid` to uniquely identify the object.
poolId	string	ID of the pool that the Bridge client is assigned to
poolName	string	Name of the pool that the Bridge client is assigned to
siteId	string	ID of the site that the Bridge client is registered to
siteName	string	Name of the site associated with the Bridge client

## capacity\_utilization The `capacity_utilization` event describes capacity consumption levels for each site and capacity type. One event is logged every 5 minutes. If a capacity type doesn't have activity during that time, no event is logged. An event covers a utilization interval, which is the time window used to measure and report capacity usage and limits. Values in the event reflect peak measurements during the interval, not averages. Because these values peak independently, their highest points can occur at different times in the interval. As a result, `capacityConsumed` divided by `capacityLimit` might not equal `percentageCapacityConsumed`. You can use the data from this event with your own log-based monitoring tools to track and visualize capacity utilization across all sites in your tenant. You can also use the [Tableau Cloud Platform Data Loader](https://github.com/tableau/tabcloud_platform_data_loader), an open-source tool available on GitHub. **Note:** Depending on your license edition, Activity Log might include capacity utilization events for capacity types that don't apply to your site. Capacity consumption shown in Tableau Cloud Manager remains accurate for your license edition. For more information, see the [capacity utilization known issue](https://help.salesforce.com/s/issue?id=a02g700000BAGuo) on Salesforce Help.

Attribute Name	Type	Description
capacityConsumed	long	Amount of capacity consumed during the utilization interval. When `capacityLimitStrategy` is `concurrency`, this value is the peak simultaneous usage. For `fixed_window` or `rolling_window`, it's the peak consumption.
capacityLimit	long	Total capacity allocated to the site for this capacity type during the interval.
capacityLimitStrategy	string	The strategy used to limit and measure capacity consumption. Possible values are: concurrency: Maximum simultaneous usage. fixed_window: Usage during a fixed time window that resets on a schedule. rolling_window: Usage during a rolling time window that adjusts incrementally.
capacityName	string	Canonical name of the capacity type.
percentageCapacityConsumed	integer	Peak capacity consumption as a percentage of the limit during the interval, rounded to an integer. For example, a peak utilization of 72.6% is reported as 73. This value can exceed 100 for capacity types whose limit isn't strictly enforced at that time.
utilizationIntervalDurationSeconds	long	Length of the utilization interval, in seconds. The interval begins at `utilizationIntervalStartTime` and lasts for the number of seconds specified by this attribute. This attribute and `utilizationIntervalStartTime` are always included together.
utilizationIntervalStartTime	string	Timestamp for the start of the utilization interval. All measurements in the event occurred at or after this time. This attribute and `utilizationIntervalDurationSeconds` are always included together.

## content\_owner\_change The `content_owner_change` event is logged when the content owner changes.

Attribute Name	Type	Description
contentId	integer	The ID of the content that had the owner changed
contentLuid	string	LUID of the content that had the owner changed
contentName	string	Name of the content that had the owner changed
contentType	string	The type of content, such as data source, workbook, or view
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
newOwnerId	integer	The ID of the new content owner
newOwnerLuid	string	The LUID of the new content owner
oldOwnerId	integer	The ID of the old content owner
oldOwnerLuid	string	The LUID of the old content owner

## create\_delete\_group The `create_delete_group` event is logged when a group is created or deleted.

Attribute Name	Type	Description
groupDomain	string	The domain of the group, such as local
groupId	integer	The ID of the group
groupLuid	string	The The LUID of the group
groupName	string	The name of the group that had its permissions changed
groupOperation	string	Group operation, either create or delete
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## create\_delete\_group\_set The `create_delete_group_set` event is logged when a group set is created or deleted.

Attribute Name	Type	Description
groupSetId	integer	The ID of the group set
groupSetLuid	string	The LUID of the group set
groupSetName	string	The name of the group set that is created or deleted
groupSetOperation	string	Group Set operation, either create or delete
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## create\_permissions The `create_permissions` event is logged when a new explicit permission rule is created. **Note:** Deprecated in October 2024. Use the [set\_permissions](#set-permissions) event instead.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as a project or workbook
capabilityId	integer	The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue	string	Description of the capability
contentId	integer	The ID of the content that had the permissions updated
contentLuid	string	The LUID of the content item
contentName	string	The name of the content that had the permissions updated
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee
granteeType	string	The type of grantee, either user or group
granteeValue	string	The updated permissions value, such as 'user allow' or 'group allow'
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## delete\_all\_permissions The `delete_all_permissions` event is logged when all explicit permission rules for content are deleted, typically when content is deleted.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as a project or workbook
contentId	integer	The ID of the content that had the permissions updated
contentLuid	string	The LUID of the content
contentName	string	The name of the content that had the permissions updated
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## delete\_permissions The `delete_permissions` event is logged when an explicit permission rule is removed from a content item through the REST API. For more information, see [Permissions Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_permissions.htm) in Tableau REST API Help. Other ways of removing permissions are logged as different events: - Removing a capability in the Permissions dialog is logged as a `set_permissions` event with a `permissionType` of `unspecified`, because the grantee's entire permission set is replaced. - Deleting content is logged as `delete_all_permissions`. - Deleting a user or group is logged as `delete_permissions_grantee`. To capture all permission removals, monitor `set_permissions`, `delete_all_permissions`, and `delete_permissions_grantee`.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as a project or workbook
capabilityId	integer	The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue	string	Description of the capability
contentId	integer	The ID of the content that had the permissions updated
contentLuid	string	The LUID of the content
contentName	string	The name of the content that had the permissions updated
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The `granteeId` attribute is always present.
granteeType	string	The type of grantee, either user or group
granteeValue	string	The updated permissions value, such as 'user allow' or 'group allow'
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## delete\_permissions\_grantee The `delete_permissions_grantee` event is logged when all explicit permission rules for a user or group are deleted, typically when the user or group is deleted.

Attribute Name	Type	Description
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The `granteeId` attribute is always present.
granteeType	string	The type of grantee, either user or group
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error

## display\_sheet\_tabs The `display_sheet_tabs` event is logged when the "Tabbed Views" value is updated on a workbook.

Attribute Name	Type	Description
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
workbookId	integer	The ID of the workbook

## hist\_access\_authoring\_view The `hist_access_authoring_view` event is logged when a user authors view.

Attribute Name	Type	Description
caption	string	The descriptive phrase constructed for the worksheet based on the workbook definition
description	string	Description of the view
fields	string	A list of fields extracted from the workbook .twb file
firstPublishedAt	string	Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
index	integer	Each view has an index that is unique among views belonging to that workbook
name	string	Name of the view
ownerLuid	string	User LUID of the view owner
ownerName	string	Name of the view owner
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId	string	The ID of the worksheet
sheetType	string	The type of worksheet. Either a story, dashboard, or view.
siteName	string	Name of the Tableau site
title	string	The worksheet title from the workbook .twb file
viewLuid	string	The LUID of the view
workbookLuid	string	The LUID of the workbook containing the view
workbookName	string	Name of the workbook containing the view

## hist\_access\_datasource The `hist_access_datasource` event is logged when a user accesses a data source. **Note:** Only partial data for this event type is available through the API. To see the full event logs, configure Activity Log to send log data to your Amazon S3 bucket for analysis. For more information, see [Set Up Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_setup.htm).

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_access\_datasource\_remotely The `hist_access_datasource_remotely` event is logged when a user accesses a data source from Tableau Bridge.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_access\_metric The `hist_access_metric` event is logged when users interact with metrics on the site. **Note:** Tableau's legacy metrics feature was retired in February 2024. As a result, this event no longer records user interaction with metrics on the site. For more information, see [Set Up for Metrics](https://help.tableau.com/v0.0/online/en-us/metrics_admin.htm).

Attribute Name	Type	Description
customizedViewLuid	string	Unique ID of the custom view from which the metric queries its data
description	string	Description of the metric
metricLuid	string	Unique ID of the metric
name	string	Name of the metric
projectLuid	string	Unique ID of the project that contains the metric
projectName	string	Name of the project that contains the metric
siteName	string	Name of the Tableau site
suspendState	integer	State of the metric. The value 0 = Not suspended, 1 = Auto-suspended, and 3 = Manually suspended.
viewLuid	string	Unique ID of the view from which the metric queries its data

## hist\_access\_summary\_data The `hist_access_summary_data` event is logged when users access the Summary Data window.

Attribute Name	Type	Description
contentVersion	integer	The version of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetName	string	Name of the sheet for which data was accessed
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views that are associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_access\_underlying\_data The `hist_access_underlying_data` event is logged when users access the Underlying Data window.

Attribute Name	Type	Description
contentVersion	integer	The version of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if this workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetName	string	Name of the sheet for which data was accessed
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views that are associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_access\_view The `hist_access_view` event is logged when users access a view.

Attribute Name	Type	Description
actorExternalId	string	The external ID for the acting user. This is an opaque identifier dependent on the actor type, but could, for example, be a user email. Can also show the identifier of a user accessing content through on-demand access.
caption	string	The descriptive phrase constructed for the worksheet based on the workbook definition
description	string	Description of the view
fields	string	A list of fields extracted from the workbook .twb file
firstPublishedAt	string	Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
index	integer	Each view has an index that is unique among views belonging to that workbook
name	string	Name of the view
ownerLuid	string	User LUID of the view owner
ownerName	string	Name of the view owner
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId	string	The ID of the worksheet
sheetType	string	The type of worksheet. Either a story, dashboard, or view.
siteName	string	Name of the Tableau site
title	string	The worksheet title from the workbook .twb file
viewLuid	string	The LUID of the view
workbookLuid	string	The LUID of the workbook containing the view
workbookName	string	Name of the workbook containing the view

## hist\_activate\_site The `hist_activate_site event` is logged when a Tableau site is activated.

Attribute Name	Type	Description
name	string	Name of the Tableau site
siteEventLuid	string	Unique ID of the site affected by the event
siteName	string	Name of the Tableau site
urlNamespace	string	Used in the construction of URLs that target the site

## hist\_add\_user\_to\_group The `hist_add_user_to_group` event is logged when a user is added to a group.

Attribute Name	Type	Description
groupLuid	string	Unique ID of the group
name	string	Name of the group
siteName	string	Name of the site
userLuid	string	LUID of the user added to the group
userName	string	Name of the user added to the group

## hist\_append\_to\_datasource\_extract The `hist_append_to_datasource_extract` event is logged when data is added to a data extract.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
details	string	A message string
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
taskLuid	string	LUID of the associated task
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_bulk\_delete\_columns The `hist_bulk_delete_columns` event is logged when columns are deleted from a data source.

Attribute Name	Type	Description
columnLuid	string	Unique ID of the column
description	string	Description of the published column
name	string	Name of the published column
ownerLuid	string	User LUID of the column owner
ownerName	string	The name of the column owner
projectLuid	string	LUID of the project that contains the column
projectName	string	Name of the project that contains the column
siteName	string	Name of the Tableau site

## hist\_change\_collection\_ownership The `hist_change_collection_ownership` event is logged when the collection owner is changed.

Attribute Name	Type	Description
collectionLuid	string	Unique ID of the collection
description	string	Description of the collection
name	string	Name of the collection
newOwnerLuid	string	The LUID of the new collection owner
newOwnerName	string	The name of the new collection owner
oldOwnerLuid	string	The LUID of the previous collection owner
oldOwnerName	string	The name of previous collection owner
ownerLuid	string	User LUID of the collection owner
ownerName	string	Name of the collection owner
siteName	string	Name of the Tableau site

## hist\_change\_data\_role\_ownership The `hist_change_data_role_ownership` event is logged when data role ownership is changed.

Attribute Name	Type	Description
dataRoleLuid	string	Unique ID of the data role
description	string	Description of the data role
name	string	Name of the data role
newOwnerLuid	string	The LUID of the new data role owner
newOwnerName	string	Name of the new data role owner
oldOwnerLuid	string	The LUID of the previous data role owner
oldOwnerName	string	Name of the previous data role owner
ownerLuid	string	User LUID of the data role owner
ownerName	string	Name of the data role owner
projectLuid	string	LUID of the project that contains the data role
projectName	string	Name of the project that contains the data role
siteName	string	Name of the Tableau site

## hist\_change\_database\_contact The `hist_change_database_contact` event is logged when changing the database contact.

Attribute Name	Type	Description
databaseLuid	string	Unique ID of the database
description	string	Description of the database
name	string	Name of the database
newContactLuid	string	LUID of the new contact
newContactName	string	Name of the new contact
oldContactLuid	string	LUID of the previous contact
oldContactName	string	Name of the previous contact
ownerLuid	string	User LUID of the database owner
ownerName	string	Name of the database owner
projectLuid	string	LUID of the project that contains the database
projectName	string	Name of the project that contains the database
siteName	string	Name of the Tableau site

## hist\_change\_datasource\_ownership The `hist_change_datasource_ownership` event is logged when changing the data source owner.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
newOwnerLuid	string	LUID of the new data source owner
newOwnerName	string	Name of the new data source owner
oldOwnerLuid	string	LUID of the previous data source owner
oldOwnerName	string	Name of the previous data source owner
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_change\_flow\_ownership The `hist_change_flow_ownership` event is logged when changing the flow owner.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
newOwnerLuid	string	LUID of the new flow owner
newOwnerName	string	Name of the new flow owner
oldOwnerLuid	string	LUID of the previous flow owner
oldOwnerName	string	Name of previous flow owner
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_change\_metric\_ownership The `hist_change_metric_ownership` event is logged when changing the metric owner. **Note:** Tableau's legacy metrics feature was retired in February 2024. As a result, this event no longer records user interaction with metrics on the site. For more information, see [Set Up for Metrics](https://help.tableau.com/v0.0/online/en-us/metrics_admin.htm).

Attribute Name	Type	Description
customizedViewLuid	string	Unique ID of the custom view from which the metric queries its data
description	string	Description of the metric
metricLuid	string	Unique ID of the metric
name	string	Name of the metric
newOwnerLuid	string	LUID of the new metric owner
newOwnerName	string	Name of the new metric owner
oldOwnerLuid	string	LUID of the previous metric owner
oldOwnerName	string	Name of the previous metric owner
projectLuid	string	Unique ID of the project that contains the metric
projectName	string	Name of the project that contains the metric
siteName	string	Name of the Tableau site
suspendState	integer	State of the metric. The value 0 = Not suspended, 1 = Auto-suspended, and 3 = Manually suspended.
viewLuid	string	Unique ID of the view from which the metric queries its data

## hist\_change\_project\_ownership The `hist_change_project_ownership` event is logged when project ownership is changed.

Attribute Name	Type	Description
description	string	Description of the project
name	string	Name of the project
newOwnerLuid	string	LUID of the new project owner
newOwnerName	string	Name of the new project owner
oldOwnerLuid	string	LUID of the previous project owner
oldOwnerName	string	Name of the previous project owner
ownerLuid	string	LUID of the project owner
ownerName	string	Name of the project owner
parentProjectLuid	string	LUID of the parent project. The value is Null for top-level projects.
projectLuid	string	Unique ID of the project
siteName	string	Name of the Tableau site
state	string	State of the project. The default value is active. Any other value indicates the project is inactive.

## hist\_change\_published\_connection\_ownership The `hist_change_published_connection_ownership` event is logged when published connection ownership is changed.

Attribute Name	Type	Description
activated	boolean	Indicates whether the published connection is available for use
description	string	Description of the published connection
name	string	Name of the published connection
newOwnerLuid	string	LUID of the new published connection owner
newOwnerName	string	Name of the new published connection owner
oldOwnerLuid	string	LUID of the previous published connection owner
oldOwnerName	string	Name of the previous published connection owner
ownerLuid	string	LUID of the published connection owner
ownerName	string	Name of the published connection owner
projectLuid	string	LUID of the project that contains the published connection
projectName	string	Name of the project that contains the published connection
publishedConnectionLuid	string	Unique ID of the published connection
siteName	string	Name of the Tableau site

## hist\_change\_site\_extract\_encryption\_mode The legacy change site extract encryption mode event from historical\_events.

Attribute Name	Type	Description
name	string	Name of the Tableau site
siteEventLuid	string	Unique ID of the site affected by the event
siteName	string	Name of the Tableau site
urlNamespace	string	Used in the construction of URLs that target the site

## hist\_change\_table\_contact The `hist_change_table_contact` event is logged when the table contact is changed.

Attribute Name	Type	Description
description	string	Description of the table
name	string	Name of the table
newContactLuid	string	LUID of the new contact
newContactName	string	Name of the new contact
oldContactLuid	string	LUID of the previous contact
oldContactName	string	Name of the previous contact
ownerLuid	string	User LUID of the table owner
ownerName	string	Name of the table owner
projectLuid	string	LUID of the project that contains the table
projectName	string	Name of the project that contains the table
siteName	string	Name of the Tableau site
tableLuid	string	Unique ID of the table

## hist\_change\_workbook\_ownership The `hist_change_workbook_ownership` event is logged when workbook ownership is changed.

Attribute Name	Type	Description
contentVersion	integer	The version of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if this workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
newOwnerLuid	string	LUID of the new project owner
newOwnerName	string	Name of the new project owner
oldOwnerLuid	string	LUID of the previous project owner
oldOwnerName	string	Name of the previous project owner
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the workbook owner
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_create\_collection The `hist_create_collection` event is logged when a user creates a collection.

Attribute Name	Type	Description
collectionLuid	string	Unique ID of the collection
description	string	Description of the collection
name	string	Name of the collection
ownerLuid	string	User LUID of the collection owner
ownerName	string	Name of the collection owner
siteName	string	Name of the Tableau site

## hist\_create\_column The `hist_create_column` event is logged when a user creates a column.

Attribute Name	Type	Description
columnLuid	string	Unique ID of the column
description	string	Description of the column
name	string	Name of the column
ownerLuid	string	User LUID of the column owner
ownerName	string	Name of the column owner
projectLuid	string	LUID of the project that contains the column
projectName	string	Name of the project that contains the column
siteName	string	Name of the Tableau site

## hist\_create\_data\_quality\_indicator The `hist_create_data_quality_indicator` event is logged when users create data quality warnings.

Attribute Name	Type	Description
dataQualityIndicatorLuid	string	Unique ID of the data quality indicator
dataQualityType	string	The type of data quality indicator Either warning, deprecated, stale data, under maintenance, sensitive data, or a custom value.
isActive	boolean	Indicates whether the data quality indicator is active or not
isSevere	boolean	Indicates whether the data quality indicator is severe or not
message	string	Message of data quality indicator
siteName	string	Name of the Tableau site
userDisplayName	string	Display name of user who created or modified the data quality indicator
userLuid	string	LUID of user who created or modified the data quality indicator

## hist\_create\_database The `hist_create_database` event is logged when a user creates a database.

Attribute Name	Type	Description
databaseLuid	string	Unique ID of the database
description	string	Description of the database
name	string	Name of the database
ownerLuid	string	User LUID of the database owner
ownerName	string	Name of the database owner
projectLuid	string	LUID of the project that contains the database
projectName	string	Name of the project that contains the database
siteName	string	Name of the Tableau site

## hist\_create\_datasource\_extracts The `hist_create_datasource_extracts` event is logged when a new data source extract is created.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
details	string	Message that includes details about the data source
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
taskLuid	string	LUID of the associated task
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_create\_datasource\_task The `hist_create_datasource_task` event is logged when a new data source task is created.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If the task is inactive, it will not run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Task title. Provides additional information about the task.
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_create\_datasource\_trigger The `hist_create_datasource_trigger` event specifies what caused the data source to be created.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_create\_flow\_task The `hist_create_flow_task` event is logged when a new flow task is created.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If the task is inactive, it will not run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Task title. Provides additional information about the task.
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_create\_flow\_trigger The `hist_create_flow_trigger` event specifies what caused the flow to be created.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_create\_group The `hist_create_group` event is logged when creating a group.

Attribute Name	Type	Description
groupLuid	string	Unique ID of the group
name	string	Name of the group
siteName	string	Name of the Tableau site

## hist\_create\_linked\_task The `hist_create_linked_task` event is logged when creating linked tasks that run sequentially.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Task title. Provides additional information about the task.
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_create\_materialized\_views The `hist_create_materialized_views` event logs the successful creation of materialized views on a workbook.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	Details of the action (why were the materialized views created or deleted).
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
eventType	string	The type of the event. Either Create, Delete, Encrypt, Decrypt, or Rekey Materialized Views.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_create\_metric The `hist_create_metric` event is logged when users create metrics on the site. **Note:** Tableau's legacy metrics feature was retired in February 2024. As a result, this event no longer records user interaction with metrics on the site. For more information, see [Set Up for Metrics](https://help.tableau.com/v0.0/online/en-us/metrics_admin.htm).

Attribute Name	Type	Description
customizedViewLuid	string	The view from which the metric queries its data
description	string	Description of the metric
metricLuid	string	Unique ID of the metric
name	string	Name of the metric
projectLuid	string	Unique ID of the associated project
projectName	string	Name of the associated project
siteName	string	Name of the Tableau site
suspendState	integer	State of the metric. The value 0 = Not suspended, 1 = Auto-suspended, and 3 = Manually suspended.
viewLuid	string	The view from which the metric queries its data

## hist\_create\_project The `hist_create_project` event is logged when users create projects on the site.

Attribute Name	Type	Description
description	string	Description of the project
name	string	Name of the project
ownerLuid	string	Unique ID of the project owner
ownerName	string	Name of the project owner
parentProjectLuid	string	LUID of the parent project. The value is Null for top-level projects.
projectLuid	string	Unique identifier for the project
siteName	string	Name of the Tableau site
state	string	State of the project. The default value is active. Any other value indicates the project is inactive.

## hist\_create\_schedule The `hist_create_schedule` event is logged when users create schedules on the site.

Attribute Name	Type	Description
active	boolean	Indicates whether the schedule is active or not. If set to False, no tasks will run when the schedule is triggered.
dayOfMonthMask	integer	Indicates which day of the month the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the month correspond to 1st = 1, 2nd = 10, 3rd = 100, 4th = 1000, 5th = 10000, etc.
dayOfWeekMask	integer	Indicates which day of the week the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the week correspond to Sunday = 1, Monday = 10, Tuesday = 100, Wednesday = 1000, Thursday = 10000, Friday = 100000, and Saturday = 1000000.
endAtMinute	integer	The minute after the specified schedule_type period begins, indicating when the schedule should stop triggering.
endScheduleAt	string	Timestamp when the schedule should stop triggering
isSerial	boolean	Indicates whether the schedule is run serially or not
minuteInterval	integer	Once triggered, the schedule will repeat at this interval until it ends as per the schedule_type, end_at_minute, or end_schedule_at.
name	string	Name of the schedule
priority	integer	Priority ranges from 1 to 100, with lower values corresponding to a higher priority.
scheduleLuid	string	Unique ID of the schedule
scheduleType	integer	The type of schedule. The value 0 = Hourly, 1 = Daily, 2 = Weekly, and 3 = Monthly.
scheduledAction	integer	Category of the scheduled action. The value 0 = Extracts and 1 = Subscriptions.
siteName	string	Name of the Tableau site
startAtMinute	integer	The minute after the scheduled start time per the schedule_type. For example, in a daily schedule, it's minutes past midnight; for hourly, it's minutes past the hour.

## hist\_create\_site The legacy create site from historical\_events

Attribute Name	Type	Description
name	string	Name of the Tableau site
siteEventLuid	string	Unique ID of the site affected by the event
siteName	string	Name of the Tableau site
urlNamespace	string	Used in the construction of URLs that target the site

## hist\_create\_subscription\_task The `hist_create_subscription_task` event is logged when subscription tasks are created.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_create\_system\_user The `hist_create_system_user` event is logged when adding a system user.

Attribute Name	Type	Description
email	string	Email address of the user
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_create\_table The `hist_create_table` event is logged when creating a database table on the site.

Attribute Name	Type	Description
description	string	Description of the table
name	string	Name of the table
ownerLuid	string	Unique ID of the table owner
ownerName	string	Name of the table owner
projectLuid	string	Unique ID of the project that contains the table
projectName	string	Name of the project that contains the table
siteName	string	Name of the Tableau site
tableLuid	string	Unique ID of the table

## hist\_create\_user The `hist_create_user event` is logged when adding a user to the site.

Attribute Name	Type	Description
email	string	Email address of the user
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_create\_workbook\_extracts The `hist_create_workbook_extracts` event is logged when changes are made to workbooks containing extracts.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	A message string
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isFailure	boolean	Indicates whether the action failed or not
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
taskLuid	string	LUID of the associated task
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_create\_workbook\_task The `hist_create_workbook_task` event is logged for workbook related tasks.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_decrypt\_datasource\_extracts The legacy decrypt datasource extracts event from historical\_events.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	Unique ID of the data source
description	string	Description of the data source
details	string	A message string
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the data source
ownerLuid	string	Unique ID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	Unique ID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_decrypt\_datasource\_extracts\_request The legacy decrypt datasource extracts request event from historical\_events.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	Unique ID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	Unique ID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	Unique ID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_decrypt\_flow\_draft\_extracts The legacy decrypt flow draft extracts event from historical\_events.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
details	string	A message string
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
updatedAt	string	Timestamp when the record was last updated

## hist\_decrypt\_flow\_draft\_extracts\_request The legacy decrypt flow draft extracts request event from historical\_events.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
updatedAt	string	Timestamp when the record was last updated

## hist\_decrypt\_flow\_extracts The legacy decrypt flow extracts event from historical\_events.

Attribute Name	Type	Description
contentVersion	string	Version of the flow file, increments by 1 on each publish.
description	string	Description of the flow
details	string	A message string
flowLuid	string	Unique ID of the flow
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_decrypt\_flow\_extracts\_request The legacy decrypt flow extracts request event from historical\_events.

Attribute Name	Type	Description
contentVersion	string	Version of the flow file, increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_decrypt\_materialized\_views The hist\_decrypt\_materialized\_views event logs the successful decrypting of materialized views on a workbook.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	Details of the action (why were the materialized views created or deleted).
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
eventType	string	The type of the event. Either Create, Delete, Encrypt, Decrypt, or Rekey Materialized Views.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_decrypt\_site\_extracts\_request The legacy decrypt site extracts request event from historical\_events.

Attribute Name	Type	Description
name	string	Name of the Tableau site
siteEventLuid	string	Unique ID of the site affected by the event
siteName	string	Name of the Tableau site
urlNamespace	string	Used in the construction of URLs that target the site

## hist\_decrypt\_workbook\_extracts The legacy decrypt workbook extracts event from historical\_events.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	A message string
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isFailure	boolean	Indicates whether the action failed or not
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_decrypt\_workbook\_extracts\_request The legacy decrypt workbook extracts request event from historical\_events.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_delete\_access\_token The `hist_delete_access_token` event is logged when a user deltes an access token.

Attribute Name	Type	Description
siteName	string	Name of the Tableau site where the access token is deleted.

## hist\_delete\_collection The `hist_delete_collection` event is logged when a collection is deleted.

Attribute Name	Type	Description
collectionLuid	string	Unique identifier
description	string	Description of the collection
name	string	Name of the collection
ownerLuid	string	Unique ID of the user who owns the collection
ownerName	string	Name of the user who owns the collection
siteName	string	Name of the Tableau site

## hist\_delete\_column The `hist_delete_column` event is logged when deleting a database column.

Attribute Name	Type	Description
columnLuid	string	Unique identifier
description	string	Description of the column
name	string	Name of the column
ownerLuid	string	Unique ID of the user who owns the column
ownerName	string	Name of the user who owns the column
projectLuid	string	Unique ID of the project that contains the column
projectName	string	Name of the project that contains the column
siteName	string	Name of the Tableau site

## hist\_delete\_data\_quality\_indicator The `hist_delete_data_quality_indicator` event is logged when a data quality warning is deleted.

Attribute Name	Type	Description
dataQualityIndicatorLuid	string	Unique identifier
dataQualityType	string	The type of data quality indicator
isActive	boolean	Indicates whether the data quality indicator is active or not
isSevere	boolean	Indicates whether the data quality indicator is severe or not
message	string	Data quality filter message
siteName	string	Name of the Tableau site
userDisplayName	string	Name of user who created or modified the data quality indicator
userLuid	string	Unique ID of the user who created or modified the data quality indicator

## hist\_delete\_data\_role The `hist_delete_data_role` event is logged when deleting a data role.

Attribute Name	Type	Description
dataRoleLuid	string	Unique identifier
description	string	Description of the data role
name	string	Name of the data role
ownerLuid	string	Unique ID of the data role owner
ownerName	string	Name of the data role owner
projectLuid	string	Unique ID of the project that contains the data role
projectName	string	Name of the project that contains the data role
siteName	string	Name of the Tableau site

## hist\_delete\_database The `hist_delete_database` event is logged when a database is deleted.

Attribute Name	Type	Description
databaseLuid	string	Unique identifier
description	string	Description of the database
name	string	Name of the database
ownerLuid	string	Unique ID of the database owner
ownerName	string	Name of the database owner
projectLuid	string	Unique ID of the project that contains the database
projectName	string	Name of the project that contains the database
siteName	string	Name of the Tableau site

## hist\_delete\_datasource The `hist_delete_datasource` event is logged when deleting a data source.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_delete\_datasource\_task The `hist_delete_datasource_task` event is logged when a data source related task is deleted.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_delete\_datasource\_trigger The `hist_delete_datasource_trigger` event specifies what caused the data source to be deleted.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_delete\_expired\_refresh\_token The `hist_delete_expired_refresh_token` event is logged when an expired refresh token is deleted by the Backgrounder process.

Attribute Name	Type	Description
deviceName	string	Name of the device associated with the refresh token
refreshTokenGuid	string	Unique ID of the refresh token
siteName	string	Name of the Tableau site

## hist\_delete\_flow The `hist_delete_flow` event is logged when a flow is deleted.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_delete\_flow\_draft The `hist_delete_flow_draft` event is logged when a flow draft is deleted.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
updatedAt	string	Timestamp when the record was last updated

## hist\_delete\_flow\_task The `hist_delete_flow_task` event is logged when deleting flow related tasks.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_delete\_flow\_trigger The `hist_delete_flow_trigger` event specifies what caused the flow to be deleted.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_delete\_group The `hist_delete_group` event is logged when a group is deleted.

Attribute Name	Type	Description
groupLuid	string	Unique ID of the group
name	string	Name of the group
siteName	string	Name of the Tableau site

## hist\_delete\_linked\_task The `hist_delete_linked_task` event is logged when deleting tasks that are linked and scheduled to run serially.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_delete\_materialized\_views The `hist_delete_materialized_views` event logs the successful deletion of materialized views on a workbook

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	Details of the action (why were the materialized views created or deleted).
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
eventType	string	The type of the event. Either Create, Delete, Encrypt, Decrypt, or Rekey Materialized Views.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_delete\_metric The `hist_delete_metric` event is logged when a metric is deleted. **Note:** Tableau's legacy metrics feature was retired in February 2024. As a result, this event no longer records user interaction with metrics on the site. For more information, see [Set Up for Metrics](https://help.tableau.com/v0.0/online/en-us/metrics_admin.htm).

Attribute Name	Type	Description
customizedViewLuid	string	The view from which the metric queries its data
description	string	Description of the metric
metricLuid	string	Unique ID of the metric
name	string	Name of the metric
projectLuid	string	Unique ID of the associated project
projectName	string	Name of the associated project
siteName	string	Name of the Tableau site
suspendState	integer	State of the metric. The value 0 = Not suspended, 1 = Auto-suspended, and 3 = Manually suspended.
viewLuid	string	The view from which the metric queries its data

## hist\_delete\_project The `hist_delete_project` event is logged when a project is deleted.

Attribute Name	Type	Description
description	string	Description of the project
name	string	Name of the project
ownerLuid	string	Unique ID of the project owner
ownerName	string	Name of the project owner
parentProjectLuid	string	LUID of the parent project. The value is Null for top-level projects.
projectLuid	string	Unique identifier for the project
siteName	string	Name of the Tableau site
state	string	State of the project. The default value is active. Any other value indicates the project is inactive.

## hist\_delete\_refresh\_token\_session The `hist_delete_refresh_token_session` event is logged when a session created by refresh token is deleted. **Note:** Only partial data for this event type is available through the API. To see the full event logs, configure Activity Log to send log data to your Amazon S3 bucket for analysis. For more information, see [Set Up Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_setup.htm).

Attribute Name	Type	Description
deviceName	string	Name of the device associated with the refresh token
refreshTokenGuid	string	Unique ID of the refresh token
sessionId	string	ID of the session
siteName	string	Name of the Tableau site

## hist\_delete\_schedule The `hist_delete_schedule` event is logged when a schedule is deleted.

Attribute Name	Type	Description
active	boolean	Indicates whether the schedule is active or not. If set to False, no tasks will run when the schedule is triggered.
dayOfMonthMask	integer	Indicates which day of the month the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the month correspond to 1st = 1, 2nd = 10, 3rd = 100, 4th = 1000, 5th = 10000, etc.
dayOfWeekMask	integer	Indicates which day of the week the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the week correspond to Sunday = 1, Monday = 10, Tuesday = 100, Wednesday = 1000, Thursday = 10000, Friday = 100000, and Saturday = 1000000.
endAtMinute	integer	The minute after the specified schedule_type period begins, indicating when the schedule should stop triggering.
endScheduleAt	string	Timestamp when the schedule should stop triggering
isSerial	boolean	Indicates whether the schedule is run serially or not
minuteInterval	integer	Once triggered, the schedule will repeat at this interval until it ends as per the schedule_type, end_at_minute, or end_schedule_at.
name	string	Name of the schedule
priority	integer	Priority ranges from 1 to 100, with lower values corresponding to a higher priority.
scheduleLuid	string	Unique ID of the schedule
scheduleType	integer	The type of schedule. The value 0 = Hourly, 1 = Daily, 2 = Weekly, and 3 = Monthly.
scheduledAction	integer	Category of the scheduled action. The value 0 = Extracts and 1 = Subscriptions.
siteName	string	Name of the Tableau site
startAtMinute	integer	The minute after the scheduled start time per the schedule_type. For example, in a daily schedule, it's minutes past midnight; for hourly, it's minutes past the hour.

## hist\_delete\_site The `hist_delete_site` event is logged when a site is deleted.

Attribute Name	Type	Description
name	string	Name of the Tableau site
siteEventLuid	string	Unique ID of the site affected by the event
siteName	string	Name of the Tableau site
urlNamespace	string	Used in the construction of URLs that target the site

## hist\_delete\_system\_user The `hist_delete_system_user` event is logged when a system user is deleted.

Attribute Name	Type	Description
email	string	Email address of the user
name	string	Name of the user
siteAdminLevel	integer	Indicates whether the user is a site admin. The value 5 = site admin and 0 = not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	The unique identifier of the user

## hist\_delete\_table The `hist_delete_table` event is logged when a table is deleted.

Attribute Name	Type	Description
description	string	Description of the table
name	string	Name of the table
ownerLuid	string	Unique ID of the table owner
ownerName	string	Name of the table owner
projectLuid	string	Unique ID of the project that contains the table
projectName	string	Name of the project that contains the table
siteName	string	Name of the Tableau site
tableLuid	string	Unique identifier

## hist\_delete\_user The `hist_delete_user` event is logged when a user is deleted from the site.

Attribute Name	Type	Description
email	string	Email address of the user
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_delete\_user\_from\_group The `hist_delete_user_from_group` event is logged when a user is removed from a group.

Attribute Name	Type	Description
groupLuid	string	Unique ID of the group
name	string	Name of the group
siteName	string	Name of the Tableau site
userLuid	string	LUID of the user deleted from the group
userName	string	The name of the user deleted from the group

## hist\_delete\_view The `hist_delete_view` event is logged when a view is deleted from the site.

Attribute Name	Type	Description
caption	string	The descriptive phrase constructed for the worksheet based on the workbook definition
description	string	Description of the view
fields	string	A list of fields extracted from the workbook .twb file
firstPublishedAt	string	Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
index	integer	Each view has an index that is unique among views belonging to that workbook
name	string	Name of the view
ownerLuid	string	User LUID of the view owner
ownerName	string	Name of the view owner
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId	string	The ID of the worksheet
sheetType	string	The type of worksheet. Either a story, dashboard, or view.
siteName	string	Name of the Tableau site
title	string	The worksheet title from the workbook .twb file
viewLuid	string	The LUID of the view
workbookLuid	string	The LUID of the workbook containing the view
workbookName	string	Name of the workbook containing the view

## hist\_delete\_workbook The `hist_delete_workbook` event is logged when a workbook is deleted.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_delete\_workbook\_task The `hist_delete_workbook_task` event is logged when a workbook related task is deleted.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_disable\_linked\_task\_schedule The `hist_disable_linked_task_schedule` event is logged when a linked task schedule is turned off.

Attribute Name	Type	Description
active	boolean	Indicates whether the schedule is active or not. If set to False, no tasks will run when the schedule is triggered.
dayOfMonthMask	integer	Indicates which day of the month the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the month correspond to 1st = 1, 2nd = 10, 3rd = 100, 4th = 1000, 5th = 10000, etc.
dayOfWeekMask	integer	Indicates which day of the week the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the week correspond to Sunday = 1, Monday = 10, Tuesday = 100, Wednesday = 1000, Thursday = 10000, Friday = 100000, and Saturday = 1000000.
endAtMinute	integer	The minute after the specified schedule_type period begins, indicating when the schedule should stop triggering.
endScheduleAt	string	Timestamp when the schedule should stop triggering
isSerial	boolean	Indicates whether the schedule is run serially or not
minuteInterval	integer	Once triggered, the schedule will repeat at this interval until it ends as per the schedule_type, end_at_minute, or end_schedule_at.
name	string	Name of the schedule
priority	integer	Priority ranges from 1 to 100, with lower values corresponding to a higher priority.
scheduleLuid	string	Unique ID of the schedule
scheduleType	integer	The type of schedule. The value 0 = Hourly, 1 = Daily, 2 = Weekly, and 3 = Monthly.
scheduledAction	integer	Category of the scheduled action. The value 0 = Extracts and 1 = Subscriptions.
siteName	string	Name of the Tableau site
startAtMinute	integer	The minute after the scheduled start time per the schedule_type. For example, in a daily schedule, it's minutes past midnight; for hourly, it's minutes past the hour.

## hist\_disable\_schedule The `hist_disable_schedule` event is logged when a schedule is turned off.

Attribute Name	Type	Description
active	boolean	Indicates whether the schedule is active or not. If set to False, no tasks will run when the schedule is triggered.
dayOfMonthMask	integer	Indicates which day of the month the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the month correspond to 1st = 1, 2nd = 10, 3rd = 100, 4th = 1000, 5th = 10000, etc.
dayOfWeekMask	integer	Indicates which day of the week the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the week correspond to Sunday = 1, Monday = 10, Tuesday = 100, Wednesday = 1000, Thursday = 10000, Friday = 100000, and Saturday = 1000000.
endAtMinute	integer	The minute after the specified schedule_type period begins, indicating when the schedule should stop triggering.
endScheduleAt	string	Timestamp when the schedule should stop triggering
isSerial	boolean	Indicates whether the schedule is run serially or not
minuteInterval	integer	Once triggered, the schedule will repeat at this interval until it ends as per the schedule_type, end_at_minute, or end_schedule_at.
name	string	Name of the schedule
priority	integer	Priority ranges from 1 to 100, with lower values corresponding to a higher priority.
scheduleLuid	string	Unique ID of the schedule
scheduleType	integer	The type of schedule. The value 0 = Hourly, 1 = Daily, 2 = Weekly, and 3 = Monthly.
scheduledAction	integer	Category of the scheduled action. The value 0 = Extracts and 1 = Subscriptions.
siteName	string	Name of the Tableau site
startAtMinute	integer	The minute after the scheduled start time per the schedule_type. For example, in a daily schedule, it's minutes past midnight; for hourly, it's minutes past the hour.

## hist\_download\_datasource The `hist_download_datasource` event is logged when a data source is downloaded from the site.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_download\_flow The `hist_download_flow` event is logged when a flow is downloaded from the site.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_download\_flow\_draft The `hist_download_flow_draft` event is logged when a flow draft is downloaded from the site.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
updatedAt	string	Timestamp when the record was last updated

## hist\_download\_workbook The `hist_download_workbook` event is logged when downloading a workbook from the site.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_enable\_linked\_task\_schedule The `hist_enable_linked_task_schedule` event is logged when a linked task scheduled is turned on.

Attribute Name	Type	Description
active	boolean	Indicates whether the schedule is active or not. If set to False, no tasks will run when the schedule is triggered.
dayOfMonthMask	integer	Indicates which day of the month the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the month correspond to 1st = 1, 2nd = 10, 3rd = 100, 4th = 1000, 5th = 10000, etc.
dayOfWeekMask	integer	Indicates which day of the week the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the week correspond to Sunday = 1, Monday = 10, Tuesday = 100, Wednesday = 1000, Thursday = 10000, Friday = 100000, and Saturday = 1000000.
endAtMinute	integer	The minute after the specified schedule_type period begins, indicating when the schedule should stop triggering.
endScheduleAt	string	Timestamp when the schedule should stop triggering
isSerial	boolean	Indicates whether the schedule is run serially or not
minuteInterval	integer	Once triggered, the schedule will repeat at this interval until it ends as per the schedule_type, end_at_minute, or end_schedule_at.
name	string	Name of the schedule
priority	integer	Priority ranges from 1 to 100, with lower values corresponding to a higher priority.
scheduleLuid	string	Unique ID of the schedule
scheduleType	integer	The type of schedule. The value 0 = Hourly, 1 = Daily, 2 = Weekly, and 3 = Monthly.
scheduledAction	integer	Category of the scheduled action. The value 0 = Extracts and 1 = Subscriptions.
siteName	string	Name of the Tableau site
startAtMinute	integer	The minute after the scheduled start time per the schedule_type. For example, in a daily schedule, it's minutes past midnight; for hourly, it's minutes past the hour.

## hist\_enable\_schedule The `hist_enable_schedule` event is logged when a schedule is turned on.

Attribute Name	Type	Description
active	boolean	Indicates whether the schedule is active or not. If set to False, no tasks will run when the schedule is triggered.
dayOfMonthMask	integer	Indicates which day of the month the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the month correspond to 1st = 1, 2nd = 10, 3rd = 100, 4th = 1000, 5th = 10000, etc.
dayOfWeekMask	integer	Indicates which day of the week the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the week correspond to Sunday = 1, Monday = 10, Tuesday = 100, Wednesday = 1000, Thursday = 10000, Friday = 100000, and Saturday = 1000000.
endAtMinute	integer	The minute after the specified schedule_type period begins, indicating when the schedule should stop triggering.
endScheduleAt	string	Timestamp when the schedule should stop triggering
isSerial	boolean	Indicates whether the schedule is run serially or not
minuteInterval	integer	Once triggered, the schedule will repeat at this interval until it ends as per the schedule_type, end_at_minute, or end_schedule_at.
name	string	Name of the schedule
priority	integer	Priority ranges from 1 to 100, with lower values corresponding to a higher priority.
scheduleLuid	string	Unique ID of the schedule
scheduleType	integer	The type of schedule. The value 0 = Hourly, 1 = Daily, 2 = Weekly, and 3 = Monthly.
scheduledAction	integer	Category of the scheduled action. The value 0 = Extracts and 1 = Subscriptions.
siteName	string	Name of the Tableau site
startAtMinute	integer	The minute after the scheduled start time per the schedule_type. For example, in a daily schedule, it's minutes past midnight; for hourly, it's minutes past the hour.

## hist\_encrypt\_datasource\_extracts The legacy encrypt datasource extracts event from historical\_events.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	Unique identifier
description	string	Description of the data source
details	string	A message string
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the data source
ownerLuid	string	Unique ID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	Unique ID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_encrypt\_datasource\_extracts\_request The legacy encrypt datasource extracts request event from historical\_events.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	Unique identifier
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	Unique ID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	Unique ID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_encrypt\_flow\_draft\_extracts The legacy encrypt flow draft extracts event from historical\_events.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
details	string	A message string
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
updatedAt	string	Timestamp when the record was last updated

## hist\_encrypt\_flow\_draft\_extracts\_request The legacy encrypt flow draft extracts request event from historical\_events.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
updatedAt	string	Timestamp when the record was last updated

## hist\_encrypt\_flow\_extracts The legacy encrypt flow extracts event from historical\_events.

Attribute Name	Type	Description
contentVersion	string	Version of the flow file, increments by 1 on each publish.
description	string	Description of the flow
details	string	A message string
flowLuid	string	Unique ID of the flow
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_encrypt\_flow\_extracts\_request The legacy encrypt flow extracts request event from historical\_events.

Attribute Name	Type	Description
contentVersion	string	Version of the flow file, increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_encrypt\_materialized\_views The `hist_encrypt_materialized_views` event logs the successful encrypting of materialized views on a workbook.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	Details of the action (why were the materialized views created or deleted).
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
eventType	string	The type of the event. Either Create, Delete, Encrypt, Decrypt, or Rekey Materialized Views.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_encrypt\_site\_extracts\_request The legacy encrypt site extracts request event from historical\_events.

Attribute Name	Type	Description
name	string	Name of the Tableau site
siteEventLuid	string	Unique ID of the site affected by the event
siteName	string	Name of the Tableau site
urlNamespace	string	Used in the construction of URLs that target the site

## hist\_encrypt\_workbook\_extracts The legacy encrypt workbook extracts event from historical\_events.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	A message string
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isFailure	boolean	Indicates whether the action failed or not
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_encrypt\_workbook\_extracts\_request The legacy encrypt workbook extracts request event from historical\_events.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_export\_summary\_data The `hist_export_summary_data` event is logged when summary data is exported from a view.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetName	string	Name of the sheet for which data was accessed.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_export\_underlying\_data The `hist_export_underlying_data` event is logged when underlying data is exported from a view.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetName	string	Name of the sheet for which data was accessed.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_hyper\_data\_update\_job The legacy Hyper data update job event from historical\_events.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	Unique identifier
description	string	Description of the data source
details	string	Details of the action (why was the data updated).
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Whether the action succeeded or failed.
name	string	Name of the data source
ownerLuid	string	Unique ID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	Unique ID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_impersonate\_user The `hist_impersonate_user` event logs when a user ID has been impersonated.

Attribute Name	Type	Description
email	string	Email address of the user
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_increment\_datasource\_extract The `hist_increment_datasource_extract` event is logged when a data source extract is incrementally refreshed.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	Unique identifier
description	string	Description of the data source
details	string	A message string
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the data source
ownerLuid	string	Unique ID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	Unique ID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
taskLuid	string	LUID of the associated task
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_increment\_workbook\_extracts The `hist_increment_workbook_extracts` event is logged when extracts in a workbook are incrementally refreshed.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	A message string
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isFailure	boolean	Indicates whether the action failed or not
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
taskLuid	string	LUID of the associated task
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_issue\_refresh\_token The `hist_issue_refresh_token` event is logged when a refresh token or personal access token (PAT) is issued.

Attribute Name	Type	Description
refreshTokenGuid	string	The unique ID of the refresh token or PAT
siteName	string	Name of the Tableau site

## hist\_lock\_site The `hist_lock_site` event is logged when a site is locked.

Attribute Name	Type	Description
name	string	Name of the Tableau site
siteEventLuid	string	Unique ID of the site affected by the event
siteName	string	Name of the Tableau site
urlNamespace	string	Used in the construction of URLs that target the site

## hist\_login The `hist_login` event is logged when a user signed in to the site.

Attribute Name	Type	Description
actorExternalId	string	The external ID for the acting user. This is an opaque identifier dependent on the actor type, but could, for example, be a user email. Can also show the identifier of a user accessing content through on-demand access.
groupNames	string	The list of group names assigned to the user with on-demand access during sign-in
siteName	string	Name of the Tableau site

## hist\_login\_with\_pat The `hist_login_with_pat` event is logged when a user signed in with a personal access token (PAT).

Attribute Name	Type	Description
clientId	string	Used for PATs. The client ID is typically the PAT name displayed in the Tableau UI.
createdAt	string	The timestamp when the PAT was first created
expiresAt	string	The timestamp when the PAT expires
lastUsedAt	string	The timestamp when the PAT was last used
refreshTokenGuid	string	The unique ID of the PAT
siteName	string	Name of the Tableau site

## hist\_logout The `hist_logout event` is logged when a user logged out of the site.

Attribute Name	Type	Description
siteName	string	Name of the Tableau site

## hist\_move\_data\_role The `hist_move_data_role` event is logged when a data role is moved to a new project.

Attribute Name	Type	Description
dataRoleLuid	string	Unique identifier
description	string	Description of the data role
destinationProjectLuid	string	Unique ID of the destination project
destinationProjectName	string	Name of the destination project
name	string	Name of the data role
ownerLuid	string	Unique ID of the data role owner
ownerName	string	Name of the data role owner
projectLuid	string	Unique ID of the project that contains the data role
projectName	string	Name of the project that contains the data role
siteName	string	Name of the Tableau site
sourceProjectLuid	string	Unique ID of the source project
sourceProjectName	string	Name of the source project

## hist\_move\_database The `hist_move_database` event is logged when a database is moved to a new project.

Attribute Name	Type	Description
databaseLuid	string	Unique identifier
description	string	Description of the database
destinationProjectLuid	string	Unique ID of the destination project
destinationProjectName	string	Name of the destination project
name	string	Name of the database
ownerLuid	string	Unique ID of the database owner
ownerName	string	Name of the database owner
projectLuid	string	Unique ID of the project that contains the database
projectName	string	Name of the project that contains the database
siteName	string	Name of the Tableau site
sourceProjectLuid	string	Unique ID of the source project
sourceProjectName	string	Name of the source project

## hist\_move\_datasource The `hist_move_datasource` event is logged when a published data source is moved to a new project.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
destinationProjectLuid	string	Unique ID of the destination project
destinationProjectName	string	Name of the destination project
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
sourceProjectLuid	string	Unique ID of the source project
sourceProjectName	string	Name of the source project
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_move\_flow The `hist_move_flow` event is logged when a flow is moved to a new project.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
destinationProjectLuid	string	Unique ID of the destination project
destinationProjectName	string	Name of the destination project
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes
sourceProjectLuid	string	Unique ID of the source project
sourceProjectName	string	Name of the source project

## hist\_move\_flow\_draft The `hist_move_flow_draft` event is logged when a flow draft is moved to a new project.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
destinationProjectLuid	string	Unique ID of the destination project
destinationProjectName	string	Name of the destination project
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
sourceProjectLuid	string	Unique ID of the source project
sourceProjectName	string	Name of the source project
updatedAt	string	Timestamp when the record was last updated

## hist\_move\_metric The `hist_move_metric` event is logged when a metric is moved to a new project. **Note:** Tableau's legacy metrics feature was retired in February 2024. As a result, this event no longer records user interaction with metrics on the site. For more information, see [Set Up for Metrics](https://help.tableau.com/v0.0/online/en-us/metrics_admin.htm).

Attribute Name	Type	Description
customizedViewLuid	string	The view from which the metric queries its data
description	string	Description of the metric
destinationProjectLuid	string	Unique ID of the destination project
destinationProjectName	string	Name of the destination project
metricLuid	string	Unique ID of the metric
name	string	Name of the metric
projectLuid	string	Unique ID of the associated project
projectName	string	Name of the associated project
siteName	string	Name of the Tableau site
sourceProjectLuid	string	Unique ID of the source project
sourceProjectName	string	Name of the source project
suspendState	integer	State of the metric. The value 0 = Not suspended, 1 = Auto-suspended, and 3 = Manually suspended.
viewLuid	string	The view from which the metric queries its data

## hist\_move\_project The `hist_move_project` event is logged when a project is moved.

Attribute Name	Type	Description
description	string	Description of the project
destinationProjectLuid	string	Unique ID of the destination project
destinationProjectName	string	Name of the destination project
name	string	Name of the project
ownerLuid	string	Unique ID of the project owner
ownerName	string	Name of the project owner
parentProjectLuid	string	LUID of the parent project. The value is Null for top-level projects.
projectLuid	string	Unique identifier for the project
siteName	string	Name of the Tableau site
sourceProjectLuid	string	Unique ID of the source project
sourceProjectName	string	Name of the source project
state	string	State of the project. The default value is active. Any other value indicates the project is inactive.

## hist\_move\_published\_connection The `hist_move_published_connection` event is logged when a published connection is moved to a new project.

Attribute Name	Type	Description
activated	boolean	Whether this published connection was ever made available for consumption
description	string	Description of the published connection
destinationProjectLuid	string	Unique ID of the destination project
destinationProjectName	string	Name of the destination project
name	string	Name of the published connection
ownerLuid	string	Unique ID of the user that owns the published connection
ownerName	string	Name of the user who owns the published connection
projectLuid	string	The associated project
projectName	string	The name of the associated project
publishedConnectionLuid	string	Unique ID of the published connection
siteName	string	Name of the Tableau site
sourceProjectLuid	string	Unique ID of the source project
sourceProjectName	string	Name of the source project

## hist\_move\_table The `hist_move_table` event is logged when a table is moved to a new project.

Attribute Name	Type	Description
description	string	Description of the table
destinationProjectLuid	string	Unique ID of the destination project
destinationProjectName	string	Name of the destination project
name	string	Name of the table
ownerLuid	string	Unique ID of the table owner
ownerName	string	Name of the table owner
projectLuid	string	Unique ID of the project that contains the table
projectName	string	Name of the project that contains the table
siteName	string	Name of the Tableau site
sourceProjectLuid	string	Unique ID of the source project
sourceProjectName	string	Name of the source project
tableLuid	string	Unique identifier

## hist\_move\_workbook The `hist_move_workbook` event is logged when a workbook is moved to a new project.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
destinationProjectLuid	string	Unique ID of the destination project
destinationProjectName	string	Name of the destination project
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
sourceProjectLuid	string	Unique ID of the source project
sourceProjectName	string	Name of the source project
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_pause\_datasource\_extract\_refresh The `hist_pause_datasource_extract_refresh` event is logged when a data source extract refresh is paused.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	Unique identifier
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	Unique ID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	Unique ID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
taskLuid	string	LUID of the associated task
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_pause\_workbook\_extract\_refresh The `hist_pause_workbook_extract_refresh` event is logged when a workbook extract refresh is paused.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
taskLuid	string	LUID of the associated task
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_publish\_data\_role The `hist_publish_data_role` event is logged when a data role is published.

Attribute Name	Type	Description
dataRoleLuid	string	Unique identifier
description	string	Description of the data role
name	string	Name of the data role
ownerLuid	string	Unique ID of the data role owner
ownerName	string	Name of the data role owner
projectLuid	string	Unique ID of the project that contains the data role
projectName	string	Name of the project that contains the data role
siteName	string	Name of the Tableau site

## hist\_publish\_datasource The `hist_publish_datasource` event is logged when a data source is published on the site.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_publish\_flow The `hist_publish_flow` event is logged when a flow is published on the site.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_publish\_view The `hist_publish_view` event is logged when a view is published on the site.

Attribute Name	Type	Description
caption	string	The descriptive phrase constructed for the worksheet based on the workbook definition
description	string	Description of the view
fields	string	A list of fields extracted from the workbook .twb file
firstPublishedAt	string	Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
index	integer	Each view has an index that is unique among views belonging to that workbook
name	string	Name of the view
ownerLuid	string	User LUID of the view owner
ownerName	string	Name of the view owner
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId	string	The ID of the worksheet
sheetType	string	The type of worksheet. Either a story, dashboard, or view.
siteName	string	Name of the Tableau site
title	string	The worksheet title from the workbook .twb file
viewLuid	string	The LUID of the view
workbookLuid	string	The LUID of the workbook containing the view
workbookName	string	Name of the workbook containing the view

## hist\_publish\_workbook The `hist_publish_workbook` event is logged when a workbook is published.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_redeem\_refresh\_token The `hist_redeem_refresh_token` event is logged when a refresh token or personal access token (PAT) is redeemed.

Attribute Name	Type	Description
refreshTokenGuid	string	The unique ID of the refresh token or PAT
siteName	string	Name of the Tableau site

## hist\_refresh\_datasource\_extract The `hist_refresh_datasource_extract` event is logged when a data extract is refreshed.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
details	string	A message string
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
taskLuid	string	LUID of the associated task
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_refresh\_workbook\_extracts The `hist_refresh_workbook_extracts` event is logged when extracts in a workbook are refreshed.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	A message string
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isFailure	boolean	Indicates whether the action failed or not
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
taskLuid	string	LUID of the associated task
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_rekey\_datasource\_extracts The legacy rekey datasource extracts event from historical\_events.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	Unique identifier
description	string	Description of the data source
details	string	A message string
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the data source
ownerLuid	string	Unique ID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	Unique ID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_rekey\_flow\_draft\_extracts The legacy rekey flow draft extracts event from historical\_events.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
details	string	A message string
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
updatedAt	string	Timestamp when the record was last updated

## hist\_rekey\_flow\_extracts The legacy rekey flow extracts event from historical\_events.

Attribute Name	Type	Description
contentVersion	string	Version of the flow file, increments by 1 on each publish.
description	string	Description of the flow
details	string	A message string
flowLuid	string	Unique ID of the flow
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_rekey\_materialized\_views The hist\_rekey\_materialized\_views event logs the successful rekeying of materialized views on a workbook.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	Details of the action (why were the materialized views created or deleted).
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
eventType	string	The type of the event. Either Create, Delete, Encrypt, Decrypt, or Rekey Materialized Views.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_rekey\_site\_extracts\_request The legacy change rekey site extracts request event from historical\_events.

Attribute Name	Type	Description
name	string	Name of the Tableau site
siteEventLuid	string	Unique ID of the site affected by the event
siteName	string	Name of the Tableau site
urlNamespace	string	Used in the construction of URLs that target the site

## hist\_rekey\_workbook\_extracts The legacy rekey workbook extracts event from historical\_events.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	A message string
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isFailure	boolean	Indicates whether the action failed or not
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_rename\_collection The `hist_rename_collection` event is logged when a collection is renamed.

Attribute Name	Type	Description
collectionLuid	string	Unique identifier
description	string	Description of the collection
formerName	string	The former name of the collection
name	string	Name of the collection
ownerLuid	string	Unique ID of the user who owns the collection
ownerName	string	Name of the user who owns the collection
siteName	string	Name of the Tableau site

## hist\_rename\_data\_role The `hist_rename_data_role` event is logged when a data role is renamed.

Attribute Name	Type	Description
dataRoleLuid	string	Unique identifier
description	string	Description of the data role
formerName	string	The former name of the data role
name	string	Name of the data role
ownerLuid	string	Unique ID of the data role owner
ownerName	string	Name of the data role owner
projectLuid	string	Unique ID of the project that contains the data role
projectName	string	Name of the project that contains the data role
siteName	string	Name of the Tableau site

## hist\_rename\_datasource The `hist_rename_datasource` event is logged when a data source is renamed.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
formerName	string	The former name of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_rename\_flow The `hist_rename_flow` event is logged when a flow is renamed.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
formerName	string	The former name of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_rename\_flow\_draft The `hist_rename_flow_draft` event is logged when a flow draft is renamed.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
formerName	string	The former name of the flow draft
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
updatedAt	string	Timestamp when the record was last updated

## hist\_rename\_group The `hist_rename_group` event is logged when a group is renamed.

Attribute Name	Type	Description
formerName	string	The former name of the group
groupLuid	string	Unique ID of the group
name	string	Name of the group
siteName	string	Name of the Tableau site

## hist\_rename\_metric The `hist_rename_metric` event is logged when a metric is renamed. **Note:** Tableau's legacy metrics feature was retired in February 2024. As a result, this event no longer records user interaction with metrics on the site. For more information, see [Set Up for Metrics](https://help.tableau.com/v0.0/online/en-us/metrics_admin.htm).

Attribute Name	Type	Description
customizedViewLuid	string	The view from which the metric queries its data
description	string	Description of the metric
formerName	string	The former name of the metric
metricLuid	string	Unique ID of the metric
name	string	Name of the metric
projectLuid	string	Unique ID of the associated project
projectName	string	Name of the associated project
siteName	string	Name of the Tableau site
suspendState	integer	State of the metric. The value 0 = Not suspended, 1 = Auto-suspended, and 3 = Manually suspended.
viewLuid	string	The view from which the metric queries its data

## hist\_rename\_published\_connection The `hist_rename_published_connection` event is logged when a published connection is renamed.

Attribute Name	Type	Description
activated	boolean	Whether this published connection was ever made available for consumption
description	string	Description of the published connection
formerName	string	The former name of the published connection
name	string	Name of the published connection
ownerLuid	string	Unique ID of the user that owns the published connection
ownerName	string	Name of the user who owns the published connection
projectLuid	string	The associated project
projectName	string	The name of the associated project
publishedConnectionLuid	string	Unique ID of the published connection
siteName	string	Name of the Tableau site

## hist\_rename\_workbook The `hist_rename_workbook` event is logged when a workbook is renamed.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
formerName	string	The former name of the workbook
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_replace\_datasource\_extract The `hist_replace_datasource_extract` event is logged when a data extract is replaced.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
details	string	A message string
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
taskLuid	string	LUID of the associated task
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_revoke\_refresh\_token The `hist_revoke_refresh_token` event is logged when a refresh token or personal access token (PAT) is revoked.

Attribute Name	Type	Description
refreshTokenGuid	string	The unique ID of the refresh token or PAT
siteName	string	Name of the Tableau site

## hist\_run\_flow The `hist_run_flow` event is logged when a flow is run manually.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_run\_flow\_scheduled The `hist_run_flow_scheduled` event is logged when a flow is run from a schedule.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes
taskLuid	string	LUID of the associated task

## hist\_save\_flow The `hist_save_flow` event is logged when a flow is saved.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_save\_flow\_draft The `hist_save_flow_draft` event is logged when a flow draft is saved.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
updatedAt	string	Timestamp when the record was last updated

## hist\_send\_data\_driven\_alert\_email The `hist_send_data_driven_alert_email` event is logged when a data-driven alert email or notification is sent successfully.

Attribute Name	Type	Description
caption	string	The descriptive phrase constructed for the worksheet based on the workbook definition
description	string	Description of the view
fields	string	A list of fields extracted from the workbook .twb file
firstPublishedAt	string	Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
index	integer	Each view has an index that is unique among views belonging to that workbook
name	string	Name of the view
ownerLuid	string	User LUID of the view owner
ownerName	string	Name of the view owner
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId	string	The ID of the worksheet
sheetType	string	The type of worksheet. Either a story, dashboard, or view.
siteName	string	Name of the Tableau site
title	string	The worksheet title from the workbook .twb file
viewLuid	string	The LUID of the view
workbookLuid	string	The LUID of the workbook containing the view
workbookName	string	Name of the workbook containing the view

## hist\_send\_failing\_data\_alert\_email The `hist_send_failing_data_alert_email` event is logged when a data-driven alert email or notification fails.

Attribute Name	Type	Description
caption	string	The descriptive phrase constructed for the worksheet based on the workbook definition
description	string	Description of the view
fields	string	A list of fields extracted from the workbook .twb file
firstPublishedAt	string	Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
index	integer	Each view has an index that is unique among views belonging to that workbook
name	string	Name of the view
ownerLuid	string	User LUID of the view owner
ownerName	string	Name of the view owner
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId	string	The ID of the worksheet
sheetType	string	The type of worksheet. Either a story, dashboard, or view.
siteName	string	Name of the Tableau site
title	string	The worksheet title from the workbook .twb file
viewLuid	string	The LUID of the view
workbookLuid	string	The LUID of the workbook containing the view
workbookName	string	Name of the workbook containing the view

## hist\_send\_refresh\_pre\_pause\_email\_for\_content The `hist_send_refresh_pre_pause_email_for_content` event logs when a refresh pre-pause email is sent.

Attribute Name	Type	Description
contentLuid	string	LUID of the content item for which the refresh pre-pause email was sent
contentName	string	Name of the content item for which the refresh pre-pause email was sent
email	string	Email address of the user
name	string	Name of the user
ownerLuid	string	LUID of the content owner
ownerName	string	Name of the content owner
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_send\_subscription\_email\_for\_view The `hist_send_subscription_email_for_view event` event is logged when a view subscription email is sent successfully.

Attribute Name	Type	Description
caption	string	The descriptive phrase constructed for the worksheet based on the workbook definition
description	string	Description of the view
fields	string	A list of fields extracted from the workbook .twb file
firstPublishedAt	string	Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
index	integer	Each view has an index that is unique among views belonging to that workbook
name	string	Name of the view
ownerLuid	string	User LUID of the view owner
ownerName	string	Name of the view owner
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
scheduleLuid	string	The UUID of the schedule. Used in REST API.
scheduleName	string	Name of the schedule
sheetId	string	The ID of the worksheet
sheetType	string	The type of worksheet. Either a story, dashboard, or view.
siteName	string	Name of the Tableau site
title	string	The worksheet title from the workbook .twb file
viewLuid	string	The LUID of the view
workbookLuid	string	The LUID of the workbook containing the view
workbookName	string	Name of the workbook containing the view

## hist\_send\_subscription\_email\_for\_workbook The `hist_send_subscription_email_for_workbook` event is logged when a workbook subscription email is sent successfully.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
scheduleLuid	string	The UUID of the schedule. Used in REST API.
scheduleName	string	A schedule can be given a name, which is stored here.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_send\_suspended\_data\_alert\_email The `hist_send_suspended_data_alert_email` event is logged when a data-driven alert is suspended.

Attribute Name	Type	Description
caption	string	The descriptive phrase constructed for the worksheet based on the workbook definition
description	string	Description of the view
fields	string	A list of fields extracted from the workbook .twb file
firstPublishedAt	string	Timestamp of when the view was first published. The value won't change when republishing the workbook containing the view.
index	integer	Each view has an index that is unique among views belonging to that workbook
name	string	Name of the view
ownerLuid	string	User LUID of the view owner
ownerName	string	Name of the view owner
repositoryUrl	string	Uniquely identifies a view and is used when referencing the view in a URL. The value is derived from the ASCII characters in the view name.
revision	string	The revision number of the view. Starts with 1.0 and increments by 0.1 each time a new version is published.
sheetId	string	The ID of the worksheet
sheetType	string	The type of worksheet. Either a story, dashboard, or view.
siteName	string	Name of the Tableau site
title	string	The worksheet title from the workbook .twb file
viewLuid	string	The LUID of the view
workbookLuid	string	The LUID of the workbook containing the view
workbookName	string	Name of the workbook containing the view

## hist\_suspend\_site The `hist_suspend_site` event is logged when a site is suspended.

Attribute Name	Type	Description
name	string	Name of the Tableau site
siteEventLuid	string	Unique ID of the site affected by the event
siteName	string	Name of the Tableau site
urlNamespace	string	Used in the construction of URLs that target the site

## hist\_update\_collection The `hist_update_collection` event is logged when a collection is updated.

Attribute Name	Type	Description
collectionLuid	string	Unique identifier
description	string	Description of the collection
name	string	Name of the collection
ownerLuid	string	Unique ID of the user who owns the collection
ownerName	string	Name of the user who owns the collection
siteName	string	Name of the Tableau site

## hist\_update\_column The `hist_update_column` event is logged when a column is updated.

Attribute Name	Type	Description
columnLuid	string	Unique identifier
description	string	Description of the column
name	string	Name of the column
ownerLuid	string	Unique ID of the user who owns the column
ownerName	string	Name of the user who owns the column
projectLuid	string	Unique ID of the project that contains the column
projectName	string	Name of the project that contains the column
siteName	string	Name of the Tableau site

## hist\_update\_data\_quality\_indicator The `hist_update_data_quality_indicator` event is logged when a data quality indicator is updated.

Attribute Name	Type	Description
dataQualityIndicatorLuid	string	Unique identifier
dataQualityType	string	The type of data quality indicator
isActive	boolean	Indicates whether the data quality indicator is active or not
isSevere	boolean	Indicates whether the data quality indicator is severe or not
message	string	Data quality filter message
siteName	string	Name of the Tableau site
userDisplayName	string	Name of user who created or modified the data quality indicator
userLuid	string	Unique ID of the user who created or modified the data quality indicator

## hist\_update\_data\_role The `hist_update_data_role` event is logged when a data role is updated.

Attribute Name	Type	Description
dataRoleLuid	string	Unique identifier
description	string	Description of the data role
name	string	Name of the data role
ownerLuid	string	Unique ID of the data role owner
ownerName	string	Name of the data role owner
projectLuid	string	Unique ID of the project that contains the data role
projectName	string	Name of the project that contains the data role
siteName	string	Name of the Tableau site

## hist\_update\_database The `hist_update_database` event is logged when a database is updated.

Attribute Name	Type	Description
databaseLuid	string	Unique identifier
description	string	Description of the database
name	string	Name of the database
ownerLuid	string	Unique ID of the database owner
ownerName	string	Name of the database owner
projectLuid	string	Unique ID of the project that contains the database
projectName	string	Name of the project that contains the database
siteName	string	Name of the Tableau site

## hist\_update\_datasource The `hist_update_datasource` event is logged when a data source is updated.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_update\_datasource\_task The `hist_update_datasource_task` event is logged when data source related tasks are updated.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_update\_datasource\_trigger The `hist_update_datasource_trigger` event specifies what caused the data source to be updated.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	LUID of the data source
description	string	Description of the data source
isCertified	boolean	Indicates whether the data source is certified
name	string	Name of the data source
ownerLuid	string	User LUID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	LUID of the project containing the data source
projectName	string	Name of the project where the data source was published
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_update\_flow The `hist_update_flow` event is logged when a flow is updated.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_update\_flow\_draft The `hist_update_flow_draft` event is logged when a flow draft is updated.

Attribute Name	Type	Description
createdAt	string	Timestamp when the record was created
flowDraftLuid	string	Unique ID of the flow draft
flowLuid	string	Unique ID of the flow. The value is Null if the flow draft isn't connected to a published flow.
name	string	Name of the flow draft
ownerLuid	string	Unique ID of the flow draft owner. The owner of the flow draft may be different than the flow owner.
ownerName	string	Name of the flow draft owner. The owner of the flow draft may be different than the flow owner.
projectLuid	string	Unique ID of the project that contains the flow draft
projectName	string	Name of the project that contains the flow draft
publishedAt	string	Timestamp when the flow draft was last published
siteName	string	Name of the Tableau site
size	long	Size of the flow draft in bytes
updatedAt	string	Timestamp when the record was last updated

## hist\_update\_flow\_task The `hist_update_flow_task` event is logged when a flow update task is run.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_update\_flow\_trigger The `hist_update_flow_trigger` event specifies what caused the flow to update.

Attribute Name	Type	Description
contentVersion	string	The version of the flow file. Increments by 1 on each publish.
description	string	Description of the flow
flowLuid	string	Unique ID of the flow
name	string	Name of the flow
siteName	string	Name of the Tableau site
size	integer	Size of the flow in bytes

## hist\_update\_linked\_task The `hist_update_linked_task` event is logged when a linked update task is run.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_update\_metric The `hist_update_metric` event is logged when a metric is updated. **Note:** Tableau's legacy metrics feature was retired in February 2024. As a result, this event no longer records user interaction with metrics on the site. For more information, see [Set Up for Metrics](https://help.tableau.com/v0.0/online/en-us/metrics_admin.htm).

Attribute Name	Type	Description
customizedViewLuid	string	The view from which the metric queries its data
description	string	Description of the metric
metricLuid	string	Unique ID of the metric
name	string	Name of the metric
projectLuid	string	Unique ID of the associated project
projectName	string	Name of the associated project
siteName	string	Name of the Tableau site
suspendState	integer	State of the metric. The value 0 = Not suspended, 1 = Auto-suspended, and 3 = Manually suspended.
viewLuid	string	The view from which the metric queries its data

## hist\_update\_project The `hist_update_project` event is logged when a project is updated.

Attribute Name	Type	Description
description	string	Description of the project
name	string	Name of the project
ownerLuid	string	Unique ID of the project owner
ownerName	string	Name of the project owner
parentProjectLuid	string	LUID of the parent project. The value is Null for top-level projects.
projectLuid	string	Unique identifier for the project
siteName	string	Name of the Tableau site
state	string	State of the project. The default value is active. Any other value indicates the project is inactive.

## hist\_update\_schedule The `hist_update_schedule` event is logged when a scheduled is updated.

Attribute Name	Type	Description
active	boolean	Indicates whether the schedule is active or not. If set to False, no tasks will run when the schedule is triggered.
dayOfMonthMask	integer	Indicates which day of the month the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the month correspond to 1st = 1, 2nd = 10, 3rd = 100, 4th = 1000, 5th = 10000, etc.
dayOfWeekMask	integer	Indicates which day of the week the schedule will run. The information is encoded in the given integer. To interpret it, convert the integer to binary. The days of the week correspond to Sunday = 1, Monday = 10, Tuesday = 100, Wednesday = 1000, Thursday = 10000, Friday = 100000, and Saturday = 1000000.
endAtMinute	integer	The minute after the specified schedule_type period begins, indicating when the schedule should stop triggering.
endScheduleAt	string	Timestamp when the schedule should stop triggering
isSerial	boolean	Indicates whether the schedule is run serially or not
minuteInterval	integer	Once triggered, the schedule will repeat at this interval until it ends as per the schedule_type, end_at_minute, or end_schedule_at.
name	string	Name of the schedule
priority	integer	Priority ranges from 1 to 100, with lower values corresponding to a higher priority.
scheduleLuid	string	Unique ID of the schedule
scheduleType	integer	The type of schedule. The value 0 = Hourly, 1 = Daily, 2 = Weekly, and 3 = Monthly.
scheduledAction	integer	Category of the scheduled action. The value 0 = Extracts and 1 = Subscriptions.
siteName	string	Name of the Tableau site
startAtMinute	integer	The minute after the scheduled start time per the schedule_type. For example, in a daily schedule, it's minutes past midnight; for hourly, it's minutes past the hour.

## hist\_update\_site The `hist_update_site` event is logged when a site is updated.

Attribute Name	Type	Description
name	string	Name of the Tableau site
siteEventLuid	string	Unique ID of the site affected by the event
siteName	string	Name of the Tableau site
urlNamespace	string	Used in the construction of URLs that target the site

## hist\_update\_system\_user\_email The `hist_update_system_user_email` event is logged when a system user's email is changed.

Attribute Name	Type	Description
email	string	Email address of the user
formerEmail	string	The former Email address of the user.
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_update\_system\_user\_force\_password\_update The `hist_update_system_user_force_password_update` event logs a successful invocation that forces a password update.

Attribute Name	Type	Description
email	string	Email address of the user
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_update\_system\_user\_image The `hist_update_system_user_image` event is logged when a system user updates their profile image.

Attribute Name	Type	Description
email	string	Email address of the user
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_update\_system\_user\_name The `hist_update_system_user_name` event is logged when a system user updates their name.

Attribute Name	Type	Description
email	string	Email address of the user
formerName	string	The former friendly name of the user.
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_update\_system\_user\_password The `hist_update_system_user_password` event is logged when a system user updates their password.

Attribute Name	Type	Description
email	string	Email address of the user
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_update\_system\_user\_reset\_login\_rate\_limiting The `hist_update_system_user_reset_login_rate_limiting` event logs a successful invocation that resets the login rate limiting values

Attribute Name	Type	Description
email	string	Email address of the user
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_update\_table The `hist_update_table` event is logged when a table is updated.

Attribute Name	Type	Description
description	string	Description of the table
name	string	Name of the table
ownerLuid	string	Unique ID of the table owner
ownerName	string	Name of the table owner
projectLuid	string	Unique ID of the project that contains the table
projectName	string	Name of the project that contains the table
siteName	string	Name of the Tableau site
tableLuid	string	Unique identifier

## hist\_update\_task\_state The `hist_update_task_state` event is logged when the state of a task is changed.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_update\_user\_site\_role The `hist_update_user_site_role` event is logged when a user's site role is changed.

Attribute Name	Type	Description
email	string	Email address of the user
name	string	Name of the user
siteAdminLevel	integer	Indicates if the user is a site admin. The value 5 = Site Admin and 0 = Not a site admin.
siteName	string	Name of the Tableau site
userLuid	string	Unique ID of the user

## hist\_update\_workbook The `hist_update_workbook` event is logged when a workbook is updated.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_update\_workbook\_task The `hist_update_workbook_task` event is logged when a workbook update task is run.

Attribute Name	Type	Description
active	boolean	Indicates whether the task is active or not. If set to False, the task won't run when the schedule is triggered.
consecutiveFailureCount	integer	Number of times the task has failed
creatorLuid	string	User ID of the user who created the task
creatorName	string	Name of the user who created the task
historicalQueueTime	integer	Amount of time the task was queued in seconds. Used to compare the difference in historical queue times.
historicalRunTime	integer	Amount of time running after the task was started in seconds. Used to compare the difference in historical run times.
lastSuccessCompletedAt	string	Timestamp of the last successful task completion
objLuid	string	Unique ID of the object. Used as the primary key in workbook or data source tables.
objName	string	Name of the object. Used with objLuid.
objType	string	The type of object. Either a workbook or data source. Used with objLuid.
priority	integer	Priority of the task, ranging from 10 (default) to 0 (highest). Jobs with higher priority will be processed earlier.
scheduleLuid	string	Unique ID of the associated schedule. Tasks will run at the scheduled start time.
siteName	string	Name of the Tableau site
state	integer	State of the task. The value 0 = Active, 1 = Suspended, and 2 = Disabled.
subtitle	string	Provides additional information about the task
taskLuid	string	The UUID of the task. Used in the REST API.
title	string	Provides additional information about the task
type	string	The type of task. Either an extract, subscription, flow, encryption, or system.

## hist\_upgrade\_datasource\_extract\_storage The legacy upgrade data source extract storage event from historical\_events.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	Unique identifier
description	string	Description of the data source
details	string	A message string
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the data source
ownerLuid	string	Unique ID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	Unique ID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
taskLuid	string	LUID of the associated task
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_upgrade\_datasource\_tde\_extract The legacy upgrade data source tde extract event from historical\_events.

Attribute Name	Type	Description
certificationNote	string	Reason for the certification status of the data source
datasourceLuid	string	Unique identifier
description	string	Description of the data source
details	string	A message string
isCertified	boolean	Indicates whether the data source is certified
isFailure	boolean	Indicates whether the action failed or not
name	string	Name of the data source
ownerLuid	string	Unique ID of the data source owner
ownerName	string	Name of the data source owner
projectLuid	string	Unique ID of the project that contains the data source
projectName	string	Name of the project that contains the data source
remoteQueryAgentName	string	Name of the remote query agent used by the data source
repositoryUrl	string	Uniquely identifies a data source and is used when referencing the data source in a URL. The value is derived from the ASCII characters in the data source name.
revision	string	The revision number of the data source. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the data source in bytes
taskLuid	string	LUID of the associated task
usingRemoteQueryAgent	boolean	Indicates whether the data source uses remote query agent

## hist\_upgrade\_workbook\_extract\_storage The legacy upgrade workbook extract storage event from historical\_events.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	A message string
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isFailure	boolean	Indicates whether the action failed or not
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
taskLuid	string	LUID of the associated task
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## hist\_upgrade\_workbook\_tde\_extract The legacy upgrade workbook tde extract event from historical\_events.

Attribute Name	Type	Description
contentVersion	integer	Version number of the workbook. Increments by 1 on each publish.
dataEngineExtracts	boolean	Indicates if the workbook has associated data engine extracts
defaultViewIndex	integer	Indicates which view will be shown by default
details	string	A message string
displayTabs	boolean	Indicates whether sheets of the workbook are displayed as tabs or not
documentVersion	string	Version number of the document description. The description is entered when saving the workbook.
extractsIncrementedAt	string	Timestamp when the last incremental extract refresh occurred
extractsRefreshedAt	string	Timestamp when the last extract refresh occurred
firstPublishedAt	string	Timestamp when the workbook was first published. The value won't change when republishing the workbook containing the view.
incrementableExtracts	boolean	Indicates whether it's possible to perform an incremental extract refresh
isFailure	boolean	Indicates whether the action failed or not
isPrivate	boolean	Indicates whether the workbook is private or not. The value True = Private and Null or False = Not private.
lastPublishedAt	string	Timestamp when the workbook was last published or saved while web authoring. For workbooks last published before this column existed, the value will be Null.
modifiedByUserLuid	string	The user who last modified and published the workbook or saved the workbook while web authoring. For workbooks that were last published before this column existed, the value will be the same as owner_id.
name	string	Name of the workbook
ownerLuid	string	Unique ID of the workbook owner. Used as a foreign key.
ownerName	string	Name of the user who owns the workbook
projectLuid	string	Unique ID of the project that contains the workbook. Used as a foreign key.
projectName	string	Name of the project that contains the workbook
publishedAllSheets	boolean	Indicates whether all sheets in the workbook were published. The value True = All sheets published and False = One or more sheets weren't published.
refreshableExtracts	boolean	Indicates whether extracts in the workbook can be refreshed
repositoryUrl	string	Uniquely identifies a workbook and is used when referencing the workbook in a URL. The value is derived from the ASCII characters in the workbook name.
revision	string	The revision number. Starts with 1.0 and increments by 0.1 each time a new version is published.
siteName	string	Name of the Tableau site
size	integer	Size of the workbook in bytes
taskLuid	string	LUID of the associated task
thumbUserLuid	string	Unique ID of the user for generating the thumbnail image. Null unless specified.
viewCount	integer	Counts the number of views associated with the workbook
workbookLuid	string	Unique ID of the workbook

## login\_authentication The `login_authentication` event logs authentication events (including default, SAML, OIDC, and Tableau with MFA). **Note:** Unsuccessful login attempts are typically recorded by your authentication provider before reaching Tableau. To investigate them, check your provider's logs.

Attribute Name	Type	Description
acceptLanguage	string	The browser `Accept-Language` request HTTP header
logRecordType	string	The record type associated with the event, either verification or authentication.
loginKey	string	Unique login tracking value. Used to associate user activity with the authentication event.
loginType	string	The authentication type used to log in, either DEFAULT, SAML, OIDC, or TABID_WITH_MFA.
loginUrl	string	URL to which the user sent the login request, including the protocol, hostname, and, if applicable, the site path prefix.
reason	string	The failure reason if login is unsuccessful
sourceIp	string	Source IP of the login request. Uses XFF or webRTC to identify the originating IP address of the client.
status	string	The authentication result, either success or failure.
tenantId	string	The ID of the tenant or organization
timestamp	string	Timestamp of the event
userAgent	string	Name of the agent or browser that initiated login
userId	string	The ID of the user
userType	string	The type of user accessing Tableau, either through the user interface or API.
username	string	Username used for login
uuid	string	Unique ID for the request

## login\_with\_jwt The `login_with_jwt` event occurs when a user signs in with a JSON Web Token (JWT). When auditing this event, use the `type` attribute to distinguish between Unified Access Token JWT and Connected App sign in attempts.

Attribute Name	Type	Description
actorExternalId	string	The external ID for the acting user. This is an opaque identifier dependent on the actor type, but could, for example, be a user email.
configId	string	JWT configuration ID used for authentication
expiresAt	string	JWT expiration time (exp) claim value
issuedAt	string	JWT issued at time (iat) claim value
jti	string	JWT ID claim. Used to track and audit tokens.
jwtIssuer	string	JWT issuer (iss) claim
scope	string	JWT scope claim used for authorization
sessionId	string	ID of the session created after a successful JWT login. Used to trace additional events related to the initial login.
siteName	string	Name of the site where the JWT login occurred
sourceIp	string	IP address of the client that initiated the JWT login
type	string	Type of JWT used for the login. Either `UAT JWT` for Unified Access Token JWTs or `Connected Apps` for JWTs validated against a Tableau connected app configuration.
userAgent	string	Name of the agent or browser that initiated the JWT login

## login\_verification The `login_verification` event logs MFA verification events for the Tableau with MFA authentication type.

Attribute Name	Type	Description
acceptLanguage	string	The browser `Accept-Language` request HTTP header
flow	string	The user workflow that required verification, such as login, ssh, or permission changes.
logRecordType	string	The record type associated with the event, either verification or authentication.
loginKey	string	Unique login tracking value. Used to associate user activity with the verification event.
reason	string	The reason for success or failure, such as User approved, No response, or Invalid passcode.
sourceIp	string	The IP address of the authentication device. Uses XFF or webRTC to identify the originating IP address of the client.
status	string	The verification result, either success or failure.
tenantId	string	The ID of the tenant or organization
timestamp	string	Timestamp of the event
userAgent	string	Name of the agent or browser that initiated login
userId	string	The ID of the user
userType	string	The type of user accessing Tableau, either through the user interface or API.
username	string	Username used for login
uuid	string	Unique ID for the request
verificationMethod	string	The verification method used, such as an authenticator app, security key, or built-in authenticator.

## metric\_subscription\_change The `metric_subscription_change` event is logged when a user adds or removes a subscription to a Pulse metric.

Attribute Name	Type	Description
actorGroupLuid	string	Group LUID of the group that followed or unfollowed the metric. If a user changes the scoped metric, the `actorGroupLuid` value will be empty, and `actorUserLuid` will be populated instead.
scopedMetricId	string	The ID of the scoped metric that had a subscription change
subscriptionOperation	string	Subscription operation, such as 'metric followed' or 'metric unfollowed'

## move\_content The `move_content` event is logged when content is moved, for example, moving a workbook between projects.

Attribute Name	Type	Description
contentId	integer	The ID of the content that had the owner changed
contentLuid	string	LUID of the content that had the owner changed
contentName	string	Name of the content that had the owner changed
contentType	string	The type of content, such as data source, workbook, or view
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
newContainerLuid	string	LUID of the new container
newContainerType	string	The new container type, such as a project
oldContainerLuid	string	LUID of the previous container
oldContainerType	string	The previous container type, such as a project

## oauth\_settings\_change The `oauth_settings_change` event occurs when the OAuth Clients Registry setting is updated on the General tab.

Attribute Name	Type	Description
clientId	string	Client ID registered with the data provider
connectionType	string	The type of connection
errorCode	string	Error code generated when altering OAuth settings
openAuthInstanceUrl	string	OAuth instance URL
openAuthProvider	string	OAuth provider
operationType	string	The type of operation, either create or delete.
platform	string	The platform where changes are recorded, such as Tableau Cloud.
platformVersion	string	The version of the platform, such as 2024.3.0.
uploadedFile	string	Name of the file uploaded to change OAuth settings

## platform\_configuration\_change The `platform_configuration_change` event occurs when the outbound connection allowlist for Tableau Prep endpoints is updated.

Attribute Name	Type	Description
errorCode	string	Error code generated when altering Tableau Prep settings
newSettingValue	string	A structured JSON string describing the new value of allowlist endpoints
platform	string	The platform where changes are recorded, such as Tableau Cloud.
platformVersion	string	The version of the platform, such as 2024.3.0.
previousSettingValue	string	A structured JSON string describing the previous value of allowlist endpoints
settingIdentifier	string	The setting identifier for the feature, such `prep_endpoint_control`.
siteName	string	Name of site where the operation occurred
userAgent	string	The client software used by the `actorUser` to make the change

## platform\_settings\_change The `platform_settings_change` event occurs when security and access configurations are changed on the Settings page.

Attribute Name	Type	Description
errorCode	string	Error code generated when altering the configuration setting
ipAddress	string	The IP address of the machine that initiated the request
isSecretUpdated	bool	Indicates whether the secret has been updated. The actual secret value isn't recorded. This attribute helps admins track changes in their organization, such as those affecting system functionality or ensuring scheduled secret rotations are carried out properly.
newSettingsValue	string	New settings value
oldSettingsValue	string	Previous settings value
platform	string	The platform where changes are recorded, such as Tableau Cloud.
platformVersion	string	The version of the platform, such as 2024.3.0.
settingDescription	string	Description of the setting that is being affected
settingIdentifier	string	The setting identifier for this feature, such as `prep_endpoint_control`.
siteName	string	Name of site where the operation occurred
tenantName	string	Name of the tenant where the operation occurred
userAgent	string	The client software used by the `actorUser` to make the change

## prep\_flowruns The `prep_flowruns` event occurs when flow runs from the Tableau Flow Processor are recorded.

Attribute Name	Type	Description
connectionEndpoints	string	The list of input and output endpoints in a Tableau Prep flow run
errorCode	string	Error code generated when altering Tableau Prep settings
flowId	string	The ID of the Tableau Prep flow
flowName	string	The name of the Tableau Prep flow
flowOwnerId	integer	The ID of the user who authored the flow
flowRunLuid	string	The LUID of the Tableau Prep flow run
platform	string	The platform where changes are recorded, such as Tableau Cloud.
platformVersion	string	The version of the platform, such as 2024.3.0.
userName	string	The user name of the user

## project\_lock\_unlock The `project_lock_unlock` event is logged when project permissions are locked or unlocked.

Attribute Name	Type	Description
controllingProjectLuid	string	LUID of the project that controls permissions for the nested project
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
projectLuid	string	LUID of the project
projectOperation	string	Project operation, either lock or unlock

## restore\_content The `restore_content` event occurs when content is restored from the recycle bin.

Attribute Name	Type	Description
contentId	integer	The ID of the restored content
contentLuid	string	The LUID of the restored content
contentName	string	The name of the restored content
contentType	string	The type of content archived
isError	bool	Indicates if the audit scenario was completed successfully or failed with an error

## set\_permissions The `set_permissions` event is logged when a permission rule is created or updated for a content item, typically when you save changes in the Permissions dialog. Removing a permission rule is also logged as this event, with a `permissionType` of `unspecified`.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as project or workbook
capabilityId	integer	The ID of the capability. A capability is the ability to perform a certain action on a particular piece of content, such as view, filter, download or delete.
capabilityValue	string	Description of the capability
contentId	integer	The ID of the content that had the permissions set
contentLuid	string	The LUID of the content item
contentName	string	The name of the content that had the permissions set
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The `granteeId` attribute is always present.
granteeType	string	The type of grantee, either user or group
granteeValue	string	The set permissions value, such as 'user allow' or 'group allow'
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
permissionType	string	The permission type. A value of `explicit` means an Allow or Deny rule was set. A value of `unspecified` means a rule was removed or set to inherited.

## site\_storage\_usage The `site_storage_usage` event logs the total storage capacity of the site in bytes, the amount of storage used, and the percentage of the total consumed. Administrators can use this data to proactively monitor storage consumption and take action before reaching the site's storage limit. **Note:** Only partial data for this event type is available through the API. To see the full event logs, configure Activity Log to send log data to your Amazon S3 bucket for analysis. For more information, see [Set Up Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_setup.htm).

Attribute Name	Type	Description
actorUsername	string	Username of the user who performed the action that initiated the event
initiatingUsername	string	Username of the initiating user
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
totalPercentageStorageQuotaUsed	float	Total percentage of storage usage
totalStorageQuotaLimit	long	Total storage capacity in bytes
totalStorageQuotaUsed	long	Total storage used in bytes

## tabgpt\_registration\_event The `tabgpt_registration_event` records Tableau Agent settings changes.

Attribute Name	Type	Description
domain	string	Domain of the Salesforce org
errorCode	string	Error code generated when altering Tableau Agent settings
instanceName	string	Instance name of the Salesforce org
operationType	string	Type of operation, either create or delete.
orgId	string	Salesforce Organization ID for the registration
platform	string	Platform where changes are recorded, such as Tableau Cloud.
platformVersion	string	Version of the platform, such as 2025.1.0.
pod	string	Name of the Tableau pod where the action is performed, such as 10ay.
siteName	string	Name of the site where the operation occurred
username	string	Username of the user in the Salesforce org

## update\_permissions The `update_permissions` event is logged when an explicit permission rule is updated for a content item. **Note:** Deprecated in October 2024. Use the [set\_permissions](#set-permissions) event instead.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as a project or workbook
capabilityId	integer	The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue	string	Description of the capability
contentId	integer	The ID of the content that had the permissions updated
contentLuid	string	The LUID of the content
contentName	string	The name of the content that had the permissions updated
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee
granteeType	string	The type of grantee, either user or group
granteeValue	string	The updated permissions value, such as 'user allow' or 'group allow'
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
permissionType	string	The permission type, either explicit or unspecified

## update\_permissions\_template The `update_permissions_template` event is logged when a permission template for a project is updated.

Attribute Name	Type	Description
authorizableType	string	The type of content that had its permissions changed, such as a project or workbook
capabilityId	integer	The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download, or delete
capabilityValue	string	Description of the capability
contentId	integer	The ID of the content that had the permissions updated
contentLuid	string	The LUID of the content
contentName	string	The name of the content that had the permissions updated
granteeId	integer	The ID of the grantee
granteeLuid	string	The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The `granteeId` attribute is always present.
granteeType	string	The type of grantee, either user or group
granteeValue	string	The updated permissions value, such as 'user allow' or 'group allow'
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
permissionType	string	The permission type. A value of `explicit` means an Allow or Deny rule was set. A value of `unspecified` means a rule was removed or set to inherited.
templateType	string	The type of permission template used to change permissions, such as workbook or data source

## user\_create\_delete The `user_create_delete` event is logged when a user is created or deleted.

Attribute Name	Type	Description
forUserName	string	The name of the user whose account was either created, updated or deleted
isError	boolean	Indicates if the audit scenario was completed successfully or failed with an error
siteRole	string	Site role of the user. Determines the maximum level of access a user can have on the site
targetUserId	integer	The ID of the user whose account was either created, updated, or deleted
targetUserLuid	string	The LUID of the user whose account was either created, updated, or deleted
userOperation	string	The action performed on a user, either create, delete, or site role change

## vizql\_http\_request The `vizql_http_request` event, also called View Interaction Events, records how users interact with published content. This event is useful for monitoring dashboard performance, improving data security, and analyzing user engagement. For more information, see [Monitor Data Exports Using the Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_monitor_data_exports.htm) and [Monitor View Load Times Using the Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_monitor_view_load_times.htm). **Note:** Only partial data for this event type is available through the API. To see the full event logs, configure Activity Log to send log data to your Amazon S3 bucket for analysis. For more information, see [Set Up Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_setup.htm).

Attribute Name	Type	Description
duration	long	Amount of time taken to handle the request, in milliseconds.
endpointName	string	The name of the called endpoint
ipAddress	string	IP address of the client machine or VPN that initiated the request
method	string	The request method used, such as GET, POST, PUT, or DELETE.
referrer	string	HTTP referrer, or source of the request.
requestId	string	The request ID
requestUri	string	The requested URI for the HTTP request
sessionId	string	New ID of the session key. Omitted if the creation attempt failed.
siteName	string	Name of the site where the operation occurred
siteUri	string	URI token of the site where the operation occurred
userAgent	string	The client software that initiated the request, such as the application, operating system, or version.
viewLuid	string	The LUID of the view
viewName	string	The name of the view
viewRepoUrl	string	The repository URL of the view
vizqlSessionId	string	The VizQL session ID
workbookLuid	string	The LUID of the workbook
workbookName	string	The name of the workbook
workbookRevision	integer	The revision number of the workbook. Starts with 1.0 and increments by 0.1 each time a new version is published.

[Skip to main content](#main-content) # Activity Log Tenant Event Type Reference This topic describes the Activity Log tenant event types and attributes. For information about site events, see [Activity Log Site Event Type Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_schema.htm). ## Event type details The following content describes tenant event types and attributes in Activity Log. Use the alphabetically sorted list of event types on the right, or **ctrl/cmd-f** to go directly to keywords you have in mind. **Note:** Timestamps for events are recorded in ISO 8601 UTC. ## Common attributes The table contains common attributes for all Activity Log tenant events. For event-specific attributes, review the individual event tables in this topic.

Attribute Name	Type	Description
eventId	string	Unique identifier for the event
eventOutcome	string	Represents the final outcome of the operation. Possible values are: success: The attempted operation completed successfully. unauthorized: The initiating user wasn't authorized to perform the operation. client_error: The operation failed due to a cause attributable to the client/caller. For example, invalid API request parameters, client connection timeout, or throttling. internal_error: The operation failed due to an unexpected internal error.
eventOutcomeReason	string	Provides additional details about the event outcome
eventProcessedTime	string	Timestamp of when the event was available in Activity Log. To see the timestamp for when the event occurred, use the `eventTime` attribute.
eventTime	string	Timestamp when the event occurred
eventType	string	Type of the event
eventVersion	string	Schema version of the event
initiatingSessionId	string	ID of user's session which initiated the operation
initiatingUrl	string	URL associated with the request that initiated the operation, such as the URL of a REST API endpoint that was invoked.
initiatingUserAgent	string	User-Agent HTTP header associated with the request that initiated the operation
initiatingUserDisplayName	string	Display name of the user who initiated the operation
initiatingUserEmail	string	Email address of the user who initiated the operation
initiatingUserId	string	ID of the user who initiated the operation
initiatingUserIpAddress	string	Remote client IP address of the request that initiated the operation. Either a valid IPv4 or IPv6 address.
initiatingUserRole	string	Role or privilege level that allowed the initiating user to perform the operation
podUri	string	Uniform Resource Identifier (URI) of pod where the operation occurred
siteId	string	ID of site where the operation occurred
siteName	string	Name of site where the operation occurred
siteUri	string	Uniform Resource Identifier (URI) of site where the operation occurred
tenantId	string	ID of tenant where the operation occurred
tenantName	string	Name of tenant where the operation occurred
tenantUri	string	Uniform Resource Identifier (URI) of tenant where the operation occurred
traceUuid	string	Auto-generated UUID identical across all the events in a batch, such as multiple permissions changed by a single user action.

## batch\_revoke\_personal\_access\_token The `batch_revoke_personal_access_token` event occurs when a tenant is suspended or deleted, or a user is removed.

Attribute Name	Type	Description
patUserId	string	ID of the user whose PATs were revoked. Not included if PATs were revoked for the entire tenant.

## batch\_revoke\_session The `batch_revoke_sessions` event occurs when all sessions associated with a tenant or user are revoked.

Attribute Name	Type	Description
sessionUserId	string	ID of the user whose sessions were revoked. Not included if sessions were revoked for the entire tenant.

## create\_or\_update\_oidc\_config The `create_or_update_oidc_config` event occurs when the OIDC configuration is changed.

Attribute Name	Type	Description
isSecretUpdated	bool	Indicates whether the secret has been updated. The actual secret value isn't recorded. This attribute helps admins track changes in their organization, such as those affecting system functionality or ensuring scheduled secret rotations are carried out properly.
newSettingsValue	string	New OIDC configuration settings
oldSettingsValue	string	Previous OIDC configuration settings
resourceId	string	Resource ID of an OIDC configuration

## create\_or\_update\_saml\_config The `create_or_update_saml_config` event occurs when the SAML configuration is changed.

Attribute Name	Type	Description
newSettingsValue	string	New SAML configuration settings
oldSettingsValue	string	Previous SAML configuration settings
resourceId	string	Resource ID of a SAML configuration

## create\_or\_update\_uat\_configuration The `create_or_update_uat_configuration` event occurs when changes are made to Unified Access Token (UAT) JSON Web Token (JWT) configuration. This event is used to track changes for security compliance and troubleshooting.

Attribute Name	Type	Description
configId	string	Unique identifier (UUID) of the UAT JWT configuration
isSecretUpdated	bool	Indicates whether the secret has been updated. The actual secret value isn't recorded. This attribute helps admins track changes to public key or jwks_uri values.
issuer	string	JWT issuer claim value. Used to identify the IdP affected by the configuration change.
newSettingsValue	string	New UAT JWT configuration settings. The values are JSON serialized and exclude sensitive keys, such as publicKey and publicKeyActive.
oldSettingsValue	string	Previous UAT JWT configuration settings. The values are JSON serialized and exclude sensitive keys, such as publicKey and publicKeyActive.

## create\_personal\_access\_token The `create_personal_access_token` event occurs when a personal access token (PAT) is generated.

Attribute Name	Type	Description
expiresAt	string	Timestamp when the PAT expires. Not included if the creation attempt failed.
tokenId	string	ID of the PAT created. Not included if the creation attempt failed.
tokenName	string	Name of the PAT

## create\_private\_connection The `create_private_connection` event occurs when a private connection is created.

Attribute Name	Type	Description
description	string	Description of the private connection
endpointServiceName	string	AWS endpoint service name of the private connection
name	string	Name of the private connection
privateConnectionId	string	ID of the created private connection
region	string	AWS region where the private connection is created

## create\_site The `create_site` event occurs when a site is created in a tenant.

Attribute Name	Type	Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

## create\_tenant The `create_tenant` event occurs when a tenant is created.

Attribute Name	Type	Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

## create\_user The `create_user` event occurs when a new user is created in a tenant.

Attribute Name	Type	Description
email	string	Email of the user added to the tenant
language	string	Language code of the user added to the tenant
locale	string	Locale code of the user added to the tenant
userId	string	Unique identifier of the user added to the tenant
userName	string	User name of the user added to the tenant

## create\_uat\_revocation The `create_uat_revocation` event occurs when a JSON Web Token (JWT) is added to the blocked list. This event is used to track changes for security compliance and access control.

Attribute Name	Type	Description
revokedJwtRecords	string	JSON array of JWT records added to the blocked list. Each record contains 'jti' (JWT ID) and 'exp' (expiration timestamp in Unix epoch seconds).

## delete\_oidc\_config The `delete_oidc_config` event occurs when the OIDC configuration is deleted.

Attribute Name	Type	Description
idpConfigurationId	string	ID of the IdP configuration
idpConfigurationName	string	Name of the IdP configuration
resourceId	string	Resource ID of the OIDC configuration

## delete\_private\_connection The `delete_private_connection` event occurs when a private connection is deleted in a tenant.

Attribute Name	Type	Description
privateConnectionId	string	ID of the deleted private connection

## delete\_saml\_config The `delete_saml_config` event occurs when the SAML configuration is deleted.

Attribute Name	Type	Description
idpConfigurationId	string	ID of the IdP configuration
idpConfigurationName	string	Name of the IdP configuration
resourceId	string	Resource ID of the SAML configuration

## delete\_site The `delete_site` event occurs when a site is deleted from a tenant.

Attribute Name	Type	Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

## delete\_tenant The `delete_tenant` event occurs when a tenant is deleted.

Attribute Name	Type	Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

## delete\_user The `delete_user` event occurs when a user is deleted from a tenant.

Attribute Name	Type	Description
email	string	Email of the user removed
userId	string	ID of the user removed
userName	string	User name of the user removed

## delete\_uat\_configuration The `delete_uat_configuration` event occurs when a JSON Web Token (JWT) configuration is removed for an identity provider (IdP). This event is used to track changes for security compliance and access monitoring.

Attribute Name	Type	Description
configId	string	Unique identifier (UUID) of the deleted UAT JWT configuration
issuer	string	JWT issuer claim value of the deleted configuration. Used to identify the affected IdP.

## delete\_uat\_revocation The `delete_uat_revocation` event occurs when a JSON Web Token (JWT) is deleted from the blocked list.

Attribute Name	Type	Description
jti	string	JWT ID deleted from the blocked list

## get\_sites The `get_sites` event occurs when a list of sites under a tenant is requested.

Attribute Name	Type	Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

## get\_users The `get_user` event occurs when a list of users within a tenant or site is requested.

Attribute Name	Type	Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

## jwt\_login The `jwt_login` event occurs when signing in to Tableau Cloud Manager (TCM) using a JSON Web Token (JWT).

Attribute Name	Type	Description
jti	string	JWT ID claim. Used to track the token when signing in to TCM.
jwtType	string	Type of JWT used for the login request
newSessionId	string	ID of the session created by the login request. This attribute isn't included for failed login attempts.

## list\_personal\_access\_tokens The `list_personal_access_tokens` event occurs when all valid personal access tokens (PATs) in Tableau Cloud Manager (TCM) are requested.

Attribute Name	Type	Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

## merge\_tenant The `merge_tenant` event occurs when a Tableau Cloud Manager tenant is merged into another tenant. This consolidation allows cloud admins to manage all sites under one tenant and benefit from unified governance.

Attribute Name	Type	Description
sourceTenantId	string	ID of source tenant in the merge operation
sourceTenantName	string	Name of the source tenant in the merge operation
sourceTenantUri	string	Uniform Resource Identifier (URI) of the source tenant in the merge operation

## migrate\_site The `migrate_site` event occurs when a site is migrated to a tenant.

Attribute Name	Type	Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

## personal\_access\_token\_login The `personal_access_token_login` event occurs when a personal access token (PAT) is used to sign in to Tableau Cloud Manager.

Attribute Name	Type	Description
newSessionId	string	ID of the session created by this login request. Not included if the login failed.
tokenId	string	ID of the PAT used to login
tokenName	string	Name of the PAT

## reactivate\_site The `reactivate_site` event occurs when a site in a tenant is reactivated.

Attribute Name	Type	Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

## revoke\_personal\_access\_token The `revoke_personal_access_token` event occurs when a personal access token (PAT) is revoked in Tableau Cloud Manager.

Attribute Name	Type	Description
tokenId	string	ID of the PAT revoked
tokenName	string	Name of the PAT

## revoke\_session The `revoke_session` event occurs when a user is logged out due to a revoked session, such as a user explicitly logging out or the session expiring.

Attribute Name	Type	Description
This event only uses common attributes. For more information, see the Common attributes section in this topic.

## site\_capacity\_change The `site_capacity_change` event occurs when the capacity allocation for a specific site is changed. Each event applies to a single capacity type. Changing multiple capacities produces a separate event for each.

Attribute Name	Type	Description
capacityName	string	Canonical name of the capacity type that was changed
newCapacityAmount	integer	New capacity amount allocated to the site
oldCapacityAmount	integer	Previous capacity amount allocated to the site

## site\_capacity\_default\_change The `site_capacity_default_change` event occurs when the default site capacity allocation is changed at the tenant level. The default applies to new sites added to the tenant and doesn't change existing sites. Because the change sets the tenant default rather than modifying a specific site, the `siteId`, `siteName`, and `siteUri` attributes are null.

Attribute Name	Type	Description
capacityName	string	Canonical name of the capacity type that was changed
newCapacityAmount	integer	New default capacity amount
oldCapacityAmount	integer	Previous default capacity amount

## site\_limits\_change The `site_limits_change` event occurs when site-level license capacity limits for site roles (Creator, Explorer, or Viewer) are changed.

Attribute Name	Type	Description
newCreatorCapacity	integer	New value for the Creator site role limit. Not included if the new limit is the default cloud limit.
newCreatorCapacityIsDefaultCloudLimit	bool	New Creator limit was set to the default cloud limit
newExplorerCapacity	integer	New value for the Explorer site role limit. Not included if the new limit is the default cloud limit.
newExplorerCapacityIsDefaultCloudLimit	bool	New Explorer limit is set to the default cloud limit
newViewerCapacity	integer	New value for the Viewer site role limit. Not included if the new limit is the default cloud limit.
newViewerCapacityIsDefaultCloudLimit	bool	New Viewer limit is set to the default cloud limit
oldCreatorCapacity	integer	Previous value for the Creator site role limit. Not included if the previous limit was the default cloud limit.
oldCreatorCapacityIsDefaultCloudLimit	bool	Previous Creator limit was set to the default cloud limit
oldExplorerCapacity	integer	Previous value for the Explorer site role limit. Not included if the previous limit was the default cloud limit.
oldExplorerCapacityIsDefaultCloudLimit	bool	Previous Explorer limit was set to the default cloud limit
oldViewerCapacity	integer	Previous value for the Viewer site role limit. Not included if the previous limit was the default cloud limit.
oldViewerCapacityIsDefaultCloudLimit	bool	Previous Viewer limit was set to the default cloud limit

## suspend\_site The `suspend_site` event occurs when a site in a tenant is suspended.

Attribute Name	Type	Description
suspensionSource	string	Source for the site suspension

## tcm\_activity\_log\_access The `tcm_activity_log_access` event occurs when Tableau Cloud Manager (TCM) Activity Log data is accessed.

Attribute Name	Type	Description
eventProcessedTimeEnd	string	End time (based on the events' processed timestamp) of the data accessed. If not included, assume all available data was accessed.
eventProcessedTimeStart	string	Start time (based on the events' processed timestamp) of the data accessed. If not included, assume all available data was accessed.
eventTypeAccessed	string	Type of events accessed. If not included, assume all available data was accessed.

## track\_private\_connection\_usage The `track_private_connection_usage` event monitors private connection usage in a tenant, logging data every hour.

Attribute Name	Type	Description
endpointId	string	The virtual private cloud (VPC) endpoint ID of the private connection
endpointServiceName	string	AWS endpoint service name of the private connection
endpointServiceRegion	string	AWS endpoint service region of the private connection
usageQuantity	long	The amount of data transferred through a private connection, in bytes. This value reflects usage for the hour before the log entry.

## update\_personal\_access\_token The `update_personal_access_token` event occurs when a personal access token (PAT) is updated.

Attribute Name	Type	Description
expiresAt	string	Timestamp when the PAT expires
tokenId	string	ID of the PAT created. Not included if the creation attempt failed.
tokenName	string	Name of the PAT

## update\_private\_connection The `update_private_connection` event occurs when a private connection is updated.

Attribute Name	Type	Description
newDescription	string	New description of the private connection
newSiteIds	string	Comma-separated list of new private connection site IDs.
oldDescription	string	Previous description of the private connection
oldSiteIds	string	Comma-separated list of previous private connection site IDs.
privateConnectionId	string	ID of the updated private connection

## update\_session The `update_session` event occurs when the expiration time of a session is updated.

Attribute Name	Type	Description
expiresAt	string	New expiration time of the session

## update\_tenant The `update_tenant` event occurs when the tenant name or status is updated.

Attribute Name	Type	Description
newStatus	string	Tenant status after the update
newTenantName	string	Tenant name after the update
newTenantOrg62Id	string	Tenant Org62 ID after the update
newTenantUri	string	Tenant Uniform Resource Identifier (URI) after the update
oldStatus	string	Tenant status before the update
oldTenantOrg62Id	string	Tenant Org62 ID before the update

## update\_user The `update_user` event occurs when an existing user in the tenant is updated.

Attribute Name	Type	Description
newEmail	string	New email of the user
newLanguage	string	New language code of the user
newLocale	string	New locale code of the user
oldEmail	string	Previous email of the user
oldLanguage	string	Previous language code of the user
oldLocale	string	Previous locale code of the user
userId	string	Unique ID of the user added
userName	string	User name of the user added to the tenant

## update\_user\_site\_role The `update_user_site_role` event occurs when a user's access to a site is updated, either by adding, changing, or removing their site role.

Attribute Name	Type	Description
email	string	Email of the user added to the tenant
newIdp	string	New authentication method assigned to the site user, or null if the user is being removed from the site.
newRole	string	New role of the user on the site, or null if the user is being removed from the site.
oldIdp	string	Previous authentication method assigned to the site user, or null if the user didn't previously have a role on the site.
oldRole	string	Previous role of the user on the site, or null if the user didn't previously have a role on the site.
userId	string	The unique identifier of the user
userName	string	User name of the user added to the site

## update\_user\_tenant\_role The `update_user_tenant_role` event occurs when a user's access to a tenant is updated by adding, changing, or removing the cloud administrator role.

Attribute Name	Type	Description
email	string	Email of the user added to the tenant
newIdp	string	New authentication method assigned to the tenant user, or null if the user is being removed from the tenant.
newRole	string	New role of the user on the tenant, or null if the user is being removed from the tenant.
oldIdp	string	Previous authentication method assigned to the tenant user, or null if the user didn't previously have a role on the tenant.
oldRole	string	Previous role of the user on the tenant, or null if the user didn't previously have a role on the tenant.
userId	string	The unique identifier of the user
userName	string	User name of the user added to the tenant

## user\_login\_create\_session The `user_login_create_session` event occurs when a user signs in to Tableau Cloud Manager (TCM) through the sign-in page or other interactive login.

Attribute Name	Type	Description
expiresAt	string	Timestamp when the session expires. Not included if the creation attempt failed.
idpId	string	ID of the IdP, indicating how the user is authenticated.
idpName	string	Name of the IdP, indicating how the user is authenticated.
newSessionId	string	New ID of the session key. Not included if the creation attempt failed.

## validate\_uat\_jwt The `validate_uat_jwt` event occurs when validating a JSON Web Token (JWT).

Attribute Name	Type	Description
configId	string	JWT configuration ID used for validation
jti	string	JWT ID claim. Used to track the token when signing in.
jwtIssuer	string	JWT issuer (iss) claim
resourceId	string	ID of the resource passed to the validation endpoint. Either tenantId or siteId.
scope	string	JWT scope claim used for authorization
tokenExpirationTime	string	JWT expiration time (exp) claim value
username	string	Username included in the JWT

[Skip to main content](#main-content) # Add a Pop-Up Tableau Data Story to Your Dashboard **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). You can place a Tableau Data Story in a pop-up window that allows your users to open a story, read it, and then close it when they're done. This is a great way to save space being used by already-established dashboards or to reduce the amount of clutter and information on a dashboard. 1. [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm). 2. Set the container to Floating by clicking the menu and selecting Floating. > [!TIP] > > Another way to set the container to Floating is by holding the shift key while dragging the container onto your dashboard. 1. Navigate to the Layout tab in the left-hand column and set the background color to white. ![The Layout pane with the background set to 100% and white.](/tableau/next/en-us/online/en-us/Img/data_stories_white_background.png) 1. Click the menu that is associated with your floating container to show its settings, and select Add Show/Hide Button. This creates an "X" icon that allows you to show or hide your story. ![A Data Story with a large X icon that allows users to hide the story.](/tableau/next/en-us/online/en-us/Img/data_stories_x.png) **Note:** If your story is selected, then your button is partially obscured by the sidebar options that are part of the Data Story object. Click anywhere outside of the story to reveal the button. 1. Hover over the "X" icon to show instructions for opening or closing the story. In this example, you're being prompted to press the Alt key at the same time you click the "X" icon. ![A Data Story object with a large X icon that allows users to hide the story and a tooltip that reads “Hide ‘Data Story’ (Alt+click to hide)](/tableau/next/en-us/online/en-us/Img/data_stories_hide_story.png) 1. Collapse the story by clicking the "X" icon at the same time as pressing the key indicated in your prompt. The story collapses, but the menu remains on the dashboard so that the user can expand the story when needed. You can move your collapsible, floating story around your dashboard as desired. [Skip to main content](#main-content) # Add a Project Image To help distinguish projects you manage on Tableau Cloud (and help your users find them), you can add an image that appears in the thumbnail. Your image must meet the following requirements: - The image must be accessible using HTTPS protocol. Shared network directory and related protocols (UNC, SMB, AFP, NFS, etc) are not supported. HTTP protocol for project images is not supported by Google Chrome. - All users who access the project must have, at a minimum, "read-only" permission on the target image. - The image must be common internet format: .jpg, png, or gif. ![Custom Explore page with projects sorted into IT, Development, Customer Solutions, and Statistics.](/tableau/next/en-us/online/en-us/Img/custom_projectimage.png) ## Set a project image 1. Sign in to a site on Tableau Cloud. In the list of Top-level Projects you have access to, select or navigate to the project you want to update. In this example, we'll add an image to the Statistics project folder. If you're not sure where to find a child project, use the Explore drop-down list and select All Projects. 2. Click the Details icon (i), to open the Project details dialog box, and then click Edit. ![Project detail page showing owner, created date, and options to edit, change owner, and delete project.](/tableau/next/en-us/online/en-us/Img/custom_projectimage_2.png) 3. In the About field, you can enter a description for your project (optional), for example "Global and US statistics." At the end of the project description, add the URL for your image using the following syntax: `!http://www.example.com/image.png!` ![Project detail page showing global and US statistics with options for project details and editing.](/tableau/next/en-us/online/en-us/Img/custom_projectimage_3.png) Select Show formatting hints to see how you can format description text. **Note:** Images embedded in project descriptions cannot be resized or positioned. Recommended size is (300 x 184 pixels). Images that are not 300 x 184 pixels may be stretched, shrunk, or cropped to fit the width of the thumbnail. In addition, they must be added at the end of the project description and be enclosed in **!** (exclamation marks), otherwise they will not be displayed as the thumbnail. 4. Click Save. ![Custom Explore page with projects sorted into IT, Development, Customer Solutions, and Statistics.](/tableau/next/en-us/online/en-us/Img/custom_projectimage_4.png) [Skip to main content](#main-content) # Add a Tableau Data Story to a Dashboard **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). After you [Create a Dashboard](https://help.tableau.com/current/pro/desktop/en-us/dashboards_create.htm), you can add the Data Story object to your dashboard to display insights about your viz that are written in natural language. Today, Tableau Data Stories are written in English only and are available in Tableau Cloud, Tableau Server (version 2023.1 and later), and Tableau Desktop. There is no data size limit when creating Data Stories. However, story generation times out after 45 seconds if it's trying to analyze a lot of data. We recommend using Data Stories with visualizations that have 1,000 or fewer data points. **Note:** Tableau Data Stories opens in a pop-up window, so be sure to allow pop-ups. If you're using full screen mode, then Data Stories can open in a new tab. 1. Drag the Data Story object into your Tableau dashboard. If you haven't already, add a sheet to your dashboard to use Tableau Data Stories. ![Data Story object with open book icon found in the dashboard editing pane](/tableau/next/en-us/online/en-us/Img/data_story_object.png) 2. In the Data Story dialog box, configure your story by first choosing the worksheet to write about. When you click **Next**, Tableau sends all associated workbook data to the Tableau Cloud or Tableau Server instance that you are logged in to. ![Configure pane with options to choose which sheet you want to write about](/tableau/next/en-us/online/en-us/Img/data_story_configure_view.png) 3. Choose the dimensions and measures to include in your story. ![Configure pane with the option to drag and drop dimensions and measures that you want included in your story](/tableau/next/en-us/online/en-us/Img/data_story_configure_field.png) 4. Choose the type of story that best describes your data: ![Configure pane with options to choose the type of story that best fits your data: Discrete, Continuous, Percent of Whole, or Scatter Plot](/tableau/next/en-us/online/en-us/Img/data_story_configure_story.png) Discrete is best for qualitative values such as names or dates, such as in bar or column charts. Continuous is best for quantitative values over time, such as a plotted in a line chart. Percent of Whole is best for proportions of a whole, such as a pie chart. Scatter Plot is best for relationships between numerical values, such as a scatter plot chart. 5. Click Done. To filter your Data Story by clicking different sections on your visualization, open the menu on your visualization and click Use as filter. After your story is generated, click Settings at the top of your Data Story object for a guided experience that helps you personalize and contextualize your story. For more information, see [Configure Settings for a Tableau Data Story](https://help.tableau.com/v0.0/online/en-us/data_stories_configure_edit.htm). **Note:** If you experience a discrepancy in your Tableau Data Story (for example, if the numbers in your story are different than in your visualization), it may be caused by way your visualization is set up. Try creating a new visualization on a different sheet, and then add a new Data Story with the [Use a hidden sheet](https://help.tableau.com/v0.0/online/en-us/data_stories_more_data.htm#Use) technique to uncover the underlying issue. [Skip to main content](#main-content) # Add More Data to Your Tableau Data Story **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). Data Stories currently supports stories with two dimensions and one measure, or one dimension and up to 10 measures. If you'd like to write about data that you don't need to show on your dashboard, then use a hidden sheet to simplify your dashboard. If you'd like to add more than two dimensions to your story, then concatenate dimensions or create multiple data stories and stack them. ## Use a hidden sheet If you have data that you want to include in a Tableau Data Story and don't need to show all the data that drove the insight, you can use a hidden sheet to bring additional measures and dimensions into your story without cluttering the dashboard. 1. Drag the Data Story object to your dashboard to see which worksheets you can write about in the Data Story dialog box. In this example, there are two worksheets available to write about. ![Data Story dialog box showing two available sheets: Tourism by Country/Region and Tourism Over Time.](/tableau/next/en-us/online/en-us/Img/data_story_configure_view.png) 1. Bring in another data source, such as "Population," by navigating to the left-hand menu, selecting Floating, and dragging that sheet onto your dashboard. ![Data Story dialog box showing three available sheets: Population, Tourism by Country/Region, and Tourism Over Time.](/tableau/next/en-us/online/en-us/Img/data_stories_hidden_3.png) The Data Story dialog box updates with the new available data source. 1. Click into Layout and adjust the size to 1 x 1 to hide the sheet but keep the underlying data in your story. ![The Dashboard pane with Floating selected.](/tableau/next/en-us/online/en-us/Img/data_stories_hidden_1.1.png) You can now configure your stories using this hidden sheet. **Note:** You may need to deselect additional legend elements to keep the sheet hidden. ## Concatenate dimensions If your data contains three dimensions and one measure and is a Discrete Story, you can concatenate (link together) two of those dimensions by creating a calculated field. 1. From the worksheet you want to use in your story, click Analysis and select Create Calculated Field. 2. Name the calculated field and use the following formula to create your calculation, using the + sign to join the dimensions. \[Dimension 1\] + \[Dimension 2\] ![A calculation box that says "\[Population 0-14\]+\[Population 15-64\]"](Img/data_stories_concatenate.png) > [!TIP] > > Drag your dimensions into the Calculated Field box and place them in the formula. 1. Click OK. 2. Drag your new calculated field into the Detail pane to make it accessible in your data story. ## Stack multiple data stories Write about more measures and dimensions by creating multiple Data Stories and stacking them vertically or horizontally on your dashboard. For example, if you wanted to create a story about actual revenue vs benchmark revenue, you could create two different stories—one with the actual revenue and the first benchmark, and another with the actual revenue and the second benchmark—and compare them. [Skip to main content](#main-content) # Add Projects and Move Content Into Them Tableau content (such as workbooks or data sources) must be in a project. Starting in Tableau Server 2022.3 and Tableau Cloud October 2022, if Data Management is licensed and Catalog is enabled, external assets (such as databases and tables) can also be in projects. Server and site administrators can add or remove top-level projects on a site, and move published content from one project to another. Project leaders with appropriate site roles can add or remove child projects and move content between projects on which they have Project Leader access. This article contains the steps for creating and moving projects. We recommend becoming familiar with the following related content as well: - To learn about projects and when or why to use them, see [Use Projects to Manage Content Access](https://help.tableau.com/v0.0/online/en-us/projects.htm). - Before you create project hierarchies, become familiar with [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#projectpermissions). - To see the specific site roles that allow full Project Leader access, see [Project-level administration](https://help.tableau.com/v0.0/online/en-us/projects.htm#project-admin). ## Add a top-level or child (nested) project 1. While you’re signed in to Tableau Cloud as an administrator or project leader, select Explore, and then do one of the following: - Select New > Project to create a new top-level project (only administrators can do this). - Navigate to and open the project in which you want to create a sub-project, and then select New > Project. If you’re not sure where to find the child project, select All Projects from the drop-down menu next to Explore, or use the filters in the upper right. 2. Enter a name and description for the project, and then click Create. ![New project dialog with fields for a project name and description.](/tableau/next/en-us/online/en-us/Img/projects_new1.png) You can include formatting and hyperlinks in the project description. Select **Show formatting hints** for syntax. You can also [Add a Project Image](https://help.tableau.com/v0.0/online/en-us/custom_projectimage.htm). When entering a project description, include a space between capital letters and parentheses to display content inside them, such as "PROJECT (a)". Omitting this space will cause display issues in the project description. **Note:** To edit a project description later, select it to open it, select the information icon next to its name, and then click **Edit**. ## Use the project tree to navigate projects By default, the Explore pane displays a project tree to help you easily navigate your projects. You can use the project tree to find sub-projects within a project folder. You can also use the project tree to search for projects. ![The project tree on the explore pane in Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/Cloud_ProjectTree.png) You can hide and unhide the project tree by clicking the project tree icon located on the Explore pane. ![The project tree icon on the explore pane in Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/Cloud_ProjectTreeIcon.png) > [!TIP] > > **Note:** To ensure the project tree is visible, maintain a browser window width of at least 1441px on the Explore page. A narrower window (1440px or less) or a lower-resolution display will hide the project tree. ## Move an asset to another project 1. In the Explore section, find the asset you want to move. You can use the filters in the upper right to search, or you can navigate through the project hierarchy. 2. On the workbook’s Actions(…) menu, select Move. 3. Select the new project for the workbook, and then click Move Content. ![](/tableau/next/en-us/online/en-us/Img/projects_move_project.png) Moving a project includes moving everything in it, including child projects and their assets. ### How moving projects affect permissions When you move a project, Project Leader permissions adapt to the new project environment. - When the target project hierarchy is **Locked**, previous Project Leader permissions are removed, and new Project Leader permissions are granted according to those set at the top-level of the target hierarchy. - When the target project hierarchy is **Customizable**, previous implicitly granted Project Leader permissions are removed, explicitly set Project Leader permissions are retained, and new Project Leader permissions are granted according to those set at the top-level of the target hierarchy. When you move a project and assets, permissions may be impacted. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#moveproject). ## Delete a project When you delete a project, all of the Tableau content in the project is also deleted. If you want to delete a project but not its content, move the content to another project, and then delete the project. External assets, such as databases and tables, are not deleted, but are moved to the External Assets Default Project. (In Tableau Server 2022.3 and earlier, the assets can be found in External Assets.) **Important** - You cannot undo deleting a project. - Deleting a project deletes all Tableau content in it, including child projects and their content, but not external assets. - You cannot delete the Default project or the External Assets Default Project. To delete a project: 1. In the Explore section, find the project you want to remove. If you’re not sure where to find the project, select All Projects from the drop-down menu next to Explore, or use the filters in the upper right. 2. On the project’s Actions (…) menu, select Delete. 3. Confirm that you want to delete the project. ## Requirements for moving assets Moving an asset is effectively like removing it from one project and publishing it to another. For non-administrators, the permissions needed on the source project are different from those needed on the destination project. ### Required site role To move assets, users must have one of the following site roles: - Server Administrator (Tableau Server only) - Site Administrator Creator or Site Administrator Explorer - Creator or Explorer (can publish) Users with a Server Administrator or Site Administrator site role do not need any additional capabilities. ### Required permissions for the project that users move content _to_ Non-administrators must have the Publish permission capability for the destination project. ### Required permissions for the project that users move content _from_ Non-administrator users must - Be the project owner, project leader, or content owner for the original project OR - Have the Move permission capability for the content (or, for data sources, be the data source owner). When moving a database with its tables, the user must have the Move capability for both the database _and_ its tables. For more information on moving assets, see [Move content](https://help.tableau.com/v0.0/online/en-us/permissions.htm#MoveContent). [Skip to main content](#main-content) # Add Tables to the Connection On the Tables tab: Add tables to the connection **Add tables** Choose an option: - On the left, under **Tables**, double-click table names or select and drag them to the **Tables** pane on the right. Include an entitlement table, if you're using one. - Select ![New Custom SQL button](/tableau/next/en-us/online/en-us/Img/ipa_New_Custom_SQL_btn.png) to create a custom table schema, or select Convert to Custom SQL on an existing table and use it as a starting point for Custom SQL. Select ![The refresh data icon in the virtual connection editor toolbar](/tableau/next/en-us/online/en-us/Img/ipa_vconns_refresh_icon.png) to get the latest data from the database for all the connections. **View and edit table details** 1. Select a table in the Tables tab. 2. In the Table Details section, select a column value to make edits like hide or rename a column, or change the data type. Select live or extract mode for tables Set individual tables to either live or extract mode: - Live Only\- Queried directly from the database. (Live is the default.) - Extracts Only\- Extracted and saved to Tableau. Under Tables, select the table or tables you want to change the mode for and select Actions, and Change to Live or Change to Extract. - Select Create Pending Extracts to create extracts, or Refresh All Extracts to refresh them after creation. - Select a table's Actions menu (...) > Extract Settings to configure the extract for incremental refresh. - Schedule extract refreshes on the virtual connection page after you publish the connection. [Read schedule extract topic](https://help.tableau.com/current/online/en-us/dm_vconn_extract.htm) Set the table visibility state Use the Visibility toggle to show or hide tables from users. ![Check mark means show](/tableau/next/en-us/online/en-us/Img/ipa_vconn_check_mark_show.png) Users can see table data. Create a policy to govern which data users can see. (Visible is the default.) ![X means hide](/tableau/next/en-us/online/en-us/Img/ipa_vconn_x_hide.png) Users can’t see table data. You can use hidden tables in a data policy and as an entitlement table. See table details Select a table at the top of the Tables tab to see its details below. Switch the table information you see using these icons: ![Tag icon represents column data type.](/tableau/next/en-us/online/en-us/Img/ipa_Tag_16px_medium.png) Data type for each column. ![Table icon represents column sample data.](/tableau/next/en-us/online/en-us/Img/ipa_Table_16px_medium.png) Sample data for each column. ![Profile icon represents the column value range.](/tableau/next/en-us/online/en-us/Img/ipa_Panes_show_16px_medium.png) Range of values in a histogram for each column selected. **Quick clip**: View your table details. Your browser does not support the video tag. See Linked keys by selecting ![table icon](/tableau/next/en-us/online/en-us/Img/ipa_Table_16px_medium.png) to see which columns link to other tables. Linked keys show only when databases have primary and foreign key information. Publish the connection and set permissions ### Save a draft or publish a connection Your connection is automatically saved as a draft while you work. Manually save the draft by clicking ![Save icon](/tableau/next/en-us/online/en-us/Img/ipa_Save_16px_medium.png). To share a new virtual connection with other users, you need to publish it. 1. Click ![Publish button](/tableau/next/en-us/online/en-us/Img/ipa_vconn_publish_btn.png) in the upper right corner of the editor. 2. Type a name for the connection in the Name field. 3. Select a project to save the connection to. 4. Click ![Publish button](/tableau/next/en-us/online/en-us/Img/ipa_vconn_publish_btn.png) When you edit an existing connection, it remains available to users in its current published state. - To save updates to a draft, click ![Save icon](/tableau/next/en-us/online/en-us/Img/ipa_Save_16px_medium.png). - To make the updated connection available to users, click ![Publish button](/tableau/next/en-us/online/en-us/Img/ipa_vconn_publish_btn.png) ### Set permissions so others can use the connection You've published the connection, and you're ready to let others use it. To do this, set the Connect capability to Allowed. 1. Navigate to the virtual connection. 2. Open the Actions menu (...) and click Permissions. 3. Select the box under the Connect icon so that connect is allowed for all users. ![Connect capability check box under Permissions Rules](/tableau/next/en-us/online/en-us/Img/ipa_vconn_connect_capability.png) 4. Click Save. [Read publish and permissions topic](https://help.tableau.com/current/online/en-us/dm_vconn_publish_save.htm) [Read virtual connections topic](https://help.tableau.com/current/online/en-us/dm_vconn_create_conn.htm) ## Related tasks [About the Virtual Connection Editor](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_about_editor.htm) [About Data Policies](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_about_data_policy.htm) [Create and Test Data Policies](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_create_data_policy.htm) Not finding what you need? Go online to see [all Tableau help](https://www.tableau.com/support/help) [Skip to main content](#main-content) # Add Users to a Site Everyone who needs to access Tableau Cloud—whether to browse, publish, edit content or administer the site—must be added as a user. Administrators have the following options for adding users: - Enter users’ usernames (email addresses) individually. - [Import Users](https://help.tableau.com/v0.0/online/en-us/users_import.htm) via a CSV file that you create using the [CSV Import File Guidelines](https://help.tableau.com/v0.0/online/en-us/csvguidelines.htm). This topic is intended for site administrators and discusses how to add users at the site level. For cloud administrators adding users to Tableau Cloud Manager, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm). ### Add users 1. When you’re signed in to the Tableau Cloud site, select **Users**. 2. On the Users page, click Add Users, and then click Add Users by Username. ![](/tableau/next/en-us/online/en-us/Img/users_add_online.png) 3. Select the authentication method that you want imported users to sign in to Tableau Cloud with. If no authentication is configured on the site, imported users will be assigned Tableau with MFA authentication method. **Note:** You can go to the Users page to change users’ authentication type any time after you add them 4. In the **Enter usernames** text box, enter the users’ usernames (in email address format). If you add more than one user, separate each username with a semicolon. For example, _tdavis@example.com; jjohnson@example.com; hwilson@example.com_ 5. Select a site role from the drop-down list, to assign that site role to all users you’re adding. For site role definitions, see [Set Users’ Site Roles](https://help.tableau.com/current/online/en-us/users_site_roles.htm). 6. Click Add Users. If a new user’s username is already associated with an account on tableau.com, the user is prompted to sign in using the existing email address and password for that account. If a new user’s username is not already associated with an account on tableau.com, the user is prompted to provide a first and last name and a password. Until the user provides these values, their entry in the Tableau Cloud user list shows the email address preceded by a period. For example: `.snguyen@example.com` After the user signs in, the entry is updated to show the full name. For example: `Susan Nguyen` [Skip to main content](#main-content) # Add Viz Extensions to Your Worksheet Viz Extensions are web applications that can extend the native visual capabilities of Tableau. Viz Extensions give users the ability to interact with custom viz types on their worksheets. Tableau Extensions expand worksheet functionality with the help of web applications created by Tableau, Tableau Partners, and third-party developers in our community. If you're a developer and want to create your own extensions, see the [Tableau Extensions API](https://tableau.github.io/extensions-api/) documentation on GitHub. A Viz Extension is similar to a [dashboard extension](https://help.tableau.com/current/pro/desktop/en-us/dashboard_extensions.htm?_gl=1*uu9rzu*_ga*MTY0NjQ4Mjc3NS4xNzA3NzcyMzUx*_ga_8YLN0SNXVS*MTcxMjE2NjcxNC41NC4xLjE3MTIxNzA1MzUuMC4wLjA.) in that it's a web application that is hosted on the [Tableau Exchange.](https://exchange.tableau.com/en-us/) It's different from a dashboard extension in that you add it to a worksheet while building the viz, rather than adding it to a dashboard as an object. ## Add a Viz Extension to a worksheet There are two ways to add a Viz Extension to your worksheet via the Marks card. If you've already downloaded it through the Tableau Exchange, you can add it as a local file. Or you can download it from the Tableau Exchange in the flow of authoring your Viz. ### Add a Viz Extension as a local file If you've already selected and downloaded a Viz Extension from the Tableau Exchange, it will be saved on your computer as a .trex file. 1. Open a Tableau workbook and connect to your data source. 2. In a worksheet, on the Marks card, expand the Mark type dropdown menu. 3. Under Viz Extensions, select Add Extension. ![Marks card dropdown menu with Viz Extensions option.](/tableau/next/en-us/online/en-us/Img/viz_ext_marks_AddExt.png) 4. In the Add an Extension dialog box that appears, select Access Local Viz Extensions. ![Add an Extension dialog box with the option to Access Local Viz Extensions.](/tableau/next/en-us/online/en-us/Img/viz_ext_addlocal.png) 5. Navigate to and open the saved .trex file. 6. If prompted, allow or deny the Viz Extension access to data in the workbook. The Viz Extension loads in the view, and the mark type changes to the name of the Viz Extension. ### Add a Viz Extension while authoring your viz If you haven't already selected and downloaded a Viz Extension, you can do so in the flow of authoring a viz. 1. Open a Tableau workbook and connect to your data source. 2. In a worksheet, on the Marks card, expand the Mark type dropdown menu. 3. Under Viz Extensions, select Add Extension. ![Marks card dropdown menu with Viz Extensions option.](/tableau/next/en-us/online/en-us/Img/viz_ext_marks_AddExt.png) 4. In the Add an Extension dialog box that appears, select the Viz Extension that you'd like to load onto your worksheet. In this example, we're loading a Sankey diagram built by Tableau. ![Add an Extension dialog box to search for and add an extension from the Tableau Exchange.](/tableau/next/en-us/online/en-us/Img/viz_ext_addext.png) 5. If prompted, allow or deny the Viz Extension access to data in the workbook. For more information, see Data security, Network-enabled, and Sandboxed extensions. 6. Select Open. ![Tableau Exchange description page for the Sankey diagram, developed by Tableau.\]](Img/viz_ext_exchange.png) The Viz Extension loads in the view, and the mark type changes to the name of the Viz Extension. ![Marks card dropdown menu with the Sankey extension magnified in the Viz Extensions section.](/tableau/next/en-us/online/en-us/Img/viz_ext_add_sankey.png) ## Use the Marks card to encode your marks Drag fields onto the encoding boxes on the Marks card to build the viz. The Mark encoding boxes and formatting options are determined by the developer. Check the extension description on the Tableau Exchange for information on the Viz Extension you're loading. To follow along with the Sankey extension, follow these encoding instructions: The Sankey extension is built to use extension-specific encoding for **Levels** and **Links**. These can be used with the built-in Marks encoding boxes Tooltip and Details to build the Sankey on the worksheet. - **Level** - Sankey levels represent the categorical dimensions that are related by the Sankey. In this extension, you can include up to 5 discrete dimensions as levels. - **Link** - Sankey links connect the categories across the Sankey. This encoding will size the width of each link based on a numeric measure. ## Manage workbook extensions Starting in Tableau 2026.2, you can view, delete, or replace all the extensions used across your workbook from one location. To manage your extensions: 1. From the toolbar, select Analysis, and then Manage Workbook Extensions. ![An Analysis dropdown menu displaying various settings and a highlighted Manage Workbook Extensions option.](/tableau/next/en-us/online/en-us/Img/vizext_manageextensions.png) 2. In the Manage Workbook Extensions dialog, select the extension you want to manage. ![A Manage Workbook Extensions dialog window displaying selected Sankey extension details.](/tableau/next/en-us/online/en-us/Img/vizext_manageextension_dialog.png) 3. Choose one of the following actions: **Delete the extension**: Select Delete to remove the extension from your workbook. You can see where the extension is currently in use on the Workbook Extensions dialog. Deleting an extension removes it from all worksheets, dashboards, and stories. Visualizations using the extension change to the Automatic mark type on the Marks card. **Replace the extension:** Select Replace to switch to a different extension. Choose the extension you want to switch to and select Confirm. Replacing an extension replaces every instance of the extension across the entire workbook. Tableau tries to preserve your settings where possible, but settings can be different between extensions or versions. 4. When you finish making updates, select OK. Note: If your workbook doesn't contain any extensions, the dialog box shows a "No extensions in this workbook" message. ## Ensure that extensions are allowed on Tableau Cloud If you're not able to add a Viz Extension, check to see if extensions have been allowed on your site. A Tableau administrator must allow extensions to run on a site and add Network-enabled extensions to an allow list. Administrators should only allow extensions that you have tested and trust. To learn more about adding Network-enabled extensions to an allow list, see [Tableau Help: Change the default settings for a site.](https://help.tableau.com/current/server/en-us/dashboard_extensions_server.htm#change-the-default-settings-for-a-site) ### Data security, Tableau Trusted extensions, and network-enabled extensions Extensions are web applications that come in two standards: - _Tableau Trusted extensions_ have been specifically reviewed by and deployed on Tableau-managed hosts. These include extensions developed and managed by Tableau, extensions built by Tableau Exchange Partners and deployed with Tableau's extension review and host service, and extensions within our legacy sandboxed extension host. - _Network-enabled extensions_ are hosted by a third-party host. These extensions allow developers to manage the delivery of their extensions without the mediation of Tableau. These include extensions that partners manage directly to provide better production support, extensions that are hosted and deployed within your local network, and extensions that require communication with third-party services outside of Tableau. Before you allow a network-enabled extension, be certain that you trust the developer and website that hosts it. You can find information on the URL where the extension is hosted and which type of data access the developer is requesting on the Manage Workbook Extensions dialog. ![A Manage Workbook Extensions dialog window displaying a highlighted extension details section.](/tableau/next/en-us/online/en-us/Img/vizext_manageextension_dialog_magnified.png) By default, extensions use the HTTPS protocol, which guarantees an encrypted channel for sending and receiving data and ensures some privacy and security. For more information about data security when using extensions, see [Extension Security - Best Practices for Deployment](https://help.tableau.com/current/server/en-us/security_extensions.htm). ### Allow or deny a network-enabled extension By default, network-enabled extensions must request permission to run. This permission dialog will provide information about the third-party server it is hosted from and data access level that the extension requires. We recommend you review this information before allowing an extension to run. Extensions typically access visible data in a view. An extension may request deeper data access in the workbook when it requests “Full Data Access.” This can include access to full underlying data, table and field names from data sources, and information about data source connections. Before allowing the extension to run in the workbook, you should review the declared information in the extension permission dialog and decide if you want to allow or deny the extension to run and access this data. ### Reset data access for your network-enabled extension If you choose deny instead of allow on the extension permission dialog, the extension will not load onto your worksheet. If you trust the extension and want to allow access, you can reset permissions by adding the same viz extension into the workbook again, which will reload the permission prompt dialog. ### Make sure that the extension has permissions to access the workbook or view If you publish a workbook that contains an extension, make sure that the extension has access to the visible data in the view. The visible data is also known as the summary data. To grant this access on Tableau Server or Tableau Cloud, be sure the workbook or view allows permission to Download Summary Data. The extension doesn't download your data. The extension just requires permission so it can interact with the data in the view. Depending upon whether you selected to show sheets as tabs when you published the workbook, you set the permission to Download Summary Data at either the workbook or view level. If the sheets weren't shown as tabs, you set the permission at the view level. If you publish the workbook or view to Tableau Public, the extension also requires access to the visible data. To grant permission, open Settings and select Allow Access. ## Ensure that JavaScript is enabled in Tableau Desktop Viz extensions interact with data using the Tableau Extensions API library, a JavaScript library. If you want to use extensions, be sure that JavaScript is enabled in the security settings: Choose Help > Settings and Performance > Set Dashboard Web View Security > Enable JavaScript. ## Get support for third-party and Tableau partner-built Viz Extensions Third-party and Tableau partner-built extensions aren't supported directly by Tableau. However, if you need help, some extension developers provide a link to the Developer Website where you can go for support. To get help: 1. Look for the Developer Website link on the Manage Workbook Extension dialog or on the extension description page in Tableau Exchange. 2. Locate the ID and version of the extension within the Manage Workbook Extension dialog. Providing these details to the developer is essential for troubleshooting, as it confirms whether an outdated version is being used and helps pinpoint the source of the problem. 3. Contact the extension's developer directly through the Developer Website. For questions regarding the Extensions API, we encourage developers to share questions and seek help through the [DataDev Slack Channel](https://tableau-datadev.slack.com/archives/CHJ9BHKG9), or the [submit an issue on GitHub](https://github.com/tableau/extensions-api/issues) for the Extension API. [Skip to main content](#main-content) # Add Web Images Dynamically to Worksheets At Tableau, we know that images are a powerful tool when analyzing data. Imagine that you're looking at a viz of monthly shoe sales. The data is telling you that you sold more high heels than wedges, but you can't picture the difference in the two types of shoe. That's where Image Role comes in. You can dynamically add web images to your worksheets and use them in your headers to add visual detail. ![Viz with images of shoes along with the shoe type and sales](/tableau/next/en-us/online/en-us/Img/imagerole_1.png) ## Prepare your data source Image Role can be assigned to discrete dimension fields that contain URLs that point to web images. To prepare your data, be sure that your image fields meet the requirements set by Tableau to be assigned an image role: - Make sure your URLs navigate to .png, .jpeg, .jpg, .svg, .webp, .jfif, .ico, or .gif image files. - Verify that each URL begins with http or https. If a transport protocol isn’t included, Tableau assumes https. - Optimize the number of images used in your data set. Usually, you can load up to 500 images per field. - Ensure that each image file is smaller than 200 kb. **Note:** If you're using Tableau 23.1 or earlier, your URLs must navigate to image files with .jpg, .jpeg, or .png file extensions. In Tableau 23.2 and later, .gif files are supported, but .gif **animations** will only show on Tableau Cloud and Tableau Server with a client-side render. In Tableau Desktop and Tableau Server with a server-side render, the .gif file will show as a static image. Depending on the complexity of your viz, Tableau may default to a server-side render, which limits the number of images to 100 per field. To learn more about complexity settings and server-side rendering, see [Configure Client-Side Rendering.](https://help.tableau.com/current/server/en-us/browser_rendering.htm) ### Example data set:

Product Name	Product Image URL	Product Sales
Flats	https://img.example.com/flats.png	12,118
High Heels	https://img.example.com/highheels.png	15,865
Running Shoes	https://img.example.com/runningshoes.png	14,200
Wedges	https://img.example.com/wedges.png	8,665

## Assign an image role to your URLs After you’ve connected to your data source, you can assign an Image Role to your URLs from either the Data Source page or on the Data pane in a worksheet. ### From the Data Source page: 1. Locate the column that has image URLs. 2. Right-click (control click on Mac) the icon on the top left of the column and select Image Role > URL. The icon changes to an image icon, and your images are ready to use. ![Data source option to assign an image role to URLs](/tableau/next/en-us/online/en-us/Img/imagerole_3.png) ### From a worksheet: 1. Open a new worksheet. 2. Locate a discrete dimension field that has image URLs. 3. Right-click (control click on Mac) the dimension field and select Image Role > URL. The icon changes to an image icon, and your images are ready to use. ![Data pane option to assign an image role to data](/tableau/next/en-us/online/en-us/Img/imagerole_2.png) ## Add images to your visualizations From your worksheet, drag the Image Role field onto the Rows or Columns shelf. You can now see images along with their associated data on your viz. ![Create an image role in the data pane.](/tableau/next/en-us/online/en-us/Img/imagerole_addtoviz2.gif) ## Share your visualizations You can export your workbooks with images and share them. Be sure that the images used in your vizzes are available to be viewed by everyone you share your vizzes with. For example, if you’re using images that are hosted on an internal server behind a firewall, be sure that everyone you share the viz with has sufficient permissions to access the images. In this example, users who view the viz while connected to the same server shouldn’t have any issues seeing the images. But users who export the viz to a pdf on a Tableau Cloud server may not be able to see the images. If you export your workbook and your viewer attempts to open it in Tableau 2022.3 or earlier, your viewer won’t be able to see the images. **Note:** It’s a best practice to always align an Image Role field with a text description to make the content accessible for screen readers and other accessibility software. ## Troubleshoot image connections Sometimes images won't display if you exceed the number of images allowed per field, have large image files on a complex viz, or are viewing the viz on a mobile device. This section helps you troubleshoot those errors. ### None of the images are displaying in my viz There are too many images in the viz Depending on the complexity of your viz, you can typically load 500 images per field. If you have a complex viz, it may default to server-side rendering. With server-side rendering, you can load 100 images per field. If you get an error message that there are too many images in the viz, filter out images and try again. Tableau couldn't access the images If you receive broken image icons instead of your images, first confirm that you have sufficient permissions to view the images (or if, for example, they're behind a firewall). Tableau must be able to access the images, and the images can't require a separate authentication to view them. If you're sure that you have permission to view the images and they're within the size requirements, check that web images are enabled on your settings page. In Tableau Desktop: 1. From your workbook, click Help in the toolbar. 2. Select Settings and Performance > Set Dashboard Web View Security. 3. Make sure that Enable Web Page Objects and Web Images is checked. In Tableau Cloud: 1. From the home page, click Settings. 2. Under general, scroll down and locate Web Page Objects and Web Images. 3. Make sure that Enable Web Page Objects and Web Images is checked. ### Some of the images aren't displaying in my viz The image file is too large Each image file must be smaller than 200 kb to render. Check your image file size and try again. You're using an earlier version of Tableau If you’re using Tableau 23.1 or earlier, only .png, .jpeg, and .jpg image files are supported. Upgrade your version of Tableau or use a supported file type for the version of Tableau you're using. The image URL must begin with http or https Each image URL must begin with either http or https. Tableau doesn't currently support FTP/SMTP calls. Verify your URL format and try again. The image file must be a URL An Image Role can be assigned to only URLs that navigate to .png, .jpeg, or .jpg, .svg, .webp, .jfif, .ico, .bmp, or .gif image files. Verify your URL format and try again. The image file type isn’t supported An Image Role can be assigned to only URLs that navigate to .png, .jpeg, or .jpg, .svg, .webp, .jfif, .ico, .bmp, or .gif image files. Verify your URL format and try again. If you’re using Tableau 23.1 or earlier, only .png, .jpeg, and .jpg image files are supported. Upgrade your version of Tableau or use a supported file type for the version of Tableau you're using. In Tableau 23.2 and later, .gif files are supported, but .gif **animations** will only show on Tableau Cloud and Tableau Server with a client-side render. In Tableau Desktop and Tableau Server with a server-side render, the .gif file will show as a static image. The image file contains bad characters An Image Role can't be assigned to URLs that have the following characters: < > & \\ ^ ' or the following character sequences: .. \\\\. \\r \\n \\t Verify that your URL doesn't contain any of these characters or character sequences and try again. ### The images aren't displaying outside of my worksheet The images aren't displaying in Viz in Tooltip Viz in Tooltip is processed with server-side rendering, which allows you to load up to 100 images per field. Verify that you have fewer than 100 images per field and try again. For more about server and client-side rendering, see [Configure Client-Side Rendering.](https://help.tableau.com/current/server/en-us/browser_rendering.htm) For more about using Viz in Tooltip, see [Create Views in Tooltips (Viz in Tooltip).](https://help.tableau.com/current/pro/desktop/en-us/viz_in_tooltip.htm) The images aren't displaying in View in Thumbnail View Thumbnail is processed with server-side rendering, which allows you to load up to 100 images per field. Verify that you have fewer than 100 images per field and try again. For more about server and client-side rendering, see [Configure Client-Side Rendering.](https://help.tableau.com/current/server/en-us/browser_rendering.htm) The images aren't displaying when I export my workbook All exports and export-related features are processed with server-side rendering, which allows you to load up to 100 images per field. Verify that you have fewer than 100 images per field and try again. The images aren't displaying on a mobile device Mobile devices have a lower complexity threshold than computers, so the processing is completed through server-side rendering, which allows you to load up to 100 images per field. Verify that you have fewer than 100 images per field and try again. You can change the complexity settings on your mobile device. For more info on complexity thresholds, see [Configure the complexity threshold for computers and mobile devices.](https://help.tableau.com/current/server/en-us/browser_rendering.htm#configure-the-complexity-threshold-for-computers-and-mobile-devices) [Skip to main content](#main-content) # Add, Rename, Delete, or Activate Sites In Tableau Cloud Manager (TCM), the sites you manage correspond to the Tableau Cloud sites within your organization. By default, a tenant contains up to 3 sites, but this capacity increases with different license types – up to 10 sites with an [Enterprise](https://help.tableau.com/current/online/en-us/to_tab_enterprise_features.htm) license and a maximum of 50 with a [Tableau+](https://help.tableau.com/current/online/en-us/to_tab_plus_features.htm) license. **Note:** Multi-Site Pilot Program customers aren't eligible to manage multiple sites using Tableau Cloud Manager. For more information about feature availability, contact your Tableau account representative. The Sites page contains data for each site in your tenant, including site location, user count, and storage usage. TCM allows you to manage sites and users, but doesn't extend to the governance of content and site settings. These capabilities are reserved for users with the site administrator role, who have the necessary access and permissions at the site level. This topic walks you through the steps to add new sites and modify existing ones in TCM. ## Add sites As a cloud administrator, you can expand your organization's capabilities within Tableau Cloud by adding new sites. Tableau recommends creating sites when you must manage a unique set of users and their content separately from others. Consider creating a site for the following scenarios: - **Environment Separation:** To differentiate between development, testing, and production environments. - **Project Isolation:** For projects that require confidentiality or are independent of existing projects. - **Regional Requirements:** When expanding to new regions or to comply with specific data residency and privacy laws. To add a site, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. On the Sites page, click New Site. 3. Complete the fields in the New Site dialog: ![](/tableau/next/en-us/online/en-us/Img/tcm_sites_new.png) 1. **Site name:** A name for the Tableau Cloud site. The site name can be the name of your organization or for a specific team, such as Sales or Marketing. Providing a descriptive name allows users to quickly understand the intended purpose of the site. - Must be unique within Tableau Cloud Manager (TCM) and the Tableau Cloud pod hosting the tenant. - Can only contain Unicode letters, numbers, and the characters `!@$%*.?-_,'()&/:#`. - Must not exceed 80 characters. 2. **Site URI:** The uniform resource identifier (URI) that users enter to sign in to the site. - Must be unique across all Tableau Cloud pods. - Can only contain letters (`A-Z`, `a-z`), numbers (`0-9`), hyphens (`-`), or underscores (`_`). - Must begin and end with a letter or number. 3. **Site location:** The region or pod where the Tableau Cloud site is hosted. We suggest selecting the closest location to your user base. 4. **Initial site administrator:** Email address of the initial site administrator. To access analytics and settings for the site, add yourself as the initial site administrator. Other site administrators can be added later. 4. Review the values and click Create. The initial site administrator receives an email with steps to sign in to the site. For more information, see [Sign In to Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_signin.htm). ### Modify site authentication Site authentication is only configurable by site administrators, directly at the site level. If you're a cloud administrator, you must also have site administrator privileges to change authentication settings. For more information, see [Configure authentication for Tableau Cloud sites](https://help.tableau.com/v0.0/online/en-us/cloud_manager_auth.htm#configure-site-auth). ### Unable to add new site When adding a site to your tenant, you see the following error: _"Site couldn't be created because there is no available capacity. Edit the default site limits or customize the cloud limits and try again."_ This issue can occur when there isn't enough minimum capacity available to create the new site. Every site on the tenant requires a minimum allocation of capacity to run. To resolve this issue, review the table for minimum capacity limits (which are defined by Tableau) and make more capacity available for the new site.

Capacity type	Minimum capacity limit
Extract concurrency	1
Extract API	5
Subscription concurrency	1
Publish API	5
Flow concurrency	0
VizQL Data Service API	0
Visualizations (if licensed with capacity-based model)	10
Pulse digests (if licensed with capacity-based model)	0

To make more capacity available, consider moving capacity from other sites to make more unallocated capacity available. 1. Sign in to [Tableau Cloud Manager](https://cloudmanager.tableau.com/) as a cloud administrator. 2. In the left-navigation pane, go to the Capacities page. 3. On the Capacities page, click the Customize Site Limits button. 4. Identify the site and capacity types that have capacity that you can make available. 5. Enter a value or select the down arrow button next to the capacity type to reduce the capacity limit. 6. When done, click Save. After you have made some capacity available by customizing the capacity limits, add the new site again. For more information about adding sites, see [Add, Rename, Delete, or Activate Sites](#). ## Rename sites You can rename sites to reflect organizational changes. Renaming a site updates the site uniform resource identifier (URI), which invalidates existing site references. **Important:** Changing a site name is a disruptive process that affects access to all site content. After the change, instruct site administrators and users to update their bookmarks, embedded views, and external apps with the new site URI. Rename a test site first to understand the impact. Testing verifies that your links and apps work, and gives you time to prepare users before you rename production sites. To rename a site, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. On the Sites page, select the site you want to rename. 3. Click the Actions menu or ellipsis icon (**...**) and select Rename. 4. Complete the fields in the Rename Site dialog: 1. **New site name:** The new name for the Tableau Cloud site. - Must be unique within Tableau Cloud Manager (TCM) and the Tableau Cloud pod hosting the tenant. - Can only contain Unicode letters, numbers, and the characters `!@$%*.?-_,'()&/:#`. - Must not exceed 80 characters. 2. **New site URI:** The new URI that users enter to sign in to the site. This URI updates automatically to match the new site name, but you can enter a custom value. - Must be unique across all Tableau Cloud pods. - Can only contain letters (`A-Z`, `a-z`), numbers (`0-9`), hyphens (`-`), or underscores (`_`). - Must begin and end with a letter or number. 5. Review the values and click Rename. ## Delete sites Deleting a site deactivates it immediately and schedules it for deletion after 30 days. During this time, the site is inaccessible to users, but you can reactivate it at any time within the 30-day period. Before proceeding with deletion, ensure that site administrators have notified content owners to back up all necessary workbooks and data sources. Site deletion is irreversible after the 30-day period, and all published content will be permanently removed. **Note:** In the event that you accidentally delete a site, allow up to 24 hours for the operation to complete before attempting to reactivate the site. To delete a site, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Navigate to the Sites page and select the check box next to the site you want to delete. 3. Click the Actions menu or ellipsis icon (**...**) and select Delete. 4. In the confirmation dialog, click Delete. A notification appears, indicating that the site is scheduled for deletion. After a site is scheduled for deletion, it reflects a "Delete Pending" status and is removed from the Sites page in Cloud Manager upon deletion. To view the remaining days before deletion, hover over the information icon in the Status column. ![](/tableau/next/en-us/online/en-us/Img/tcm_sites_delete_info.png) ## Activate sites Cloud administrators can activate a site scheduled for deletion within the 30-day period to prevent permanent removal and ensure continued availability. To activate a site, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Navigate to the Sites page and select the check box next to the site you want to activate. 3. Click the Actions menu or ellipsis icon (**...**) and select Activate. 4. In the confirmation dialog, click Activate. After a site is activated, it reflects an "Active" status and will be accessible to users again. Activating the site preserves all existing workbooks and data sources without any changes. ### User activation and site roles When activating a site, users are restored to the roles they held before the site was scheduled for deletion. If there aren't enough licenses available, such as when other sites consume licenses during the suspended state, users are added until the available license count is exhausted. Any remaining users are unlicensed on the site. To license the affected users, adjust site role limits across sites. For more information, see [Manage Site Role Limits](https://help.tableau.com/v0.0/online/en-us/cloud_manager_site_role_limit.htm). [Skip to main content](#main-content) # Administrative Views for Flows Administrative views can be used to monitor the activities related to flows, performance history, and the disk space used. The **Status** page contains an embedded Tableau workbook with various administrative views that can be used to monitor different types of server or site activity. ## Who can do this? Tableau Site administrators can view and work with Administrative Views. ## Action by all users Use this view to gather insight into how flows are being used. This includes actions like publish, download, and flow runs. You can filter the view by actions, by site, and by time range. The Total Users count shows the number of users who have performed an action. This value is not affected by any filtering. The Active user count shows the number of users who have been active during the selected time period and performed one of the selected actions. ![An administrative view showing a line chart on flows and how they are being used.](/tableau/next/en-us/online/en-us/Img/prep_conductor_admin_views_action_allusers.png) ## Action by Specific User Use this view to gather insights about how an individual user is working with flows. You can filter the view by user name, the type of action, and by time range. ![An administrative view showing how an individual user is working with flows.](/tableau/next/en-us/online/en-us/Img/prep_conductor_admin_views_action_specificuser.png) ## Action by Recent Users This view shows you which users have been active on Tableau Cloud over the past 24 hours. This can be useful if you need to do some maintenance activity on the server and want to know which users and how many this will affect, and what they're doing. The view shows **Active**, **Recently Active**, and **Idle** users that are currently signed in to Tableau Cloud. For this view, an active user is one who took an action in the last 5 minutes, a recently active user is one who last took an action within 30 minutes, and an idle user is one who last took an action more than 30 minutes ago. Select a user to see only the actions that user performed recently. Hover over an action to see details of the action. ![An administraive view view showing which flow users have been active on Tableau Server or Tableau Cloud over the past 24 hours.](/tableau/next/en-us/online/en-us/Img/prep_conductor_admin_views_action_recentusers.png) ## Backgrounder Task Delays This view shows the delay for extract refresh tasks, subscription, and flow tasks—that is, the amount of time between when they are scheduled to run and when they actually run. You can use the view to help identify places you can improve server performance by distributing your task schedules and optimizing tasks. ![An administrative view showing Extract, Subscription, and Flow wait times.](/tableau/next/en-us/online/en-us/Img/prep_conductor_admin_views_backgrounder_delays.png) Possible reasons for the delays and ways to reduce the delays include the following: - Many tasks are scheduled for the same time. In the example view, tasks that show long delays are clustered at the same time every day, which creates spikes in the wait time. You can set the Timeline filter to a single day to view task delays by hour and identify the hours of the day when many tasks are scheduled at the same time. One solution is to distribute the tasks to off-peak hours to reduce load on the server. ## Background Tasks for Non Extracts Background Tasks are created to run flows (scheduled and ad hoc). You can use this view to see how many flow tasks succeeded or failed on this site. For details on a task, hover over its icon. ![An administrative view showing how many flow tasks succeeded or failed on this site.](/tableau/next/en-us/online/en-us/Img/prep_conductor_admin_views_backgrounder_tasks.png) ## Performance of Flow Runs Use this view to see the performance history for all the flows on a site. You can filter by Flow Name, Output Step Name, Flow Owner, Run Type (Scheduled or Ad Hoc), and the time the flow runs were started. ![An administrative view showing the flow performance over time. Each point on the chart corresponds to a specific flow run, displaying the flow name, output step, flow owner, run type, and start and end times.](/tableau/next/en-us/online/en-us/Img/prep_conductor_admin_views_flow_performance.png) Questions you can answer using this view include: - **What flow tasks are currently scheduled?** – To do this, use the Start Time filter and select the time frame you want to look at. For example, to see flow tasks that are scheduled in the next 3 hours, select **Hours** -> **Next** -> and enter **3**. - **What is the duration of flow tasks?** - To answer this, click on a mark in the view to see details, including the task duration. - **How many flows were run ad hoc, and how many were scheduled runs?** - To answer this, use the **Run Type** filter and select **Ad hoc** or **Scheduled**. This view can also show you the following information: - Flows with the highest run frequency have the most marks. - To see flows that are currently running at the same time, hover over a mark that shows “**In Progress**” or “**Pending and select** “**Keep Only**” to filter all flow runs that are currently running. - To see flows that are running at the same time during a specific time range, select a range for the **Start Time** filter. For example, select “**Next three hours**” to see which flows will be running in the next three hours. ## Stats for Space Usage Use this view to identify which flow outputs are taking up the most disk space on the server. Disk space usage is displayed by user, project, and by the size of flow output and is rounded down to the nearest number. ![An administrative view showing which flow outputs are taking up the most disk space on the server.](/tableau/next/en-us/online/en-us/Img/prep_conductor_admin_views_spaceusage.png) Use the Min Size filter to control which flow outputs are displayed, based on the amount of space they take up. Use the object type filter for flows. - **What Users Use the Most Space** – This section shows the users who own flows (when filtered for flows) that are taking up the most space. Click a user name to filter the next two graphs for that user. - **What Projects Use the Most Space** – This section shows the projects with flows (when filtered for flows) that are using the most space. - **What Workbooks, Data Source and Flows Use the Most Space** – This section shows the flows (when filtered for flows) that take up the most space. ## Who can do this - **Tableau Site Administrators**: - Set up email notifications at the site level - View errors - Resume suspended tasks - View alerts - **Flow owners, project leaders and any user who is granted permissions to view the flow**: - View errors - Resume suspended tasks - View alerts (Flow owners) [Skip to main content](#main-content) # Allow Access to Approved Sites Only Starting in May 2026 (Tableau 2026.2), you can configure your organization's network to restrict user access to approved Tableau Cloud sites only. This security feature helps prevent unauthorized data sharing by blocking access to unauthorized sites like personal trial sites or other organizations' Tableau Cloud sites. **Note:** This topic describes how to control which sites your users can access from your network. To control which locations your users can access sites from, consider [IP filtering](https://help.tableau.com/v0.0/online/en-us/ip_filtering.htm). ### Benefits of restricting site access Site-specific access is a network-based security control that allows your organization to enforce which Tableau Cloud sites users can access from your network. When configured, users can only sign in to and interact with Tableau Cloud sites that your organization has explicitly approved. This approach is particularly important in industries and regions with strict data security requirements, such as financial services, healthcare, and public sector organizations. This capability helps organizations: - **Prevent data loss:** Block users from uploading company data to unauthorized Tableau Cloud trial sites or other sites - **Maintain compliance:** Prevent unauthorized use of unapproved Tableau Cloud sites to demonstrate control over where organizational data can be published and shared - **Meet regulatory requirements:** Address strict data security requirements in regulated industries and regions ### How it works Site-specific site access works by using your organization's network infrastructure: 1. Your organization configures an SSL proxy server to intercept HTTPS traffic to Tableau Cloud (`*.online.tableau.com`). 2. The proxy adds the `X-Tableau-Allowed-Sites` header to requests that identify which Tableau Cloud sites are approved for access. 3. Tableau Cloud reads these headers and allows or blocks access based on the approved site list. 4. When a user attempts to access a non-approved site, access is denied. **Important:** Tableau Support can't assist with configuring or troubleshooting SSL proxies. ### What restricting site access affects When this capability is enabled for your network, the following access is affected: - Access through a web browser - Tableau Desktop connections to Tableau Cloud - Tableau REST API calls - Embedded views ### Before you begin Site-specific access requires coordination between Tableau Cloud cloud administrators and your organization's IT admin. Before implementing this feature, make sure you have: - **SSL proxy infrastructure**: An SSL proxy server that supports SSL interception and HTTP header injection - **IT support**: Technical resources to configure the proxy server and maintain header injection - **Site inventory**: A complete list of approved Tableau Cloud site IDs ## Configure organization-specific site access Implementing site-specific access involves both IT configuration and ongoing Tableau Cloud administration. ### Step 1: Identify approved sites The best way to generate a comprehensive list of site IDs for approved sites is through Tableau Cloud Manager (TCM) and your web browser's developer tools. 1. Open a web browser and go to the browser's developer tools. 2. Go to and sign in to [Tableau Cloud Manager](https://cloudmanager.tableau.com/) as a cloud administrator. 3. Back in the browser's developer tools, on the Network tab, do the following: 1. Look for requests to `https://.cloudmanager.tableau.com/api/v1/tenants//sites`. 2. Go to `sites?maxResults=200`. 3. Inspect the response. The response contains a list of all sites within your tenant, including the site IDs. Site IDs are listed as `siteUUID`. 4. Capture all of the `siteUUID` values in the response to compile the list of sites to include in the `X-Tableau-Allowed-Sites` header. ### Step 2: Work with IT to configure SSL proxy Provide your IT admin with the list of approved sites and work with them to configure the SSL proxy. Configure the SSL proxy to add the following header to requests for `*.online.tableau.com`. The HTTP header value is a comma-separated list of approved site IDs. Up to about 400 site IDs can be listed in the header. - For a single site: `X-Tableau-Allowed-Sites: siteUUID` - For multiple sites: `X-Tableau-Allowed-Sites: siteUUID1,siteUUID2,siteUUID3` **Note:** If your Tableau Cloud site is configured to use a [custom domain](https://help.tableau.com/v0.0/online/en-us/custom_domain.htm), the IT admin needs to configure the SSL proxy to add the `X-Tableau-Allowed-Sites` header to requests for the custom domain. ### Step 3: Validate traffic routing through proxy After the SSL proxy is configured, the IT admin should validate that all user traffic to your sites are routed through the configured SSL proxy to ensure the HTTP header is applied to every request. ### Step 4: Test the configuration Test the configuration to verify that approved sites are accessible and non-approved sites are blocked. You can test the configuration by: 1. **Verify blocking:** Verify blocking works by going to a site that's not included in the list of site IDs that were added to the HTTP header. Blocking works when you see an HTTP 403 (Forbidden) response. 2. **Verify allowed access:** Verify access works by going to a site that's included in the list of site IDs that were added to the HTTP header. Access works when the page loads normally. 3. **Verify backwards compatibility:** Verify backwards compatibility by removing `X-Tableau-Allowed-Sites` HTTP header from your proxy configuration. Navigate to your site. Backwards compatibility works when the page loads normally. ## Troubleshoot

Symptom	Issue	Resolution
Users report unexpected HTTP 403 (Forbidden) errors	Unexpected HTTP 403 (Forbidden) errors	Verify the site IDs in the `X-Tableau-Allowed-Sites` header matches exactly the sites users are trying to access.
Users can't access any site	All sites are inaccessible	Check that the `X-Tableau-Allowed-Sites` header contains the correct site IDs, there are no typos, or extra white spaces.
`X-Tableau-Allowed-Sites` doesn't appear to be working	Feature doesn't appear to be working	Confirm the SSL proxy is correctly adding the `X-Tableau-Allowed-Sites` header to requests to `*.online.tableau.com`.

[Skip to main content](#main-content) # Analyzed Fields in Explain Data Explain Data runs a statistical analysis on a dashboard or sheet to find marks that are outliers, or specifically on a mark you select. The analysis also considers possibly related data points from the data source that aren't represented in the current view. Explain Data might not include every column from the data source in the analysis. In many cases, certain types of fields will be automatically excluded from the analysis. For more information, see [Fields excluded by default](#DefaultExcFields). ![Explain Data view analyzed fields.](/tableau/next/en-us/online/en-us/Img/explaindata_viewfields.gif) **Note**: Dimensions with more than 500 unique values won't be considered for analysis (unless allowed by the author in Explain Data Settings). All users can view information on which fields are included or excluded in the current analysis. Creators and Explorers who have editing permissions can edit the fields used by Explain Data for statistical analysis. ## View fields analyzed by Explain Data When you expand an explanation for a measure that is contributing to the value of the mark, a link that indicates the number of fields considered in the analysis is displayed at the bottom of the Data Guide pane. ![Explain Data details with a link to view the 14 of 23 fields that are relevant to the higher sum value.](/tableau/next/en-us/online/en-us/Img/explaindata_fieldslink.png) Click the link to see the list of fields included in or excluded from the current statistical analysis. When a data source contains more than 1000 unvisualized dimensions or measures, you might see an alert asking if you want Explain Data to consider more fields. Click Explain All to run an analysis that includes more fields. The analysis may take longer to complete. #### To view fields used by Explain Data for statistical analysis 1. [Run Explain Data on dashboard, sheet, or mark](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm#RunExD). 2. In the Data Guide pane, under **Contributing to the value of**, click a measure name. ![Explain Data details about an analyzed mark, with text highlighted that describes a higher than expected trip distance sum value of 8,800.](/tableau/next/en-us/online/en-us/Img/explaindata_viewfields1.png) 3. Click the _number-of-fields_ link at the bottom of the pane. ![Explain Data details about an analyzed mark, with text highlighted that reads "12 of 23 fields".](/tableau/next/en-us/online/en-us/Img/explaindata_viewfields2.png) ## Change fields used for statistical analysis Creators and Explorers who have editing permissions can select fields to be included or excluded from the statistical analysis in the Fields tab of the Explain Data Settings dialog box. ![Explain Data Settings window that provides information about the data settings, including fields and data types.](/tableau/next/en-us/online/en-us/Img/explaindata_settings.png) When a data source contains dimensions with a large number of unique values (up to 500), those fields won't be considered for analysis. #### To edit the fields used by Explain Data for statistical analysis Settings for analyzed fields are applied at the data source level. 1. Run Explain Data on a mark when editing a view. 2. In the Data Guide pane, click the settings icon at the bottom of the pane. Or, click the Edit button in the Analyzed Fields view ([how to open analyzed fields](#ViewAnalyzed)). ![Edit button on the Analyzed Fields pane.](/tableau/next/en-us/online/en-us/Img/explaindata_editfields.png) 3. In the Explain Data Settings dialog box, click the Fields tab. 4. Click a drop-down arrow next to a field name, select Automatic or Never Include, and then click OK. Note that fields must have less than 500 unique values to be included in the analysis. ![Explain Data Settings window with a measure selected and the dropdown menu expanded to reveal options for including or excluding the field.](/tableau/next/en-us/online/en-us/Img/explaindata_excludefield.png) ## Fields excluded by default

Fields excluded by default	Reasons for exclusion
All unvisualized measures when there are more than 1,000 measures in the data source. All unvisualized dimensions when there are more than 1,000 dimensions in the data source.	Computing explanations for more than 1000 unvisualized measures or dimensions can take longer to compute, sometimes several minutes. These fields are excluded by default for initial analysis, but you can choose to include them for further analysis. In this situation, you might see an alert asking if you want Explain Data to consider more fields. Click the alert link to get more information. Click Explain All to run an analysis that includes more fields.
Fields that use geometry, latitude, or longitude	Geometry, latitude, or longitude by themselves can never be explanations. It is highly likely that an explanation that calls out the latitude or the longitude as an explanation is due to a spurious correlation and not a probable explanation.
Dimensions with high cardinality (dimensions with > 500 members)	High cardinality dimensions take longer to compute. Dimensions with more than 500 unique values will not be considered for analysis.
Groups, bins, or sets	Not currently supported.
Table calculations	Table calculations cannot be analyzed when table calculations are at a different level of detail than the view.
Unvisualized measures that can't be averaged	Unvisualized measures that can't be averaged include measures that are calculated fields where the calculation expression includes aggregations (display as AGG() fields when added to the sheet).
Discrete measures and continuous dimensions	Not currently supported.
Hidden fields	Not available.
Calculated fields with errors	No values present to analyze.

[Skip to main content](#main-content) # Ask Data Usage **Important changes for Ask Data and Metrics** Tableau's Ask Data and Metrics features were retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau AI and Tableau Pulse are reimagining the data experience.](https://www.tableau.com/blog/tableau-pulse-and-tableau-gpt) The Ask Data Usage view is a pre-built dashboard that allows site or server admins to see and understand the usage patterns and value of Ask Data for a site. Admins can see the growth of engagement with Ask Data and monitor the results of internal training or roll-outs. The dashboard highlights the top Ask Data users, data sources, and data source owners, along with some headline value metrics. ![A dashboard illustrating Ask Data's usage and adoption, tracking the number of users, queries, and data sources over time.](/tableau/next/en-us/online/en-us/Img/adminview_ask_data_usage.png) To enable Ask Data, see [Disable or Enable Ask Data for a Site](https://help.tableau.com/v0.0/online/en-us/ask_data_enable.htm). ## Explore the dashboard The Ask Data Usage view provides information about Ask Data across the entire site. You can use the following metrics to understand user engagement and help drive self-service analytics adoption in your organization. ![Ask Data usage is evidenced by 22 users, 177 queries, and 930 data sources.](/tableau/next/en-us/online/en-us/Img/adminview_ask_data_usage_top.png) At the top of the dashboard, three headline metrics provide an overview of Ask Data usage on the site. - Number of Users on Ask Data - This shows the total number of Ask Data users on the site. - Number of Queries on Ask Data - This shows the total number of Ask Data queries issued on the site. - Number of Data Sources Used with Ask Data - This shows the total number of data sources used with Ask Data. ![Two line graphs display the growth of distinct users and distinct data source owners over time.](/tableau/next/en-us/online/en-us/Img/adminview_ask_data_usage_middle.png) In the middle of the dashboard, two line charts show you how Ask Data is used over time. - Distinct Users Over Time - This shows the distinct number of Ask Data users over time. - Distinct Data Source Owners Over Time - This shows the distinct number of data source owners over time. ![Three bar charts display the top data users, data sources, and data source owners.](/tableau/next/en-us/online/en-us/Img/adminview_ask_data_usage_bottom.png) At the bottom of the dashboard, three bar charts list the top Ask Data users, data sources, and data source owners. - Top Ask Data Users - This lists the top Ask Data users and the total number of queries issued by each user. - Top Ask Data Data Sources - This lists the top Ask Data data sources and the total number of queries issued for each data source. - Top Ask Data Data Source Owners - This lists the top Ask Data data source owners and the total number of data sources owned by each user. [Skip to main content](#main-content) # Ask Questions and Discover Insights in Tableau Pulse Tableau Pulse helps you investigate your data by surfacing insights and suggesting questions for further exploration. As you click through the questions about your data, answers are revealed in charts with insights about the underlying data. There are two ways to explore insights: Ask Q&A and Tableau Agent in Pulse. [Ask Q&A](#Ask) suggests questions for pre-detected insights for a single metric. Ask Q&A is always available and doesn't use AI in Tableau. [Tableau Agent in Pulse](#Explore) is a conversational AI that helps you explore groups of metrics. Ask a question in your own words, and Tableau Agent in Pulse uses statistical algorithms to examine grouped metrics and surface insights that are interesting and worth investigating. Because Tableau Agent in Pulse looks across grouped metrics, it can reveal insights that you might miss if you explored only a single metric. ## What is Tableau Agent in Pulse? **Note:** Enhanced Q&A (Discover) has been renamed to Tableau Agent in Pulse. The functionality remains the same. Only the name has changed. You'll see the name change in upcoming releases. Tableau Agent in Pulse is an AI-powered tool that helps you explore insights across groups of metrics. - **It's a conversational way to investigate your metrics.** Your first question is just the start. Dig deeper by asking about different dimensions and time periods for additional insights. - **It's for everyone, no matter your experience level.** You don't need data visualization expertise to get actionable insights. Use natural language to understand what's driving changes to your metrics. - **It's there to guide you in your exploration.** If you aren't sure what to ask, Tableau Agent in Pulse provides suggested initial and follow-up questions. - **It's scoped to metrics in Tableau Pulse.** Tableau Agent in Pulse is a specialized AI that helps you understand your metrics but isn’t intended for general Q&A. - **It's rooted in trusted insights.** Each answer is backed up by citations that are based on your metrics. Those citations are illustrated by visualizations that help you understand that data at a glance. - **It's informed about groups of metrics.** Tableau Agent in Pulse has a wider lens on your data than individual metrics. When you ask about a broader set of metrics, Tableau Agent in Pulse looks across grouped metrics to uncover insights that you wouldn't see if you looked at a single metric in isolation. ## Explore groups of metrics with Tableau Agent in Pulse When Tableau Agent in Pulse is turned on, it's surfaced on the Tableau Pulse home page. For metrics that are sorted by data source or definition, the Ask Tableau Agent in Pulse button appears. When you ask a question with this button, Tableau Pulse looks across all of the metrics in the group to find insights. For metrics sorted by data source, definition, or time range, there are suggested questions for you to explore. These questions look across a sub-set of metrics in the group. Tableau Agent in Pulse highlights shared contributors, detects when trends move together or in opposite directions, flags outliers across metrics, and identifies metrics that are jointly above or below expected ranges. > [!IMPORTANT] > > Tableau Agent in Pulse is a Tableau+ feature that must be turned on in the Tableau Cloud site settings. For more information, see [Turn on Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-enhancedQA-discover). If your site doesn’t have a Tableau+ license edition, you can try Tableau Agent in Pulse with Try AI. For more information, see [Try Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/tableau_gai_trial.htm). ### Ask questions with Tableau Agent in Pulse To start using Tableau Agent in Pulse, ask a question about the metrics on your Following tab. You can also access Tableau Agent in Pulse by selecting a question in an email digest or by selecting the Ask button on a metric and then selecting a suggested question. 1. On the Tableau Pulse home page, under a group of metrics, select Ask Tableau Agent in Pulse. This button appears only if you have your metrics sorted by data source or metric definition. If you aren’t sure what to ask, you can select one of the suggested questions. ![Example of Tableau Pulse home page with a group of followed metrics sorted by data source and suggested questions about that group of metrics.](/tableau/next/en-us/online/en-us/Img/pulse_discover_quick_query.png) 2. In the text box that appears, enter a question about your data. For examples of questions that you can ask, see [Example questions for Tableau Agent in Pulse](#example-questions). 3. On the Tableau Agent in Pulse page, an insight brief answers the question. Click a citation link at the end of an insight to see its source. Click Metric Sources to see metrics considered as part of the analysis when the response is generated. ![The Tableau Agent in Pulse page with insight brief text and source metric](/tableau/next/en-us/online/en-us/Img/pulse_agent_page.png) 4. Select other questions at the bottom of the insight brief to explore more insights, or enter a question in your own words in the text box located near the bottom of the Tableau Agent in Pulse page. ![Two suggested questions for Tableau Agent in Pulse](/tableau/next/en-us/online/en-us/Img/pulse_agent_questions.png) #### Example questions for Tableau Agent in Pulse Use these questions as inspiration to guide your conversation with Tableau Agent in Pulse. | Insight Type | Example Question | | --- | --- | | Period Over Period Change | What happened to admission rates in the last 30 days? | | Correlated Metrics | How are revenue and deliveries relating to each other in the last 90 days? | | Record-level Outliers | Which transactions are outliers? | | Current Trend | What's the trend for call time this week? | | Unexpected Values | Is CSAT lower than expected? | | Goal and Threshold Breakdown | Are refunds in the southwest below the threshold? | | Pace to Goal | How are we trending towards our donation target for this month? | | Top Drivers | Which product lines are driving revenue growth? | | Top Detractors | Which product lines detracted the most from revenue? | | Concentrated Contribution Alert | Are there any risky monopoly scenarios? | | Top Contributors | Which account executives contributed the most to sales this quarter? | | Bottom Contributors | Which menu items contributed the least to profit this year? | | Cross-Metric Analysis | What's up with churn rate and new applications? | #### Limit the scope of your conversation for better answers Large language models have a set amount of information that they can process, known as their context window. The breadth of the metrics and data that you ask about, the length of your conversation, and the complexity of your questions all add to the context that the large language model processes to answer your questions. Too much information can overload the context window and lead to unsatisfactory responses. Optimize the information that Tableau Agent in Pulse processes by following these tips for your conversation. - Limit the number of metrics in the group that you're asking about by being selective in the metrics that you follow. Tableau Agent in Pulse looks at all of the metrics that you follow for a definition or data source group. - Be careful asking about dimensions that have a large number of unique values, such as ID numbers for customers or accounts. Instead, scope your question by asking about categories, such as segment or business area. - Start a new conversation if you’re changing topics to keep the conversation history manageable. ### How to set up Tableau Agent in Pulse Tableau Agent in Pulse requires a Salesforce org to be connected to Tableau Cloud. The connection settings are listed at the beginning of the AI in Tableau section of General settings in Tableau Cloud. Also, Einstein generative AI in Salesforce must be set up for the selected Salesforce org. To make Tableau Agent in Pulse available in Tableau Cloud, your Tableau Cloud admin must make configuration changes in both Salesforce and your Tableau Cloud site. The complete instructions are described in the help topic [Configure Tableau Cloud sites for AI](https://help.tableau.com/current/online/en-us/setup_tabAI_site_setting.htm#configure-tableau-cloud-sites-for-ai). The trial of Tableau Agent in Pulse doesn't require a dedicated Salesforce org. For information about how to start the trial, see [Start your trial of Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/tableau_gai_trial.htm#start-trial). ### Ideal (and less ideal) data scenarios for Tableau Agent in Pulse To get the best experience when using Tableau Agent in Pulse, use data that is clean, structured, and validated. Connecting to data that is consistently formatted and accurate produces better metrics and more reliable insights. Data with the following characteristics provides the best experience with Tableau Agent in Pulse: - Time-series data: Data that evolves over time (for example, sales, traffic, financial metrics). - Aggregated metrics: Key business numbers that can be summarized as metrics (for example, total sales, average satisfaction, loan approval counts). - Clear dimensions: Data sets with well-defined categories such as region, product, or customer segment. Data scenarios that provide a less ideal experience include: - Highly granular data: Data at the highest level of detail with very fine granularity such as minute-by-minute logs. - Single, point-in-time data: Static data sets such as one-time survey results. - Unstructured data: Free-form text or multimedia that lacks structure. ### Time-based filtering Tableau Agent in Pulse can handle time-based scope adjustments. For example, you can refine your question to compare data from different time periods, such as asking, "What happened last month compared to this month?" Use questions to adjust the granularity or breadth of the insights you're exploring. ### Dimension-based filtering Tableau Agent in Pulse can handle questions that filter metrics based on dimension values (region, product, segment) or compare dimension members (West versus East) to uncover meaningful patterns. Tableau Agent in Pulse supports filtering and comparing metrics by dimension members. For example, you could ask "Show sales for California" or "Compare APAC vs. EMEA" to automatically expand your exploration to the full set of compatible metrics. **Note**: Questions you ask on the Tableau Agent in Pulse page can only filter or compare metrics that share key traits, like the same time granularity or the same set of dimensions. If a metric doesn’t match, it won’t be included in the answer. ### Cross-check insight sources for transparency When using Tableau Agent in Pulse, you can cross-check the insights it generates by clicking the link at the end of each insight. These links cite the metric source and display the insight chart when available. You can use this information to verify that the insights that Tableau Agent in Pulse provides are grounded using the correct data. Occasionally, a metric source might not be clickable if Tableau Pulse couldn't generate a metric with those specific filters, but the insight is still rooted in your data. ### Multilingual support for questions and responses in Tableau Agent in Pulse Tableau Agent in Pulse supports multilingual questions and responses, aligned with Tableau Cloud supported languages. Suggested questions, follow-up questions, and insight briefs adapt to the site’s language setting. Metric names and filters always remain in their original, authored language for clarity and consistency. Tableau Agent in Pulse can fluently adapt to the language that you enter as a query. It detects the input language as you ask questions and returns responses in that language—even if it differs from the site or data language. **Note**: Einstein Trust Layer masking supports 6 core languages; others may reduce response quality. Metric names stay in original language. Input language detection may vary in unsupported locales. When the LLM attempts to negotiate differences between language input, it can get confused with certain languages and sometimes blend those languages in its response. With current LLM capabilities, for certain languages such as Chinese, the results may be inconsistent. Specifically, entering questions in traditional Chinese can result in responses that contain simplified Chinese, which can make the response difficult to read. ### Limitations of Tableau Agent in Pulse Tableau Agent in Pulse is limited to working with insights from Tableau Pulse metrics, so it can't generate insights from data outside that framework. It can't answer questions about columns that aren't used in the metrics or metadata about the data source such as "Is this data certified?" It can filter or compare metrics that share key traits, like the same time granularity or the same set of dimensions. If a metric doesn’t match, it won’t be included in the answer. While Tableau Agent in Pulse strives to provide accurate and actionable insights, occasional hallucinations (inaccurate or off-topic answers) may occur, especially when you ask questions that create more complex queries. LLMs can hallucinate because they generate responses based on patterns in data and probabilities, not direct access to real-world facts. As a result, generative AI can be prone to creating output that sounds plausible but contains incorrect or irrelevant information. For more information, see [AI in Tableau and Trust](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust.htm) and [Reviewing generative AI outputs](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust.htm#reviewing-generative-ai-outputs). ### Einstein Trust Layer masking for Tableau Agent in Pulse The Einstein Trust Layer uses advanced pattern matching and machine learning techniques to detect sensitive data in prompts. Personally Identifiable Information (PII) such as names and email addresses are automatically masked using machine learning. For best results, consider structuring your data with clear entity identifiers and consistent field labels to minimize ambiguity and ensure accurate results when masking is applied. ## Ask questions about a single metric with Ask Q&A Ask Q&A is available for single metric exploration. If you don't see an insight you're looking for, click the Ask button to the left of the available questions, and then enter a new question about the metric. Based on your question, Tableau Pulse will look for and rank semantic matches for insights that it detects for the same metric you're investigating. It then lists a question for each detected insight. The filter settings and data available for the metric affect the insights that Tableau Pulse can detect. For more information, see [How Tableau Approaches NLP with Q&A to Empower Everyone](https://www.tableau.com/blog/how-tableau-pulse-approaches-nlp-with-qa). Ask Q&A can be enhanced by turning on the AI in Tableau setting for better semantic matches in Tableau Cloud site settings. For more information, see [Turn on better semantic matches for Ask Q&A in Tableau](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-better-semantic-match-ask). ### Explore a single metric with Ask 1. On the Tableau Pulse home page, click a metric of interest. 2. On the metric page, under Discover Top Insights (following the chart visualization), click a suggested question. 3. To ask your own question, click the Ask button. 4. Enter your question about the metric. Try asking questions about trends, changes, outliers, or categories that might be contributing to the metric. You can also ask questions that adjust the time granularity and apply dimensional filters for the current metric. For example, you could enter "Sales in California last week," "Zoom into technology," or "What about yesterday?" 5. Based on semantic matching and ranking, Pulse lists questions for each detected insight. Click a question to see the insight. If Pulse can't find a match, it might suggest other questions of interest. [Skip to main content](#main-content) # Audit Permissions Using the Activity Log Permission auditing allows system administrators to monitor which users have modified access controls to Tableau content. There are two ways to modify access control: _explicit_ changes (by changing permission capabilities on a project or content item) and _effective_ changes (by changing user site roles, group membership, moving content, and so on). All of these changes are recorded, so administrators can certify that security and access controls are maintained. For more information about how permission rules are evaluated, see [Effective permissions](https://help.tableau.com/v0.0/online/en-us/permission_effective.htm). ## Log format Every action that modifies user or group access to content will get a log entry. Each log entry is structured in a JSON format, with specific keys representing different pieces of information. A log entry contains two parts: - Metadata: Contains information about when and where an action occurred and what user performed the action. - Action: Contains information about what piece of content had its permissions changed, what capabilities were changed, and to what values the capabilities were changed. **Note:** Activity Log records changes made through the Permissions Dialog UI and REST API. For more information about API methods, see [Permissions Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_permissions.htm). The Activity Log entries are not formatted, and the keys are not sorted in any particular order in the logs. When auditing permissions, you can combine Activity Log data with other data sources, such as [Admin Insights](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm), to link IDs to names and make the events easier to interpret. ### Example The following is an example log entry showing a group was allowed to connect to a data source. { "actorUserId": 39872, "actorUserLuid": "4e6b42bf-9040-4e60-b326-1c56a4fb96f8", "authorizableType": "DATASOURCE", "capabilityId": 32, "capabilityValue": "connect", "contentId": 2099835, "contentName": "Superstore ExtractNeal3", "eventTime": "2023-01-31T22:44:23.650058Z", "granteeId": 22, "granteeLuid": "dae0717a-d524-436d-b469-fadeaa22a5dd", "granteeType": "Group", "granteeValue": "GROUP\_ALLOW", "initiatingUserId": 39872, "initiatingUserLuid": "4e6b42bf-9040-4e60-b326-1c56a4fb96f8", "isError": false, "eventCategory": "security", "eventType": "set\_permissions", "eventVersion": "1.0", "permissionType": "explicit", "siteLuid": "b45e272d-10c7-49d5-9037-e53ce47dbf4e" } The log entry captures essential information regarding the event, including: - `eventType` shows a set permissions event occurred - `permissionType` shows an explicit change to permissions - `contentId` shows the ID of the content that was modified - `authorizableType` shows the content type, in this case, a data source - `capabilityValue` shows the capability that was changed - `granteeId` shows the grantee that was affected - `actorUserId` shows the ID of the user who performed the change - `eventTime` shows the date and time of the change ## Events Log entries contain various event types for permissions changes, such as `content_owner_change` when the content owner changes or `set_permissions` when a permission rule is created or updated. Different actions produce different events. For more information about event types, attributes, and when they're recorded, see [Activity Log Site Event Type Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_schema.htm). [Skip to main content](#main-content) # Authentication Authentication refers to the options for how users can sign in to their Tableau Cloud site, and how they access it after signing in the first time. Authentication verifies a user’s identity. Tableau Cloud supports multiple authentication types, which you can configure on the Authentication page. This topic is intended for site administrators configuring authentication to a site. For cloud administrators configuring authentication for Tableau Cloud Manager, see [Tableau Cloud Manager Authentication](https://help.tableau.com/v0.0/online/en-us/cloud_manager_auth.htm). Regardless of the authentication type you configure for your site, multi-factor authentication (MFA) is required when accessing Tableau Cloud. This contractual requirement went into effect February 1, 2022. For more information, see [About multi-factor authentication and Tableau Cloud](#mfa_requirement) below. - **Tableau with MFA:** This is the built-in and default authentication type. It requires users to provide a combination of 1) Tableau credentials (also called TableauID), consisting of a username and password that are stored with Tableau Cloud, and 2) an MFA verification method, such as an authenticator app or security key, to confirm a user's identity. For more information, see [Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_security_mfa.htm). - **Tableau:** If Tableau hasn't updated your site to require Tableau with MFA yet, you can continue to use this authentication type on a temporary basis. Users enter their TableauID credentials directly on the Tableau Cloud sign-in page. - **Google:** If your organization uses Google applications, you can enable Tableau Cloud to use Google accounts for single sign-on (SSO) with MFA using OpenID Connect (OIDC). When you enable Google authentication, users are directed to the Google sign-in page to enter their credentials, which are stored by Google. - **OIDC:** Another way to use SSO is through generic OpenID Connect (OIDC). To do this, you use a third-party identity provider (IdP) with MFA, and configure the site to establish a trust relationship with the IdP. When you enable OIDC, users are directed to the IdP’s sign-in page, where they enter their SSO credentials, already stored with the IdP. - **Salesforce:** If your organization uses Salesforce, you can enable Tableau Cloud to use Salesforce accounts for single sign-on (SSO) with MFA using OpenID Connect (OIDC). When you enable Salesforce authentication, users are directed to the Salesforce sign-in page to enter their credentials, which are stored and managed in Salesforce. Minimal configuration may be required. For more information, see [Salesforce Authentication](https://help.tableau.com/v0.0/online/en-us/security_auth_sfdc.htm). - **SAML:** Another way to use SSO is through Security Assertion Markup Language (SAML). To do this, you use a third-party identity provider (IdP) with MFA, and configure the site to establish a trust relationship with the IdP. When you enable SAML, users are directed to the IdP’s sign-in page, where they enter their SSO credentials, already stored with the IdP. **Notes:** - Access and management permissions are implemented through site roles. Site roles define which users are admins, and which users are content consumers and publishers on the site. For more information about admins, site roles, groups, Guest User, and user-related administrative tasks, see [Manage Users and Groups](https://help.tableau.com/v0.0/online/en-us/users.htm) and [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm). - In the context of authentication, it’s important to understand that users are not authorized to access external data sources through Tableau Cloud by virtue of having an account. In other words, in the default configuration, Tableau Cloud does not act as a proxy to external data sources. Such access requires additional configuration of the data source on Tableau Cloud or authentication at the data source when a user connects from Tableau Desktop. ### About multi-factor authentication and Tableau Cloud To get ahead of the rise and constantly evolving security threats that can cripple an organization, MFA authentication became a Tableau Cloud requirement beginning February 1, 2022. MFA is an effective tool for enhancing sign-in security and protecting your organization and its data against security threats. For more information, see the [Salesforce Multi-Factor Authentication FAQ](https://help.salesforce.com/apex/HTViewSolution?urlname=Salesforce-Multi-Factor-Authentication-FAQ) in Salesforce Help. To enhance account security, multi-factor authentication (MFA) is an authentication method that must be used in conjunction with one of the other authentication methods described above. MFA can be implemented in one of two ways: - **SSO and MFA (recommended method):** To satisfy the MFA requirement, enable MFA with your SSO identity provider (IdP). - **Tableau with MFA (alternative method):** If you don’t work directly with an SSO IdP, you can instead enable a combination of 1) TableauID credentials, which are stored with Tableau Cloud, and 2) an additional verification method before you and your users can access the site. We also recommend that users set up recovery codes as a backup verification method for emergency cases only. For more information, see [Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_security_mfa.htm). ### About Google, OIDC, Salesforce, or SAML configurations If you enable Google, OIDC, Salesforce, or SAML authentication on your site, you can select which users you want to sign in using external credentials and which to use Tableau credentials (Tableau ID). You can allow Tableau and one or more external providers configured for a site, but each user must be set to use one or the other type. You can configure user authentication options on the Users page. **Important:** In addition to these authentication requirements described above, we recommend that you dedicate a site administrator account that is configured for Tableau with MFA authentication. In the event of an issue with SAML or the IdP, a dedicated Tableau with MFA account helps ensure that you have access to your site. #### Notes about configuring additional authentication methods Beginning in January 2025 (Tableau 2024.3), you can configure one or more authentication methods for your site. Each authentication configuration requires a name. Existing configurations that were created before January 2025 will be given a name automatically. For example, if SAML was configured for your site before January 2025, the configuration name is "Initial SAML". Names for existing configurations can't be changed. The maximum number of configurations that a site can have depends on when the site was created and if SAML or OIDC was configured. - For sites created before January 2025 upgrade: - If you configured SAML only or OIDC only before the January 2025 upgrade, you can create up to 19 configurations. - If you configured SAML and then OIDC or OIDC then SAML before the January 2025 upgrade, you can create up to 18 configurations. - For sites created after the January 2025 upgrade, you can create up to 20 configurations. **Note:** Configurations can be enabled, disabled, and deleted. However, the SAML configuration associated with SCIM can't be disabled or deleted until the SCIM capability is turned off. For more information about SCIM, see [SCIM](https://help.tableau.com/v0.0/online/en-us/scim_config_online.htm). ## Allow direct access from Tableau connected clients By default, after users provide their credentials to sign in to a site, they can subsequently access the Tableau Cloud site directly from a _connected_ Tableau client. To learn more, see [Access Sites from Connected Clients](https://help.tableau.com/v0.0/online/en-us/to_connected_clients.htm). **Note:** Optionally, you might need to add `*.salesforce.com` if MFA with Tableau authentication is enabled for your site and your environment is using proxies that prevent clients from accessing other necessary services. ## Other authentication scenarios: Embedding and integration You can put analytics directly in your users’ workflows by integrating and embedding Tableau into custom web portals, applications, and customer-facing products. For integration of external applications with Tableau Cloud and embedding Tableau Cloud content, there are additional mechanisms to authenticate users who access Tableau depending on the intended workflow: - **Embedding with Tableau connected apps:** - **Direct trust**—Tableau connected apps enable a seamless and secure authentication experience by facilitating an explicit trust relationship between your Tableau Cloud site and external applications where Tableau content is embedded. The trust relationship provides your users with a single sign-on (SSO) experience without having to integrate with an identity provider. Using connected apps also enables a programmatic way to authorize access to the Tableau REST API using JSON Web Tokens (JWTs). For more information, see [Configure Connected Apps with Direct Trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_direct.htm). - **OAuth 2.0 trust**— You can register an external authorization server (EAS) with Tableau Cloud to establish a trust relationship between your site and the EAS using the OAuth 2.0 standard protocol. The trust relationship provides your users with a single sign-on experience (SSO), through your IdP, to embedded Tableau content. In addition, registering an EAS enables a programmatic way to authorize access to the Tableau REST API using JSON Web Tokens (JWTs). For more information, see [Configure Connected Apps with OAuth 2.0 Trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_eas.htm). - **Salesforce integration:** Augment your data analysis through machine learning models and comprehensive statistical analysis using Einstein Discovery. For more information, see [Configure Einstein Discovery Integration](https://help.tableau.com/v0.0/online/en-us/config_einstein_extensions.htm). - **Slack integration:** Make Tableau notifications available to licensed Tableau users in their Slack workspace. For more information, see [Integrate Tableau with a Slack Workspace](https://help.tableau.com/v0.0/online/en-us/slack_admin.htm). ## Other articles in this section [Skip to main content](#main-content) # Author Visualizations with Assistive Technologies Starting in Tableau 2026.1, you can author and edit visualizations on Tableau Cloud and Tableau Public using only a keyboard. This keyboard-only functionality allows users to create content without a mouse, offering a consistent experience for those who use screen readers or prefer keyboard navigation. Tableau provides announcements as you navigate, ensuring you understand which part of the interface is in focus. ## Build a view using your keyboard You can navigate the Data pane, add fields to the visualization, and rearrange items on shelves using standard keyboard strokes. ### Add fields to the worksheet from the Data pane 1. Use the Tab key to move focus to the Data pane. 2. Use the Up and Down Arrow keys to move through the list of fields. 3. To select or unselect a field, press the Spacebar. To select a field and open its context menu, press Enter. Using the context menu gives you the ability to place the field exactly where you intend on the visualization. 1. From the context menu, select Add to from the menu. 2. Use the Arrow keys to select the location where you want to place the field. As you Arrow through the locations, an orange focus indicator appears on the target areas, such as on the Columns shelf or the Pages card. 3. Press the Spacebar to drop the item in the specified location. Tableau adds the field to the view and updates the visualization immediately. When the field is dropped on the specified location, the focus returns to the Data pane. If you'd like to cancel an action or close the context menu without making a selection, press Esc. This will return the focus to the field in the Data pane. You can also build a visualization using your keyboard by interacting with the Show Me panel. To learn more about building a view with Show Me, see [Use Show Me to Start a View](https://help.tableau.com/current/pro/desktop/en-us/buildauto_showme.htm). ### Configure options for Filters and Marks cards When you drop a field onto Filters or the Marks card, you need to complete a few more steps. #### For Filters: 1. Drop the field onto the Filters card. The filter configuration dialog opens. 2. Use the Tab key to move between sections of the filter dialog (For example, General or Condition). 3. Press Enter to open a section or list of options. 4. Navigate through the available options using the Arrow keys. 5. Press Enter again to select the items you wish to filter. 6. After the filter is configured, press Tab until you reach the desired action button (For example, Reset, Apply, Cancel, or OK). 7. Press Enter to confirm your choice. The filter saves and the dialog closes automatically. #### For the Marks card: 1. Drop the desired field on the Marks card. 2. Use the Arrow keys to select the specific visual property for encoding (For example, Color, Size, Label). 3. Press the Spacebar to place the field on that encoding box. ##### To configure settings for an existing field on the Marks card: 1. Make sure that the relevant card or field is in focus, then press Enter to open its context menu for more visualization options. 2. Use the Tab key to move through the various settings within the menu (For example, in the Color card, navigate through Edit Colors, Opacity, Border, and Halo). 3. With the setting in focus, adjust the value using the Arrow keys. For example, with Opacity in focus, use the Left or Down Arrow keys to decrease the opacity and the Right or Up Arrow keys to increase it. ### Interact with fields on the visualization with a keyboard A field that has been placed on a visualization is often called a pill. You can move them to a different location, copy them to a different location, and remove them from the visualization, but the keyboard strokes are slightly different. 1. Use the Tab key to move through the worksheet until the pill you'd like to interact with is in focus. 2. Press Enter to open the pill's context menu. 3. Use the Arrow keys to navigate to your next action, such as Move to or Copy to, and press Enter again. 4. If you're moving or copying the pill, use the Arrow keys to select the location where you want to place the pill. As you Arrow through the locations, an orange focus indicator appears on the target areas. 5. Press the Spacebar to move or copy the item to the new location. 6. If you're removing a pill from the visualization, use the Arrow keys to navigate to Remove, and press Enter. The focus remains in place. For example, if you've copied a pill to the Rows shelf, the focus remains on the Rows shelf. ## Keyboard controls for authoring ### Visualization authoring keystrokes Use these keyboard controls to build visualizations without a mouse.

Action	Keystrokes
Move the focus forward through the visualization elements	Tab
Move the focus backward through the visualization elements	Shift + Tab
Select and open a context menu Expand or collapse a card	Enter
Open context menu	Enter or Shift + F10
Select or unselect an item in the schema	Spacebar
Move pill left	Ctrl + Left Arrow
Move pill right	Ctrl + Right Arrow
Cancel the action and return to the last location	Esc

### Drag-and-drop keystrokes Use these keyboard controls to drag-and-drop items without a mouse. | Action | Keystrokes | | --- | --- | | Enter drag-and-drop mode | Press Enter on a destination (for example, Columns) through the context menu | | Move forward | Right or Down Arrow | | Move backward | Left or Up Arrow | | Drop item | Spacebar | | Cancel | Esc | ### Walkthrough: Add a field to the worksheet using a keyboard in three steps **Step one:** From the Data pane, use the Arrow keys to navigate to a field, and then press Enter to select it and open its context menu. ![The Tableau Data pane with a dimension called Genre selected.](/tableau/next/en-us/online/en-us/Img/accessible_authoring_step1.png) **Step two:** Navigate the options using the Arrow keys, and then press Enter. For example, move the selection to Add to and press Enter. ![The Tableau Data Pane with Genre selected. Genre's context menu is open and the focus is on "Sheet (Automatically)".](/tableau/next/en-us/online/en-us/Img/accessible_authoring_step2.png) **Step three**: Use the Arrow keys to navigate to the desired location for the field, such as Sheet (Automatically), and then press Enter. ![The Tableau workspace, where a table is now created after following the steps to create a viz.](/tableau/next/en-us/online/en-us/Img/accessible_authoring_step3.png) Tableau automatically creates a viz with the field, dropping in the most logical location based on the data type and the current view. ## Build a Dashboard using your keyboard You can add and remove worksheets from the dashboard, navigate through the dashboard, and access context menus on a dashboard. All using standard keyboard strokes. ### How keyboard focus works on the dashboard Tab and Shift+Tab move between the main regions of the dashboard in reading order: 1. Toolbar 2. Left pane (Data pane, Analytics pane, or the Dashboard pane) 3. Dashboard canvas, or on a worksheet, the shelves and Marks card 4. Sheet tabs Every main region functions as a single Tab stop. Once focused within a region, navigate through its options—like toolbar buttons—using the arrow keys. Pressing Enter or the Spacebar will activate or select the highlighted option, while pressing Esc lets you step back to the previous navigation level. ### Select and explore zones on a dashboard Each item in a dashboard, such as a sheet, filter, legend, or container, is a zone. Zone controls appear only after you select the zone. 1. Press Tab to move focus to a zone. Zones are reached in layout order, with containers before the items inside them. 2. Press the Spacebar to select the zone. The zone menu button and drag handle appear. 3. Press Tab to move from the zone to its drag handle and then to its zone menu button. Use the arrow keys to move between the zone menu buttons. 4. Press Enter to move into the zone and work with its contents, such as a filter control. Use the arrow keys to move within it. 5. Press Esc to leave the zone content. Press Esc again to deselect the zone. 6. To open the zone's context menu from the zone, press Ctrl+Enter. ### Add a sheet or object to a dashboard 1. In the left pane, use the arrow keys to navigate to a sheet or dashboard object and press Enter to open its menu. 2. Use the Up and Down arrows to navigate to and then select Add to and press Enter. 3. Choose a destination: Dashboard (Automatically) places the item using Tableau's automatic placement. Dashboard Tiled Zones places the worksheet in a specific destination that you choose. 4. If you chose a specific destination, use the arrow keys to move between valid drop positions. Left or Up moves backward, and Right or Down moves forward. Movement does not loop around, and Tableau alerts you upon reaching the start or end position. 5. Press Spacebar or Enter to drop, or press Esc to cancel. As you move, Tableau announces each position, for example: "B3 to C5. Inside Vertical Container. Left of Sales Chart. Above Profit Table." The position is a cell on a 26 × 26 grid over the dashboard. After a drop, Tableau announces any related legends or controls it added, such as "Ship Mode Filter Control added for Dual Axis." Focus returns to the item you dragged from, or to the item you moved, after you drop or cancel. ### Dashboard authoring keystrokes | Action | Keystrokes | | --- | --- | | Move between regions, zones, drag handle, and zone menu | Tab or Shift+Tab | | Select or deselect a zone; activate the focused button | Spacebar | | Move into zone content; activate the focused button | Enter | | Leave zone content, then deselect the zone | Esc | | Move within zone content or between zone menu buttons | Arrow keys | | Open the zone context menu | Ctrl+Enter | ### Walkthrough: Add a worksheet to a dashboard using a keyboard in three steps **Step one:** From the Data pane, use the arrow keys to navigate to a worksheet, and then press Enter to select it and open its context menu. ![A dashboard interface displaying a sheet context menu.](/tableau/next/en-us/online/en-us/Img/dashboard_auth_step1_489x314.png) **Step two**: Navigate to Add to using the arrow keys and press Enter. ![A dashboard interface displaying expanded automatic and tiled zone placement options.](/tableau/next/en-us/online/en-us/Img/dashboard_auth_step2_489x288.png) **Step three**: Select a target placement such as Dashboard (Automatically) with the arrow keys, then press Enter. ![A dashboard with a worksheet now appearing on it.](/tableau/next/en-us/online/en-us/Img/dashboard_auth_step3_494x339.png) Tableau automatically adds the worksheet to the dashboard, dropping it at the most logical location. [Skip to main content](#main-content) # Automate Extract Refresh Tasks from the Command Line You can automate extract refresh tasks using the Tableau Data Extract Command-Line Utility. This is a command-line utility that comes with Tableau Desktop, through which you can refresh published extract data sources or append data to them from a file. Requirements for using the Tableau Data Extract Command-Line Utility include the following: - It is available with Tableau Desktop on Windows and can run only on a Windows system. - It is not available with the trial version of Tableau Desktop. - You can use it for extract data sources that don't use OAuth. - You can use it to refresh single-connection data sources only. It does not work for multi-connection data sources. **Deprecated October 2022:** This utility isn't available in later releases due to the [multi-factor authentication](https://help.tableau.com/current/online/en-us/to_security_mfa.htm) requirement in Tableau Cloud. To refresh data sources or virtual connections data that Tableau Cloud can't reach directly, use Tableau Bridge instead. For more information, see [Set Up a Bridge Refresh Schedule](https://help.tableau.com/current/online/en-us/to_sync_schedule.htm). To initiate refresh jobs using a script, use tabcmd [refreshextracts](https://help.tableau.com/current/server/en-us/tabcmd_cmd.htm#refreshextracts-workbookname-or-datasourcename) or REST API [Run Extract Refresh Task](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#run_extract_refresh_task). ## Run the utility 1. Open the Command Prompt as an administrator and change to the Tableau Desktop bin directory. For example: `cd C:\Program Files\Tableau\Tableau 2022.4\bin` 2. Use either of the following commands, adding parameters described in the tables below. - `tableau refreshextract` - `tableau addfiletoextract` **Note:** When using the utility, always specify `tableau` on the command line or in scripts, never `tableau.exe`. **Note:** To troubleshoot, check the logs in the tableaucom.txt file in the \\My Tableau Repository\\Logs folder. **Note:** In a multiple-site environment, specify the site to which the command applies. ## Syntax and parameters for the tableau refreshextract command Use `tableau refreshextract` to refresh an extract on Tableau Server or Tableau Cloud. Refreshing an extract updates an existing extract with any modifications that have been made to the data source since the last refresh. To see help for this command, at the Windows command prompt, type the following command: `tableau help refreshextract` ### Using parameters - All options have a full form that you use with a double hyphen (for example, `--server`). - Some options also have a short form that you use with a single hyphen (for example, `-s`). - If the value for an option contains spaces, enclose it in quotation marks. - The source being refreshed must be the original data source, not an extract (`.hyper`). ### tableau refreshextract command options

Short Form	Full Form	Description
	`--source-username <user name>`	A valid user name for the data source connection. Use this option with `--source-password`, or use `--original-file` instead of the user name and password options. Note: You must provide the user name and password when refreshing a published extract, even if the data source was originally published with embedded credentials.
	`--source-password "<password>"`	The password for the data source user.
	`--original-file <path and file name>` or `--original-file <path and folder name>`	Path and file name for the data source to be refreshed on the server. For example: `--original-file c:\folder\file.csv` To refresh a multi-file data source, pass the path to a folder that contains the data files. For example: `--original-file c:\folder`. If the file is on a network share, use the UNC format for the path: `\\server\path\filename.csv`
	`--force-full-refresh`	If the data source is set up for incremental refreshes, use this option to force a full extract refresh. If this option is not included, an incremental refresh is performed. Not all data sources support incremental refresh.
`-s <server http address>`	`--server <URL>`	The URL for the Tableau server on which the data is published. For Tableau Cloud, specify `https://online.tableau.com`.
`-t <site id>`	`--site <siteid>`	In a multiple-site environment, specifies the site to which the command applies. For Tableau Cloud, use this argument if your user name is associated with more than one site. For Tableau Server, if you do not specify a site, the default site is assumed. The site id is independent of the site name, and it is indicated in the URL when you view the site in a browser. For example, if the URL for the page you see after signing in to Tableau Cloud is https://online.tableau.com/t/vernazza/views the site id is vernazza.
	`--datasource <datasource>`	The name of the data source, as published to Tableau Server or Tableau Cloud.
	`--project <projectname>`	The project to which the data source belongs. If this option is not included, the default project is assumed. If the project you want to specify is a child project nested within a project hierarchy, you must use this parameter along with the `--parent-project-path` parameter.
	`--parent-project-path path/to/project`	If a project to which the data source is published is not at the top level of a project hierarchy, use this parameter along with the `--project` parameter to specify the path to a nested project. Use the forward slash character (`/`) to delimit project levels in the hierarchy. Use the backward slash (`\`), to escape instances of forward or backward slash characters in project names. For example, for a project named Sandbox, in project Social, under top-level Marketing: `--project Sandbox --parent-project-path Marketing/Social`
`-u <user name>`	`--username <username>`	Valid Tableau Server or Tableau Cloud user.
`-p "<password>"`	`--password "<password>"`	The password for the specified Tableau Server or Tableau Cloud user.
	`--proxy-username <username>`	The user name for a proxy server.
	`--proxy-password "<password>"`	The password for a proxy server.
`-c "<path and file name>"`	`--config-file "<path and file name>"`	Path and file name information for a file containing configuration options for the command. Always enclose the path in double quotation marks. For more information, see Using a config file below.

### Sample tableau refreshextract command The following command refreshes an extract named CurrentYrOverYrStats that has been published to Tableau Cloud. This command specifies the following: - Tableau Cloud user and password. - Tableau Cloud site and project names. - The data source, which in this case is hosted by a cloud-based data source provider (for example, Salesforce.com), and the username and password to sign in to the hosted data source. `C:\Program Files\Tableau\Tableau 2022.4\bin>tableau refreshextract --server https://online.tableau.com --username email@domain.com --password "OurServerPwd" --site vernazza --project "New Animations" --datasource "CurrentYrOverYrStats" --source-username database_user@hosted_datasource_provider.com --source-password "db_password"` To refresh an extract of file-based data source, provide the path to the original file from which you created the extract. If the file is on a network share, use the UNC format instead of a mapped drive. `C:\Program Files\Tableau\Tableau 2022.4\bin>tableau refreshextract --server https://online.tableau.com --username email@domain.com --password "OurServerPwd" --site vernazza --project "New Animations" --datasource "CurrentYrOverYrStats" --original-file "\\server\path\filename.csv"` ## Syntax for tableau addfiletoextract Use `tableau addfiletoextract` to append file content to an extract that has been published to Tableau Server or Tableau Cloud. This command combines the two files. If you want simply to update an existing extract with the latest changes, use the `refreshextract` command instead. Using `addfiletoextract` to update an existing extract will duplicate data instead. To see help for this command, at the Windows command prompt, type the following command: `tableau help addfiletoextract` All options have a full form that you use with a double hyphen (for example, `--server`). Some options also have a short form that you use with a single hyphen (for example, `-s`). If the value for an option contains spaces, enclose it in quotation marks. ### tableau addfiletoextract command options

Short Form	Full Form	Description
	`--file <path and file name>`	Path and file name information for the data file containing data to append. The file can be from Excel, Access, a Tableau data extract, or a delimited text file. It cannot be password protected. Use UNC format if the file is on a network share. For example, `\\server\path\filename.csv`
`-s <server http address>`	`--server <URL>`	The URL for the Tableau server on which the data is published. For Tableau Cloud, specify `https://online.tableau.com`.
`-t <site id>`	`--site <site id>`	In a multiple-site environment, specifies the site to which the command applies. For Tableau Cloud, you must include this argument if your user name is associated with more than one site. For Tableau Server, if you do not specify a site, the default site is assumed.
	`--datasource <datasource>`	The name of the data source, as published to Tableau Server or Tableau Cloud.
	`--project <projectname>`	The project to which the data source belongs. If this option is not included, the default project is assumed. If the project you want to specify is a child project nested within a project hierarchy, you must use this parameter along with the `--parent-project-path` parameter.
	`--parent-project-path path/to/project`	If a project to which the data source is published is not at the top level of a project hierarchy, use this parameter along with the `--project` parameter to specify the path to a nested project. Use the forward slash character (`/`) to delimit project levels in the hierarchy. Use the backward slash (`\`), to escape instances of forward or backward slash characters in project names. For example, for a project named Sandbox, in project Social, under top-level Marketing: `--project Sandbox --parent-project-path Marketing/Social`
`-u <username>`	`--username <username>`	Valid Tableau Server or Tableau Cloud user.
`-p "<password>"`	`--password "<password>"`	The password for the specified Tableau Server or Tableau Cloud user.
	`--proxy-username <username>`	The user name for a proxy server.
	`--proxy-password "<password>"`	The password for a proxy server.
`-c "<path and filename>"`	`--config-file "<path and filename>"`	Path and file name information for a file containing configuration options for the command. Always enclose the path in double quotation marks. For more information, see Using a config file below.

### Sample tableau addfiletoextract command `C:\Program Files\Tableau\Tableau 2022.4\bin>tableau addfiletoextract --server https://online.tableau.com --username email@domain.com --password "OurServerPwd" --site vernazza --project "New Animations" --datasource "CurrentYrOverYrStats" --file "C:\Users\user2\Documents\DataUploadFiles\AprMay.csv"` ## Using a config file You can use a plain text editor, such as Notepad or Text Edit, to create a config (configuration) file that you can use with `tableau refreshextract` or `tableau addfiletoextract`. A config file can be useful if you expect to update the same data source regularly over time. Instead of having to type the same options each time you run a command, you specify the config file. A config file also has the advantage of not exposing user names and passwords on the command line. ### Create the config file For example, say you created a file called config.txt and saved it to your Documents folder. And in the file, you included the parameter information shown below. For an extract from a hosted data source, published to Tableau Cloud, where **server** is **https://online.tableau.com**: `server=https://online.tableau.com site=vernazza username=email@domain.com password=OurPassword project=New Animations datasource=CurrentYrOverYrStats source-username=database_user@hosted_datasource_provider.com source-password=db_password` ### Reference the Config File from the Command Line After you create the config file, you run the `tableau refreshextract` or `tableau addfiletoextract` command, pointing to the config file as the only option you use on the command line, and enclosing the config file’s path in double quotation marks. The syntax is as follows: `tableau refreshextract --config-file ""` For example, to refresh the extract specified in the sample in the [Create the config file](#Create) section, you would run the following command (making sure that you are working in the bin directory for your version of Tableau Desktop): `C:\Program Files\Tableau\Tableau 2022.4\bin>tableau refreshextract --config-file "C:\Users\user1\Documents\config.txt"` ### Syntax Differences for Config Files The syntax for specifying options inside a config file differs from the syntax you use on the command line in the following ways: - Option names do not begin with dashes or hyphens. - You use an equals sign (with no spaces) to separate option names from option values. - Quotation marks are not necessary (or allowed) around values, even when they include spaces (as for the `project` option in the example shown earlier). ## Use Windows Task Scheduler to Refresh Extracts You can use Windows Task Scheduler, in combination with the Tableau Data Extract Command-Line Utility, to automate regular updates to Tableau Cloud data sources from within your corporate firewall. You can configure a task to occur once per day, week, or month, or after a specific system event. For example, run the task when the computer starts. To learn more, see the [Task Scheduler How To...](http://technet.microsoft.com/en-us/library/cc766428.aspx) page in the Microsoft TechNet library. [Skip to main content](#main-content) # Automate Tasks Using tabcmd Automate site administration tasks on your Tableau Cloud site with the tabcmd command-line utility. For example, you can use tabcmd to create or delete users, projects, and groups. The topics in this section contain information about installing and using tabcmd commands. ## Other articles in this section [Skip to main content](#main-content) # Automatically Build Views with Ask Data **Important changes for Ask Data and Metrics** Tableau's Ask Data and Metrics features were retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau AI and Tableau Pulse are reimagining the data experience.](https://www.tableau.com/blog/tableau-pulse-and-tableau-gpt) Ask Data lets you type a question in common language and instantly get a response right in Tableau. Answers come in the form of automatic data visualizations, with no need to manually drag-and-drop fields or understand the nuances of your data's structure. Ask Data lets you ask sophisticated questions naturally, with support for key analytical concepts such as time series and spatial analysis, and an understanding of conversational phrases such as "last year" and "most popular." ![Create a viz using Ask Data](/tableau/next/en-us/online/en-us/Img/askdata_1.gif) ## Navigating to Ask Data lenses Before you can query a data source with Ask Data, [a Tableau author must first create a lens](https://help.tableau.com/current/pro/desktop/en-us/ask_data_lenses.htm) that specifies the subset of data fields the lens uses. In Tableau, here are all the places where you can access an Ask Data lens: - On the All Lenses page at the top level of your Tableau Cloud or Tableau Server site. ![The Ad Campaigns and Shipping Analysis lenses for Ask Data.](/tableau/next/en-us/online/en-us/Img/ask_data_all_lenses.png) - On the Ask Data tab for a data source for which lenses have been created. ![The Super Store data source page displays with three connected lense options highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_connected_lenses.png) - In an Ask Data object on a dashboard. ![A dashboard with a map, a scatterplot, and a customer ranking list.](/tableau/next/en-us/online/en-us/Img/ask_data_in_dashboard.png) ## Ask Data from a lens page or dashboard object ### Navigate to a lens and learn more about its data 1. Navigate to a lens via the All Lenses page for your Tableau site, the Ask Data tab for a data source, or an Ask Data object on a dashboard. 2. (Optional) Under Recommended Visualizations, click an entry to quickly see visualizations the lens author has created for your organization. If the recommendations don't address your current data analysis needs, [build a query](#Build) to create your own question. 3. In the Data pane at left, briefly hover over each field to learn more about the data it contains. ![Viz with Country string highlighted in the side pane and Country details shown, including the number of unique country values and a list of country names.](/tableau/next/en-us/online/en-us/Img/ask_data_tooltip.png) In a narrower dashboard object, the Data pane may be hidden, but you can see the same information by clicking the Fields drop-down menu. ![A dashboard with the Fields menu highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_dashboard_fields.png) ### Build queries by entering text 1. Type in the box reading Search fields or values to create a visualization. ![Search field for adding fields or values to a visualization.](/tableau/next/en-us/online/en-us/Img/ask_data_ask_textbox.png) 2. As you type, Ask Data searches data fields, functions, and string values and displays results in a drop-down list. Click items in the list to add them to your current entry, shown above the search box. To automatically create a viz using the current entry, press Enter at any time. ![The Ask Data UI for search, with the autofill dropdown showing](/tableau/next/en-us/online/en-us/Img/ask_data_entity_search.png) Modifying a query by searching for fields and analytical functions A. Current entry B. Current filters C. Search box D. Returned fields E. Returned analytical functions F. Returned field values ### Build queries by adding suggested phrases Tableau will suggest phrases based on the most common queries asked in your lens and by others in your organization. When you open your lens, you'll notice suggestions that will help you get quick answers to common questions. You can add these suggestions to your query by clicking them. As you add phrases to your query, the suggestions dynamically update with more relevant phrases. The view automatically builds with each selection. ![Create a viz using Ask Data](/tableau/next/en-us/online/en-us/Img/askdata_2.gif) ### Build queries by adding fields and filters 1. Click Add Field or Add Filter. ![The Ask Data Phrase Builder with the Add Field and Add Filter options highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_click_phrasebuilder.png) 2. Click the desired field. (To narrow down a long list, first type in the Search Fields box.) ![The Ask Data Phrase Builder with the Sales measure selected for visualization.](/tableau/next/en-us/online/en-us/Img/ask_data_click_phrasebuilder_2.png) 3. Set any sub-options, such as aggregation type for a numeric field, or grouping for string and date fields. 4. To add more fields or filters, click the plus sign. ![The Ask Data Phrase Builder with the plus icon highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_click_phrasebuilder_3.png) ### See how elements of your query are applied To see how elements of your query are applied, hover over them in the text box or the interpretation above it. Words that aren't used are grayed out, helping you rephrase your query in a way that's clearer to Ask Data. ![Ask Data mapping.](/tableau/next/en-us/online/en-us/Img/ask_data_mapping.gif) ## Rephrase your question You can rephrase questions by clicking options, data fields, and filters in the user interface. ### Change the viz type If the default viz doesn't fully reveal your data, click the menu at upper right, and choose from these supported viz types: - Bar Chart - Gantt Bar - Heat Map - Histogram - Line Chart - Map - Pie Chart - Scatter - Stacked Bar Chart - Text Table - Treemap ![A viz of a map of the United States displays average profit per city, and a dropdown menu is highlighted to show the following options for changing the viz type: map, bar chart, text table, stacked bar, heat map, and treemap.](/tableau/next/en-us/online/en-us/Img/ask_data_viz_change.png) **Note:** To automatically create certain viz types, Ask Data sometimes adds fields such as "Number of Records" to your entries. ### Change fields, filters, and displayed data Ask Data gives you several ways to fine-tune how field values are displayed. - To switch the fields used for the vertical and horizontal axes, click the Swap Axes button ![Swap Axes button.](/tableau/next/en-us/online/en-us/Img/environ_swap.png) to the left of the viz selection menu: ![The swap axes icon.](/tableau/next/en-us/online/en-us/Img/ask_data_swap_axes_context.png) - To change a field, first click it in your query entry, and then click the field name below. (To change fields used in difference calculations, see [Compare differences over time](#Compare).) ![The CO2 emissions measure is highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_change_field.png) - To change a field's aggregation or grouping type (for example, from average to sum), click the field name in the text box, and then choose a different aggregation or grouping. ![Aggregation method selection options shown for sum, average, or median with average selected.](/tableau/next/en-us/online/en-us/Img/ask_data_aggtype_short.png) - For categorical filters, click values (for example, "exclude United States" in the example below) to change specific values or enter wildcard parameters. ![Ask Data filter adjustment shown with a country value excluded.](/tableau/next/en-us/online/en-us/Img/ask_data_adjust_filter.png) - To adjust a numeric range, click words such as "high" or "cheap." ![Ask Data filter adjustment shown with the profit range adjustment options.](/tableau/next/en-us/online/en-us/Img/ask_data_adjust_range.png) - To delete a field or filter, hover over it and click the X. ### Adjust date filters To adjust a date filter, click words such as "last" or "previous." Then click one of the following: - Specific Dates to enter a specific time period or date value - Relative Dates to show a date range relative to the present day - Range of Dates to enter specific start and end points Specific Dates offers some unique options in the Date Detail menu: - Time Period options show a single continuous date range - Date Value options show ranges that can repeat in multiple time periods. For example, to see combined sales performance for Q1 across multiple years, under Date Value, you would choose Quarters. ![A date filter dialog for specific dates. ](/tableau/next/en-us/online/en-us/Img/ask_data_specific_date.png) ## Compare differences over time Ask Data lets you compare time periods with phrases such as "year over year" or "quarter over quarter." The results appear as difference or percent difference table calculations in workbooks you save from Ask Data. ![Line chart showing year-over-year difference in the sum of sales over order date, with year over yeard difference highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_yoy.png) In the text box, click a difference calculation to choose other fields, aggregation methods, and time periods. ![A dialog box shows options for calculating the difference in average sales over order date or ship date.](/tableau/next/en-us/online/en-us/Img/ask_data_yoy_revise.png) ## Apply simple calculations Ask Data supports simple calculations between two measures, which you can apply using these symbols: + sums the measures \- produces the difference between them \* multiplies / divides In workbooks you save from Ask Data, these calculations don't become calculated fields but instead ad hoc calculations on the Columns, Rows, or Marks shelves. ![A viz with the Ask Data calculations option highlighted showing an equation where the sum of profit is divided by the sum of sales.](/tableau/next/en-us/online/en-us/Img/ask_data_calculations.png) ## Add sheets with other vizzes To quickly create multiple different vizzes from a lens, add sheets in Ask Data. At the bottom of the web page, do any of the following: - Click the Add Sheet icon to the right of named sheets. ![Sheet tabs labeled Sheet 1 and Sheet 2, with a button to add a new sheet.](/tableau/next/en-us/online/en-us/Img/ask_data_sheets.png) - Right-click a sheet name, and choose either Duplicate or Delete. (To rename sheets from Ask Data, you need to save them in a new workbook.) ## Share Ask Data vizzes via email, Slack, or a link You can quickly share Ask Data vizzes with anyone who has access to a lens. 1. In the upper right corner of the browser, click the Share icon. ![Share icon](/tableau/next/en-us/online/en-us/Img/ask_data_link.png) 2. Do either of the following: - To share the viz via email or Slack, enter specific user names in the text box. (Email and Slack integration must previously be configured by your Tableau administrator.) - To copy a URL you can paste into custom emails and other messages, click Copy Link. ## Send feedback to the lens owner If you have questions about the structure of a lens or how best to use it with Ask Data, you can send feedback directly to the author. (This option is enabled by default, but lens authors may disable it.) 1. To the left of the query box for Ask Data, click the Ask Data tips icon. ![Hovered over information icon showing the Ask Data tips tooltip.](/tableau/next/en-us/online/en-us/Img/ask_data_tips_button.png) 2. At the bottom of the tips dialog, click Contact the Lens Author. ## Tips for successful queries As you structure questions for Ask Data, apply these tips to get better results. - **Use keywords** — For example, instead of "I want to see all the countries that these airports are in, try "by airport and country." - **Use exact wording for field names and values** — For example, if your lens includes Airport Code, Airport Name, and Airport Region fields, specify those by name. - **See a ranked list** — Ask Data maps terms such as "best" and "worst" to Top 1 and Bottom 1, respectively. If you want to see broader rankings, use "high" and "low" instead. For example, enter "houses with low sale prices." - **Query table calculations** — In query expressions for table calculation fields, note that you can't filter, limit, or include "year over year difference." - **Surround unusually long values with quotation marks** — To analyze long field values that contain line returns, tabs, or more than ten words, surround them with quotation marks. To improve performance, Ask Data doesn't index fields of that length, or anything beyond the first 200,000 unique field values. ## Other articles in this section [Skip to main content](#main-content) # Automatically Suspend Extract Refreshes for Inactive Workbooks and Data Sources To save resources, Tableau can automatically suspend extract refresh tasks for inactive workbooks and published data sources. This feature applies to full extract refreshes only, and only applies to refresh tasks that run more frequently than weekly. It does not apply to: - incremental extract refreshes - weekly or less frequent than weekly refresh tasks - published data sources being updated by Bridge. Extract refresh tasks for an inactive workbook are suspended after the workbook has been inactive for 32 days. **Note:** Support for automatic suspension of extract refreshes for data sources is available beginning in the Tableau Cloud July 2023 release. For a workbook, if any of the following events occur, the workbook's inactivity countdown timer is reset: - Viewing the workbook sheets - Having any data-driven alert or subscription set-up on the workbook - Downloading the workbook - Moving the workbook's location or changing the owner For a published data source, any event which fetches the data from the data source will cause its inactivity countdown timer to be reset. These include: - Loading a workbook view that is connected to the data source - Visiting the data source’s Ask Data page - Tableau Desktop connecting to the data source - In web authoring, opening a workbook that uses a published data source, even without publishing the workbook - Tableau Prep flow runs (including scheduled Prep Conductor runs) that use a data source as a flow input - A Tableau Pulse metric digest or user view that is using a published data source - User-triggered "Run Now" refreshes of a data source ## Notifications Email notifications are sent to the owner of the workbook or data source at the following times: - Three days before the extract refresh schedule is suspended - When the extract refresh schedule is suspended ## Resume suspended extract refreshes Suspended extract refreshes won't automatically resume if someone uses the workbook. It must be done manually by a site administrator. To view and resume extract refreshes that were suspended: 1. Sign in to the site as an administrator and click **Tasks**. 2. Click the **Extract Refreshes** tab. 3. Select one or more items. 4. From the **Actions** menu, select **Resume**. [Skip to main content](#main-content) # Autosave Workbooks In Tableau Cloud, Autosave saves the edits that you make to a new or existing workbook while you work. ## How does Autosave work? As soon as you start making changes to a new or existing workbook, we'll start to autosave the changes to a private draft version of your workbook. When you're ready to share your changes with others, use Publish to replace the last published revision with your draft. **Note:** Autosave doesn't automatically save every type of change, such as specific types of assets. In these cases, you'll see a notification that you must Publish your workbook to save your edits. ### Workbook file size Autosave is available for workbooks that are smaller than 5MB. You must Publish to manually save changes for larger workbook files. ### What if multiple users edit the same workbook? When more than one user works on the same workbook, each user's edits are associated with and saved to their own private draft. When you begin to edit a workbook, you'll receive a notification if the version you're working from has a published revision from another user. You're then offered a choice to either discard your draft and edit the current revision or to resume editing your private draft. > [!WARNING] > > You won't receive a notification if another user publishes a revision after you've begun your edits to your private draft. If another user publishes their draft before you publish your version, your changes will overwrite theirs. You can check the workbook Revision History to see when the workbook was last published. From the revision history, you can choose to Preview a revision, or Restore a previous revision. For more information, see [Work with Content Revisions](https://help.tableau.com/current/pro/desktop/en-us/qs_revision_history.htm). If you choose to discard your draft to edit the current revision, the draft and associated asset files that were uploaded are deleted. To retain assets and edits that you made in your private draft, you can manually incorporate the edits of other users into your private draft. Then, publish the workbook with both sets of changes. ### Permissions requirement Autosave is available to Creators and Explorers (can publish) with web editing capabilities at the workbook level. If a user has web editing capabilities at the view level only, Autosave won't be turned on. [Skip to main content](#main-content) # Background Tasks for Extracts The Background Tasks for Extracts view displays extract-specific tasks that run on the server. This view gives you a snapshot of Tableau Cloud activity over the past 30 days. ![The time-series graph displays the number of extracts run on the server over the past seven days, while the bar chart illustrates the daily count of successful and failed extracts.](/tableau/next/en-us/online/en-us/Img/adminview_extract.png) ## Understand this view To better understand this pre-built admin view, make note of the following: - The table, "What Extracts Ran on this Server," lists the extracts that ran in the time period specified in Timeline. - You can click Success or Error to filter the table based on status. - You can also click a specific task to update the "How Much Time did Extracts Take" graph for the selected task. - The table, "How Many Extracts Succeeded or Failed," updates for the status (success or failure) of the task, but the count of extracts that succeeded or failed does not change. ### Status Tasks can have a status of success or error.

Icon	Description
	Error—Server was unable to complete the task.
	Success—Server completed the task.

### See details about a task For details on about the task, use your mouse to hover over the success or error icon. ![Information on the data extract status.](/tableau/next/en-us/online/en-us/Img/adminview_extract_details.png) #### Errors in task details If a refresh task reaches the timeout limit, you might see one of the following errors in the task details: - _The query time resource limit (7200 seconds) was exceeded._ - _com.tableau.nativeapi.dll.TableauCancelException: Operation cancelled._ - _The query time resource limit (8100 seconds) was exceeded._ For more information about the timeout limit for refresh tasks and suggestions for resolving these errors, see [Time limit for extract refreshes](https://help.tableau.com/v0.0/online/en-us/schedule_add.htm#timeout). [Skip to main content](#main-content) # Background Tasks for Non Extracts The Background Tasks for Non Extracts view displays tasks that the server runs that are not related to standard Online extract refreshes. For example, Bridge Refresh jobs, edited OAuth connections, subscription notifications, and so on. This view gives you a snapshot of Tableau Cloud activity over the past 30 days. A table lists the tasks that ran in the time range specified. Click Success or Error to filter the table based on status. Select a specific task in the How Many Tasks Succeeded or Failed on this Site table to update the What Background Tasks Ran on this Site graph for the selected task. Tasks can have a status of success or error. For details about the task, use your mouse to hover over the success or error icon.

Icon	Description
	Error—Server was unable to complete the task.
	Success—Server completed the task.

Details that you can see about the task are its ID, status, priority, when it was created, started and completed. You can also see its runtime: the total run time of the background job, which includes the run time of the job plus background job overhead such as initialization and cleanup. You can also see which backgrounder the job is running on. [Skip to main content](#main-content) # Billing for Inbound Private Connect ## Usage and Billing Private connection data usage is metered and billed based on the volume of data that crosses the private connection. AWS publishes endpoint usage metrics to CloudWatch, which tracks incoming and outgoing traffic usage across your VPC endpoint. Tableau bills based on this aggregated traffic. For information on usage or pricing, or if you're interested in adding Private Connect to your environment, contact your Tableau account manager. [Skip to main content](#main-content) # Bridge Extracts The Bridge Extracts admin view captures the last 30-days' worth of refresh activity by Tableau Bridge. ![A line chart displays extract refreshes over time, accompanied by a second chart depicting the number of extract failures by reason.](/tableau/next/en-us/online/en-us/Img/adminview_bridge_extracts.png) This pre-built admin view can help answer the following questions the site admin might have about refreshes performed by one or all of the Bridge clients registered to the site: - **Error rate:** How often are refreshes succeeding and failing? If refreshes are failing, why? - **Requests made:** How many refreshes are scheduled? - **Time-elapsed:** How long are refreshes taking? - **Saturation:** How busy is each client? You can filter the view by the client name, when the extract data source was created, the extract data source name, and the duration of the refresh. ### Notes about this view - If you don't see any data in the admin view, verify that you have a Bridge client associated with your site. Alternatively, change the value for the "Extract created" filter in the upper-right corner of the view. - If you don't see the duration-based data that you expect in the view, clear the "Avg. Duration of refresh (seconds)" filter by clicking the Show All Values (![A filter icon with a red X mark.](/tableau/next/en-us/online/en-us/Img/adminview_show_all_values.png)) icon. - In the "Common extract refresh failures" table, hover over each bar to see the error and the error details. If there's more than one data source associated with the error, an asterisk (\*) shows instead. - In some cases, data on the _Bridge Tasks for Extracts_ view is missing or incomplete. This is because the view doesn't include certain jobs, such as canceled or failed jobs. Use _Background Tasks for Extracts_ to view extract-specific tasks. [Skip to main content](#main-content) # Bridge Security Tableau Bridge applies the following security designs: - All communication is initiated from behind the private network firewall and therefore does not require you to manage additional exceptions. - Data in transit, between Tableau Bridge and Tableau Cloud, is encrypted. - Database credentials are stored on the computer using Windows credentials manager if the data source or virtual connection is set up to use Bridge legacy schedules. For refresh schedules, the credentials are passed on to the client that is selected to perform the refresh. You can find more details about Bridge security in the sections below. ## Transmission security **Note**: Tableau Bridge uses port 443 to make outbound internet requests to Tableau Cloud and port 80 for outbound requests for certificate validation. Tableau Bridge initiates a secure, bidirectional communication to your Tableau Cloud environment using a WebSocket (wss://) connection. The WebSocket connection is persistent and coordinates the data upload between Bridge and Tableau Cloud. All users are authenticated and authorized before the connection is made, and all inputs are validated to be from trusted sources within Tableau Cloud. ## Authentication There are two primary authentication points for Bridge: Tableau Cloud and private network data. If the client is unlinked or you upgrade to a new version, you don't need to re-login. In this scenario, Bridge uses the existing token that is saved locally in the Windows credentials store. If the client is shut down, or the Exit option on the Windows task bar is used, you are required to re-login and provide credentials. This creates a new refresh token which is saved to the Windows credentials store. You can check the tokens in the credentials manager and check the Generic credentials for _TABLEAU\_CONNECTIONS\_online.tableau.com_. ### Tableau Cloud To connect to Tableau Cloud, a users Tableau Cloud credentials are entered through the Bridge client. After 1) the credentials are entered, 2) an authorization token is returned by Tableau Cloud. The 3) token is stored on the computer where the client is running using the credentials manager of the Windows operating system. Bridge uses the token to perform various tasks such as downloading the refresh schedule information for an extract. ![A diagram illustrates the journey of user credentials from a machine to Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/bridge_security_auth_cloud_overview_sz.png) ### Private network data To access private network data, some data sources or virtual connections require authentication using database credentials. Depending on the connection type of the content, the client handles database credentials in one of the following ways: - For **live connections and extract connections that use refresh schedules**, database credentials are sent at the time of the request and use a TLS 1.2 connection. - For **extract connections that use Bridge legacy schedules**, if the data source requires database credentials, these credentials must be entered in the client directly. The database credentials are stored on the computer using the credentials manager of the Windows operating system. The client sends the database credentials to the database, which is also behind the private network firewall, at the scheduled refresh time. The client supports domain-based security (Active Directory) and user name/password credentials to access private network data. ## Changes to private network firewall The Bridge client requires no changes to the private network firewall. The client achieves this by making only outbound connections to Tableau Cloud. To allow outbound connections, the client uses the following protocols depending on the connection type used by the content: - For **live connections and extract connections that use refresh schedules**, secure WebSockets (wss://). - For **extract connections that use Bridge legacy schedules**, HTTP Secure (https://). ## Access to private network data Connections to private network data are initiated by the Bridge client on behalf of Tableau Cloud. The process by which the connection is initiated depends on the content type and connection type. - For **data sources with live connections or virtual connections**, the client 1) establishes a persistent connection to a Tableau Bridge service, which is the part of the client that resides on Tableau Cloud, using secure WebSockets (wss://). The client then waits for a response from Tableau Cloud before 2) initiating a live query to the private network data. The client 3) passes the query to the private network data, then 4) returns the private network data using 5) the same persistent connection. ![A diagram of the connection process between the Tableau Bridge client and the Tableau Bridge service for private network data access.](/tableau/next/en-us/online/en-us/Img/bridge_security_live_cloud_sz.png) - For **data sources with extract connections that use refresh schedules**, the client 1) establishes a persistent connection to a Tableau Bridge service, which is the part of the client that resides on Tableau Cloud, using secure WebSockets (wss://). The client then waits for a request from Tableau Cloud for new refresh schedules. When the client receives the requests, 2) the client contacts Tableau Cloud using a secure connection (https://) for the data source (.tds) files. 3/4) Then the client connects to the private network data using the embedded credentials that are included in the job request. The client 5) creates an extract of the data and then 6) republishes the extract to Tableau Cloud using the Tableau Bridge service. Steps 2-6 can be occurring in parallel to allow multiple refresh requests to happen. ![A diagram of the connection between a Tableau Bridge client, Tableau Cloud, and a private network database is displayed.](/tableau/next/en-us/online/en-us/Img/bridge_security_online_cloud-sz.png) - For **data sources with extract connections that use Bridge legacy schedules**, the client 1) contacts Tableau Cloud using a secure connection (https://) for new refresh schedules and data source (.tds) files. If 2) this information is available, at the scheduled time, 3/4) the client connects to the private network data using the stored credentials. The client 5) creates an extract of the data and then 6) republishes the extract to Tableau Cloud using a Tableau Bridge service. The Tableau Bridge service is a part of the client that resides on Tableau Cloud. ![A diagram of a Tableau Bridge client interacting with a data network.](/tableau/next/en-us/online/en-us/Img/bridge_security_extract_cloud_sz.png) ## Forward proxy filtering To ensure that your data is transmitted to Tableau Cloud only, we recommend implementing domain-based filtering on outbound connections (forward proxy filtering) from the Bridge client. After the initial outbound connection, communication is bidirectional. Tableau Bridge doesn't support pass-through or manual proxy authentication. The following list contains the partially qualified domain names that Bridge uses for outbound connections: - **\*.online.tableau.com** - **\*.compute-1.amazonaws.com**, Amazon VPC's public DNS hostname, which takes the form ec2-.compute-1.amazonaws.com, for the us-east-1 region - **\*.compute.amazonaws.com**, Amazon VPC's public DNS hostname, which takes the form ec2-.compute.amazonaws.com, for all other regions (outside of us-east-1) - (Optional) **\*.salesforce.com**, **id.tableau.com**, and **identity.idp.tableau.com** if multi-factor authentication (MFA) with Tableau authentication (Tableau with MFA) is enabled for your site and your environment is using proxies that prevent clients from accessing other necessary services - (Optional) **crash-artifacts-747369.s3.amazonaws.com**, used for receiving crash dump reports - (Optional) **s3-us-west-2-w.amazonaws.com**, used for receiving crash dump reports - (Optional) **s3-w-a.us-west-2.amazonaws.com**, used for receiving crash dump reports - (Optional) **bam.nr-data.net**, used for New Relic's web analytic platforms - (Optional) **js-agent.newrelic.com**, sends performance data to New Relic [Skip to main content](#main-content) # Bridge Site Capacity A site has a 1 TB storage limit for workbooks and extracts. Additional capacity is available with non-standard editions or add-on. An individual workbook or data source (live or extract) published to your site can have an optimal maximum size of 25 GB. Tableau Bridge can have an impact on the site capacity. - Extracts generated by Tableau Bridge do have an impact on the site storage capacity. - Virtual connections and embedded data sources that are extracted through Bridge also have an impact on the site capacity. This is because the data is processed through Tableau Cloud backgrounder.

	Capacity type	Bridge impact on site capacity?

Storage	Site	Yes (extracts), see Storage.
Storage	Individual workbook, published data source, or flow size	Yes, see Storage.

Extract published data sources with Bridge	Daily refreshes	No
	Concurrent refreshes	No
	Individual refresh runtime	No

Virtual connections and embedded data sources with Bridge	Daily refreshes	Yes, see Extracts - daily, runtime, and memory usage.
	Concurrent refreshes	Yes, see Extract concurrency.
	Individual refresh runtime	Yes, see Extracts - daily, runtime, and memory usage.

[Skip to main content](#main-content) # Build a Multi-Fact Relationship Data Model Analysis often involves bringing together tables of data that don't have a direct relationship to each other yet both relate to the same, common information such as date or location. This type of analysis is sometimes referred to as multi-fact analysis with shared dimensions. To perform this kind of analysis in Tableau, create a data source that uses multiple base tables connected by shared tables. - _Base tables_ are the left-most tables in the data model on the Data Source tab. For guidance on how to determine which tables to use as base tables, see [When to Use a Multi-fact Relationship Model](https://help.tableau.com/v0.0/online/en-us/datasource_mfr_when_to_use.htm). - _Shared tables_ are downstream tables with multiple incoming relationships. These tables contain fields that can stitch together unrelated fields during analysis in a viz. Date and Location are examples of commonly shared tables. ## Build the model Building a multi-fact relationship data model is essentially the same as creating any other data source that uses relationships, but with two additional pieces: additional base tables and multiple incoming relationships to shared tables. 1. [Connect to your data](https://help.tableau.com/current/pro/desktop/en-us/basicconnectoverview.htm). You can use [multiple data connections](https://help.tableau.com/current/pro/desktop/en-us/datasource_plan.htm#tableau-data-sources) if your tables aren't all in the same database. 2. Drag a table to the canvas to create the first base table. 3. Drag another table from the left pane to the New Base Table drop area. ![the data modeling canvas with an existing base table and a drop area for New Base Table](/tableau/next/en-us/online/en-us/Img/mfr_new_base_table.png) Tableau shows a warning that you're building a data model with multiple base tables. We recommend that you only set up a multiple base table model if your data needs it. Otherwise, use a single base table model to avoid the complexities that come with a multiple base table model. ![a data model with two base tables, one with a warning for Multiple base tables](/tableau/next/en-us/online/en-us/Img/mfr_multi_base_table_warning.png) 4. Drag another field to the canvas and relate it to one of the base tables. [Configure each relationship if necessary](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm#create-and-define-relationships). ![a downstream table being added to the data model](/tableau/next/en-us/online/en-us/Img/mfr_build_downstream.png) 5. Hover over the not-yet-related base table to bring up a plus sign (affectionately known as a "meatball"). ![the Clubs base table with a cursor over it and the plus sign "meatball" showing](/tableau/next/en-us/online/en-us/Img/mfr_build_meatball_base.png) 6. Drag the plus sign icon to the shared table to create a new incoming relationship (also known as a "noodle"). ![a meatball dragging a new noodle to an existing downstream table](/tableau/next/en-us/online/en-us/Img/mfr_build_meatball.png) 7. _Optional:_ Continue adding downstream tables and base tables. Click and drag the plus sign icon to build shared tables as needed. **Note**: Rather than starting with the base tables, you can also build a single base table model first and add more base tables later. ## Explore the model A data model with multiple base tables is built with relationships, but not all tables are related to each other to the same degree. Each base table defines a _tree_, which contains every table related to that base table, either directly related or downstream from a related table. Shared tables exist in multiple trees. For more information about degrees of relatedness, see [About Multi-fact Relationship Data Models](https://help.tableau.com/v0.0/online/en-us/datasource_mfr_multiple_base_tables.htm). When you view a model with multiple base tables, there are various options for exploring and managing the data model. These options are especially useful when a data model is complex. ![a data model with four base tables and multiple shared tables as well as unshared downstream tables](/tableau/next/en-us/online/en-us/Img/mfr_build_complex_model.png) An example of a complex data model with four base tables, multiple shared tables, and downstream tables. The downstream tables are both shared and unshared between the base tables. 2024.2 introduced some new layout details for the data model. In a multi-fact relationship data model, relationships bundle together to help track how many incoming relationships a table has. Shared tables (and downstream shared tables) have a bolder outline than tables that aren't shared. ### Terminology Tables in a multiple base table data model have specific roles. Base tables and shared tables are the only tables that must exist in a multi-fact relationship data model. (Without more than one base table, it's not a multi-fact relationship data model. Without a shared table connecting the base tables, it's not a valid data model.) Because of the often complex nature of these models, it's useful to have a shared terminology: - _Base tables_ are on the far left and have no incoming relationships. - In the example, Inventory, Marketing, Sales, and Support are base tables. - _Sub-base tables_ are between a base table and a shared table. - In the example, Parts is a sub-base table. - _Shared tables_ have more than one incoming relationship. - In the example, Products, Dates, Customer, and Supplier are shared tables. - _Downstream shared tables_ have exactly one incoming relationship and have a shared table somewhere upstream of them. - In the example, Subcategory and Category are downstream shared tables. - _Downstream unshared tables_ have exactly one incoming relationship and have no shared tables upstream of them. - In the example, there are no downstream unshared tables. ![A data model laying out the terms base table, sub-base table, downstream unshared table, shared table, and downstream shared table.](/tableau/next/en-us/online/en-us/Img/mfr_terminology.png) Test your understanding: identify the types of tables in the example data source ![a data model with four base tables and multiple shared tables as well as unshared downstream tables](/tableau/next/en-us/online/en-us/Img/mfr_build_complex_model.png) - **Base tables**: Inventory, Marketing, Sales, and Support - **Sub-base table:** Parts - **Shared tables:** Products, Dates, Customer, and Supplier - **Downstream shared tables:** Subcategory and Category - **Downstream unshared tables:** none ### Identify a relationship tree Hover over a table to highlight the tables it's related to. Tableau emphasizes the tree for that table and deemphasizes unrelated tables. ![the complex model, with one base table's tree highlighted and the other tables dimmed](/tableau/next/en-us/online/en-us/Img/mfr_build_highlightedtree.png) The Marketing base table tree consists of two shared tables, Dates and Products, and downstream shared tables Subcategory and category. ### View relationship details Hover over a relationship or bundle of relationships to see the details in a tooltip. ![A triple noodle bundle, with a tooltip that has a row for each relationship's details](/tableau/next/en-us/online/en-us/Img/mfr_build_noodle_bundle.png) The incoming relationships to the Products table include three individual relationships to the Inventory, Marketing, and Sales base tables. ### Select a relationship When a relationship is selected, it's's highlighted in blue in the canvas and its details appear in the Table Details pane. The Table Details pane is where you can [inspect or modify the relationship clause](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm#create-a-relationship). There are multiple ways to select a relationship: - Click a relationship line (noodle) in the canvas. Every relationship has a clickable zone that selects just that noodle. - Right-click or control-click a table in the canvas to open its menu. Select the Select Relationship option and choose which table's relationship you want. - Click a bundle of relationships in the canvas to bring up a persistent tooltip (hovering over a bundle brings up the tooltip, click to make it persist). Then select a row in the tooltip details to highlight that relationship in the model. - Open the menu in the toolbar of the Table Details pane and select the desired relationship. You can also use this menu to select a specific table to see its preview in the pane. ![the menu in the Table Details pane](/tableau/next/en-us/online/en-us/Img/mfr_build_table_details_menu.png) ### Swap with base table Intermediate tables in a relationship between a base table and shared tables give you the option to swap the downstream table with the base table. This is purely a visual change to aid with conceptual understanding and doesn't change the structure of the data model. Right-click or control-click a downstream table and select Swap with base table (table name). The swap option is also only present on the downstream table and not the base table. The swap option isn't available for tables which would alter the data model if swapped, such as shared tables or downstream shared tables. Only downstream unshared tables or sub-base tables can be swapped with base tables. #### _Example_ In this example, the **Parlor Info** and the **Ice Cream Sales** tables can be swapped without changing the data model's fundamental structure. No other tables can be swapped. - Ice Cream Sales is related to both Parlor Info and the shared Date table. - Parlor Info is related to both Ice Cream Sales and the shared Location table. - Weather is related to both the shared tables of Date and Location. These two models are conceptually equivalent: ![two versions of equivalent data models where a base table and its unshared downstream table are switched](/tableau/next/en-us/online/en-us/Img/mfr_swapbase_icecream.png) ### Collapse a base table You can also collapse a relationship path, or tree, to just its base table to simplify the view of the data model temporarily. Click the Collapse ![](/tableau/next/en-us/online/en-us/Img/mfr_icon_collapse.png) or Expand ![](/tableau/next/en-us/online/en-us/Img/mfr_icon_expand.png) buttons on a base table to collapse or expand its entire tree. Alternatively, right-click or ctrl-click on a downstream table and select Collapse this path or Collapse other paths. This option isn't available on shared tables or tables downstream of shared tables. Collapsing a tree to its base table is purely visual and won't trigger the Unrelated Tables alert. A collapsed path is indicated by a base table with a stacked table and an Expand button. Collapsing affects all tables and relationships that are relevant only to that tree, so tables that are shared with an uncollapsed path aren't hidden. Use the Expand ![](/tableau/next/en-us/online/en-us/Img/mfr_icon_expand.png) button to re-open the base table and everything in the tree. ![the support base table's tree being collapsed and expanded](/tableau/next/en-us/online/en-us/Img/mfr_build_collapsetree_gif.gif) ## Troubleshooting ### Create a single data source All tables must be related to the entire data source in some way. If there are any tables that aren't related to the overall data model, an alert appears. The alert remains until no tables or trees are fully separate from the rest of the data model. When the alert is active, the data source can't be published and you can't use the data source in an analysis. You can open the alert and set Visually Separate Unrelated Tables to identify which tables triggered the alert. This option is useful when you have a complex model and need to identify which table or tables aren't yet related to the rest of the data model. #### _Example_ In the steps under [Build a model](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_build.htm#Build), an alert appears in Step 4 before a relationship is added to connect the second base table. ![An unrelated table alert message](/tableau/next/en-us/online/en-us/Img/mfr_build_unrelated_alert.png) Setting Visually Separate Unrelated Tables to On moves the table **Clubs** underneath the Unrelated Tables line. Relating **Clubs** to **Students** resolves the alert. ![A data model with an unrelated table below a dotted red line labled Unrelated Tables](/tableau/next/en-us/online/en-us/Img/mfr_build_visuallyseparate.png) #### Resolve a cycle Even if some tables aren't directly related to each other, the entire data model must be a cohesive whole. In this example, each base table defines a tree but there's no shared table connecting them. This isn't a valid model for analysis. ![A data model with two base tables whose distinct trees don't overlap](/tableau/next/en-us/online/en-us/Img/mfr_build_unrelated1.png) The two groups of related tables need to be combined via a shared table... ![The same data model, now connectted with a shared table](/tableau/next/en-us/online/en-us/Img/mfr_build_unrelated2.png) ...or the data model needs to be created as two separate data sources. ![The same data model, broken into two data sources](/tableau/next/en-us/online/en-us/Img/mfr_build_unrelated3.png) ### Data model restrictions Some relationship paths between tables are not supported in a multi-base table model. If you're unable to drop the meatball when you attempt to create a second incoming relationship on a table, make sure the structure you're trying to create is supported in Tableau. Examples of unsupported models include: #### Cycles Cycles—where there's more than one relationship path from an upstream table to the same downstream table—are not supported. This unsupported structure is sometimes called a bowtie. To model this kind of relationship between tables in Tableau, use multiple base tables instead of a bowtie by converting the downstream table to another base table. ![a diagram of a bowtie and another diagram with the downstream table changed to an additional base table](/tableau/next/en-us/online/en-us/Img/mfr_build_bowtie_tableauified.png) The data model must be a _directed acyclical graph_. This means every incoming relationship to a table must be traceable upstream to a different base table.

Not supported. Table X has two incoming relationships that are both from tables downstream from Base Table A	Supported. Tables S and T both have multiple incoming relationships, but each one is from a different base table.	Supported. Although it may visually look like there's a cycle, the incoming relationships for both Table S and Table T can be traced back to different base tables.

#### Nested shared tables Nested shared tables are not supported. Any tables downstream from a shared table (a table with multiple incoming relationships) can only have one incoming relationship. ![unsupported model with a nested shared table](/tableau/next/en-us/online/en-us/Img/mfr_build_nestedshared.png) Not supported. Table T is downstream from a shared table and can't receive an additional incoming relationship. [Skip to main content](#main-content) # Buy More Licenses You can scale your Tableau Cloud deployment at any time by purchasing additional licenses through the Tableau Webstore. ## What accounts are eligible? To buy more licenses through the Webstore, you must meet the following requirements: - [Customer Portal](https://kb.tableau.com/articles/howto/getting-started-with-the-customer-portal) account administrator or [Tableau Cloud Manager](https://help.tableau.com/current/online/en-us/cloud_manager_intro.htm) cloud administrator - Not a Government account - Not licensed with [Embedded Analytics](https://help.tableau.com/v0.0/online/en-us/license_product_keys.htm#embedding) If you are not currently eligible, [contact our sales team](https://www.tableau.com/about/contact) to complete a transaction. ## Access the Tableau Webstore Complete the following steps to redirect and buy more licenses through the Tableau Webstore: 1. Sign in to one of the following locations as an administrator: - For site administrators, sign in to a Tableau Cloud site and select Users. - For cloud administrators, sign in to Tableau Cloud Manager and select Users. 2. On the Users page, select Buy More Licenses, and then Go to Webstore. The Webstore opens in a separate browser tab. ![A dialog box prompting you to confirm your departure from Tableau Online to the webstore where you can buy more licenses.](/tableau/next/en-us/online/en-us/Img/to_buy_more_licenses.png) 3. Sign in to the Webstore using your Tableau account. If you have previously authenticated with your [Tableau account](https://identity.idp.tableau.com/login), you aren't prompted to sign in again. ![The Tableau sign-in page. ](/tableau/next/en-us/online/en-us/Img/to_customer_portal_login.png) 4. On the Webstore, select the number of **Creator**, **Explorer**, and **Viewer** licenses to add to your deployment. ![Form for adding new seats to your Tableau deployment.](/tableau/next/en-us/online/en-us/Img/to_buy_more_licenses_selection.png) 5. Select Add to Current Deployment and continue to the Contact & Billing and Summary & Payment sections. An order confirmation email is sent shortly after payment. If you don’t see an email from Tableau, be sure to check your spam folder. The new licenses are available on the site and Tableau Cloud Manager after the transaction is processed. **Note:** If a site role limit is set, cloud administrators must update site role limits in Tableau Cloud Manager to increase the maximum number of licenses for the site. For more information, see [Manage Site Role Limits](https://help.tableau.com/v0.0/online/en-us/cloud_manager_site_role_limit.htm). [Skip to main content](#main-content) # Capacity Managed in Tableau Cloud Manager Capacity management is a collection of capabilities found on the Capacities page in Tableau Cloud Manager (TCM). Capacity management in TCM gives cloud administrators greater visibility and control over how resources are distributed across the sites on a tenant. ![Image of TCM's Capacities page.](/tableau/next/en-us/online/en-us/Img/tcm_ccm_homepage.png) Starting from May 2026 (Tableau 2026.1), capacity is a combination of fixed site limits and site limits that are configurable at the tenant-level. Certain capabilities are consolidated into tenant-level limits, referred to as cloud limits, that form a shared pool of capacity. As a cloud administrator, you can draw from this pool to allocate capacity to sites that need it the most. The following capacity types can be managed through in TCM: - [Extract concurrency](#extracts) - [Extract APIs](#extract_apis) - [Subscription concurrency](#subscriptions) - [Publish APIs](#publish_apis) - [Flow concurrency](#flows) - [VizQL Data Service APIs](#vds_apis) - [Visualizations](#visualizations) (if licensed with capacity-based model) - [Pulse digests](#pulse_digests) (if licensed with capacity-based model) **Notes:** - The type of capacity that you can manage in TCM is subject to change as we evolve our infrastructure. - Capacity can be increased by the Tableau Cloud edition, number of Creator licenses; or by enabling the capacity-based license model for viewers. This topic covers the tenant-level capacities that are configurable and can be allocated across the sites on the tenant by using TCM. For capacities with fixed limits, optimizing for those limits, and troubleshooting suggestions, see [Capacity Set at the Site](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity_site.htm). ### Benefits of managing capacity in TCM Capacity management in TCM provides the following benefits: - **Proactive visibility.** See tenant-level and site capacity limits. Use consumption data and highlights to take timely action when sites are approaching or reaching limits to reduce impacts on your users. - **Flexibility to redistribute resources.** Move tenant-level capacity between sites based on usage and business need. - **Centralized administration.** Manage allocation at the tenant level in TCM. You don't need to be a site admin on a specific site to view or adjust capacity. - **Support growth.** Reserve capacity for new sites, seasonal spikes, or other periods of high demand. ## Capacity in TCM The Capacities page displays three categories of information: - **Cloud limits:** Cloud limits is the pool of capacity for the sites on a tenant. The capacity values represent the maximum capacity available. - **Default site limits:** Default site limits are the capacity allocated to all new sites and sites whose limits haven't been customized. - **Resource allocation and usage:** Dashboard to monitor resource allocation and consumption across sites on the tenant. Consumption is represented by concurrency usage or rate-limit usage depending on the capacity type and highlighted by visual indicators when limits reach certain thresholds. For more information, see [Capacity Metrics in Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity_metrics.htm). **Note:** Rate-limited usage capacity in TCM is measured on an hourly basis with the exception of Pulse digests (if available), which are measured on a daily basis. ### Extract concurrency A tenant comes with designated capacity for extract refresh jobs. Extract capacity is the number of concurrent extract refresh jobs a site on the tenant can run at one time. Depending on available system resources, the wait time (that is, the time before a job starts) is adjusted to start a job within 15 minutes or less from the scheduled start time. Jobs that count toward extract capacity include: - Scheduled refreshes - Manual refreshes - Extract creation - Certain command line or API calls that trigger refreshes, including appending data incrementally For extract refresh job runtime and memory size limits, see [Extracts - daily, runtime, and memory usage](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity_site.htm#extracts). **Note:** Tableau Bridge refreshes of embedded extracts and virtual connections impact a site's extract concurrency capacity. For more information about which capacity types are impacted by Tableau Bridge, see [Bridge Site Capacity](https://help.tableau.com/v0.0/online/en-us/to_bridge_site_capacity.htm) ### Extract APIs A tenant comes with designated capacity for extract refresh API calls. Extract API capacity is the number of calls that can be made on a site during a one-hour period. Calls that count toward extract API capacity include: - **Tableau REST API:** [Run Extract Refresh Task](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#run_extract_refresh_task), [Update Data Source Now](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#update_data_source_now), and [Update Workbook Now](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#update_workbook_now) - **tabcmd:** [refreshextracts](https://help.tableau.com/current/online/en-us/tabcmd_cmd.htm#refreshextracts-workbookname-or-datasourcename) - [Tableau Client (Python) library](https://tableau.github.io/server-client-python/docs/)**:** calls to initiate extract refresh jobs **Note:** If the number of calls exceed the API or command line calls capacity described above, you see one of the following errors: _Unknown 429_ or _ApiCallError: 429000: Too Many Requests – Too many requests for 'api.rest.refresh\_extracts'. Please retry after 146 second(s)_. ### Subscription concurrency A tenant comes with designated capacity for subscription jobs. Subscriptions capacity is the number of concurrent subscription jobs a site can run at one time. Depending on available system resources, the wait time (that is, the time before a job starts) is adjusted to start a job within 15 minutes or less from the scheduled start time. Jobs that count toward subscription capacity include generating emails from subscriptions created through Tableau Cloud directly or API calls that generate the email subscriptions. For subscription job runtime and email size limits, see [Subscriptions - runtime and email size](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity_site.htm#subscriptions). ### Publish APIs A tenant comes with designated capacity for publish API calls to initiate publish and update jobs. Calls that count toward publish API capacity include: - **Tableau REST API:** [Publish Workbook](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#publish_workbook), [Publish Data Source](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#publish_data_source), [Update Workbook](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#update_workbook), [Update Data Source](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#update_data_source), [Tableau Prep flow runs](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_flow.htm) - **tabcmd:** [publish](https://help.tableau.com/current/online/en-us/tabcmd_cmd.htm#publish-filenametwbx-filenametdsx-or-filenamehyper) - [Tableau Client (Python) library](https://tableau.github.io/server-client-python/docs/): Calls that initiate publish or update jobs for workbooks and data sources ### Flow concurrency Flows capacity is measured in resource blocks. Each resource block represents the number of concurrent flow jobs that can run at one time. A site has a default capacity of 1 concurrent flow job, which is the equivalent to having one Resource Block. Depending on available system resources, the wait time (that is, the time before a job starts) is adjusted to start a job within 15 minutes or less from the scheduled start time. **Notes:** - Capacity management in TCM displays both concurrency usage and configurable limits. Flow concurrency usage capacity includes _all_ flow jobs on a site (both default Resource Blocks for sites and purchased Resource Blocks for the tenant). However, Additional flow concurrency limit includes only purchased Resource Blocks and capacity that can be moved between sites. - The default Resource Block for a site is not viewable or moveable between sites in TCM. For user request rates, flow job runtime, and memory usage limits, see [Flows - user requests, daily, runtime, and memory usage](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity_site.htm#flows). ### VizQL Data Service APIs A tenant comes with designated capacity for calls to the [VizQL Data Service (VDS) API](https://help.tableau.com/current/api/vizql-data-service/en-us/index.html). VDS API capacity is the number of VDS API calls that can be made on site during an hourly period. **Notes:** - If your organization uses usage-based licensing (UBL), this capacity won't appear in TCM. This is because your account is managed by usage, not by a configurable capacity limit. - If your organization uses capacity-based licensing, VDS API capacity is determined by the Visualizations capacity. ### Visualizations Visualization capacity in TCM, available through capacity-based license model, is the tenant-wide number of requests that can run on a site during an hourly period to load dashboards and views, refresh view data, make calls to the [VizQL Data Service (VDS) APIs](https://help.tableau.com/current/api/vizql-data-service/en-us/index.html), explore Pulse metrics, and make calls to the [Pulse APIs](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_pulse.htm). **Notes:** - While a capacity-based licensing model provides a flexible tenant-wide request pool across your sites, each user is still subject to 600 requests per hour. The user request rate is fixed at the site level and not configurable in TCM. - If a capacity-based license model has not been enabled, visualization capacity is fixed at the site level and not configurable in TCM. For more information, see [Visualizations - timeout, request rate, memory usage](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity_site.htm#visualizations). - If a capacity-based license model has not been enabled, VDS API capacity is tracked as a standalone capacity type. For more information, see [VizQL Data Service APIs](#vds_apis). ### Pulse digests Pulse digests capacity in TCM, available through capacity-based license model, is the number of scheduled digests that can be generated and sent on a site during a 24-hour period. **Note:** Pulse digests don't have capacity limits in role-based usage models. ## Manage capacity Click the drop-down arrow button below to expand each section. ### Changes introduced by capacity management Click the drop-down arrow button to expand the section and see the changes introduced by capacity management in TCM. #### Site allocation changes Before capacity management, sites had a fixed set of capacity limits. Starting in May 2026 (Tableau 2026.1), certain capacity limits are consolidated into tenant-level limits (also referred to as cloud limits), providing cloud administrators the flexibility to allocate capacity between sites on the tenant or hold capacity until it's needed for existing or new sites. #### Extract concurrency changes Before capacity management, sites with the Advanced Management add-on, or licensed with Tableau+ or Enterprise edition, were created with 25 concurrent extract refreshes. Starting in May 2026 (Tableau 2026.1), all new sites are provisioned with a default limit of 10 concurrent extract refreshes. Cloud administrators can change this default. #### Flow concurrency changes Before capacity management, flow resource blocks were automatically provisioned to sites. Starting in May 2026 (Tableau 2026.1), flow resource blocks are allocated at the tenant level. Cloud administrators can allocate purchased resource blocks to the site where they're needed. **Notes:** - Capacities page only allows purchased resource block limits to be configurable. - Each site receives one Resource Block that can't be moved to other sites on the tenant. #### Licensing model addition To increase capacity for Tableau Cloud, you can enable the capacity-based license model that was introduced in July 2026 (Tableau 2026.2). The capacity-based license model, Capacity-based Viewer Blocks, replaces the edition's default capacity for the following capacity types: extracts, extract APIs, publish APIs, and subscriptions. Under the new model, you also get capacity for scheduled Pulse digests and additional visualizations capacity.

Capacity type	Usage-based	Capacity-based
Extracts	Standard: Up to 15 concurrent jobs per tenant Enterprise: Up to 25 concurrent jobs with 1 additional job per 10 Creator licenses per tenant Cloud+, Tableau+: Up to 50 jobs with 1 additional job for every 5 Creator licenses per tenant	15 concurrent jobs per tenant
Extract APIs	Standard: 120 calls per hour Enterprise: 240 calls with 1 additional call for every Creator license per hour per tenant Cloud+, Tableau+: 480 calls with 2 additional calls for every 1 Creator license per hour per tenant	1,000 calls per hour per tenant
Flows	Standard: 1 resource block per site Enterprise, Cloud+, Tableau+: Dependent on purchased resource blocks per tenant	n/a
Publish APIs	Standard: 800 calls per hour per tenant Enterprise: 1,200 calls with 1 additional call for every 2 Creator licenses per hour per tenant Cloud+, Tableau+: 2,400 calls with 1 additional call for every 1 Creator license per hour per tenant	1,000 calls per hour per tenant
Pulse digests	n/a	1,000 calls per day per tenant
Subscriptions	Standard: Up to 20 concurrent jobs per tenant Enterprise: Up to 25 concurrent jobs with 1 additional job for every 10 Creator licenses per tenant Cloud+, Tableau+: Up to 50 concurrent jobs with 1 additional job for every 5 Creator licenses per tenant	25 concurrent jobs per tenant
Visualizations	Up to 600 calls per hour per user per site	Up to 600 calls per user per site 300 calls per hour per tenant
VizQL Data Service APIs	100 calls per every 1 Creator license per hour per tenant	n/a

### Frequently asked questions (FAQs) Click the drop-down arrow to expand the section and see the capacity management frequently asked questions. #### Do site limits still exist? Yes, capacities displayed on the Capacities page are managed at the tenant level. This means, site limits will never be able to exceed the capacity available to the tenant. The capacities not displayed on the Capacities page continue to be site-specific capacity and can't be reallocated to other sites on the tenant. #### Which capacities can I manage? You can manage the following capacities in TCM: - Extract concurrency - Subscription concurrency - Extract API calls - Flow concurrency - Publish API calls - VizQL Data Service calls - Visualizations (if licensed with capacity-based model) - Pulse digests (if licensed with capacity-based model) #### What can I do on the Capacities page? - See the capacity allowances on the tenant - See the capacity allocated to the sites on the tenant - Manage and reallocate limits between sites on the tenant - Access insights and recommendations on capacity usage across your sites on the tenant #### Can I allocate capacity to sites where I'm not a site administrator? Yes, capacity allocation is handled at the tenant level in Tableau Cloud Manager (TCM). You must be a cloud administrator to view and allocate capacity across any site on the tenant, regardless of whether you're a site admin on the specific site. #### How are limits determined? Capacity allowances are calculated based on your Tableau edition and number of Creator licenses. Starting in July 2026, capacity allowances can also be calculated based on the capacity-based license model. #### What happens if I don't have enough capacity to create a new site? If there isn't enough capacity to create a new site with your defined default site limits, the site will be created with minimum capacity limits, which are defined by Tableau.

Capacity type	Minimum capacity limit
Extract concurrency	1
Extract API	5
Subscription concurrency	1
Publish API	5
Flow concurrency	0
VizQL Data Service API	0
Visualizations (if licensed with capacity-based model)	10
Pulse digests (if licensed with capacity-based model)	0

If a tenant doesn't have enough minimum capacity, you'll see a site creation error. For more information, see the [Troubleshoot capacity management](#troubleshoot) section, below. #### What happens when visualization capacity is exceeded? When a site exceeds its visualization capacity, indicators will show in TCM notifying you as usage crosses warning and critical thresholds. In addition, all cloud administrators will receive email notifications at specific thresholds notifying them of their limits. You can expect to see a maximum of one email per hour per reached threshold limit for each site. Both indicators and email notifications are designed to provide proactive visibility into how much capacity has been exceeded. These notifications have been designed to help cloud administrators monitor heavy usage trends while allowing sites to maintain continuity and user access. ### Customize site limits Each site on the tenant is allocated capacity limits. You can reallocate or modify capacity limits based on each site's capacity needs. 1. Sign in to [Tableau Cloud Manager](https://cloudmanager.tableau.com/) as a cloud administrator. 2. In the left-navigation pane, go to the Capacities page. 3. On the Capacities page, click the Customize Site Limits button. 4. Under the capacity type for a specific site, enter a new capacity limit or click the up or down arrow to adjust the capacity limit. **Note:** The value you enter can't exceed the available limits for that particular capacity type. ![Image of the "Customize site limits" configuraiton page in TCM's Capacities page.](/tableau/next/en-us/online/en-us/Img/tcm_ccm_customize_limits.png) ### Change default capacity limits Each new site created on the tenant is allocated with default capacity limits. You can modify these limits. **Note:** New sites are created with minimum capacity if there isn't enough default capacity available for the site. Without minimum capacity, site creation will fail with an error until the cloud administrator makes capacity available by moving it from existing sites. For more information, see [Add, Rename, Delete, or Activate Sites](https://help.tableau.com/v0.0/online/en-us/cloud_manager_sites.htm). 1. Sign in to [Tableau Cloud Manager](https://cloudmanager.tableau.com/) as a cloud administrator. 2. In the left-navigation pane, go to the Capacities page. 3. On the Capacities page, click the Edit Default Site Limits button. 4. Under the capacity type, enter a new capacity limit. ![Image of the "Edit default site limits" configuraiton page in TCM's Capacities page.](/tableau/next/en-us/online/en-us/Img/tcm_ccm_default_limits.png) ## Monitory capacity management You can use [Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_overview.htm) event logs to monitor capacity allocation changes. For example, you can query the following event types: - `[site_capacity_change](https://help.tableau.com/v0.0/online/en-us/activity_log_tenant_schema.htm#site-capacity-change)` - `[site_capacity_default_change](https://help.tableau.com/v0.0/online/en-us/activity_log_tenant_schema.htm#site-capacity-default-change)` ## Troubleshoot capacity management Use this section to help troubleshoot issues you might have with capacity management in TCM. ### Unable to add new site When adding a site to your tenant, you see the following error: _"Site couldn't be created because there is no available capacity. Edit the default site limits or customize the cloud limits and try again."_ This issue can occur when there isn't enough minimum capacity available to create the new site. Every site on the tenant requires a minimum allocation of capacity to run. To resolve this issue, review the table for minimum capacity limits (which are defined by Tableau) and make more capacity available for the new site.

Capacity type	Minimum capacity limit
Extract concurrency	1
Extract API	5
Subscription concurrency	1
Publish API	5
Flow concurrency	0
VizQL Data Service API	0
Visualizations (if licensed with capacity-based model)	10
Pulse digests (if licensed with capacity-based model)	0

Capacity metrics	Descriptions	What it indicates
Maximum sustained concurrency	The highest percentage of time within an hour period that concurrency capacity was fully used.	Highlights peak consumption or insufficient capacity. Important: A maximum sustained concurrency value greater than 0% indicates that maximum concurrency capacity was reached at some point. Higher percentages mean that maximum consumption occurred on a sustained basis, which can impact task completion time and serving up-to-date data to users. Example Suppose your site has 500 subscription jobs set to run on Monday at 9 AM. Because all 500 subscriptions are sent to run at the same time, maximum concurrency is reached. As each subscription is sent, a new one replaces it, keeping the concurrency limit fully used for 30 consecutive minutes. After 30 minutes, maximum concurrency is no longer used, and the rest of the subscriptions are completed. When you check the capacities metrics for subscriptions, you see 50% for the capacity metric because for 30 out of 60 minutes within a given hourly window, subscription concurrency was fully utilized.
Median sustained concurrency	The median value of the percentage of time within an hour period that concurrency capacity was fully used.	Omits outliers and reflects the typical load on the system. Use this metric to understand whether high concurrency is normal or an exception.
Average sustained concurrency	The average value of the percentage of time within an hour period that concurrency capacity was fully used.	Sensitive to outliers; reflects the general load trend on the system. Compare with the median to identify whether peaks are skewing the average.

### Usage metrics Usage capacity metrics apply to rate-limited capacity types: extract APIs, publish APIs, and VizQL Data Service (VDS) APIs. They measure how much of your hourly API call allowance has been used. Under the capacity-based license model, usage capacity metrics includes visualizations (including VDS API calls) and Pulse digests. Visualizations capacity metrics measure how much of your hourly call allowance has been used. Pulse digests capacity metrics measure how much of your daily call allowance has been used.

Capacity metrics	Descriptions	What it indicates
Maximum capacity usage	The highest percentage of capacity used within an hour period.	Highlights high call rates or insufficient capacity. High values can indicate that calls are at risk of failing.

## Warning, critical, and error indicators The Capacities and Capacities Metrics pages use highlights to help you quickly identify which sites and capacities need attention. The threshold ranges that trigger an indicator differ between concurrency and usage capacity types. **Note:** The warning, critical, and error indicators on the Capacities page cover the past 24 hours. The indicators on the Capacities Metrics page display only on the Past 24 hours capacity metrics card, not on the Past 48 hours capacity metrics card. ### Yellow indicator - warning ![Image of yellow (warning) indicator.](/tableau/next/en-us/online/en-us/Img/tcm_ccm_indicator_yellow.png) - **Concurrency capacity type:** A yellow (warning) indicator displays when a site's usage for a capacity type reaches 50%-75% of sustained saturation. This is an early sign that the site is under meaningful load. - **Usage capacity type:** A yellow (warning) indicator displays when a site's consumption for a capacity type reaches 85%-99% of its allocated limit. This is an early sign that the site is making a high volume of calls and approaching the rate limit. When you see these indicators, consider reviewing the [When you see warning, critical, or error indicators](#indicators_next_steps) section below. ### Orange indicator - critical ![Image of orange (critical) indicator.](/tableau/next/en-us/online/en-us/Img/tcm_ccm_indicator_orange.png) - **Concurrency capacity type:** An orange (critical) indicator displays when a site's usage for a capacity type reaches 76%-100% of sustained saturation. At this level, consequential delays in background jobs are likely to occur and users are at a high risk receiving stale data. - **Usage capacity type:** An orange (critical) indicator displays when a site's consumption reaches 100% of its allocated limit. This means the site has fully exhausted its available capacity for that type. When this happens, calls might be delayed or fail, which can cause disruption to your users. When you see these indicators, we strongly recommend reviewing the [When you see warning, critical, or error indicators](#indicators_next_steps) section below. ### Red indicator - error ![Image of red (error) indicator.](/tableau/next/en-us/online/en-us/Img/tcm_ccm_indicator_red.png) - **All capacity types:** A red (error) indicator displays when the site limits in aggregate exceed the limits for the tenant. This can occur when there are changes to the Creator license quantity, which causes compliance issues. This issue should be resolved immediately by reallocating capacity. For more information, see [Reduce site limits message](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity.htm#troubleshoot_reduce_limits). ### When you see warning, critical, or error indicators When you see yellow, orange, or red highlights in the capacity management dashboard, check the Recommendations column. Sites with Review site limits are candidates for capacity reallocation. When reallocating capacity, consider the following: - Click the site name to open the Capacity Metrics page for a more detailed view. - For the specific site, click the Actions menu and select Customize Site Limits. For more information, see [Capacity Managed in Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity.htm#allocate). Sites with Reduce site limits should have the highlighted capacity limits reduced. For more information, see [Capacity Managed in Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity.htm#reduce_limits). To reduce capacity limits, see [Capacity Managed in Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity.htm#allocate). [Skip to main content](#main-content) # Capacity Set at the Site Your Tableau site is created with capacity limits to optimize for storage, visualization rendering, and system responsiveness. This topic covers capacities that are fixed at the site level. The capacities covered aren't exhaustive of all product limits. For tenant-level capacities that can be allocated across the sites on the tenant, see [Capacity Managed in Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity.htm). ## Capacity set at the site level The following capacities types are fixed at the site level: - [Storage](#storage) - [Extracts - daily, runtime, and memory usage](#extracts) - [Subscriptions - runtime and email size](#subscriptions) - [Flows - user requests, daily, runtime, and memory usage](#flows) - [Visualizations - timeout, request rate, memory usage](#visualizations) - [Additional APIs and command line calls](#apis) ### Storage A site comes with site and individual content storage capacities. - **Site storage:** A site comes with 1 TB of storage capacity. Workbooks, published data sources, and flows count toward this storage capacity. **Notes:** - Sites with Enterprise edition, Tableau+ edition, or existing sites with the Advanced Management add-on, get 5 TB of site storage. - Extracts generated by Tableau Bridge impact site storage. For more information about which capacity types are impacted by Tableau Bridge, see [Bridge Site Capacity](https://help.tableau.com/v0.0/online/en-us/to_bridge_site_capacity.htm). - **Individual workbook, published data source, and flow size:** An individual workbook, data source (live or extract), or flow published to your site should not exceed 25 GB. Content should not exceed that size for optimal performance and to avoid other constraints, such as query usage and runtime limits. **Notes:** - If your extract data source exceeds 10 GB in size, we recommend that you consider using live connection to the database, aggregate the data in the extract to reduce its size, or use incremental extracts. Frequently republishing or refreshing large full extracts can be time intensive and usually indicates that more efficient data freshness strategies should be considered. - Extracts generated by Tableau Bridge are subject to the size limit. For more information about which capacity types are impacted by Tableau Bridge, see [Bridge Site Capacity](https://help.tableau.com/v0.0/online/en-us/to_bridge_site_capacity.htm) ### Extracts - daily, runtime, and memory usage A site comes with designated capacity for extract refresh daily jobs, runtime, and memory usage. **Note:** Tableau Bridge refreshes of embedded extracts and virtual connections impact a site's extract daily, runtime, and memory usage capacity. For more information about which capacity types are impacted by Tableau Bridge, see [Bridge Site Capacity](https://help.tableau.com/v0.0/online/en-us/to_bridge_site_capacity.htm). - **Daily jobs:** Daily jobs capacity is the number of shared hours each site can spend per Creator license a day to perform all jobs on the site. A server process, called backgrounder, initiates and performs these jobs. A site with more Creator licenses gets more daily jobs (backgrounder) capacity to meet the needs of a larger site population. For example: | If your site has... | multiplied by the default time | Daily jobs capacity | | --- | --- | --- | | 10 Creator licenses | 8 hours | Up to **80 hours/day** | | 50 Creator licenses | 8 hours | Up to **400 hours/day** | Daily jobs capacity resets each day at 24:00:00 UTC (coordinated universal time). #### About extract refreshes Refresh jobs that count toward daily jobs capacity include full and incremental refreshes and extract creation, which can be initiated by scheduled refreshes, manual refreshes, and certain command line or API calls. **Notes:** - As long as your site has time remaining in its daily refresh capacity, a refresh job will start. - Site admins receive email notifications when a site reaches 70%, 90%, and 100% of its daily refresh capacity. - If a site exhausts its daily refresh capacity, any future extract refreshes are canceled and email notifications are sent to content owners alerting them of the refresh cancellation. - **Job runtime:** Each extract refresh job type has a maximum runtime of two hours (120 minutes or 7,200 seconds). If a refresh job reaches its maximum runtime, you see a timeout error. For more information about the error and ways you can modify extracts to keep refresh jobs within the runtime capacity, see [Time limit for extract refreshes](https://help.tableau.com/v0.0/online/en-us/schedule_add.htm#timeout). - **Refresh memory usage:** A site has capacity to use no more than 20 GB of memory to refresh an extract. The amount of memory needed to refresh extracts can vary depending on the size of the extract and other factors. #### Tips for optimizing extract refresh capacity If you're managing an extract-heavy environment, Tableau recommends following some best practices to make the most efficient use of your extract refresh capacity. - **Stop refreshing unused extracts**. One of the best ways to reclaim capacity for your site is to stop automatic refreshes, either through schedules on Tableau Cloud or through scripts of extracts that aren't being used. For more information about deleting a refresh schedule, see [Manage Tasks](https://help.tableau.com/v0.0/online/en-us/task.htm). - **Reduce the frequency of refreshes**. Another method of reclaiming capacity for your site is to reduce the frequency of extract refreshes. For example, instead of refreshing an extract hourly, consider refreshing an extract daily or only during business hours when fresh data is most useful. For more information about changing a refresh schedule, see [Manage Tasks](https://help.tableau.com/v0.0/online/en-us/task.htm). - **Use incremental refreshes instead of full refreshes**. To decrease the amount of time an extract takes to refresh, consider performing an incremental refresh of the extract instead of a full refresh. For more information, see [Schedule Refreshes on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/schedule_add.htm). **Note:** Changing from a full to an incremental refresh can be done from Tableau Cloud only if the extract was configured for incremental refresh in Tableau Desktop before the extract was published. For more information about incremental refreshes, see [Configure an incremental extract refresh](https://help.tableau.com/current/pro/desktop/en-us/extracting_refresh.htm#incremental) in the Tableau User Help. - **Use live connections instead of extract connections**. For views, dashboards, and workbooks whose data needs to be updated frequently, consider setting up the data source to use a live connection instead of an extract connection. - **Optimize the data in the extract**. Improving the performance of an extract can also help reduce the amount of time an extract takes to refresh. There are a number of changes you can make to the extract's data to help its overall performance, such as removing unused fields, using filters to remove unused rows, and changing date ranges. ### Subscriptions - runtime and email size A site comes with designated capacity for subscription runtime and email size. - **Job runtime:** Each subscription job has a maximum runtime of 30 minutes (1,800 seconds). - **Email size:** A subscription email can be a maximum size of 2 MB. ### Flows - user requests, daily, runtime, and memory usage A site comes with designated capacity for flow user requests, runtime, and memory usage. - **User request rate:** Each user can have a maximum of 4 active flow web editing sessions at one time. If more sessions are opened, the oldest session will be closed. - **Daily jobs:** Users can run flows for up to 24 hours per day per Resource Block. Each resource block represents the number of concurrent flow jobs that can run at one time on the site. Additional capacity for concurrent flow jobs can be purchased. For more information, see [Resource Blocks](https://help.tableau.com/v0.0/online/en-us/to_resource_blocks.htm). For more information about how flow capacity is measured, see [Flow concurrency](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity.htm#flows). - **Job runtime**: In addition to the daily site allowance, the runtime for any single, individual flow job is capped at a maximum of 6 hours. If an individual flow execution exceeds this 6-hour threshold, the job will automatically time out and fail. - **Flow memory usage:** A site has capacity to use no more than 19.5 GB of memory for a flow job. ### Visualizations - timeout, request rate, memory usage A site comes with designated capacity to query individual visualizations, also known as views. You can find more information about each capacity type below. - **Idle timeout:** If the user hasn't interacted with or edited a view for 120 consecutive minutes, the user must reload (for example, refresh the page or click the Reconnect button if a banner displays) the view or saved draft to interact with it again. - **User request rate:** Each user on a site has the capacity to make up to 600 requests per hour to load and refresh views. When this capacity has been reached, the user can't interact with, edit, and save the view. After an hour, the view can be refreshed and new views can be loaded. **Notes:** - If the cumulative number of user requests exceeds the site-level request rate, users can't interact with, edit, and save views. - While the per-user request rate applies to all license types, the capacity-based model adds a tenant-wide request rate capacity that is configurable in Tableau Cloud Manager (TCM). For more information, see [Visualizations](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity.htm#visualizations). - **Query memory usage size:** A site has capacity to use no more than 40 GB of memory to query a view that uses an extract data source. The amount of memory needed to query a view can vary depending on the complexity of the data manipulations that Tableau needs to perform to generate the marks in the view. Views that exceed these capacity types might be canceled to ensure enough system resources are available so that other views on the site can load. #### Tips for optimizing visualization capacity Views that exceed visualization capacity can indicate the queries that Tableau must run in order to generate the view might be too complex. In such cases, you can use the following tips to help optimize queries thereby minimizing the time it takes to load views on Tableau Cloud. Most tips require that you edit the data source or workbook and republish to Tableau Cloud for changes to take effect. For more tips, see the [Workbook Performance](https://help.tableau.com/current/pro/desktop/en-us/performance_tips.htm) topic in the Tableau Help. - **Use data source filters**: When you add a filter on a data source, you reduce the amount of data that needs to be generated in the view. Reducing the amount of data can help minimize load times of views. For more information, see [Filter Data from Data Sources](https://help.tableau.com/current/pro/desktop/en-us/filtering_datasource.htm) in the Tableau Help. - **Use context filters**: Similar to data source filters, context filters reduce the data in the data source but at the sheet level. Context filters work independently of other filters and can significantly reduce the amount of data that needs to be generated in the view. Reducing the amount of data can help minimize load times of views. For more information, see [Improve View Performance with Context Filters](https://help.tableau.com/current/pro/desktop/en-us/filtering_context.htm) in the Tableau Help. - **Decrease date ranges**: As a rule, dates require more computing power than other types of data like numbers and booleans. If the view contains date filters, you can reduce the date ranges or the number of dates that need to be generated to help minimize the load times of views. - **Reduce marks**: Because Tableau must calculate the marks in order to generate the view, the number of marks can impact how quickly the view can load. There are several ways you can reduce marks, including using some of the filters listed above or using sets to filter, custom SQL to aggregate data, and so on. For more information, see [Reduce the number of marks in the view](https://help.tableau.com/current/pro/desktop/en-us/perf_visualization.htm#reduce-the-number-of-marks-on-the-view). ### Additional APIs and command line calls A site comes with designated capacity for API and command line calls. The site is equipped with capacity for the following: - **[Query Job](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#query_job) and [Cancel Job](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#cancel_job) (Tableau REST API) and [Tableau Client (Python) library](https://tableau.github.io/server-client-python/docs/):** A site allows 20000 calls per 24-hour period. - [Get Users on Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#get_users_on_site) **(Tableau REST API):** A site allows 5000 calls per minute. - [Remove User from Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#remove_user_from_site) **(Tableau REST API):** A site allows 1600 calls per minute. **Note:** If the number of calls exceed the API or command line calls described above, you see one of the following errors: _Unknown 429_ or _ApiCallError: 429000: Too Many Requests – Too many requests for 'api.rest.refresh\_extracts'. Please retry after 146 second(s)_. ## Monitor capacity As a site admin, there are a few capabilities that you can use to help you monitor your site's capacity. ### Admin tools There are various admin tools to help you monitor different types of activity on your site. You can find more capacity usage information for the features listed below. - **Storage:** You can monitor your site's storage capacity and check which workbooks, data sources, and flows take up the most space on your site using the Admin Insights "Stats for Space Usage" dashboard. Select Explore > Admin Insights > Admin Insights Starter > Stats for Space Usage. For more information about Admin Insights, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). - **Flows:** You can monitor the performance of flow runs. Select Site Status > Flow Performance History. Using the dashboard, under Flow History, click a mark to see details about the flows job. For more information about this admin view, see [Administrative Views for Flows](https://help.tableau.com/v0.0/online/en-us/prep_conductor_admin_views.htm). - **Metrics:** You can monitor your site's metrics jobs by using the "Background Tasks for Non Extracts" admin view. Select Site Status > Background Tasks for Non Extracts, and then from the Tasks filter drop-down, select Update all metrics on a view check box. For more information about this admin view, see [Background Tasks for Non Extracts](https://help.tableau.com/v0.0/online/en-us/adminview_backgrnd_nonextract.htm). ### Activity logs For sites with the Advanced Management add-on, you can use Activity Log to capture event data and track specific actions like view load times that impact your visualization and jobs capacity. For more information, see [Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_overview.htm). [Skip to main content](#main-content) # Change the Bridge Client Settings There are several Bridge client settings that the site admin can configure to change how a client runs. ## Windows Client For Windows clients, the default location of the Configuration file is `C:\Users\jsmith\Documents\My Tableau Bridge Repository\Configuration\TabBridgeClientConfiguration.txt`. The client must be restarted for any changes made to the configuration file to take effect. ## Bridge for Linux for Containers The `TabBridgeClientConfiguration.txt` file is generated with default configurations the first time you run the Bridge client. To make changes to the configuration settings, edit the `TabBridgeClientConfiguration.txt` file, and create a new Docker container with the updated file. For more information about how to create and update a container, see [Containerize an application](https://docs.docker.com/get-started/02_our_app/). ## Bridge legacy schedules In some cases, a data source owner might be responsible for some of the tasks described in this topic if they maintain their own client to run Bridge legacy schedules. ## Bridge client settings ### serviceConnectionSettings Configuration: `serviceConnectionSettings` Options:

`serviceUrl`	Tableau site URL. Not configurable.
`proxyServer`	Proxy Server and port. Configurable

#### Example The client must be restarted for any changes made to the configuration file to take effect. ``` "serviceConnectionSettings" : { "serviceUrl" : "https://online.tableau.com", "proxyServer" : { "serverName" : "http://localhost", "serverPort" : 8888 } ``` ### connection Configuration: `connection` Options:

connectTimeout

The Bridge client wait time when trying to connect to Tableau Cloud.

Default value: 1 minute

Configurable.

operationTimeout

The Bridge client wait time for each server (such as VizPortal) API call after successfully connecting to Tableau Cloud.

Default value: 15 minutes

Configurable.

maxAttemptsToRedirectHttpRequests

An API call to a server can be redirected from POD to POD. This number specifies the maximum number of redirects per server API call. Default value: 20

Configurable.

#### Example ``` "connection" : { "connectTimeout" : "00:01:00", "operationTimeout" : "00:15:00", "maxAttemptsToRedirectHttpRequests" : 20 } ``` ### dataSourceRefreshSettings Configuration: `dataSourceRefreshSettings` Options:

`shutdownTimeoutInSeconds`	Not configurable.
`downloadDataSourcesInterval`	The time interval for the temporary downloading the names of live data sources and extract data sources that are assigned to the client for Bridge legacy schedules. Default value: 30 minutes. Configurable.
`checkRefreshDataSourcesInterval`	The time interval for the Bridge client to check data sources assigned to the client to establish if a refresh is needed for Bridge legacy schedules. Default value: 5 seconds Configurable.
`extractRefreshTimeout`	Enforces a time limit for refreshes performed by the client. The timeout limit is the longest allowable time for a single extract to complete a refresh before it's canceled by the client. If an extract refresh is canceled as a result of reaching the timeout limit, you will see a message in the client and an email alert will be sent to the data source owner. Default value: 24 hours. For virtual connections, the default extract refresh timeout limit is 2 hours and is controlled on by Tableau Cloud The time limit can’t be controlled by the Bridge client. Configurable.
`maxRemoteJobConcurrency`	Specifies the maximum number of concurrent remote refresh jobs (PDS Extracts) allowed for a single client. Default value: 10 Minimum: 1 Maximum: 90 Configurable. To apply this setting: Unlink the client. Relink the client and sign in. Assign the client to a named pool. Note: For Windows users, if the application reports an incorrect error requiring a different action after changing this setting, manually clear the bridge credentials from Windows Secure Storage.
`JSONLogForExtractRefresh`	When set to true, the client generates an additional log file in JSON format. The log captures the metrics of extract refreshes, for both Bridge legacy and Remote refreshes, with one line per extract. The format of the JSON log file is readable by Tableau Desktop and can be used as a data source to create live vizzes. For more information, see JSON File. An example of the log file is: `ExtractRefreshMetrics_<timestamp>.json` Changing the value of this configuration option requires a restart of the Bridge client. The `loggerSettings` configuration options apply to the JSON log file. Default value: false Configurable.
`dataSources`	Applies to Bridge legacy schedule refresh jobs. Not user editable. Provides a list of mapped local file locations for file-based data sources. Not configurable

#### Example To govern the misuse of extracts or refreshes, you can enforce a time limit using `extractRefreshTimeout`, also known as a timeout limit, for refreshes performed by a client. The timeout limit is the longest allowable time for a single extract to complete a refresh before it's canceled by the client. **Note**: For extracts of virtual connections, the default for `extractRefreshTimeout` is 2 hours and can’t be controlled by the Bridge client. As an alternative, you can modify the virtual connection to refresh within the default 2 hour window or switch to a published data source. By default, the timeout limit for a client is set to 24 hours. You can change the timeout limit for a client through the Bridge configuration file. If an extract refresh is canceled as a result of reaching the timeout limit, you will see a message in the client and an email alert will be sent to the data source owner. The client must be restarted for any changes made to the configuration file to take effect. ``` "dataSourceRefreshSettings" : { "shutdownTimeoutInSeconds" : "00:00:30", "downloadDataSourcesInterval" : "00:30:00", "checkRefreshDataSourcesInterval" : "00:00:05", "extractRefreshTimeout" : "24:00:00", "maxRemoteJobConcurrency" : 10, "JSONLogForExtractRefresh" : false, "dataSources" : [ ] } ``` ### loggerSettings Configuration: `loggerSettings` Options:

maxLogFileSizeInMB

Maximum size of the log files in MB. When a log file exceeds the size limit, a new log file is created.

Default value: 25 MB.

Configurable.

maxBackupLogFileCount

Maximum number of allowed Bridge log files. When the number of log files exceed the limit, the oldest log file is deleted.

Default is 40.

Configurable.

remoteRequestLogFileLifeSpan

For each Bridge Refresh job that is sent to the client, a new set of log files is created:

tabbridgeclijob_<process_id, and if the data source is JDBC-based: fjprotocolserver_<process_id>, and stdout_jprotocolserver_<process_id>.

By default, the maximum amount of time the log files remain in the Logs folder before being deleted is 8 hours if the number of log files exceeds maxBackupLogFileCount. Otherwise, these log files remain indefinitely while the number of log files is less than or equal to maxBackupLogFileCount.

<process_id> represents the Windows process ID.

Default value: 8 hours

Configurable.

#### Example The client creates logs of activities as part of its normal operation. You can use these logs to monitor refreshes, troubleshoot issues with Bridge, or if Tableau Support requests logs from you to help resolve an issue. You can manage the size of Bridge log files or increase the time log files remain before being deleted in the TabBridgeClientConfiguration.txt file. Note: Log files named tabprotosrv\* vary from other Bridge log files. The maximum size is 1 MB and the maximum number of allowed log files is 8,192. These values are also not configurable. ``` "loggerSettings" : { "maxLogFileSizeInMB" : 25, "maxBackupLogFileCount" : 40, "remoteRequestLogFileLifeSpan" : "00:00:00" } ``` ### dataSyncRestartInterval Configuration: `dataSyncRestartInterval`

Sets the restart interval of the Data Sync.

Configurable.

### internetConnectionMonitorInterval Configuration: `internetConnectionMonitorInterval`

Interval for Bridge to ping the internet to determine if there is a valid connection.

Default value: 30 seconds

Configurable.

### secureStorageMonitorInterval Configuration: `secureStorageMonitorInterval`

Interval for Bridge to determine secure storage.

Not Configurable.

#### cleanUpTempDirOnStartUp Configuration: `cleanUpTempDirOnStartUp`

Determines whether to remove the temp files when the Bridge client starts.

Default value: true

Configurable.

#### JSONLogForLiveQuery Configuration: `JSONLogForLiveQuery`

When set to true, the client generates an additional log file in JSON format. The log captures the metrics of live query request, with one line per extract

The format of the JSON log file is readable by Tableau Desktop and can be used as a data source to create live vizzes. For more information, see JSON File.

Changing the value of this configuration option requires a restart of the Bridge client.

Default value: true

Configurable.

#### Example ``` "dataSyncRestartInterval" : "24:00:00", "internetConnectionMonitorInterval" : "00:00:30", "secureStorageMonitorInterval" : "00:00:30", "cleanUpTempDirOnStartUp" : true,, "JSONLogForLiveQuery" : true } ``` ## Default configuration file To copy the default configuration file, click the **Copy to clipboard** icon in the upper right corner. ``` { "serviceConnectionSettings" : { "serviceUrl" : "https://online.tableau.com/", "connection" : { "connectTimeout" : "00:01:00", "operationTimeout" : "00:15:00", "maxAttemptsToRedirectHttpRequests" : 20 }, }, "dataSourceRefreshSettings" : { "shutdownTimeoutInSeconds" : "00:00:30", "downloadDataSourcesInterval" : "00:30:00", "checkRefreshDataSourcesInterval" : "00:00:05", "extractRefreshTimeout" : "24:00:00", "maxRemoteJobConcurrency" : 10, "JSONLogForExtractRefresh" : false, "dataSources" : [ ] }, "loggerSettings" : { "maxLogFileSizeInMB" : 25, "maxBackupLogFileCount" : 40, "remoteRequestLogFileLifeSpan" : "08:00:00" }, "dataSyncRestartInterval" : "24:00:00", "internetConnectionMonitorInterval" : "00:00:30", "secureStorageMonitorInterval" : "00:00:30", "cleanUpTempDirOnStartUp" : true, "JSONLogForLiveQuery" : true } ``` ## Other articles in this section [Skip to main content](#main-content) # Change the Windows Client Service In order for a client to be included in a pool, the client should run as a Windows service (Service mode). By default, a client is set to run as a Windows service so that it can load balance live queries and refreshes in the background without requiring a dedicated user to be logged in to the machine. For a client to run as a Windows service, the Windows user account that runs the client must be a member of the local Administrator group on the machine. **Note:** If you're a data source owner and managing the client yourself, your client will not be included in the pool. However, if you want the Bridge (legacy) schedule to run in the background even when you're not logged on to your machine, your client must be running as a Windows service (Service mode). 1. Open the Windows system tray and click the Bridge icon to open the client. 2. From the Mode drop-down menu, select Service. A sign-in windows displays. ![Run Tableau Bridge continuously as a Windows service.](/tableau/next/en-us/online/en-us/Img/to_sync_run_as_service.png) 3. Enter your local admin credentials. In your list of Windows services, Bridge appears as Tableau Bridge service. You can see this in the Windows Services console or on the Services tab in the Task Manager. ### Restarting the Windows Client The way you restart the client depends on whether the client is running in Application or Service mode. - For Application mode: from the client menu, select Exit. - For Service mode: from the Mode drop-down menu, select Application; from the client menu, select Exit. In the dialog box, select the Exit client and stop activities check box and click Close. - ![A dialog box with a warning that closing the Tableau Bridge client will halt live query and scheduled refresh operations.](/tableau/next/en-us/online/en-us/Img/bridge_exit_service.png) ### Unlinking the Windows Client Right-click the Bridge icon in the Windows System tray and select Unlink. ![A menu shows options for Help, Unlink, and Exit.](/tableau/next/en-us/online/en-us/Img/to_sync_unlink.png) For more information about the Unlink option, see [Stop Keeping Data Fresh Through Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_signout_unlink.htm#unlink-effects). ### Stop running Bridge as a Windows service To stop the client from running as a service, change its mode. 1. Open the Windows system tray and click the Bridge icon to open the client. 2. From the Mode drop-down menu, select Application. ![Run Tableau Bridge as an application instead of a service.](/tableau/next/en-us/online/en-us/Img/to_sync_revert_to_application.png) When the client is running in Application mode, live queries and scheduled refreshes can only run when the user is logged in to the Windows user account on the machine where the client is running from. ### Switch the site a Client is associated with When you want to use a client to keep content published to a different Tableau Cloud site fresh, you can unlink the existing client and authenticate to the new site from the client. 1. Open the Windows system tray and click the Bridge icon to open the client. 2. From the drop-down menu, select Unlink. ![Unlink to remove all data information and stop sending refreshes to Tableau Cloud](/tableau/next/en-us/online/en-us/Img/to_sync_unlink.png) Unlink removes the list of data sources that use Bridge (legacy) schedules, schedules, and connection information from the client. 3. Open the Windows system tray and click the Bridge icon to open the client. 4. When prompted, sign in to the new site with your site admin credentials. 5. Do one or both of the following to configure the client: - If this client refreshes data sources associated with a specific client, ask data source owners to reconfigure their data sources and refresh schedules. - If you want this client to facilitate live connections or extract connections that use Online schedules, ensure that the new client is part of the pool. For more information, see [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm) When you unlink a client, you might also need to remove the Bridge (legacy) schedules for the data sources that the client was refreshing. The other data sources continue to have data freshness tasks performed by other registered clients in the pool. For more information, see [Stop Keeping Data Fresh Through Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_signout_unlink.htm#unlink-effects). [Skip to main content](#main-content) # Choose the Right Story Type for Your Tableau Desktop Data Story **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). When you [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm), it's important to choose the right type of story for your data. Do you want your story about trends over time? Or do you want your story about two values that you're comparing? To help you tell the right story, this topic describes the different types of stories, including an example of each story type. ## Continuous Continuous stories are best for analyzing trends or progress over time. When you create a continuous story, it includes content for performance, segments, volatility, and trend lines. The story also includes contribution analysis and correlation for stories that use more than one dimension. To use a continuous story, your worksheet must have: - 1 dimension that has between 1-10 measures - 2 dimensions and up to 3 measures The following example is a continuous story for a line chart that has a single dimension and multiple measures: ![Three line charts with a continuous story example](/tableau/next/en-us/online/en-us/Img/data_stories_continuous.png) ## Discrete Discrete stories are best for comparing values and understanding the distribution of data in each value. When you create a discrete story, the story includes content about the distribution and groupings or clusters across the data. And the story includes contribution analysis for worksheets that use multiple dimensions. Consider using a discrete story when you want to: - Understand drivers of your key performance indicators (KPIs) in sales reports. - Identify and understand outliers quickly during data discovery. - Identify trends that aren't easily observable in the visual when performing an audit. - Uncover complex utilization insights instantly for geographic analysis. - Identify and call out key relationships, for example, between sales and profit. To use a discrete story, your worksheet must have: - 1 dimension that has between 1-10 measures - 2 dimensions and up to 3 measures The following example is a discrete story for a bar chart that has a single dimension and two measures: ![A bar chart with a discerete story example](/tableau/next/en-us/online/en-us/Img/data_stories_discrete.png) ## Percent of whole Percent of whole stories are best for pie charts. To use a percent of whole story, your worksheet must have: - 1 dimension - 1 measure The following example is a percent of whole story that uses a pie chart with a single dimension and a single measure: ![A pie chart with a percent of whole story example](/tableau/next/en-us/online/en-us/Img/data_stories_percent.png) ## Scatter plot Scatter plot stories are best for understanding the relationship between two measures. When you create a scatter plot story, the story includes content about the relationship (regression) between two measures. And the story includes content about groups (clusters) within the data, when they exist. Consider using a scatter plot story when you want to: - Call out relationships between two measures to identify impact (regression analysis). - Identify and understand outliers that are above or below defined thresholds. - Analyze how your data is distributed. To use a scatter plot story, your worksheet must have: - 1 dimension - 2 or 3 measures **Note:** When you create your scatter plot story, the first measure you select is treated as the independent variable and the second measure is the dependent variable. The following example is a scatter plot story that uses a scatter plot that has a single dimension and two measures: ![A scatter plot chart with a scatter plot story example](/tableau/next/en-us/online/en-us/Img/data_stories_scatter.png) [Skip to main content](#main-content) # Cloud Administrator Role and Tasks This topic outlines the role of a cloud administrator, highlighting how it differs from the site administrator role, and defines the core responsibilities involved in Tableau Cloud Manager (TCM). ## How we define the cloud administrator role The cloud administrator is responsible for overseeing the Tableau Cloud sites in your organization. Unlike the site administrator, who manages specific site settings and content permissions, the cloud administrator operates at the tenant level, handling broader responsibilities such as user management across multiple sites, license monitoring, and site creation. For more information about tenant and site administration in Tableau Cloud, see [Understanding tenant and site administration in Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/cloud_manager_intro.htm#tenant-site-info). ### Licensing and access The role of a cloud administrator is unique compared to traditional site roles. Cloud administrators only have access to Tableau Cloud Manager, and because they don't have site access, they don't consume a Tableau Cloud license. If site access is required, cloud administrators can assign themselves a site role through TCM, thus gaining access to any site within the tenant. ## Key responsibilities of a cloud administrator The following are the primary responsibilities of cloud administrators in Tableau Cloud Manager: - **Manage users across sites:** Cloud administrators oversee users across all sites within Tableau Cloud, such as adding or removing users and adjusting site roles at the tenant level. - **Bulk upload users across sites:** Cloud administrators can import large numbers of users and configure site access using CSV files. Bulk upload is beneficial for managing user access across multiple sites in large-scale deployments. - **Track overall licenses:** Cloud administrators actively monitor and manage Tableau Cloud licenses by setting site role limits, enabling site administrators to add users up to a specified count. - **Create sites:** Cloud administrators are responsible for the creation and deletion of sites within Tableau Cloud. They set the initial framework of sites by assigning the name, region, and initial site administrator. After configuring a site, admin responsibility is then passed to site administrators who manage site level operations. ### Tasks outside the cloud administrator's scope Cloud administrators focus on tenant-level management and don't directly handle the day-to-day management of specific sites. To gain site access and perform tasks such as setting specific site permissions, managing content, and customizing sites in detail, they must also be assigned the site administrator role. For more information about modifying a user's site membership, see [Manage users' site membership](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm#manage-site-membership). In this topic, we reviewed the differences between the roles of cloud administrator and site administrator. However, in your organization, the same person might cover both roles. In practice, you can divide these responsibilities in the way that works best for your environment. [Skip to main content](#main-content) # Configure Einstein Discovery Integration Beginning March, 2021, Tableau Cloud supports integration with Einstein Discovery, making Einstein Discovery predictions available to authors and viewers of dashboards. Starting in version 2021.2.0, Einstein Discovery predictions is also now available when authoring flows on the web. Einstein Discovery in Tableau is powered by [salesforce.com](http://salesforce.com/). Consult your agreement with [salesforce.com](http://salesforce.com/) for applicable terms. For details on how to use Einstein Discovery predictions in Tableau, including licensing and permission requirements, see [Integrate Einstein Discovery Predictions in Tableau](https://help.tableau.com/current/pro/desktop/en-us/einstein_discovery_predictions.htm) in the Tableau Desktop and Web Authoring Help. For information about adding predictions in flows, see [Add Einstein Discovery Predictions to your flow](https://help.tableau.com/current/prep/en-us/prep_predictions.htm). ## Einstein Discovery dashboard extension The Einstein Discovery dashboard extension allow workbook authors to surface real-time predictions in Tableau. The dashboard extension delivers predictions interactively, on-demand, using source data in a Tableau workbook and an Einstein Discovery-powered model deployed in Salesforce. By default Tableau Cloud site configuration allows saved OAuth access tokens, so the only step necessary is to configure Cross-Origin Resource Sharing (CORS) in the Salesforce org that hosts Einstein Discovery. This requires permissions in the Salesforce org. For details on necessary licenses and permissions, see [Requirements for access - Einstein Discovery](https://help.tableau.com/current/pro/desktop/en-us/einstein_discovery_predictions.htm#Requirem). For details on configuring CORS in Salesforce, see [Configure CORS in Salesforce.com for Einstein Discover Integration in Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/config_cors_sfdc.htm). ## Einstein Discovery analytics extension The Einstein Discovery analytics extension gives your users the ability to embed predictions directly in Tableau calculated fields. A table calc script requests predictions from a model deployed in Salesforce by passing its associated prediction ID and input data that the model requires. Use Model Manager in Salesforce to auto-generate a Tableau table calculation script, and then paste that script into a calculated field for use in a Tableau workbook. By default Tableau Cloud site configuration allows saved OAuth access tokens, so the only step necessary is to configure Cross-Origin Resource Sharing (CORS) in the Salesforce org that hosts Einstein Discovery. This requires administrator permissions in the Salesforce org. For details, see [Configure CORS in Salesforce.com for Einstein Discover Integration in Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/config_cors_sfdc.htm). ## Einstein Discovery Tableau Prep extension _Supported in Tableau Server and Tableau Cloud starting in version 2021.2.0_ The Einstein Discovery Tableau Prep extension enables users to embed Einstein predictions directly in their flows when authoring flows on the web. By default, Tableau Cloud site configuration allows saved OAuth access tokens, so the only step necessary is to enable Tableau Prep Extensions for the server. This requires administrator permissions in the Salesforce org. For details, see [Enable Tableau Prep Extensions](https://help.tableau.com/current/server/en-us/web_author_flows.htm). ## Other articles in this section [Skip to main content](#main-content) # Configure a Tableau Pulse Lightning Web Component The Tableau Pulse Lightning web component (LWC) allows Salesforce customers to drag and drop embedded Tableau Pulse metrics from Tableau Cloud onto Salesforce Lightning pages. Tableau Pulse LWC supports embedding on App, Home, and Record pages, as well as Experience Cloud and the Salesforce Utility Bar. For instructions to turn on a Tableau LWC, add a trusted URL, set up seamless authentication and host mapping, and add a component to a Lightning page, see [Configuring Tableau Lightning Web Components](https://help.tableau.com/current/online/en-us/lwc_seamless_auth.htm). When you’ve added a Tableau Pulse LWC to your Lightning page, configure the component fields. Component field Description

Component field	Description
Tableau Pulse URL	This field is required. Enter the URL for the Tableau Pulse page or metric that you want to embed.
Site ID	This field is required for seamless authentication if there isn’t a host mapping specified for the URL used in the Tableau Pulse URL field. If a host mapping exists for the Tableau site, the contents of this field are ignored.
Height	Height in pixels. When set to the default value of 0, height adjusts automatically to best fit the selected layout.
Layout	Determines the size and level of detail displayed. Choose from Full, Compact, or Mini.
UAF Definition Names	App, Home, and Record pages Select from UAF claim definitions configured in the Tableau UAF Claims Definition settings. To add a definition: Select Select…. Use the arrows to move available definitions to the Selected field. Select OK. Experience Cloud pages and Salesforce Utility Bar Enter a comma-separated list of UAF claim definition names. To copy definition names, from the Salesforce app, navigate to the Tableau UAF Claims Definition setup page, and select Copy.
Debug Mode	Check the box to turn on debug mode.
Force refresh toggle	When troubleshooting, you can toggle this checkbox to refresh only this component instead of refreshing the whole Lightning App Builder Page or all components on the Lightning Page.
Set Component Visibility: Filters	Create filters for when to display the component. For example, you can filter on a specific user, permissions, or device form factor. To add a filter: Select Add Filter. Choose Select to pick a field to filter on. Complete your selection, and then select Done. Select Done to save your filter. Important: You must enter field names as they are defined in the data source. For example, if the data source is in English, but the data source fields are translated to Japanese for a user, the user must enter the original English field name.
Static Filters	Add static filters to the Tableau Pulse metric (for example, Region=North).

### Fields available only on Record pages The following fields make it possible to dynamically filter on up to two fields. For example, you can filter on "Account ID" using the checkbox and "State/Province" using the advanced filters. Component field Description

Component field	Description
Filter on Record ID	Used for dynamic filtering of the view using the Record ID. The name of the field in the data source for the pulse metric must match the format “Record Type ID” and is case sensitive. For example, if the Lightning page is for Account records, the field in the pulse metric must be named “Account ID”.
Tableau Dynamic Filter Name	Used for dynamic filtering using a specific field from the current record. Enter the name of the field in the data source for the pulse metric.
Salesforce Dynamic Filter Value	Used for dynamic filtering using a specific field from the current record. Select the corresponding field on the Salesforce record.

## Tableau Pulse component troubleshooting From the page that contains the Tableau Pulse Lightning web component, select the gear icon, and then select Edit Page. 1. Click on the Tableau Pulse Lightning web component to open the property editor. 2. Confirm that the **Tableau Pulse URL** field contains a valid URL for a Tableau Pulse page or metric. 3. Verify that the **Site ID** field is populated with the Site ID for the Tableau site. To find the Site ID, open the Share dialog for the workbook or view from the Tableau site. For other Tableau LWC and seamless authentication information and troubleshooting, see [Configuring Tableau Lightning Web Components](https://help.tableau.com/current/online/en-us/lwc_seamless_auth.htm). [Skip to main content](#main-content) # Configure a Tableau View Lightning Web Component The Tableau View Lightning web component (LWC) allows Salesforce customers to drag and drop embedded Tableau views from Tableau Cloud or Tableau Server onto Salesforce Lightning pages. Tableau View LWC supports embedding on App, Home, and Record pages, as well as Experience Cloud pages. For instructions to turn on a Tableau LWC, add a trusted URL, set up seamless authentication and host mapping, and add a component to a Lightning page, see [Configuring Tableau Lightning Web Components](https://help.tableau.com/current/online/en-us/lwc_seamless_auth.htm). When you’ve added a Tableau View LWC to your Lightning page, configure the component fields. Component field Description

Component field	Description
URL for the Tableau view	This field is required. Enter the URL for the Tableau View that you want to embed. To find the URL, open a new tab and find the Tableau view that you want to embed. Select Share, and then select Copy Link. Note: The URL must be for a view, not a workbook.
Enable Single Sign-On	Checking this box is required if you’re using token-based authentication.
Site ID	This field is required for seamless authentication if there isn’t a host mapping specified for the URL used in the Tableau view field. If a host mapping exists for the Tableau site, the contents of this field are ignored.
Show Tabs	Check the box if you want to show tabs.
Show Toolbar	Check the box if you want to show the toolbar.
Height	Height in pixels.
Custom Query Parameters	Used to add custom parameters and for static filtering of the view. Enter as FieldName=FieldValue (for example, Manufacturer=3M or Region=North).
UAF Definition Names	App, Home, and Record pages Select from UAF claim definitions configured in the Tableau UAF Claims Definition settings. To add a definition: Select Select…. Use the arrows to move available definitions to the Selected field. Select OK. Experience Cloud pages Enter a comma-separated list of UAF claim definition names. To copy definition names, from the Salesforce app, navigate to the Tableau UAF Claims Definition setup page, and select Copy.
Debug Mode	Check the box to turn on debug mode.
Force refresh toggle	When troubleshooting, you can toggle this checkbox to refresh only this component instead of refreshing the whole Lightning App Builder Page or all components on the Lightning Page.
Set Component Visibility: Filters	Create filters for when to display the component. For example, you can filter on a specific user, permissions, or device form factor. To add a filter: Select Add Filter. Choose Select to pick a field to filter on. Complete your selection, and then select Done. Select Done to save your filter. Important: You must enter field names as they are defined in the data source. For example, if the data source is in English, but the data source fields are translated to Japanese for a user, the user must enter the original English field name.

Component field	Description
Filter on Record ID	Used for dynamic filtering of the view using the Record ID. The name of the field in the data source for the view must match the format “Record Type ID” and is case sensitive. For example, if the Lightning page is for Account records, the field in the view must be named “Account ID”.
Tableau Dynamic Filter Name	Used for dynamic filtering using a specific field from the current record. Enter the name of the field in the data source for the view.
Salesforce Dynamic Filter Value	Used for dynamic filtering using a specific field from the current record. Select the corresponding field on the Salesforce record.

## Tableau View component troubleshooting From the page that contains the Tableau View Lightning web component, select the gear icon, and then select Edit Page. 1. Click on the Tableau View Lightning web component to open the property editor. 2. Confirm that the **URL for the Tableau view** field contains a valid URL for a Tableau view (not a workbook). Open the Share dialog for a Tableau view, and then choose Copy Link. 3. The checkbox for Enable Single Sign-On must be selected. 4. Verify the Site ID field if no host mapping has been saved for this site. **Note**: The Site ID field is ignored if a host mapping is defined for the site. - For Tableau Cloud, the field must be populated with the Site ID copied from the embedded Tableau view Share dialog. - For Tableau Server, the field must be empty. For other Tableau LWC and seamless authentication information and troubleshooting, see [Configuring Tableau Lightning Web Components](https://help.tableau.com/current/online/en-us/lwc_seamless_auth.htm). [Skip to main content](#main-content) # Configure Connected Apps with Direct Trust Beginning in early January 2022, Tableau connected apps enable a seamless and secure authentication experience by facilitating an explicit trust relationship between your Tableau Cloud site and external applications. **Note:** In order for the session token to be valid, the clocks of the external application and the server that hosts the external application must be set to Coordinated Universal Time (UTC). If either clock uses a different standard, the connected app will not be trusted. ## How Tableau connected apps work with direct trust The trust relationship between your Tableau Cloud site and external application is established and verified through an authentication token in the JSON Web Token (JWT) standard, which uses a shared secret provided by the Tableau connected app and signed by your external application. ### Key components of a connected app The following components of the connected work together with the JWT in your external application to authenticate users and display embedded content. - **Secrets:** Secrets are keys shared by Tableau and your external application. They are used in signatures that form the JWT. A secret is required when using connected apps for embedding authentication or REST API authorization. Secrets can be created in a connected app, do not expire, and remain valid until deleted. - **Domain allowlist (embedding workflows only):** You can specify a list of allowed domains in each connected app. Tableau content embedded through a connected app is only allowed under the specified domains. This helps ensure that content is exposed under the domains that are secured and approved by your business. - **Access level (embedding workflows only):** You can specify what content can be embedded through a connected app by associating a connected app with one project or all projects. If you specify one project, only the content in the selected project can be embedded through the connected app. If you want to specify multiple projects, you must use the Tableau REST API. ### Connected app workflow #### Embedding workflows The diagram below illustrates how authentication works between your external application (web server and webpage) and Tableau connected app. ![A diagram that illustrates the flow of data between a webpage, an external application, and Tableau.](/tableau/next/en-us/online/en-us/Img/connectedapp_how.png) 1. **User visits the webpage:** When a user visits the embedded content on a webpage, webpage sends a GET request to your external application to retrieve the HTML on that webpage. 2. **External application constructs an authentication token:** The external application constructs a JWT, which contains a secret from the connected app (see Step 3 below for additional JWT requirements) and the scope of user access for the embedded content. The secret is signed by the external application and is used for verification of the trust relationship in a later step. 3. **External application responds with authentication token:** The external application responds to the page with the JWT in the embedded content’s URL called by the webpage. 4. **Webpage requests content from Tableau**: With the attempt to load the embedded content, the webpage calls the embedded content’s URL, which sends a GET request to Tableau. 5. **Tableau validates the token:** Tableau receives the JWT and verifies the trust relationship with the external application by identifying the connected app and shared secret used in the JWT. Then Tableau creates a session for the user. The session not only respects the embedding scopes defined in the JWT, but also the restrictions specified in the connected app, including the allowed domains and allowed projects. 6. **Tableau returns the content based on the restricted embedding context:** The embedded content only loads when the page is under an allowed domain and the content is published to an allowed project (if applicable). The authenticated user can only interact with the embedded content by the scope defined in the JWT. ## Create a connected app ### Step 1: Create a connected app Create a connected app from Tableau Cloud’s Settings page. 1. As a site admin, sign in to Tableau Cloud. 2. From the left pane, select Settings > Connected Apps. 3. Select the New Connected App button drop-down arrow and select Direct Trust. 4. In the Create Connected App dialog box, do _one_ of following: - For _REST API authorization workflows (including Metadata API workflows that use the REST API for authentication)_, in the Connected app name text box, enter a name for the connected app and select the Create button. **Note:** You can ignore Access level and Domain allowlist when configuring a connected app for REST API and Metadata API authorization. - For _embedding workflows_, do the following: 1. In the Connected app name text box, enter a name for the connected app. 2. From the Applies to drop-down menu, select All project or Only one project to control which views or metrics can be embedded. If you select the "Only one project" option, select the specific project to scope to. For more information about these two options, see [Access level (embedding workflows only)](#projects). **Notes:** - In October 2023 (Tableau 2023.3), Tableau retired the ability to embed metrics. - In February 2024 (Tableau 2024.1), you can specify multiple projects using the Tableau REST API. For more information, see [Create Connected App](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_connected_app.htm#create_connectedapp) and [Update Connected App](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_connected_app.htm#update_connectedapp) methods in the REST API Help. 3. In the Domain allowlist, specify the domains using the rules described in [Domain formatting](#domain_formatting) below to control where views or metrics can be embedded. **Important:** We recommend using the domain allowlist as a security best practice to ensure Tableau content is only embedded in locations that you allow. 4. When finished, select the Create button. ![A form for creating a connected app, including fields for app name, access level, and domain allowlist.](/tableau/next/en-us/online/en-us/Img/connectedapp_create.png) 5. Next to the connected app's name, select the actions menu and select Enable. For security purposes, a connected app is set to disabled by default when created. ![Enable, edit, or delete connected apps dialog.](/tableau/next/en-us/online/en-us/Img/connectedapp_action_menu.png) 6. Make note of the connected app’s ID, also known as the client ID, to use in Step 3 below. ![Your client ID and a "Copy" button.](/tableau/next/en-us/online/en-us/Img/connectedapp_clientid.png) ### Step 2: Generate a secret You can generate a total of two secrets for each connected app. The second secret can be used for secret rotation purposes to help protect against issues if a secret is compromised. 1. On the detail page of the connected app you created in Step 1, select the Generate New Secret button. 2. Make note of the secret ID and secret value to use in Step 3 below. ![Generated date, ID, and value of an action.](/tableau/next/en-us/online/en-us/Img/connectedapp_secret.png) ### Step 3: Configure the JWT After you’ve generated a secret, you want to enable your external application to send a valid JWT. JWT is a standard used to securely transfer information between two parties. The JWT is signed by your external application to securely send information to Tableau Cloud. The JWT references the connected app, the user that the session is being generated for, and the level of access the user should have. A valid JWT includes the following information: - Connected app ID, also known as the client ID, from Step 1 - Secret ID and secret value generated in Step 2 - Registered claims and header:

Claim	Name	Description or required value
"`kid`"	Secret ID	Required (in header). The connected app's secret key identifier.
"`iss`"	Issuer	Required (in header). Unique issuer URI that identifies the trusted connect app and its signing key.
"`alg`"	Algorithm	Required (in header). JWT signing algorithm. Only HS256 is supported.
"`sub`"	Subject	User name (email address) of the authenticated Tableau Cloud user.
"`aud`"	Audience	Value must be: "`tableau`".
"`exp`"	Expiration Time	A valid JWT must not be expired. The expiration time (in UTC) of the JWT must be within the maximum validity period, which is 10 minutes.
"`jti`"	JWT ID	Required as a claim. The JWT ID claim provides a unique identifier for the JWT and is case sensitive.
"`scp`" Important: Do not use "`scope`".	Scope	For embedding workflows, supported values include: "`tableau:views:embed`" "`tableau:views:embed_authoring`" "`tableau:metrics:embed`" (Retired in October 2023 (Tableau 2023.3)) "`tableau:ask_data:embed`" (Retired in February 2024 (Tableau 2024.1)) Notes: Values must be passed as a list type. For `tableau:views:embed` and `tableau:views:embed_authoring`, the scope respects users’ permissions already configured in Tableau Cloud and allows users to interact with the tools in the embedded view if available in the original view. We recommend the embed code exclude the toolbar parameter. For more information see Known issues (embedding workflows only) below. For REST API authorization workflows, see REST API methods that support JWT authorization. For Metadata API workflows that use the REST API for authentication, the only supported scope is `tableau:content:read`. For VizQL Data Service workflows that use the REST API for authentication, the only supported scope is `tableau:viz_data_service:read`.
`https://tableau.com/oda`	On-demand access - claim (enable capability)	For embedding workflows only. Value must be "`true`" and one or more Tableau Cloud groups must be specified (see next row). For more information, including prerequisites like the Embedding Analytics or Capacity-based Viewer Blocks license, see the Customize and Control Data Access page in the Tableau Embedding API v3 Help.
`https://tableau.com/groups`	On-demand access - claim (specify group name)	For embedding workflows only. Value must match the name of one or more groups in Tableau Cloud. For more information, including prerequisites like the Embedding Analytics or Capacity-based Viewer Blocks license, see the Customize and Control Data Access page in the Tableau Embedding API v3 Help.
`https://tableau.com/groups`	Dynamic group membership	For embedding workflows only. Value must match the name of one or more groups in Tableau Cloud. For more information, see Dynamic group membership using assertions.
(User attribute)	(User attribute values)	For embedding workflows only. You can include user attributes in the JWT. Then when user attribute functions are used in embedded content, Tableau checks the authenticated user’s context and determines what data can display at runtime. Notes: Check the Tableau Embedding API v3 Help for known issues and limitations that might affect your workflow. For the user attribute to work, 1) you must enable the Control User Access in Authentication Workflows setting and 2) the content author must create a user attribute function. User attributes are case sensitive.

#### Example JWTs Here are example JWTs in both Java and Python languages. The Java and Python examples use the nimbus-jose-jwt library and the PyJWT library, respectively. **Java** import com.nimbusds.jose.\*; import com.nimbusds.jose.crypto.\*; import com.nimbusds.jwt.\*; import java.util.\*; ... String secret = "secretvalue"; String kid = "connectedAppSecretId"; String clientId = "connectedAppClientId"; List scopes = new ArrayList<>(Arrays.asList("tableau:views:embed")); String username = "user@domain.com"; JWSSigner signer = new MACSigner(secret); JWSHeader header = new JWSHeader.Builder(JWSAlgorithm.HS256).keyID(kid).customParam("iss", clientId).build(); JWTClaimsSet claimsSet = new JWTClaimsSet.Builder() .issuer(clientId) .expirationTime(new Date(new Date().getTime() + 60 \* 1000)) //expires in 1 minute .jwtID(UUID.randomUUID().toString()) .audience("tableau") .subject("username") .claim("scp", scopes) .claim("https://tableau.com/oda", "true") .claim("https://tableau.com/groups", "Contractors", "Team C", "Group1", "Group2") .claim("Region", "East") .build(); SignedJWT signedJWT = new SignedJWT(header, claimsSet); signedJWT.sign(signer); model.addAttribute("token", signedJWT.serialize()); **Python** import jwt token = jwt.encode( { "iss": connectedAppClientId, "exp": datetime.datetime.utcnow() + datetime.timedelta(minutes=5), "jti": str(uuid.uuid4()), "aud": "tableau", "sub": user, "scp": \["tableau:views:embed", "tableau:metrics:embed"\], "https://tableau.com/oda":"true", "https://tableau.com/groups": \["Contractors", "Team C", "Group1", "Group2"\], "Region": "East" }, connectedAppSecretKey, algorithm = "HS256", headers = { 'kid': connectedAppSecretId, 'iss': connectedAppClientId } ) After you’ve configured the JWT, when the code is run by your external application, it will generate a token. ### Step 4: Next steps #### For embedding workflows After the JWT has been configured, you must add embed code to your external application. Ensure that you include the valid JWT you configured in Step 3 above in the web component that your external application calls. For more information about embedding Tableau content and capabilities supported in embedding workflows, see the following: - Embed Tableau content using the [Tableau Embedding API v3](https://help.tableau.com/current/api/embedding_api/en-us/index.html). - User attributes for attribute-based access control (ABAC), on-demand access, and dynamic group membership, see [Customize and Control Data Access](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_user_attributes.html) in the Tableau Embedding API v3. - Embed metrics, see [Embed Metrics into Webpages](https://help.tableau.com/current/pro/desktop/en-us/embed_metrics.htm) topic in the Tableau Help. (In October 2023 (Tableau 2023.3), Tableau retired the ability to embed metrics.) **Note:** For users to successfully authenticate when they access embedded content, browsers must be configured to allow third-party cookies. #### For REST API authorization workflows After the JWT has been configured, you must add the valid JWT to the REST API Sign In request for authorized access. For more information, see [Access Scopes for Connected Apps](https://help.tableau.com/v0.0/online/en-us/connected_apps_scopes.htm). #### For Metadata API workflows After the JWT has been configured, you must add the valid JWT to the REST API Sign In request. For more information, see [Access Scopes for Connected Apps](https://help.tableau.com/v0.0/online/en-us/connected_apps_scopes.htm). #### For external tokens for SCIM workflows After the JWT has been configured, you must have SAML authentication configured and the SCIM capability enabled. For more information, see [Configure Connected Apps with Direct Trust](#scim). ## Manage a connected app The Connected Apps page is where you can manage all the connected apps for your site. You can perform tasks such creating, deleting, and disabling connected apps; and revoking or generating new secrets if existing secrets have been compromised. 1. As a site admin, sign in to Tableau Cloud. 2. From the left pane, select Settings > Connected Apps. 3. Select the check box next to the connected app you want to manage and do one or more of the following: - **Generate a new secret** according to the rotation timeline specified by your organization’s security policies. To generate an additional secret, click on the name of the connected app and then click the Generate New Secret button. A connected app can have a maximum of two secrets. Both secrets can be active at the same time, do not expire, and remain valid until deleted. - **Review the connected app details** by selecting the name of the connected app to see when the connected app was created, its ID, project and domain scopes, and its secrets. - **Change the project scope or domain**, in the Actions menu, select Edit. Make your changes and select Update. **Note:** If you change the project or domain scopes and the embedded content doesn’t exist in either the new project or new domain, the embedded view or metric is unable to display and users will see an error when accessing the embedded content. - **Delete a secret** by selecting the connected app's name. On the connected app’s page, click Actions next to the secret and select Delete. In the confirmation dialog box, select Delete again. **Note:** If the connected app’s secret is being used by an external application, the embedded view or metric is unable to display after the secret is deleted. For more information, see [Effects of disabling or deleting a connected app, or deleting a secret](#effects) below. - **Disable a connected app**, in the Actions menu, select Disable. If the connected app is being used by an external application, the embedded view or metric is unable to display after the connected app is disabled. For more information, see [Effects of disabling or deleting a connected app, or deleting a secret](#effects) below. ![A form displaying two randomly generated client codes.](/tableau/next/en-us/online/en-us/Img/connectedapp_details.png) ### Effects of disabling or deleting a connected app, or deleting a secret To display embedded content to your user or enable REST API access through a connected app, the connected app must be enabled and its secret generated. If the connect app is being used in your external application and is either disabled or deleted, or its secret deleted or replaced, users will get a 403 error. To avoid this issue, ensure the connect app is enabled and the JWT is using the correct secret ID and value. ### Access level (embedding workflows only) You can select one of two project types when configuring a connected app's access level. The access level controls which content can be embedded. - **All projects:** This option enables the content in all projects to be embedded - **Only one project:** This option enables only the content in the specified project to be embedded. If the specified project contains nested projects, embedding content in those nested projects is not enabled. **About multiple projects** Starting in February 2024 (Tableau 2024.1), you can enable the content in multiple projects for a connected app using the Tableau REST API only. To specify which projects, use the "project IDs" in either the [Create a Connected App](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_connected_app.htm#create_connectedapp) or [Update a Connected App](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_connected_app.htm#update_connectedapp) methods. **Note:** When multiple projects are configured for your connected app, Tableau displays **Multiple projects** for the connected app's access level. If you select either Only one project or All projects and update the connected app, the "Multiple projects" option will no longer be visible. If you need to configure the connected app for multiple projects again, you must use the REST API. ### Domain allowlist rules (embedding workflows only) The connected app’s domain allowlist enables you to restrict access to embedded Tableau content to all domains or some domains; or exclude some domains or block all domains. **Important:** We recommend using the domain allowlist as a security best practice to ensure Tableau content is only embedded in locations that you allow. #### Domain options You can select one of two options when configuring a connected app’s domain allowlist: - **All domains:** As the default option, this option enables unrestricted access to embedded content. - **Only specific domains:** This option gives you the ability to scope down access to embedded content. If you use this option, follow the formatting rules specified in the following section, [Domain formatting](#domain_formatting). #### Domain formatting In the domain allowlist text box, you can enter one or more domains using the formatting examples below. **Note:** Domain formatting rules also apply when using the [Connect App methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_connected_app.htm) in the Tableau REST API. Here are some formatting examples based on common scenarios:

To specify...	Example	Embedding access
Range of domains	*.myco.com	Embedded content is accessible from all subdomains under myco.com.
All ports	myco.com:*	Embedded content is access from all ports in myco.com.
Specific port	myco.com:8080	Embedded content is accessible from port 8080 in myco.com only.
Multiple discrete domains	myco.com events.myco.com ops.myco.com	Embedded content is accessible from all three domains. Note: When specifying multiple domains, type each domain on a new line or separate domains with a space. For the REST API, domains must be separated by a space.
Secure traffic only	https://	Embedded content is securely accessible regardless of domain.
Secure traffic to all ports for a range of domains	https://myco.com:	Embedded content is securely accessible from all ports on all subdomains under myco.com.
No domains	[no domains]	Access to embedded content is blocked.

### Known issues (embedding workflows only) There are a couple of known issues when using connected apps that will be addressed in a future release. - **Toolbar features:** When embedded content has the toolbar parameter defined, not all toolbar features will work. To work around this issue, we recommend you hide the toolbar parameter like in the example below. - **Published data sources:** Published data sources set to Prompt User for database credentials will not display. To work around this issue, if possible, we recommend data source owners embed their database credentials instead. - **Ask Data objects in embedded dashboards:** Ask Data objects in embedded dashboards will not load. (In February 2024 (Tableau 2024.1), Tableau retired Ask Data.) - **Metrics and domain allowlists:** Embedded metrics views will display despite access restrictions that might be specified in the connected apps' domain allowlists. **Note:** Metrics data accessed from toolbars of embedded views will work as expected. (In October 2023 (Tableau 2023.3), Tableau retired the ability to embed metrics.) ## Troubleshoot You can refer to [Troubleshoot Connected Apps - Direct Trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_troubleshoot.htm) for errors that might be associated with the connected app and suggested troubleshooting steps. [Skip to main content](#main-content) # Configure Connected Apps with OAuth 2.0 Trust As a Tableau Cloud site admin, you can register one or more external authorization servers (EASs) to establish a trust relationship between your Tableau Cloud site and the EAS using the OAuth 2.0 standard protocol. **Important:** - Some of the procedures in this topic require configuration with third party software and services. We’ve made a best effort to verify the procedures to enable the EAS feature on Tableau Cloud. However, third-party software and services might change or your organization might differ. If you encounter issues, refer to your third-party documentation for authoritative configuration details and support. - In order for the session token to be valid, the clocks of the external application and the server that hosts the external application must be set to Coordinated Universal Time (UTC). If either clock uses a different standard, the connected app will not be trusted. ## How Tableau connected apps work with OAuth 2.0 trust The trust relationship between your Tableau Cloud site and external application is established and verified through an authentication token in the JSON Web Token (JWT) standard. When embedded Tableau content is loaded in your external application, Authorization Code Flow, OAuth flow is used. After users successfully sign in to the IdP, they are then automatically signed in to Tableau Cloud. Follow the steps described below to register your EAS with your Tableau Cloud site. ### Key components of a connected app The following components of the connected work together with the JWT in your external application to authenticate users and display embedded content. - **External authorization server (EAS):** The server, typically your IdP, that functions as the interface between the user and the external application. The server authenticates and authorizes user access to the protected Tableau content. - **Issuer URL:** The URL that uniquely identifies the EAS instance. ### Connected app workflow #### Embedding workflows The diagram below illustrates how authentication works between your external authorization server (EAS), external application (web server and webpage), and Tableau connected app. ![](/tableau/next/en-us/online/en-us/Img/connectedapp_how_EAS.png) 1. **User visits the webpage:** When a user visits the embedded content on a webpage, the webpage sends a GET request to the external application. 2. **External application redirects request to EAS:** External application responds with a webpage that redirects to the external authorization server (EAS). 3. **User authenticates with EAS:** User authenticates and authorizes with the EAS. 4. **EAS responds to webpage with authorization code:** The EAS responds to the page with an authorization code and redirects back to the webpage. 5. **EAS converts authorization code to JWT:** Webpage calls the EAS to convert the authorization code to a JWT, which the webpage puts into the embedded content’s URL. 6. **Webpage requests content from Tableau:** Webpage loads the iFrame and sends a GET request to Tableau. 7. **Tableau validates the token:** Tableau validates the JWT in the URL with the signature and responds with the content and respects the embedding scopes defined in the JWT. ## Create a connected app ### Step 1: Before you begin To register an EAS with your Tableau Cloud site, you must have an EAS already configured. In addition, the EAS must send a valid JSON Web Token (JWT) that contains the registered claims and header listed in the table below.

Claim	Name	Description or required value
"`kid`"	Key ID	Required (in header). A unique key identifier from the identity provider.
"`iss`"	Issuer	Required (in header or as a claim). Unique issuer URI, in HTTPS, that identifies the trusted connect app and its signing key.
"`alg`"	Algorithm	Required (in header). JWT signing algorithm. Supported algorithm names are listed in the Class JWSAlgorithm page in the javadoc.io documentation.
"`sub`"	Subject	User name (email address) of the authenticated Tableau Cloud user.
"`aud`"	Audience	Value must be: "`tableau:<site_luid>`" To obtain the site LUID, you can use the Tableau REST API's Sign In method or follow the steps below to copy the site ID. Note: You must register an EAS using the procedure described here before you can copy the site ID. Select Settings > Connected Apps and then select the External Authorization Server connected app. Click the Copy Site ID button.
"`exp`"	Expiration Time	A valid JWT must not be expired. The expiration time (in UTC) of the JWT must be within the maximum validity period, which is 10 minutes.
"`jti`"	JWT ID	The JWT ID claim provides a unique identifier for the JWT and is case sensitive.
"`scp`"	Scope	For embedding workflows, supported values include: "`tableau:views:embed`" "`tableau:views:embed_authoring`" "`tableau:metrics:embed`" (Retired in October 2023 (Tableau 2023.3)) "`tableau:ask_data:embed`"(Retired in February 2024 (Tableau 2024.1)) Notes: Values must be passed as a list type. For `tableau:views:embed`, the scope respects users’ permissions already configured in Tableau Cloud and allows users to interact with the tools in the embedded view if available in the original view. We recommend the embed code exclude the toolbar parameter. For more information see Known issues (embedding workflows only) below. For REST API authorization workflows, see REST API methods that support JWT authorization. For Metadata API workflows that use the REST API for authentication, the only supported scope is `tableau:content:read`. For VizQL Data Service workflows that use the REST API for authentication, the only supported scope is `tableau:viz_data_service:read`.
`https://tableau.com/oda`	On-demand access - claim (enable capability)	For embedding workflows only. Value must be "`true`" and one or more Tableau Cloud groups must be specified (see next row). For more information, including prerequisites like the Embedding Analytics or Capacity-based Viewer Blocks license, see the Customize and Control Data Access page in the Tableau Embedding API v3 Help.
`https://tableau.com/groups`	On-demand access - claim (specify group name)	For embedding workflows only. Value must match the name of one or more groups in Tableau Cloud. For more information, including prerequisites like the Embedding Analytics or Capacity-based Viewer Blocks license, see the Customize and Control Data Access page in the Tableau Embedding API v3 Help.
`https://tableau.com/groups`	Dynamic group membership	For embedding workflows only. Value must match the name of one or more groups in Tableau Cloud. For more information, see Dynamic group membership using assertions.
(User attributes)	(User attribute values)	For embedding workflows only. You can include user attributes in the JWT. Then when user attribute functions are used in embedded content, Tableau checks the authenticated user’s context and determines what data can display at runtime. Notes: Check the Tableau Embedding API v3 Help for known issues and limitations that might affect your workflow. For the user attribute to work, 1) you must enable the Control User Access in Authentication Workflows setting and 2) the content author must create a user attribute function. User attributes are case sensitive.

**Note:** The JWT claims above are documented in the [Registered Claim Names](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1) section in the documentation distributed by the Internet Engineering Task Force (IETF) organization. ### Step 2: Register your EAS with Tableau Cloud By registering your EAS with Tableau Cloud, you establish a trust relationship between the EAS and your Tableau Cloud site. This means when users access Tableau content embedded in your external application, they are redirected to authenticate with the IdP. The EAS generates the authentication token, which is passed to Tableau Cloud for verification. After the trust relationship is verified, access to the embedded content is granted users. **Note:** Some EAS support the option to display a consent dialog that asks for users’ approval for the application to access Tableau content. To ensure the best experience for your users, we recommend you configure your EAS to automatically consent to the external application’s request on users’ behalf. 1. As a site admin, sign in to Tableau Cloud. 2. From the left pane, select Settings > Connected Apps. 3. Click the New Connected App button drop-down arrow and select OAuth 2.0 Trust. 4. In the Create Connected App dialog box, do the following: 1. In the Name text box, enter a name for the connected app. 2. In the Issuer URL text box, paste the issuer URL of the EAS. 3. Select the Enable connected app. For security purposes, a connected app is set to disabled by default when created. 4. When finished, click the Create button. ![A form to create a connected app, complete with fields for name, URLs, and a checkbox to enable the app.](/tableau/next/en-us/online/en-us/Img/connectedapp_create_eas.png) 5. After the connected app is created, copy the connected app’s site ID. The site ID is used for the JWT's "aud" (Audience) claim described in Step 1 above. ![Details of the external authorization server, with a button to copy the site ID.](/tableau/next/en-us/online/en-us/Img/connectedapp_eas_button_luid.png) ### Step 3: Next steps #### For embedding workflows After configuring your Tableau Cloud site to use your EAS, you must add embed code to your external application. Ensure that you include the valid JWT generated by your EAS, as described in Step 1, in the web component that your external application calls. For more information about embedding Tableau content, see the following: - Embed Tableau content using the [Tableau Embedding API v3](https://help.tableau.com/current/api/embedding_api/en-us/index.html). - User attributes for attribute-based access control (ABAC), on-demand access, and dynamic group membership, see [Customize and Control Data Access](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_user_attributes.html) in the Tableau Embedding API v3. - Embed metrics, see [Embed Metrics into Webpages](https://help.tableau.com/current/pro/desktop/en-us/embed_metrics.htm) topic in the Tableau Help. (In October 2023 (Tableau 2023.3), Tableau retired the ability to embed metrics.) **Note:** For users to successfully authenticate when they access embedded content, browsers must be configured to allow third-party cookies. ##### Control where content can be embedded using domain allowlist for embedding Starting in June 2023 (Tableau 2023.2), you and your users can control whether Tableau content can be embedded without restriction or restricted to certain domains using the Update Embedding Settings for Site method in Tableau REST API. By default, the `unrestrictedEmbedding` site setting for embedding is set to `true` to allow unrestricted embedding. Alternatively, you and your users can set the setting to `false` and specify the domains where Tableau content in external applications can be embedded using the `allowList` parameter. For more information, see one or both of the following: - [Update Embedding Settings for Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_site.htm#update_embedding_settings_for_site) in the Tableau REST API Help - [Tableau Site Setting for Embedding](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_site.html#about-tableau-site-settings-for-embedding) in the Tableau Embedding API v3 Help. #### For REST API authorization workflows After the JWT has been configured, you must add the valid JWT to the REST API Sign In request for authorized access. For more information, see [Access Scopes for Connected Apps](https://help.tableau.com/v0.0/online/en-us/connected_apps_scopes.htm). #### For Metadata API workflows After the JWT has been configured, you must add the valid JWT to the REST API Sign In request. For more information, see [Access Scopes for Connected Apps](https://help.tableau.com/v0.0/online/en-us/connected_apps_scopes.htm). #### For external tokens for SCIM workflows After the JWT has been configured, you must have SAML authentication configured and the SCIM capability enabled. For more information, see [Configure Connected Apps with OAuth 2.0 Trust](#scim). ### Known issues (embedding workflows only) There are a couple of known issues when using connected apps that will be addressed in a future release. - **Toolbar features:** When embedded content has the toolbar parameter defined, not all toolbar features will work. To work around this issue, we recommend you hide the toolbar parameter like in the example below. - **Published data sources:** Published data sources set to Prompt User for database credentials will not display. To work around this issue, if possible, we recommend data source owners embed their database credentials instead. ### Troubleshoot When embedded content fails to display in your external application or Tableau REST API authorization fails, you can use a browser’s developer tools to inspect and identify error codes that might be associated with the EAS feature enabled on your Tableau Cloud site. Refer to the table below to review the description of the error code and potential resolution.

Error code	Summary	Description	Potential resolution or explanation
5	SYSTEM_USER_NOT_FOUND	Tableau user could not be found	To resolve this issue, verify the '`sub`' (Subject) claim value in the JWT is the user name (email address) of the authenticated Tableau Cloud user. This value is case sensitive.
16	LOGIN_FAILED	Login failed	This error is typically caused by one of the following claim issues in the JWT: The '`exp`' (Expiration Time) exceeds the default maximum validity period. To resolve this issue, review registered claims required for a valid JWT and ensure the correct value does not exceed 10 minutes. The '`sub`' (Subject) is calling an unknown user. To resolve this issue, verify the '`sub`' value is the user name (email address) of the authenticated Tableau Cloud user.
67	FEATURE_NOT_ENABLED	On-demand access is not supported	On-demand access is available through licensed Tableau Cloud sites only.
142	EXTERNAL_AUTHORIZATION_SERVER_NOT_FOUND	EAS not found	To resolve this issue, verify the correct issuer is being called.
143	EXTERNAL_AUTHORIZATION_SERVER_LIMIT_EXCEEDED	EAS limit exceeded	The site has reached the maximum allowable number (1) of registered external authorization servers (EAS).
144	INVALID_ISSUER_URL	Invalid issuer URL	The issuer URL is not valid or the '`iss`' (Issuer) attribute is missing from the JWT.
149	EAS_INVALID_JWKS_URI	Missing JWKS URI	JWKS URI does not exist in the IdP metadata or the JWKS URI is not configured in Tableau. To resolve this issue, configure a valid JWKS URI.
150	EAS_RETRIEVE_JWK_SOURCE_FAILED	Failure in retrieving keysource	To resolve this issue, verify the JWKS URI is configured correctly.
151	EAS_RETRIEVE_METADATA_FAILED	Failure in retrieving metadata from issuerUrl	To resolve this issue, verify the JWKS URI is configured correctly.
10081	COULD_NOT_RETRIEVE_IDP_METADATA	Missing EAS metadata endpoint	To resolve this issue, verify the EAS is configured correctly and the correct issuer is being called.
10082	AUTHORIZATION_SERVER_ISSUER_NOT_SPECIFIED	Missing issuer	To resolve this issue, verify the correct issuer is being called.
10083	BAD_JWT	JWT header contains issues	The '`kid`' (Secret ID) or '`clientId`' (Issuer) claims are missing from the JWT header. To resolve this issue, ensure this information is included.
10084	JWT_PARSE_ERROR	JWT contains issues	To resolve this issue, verify the following: The '`aud`' (Audience) value referenced in the JWT uses the "tableau" value. This value is case sensitive. The '`aud`' (Audience) and '`sub`' (Subject) are included in the JWT.
10085	COULD_NOT_FETCH_JWT_KEYS	JWT could not find keys	Could not find the secret. To resolve this issue, verify the correct issuer is being called.
10087	BLOCKLISTED_JWS_ALGORITHM_USED_TO_SIGN	Issue with the JWT signing algorithm	To resolve the issue, you can remove the signing algorithm.
10088	RSA_KEY_SIZE_INVALID	Issue with JWT signing requirements	To resolve this issue, verify with the EAS or IdP the JWT is being signed with an RSA key size of 2048.
10091	JTI_ALREADY_USED	Unique JWT required	The JWT has already been used in the authentication process. To resolve this issue, the EAS or IdP must generate a new JWT.
10092	NOT_IN_DOMAIN_ALLOW_LIST	Domain of the embedded content is not specified	To resolve this issue, ensure the `unrestrictedEmbedding` setting is set to `true` or `domainAllowlist` parameter includes the domains where Tableau content is embedded using the Update Embedding Settings for Site method in the Tableau REST API.
10094	MISSING_REQUIRED_JTI	Missing JWT ID	To resolve this issue, verify the '`jti`' (JWT ID) is included in the JWT.
10095	EXTERNAL_AUTHZ_SERVER_DISABLED	EAS disabled	The connected app for the EAS registered to the site is disabled.
10096	JWT_EXPIRATION_EXCEEDS_CONFIGURED_EXPIRATION_PERIOD		The '`exp`' (Expiration Time) exceeds the default maximum validity period. To resolve this issue, review registered claims required for a valid JWT and ensure the correct value does not exceed 10 minutes.
10097	SCOPES_MALFORMED	Issues with scopes claim	This error can occur when the '`scp`' (Scope) claim is either missing from the JWT or not passed as a list type. To resolve this issue, verify '`scp`' is included in the JWT and passed as a list type. For troubleshooting help with a JWT, see Debugger on the auth0 site.
10098	JWT_UNSIGNED_OR_ENCRYPTED	JWT is unsigned or encrypted	Tableau does not support an unsigned or encrypted JWT.
10099	SCOPES_MISSING_IN_JWT	Missing scopes claim	The JWT is missing the required '`scp`' (Scope) claim. To resolve this issue, verify '`scp`' is included in the JWT. For troubleshooting help with a JWT, see Debugger on the auth0 site.
10100	JTI_PERSISTENCE_FAILED	Unexpected JWT ID error	There was an unexpected error with the '`jti`' (JWT ID). To resolve this issue, a new JWT with a new '`jti`' must be generated.
10101	EPHEMERAL_USER_LOGIN_FAILED_SITE_NOT_UBP_ENABLED	On-demand access is not supported	The site is not licensed with the Embedded Analytics usage-based model that is required to enable on-demand access. For more information, see Understanding License Models.
10102	EPHEMERAL_USER_NOT_SUPPORTED	On-demand access is not supported when iframe-auth attribute is enabled	This error can occur when the iframe-auth attribute is enabled. To resolve this issue, verify that the Tableau Embedding API version 3.6 or later is being used.
10103	JWT_MAX_SIZE_EXCEEDED	JWT exceeds maximum size	This error can occur when JWT size exceeds 8000 bytes. To resolve this issue, make sure that only the necessary claims are being passed to Tableau Cloud.
10113	EPHEMERAL_USER_LOGIN_FAILED_SITE_NOT_ENTITLED_FOR_ODA_ACCESS	On-demand access is not supported	This site is not licensed with Embedded Analytics usage-based model; or Capacity-based Viewer Blocks is not enabled with Cloud+ or Tableau+ edition, which is required for on-demand access. For more information, see Usage-based license model or Capacity-based license model.

[Skip to main content](#main-content) # Configure Connections with Analytics Extensions Analytics extensions allow you to extend Tableau dynamic calculations in a workbook with languages like R and Python, with Einstein Discovery, and with other tools and platforms. These settings endpoints enable you to configure analytics extensions on your site in Tableau Cloud. For more information, see [Analytics Extensions API](https://tableau.github.io/analytics-extensions-api/). For more information about user scenarios and configuring analytics connections in Tableau Desktop or for web authoring, see [Pass Expressions with Analytics Extensions](https://help.tableau.com/current/pro/desktop/en-us/r_connection_manage.htm), in the _Tableau Desktop and Web Authoring Help_. **Note:** Beginning in June 2021, you can create multiple analytics extensions connections for a site, including multiple connection for the same type of extension (you are presently limited to a single Einstein Discovery analytics extension for each site). For details, see [Tableau Cloud Release Notes](https://help.tableau.com/v0.0/online/en-us/whatsnew_online.htm#2021-2-multiple-analytics-ext-per-TOLsite). This topic describes how to configure sites on Tableau Cloud with analytics extensions. ## Security requirements and configuration For increased security, Tableau Cloud requires an encrypted channel and authenticated access to the external services used for analytics extensions. ### Certificate The server running the external service for analytics extensions must be configured with a valid TLS/SSL certificate from a trusted 3rd party certificate authority (CA). Tableau Cloud will not establish a connection with external servers that are configured with a self-signed certificate, a certificate from a private PKI, or a certificate that is not trusted by an established 3rd party CA. ### Safelist firewall configuration Many organizations deploy a firewall that requires safelist exceptions for known hosts outside the network. In this scenario, you will need to specify two Tableau Cloud IP addresses as exceptions. The Tableau Cloud IP addresses used for connections to analytics extensions servers are `44.224.205.196` and `44.230.200.109`. ## Configure analytics extensions settings 1. Sign in to Tableau Cloud as a site administrator. 2. Click Settings. 3. On the Settings page, click the Extensions tab and then scroll to Analytics Extensions. 4. Select Enable analytics extensions for site. 5. Click Create new connection. 6. In the New Connection dialog, click the connection type you want to add, then enter the configuration settings for your analytics service: ![New Connection dialog shown with four options for connection type selections: TabPy, Einstein Discovery, RServe, and Analytics Extensions API.](/tableau/next/en-us/online/en-us/Img/analytics-extension-site-cx-type.png) 7. The options you need to configure depend on the connection type you choose: - For an Einstein Discovery connection, click Enable. - For TabPy, Rserve, and Analytics Extensions API connections, enter the following information: - Connection Name: Specify the server type you are connecting to. RSERVE supports connections to R using the Rserve package. TABPY supports connections to Python using TabPy, or to other analytics extensions. - Require SSL: Select this option to encrypt the connection to the analytics service. If you specify a `HTTPS` URL in the Hostname field, then you must select this option. - Hostname: Specify the computer name or URL where the analytics service is running. This field is case sensitive. - Port: Specify the port for the service. - Sign in with a username and password: Select this option to specify user name and password that is used to authenticate to the analytics service. **Important:** Beginning with version 2026.3.0 new Rserve connections default to HTTP instead of TCP. You can still configure Rserve connections over TCP and while there is currently no depreciation date for TCP connections, these _will_ eventually be deprecated. Once deprecated, all connections to Rserve will require HTTP. We recommend that you migrate your existing Rserve TCP connections to HTTP before deprecation. If you do this now you will not need make any additional changes once Rserve TCP is fully deprecated. For details on how to switch an existing Rserve connection from TCP to HTTP, see 8. Click Save. ### Edit or delete an analytics extension connection To edit or delete a configuration, navigate to Analytics Extensions on the Extensions tab of your site. ![Edit and Delete icons highlighted in the Analytics Extensions options.](/tableau/next/en-us/online/en-us/Img/analytics-extension-edit-delete.png) Click the Edit or Delete icon and follow the prompts to change the configuration. ## Script errors Tableau cannot verify that workbooks that use an analytics extension will render properly on Tableau Cloud. There might be scenarios where a required statistical library is available on a user's computer but not on the analytics extension instance that Tableau Cloud is using. A warning will be displayed when you publish a workbook if it contains views that use an analytics extension. This worksheet contains external service scripts, which cannot be viewed on the target platform until the administrator configures an external service connection. ## Other articles in this section [Skip to main content](#main-content) # Configure CORS in Salesforce.com for Einstein Discover Integration in Tableau Cloud In version 2021.1.0 the ability to integrate Einstein Discovery predictions into Tableau Dashboards was added. You can do this using the Einstein Discovery dashboard extension. A prerequisite for this is configuring Cross-Origin Resource Sharing (CORS) in the Salesforce org that hosts Tableau CRM and includes the model and predictions that are going to be used. This procedure explains how an administrator in a Salesforce.com organization would do this configuration. You can find more information about CORS in the Salesforce documentation, [Configure Salesforce CORS Allowlist](https://help.salesforce.com/s/articleView?id=sf.extend_code_cors.htm). ## Configure CORS for Einstein Discovery. **Note:** This procedure documents the process in Salesforce Lightning. If you are using the traditional interface, the navigation may be different but the configuration is the same. 1. Sign in to your Salesforce.com developer account, click your user name in the upper-right, and then select Setup. ![A gear icon with a tooltip that says Setup.](/tableau/next/en-us/online/en-us/Img/config_oauth_einstein_cxapp_setup.png) 2. In the left navigation column, search for "cors" and select CORS . ![Search field with CORS entered as a search term, and the CORS search result shown.](/tableau/next/en-us/online/en-us/Img/config_cors_einstein_search.png) 3. In CORS, in the Allowed Origins List section, click New. ![CORS setup window with the Allowed Origins List shown and a cursor hovering over the New button.](/tableau/next/en-us/online/en-us/Img/config_cors_einstein_new.png) 4. In CORS Allowed Origin List Edit, enter the URL of Tableau Cloud, beginning with "https://". ![CORS setup window with an original URL pattern entered and a cursor hovering over the Save button.](/tableau/next/en-us/online/en-us/Img/config_cors_einstein_allow_list.png) For more information about the URL pattern, see the Salesforce developer documentation: [https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/extend\_code\_cors.htm](https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/extend_code_cors.htm) 5. Click Save. [Skip to main content](#main-content) # Configure External OAuth for Impala Starting in Tableau 2025.3 for Tableau Desktop and Tableau Server, and 2026.1 for Tableau Cloud, you can use OAuth 2.0/OIDC to federate identity from an external identity provider to Impala. Depending on the identity provider, there are different steps needed to configure the integration. This is a high-level overview. ## Configure IDP on Impala For information on configuring your IdP on Impala, see [Configuring OAuth Authentication](https://docs.cloudera.com/cdp-private-cloud-base/7.1.9/impala-secure/topics/impala-oauth.html "Link to Cloudera docs for configuring OAuth on Impala") in the Cloudera documentation. ## Configure the IDP 1. Create OAuth clients on the IDP for Tableau Desktop, and Tableau Server or Tableau Cloud. The Tableau Desktopclient should enable `[PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce)` and use `http://localhost` redirects. 2. Create the Tableau OAuth config files. For details on how to do this, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) on [GitHub](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth documentation on GitHub"), and examples [here](https://github.com/tableau/connector-plugin-sdk/tree/master/samples/components/oauth "OAuth examples on GitHub."). We welcome examples for other IDPs. 1. Be sure to prefix the Tableau OAuth config IDs with "`custom_`". **Note:** OAuth config IDs have a maximum limit of 36 characters. IDs longer than this may not generate an error, but will not work. 2. If your IDP supports dynamic localhost port then disable `OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL`. If your IDP does not support this, make sure to add several localhost callback URLs to the allowlist in the config file and on the IDP. 3. Install the new Tableau OAuth configuration files in the `OAuthConfigs` folder associated with each application on desktop hosts (Tableau Desktop, Tableau Prep Builder, Tableau Bridge), and on each Tableau Server and Tableau Cloud site that will be using OAuth, via the site settings page. For more details, see [Custom OAuth Configs on Tableau Desktop](https://tableau.github.io/connector-plugin-sdk/docs/oauth#custom-oauth-configs-on-desktop) and [Site Level OAuth Clients](https://tableau.github.io/connector-plugin-sdk/docs/oauth#site-level-oauth-clients). ## Connect to Impala The user must select Sign in using OAuth, and select the OAuth Provider installed earlier. ![](/tableau/next/en-us/online/en-us/Img/impala_oauth_connect.png) [Skip to main content](#main-content) # Configure External OAuth for SAP HANA Starting in Tableau 2024.3 for Tableau Cloud, you can use OAuth 2.0/OIDC to federate identity from an external identity provider to HANA. Depending on the identity provider, there are different steps needed to configure the integration. This is a high-level overview. **Note**: Single use refresh tokens (sometimes called rolling refresh tokens or refresh token rotation) are not supported for OAuth connections using Tableau Bridge to Tableau Cloud. Support for these tokens are planned for a future release. ## Configure IDP on HANA For information on configuring your IdP on HANA, see [Single Sign-On Using JSON Web Tokens](https://help.sap.com/docs/hana-cloud-database/sap-hana-cloud-sap-hana-database-security-guide/single-sign-on-using-json-web-tokens) in the SAP help system. Here are some examples of different ways to set up IdP: - Okta IdP using HANA Cockpit: [Connect to SAP HANA Cloud With Okta Account](https://help.alteryx.com/current/en/designer/data-sources/sap-hana/connect-to-sap-hana-cloud-with-okta-account.html#connect-to-sap-hana-cloud-with-okta-account) - Azure IdP using HANA Studio: [Setting Up an SAP HANA Instance with OAuth or SSO](https://www2.microstrategy.com/producthelp/Current/Gateway_Connections/WebHelp/Lang_1033/Content/sap_hana_instance_oauth_sso.htm) ## Configure the IDP 1. Create OAuth clients on the IDP for Tableau Desktop, and Tableau Server or Tableau Cloud. The Desktop client should enable `[PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce)` and use `http://localhost` redirects. 2. Create the Tableau OAuth config files. For details on how to do this, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) on [GitHub](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth documentation on GitHub"), and examples [here](https://github.com/tableau/connector-plugin-sdk/tree/master/samples/components/oauth "OAuth examples on GitHub."). We welcome examples for other IDPs. 1. Be sure to prefix the Tableau OAuth config IDs with "`custom_`". **Note:** OAuth config IDs have a maximum limit of 36 characters. IDs longer than this may not generate an error, but will not work. 2. If your IDP supports dynamic localhost port then disable `OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL`. If your IDP does not support this, make sure to add several localhost callback URLs to the allowlist in the config file and on the IDP. 3. Install the new Tableau OAuth configuration files in the `OAuthConfigs` folder associated with each application on desktop hosts (Tableau Desktop, Tableau Prep Builder, Tableau Bridge), and on each Tableau Server and Tableau Cloud site that will be using OAuth, via the site settings page. For more details, see [Custom OAuth Configs on Desktop](https://tableau.github.io/connector-plugin-sdk/docs/oauth#custom-oauth-configs-on-desktop) and [Site Level OAuth Clients](https://tableau.github.io/connector-plugin-sdk/docs/oauth#site-level-oauth-clients). ## Connect to HANA The user must select Sign in using OAuth, and select the OAuth Provider installed earlier. ![](/tableau/next/en-us/online/en-us/Img/hana_connect.png) ## Okta If using Okta it's better to use a "custom authorization server" rather than the "org authorization server." The custom authorization servers are more flexible. There is a custom authorization server created by default, which is called "default". The authorization URL should look like this: https://${yourOktaDomain}/oauth2/{authServerName}/v1/authorize ![](/tableau/next/en-us/online/en-us/Img/redshift_oauth_iam_okta_800x332.png) [Skip to main content](#main-content) # Configure External OAuth for Snowflake: Client Credentials Flow OAuth client credentials authentication enables machine-to-machine connections to Snowflake without user interaction. This method is ideal for: - Service accounts for automated data refreshes - Scheduled extract jobs - CI/CD pipelines - Published data sources that require embedded credentials Unlike standard OAuth (which uses the authorization code flow), client credentials flow does not prompt users to sign in. Instead, Tableau authenticates directly with your identity provider using a client ID and secret. **Note:** Client credentials flow requires Snowflake's External OAuth feature with a supported identity provider. This is different from Snowflake's native OAuth. ## Before you begin To use OAuth client credentials with Snowflake you need: | Requirement | Description | | --- | --- | | Identity provider | Okta, Azure AD, or Ping Federate configured for client credentials grant | | Snowflake account | Enterprise edition or higher with ACCOUNTADMIN access | | OAuth application | API Services (Okta), App Registration (Azure AD), or equivalent | | Custom scopes | Scopes for Snowflake role assignment (e.g., \`session:role:SYSADMIN\` ) | ## Configure your identity provider The following steps use Okta as an example. For other providers, consult their documentation for client credentials configuration. ### Step 1: Create an API Services Application 1. Sign in to your Okta Admin Console. 2. Go to \*\***Applications** > **Applications**. 3. Select \*\***Create App Integration**. 4. Choose \*\***API Services**\*\* and select \*\***Next**. 5. Enter an application name (for example, `snowflake-tableau-service`). 6. Select **Save**. 7. Copy the **Client ID** and **Client Secret**. You will need these values later. ### Step 2: Disable DPoP (if enabled) Demonstrating Proof of Possession (DPoP) must be disabled for client credentials flow. 1. In your application settings, go to **General** \> **Client Credentials**. 2. Clear the **Require Demonstrating Proof of Possession (DPoP) header in token requests** checkbox. 3. Select **Save**. ### Step 3: Add Custom Scopes Snowflake requires custom scopes to assign roles to the authenticated session. 1. Go to **Security** > **API** \> **Authorization Servers**. 2. Select the **default** authorization server (or your custom server). 3. Select the **Scopes** tab, then **Add Scope**. 4. Add these scopes: | Scope Name | Description | | --- | --- | | snowflake | General access scope for Snowflake | | session:role:SYSADMIN | Assigns the SYSADMIN role (adjust for your role) | **Note:** Create additional scopes for any other roles your service account needs. ### Step 4: Configure an Access Policy 1. Select the **Access Policies** tab. 2. Select an existing policy or create a new one. 3. Add a rule with these settings: - **Grant type:** Client Credentials - **Scopes:** Any scopes (or select specific scopes) 4. Select **Create Rule** or **Save**. ## Configure Snowflake Run the following SQL statements in Snowflake as ACCOUNTADMIN. Replace the placeholder values with your configuration. ### Step 1: Create the External OAuth Integration USE ROLE ACCOUNTADMIN; CREATE OR REPLACE SECURITY INTEGRATION okta\_oauth\_integration TYPE = EXTERNAL\_OAUTH ENABLED = TRUE EXTERNAL\_OAUTH\_TYPE = OKTA EXTERNAL\_OAUTH\_ISSUER = 'https://.okta.com/oauth2/default' EXTERNAL\_OAUTH\_JWS\_KEYS\_URL = 'https://.okta.com/oauth2/ default/v1/keys' EXTERNAL\_OAUTH\_TOKEN\_USER\_MAPPING\_CLAIM = 'sub' EXTERNAL\_OAUTH\_SNOWFLAKE\_USER\_MAPPING\_ATTRIBUTE = 'login\_name' EXTERNAL\_OAUTH\_AUDIENCE\_LIST = ('api://default', 'snowflake') EXTERNAL\_OAUTH\_ANY\_ROLE\_MODE = 'ENABLE'; | Parameter | Description | | --- | --- | | `EXTERNAL_OAUTH_TYPE` | Your identity provider: `OKTA` , `AZURE` , or `PING_FEDERATE` | | `EXTERNAL_OAUTH_ISSUER` | The issuer URL from your authorization server | | `EXTERNAL_OAUTH_JWS_KEYS_URL` | The JWKS endpoint for token validation | | `EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLA IM` | The JWT claim that identifies the user. Use `sub` for Okta. | | `EXTERNAL_OAUTH_ANY_ROLE_MODE` | Set to `ENABLE` to allow role assignment via scopes | ### Step 2: Create a Service User Create a Snowflake user with a `LOGIN_NAME` that matches the OAuth client ID. CREATE USER IF NOT EXISTS service\_account\_user LOGIN\_NAME = '' DISPLAY\_NAME = 'OAuth Service Account' MUST\_CHANGE\_PASSWORD = FALSE DISABLED = FALSE; \-- Grant role to the service user GRANT ROLE SYSADMIN TO USER service\_account\_user; \-- Set the default role ALTER USER service\_account\_user SET DEFAULT\_ROLE = 'SYSADMIN'; \-- Grant warehouse access GRANT USAGE ON WAREHOUSE TO USER service\_account\_user; \-- Grant database and schema access GRANT USAGE ON DATABASE TO USER service\_account\_user; GRANT USAGE ON SCHEMA . TO USER service\_account\_user; GRANT SELECT ON ALL TABLES IN SCHEMA . TO USER service\_account\_user; **Important:** The `LOGIN_NAME` must exactly match the `sub` claim in the OAuth token. For Okta API Services applications, this is the Client ID. ## Connect from Tableau Desktop 1. In Tableau Desktop, select **Connect** \> **Snowflake**. 2. Enter your connection details: | Field | Value | | --- | --- | | Server | Your Snowflake account URL (e.g., `account.snowflakecomputing.com`) | | Role | The role to use (e.g., `SYSADMIN`) | | Warehouse | Your Snowflake warehouse | | Authentication | OAuth Client Credentials | 3. Enter the OAuth configuration: | Field | Value | | --- | --- | | OAuth Token Request URL | `https://.okta.com/oauth2/default/ v1/token` | | Username | Your OAuth Client ID | | Password | Your OAuth Client Secret | | OAuth Scope | `snowflake session:role:SYSADMIN` | **Note:** The OAuth Scope must include any custom scopes you configured for role assignment. 4. Select **Sign In**. ## Publish to Tableau Cloud or Tableau Server When publishing a workbook or data source that uses OAuth client credentials: 1. In the **Publish** dialog, select **Edit** next to **Data Sources**. 2. For **Authentication**, select **Embedded password**. 3. The client credentials are embedded in the published content. **Important:** Unlike standard OAuth, client credentials are treated as embedded passwords. Users accessing the published content use the service account credentials, not their own identity. ### Credential Rotation When your OAuth client secret rotates, update the embedded credentials on Tableau Cloud: 1. Sign in to Tableau Cloud. 2. Navigate to the published data source. 3. Select **Connections**. 4. Update the connection with the new client secret. For automated rotation, use the Tableau REST API to update connection credentials programmatically. ## Frequently Asked Questions ### When should I use OAuth client credentials instead of standard OAuth? Use client credentials when you need unattended, machine-to-machine authentication. Standard OAuth requires user interaction for the initial sign-in and periodic reauthentication. Client credentials use a service account identity and do not require user interaction. ### Can I use client credentials with Snowflake's native OAuth? No. Snowflake's native OAuth only supports the authorization code flow. Client credentials require External OAuth with a supported identity provider (Okta, Azure AD, or Ping Federate). ### How do I handle secret rotation for published content? When your OAuth client secret rotates, you must update the embedded credentials in Tableau Cloud. You can do this manually through the Tableau Cloud UI or programmatically using the Tableau REST API. Consider automating this process as part of your secret rotation workflow. ### Why does my connection fail with a role error even though EXTERNAL\_OAUTH\_ANY\_ROLE\_MODE is enabled? Snowflake requires role information in the OAuth token. Add a custom scope (e.g., `session:role:SYSADMIN`) to your authorization server and include it in the OAuth Scope field when connecting from Tableau. ## Troubleshooting | Error message | Cause | Solution | | --- | --- | --- | | "User does not exist or not authorized" | Snowflake user `LOGIN_NAME` does not match OAuth client ID | Set the user's `LOGIN_NAME` to match the `sub` claim (client ID for Okta) | | "The role requested is not listed in the Access Token" | Missing role scope in token | Add `session:role:` scope to your authorization server and include it in OAuth Scope | | "Invalid DPoP proof" | DPoP is enabled in Okta | Disable "Require Demonstrating Proof of Possession (DPoP)" in your Okta app | | "Invalid scope" | Custom scopes not configured | Add required scopes to your authorization server; do not include `openid` | | Token validation failure | Incorrect JWKS URL or issuer | Verify `EXTERNAL_OAUTH_JWS_KEYS _URL` and `EXTERNAL_OAUTH_ISSUER` match your authorization server | ## See Also - [Configure OAuth for Snowflake Connections on Tableau Server](https://help.tableau.com/current/server/en-us/config_oauth_snowflake.htm) - Learn about standard OAuth authentication with Snowflake. - [External OAuth Security Integrations](https://docs.snowflake.com/en/user-guide/oauth-external-overview) - Snowflake documentation for configuring external OAuth providers. - [Okta Client Credentials Flow](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/) - Okta documentation for implementing client credentials. - [Update Data Source Connection](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_data_sources.htm#update_data_source_connection) - Tableau REST API reference for credential updates. [Skip to main content](#main-content) # Configure IP Filters for Tableau Cloud IP filtering secures your Tableau Cloud site by restricting access to approved IP addresses and ranges. Only users and services connecting from these allowed locations can access your site. ## What to expect when using IP filters Here's what happens when users and services attempt to access a site with IP filtering configured. ### What IP filtering affects IP filtering provides security by checking incoming traffic against the list of approved IP addresses and ranges that you define for the site. Use only routable public IP addresses in this list. Private IP addresses and ranges, such as 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16, won't work and can cause lockouts. This restriction affects all incoming traffic to your site, including: - Access through a web browser - Tableau Desktop connections - REST API calls - Embedded views ### Backend behavior and exceptions IP filtering doesn't affect processes that run in the background, such as Tableau Bridge. For example, unapproved Bridge computers continue to work, but their status won't appear on the Bridge settings page. ### Sign-in behavior Signing in to Tableau Cloud works separately from IP filtering. - Users can access `www.online.tableau.com` even if their IP address is blocked from a specific site. - The site picker lists all sites a user belongs to, even if IP filtering restricts access to some of them. - Access is denied only when a user or service attempts to connect to a filtered site from an unapproved IP address. ## Add IP filters To add an IP filter to your site, use these steps: 1. Sign in to the Tableau Cloud site as an admin and select Settings. 2. On the Security tab, scroll to IP Filtering. 3. Select the Enable IP Filtering checkbox. An inline message shows your device’s IP address. ![A Tableau Cloud security settings page displaying IP filtering options.](/tableau/next/en-us/online/en-us/Img/ip_filtering_add.png) 4. In the New IP Addresses and IP Ranges section, use one of these options to define the IP addresses and ranges to allow: - **Individual address:** Enter the IP address to allow. To add more addresses, select Add. - **Bulk editor:** Expand the dropdown menu and select IP Address Bulk Editor. In the dialog, enter each IP address or range on a separate line. ![An IP address bulk editor dialog box displaying allowed IP addresses and ranges.](/tableau/next/en-us/online/en-us/Img/ip_filtering_bulk_editor.png) > [!WARNING] > > **Important:** Before saving, verify that you've included your current public IP address. Don't add private addresses and ranges such as 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. Using these addresses or excluding your current location can lock you out of your site. 5. Select Save. Changes take effect within 15 minutes. ## Update or remove IP filters To make changes to IP filters on your site, use these steps: 1. Sign in to the Tableau Cloud site as an admin and select Settings. 2. On the Security tab, scroll to IP Filtering. 3. To update an IP address, use one of these options: - **Individual address:** Select the row to edit it directly. - **Bulk editor:** Expand the dropdown menu and select IP Address Bulk Editor. In the dialog, enter each IP address or range on a separate line. - **Delete an address:** Select the delete icon next to the row. 4. Select Save. Changes take effect within 15 minutes. ## Turn off IP filtering Turning off IP filtering permanently deletes the list of IP addresses and ranges you defined. Any licensed user can then sign in to the site, regardless of their IP address. If you plan to use these settings later, copy your allow list before turning off IP filtering. To turn off IP filtering, use these steps: 1. Sign in to the Tableau Cloud site as an admin and select Settings. 2. On the Security tab, scroll to IP Filtering. 3. (Optional) Copy your list of IP addresses and ranges. 4. Clear the Enable IP Filtering checkbox. ![An IP filtering section displaying an unchecked enablement checkbox.](/tableau/next/en-us/online/en-us/Img/ip_filtering_setting.png) 5. Select Save. ## Troubleshooting ### Regain site access If you lose access to your site after configuring IP filters, you can use these options to regain access. - **Ask another site admin:** Contact another site admin who isn’t affected by the IP filter and have them update or remove the filter list. - **Try a different IP address:** Access the site from another device or network that you know is allowed, such as your VPN. If you can sign in, update or remove the IP filter. If you’re the only site admin and you lose all your access, contact Tableau Support for assistance. Tableau must manually reset or update the IP filters before you can sign in again. [Skip to main content](#main-content) # Configure Pools This topic describes how site admins can configure and manage pooling for Bridge clients. Pooling allows clients across the site to load balance data freshness tasks for data sources or virtual connections that connect to private network data. The purpose of a pool is to distribute (or load balance) data freshness tasks among the available clients in a pool whose access is scoped to a domain within your private network. Pools map to domains, giving you the ability to dedicate pools to keeping specific data fresh and maintaining security by restricting access to protected domains in your private network. Although the client in the pool that performs the data freshness task is chosen at random, if for whatever reason a client can no longer perform the task, the task is automatically rerouted to another available client in the pool to handle the task. There is no additional intervention required from you or your users to support or manage the pool of clients. Pooling is optimized for keeping data sources or virtual connections that connect to data on one or more private networks fresh. Pooling support does not extend to data sources that use Bridge (legacy) schedules. In general, pooling is optimized for the following situations: - **Bridge is used as a critical service.** If your organization requires that live query and scheduled refresh support must be available even if a client becomes unavailable. - **Client is at capacity.** If your existing site traffic exceeds the current capacity of the client. - **Tableau Cloud-managed schedules for file-based data sources.** Beginning with Bridge client version 2021.4.3, Bridge pools enable Bridge refresh schedules for file-based data sources. - **Keeping data fresh on multiple private networks.** - **Virtual connections.** (Requires Data Management) Bridge is required to refresh data in virtual connections that connect to private network data. For more information about virtual connections, see [About Virtual Connections and Data Policies](https://help.tableau.com/v0.0/online/en-us/dm_vconn_overview.htm). ### Before configuring the pool Before you can configure a client pool for your site, review the following: - Clients must be installed and running. For more information about software and hardware, see [Plan Your Bridge Deployment](https://help.tableau.com/v0.0/online/en-us/to_bridge_scale.htm#system). - Clients are configured to run as a service. For more information, see [Application versus Service mode](https://help.tableau.com/v0.0/online/en-us/to_bridge_client.htm#mode). - The user authenticated into a client is a Tableau Cloud site admin. For more information about deploying Bridge, see [Plan Your Bridge Deployment](https://help.tableau.com/v0.0/online/en-us/to_bridge_scale.htm). - To keep virtual connections fresh, ensure all clients in the pool are running Bridge 2021.4 (or later). - To load balance file-based data sources, ensure the following: - All clients in the pool are running Bridge 2021.4.3 (or later). - References to file data must use the full UNC path that includes the server name or hostname. For more information, see [About the Bridge Client](https://help.tableau.com/v0.0/online/en-us/to_bridge_client.htm). - File-based data sources are extract only. #### Note about user roles Only site admins, or users with either the Site Administrator or Site Administrator Creator role, can configure and maintain pooled clients. Regardless of the type of user authenticated into the client, only site admins can add new pools, add clients to a pool, remove clients from a pool, and monitor clients in a pool. #### Note about refresh jobs The Jobs page can show you the completed, in progress, pending, canceled, and suspended all Bridge refresh jobs that use Bridge refresh schedules. This includes refreshes for file-based and non-file based data sources. For more information, see [About Bridge Refresh jobs](https://help.tableau.com/v0.0/online/en-us/server_backgrounder_job_management.htm#bridge). For more information about various ways you can monitor Bridge activity, see [Monitor data freshness tasks](https://help.tableau.com/v0.0/online/en-us/to_bridge_manage.htm#monitor). ### Step 1: Ensure clients can connect to the site In order for Bridge to work with your site, you must allow clients to authenticate to the site. 1. Sign in to Tableau Cloud using your site admin credentials and go to the Settings page. 2. Click the Authentication tab and validate that the **Let clients automatically connect to this Tableau Cloud site** check box under the Connected Clients heading is selected. For more information about this check box, see [Access Sites from Connected Clients](https://help.tableau.com/v0.0/online/en-us/to_connected_clients.htm). **Note:** If enabled, the connected clients option must be enabled to support multi-factor authentication with Tableau authentication. If connected clients are disabled for your site, Bridge can only support Tableau username and password authentication. ### Step 2: Configure a pool Pools, which require Bridge 2021.4 (or later) clients, help route live query and extract refresh jobs to the appropriate private network. Use pools to access data distributed across multiple private networks, enable extract refreshes for file-based data sources, and to support data freshness tasks for virtual connections. 1. On the Bridge tab, under Pooling, click the Add New Pool button. 2. In the dialog box, enter a new pool name in the Pool text box and click Save. After you have at least one pool configured, as part of the publishing process, Tableau Cloud associates certain data sources or virtual connections with Bridge and client pools automatically. ### Step 3: Specify a domain for a pool Each new pool requires a domain to be specified through the Private Network Allowlist. This information is required to enable Bridge access to data in the private network on behalf of Tableau Cloud. The total number of domains on the allowlist and pools in your organization may not exceed 100. Using the private network allowlist, you must specify the domains of the private network where you want to enable client access. These domains should correspond to private network locations of databases and file shares that you want to make accessible to Bridge on behalf of Tableau Cloud. #### Domain names The domain names that you specify in the allowlist are the server names used in the data source connection or virtual connection. In some cases, you can find the server name listed in the Connections tab of the data source page in Tableau Cloud. **Note**: When accessing workbooks which connect to published data sources, do not use \*.tableau.com in the Private Network Allowlist. The domain \*.online.tableau.com is used for proxy filtering for outbound connections. See [Optional forward proxy filtering](https://help.tableau.com/current/online/en-us/to_bridge_security.htm). For example, to keep data sources like “Starbucks” up to date, you might specify “mssql.myco.lan” and “oracle.myco.lan” or “\*.myco.lan” in the allowlist. ![Connections tab with list of two connections to databases, Microsoft SQL Server and Oracle.](/tableau/next/en-us/online/en-us/Img/bridge_online_server_name.png) To keep data sources like "Fitness Challenge" up to date, specify "fitness-challenge" in the allowlist. ![Connections Tab for Tableau Cloud and Server.](/tableau/next/en-us/online/en-us/Img/bridge_online_server_name_missing.png) In other cases, the Connections tab might not list the server name. When the server name is not listed, consider working with the content owner to identify where the data is hosted and specify the server name in the allowlist when you have that information. As a temporary alternative, you can skip to [Step 4: Add clients to a pool](#step4) to assign clients to use the Default Pool instead. #### IP addresses Instead of domain names, you can specify IPv4 addresses in the allowlist. We recommend you specify IPv4 addresses in the allowlist if IPv4 addresses are used in the data source connections or virtual connections. Consider working with your content owners to get this information. If you don’t have that information, as a temporary alternative, you can skip to [Step 4: Add clients to a pool](#step4) to assign clients to use the Default Pool instead. **Notes:** - For security purposes, the allowlist is empty by default to prevent Tableau access. This ensures that site admins specify what data can be sent to Tableau Cloud using Bridge. - You can use Fiddler with Tableau Desktop to capture the URI that is used when connecting to a data source. For more information, see [Fiddler](https://www.telerik.com/fiddler). - You can assign one or more domains to a pool. - If your site was set up to use pooling prior to Tableau 2021.4, the Default Pool remains for backward compatibility purposes but can't be configured to access a specific private network. To reduce the scope of access of this pool and to enable more advanced scheduling capabilities, we recommend you create new pools and map them to specific domains. To map a domain to a pool, do the following: 1. While on the Bridge tab, under the Private Network Allowlist, click the Add New Domain button. 2. In the Domain text box, enter the URI of the domain using the information described in [Allowlist registry rules](#allowlist_rules). 3. Under Domain permissions, ensure the Allow radio button is selected. 4. Under Pool, select the pool whose scope of access should be limited to the URI you specified in step 2. 5. Repeat steps 1-4 for each additional domain. 6. When finished, click Save. #### Allowlist registry rules Use the following rules when specifying the domains that you want to enable Bridge access to. This allows Bridge, on behalf of Tableau Cloud, to access the data on your private network to perform data freshness tasks. A domain enables Bridge to connect to both databases and file data hosted in that domain. **Notes:** - The total number of pools + domains in the allowlist registry may not exceed 100. If you exceed 100 of these combined objects, you will be unable to add new pools. - Domains are _not_ verified when added to the allowlist, when data sources or virtual connections are published, or when refresh schedules are configured. - Duplication due to the same domain being added to the allowlist as both the domain name and its IP address are not verified. In this scenario, if one pool maps to the domain name and another pool maps to the IP address, the format specified in the data source connection or virtual connection determines which pool keeps the data fresh. - Domains must be accessible by Bridge. This means, all clients in the pool must have access to the specified domain. - If no domains are specified, Bridge is unable to run data freshness tasks for data sources or virtual connections configured for Bridge refresh schedules. **Note:** Data sources configured for Bridge legacy schedules will continue to run in the same way. - Domain entries support the following characters: - Letters: A–Z, a–z - Digits: 0–9 - Symbols: - . \* / @ # % & ( ) + = \[ \] { } ; : " , < > ? |\\

Scenario	Description	Example
Exact domain name	Can either be a FQDN or PQDN. Port numbers are not allowed.	myco.com marketing.myco.com oracle.myco.com
Range of domain names	Use an optional leading wildcard () to include all subdomains. The must be followed directly by a period (.).	*.myco.com
Exact IPv4 address	Use an IPv4 literal (abbreviations are not allowed). IPv6 addresses are not allowed.	255.255.0.1 192.168.0.0
Range of IPv4 addresses	Use a subnet mask to include a range of IPv4 addresses.	255.255.0.1/16
Block domains	(Named pools only) Block Bridge connectivity to hosts in this domain.	When adding or editing a domain in the private network allowlist, select the Block radio button option.

#### Allowlist registry examples **Example 1 - database data** Suppose you want Bridge to do the following: - Perform data freshness tasks for data located in **data.lan** and **sqlserver.myco.lan**. - _Prevent_ data freshness tasks for data located in **oracle.myco.lan**. To enable Bridge to support these scenarios, you can map the domains to two pools (A and B) and block the third domain.

If you specify...	and map to pool...	...data is refreshed in locations
*.lan	Pool A	data.lan
sqlserver.myco.lan	Pool B	sqlserver.myco.lan
.myco.lan Note:* Although this domain range blocks data freshness tasks on oracle.myco.lan, a blocked domain range can unblock a specific domain within it if the domain is explicitly allowed, such as sqlserver.myco.lan.	(Blocked)	-

**Example 2 - file data** Suppose you have file data, C:\\Shared\\employees.csv, located on **fileserv.myco.lan**. To enable Bridge access to this data, map the domain of the machine to a pool. You can specify _one_ of the following domains to a pool: - Option #1: \*.lan - Option #2: \*.myco.lan - Option #3: fileserv.myco.lan **Note:** The host machine must allow network access to the "Shared" folder. ### Step 4: Add clients to a pool Follow the procedure below to assign clients not already assigned to a pool. **Note:** To support data freshness tasks for all data, ensure clients in the pool are running Bridge 2021.4 (or later). 1. On the Bridge tab in the **Unassigned Clients** table, navigate to the client you want to assign to a pool and click Assign. 2. In the Pool drop-down menu, select the pool you want to associate with the client. 3. Repeat step 2 for each unassigned client you want to assign to a pool. ## Troubleshoot pooling **Bridge Refresh jobs fail with one of the errors listed below.** The following errors can be seen on the Jobs page and the Background Tasks for Non Extracts admin view. - "errorID=NO\_POOLED\_AGENTS\_ASSIGNED" This issue is specific to default pools and can occur for one of two reasons: - When the server address or IP address of a data source does not match a domain specified in the Private Network Allowlist. This causes refresh jobs to be sent to the Default Pool where there are no assigned clients. To resolve this issue, make sure 1) the allowlist contains the domains (server addresses or IP addresses) used by the data sources, and 2) at least one pool is associated with those domains (sever addresses or IP addresses). For more information, see [Step 3: Specify a domain for a pool](#step3). - When there are no clients in the default pool. To resolve this issue, add at least one Bridge 2020.2 (or later) client to the default pool. For more information, see [Step 4: Add clients to a pool](#step4). - "errorID=NO\_POOLED\_AGENTS\_ASSIGNED\_NAMED\_POOL" This issue can occur when there are no clients in the named pool. To resolve this issue, add at least one Bridge 2021.4 (or later) client to the named pool. For more information, see [Step 4: Add clients to a pool](#step4). - "errorID=NO\_AGENT\_IN\_POOL\_SUPPORTS\_REMOTE\_EXTRACT\_REFRESH" This issue can occur when a refresh job tries to run without at least one Bridge 2020.2 (or later) client in the pool. To resolve this issue, add at least one Bridge 2020.2 (or later) client to the pool. For more information, see [Step 3: Specify a domain for a pool](#step3). - "errorID=NO\_POOLED\_AGENTS\_CONNECTED" This issue can occur when none of the clients in the pool are available to run data freshness tasks. For more information, see the [Configure Pools](#status) section above. - "errorID=REMOTE\_EXTRACT\_REFRESH\_ALL\_AGENTS\_BUSY" or "errorMessage: Maximum concurrency reached" in the client These issues can occur if the number of refresh jobs running at a given time exceeds the capacity of your client pool. To help resolve this issue, you can do the following: - Add additional clients to the pool. For more information, see [Step 4: Add clients to a pool](#step4). - Increase the size of the **connectionPool** setting on each client. For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#poolcapacity). - **"errorID= AGENTS\_IN\_POOL\_REQUIRE\_UPGRADE"** Beginning with Tableau 2021.4, this issue can occur when the clients in the pool need to be upgraded to Bridge 2021.4 (or later) in order to run data freshness tasks. For more information about upgrading clients, see [Install Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm#upgrade-bridge). **Bridge clients are being signed out** This issue can happen if you deploy a large number of clients under the same Windows services account. When there are more than 10 clients running under one Windows services account, account security measures can cause clients to be logged out. For more information, see [Windows services account](https://help.tableau.com/v0.0/online/en-us/to_bridge_scale.htm#windows). **Other potential pooling issues** When trying to diagnose issues related to pooling, consider reviewing the following log files for a client on the Bridge client machine: _tabbridgeclijob\__, _jprotocolserver\_, _stdout\_jprotocolserver\__. For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#log-config). **Adding a new pool results in error, An internal system error occurred** This error may occur if the total number of pools in your organization combined with the number of domains in the allowlist registry exceeds 100. [Skip to main content](#main-content) # Configure Projects, Groups, Group Sets, and Permissions for Managed Self-Service Publishing to Tableau Cloud and Tableau Server is easy. For some organizations, it might be a little _too_ easy. There is value in creating a controlled framework before letting creators publish their own content. To keep things tidy and to make sure people can find and access the right content, it may be useful to configure your site for managed self-service. This means having guidelines and settings in place to ensure content is organized, discoverable, and secure without having bottlenecks in the publishing process. This article lays out a possible path for you as a site administrator to set up your site for managed self-service: 1. Identify the types of groups and projects you’ll need 2. Create groups and group sets 3. Remove permissions that will cause ambiguities and establish default permission patterns 4. Create projects 5. Lock project permissions **Note:** The information provided here is adapted and simplified from practices of Tableau Visionaries and customers who have shared their experiences. ## Plan your strategy Permissions in Tableau consist of rules that are applied to content (projects, workbooks, etc.) for a group or user. These permission rules are built by allowing or denying specific capabilities. ![The permission rules interface showing various capabilties allowed and denied](/tableau/next/en-us/online/en-us/Img/perms_permissionrules.png) Having a comprehensive plan for your projects, groups, and permission rules is useful whether you’re starting new or making changes. The details are up to you, but there are two important practices that we recommend for all environments: - Manage permissions on projects, not individual pieces of content. - Assign permissions for groups, not individual users. Setting permissions at the individual user level and on individual content assets becomes unmanageable quickly. ### Use a closed permissions model General models for setting permissions are open or closed. In an open model, users get a high level of access, and you explicitly deny capabilities. In a closed model, users get only the access they need to do their jobs. This is the model security professionals advocate. The examples in this topic follow a closed model. For more information on how Tableau permissions are evaluated, see [Effective permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm). ## Identify the types of projects and groups you’ll need Designing a structure to accommodate content (in projects) and categories of users (as groups) or categories of groups (in group sets) can be the most challenging part of setting up a site, but it makes ongoing management much easier. **Projects**: Projects function both as a unit for managing permissions and as an organizational and navigational framework. Try to create a project structure that balances how people expect to find content and allows for logical permissioning. **Groups or group sets**: Before you create groups it can be useful to find common themes in how people interact with content. Try to identify patterns you can use to create groups or group sets and avoid one-off permissions for individual users. Example 1: Project and group structure For example, let’s imagine an environment where there is company-wide content that everyone should be able to access, as well as some HR content that needs to be restricted. Projects include: - **Acme Corp Conference**. This will include data sources and workbooks for ticket sales, dashboards for content strategy, and project plans for the company conference. - **Employee Success**. This will include anonymized data sources and workbooks for the internal employee survey - **Human Resources**. This will include HR data sources and workbooks that should only be available to members of the HR team. Then, groups should match what people need to do: - **Core Content Creators**. This group is for users who can publish to top-level projects and have broad access to data sources, but who don’t need to be able to move or otherwise manage content. - **HR Content Creators.** This group is for users who have access to HR data sources and can publish to the HR project. - **Business Users.** This group is for users who should be able to access the content created by the Core Content Creators, but shouldn’t even know the HR content exists. - **HR Users.** This group is for users who should be able to access content in the HR project but don’t have rights to create or publish content. - **Core Project Leaders.** This group is for users who should be given project leader status on the projects that aren’t HR. Example 2: Group and group set structure Beginning in June 2024 (Tableau 2024.2), you can use group sets to further control the capabilities granted (or denied) to users by enabling permissions at the group set-level. When permissions are set at the group set-level, users must belong to all groups in the group sets to be evaluated. **Note:** Group set permission rules are evaluated after user and group rules. For example, suppose you’ve created the groups to match what people need from Example 1 above. You can create the following group set to further lock down HR access: - **HR Leaders.** This group set consists of HR Content Creators and Core Project Leaders. Only if the users in this group set belong to both groups are they given project leader status, ability to access sensitive HR data sources, and publish to the HR project. ### Consider site roles Remember that permissions are tied to content, not groups or users. This means that you can’t give a group **Explore** permissions in a vacuum. Rather, the group can be given **Explore** permissions for a project and its content. Site roles, however, are given to specific users and may define or limit the permissions they can have. For more information on how licenses, site roles, and permissions tie together, see [Permissions, Site Roles, and Licenses](https://help.tableau.com/current/server/en-us/permission_license_siterole.htm). ## Create the groups and group sets While it might be tempting to create the groups and projects as soon as you identify what you need, it’s important to do things in a certain order. **Projects**: Projects shouldn’t be created until after the Default project has been properly configured (see the next section). This is because top-level projects use the Default project as a template for their permission rules. **Groups**: Groups need to be created before they can be used to build permission rules. Users do not need to be added to the groups yet, but they can be. For more information about creating groups, see [Create a Group and Add Users to It](https://help.tableau.com/v0.0/online/en-us/to_add_users_groups.htm). **Group sets:** Groups need to be created before they can be used to build permission rules. Users do not need to be added to the groups yet, but they can be. For more information, see [Work with Group Sets](https://help.tableau.com/v0.0/online/en-us/group_sets.htm). > [!TIP] > > Creating multiple groups and projects and setting permissions manually can get a little tedious. To automate these processes and make them repeatable for future updates, you can perform these tasks using [REST API](https://help.tableau.com/current/api/rest_api/en-us/help.htm#REST/rest_api.htm) commands. You can use [tabcmd](https://help.tableau.com/current/server-linux/en-us/tabcmd.htm) commands for tasks such as adding or deleting a single project or group and adding users, but not for setting permissions. ### Membership in multiple groups It’s possible to include the users in the HR Content Creators and HR Users groups in the Business Users group. This would make it easy to assign permissions to Core Content Users versus Business Users for the majority of content. However, in that scenario, the Business Users group couldn’t be denied any capabilities in the Human Resources folder without denying the HR users as well. Instead, the Business Users group would have to be left as unspecified, and the specific HR Content Creators and HR Users groups would be given their applicable capabilities. This is because Tableau permissions are restrictive. If the Business Users group was denied certain capabilities, that Deny would override the Allow of another permission rule for users in both groups. #### Impact of group sets If assigned permissions are enabled at the group set-level, permissions for every group in the group set must not be specified or not be denied to allow the capability. ![Flowchart of group-level permissions.](/tableau/next/en-us/online/en-us/Img/perms_evalflow_basic.png "flowchart showing the evaluation flow for effective permissions") When deciding how group membership should be assigned it’s important to understand how permission rules are evaluated. For more information, see [Effective Permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm). ## Remove permissions that will cause ambiguities and establish default permission patterns Every site has an All Users group and a Default project . **All Users group**: Any user added to the site becomes a member of the All Users group automatically. To avoid any confusion with permission rules set on multiple groups, it’s best to remove the permissions from the All Users group. **Default project**: The Default project works as a template for new projects in the site. All new top-level projects will take their permission rules from the Default project. Establishing baseline permission patterns on the Default project means you will have a predictable starting point for new projects. (Note that nested projects inherit the permission rules from their parent project, not the Default project. ) Remove the permission rule for the All Users group on the Default project 1. Select Explore to see the top-level projects on the site. 2. On the Default project’s Action (…) menu, select Permissions. 3. Next to the All Users group name, select **…**, and then select Delete Rule…. This lets you establish permission rules for the groups that you have full control over without any conflicting permissions assigned to All Users. For more information on how multiple rules are evaluated to determine effective permissions, see [Effective Permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm). ### Create permission rules Now you can set up the basic permission patterns for the Default project that all new top-level projects will inherit. You may choose to keep the Default project’s permission rules empty and build permissions for each new top-level project individually. However, if there are any permission rules that should apply to the majority of projects, it can be helpful to set them on the Default project. Remember that the permissions dialog for a project contains tabs for each type of content. **You must set permissions for each type of content at the project level** or users will be denied access to that content type. (A capability is only granted to a user if they are expressly allowed it. Leaving a capability as Unspecified will result in it being denied. For more information, see [Effective Permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm).) Tip: Every time you create a permission rule at the project level, make sure you look through all the content type tabs. Create permission rules as desired: 1. Click \+ Add Group/User Rule and start typing to search for a group name. 2. For each tab, choose an existing template from the drop-down or create a custom rule by clicking the capabilities. 3. When finished, click Save. For more information on setting permissions, see [Set Permissions](https://help.tableau.com/current/server/en-us/permissions.htm#set-permissions). Example: Project level permissions for each content type For our example, the majority of projects should be available to most people. For the default project, we’ll use the [permission rules templates](https://help.tableau.com/current/server/en-us/permissions_capabilities.htm#capabilities) to give the core content creators publishing rights and everyone else the ability to interact with workbooks and not much else.

Group	Projects	Workbooks	Data Sources	(Other content)
Core Content Creators	Publish	Publish	Publish	View
HR Content Creators	View	Explore	View	None
Business Users	View	Explore	View	None
HR Users	View	Explore	View	None
Core Project Leaders	Set as project leader	n/a	n/a	n/a

This pattern follows a closed model and limits permissions to basic usage for most content for most users. As new top-level projects are created, these rules are what will be inherited by default, but the permission rules can be modified per project as needed. Remember that the **Human Resources** project should have these permissions removed and its own pattern established. ## Create projects and adjust permissions After the Default project is set with your custom permissions templates, you can create the rest of your projects. For each project, you can adjust the default permissions as appropriate. To create a project 1. Select Explore to see the top-level projects on the site. 2. From the New dropdown, select Project. 3. Name the project and, if desired, give it a description. It can be useful to establish a naming convention. For example, a basic structure might be - ; such as DevOps - Monitoring. The description appears when you hover over a project thumbnail and on the Project details page. A good description can help users know they’re in the right place. 1. [Adjust permissions](https://help.tableau.com/current/server/en-us/permissions.htm#set-permissions) as necessary. 1. Open the new project. 2. From the Action menu (...), select Permissions 3. Modify any permission rules as desired. _Remember to check all the content tabs_. ## Lock content permissions In addition to permission rules, projects have a content permission setting. This setting can be configured in two ways, either **Locked** (recommended) or **Customizable**. Locking a project is a way of maintaining consistency and ensuring that all content in the project has uniform permissions (per content type). A customizable project permits authorized users set individual permission rules on pieces of content. For more information, see [Lock content permissions](https://help.tableau.com/current/server/en-us/permissions_projects.htm#lock-content-permissions). Regardless of the content permission setting, permissions are always enforced on content. ## Possible project structures Some organizations find it useful to have projects that serve specific purposes. Here are some example projects and their intended uses. Note that these are example templates and you should always test the configuration in your environment. For information about what capabilities are included with each content type’s permission rule templates, see [Permission capabilities](https://help.tableau.com/current/server/en-us/permissions_capabilities.htm). Examples: permission settings for specific purposes #### Workbooks shared for open collaboration on the server Anyone in the department can publish to the open-collaboration project while their content is in development. Colleagues can collaborate using web editing on the server. Some people call this a sandbox, some call it staging, and so on. On this project you can allow web editing, saving, downloading, and so on. Here you want not only to enable collaboration, but also to enable people who don’t have Tableau Desktop to contribute and provide feedback.

Group	Projects	Workbooks	Data Sources	(Other content)
Data Stewards	Publish	Publish	Publish	TBD
Analysts	Publish	Publish	Explore	TBD
Business Users	Publish	Publish	Explore	TBD

Remember that some capabilities in the Publish template (such as Overwrite) may be [prevented by a user’s site role](https://help.tableau.com/current/online/en-us/permission_license_siterole.htm) even if they are allowed that capability. **Note**: "_TBD_" indicates these permission rules aren't easily determined by the scenario and can be set however makes sense for a given environment. #### Shared reports that cannot be edited This could be a project that people who create workbooks and data sources (Analysts and Data Stewards) could publish to when they want to make content available to business users for viewing, with confidence that their work cannot be “borrowed” or modified. For this type of project, you would deny all capabilities that allow editing or getting the data off of the server for reuse. You would allow viewing capabilities.

Group	Projects	Workbooks	Data Sources	(Other content)
Data Stewards	Publish	TBD	Publish	TBD
Analysts	Publish	Publish	View	TBD
Business Users	View	View	None	None

#### Vetted data sources for Analysts to connect to This would be where Data Stewards publish the data sources that meet all of your data requirements and become the “source of truth” for your organization. Project leaders on this project can certify these data sources, so that they rank higher in search results and are included in recommended data sources. You would allow authorized Analysts to connect their workbooks to data sources in this project, but not download or edit them. You would deny the view capability to the Business Users group for this project, so those users would not even see this project.

Group	Projects	Workbooks	Data Sources	(Other content)
Data Stewards	Publish	TBD	Publish	TBD
Analysts	View	None	View	None
Business Users	None	None	None	None

#### Inactive content Another possibility is to segregate workbooks and data sources that the site’s administrative views show haven’t been used for a period of time. You could give content owners a time limit before their content is removed from the server. Whether you do this or delete directly from the working projects is up to your organization. In an active environment, don’t be afraid to be intentional about removing content that is not being used.

Group	Projects	Workbooks	Data Sources	(Other content)
Data Stewards	None	None	None	None
Analysts	View	View	TBD	TBD
Business Users	None	None	None	None

#### Source for workbook templates This is a project that people can download from but not publish or save to, where authorized publishers or project leaders make template workbooks available. Templates that have your organization’s approved fonts, colors, images, and even data connections built in can save authors a lot of time and keep your reports looking consistent.

Group	Projects	Workbooks	Data Sources	(Other content)
Authorized Author	Publish	Publish	Publish	TBD
Data Stewards	None	None	None	None
Analysts	View	Template: Explore + Capability: Download Workbook/Save a Copy	View	None
Business Users	None	None	None	None

## Next steps Besides projects, groups, and permissions, other data governance themes include: **User education** Help _all_ of your Tableau users become good data stewards. The most successful Tableau organizations create Tableau user groups, have regular training sessions, and so on. For a common approach to orienting users to the site, see [Dashboard-based Custom Portals](https://help.tableau.com/v0.0/online/en-us/portal_dashboard.htm). For publishing and data certification tips, see the following topics: - [Use Certification to Help Users Find Trusted Data](https://help.tableau.com/v0.0/online/en-us/datasource_certified.htm) - [Prepare for Publishing a Workbook](https://help.tableau.com/current/pro/desktop/en-us/publish_workbooks_prepare.htm "Get tips for workbook publishing") (links to Tableau Help) - [Best Practices for Published Data Sources](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources_about.htm) (links to Tableau Help) **Optimize extract refresh and subscription activity** If you use Tableau Server, create policies for extract refresh and subscription schedules, to avoid them dominating the site’s resources. The TC customer presentations by Wells Fargo and Sprint address this subject in detail. In addition, see the topics under [Performance Tuning](https://help.tableau.com/current/server/en-us/perf_tuning.htm). If you use Tableau Cloud, see the following topics to become familiar with the ways people can refresh extracts: - [Keep Data Fresh](https://help.tableau.com/current/online/en-us/to_keep_data_fresh.htm) - [Use Tableau Bridge to Expand Data Freshness Options](https://help.tableau.com/current/online/en-us/to_sync_local_data.htm) **Monitoring** Use administrative views to keep an eye on the site’s performance and content use. [Administrative Views](https://help.tableau.com/current/online/en-us/adminview.htm) [Skip to main content](#main-content) # Configure SAML for Tableau Viz Lightning Web Component Tableau provides a Lightning Web Component (LWC) for embedding a Tableau visualization within a Salesforce Lightning page. This topic describes how to enable a SSO experience for embedded Tableau visualizations in a Salesforce Lightning page. SSO for the Tableau Viz LWC scenario requires SAML configuration. The SAML IdP used for Tableau authentication must be either the Salesforce IdP or same IdP that is used for your Salesforce instance. In this scenario, Salesforce administrators can drag-and-drop Tableau Viz LWC into the Lightning page to embed a visualization. Any view that is available to them on Tableau Cloud can be displayed in the dashboard by entering the embedded URL to the view. When single sign-on (SSO) is configured for Tableau Viz LWC on Tableau Cloud, the user experience is seamless: after the user signs into Salesforce, embedded Tableau views will work without further authentication to Tableau Cloud. When SSO is not configured, then users will need to reauthenticate with Tableau Cloud to view embedded visualizations from Tableau Cloud. **Note**: Users configured with [Salesforce Authentication](https://help.tableau.com/v0.0/online/en-us/security_auth_sfdc.htm) will need to reauthenticate with Tableau Cloud to view embedded visualizations in Tableau Cloud. ## Requirements - The SAML IdP used for Tableau authentication must be either the Salesforce IdP or same IdP that is used for your Salesforce instance. - SAML must be configured on Tableau Cloud. See [Enable SAML Authentication on a Site or TCM](https://help.tableau.com/v0.0/online/en-us/saml_config_site.htm). - SAML must be configured for Salesforce. - Install the Tableau Viz Lightning Web Component. See [Embed Tableau Views into Salesforce](https://help.tableau.com/current/pro/desktop/en-us/embed_ex_lwc.htm). ## Configuring the authentication workflow You may need to make additional configurations to optimize the sign-in experience for users who access Lightning with embedded Tableau views. If a seamless authentication user experience is important, then you will need to make some additional configurations. In this context, “seamless” means that users who access the Salesforce Lightning page where Tableau Viz LWC SSO has been enabled, will not be required to perform any action to view the embedded Tableau view. In the seamless scenario, if the user is logged into Salesforce, then embedded Tableau views will be displayed with no additional user action. This scenario is enabled by _in-frame authentication_. For a seamless user experience you will need to enable in-frame authentication on Tableau Cloud and at your IdP. The sections below describe how to configure in-frame authentication. On the other hand, there are scenarios where users are interacting with the Lightning page that will require them to click a “Sign in” button to view the embedded Tableau view. This scenario, where a user must take another action to view the embedded Tableau view, is called pop-up authentication. ![Tableau Online sign-in popup.](/tableau/next/en-us/online/en-us/Img/lwc-pop-up.png) Pop-up authentication is the default user experience if you do not enable in-frame authentication. ## Enable in-frame authentication on Tableau Cloud Before you enable in-frame authentication on Tableau Cloud, you must have already configured and enabled SAML. 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. On the **Authentication** tab, click the New Configuration button, select SAML from the Authentication drop-down, and then enter a name for the configuration. 3. Navigate down to **4\. Choose default for embedded views (optional)** and select the **Authenticate using an inline frame (iFrame)** radio button. ![Choose default for embedded views settings with the option to authenticate using an inline frame selected.](/tableau/next/en-us/online/en-us/Img/lwc-embedd-tol.png) **Caution:** Inline frames can be vulnerable to a clickjack attack. _Clickjacking_ is a type of attack against web pages in which the attacker tries to lure users into clicking or entering content by displaying the page to attack in a transparent layer over an unrelated page. In the context of Tableau Cloud, an attacker might try to use a clickjack attack to capture user credentials or to get an authenticated user to change settings. For more information about clickjack attacks, see [Clickjacking](https://www.owasp.org/index.php/Clickjacking) on the Open Web Application Security Project website. ## Enable in-frame authentication with your SAML IdP As described above, a seamless authentication user experience with Salesforce Mobile requires IdP support for in-frame authentication. This functionality may also be referred to as “iframe embedding” or “framing protection” at IdPs. ### Salesforce safelist domains In some cases, IdPs only allow enabling in-frame authentication by domain. In those cases, set the following Salesforce wildcard domains when you enable in-frame authentication: `*.force` `*.visualforce` ### Salesforce IdP Salesforce IdP supports in-frame authentication by default. You do not need to enable or configure in-frame authentication in the Salesforce configuration. However, you must configure Tableau Cloud for in-frame authentication as described above. ### Okta IdP See _Embed Okta in an iframe_, in the Okta Help Center topic, [General customization options](https://help.okta.com/en/prod/Content/Topics/Settings/settings-customization-general.htm). ### Ping IdP See the Ping support topic, [How to Disable the "X-Frame-Options=SAMEORIGIN" Header in PingFederate](https://support.pingidentity.com/s/article/How-to-Disable-the-X-Frame-Options-SAMEORIGIN-Header-in-PingFederate). ### OneLogin IdP See _Framing protection_, in the OneLogin Knowledge Base article, [Account Settings for Account Owners](https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010304#:~:text=Framing%20protection%20allows%20granular%20customization,a%20user%20agent%20can%20access.). ### ADFS and EntraID IdP Microsoft has blocked all in-frame authentication and it cannot be enabled. Instead, Microsoft only supports pop-up authentication in a second window. As a result, pop up behavior can be blocked by some browsers, which will require users to accept pop ups for the `force.com` and `visualforce.com` sites. ## Salesforce Mobile App If your users primarily interact with Lightning on the Salesforce Mobile App, then you should be aware of the following scenarios: - The Salesforce Mobile App requires that you configure SSO/SAML to view embedded Tableau. - The Salesforce Mobile App requires in-frame authentication. Pop-up authentication does not work. Instead, users on the Salesforce Mobile App will see the Tableau sign-in button but will not be able to sign to Tableau. - Mobile App will not work on ADFS and Azure AD IdP. - Users with Android devices will be required to sign-in to view the embedded Tableau visualization the first time, then SSO will work as expected. [Skip to main content](#main-content) # Configure SAML with AD FS You can configure Active Directory Federation Services (AD FS) as a SAML identity provider, and add Tableau Cloud or Tableau Cloud Manager (TCM) to your supported single sign-on applications. When you integrate AD FS with SAML and Tableau Cloud or TCM, your users can sign in to Tableau Cloud or TCM using their standard network credentials. **Notes:** - These steps reflect a third-party application and are subject to change without our knowledge. If the steps described here do not match the screens you see in your IdP account, you can use the general [SAML configuration steps](https://help.tableau.com/current/online/en-us/saml_config_site.htm#SAML), along with the IdP’s documentation. - Beginning February 2022, multi-factor authentication (MFA) through your SAML SSO identity provider (IdP) is a Tableau requirement. - The configuration steps in the IdP may be in a different order than what you see in Tableau. ## Prerequisites Before you can configure Tableau Cloud or TCM and SAML with AD FS, your environment must have the following: - A server running Microsoft Windows Server 2008 R2 (or later) with AD FS 2.0 (or later) and IIS installed. - We recommend that you secure your AD FS server (for example, using a reverse proxy). When your AD FS server is accessible from outside your firewall, Tableau can redirect users to the sign in page hosted by AD FS. - For Tableau Cloud, a site administrator account that uses Tableau with MFA authentication. If SAML single sign-on fails, you can still sign in to Tableau Cloud as a site administrator. - For TCM, a cloud administrator account that uses Tableau with MFA authentication. If SAML single sign-on fails, you can still sign in to TCM. ## Step 1: Get started In Tableau Cloud, do the following: 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. On the Authentication tab, click the New Configuration button, select SAML from the Authentication drop-down, and then enter a name for the configuration. ![Screen shot of Tableau Cloud site authentication settings -- new configuration page](/tableau/next/en-us/online/en-us/Img/saml_config_site3.png) **Note:** Configurations created before January 2025 (Tableau 2024.3) can't be renamed. Alternatively, in TCM, do the following: 1. Sign in to TCM as a cloud administrator, and select Settings > Authentication. 2. Select the Enable an additional authentication method check box, and select SAML from the Authentication drop-down. 3. Click the Configuration (required) drop-down arrow. In AD FS, do the following: The procedure below exports AD FS metadata that you’ll import to Tableau Cloud or TCM. You will also make sure the metadata is configured and encoded properly for Tableau, and verify other AD FS requirements for your SAML configuration. 1. Export AD FS Federation metadata to an XML file, and then download the file from **https://__/federationmetadata/2007-06/FederationMetadata.xml**. 2. Open the metadata file in a text editor like Sublime Text or Notepad++, and verify that it is correctly encoded as UTF-8 without BOM. If the file shows some other encoding type, save it from the text editor with the correct encoding. 3. Verify that AD FS uses forms-based authentication. Sign-ins are performed in a browser window, so you need AD FS to default to this type of authentication. Edit **c:\\inetpub\\adfs\\ls\\web.config**, search for the tag **,** and move the line so it appears first in the list. Save the file so that IIS can automatically reload it. **Note:** If you don't see the **c:\\inetpub\\adfs\\ls\\web.config** file, IIS is not installed and configured on your AD FS server. 4. Configure an additional AD FS relying party identifier. This allows your system to work around any AD FS issues with SAML logout. Do one of the following: Windows Server 2008 R2: 1. In **AD FS 2.0**, right-click on the relying party you created for Tableau Cloud or TCM earlier, and click **Properties**. 2. On the **Identifiers** tab, in the **Relying party identifier** box, enter **https:///public/sp/metadata** and then click **Add**. Windows Server 2012 R2: 1. In **AD FS Management**, in the **Relying Party Trusts** list, right-click on the relying party you created for Tableau Cloud or TCM earlier, and click **Properties**. 2. On the **Identifiers** tab, in the **Relying party identifier** box, enter **https:// **to Administrative Tools**\> **AD FS 2.0**. 2. In **AD FS 2.0**, under **Trust Relationships**, right-click the **Relying Party Trusts** folder, and then click **Add Relying Party Trust**. Windows Server 2012 R2: 1. Open **Server Manager**, and then on the **Tools** menu, click **AD FS Management**. 2. In **AD FS Management**, on the **Action** menu, click **Add Relying Party Trust**. 6. In the **Add Relying Party Trust Wizard**, click **Start**. 7. On the **Select Data Source** page, select **Import data about the relying party from a file**, and then click **Browse** to locate your Tableau Cloud or TCM metadata file. By default, the file name is **saml\_sp\_metadata.xml**. 8. Click **Next**, and on the **Specify Display Name** page, type a name and description for the relying party trust in the **Display name** and **Notes** boxes. 9. Click Next to skip the **Configure Multi-factor Authentication Now** page. 10. Click Next to skip the **Choose Issuance Authorization Rules** page. 11. Click Next to skip the **Ready to Add Trust** page. 12. On the **Finish** page, select the **Open the Edit Claim Rules dialog for this relying party trust when the wizard closes** check box, and then click **Close**. Next, you’ll work in the **Edit Claim Rules** dialog, to add a rule that makes sure the assertions sent by AD FS match the assertions Tableau Cloud or TCM expects. At a minimum, Tableau Cloud or TCM needs a username (in email address format). However, including first and last names in addition to email will ensure the user names displayed in Tableau Cloud or TCM are the same as those in your AD account. 1. In the Edit Claim Rules dialog box, click **Add Rule**. 2. On the **Choose Rule Type** page, for **Claim rule template**, select **Send LDAP Attributes as Claims**, and then click **Next**. 3. On the **Configure Claim Rule** page, for **Claim rule name**, enter a name for the rule that makes sense to you. 4. For **Attribute store**, select **Active Directory**, complete the mapping as shown below, and then click **Finish**. The mapping is case sensitive and requires exact spelling, so double-check your entries. The table here shows common attributes and claim mappings. Verify attributes with your specific Active Directory configuration. **Note:** Tableau Cloud or TCM requires the **NameID** attribute in the SAML response. You can provide other attributes to map user names in Tableau Cloud or TCM, but the response message must include the **NameID** attribute.

LDAP Attribute

Outgoing Claim Type

Depending on the version of AD FS:

User-Principal-Name
or
E-Mail-Addresses

email
or
E-Mail Address

Given-Name

firstName

Surname

lastName

If you are running AD FS 2016 or later, then you must add a rule to pass through all claim values. If you are running an older version of AD FS, skip to the next procedure to export AD FS metadata. 1. Click **Add Rule**. 2. Under **Claim rule template,** choose **Pass Through or Filter an Incoming Claim.** 3. Under **Claim rule name**, enter Windows. 4. On the **Edit Rule - Windows** pop-up: - Under **Incoming claim type**, select **Windows account name**. - Select **Pass through all claim values**. - Click **OK**. In Tableau Cloud, do the following: 1. Go back to Tableau Cloud, on the New Configuration page, under 3\. Map attributes, populate the claim values from AD FS in Tableau Cloud. 2. Click the Save and Continue button. Alternatively, in TCM do the following: 1. Go back to TCM, on the Authentication page, under 3\. Map attributes, populate the claim values from AD FS in TCM. 2. Click the Save and Continue button. ## Step 4: Test the SAML configuration in Tableau Cloud or TCM 1. In Tableau Cloud or TCM, add a sample user to both AD FS and Tableau Cloud or TCM to test the SAML configuration. - To add users in Tableau Cloud, see [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) topic. - To add users in TCM, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic. 2. Do _one_ of the following: - In Tableau Cloud, on the New Configuration page, under 7\. Test configuration, click the Test Configuration button. - In TCM, on the Authentication page, under 6\. Test configuration, click the Test Configuration button We highly recommend that you test the SAML configuration to avoid any locked out scenarios. Testing the configuration helps ensure that you have configured SAML correctly before changing the authentication type of your users to SAML. To test the configuration successfully, make sure that there is at least one user who you can sign in as who is already provisioned in the IdP and added to your Tableau Cloud or TCM with SAML authentication type configured. ## Step 5: Add additional users to the SAML-enabled Tableau Cloud site or TCM Use the steps below to add additional users to your site. The procedure described in this section is performed on the Tableau Cloud’s or TCM's Users page. 1. After you complete the steps above, from the left pane, navigate to the Users page. 2. Follow the procedure described in one of the following topics: - For Tableau Cloud, see [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) topic. Alternatively, you can add users using a .csv file by following the procedure described in [Import Users](https://help.tableau.com/v0.0/online/en-us/users_import.htm) topic. - For TCM, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic. Alternatively, you can add users using a .csv file by following the procedure described in [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm##bulk-import-users) section in the same topic. ## Additional requirements and tips for SAML support with AD FS - After you set up SAML integration between AD FS and Tableau Cloud or TCM, you must update Tableau to reflect particular user changes you make in Active Directory. For example, adding or removing users. You can add users automatically or manually: - **To add users automatically:** Create a script (using PowerShell, Python, or batch file) to push AD changes to Tableau Cloud or TCM. The script can use [tabcmd](https://help.tableau.com/v0.0/online/en-us/tabcmd_cmd.htm) or the [Tableau REST API](https://help.tableau.com/v0.0/online/en-us/dev_resources.htm) to interact with Tableau Cloud. The script can use [Tableau Cloud Manager REST API](https://help.tableau.com/v0.0/online/en-us/dev_resources.htm) to interact with TCM. - **To add users manually:** Sign in to the Tableau Cloud or TCM UI, go to the Users page, click Add Users, select Add Users by Username, and enter users’ username or upload a .csv file that contains their information. **Note:** If you want to remove a user but keep content assets they own, change the owner of the content before you remove the user. Deleting a user also deletes content they own. - In Tableau Cloud or TCM, a user’s username is their unique identifier. As described in the steps for configuring AD FS to accept sign-in requests from Tableau Cloud or TCM, users’ Tableau Cloud or TCM usernames must match the username stored in AD. - In [Step 3: Configure "Tableau Cloud application" in your IdP](#idp), you added a claim rule in AD FS to match the first name, last name, and username attributes between AD FS and Tableau Cloud. Alternatively, you can use step **3\. Map attributes** in Tableau Cloud to do the same. [Skip to main content](#main-content) # Configure SAML with Microsoft Entra ID If you’ve configured Microsoft Entra ID (also known as Microsoft Azure Active Directory (Azure AD)) as your SAML identity provider (IdP), use the information in this topic alongside the Microsoft Entra documentation to add Tableau Cloud or Tableau Cloud Manager (TCM) to your single sign-on applications. **Notes:** - These steps reflect a third-party application and are subject to change without our knowledge. If the steps described here do not match the screens you see in your IdP account, you can use the general [SAML configuration steps](https://help.tableau.com/current/online/en-us/saml_config_site.htm#SAML), along with the IdP’s documentation. - Beginning February 2022, multi-factor authentication (MFA) through your SAML SSO identity provider (IdP) is a Tableau requirement. - The configuration steps in the IdP may be in a different order than what you see in Tableau. ## Prerequisites Before you can configure Tableau and SAML with Entra ID, your environment must have the following: - [Meet the Prerequisites](https://learn.microsoft.com/en-us/entra/identity/saas-apps/tableauonline-tutorial#prerequisites) as described in the Tutorial: Microsoft Entra SSO integration with Tableau Cloud documentation - [Create a Microsoft Entra test user](https://learn.microsoft.com/en-us/entra/identity/saas-apps/tableauonline-tutorial#create-a-microsoft-entra-test-user) as described in the Tutorial: Microsoft Entra SSO integration with Tableau Cloud documentation ## Step 1: Get started In Tableau Cloud, do the following: 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. On the Authentication tab, click the New Configuration button, select SAML from the Authentication drop-down, and then enter a name for the configuration. ![Screen shot of Tableau Cloud site authentication settings -- new configuration page](/tableau/next/en-us/online/en-us/Img/saml_config_site3.png) **Note:** Configurations created before January 2025 (Tableau 2024.3) can't be renamed. Alternatively, in TCM, do the following: 1. Sign in to TCM as a cloud administrator, and select Settings > Authentication. 2. Select the Enable an additional authentication method check box, and select SAML from the Authentication drop-down. 3. Click the Configuration (required) drop-down arrow. In Entra, do the following: **Note:** For TCM, you use the "Tableau Cloud application" in the IdP to configure TCM authentication. 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/) as at least a Cloud Application Administrator. 2. Navigate to Enterprise applications > New application. 3. On the Browse Microsoft Entra Gallery page, enter "Tableau Cloud" in the search box. 4. Select Tableau Cloud from the search results, and in the right panel, optionally change the default name of the application instance and then click Create. **Notes:** - Adding the instance of Tableau Cloud application might take a few moments. - When creating an instance of the Tableau Cloud application through the gallery, SAML is the only configuration type supported for integration with Tableau. 5. In the left pane, navigate to Single sign-on. 6. On the Select a single sign-on method page, select SAML. 7. On the Set up Single Sign-On with SAML page, next to Basic SAML Configuration, click Edit, and do the following: 1. In the Identifier (Entity ID) text box, enter the following placeholder URL that you will edit again in step 3: `https://sso.online.tableau.com/public/sp/metadata?alias=` 2. In the Reply URL text box, enter the following placeholder URL that you will edit again in step 3: `https://sso.online.tableau.com/public/sp/` 3. Select Save. 8. Next, next to SAML Signing Certificate, click Edit. 9. Click Download to download the Federation Metadata XML. 10. Finally, next to Attributes & Claims, select Edit to prepare for step 2.2, below. ## Step 2: Configure SAML in Tableau Cloud or TCM Complete the following procedure after you save the SAML metadata file from Entra, as described in the section above. **For Tableau Cloud** 1. Back in Tableau Cloud, on the New Configuration page, under 2\. Upload metadata to Tableau, click the Choose a file button and navigate to the SAML metadata file you saved from Entra. This automatically fills the IdP entity ID and SSO Service URL values. 2. Under 3\. Map attributes copy the corresponding attribute names (assertions) from the Entra’s Attributes & Claims section: 1. For the Username field, enter the correct assertion value used by your organization. For example, your organization might use `nameID`, `mail`, `userprincipalName`, the `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` URL, or other assertion value. 2. For the remaining optional fields, copy the URL claim names. 3. Under 4\. Choose default for embedding views (optional), select the experience you want to enable when users access embedded Tableau content. 4. Select the Save and Continue button. 5. Go to 5\. Get Tableau Cloud metadata to prepare for step 3.1 below. **For TCM** 1. Back in TCM, on the Authentication page, under 2\. Upload metadata to Tableau, click the Choose a file button and navigate to the SAML metadata file you saved from Entra. This automatically fills the IdP entity ID and SSO Service URL values. 2. Under 3\. Map attributes copy the corresponding attribute names (assertions) from the Entra’s Attributes & Claims section: 1. For the Username field, enter the correct assertion value used by your organization. For example, your organization might use `nameID`, `mail`, `userprincipalName`, the `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name` URL, or other assertion value. 2. For the remaining optional fields, copy the URL claim names. 3. Select the Save and Continue button. 4. Go to 4\. Get Tableau Cloud metadata to prepare for step 3.1 below. ## Step 3: Configure "Tableau Cloud application" in your IdP 1. Back in the Entra, on the Set up Single Sign-On with SAML page, next to Basic SAML Configuration, click Edit, and do the following: 1. For Identifier (Entity ID), do one of the following: - Under Tableau Cloud's 5\. Get Tableau Cloud metadata, copy the Tableau Cloud entity ID URL. - Under TCM's 4\. Get Tableau Cloud metadata, copy the Tableau Cloud entity ID URL. 2. For Reply URL, do one of the following: - Under Tableau Cloud's 5\. Get Tableau Cloud metadata, copy the Tableau Cloud ACS URL. - Under TCM's 4\. Get Tableau Cloud metadata, copy the Tableau Cloud ACS URL. 3. Select Save. ## Step 4: Test the SAML configuration In Entra, do the following: - Assign the [Microsoft Entra test user](https://learn.microsoft.com/en-us/entra/identity/saas-apps/tableauonline-tutorial#assign-the-microsoft-entra-test-user) as described in the Tutorial: Microsoft Entra SSO integration with Tableau Cloud documentation. In Tableau Cloud or TCM, do the following: 1. Add that Entra user to Tableau Cloud or TCM to test the SAML configuration. - To add users in Tableau Cloud, see the [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) topic. - To add users in TCM, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic. 2. Do _one_ of the following: - In Tableau Cloud, on the New Configuration page, under 7\. Test configuration, click the Test Configuration button. - In TCM, on the Authentication page, under 6\. Test configuration, click the Test Configuration button. We highly recommend that you test the SAML configuration to avoid any locked out scenarios. Testing the configuration helps ensure that you have configured SAML correctly before changing the authentication type of your users to SAML. To test the configuration successfully, make sure that there is at least one user who you can sign in as who is already provisioned in the IdP and added to your Tableau Cloud or TCM with SAML authentication type configured. ## Additional notes for SAML support with Microsoft Entra ID - To avoid enabling SP-initiated single logout (SLO), ensure that the IdP metadata uploaded to Tableau Cloud or TCM SAML settings does not contain the SLO endpoint. Alternatively, in the IdP metadata that you upload to Tableau Cloud or TCM SAML settings, you can replace the existing “SingleLogoutService” value with "https://sso.online.tableau.com/public/idp/SSO”. - If using IdP-initiated SSO for your application, do not provide a “Sign On URL” value in the Tableau Cloud or TCM application from the gallery in Entra. Providing a value for this field will bypass IdP-initiated SSO. - If you configure a [Use a Custom Domain with Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/custom_domain.htm) for your Tableau Cloud site, you must update both the Tableau Cloud Entity ID and ACS URL in your IDP's application settings to reflect the custom domain. For example, if your custom domain is `analytics.example.com`, update these URLs to use that domain instead of the default Tableau Cloud URLs. For example, update Entra ID's **Identifier**(Entity ID) and **Reply URL**(ACS URL). [Skip to main content](#main-content) # Configure SAML with Okta If you use Okta as your SAML identity provider (IdP), you can use the information in this topic to set up SAML authentication for Tableau Cloud or Tableau Cloud Manager (TCM). You can also use the [How to Configure SAML 2.0 for Tableau Cloud](https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Tableau-Online.html) topic in the Okta documentation. Tableau Cloud’s SAML integration with Okta supports service provider (SP)-initiated SSO, identity provider (IdP)-initiated SSO, and single logout (SLO). **Notes:** - These steps reflect a third-party application and are subject to change without our knowledge. If the steps described here do not match the screens you see in your IdP account, you can use the general [SAML configuration steps](https://help.tableau.com/current/online/en-us/saml_config_site.htm#SAML), along with the IdP’s documentation. - Beginning February 2022, multi-factor authentication (MFA) through your SAML SSO identity provider (IdP) is a Tableau requirement. - The configuration steps in the IdP may be in a different order than what you see in Tableau. ## Step 1: Get started In Tableau Cloud, do the following: 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. On the Authentication tab, click the New Configuration button, select SAML from the Authentication drop-down, and then enter a name for the configuration. ![Screen shot of Tableau Cloud site authentication settings -- new configuration page](/tableau/next/en-us/online/en-us/Img/saml_config_site3.png) **Note:** Configurations created before January 2025 (Tableau 2024.3) can't be renamed. Alternatively, in TCM, do the following: 1. Sign in to TCM as a cloud administrator, and select Settings > Authentication. 2. Select the Enable an additional authentication method check box, and select SAML from the Authentication drop-down. 3. Click the Configuration (required) drop-down arrow. In the Okta administrator console, do the following: **Note:** For TCM, you use the "Tableau Cloud application" in the IdP to configure TCM authentication. 1. Open a new browser tab or window and sign in to your Okta administrator console. 2. From the left pane, select Applications > Applications and click the Browse App Catalog button. 3. Search for and click "Tableau Cloud" and then click the Add Integration button. This opens the General Settings tab. 4. (Optional) If you have more than one Tableau Cloud site, edit the site name in the Application label field to help you differentiate between your Tableau Cloud application instances. 5. Navigate to the Sign On tab, click Edit, and do the following: 1. Under Metadata details, copy the Metadata URL. 2. Paste the URL into a new browser and save the results as a file using the default "metadata.xml". ## Step 2: Configure SAML in Tableau Cloud or TCM Complete the following procedure after you save the SAML metadata file from Okta, as described in the section above. **For Tableau Cloud** 1. Back in Tableau Cloud, on the New Configuration page, under 2\. Upload metadata to Tableau, click the Choose a file button and navigate to the SAML metadata file you saved from Okta. This automatically fills the IdP entity ID and SSO Service URL values. 2. Map the attribute names (assertions) under 3\. Map attributes to the corresponding attribute names (assertions) in the Okta administrator console's Tableau Cloud User Profile Mappings page. 3. Under 4\. Choose default for embedding views (optional), select the experience you want to enable when users access embedded content. For more information, see the [About enabling iFrame embedding](#enable-iframe-embedding) section below. 4. Click the Save and Continue button. **For TCM** 1. Back in TCM, on the Authentication page, under 2\. Upload metadata to Tableau, click the Choose a file button and navigate to the SAML metadata file you saved from Okta. This automatically fills the IdP entity ID and SSO Service URL values. 2. Map the attribute names (assertions) under 3\. Map attributes to the corresponding attribute names (assertions) in the Okta administrator console's Tableau Cloud User Profile Mappings page. 3. Click the Save and Continue button. ## Step 3. Configure "Tableau Cloud application" in your IdP For Tableau Cloud, the procedure in this section will use the information from 5\. Get Tableau Cloud Metadata, under Method 2: Copy metadata and download certificate on the New Configuration page in Tableau Cloud. For TCM, the procedure in this section will use the information from 4\. Get Tableau Cloud Metadata, under Method 2: Copy metadata and download certificate on the Authentication page in TCM. **Note:** For TCM, you use the "Tableau Cloud application" in the IdP to configure TCM authentication. 1. In the Okta administrator console, click the Assignments tab to add your users or groups. 2. When finished, click Done. 3. Click the Sign On tab and in the Settings section, click Edit. 4. (Optional) If you want to enable single logout (SLO), do the following: 1. Select the Enable Single Logout check box. 2. Copy the "Single Logout URL" value from the Tableau Cloud metadata file. For example, . For more information, see the [Configure Single Logout Using SAML with Okta](https://kb.tableau.com/articles/howto/configure-single-logout-using-saml-with-okta) in the Tableau Knowledge Base. 3. In the Advanced Sign-on Settings text box, enter the value you copied in step b. 4. Next to Signature Certificate, click the Browse button and navigate to the certificate file you downloaded in the section above. 5. Select the file and click the Upload button. 6. When finished, click Save. 5. Select Applications > Applications, click the Tableau Cloud application, select the Sign On tab, and do the following: 1. Click Edit. 2. Under Advanced Sign-on Settings, for the Tableau Cloud entity ID text box in the Okta administrator console, paste the Tableau Cloud entity ID value from Tableau Cloud or TCM. ![](/tableau/next/en-us/online/en-us/Img/saml_okta_entityID.png) 3. For the Tableau Cloud ACS URL text box in the Okta administrator console, paste the Tableau Cloud ACS URL value from Tableau Cloud or TCM. ![](/tableau/next/en-us/online/en-us/Img/saml_okta_ACS.png) **Note:** The Tableau Cloud and TCM SAML configuration settings appear in a different order than on the Okta settings page. To prevent SAML authentication issues, make sure that the Tableau Cloud entity ID and Tableau Cloud ACS URL are entered into the correct fields in Okta. 6. When finished, click Save. ## Step 4: Test the SAML configuration In Okta, do the following: - Add a sample user to Okta and assign them to the "Tableau Cloud application". In Tableau Cloud or TCM, do the following: 1. Add that Okta user to Tableau Cloud to test the SAML configuration. - To add users in Tableau Cloud, see the [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) topic. - To add users in TCM, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic. 2. Do one of the following: - In Tableau Cloud, on the New Configuration page, under 7\. Test Configuration, click the Test Configuration button. - In TCM, on the Authentication page, under 6\. Test configuration, click the Test Configuration button. We highly recommend that you test the SAML configuration to avoid any locked out scenarios. Testing the configuration helps ensure that you have configured SAML correctly before changing the authentication type of your users to SAML. To test the configuration successfully, make sure that there is at least one user who you can sign in as who is already provisioned in the IdP and added to your Tableau Cloud or TCM with SAML authentication type configured. **Note:** If the connection fails, consider keeping the `NameID` attribute in Tableau as-is. ## Step 5: Add additional users to the SAML-enabled Tableau Cloud site or TCM If you plan to use SCIM to provision your users from Okta, do not manually add your users to Tableau Cloud. For more information, see Configure [Configure SCIM with Okta](https://help.tableau.com/v0.0/online/en-us/scim_config_okta.htm). If you are not using SCIM, then use the steps below to add additional users to your site. **Note:** SCIM provisioning is not available for TCM. The procedure described in this section is performed on the Tableau Cloud's Users page. 1. After you complete the steps above, from the left pane, navigate to the Users page. 2. Follow the procedure described in: - [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) topic for Tableau Cloud - [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic for TCM ## About enabling iFrame embedding **Note:** Applies to Tableau Cloud only. When you enable SAML on your site, you need to specify how users sign in to access views embedded in web pages. These steps configure Okta to allow authentication using an inline frame (iFrame) for embedded visualization. Inline frame embedding may provide a more seamless user experience when signing on to view embedded visualizations. For example, if a user is already authenticated with your identity provider and iFrame embedding is enabled, the user would seamlessly authenticate with Tableau Cloud when browsing to pages that contain embedded visualizations. **Caution:** IFrame can be vulnerable to a clickjack attack. _Clickjacking_ is a type of attack against web pages in which the attacker tries to lure users into clicking or entering content by displaying the page to attack in a transparent layer over an unrelated page. In the context of Tableau Cloud, an attacker might try to use a clickjack attack to capture user credentials or to get an authenticated user to change settings. For more information about clickjack attacks, see [Clickjacking](https://www.owasp.org/index.php/Clickjacking) on the Open Web Application Security Project website. 1. Sign in to your Okta administrator console. 2. From the left pane, select Customizations > Other and navigate to the IFrame Embedding section. 3. Click Edit, select the Allow iFrame embedding check box, and then click Save. [Skip to main content](#main-content) # Configure SAML with OneLogin If you use OneLogin as your SAML identity provider (IdP), you can use the information in this topic to set up SAML authentication for Tableau Cloud or Tableau Cloud Manager (TCM). These steps assume that you have permissions for modifying your organization’s OneLogin portal, and you are comfortable reading XML and pasting values into attributes. **Notes:** - These steps reflect a third-party application and are subject to change without our knowledge. If the steps described here do not match the screens you see in your IdP account, you can use the general [SAML configuration steps](https://help.tableau.com/current/online/en-us/saml_config_site.htm#SAML), along with the IdP’s documentation. - Beginning February 2022, multi-factor authentication (MFA) through your SAML SSO identity provider (IdP) is a Tableau requirement. - The configuration steps in the IdP may be in a different order than what you see in Tableau. ## Step 1: Get started In Tableau Cloud, do the following: 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. On the Authentication tab, click the New Configuration button, select SAML from the Authentication drop-down, and then enter a name for the configuration. ![Screen shot of Tableau Cloud site authentication settings -- new configuration page](/tableau/next/en-us/online/en-us/Img/saml_config_site3.png) **Note:** Configurations created before January 2025 (Tableau 2024.3) can't be renamed. Alternatively, in TCM, do the following: 1. Sign in to TCM as a cloud administrator, and select Settings > Authentication. 2. Select the Enable an additional authentication method check box, and select SAML from the Authentication drop-down. 3. Click the Configuration (required) drop-down arrow. In OneLogin, do the following: 1. Open a new browser tab or window, sign in to your OneLogin admin portal, and then do the following: 2. On the Applications page, select Add Apps. Search for Tableau, and in the results, select Tableau Cloud SSO. In this area you configure the SAML connection. **Note:** The Tableau Cloud SSO option for OneLogin does not work with Tableau Server. 3. On the **Info** page, set up your portal preferences. If you have more than one Tableau Cloud site, include the site name in the Display Name field to help users know which site to select. 4. On the SSO page, select and copy the URI shown in the SLO Endpoint (HTTP) field. **Note:** Although the label indicates HTTP, the URI provided is an **https** address, because the SLO (single logout) endpoint uses SSL/TLS encryption. 5. On the same page, select More Actions > SAML Metadata, and save the OneLogin metadata file to your computer. ## Step 2: Configure SAML in Tableau Cloud or TCM Complete the following steps after you download the SAML metadata file from OneLogin, as described in the section above. **For Tableau Cloud** 1. Back in Tableau Cloud, on the New Configuration page, under 2\. Upload metadata to Tableau, click the Choose a file button and navigate to the SAML metadata file you downloaded from OneLogin. **Important:** If you encounter any issues with uploading the OneLogin metadata file, consider using a non-default certificate with OneLogin. To create a new certificate, from the Onelogin admin portal, select Security > Certificates. If you create a new certificate, ensure the Tableau Cloud application in OneLogin uses this new certificate. 2. Continue to 3\. Map attributes and set the values as follows: 1. For Username, enter Email. This is the email address the users use to sign in to Tableau Cloud. 2. For Email address, enter the optional attribute value according to the IdP's documentation. This attribute is the email address where the user should receive notifications if different from username. The email address attribute is used for notifications purposes only and not used for sign-in. 3. For Display name, select the First and last name radio button. 1. For First name, enter FirstName. 2. For Last name, enter LastName. ![Screenshot of the SAML configuration page -- step 3. Map attributes](/tableau/next/en-us/online/en-us/Img/saml_config_site_match_assertions.png) 3. Under 4\. Choose default for embedding views (optional), select the experience you want to enable when users access embedded content. For more information, see the [About enabling iFrame embedding](#enable-iframe-embedding) section below. 4. Click the Save and Continue button. **For TCM** 1. Back in TCM, on the Authentication page, under 2\. Upload metadata to Tableau, click the Choose a file button and navigate to the SAML metadata file you downloaded from OneLogin. **Important:** If you encounter any issues with uploading the OneLogin metadata file, consider using a non-default certificate with OneLogin. To create a new certificate, from the Onelogin admin portal, select Security > Certificates. If you create a new certificate, ensure the TCM application in OneLogin uses this new certificate. 2. Continue to 3\. Map attributes and set the values as follows: 1. For Username, enter Email. This is the email address the users use to sign in to TCM. **Note:** The Email address field shown above will not appear for TCM. 2. For Email address, enter the optional attribute value according to the IdP's documentation. This attribute is the email address where the user should receive notifications if different from username. The email address attribute is used for notifications purposes only and not used for sign-in. 3. For Display name, select the First and last name radio button. 1. For First name, enter FirstName. 2. For Last name, enter LastName. 3. Click the Save and Continue button. ## Step 3. Configure "Tableau Cloud application" in your IdP For Tableau Cloud, the procedure in this section will use the information from 5\. Get Tableau Cloud Metadata, under Method 2: Copy metadata and download certificate on the New Configuration page in Tableau Cloud. For TCM, the procedure in this section will use the information from 4\. Get Tableau Cloud Metadata, under Method 2: Copy metadata and download certificate on the Authenticaiton page in TCM. 1. Back in the OneLogin portal, in the Tableau Cloud or TCM application, on the **Configuration** page, do the following: 1. For Consumer URL in the OneLogin portal, paste the Tableau Cloud ACS URL value from Tableau Cloud or TCM. 2. For Audience in the OneLogin portal, paste the Tableau Cloud entity ID value from Tableau Cloud or TCM. ![Screenshot of the Tableau Cloud SAML's New Configuration page -- step 5. Export metadata from Tableau Cloud](/tableau/next/en-us/online/en-us/Img/saml_config_onelogin2.png) 2. Navigate to the SSO page, select SHA-256 for the SAML Signature Algorithm. 3. Navigate to the Parameters and make sure the values appear as follows: | Tableau Cloud or TCM field | Value | | --- | --- | | Username | Email | | First Name | First Name | | Last Name | Last Name | ## Step 4: Test the SAML configuration In OneLogin, do the following: - Add a sample user to OneLogin and assign them to the "Tableau Cloud application". In Tableau Cloud or TCM, do the following: 1. Add that OneLogin user to Tableau to test the SAML configuration. - To add users in Tableau Cloud, see the [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) topic. - To add users in TCM, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic. 2. Do _one_ of the following: - In Tableau Cloud, on the New Configuration page, under 7\. Test configuration, click the Test Configuration button. - In TCM, on the Authentication page, under 6\. Test configuration, click the Test Configuration button. We highly recommend that you test the SAML configuration to avoid any locked out scenarios. Testing the configuration helps ensure that you have configured SAML correctly before changing the authentication type of your users to SAML. To test the configuration successfully, make sure that there is at least one user who you can sign in as who is already provisioned in the IdP and added to your Tableau Cloud or TCM with SAML authentication type configured. ## Step 5: Add additional users to the SAML-enabled Tableau Cloud site or TCM Use the steps below to add additional users to your site. The procedure described in this section is performed on the Tableau Cloud's or TCM's Users page. 1. After you complete the steps above, from the left pane, navigate to the Users page. 2. Follow the procedure described in: - [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) topic for Tableau Cloud - [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic for TCM ## About enabling iFrame embedding **Note:** Applies to Tableau Cloud only. When you enable SAML on your site, you need to specify how users sign in to access views embedded in web pages. These steps configure Okta to allow authentication using an inline frame (iFrame) for embedded visualization. Inline frame embedding may provide a more seamless user experience when signing on to view embedded visualizations. For example, if a user is already authenticated with your identity provider and iFrame embedding is enabled, the user would seamlessly authenticate with Tableau Cloud when browsing to pages that contain embedded visualizations. **Caution:** Inline frames can be vulnerable to a clickjack attack. _Clickjacking_ is a type of attack against web pages in which the attacker tries to lure users into clicking or entering content by displaying the page to attack in a transparent layer over an unrelated page. In the context of Tableau Cloud, an attacker might try to use a clickjack attack to capture user credentials or to get an authenticated user to change settings. For more information about clickjack attacks, see [Clickjacking](https://www.owasp.org/index.php/Clickjacking) on the Open Web Application Security Project website. 1. Open a new browser tab or window, and sign in to your OneLogin admin portal. 2. On the Settings menu, click Account Settings. 3. On the Basic page, in **Framing Protection**, select the Disable Framing Protection (X-Frame-Options) check box. [Skip to main content](#main-content) # Configure SAML with PingOne If you use PingOne as your SAML identity provider (IdP), you can use the information in this topic to set up SAML authentication for Tableau Cloud or Tableau Cloud Manager (TCM). **Notes:** - These steps reflect a third-party application and are subject to change without our knowledge. If the steps described here do not match the screens you see in your IdP account, you can use the general [SAML configuration steps](https://help.tableau.com/current/online/en-us/saml_config_site.htm#SAML), along with the IdP’s documentation. - Beginning February 2022, multi-factor authentication (MFA) through your SAML SSO identity provider (IdP) is a Tableau requirement. - The configuration steps in the IdP may be in a different order than what you see in Tableau. ## Step 1: Get started In Tableau Cloud, do the following: 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. On the Authentication tab, click the New Configuration button, select SAML from the Authentication drop-down, and then enter a name for the configuration. ![Screen shot of Tableau Cloud site authentication settings -- new configuration page](/tableau/next/en-us/online/en-us/Img/saml_config_site3.png) **Note:** Configurations created before January 2025 (Tableau 2024.3) can't be renamed. Alternatively, in TCM, do the following: 1. Sign in to TCM as a cloud administrator, and select Settings > Authentication. 2. Select the Enable an additional authentication method check box, and select SAML from the Authentication drop-down. 3. Click the Configuration (required) drop-down arrow. In PingOne, do the following: **Note:** For TCM, you use the "Tableau Cloud application" in the IdP to configure TCM authentication. 1. Open a new browser tab or window, sign in to your PingOne account, and then click the Applications tab. 2. In the Application Catalog search for and select Tableau Cloud. 3. Click Setup button, the Save & Publish button, and then click the Download link next to SAML Metadata, and save the PingOne SAML metadata file to your computer. ![](/tableau/next/en-us/online/en-us/Img/saml_config_pingone3.png) ## Step 2: Configure SAML in Tableau Cloud or TCM Complete the following procedure after you download the SAML metadata file from PingOne, as described in the section above. **For Tableau Cloud** 1. Back in Tableau Cloud, in the New Configuration page, under 2\. Upload metadata to Tableau, click the Choose a file button and navigate to the SAML metadata file you downloaded from your PingOne account. 2. Continue to Step 3: Map attributes, and complete the remaining steps as described. 3. Under 4\. Choose default for embedded views, you can optionally select how users authenticate to embedded views. 4. Click the Save and Continue button. 5. Under 5\. Get Tableau Cloud metadata, click the Export Metadata button and save the Tableau metadata file to your computer. By default, the file name is **saml\_sp\_metadata.xml**. **For TCM** 1. Back in TCM, in the Authentication page, under 2\. Upload metadata to Tableau, click the Choose a file button and navigate to the SAML metadata file you downloaded from your PingOne account. 2. Continue to Step 3: Match assertions, and complete the remaining steps as described. 3. Click the Save and Continue button. 4. Under 4\. Get Tableau Cloud metadata, click the Export Metadata button and save the Tableau metadata file to your computer. By default, the file name is **saml\_sp\_metadata.xml**. ## Step 3. Configure "Tableau Cloud application" in your IdP **Note:** For TCM, you use the "Tableau Cloud application" in the IdP to configure TCM authentication. 1. Back in your PingOne account, in the Tableau Cloud application, navigate to Setup. 2. On the 1\. SSO Instructions page, click Continue to Next Step. 3. On the 2\. Configure your connection page, for Upload Metadata, click Select File, and upload the Tableau Cloud or TCM metadata file you saved from Tableau Cloud or TCM. 4. Click Continue to Next Step. When you import the Tableau Cloud or TCM metadata as part of the PingOneSAML configuration, the certificate embedded in the metadata is not applied to the IdP application definition. This can cause the following error when people sign out of the SAML site: _It looks like the signing certificate has not been configured._ ### Configure the PingOne certificate To resolve the sign-out error, you can download the certificate from Tableau Cloud or TCM, convert it from DER encoded to Base-64 encoded, and then upload it to PingOne. The steps for converting the certificate are specific to Windows. In Tableau Cloud, do the following: 1. Back in Tableau Cloud, make sure SAML is selected and you're on the New Configuration page. 2. Under 5\. Get Tableau Cloud metadata, for Method 2: Copy metadata and download certificate, click the Download Certificate button, and save the .cer file to your computer. ![](/tableau/next/en-us/online/en-us/Img/saml_config_pingone5.png) Alternatively, in TCM, do the following: 1. Back in TCM, make sure SAML is selected and you're on the Authentication page. 2. Under 4\. Get Tableau Cloud metadata, for Method 2: Copy metadata and download certificate, click the Download Certificate button, and save the .cer file to your computer. ![](/tableau/next/en-us/online/en-us/Img/saml_config_pingone5.png) On your computer, do the following: 1. Double-click the .cer file you downloaded, and click Open. 2. In the Certificate dialog box, select the Details tab and click Copy to File. 3. In the Certificate Export Wizard, do the following: 1. Click Next on the opening screen, and then select Base-64 encoded X.590 (.CER). 2. Click Next, and specify the name and location of the file you are exporting. 3. Click Next, review the summary information, and then click Finish. In PingOne, do the following: 1. In your PingOne account, return to the application setup pages for Tableau Cloud or TCM. 2. In Step 2. Configure your connection, for Verification Certificate, click Choose File, and upload the new .cer file you created. ![](/tableau/next/en-us/online/en-us/Img/saml_config_pingone6.png) ## Step 4: Test the SAML configuration In PingOne, do the following: - Add a sample user to PingOne and assign them to the Tableau Cloud or TCM application. In Tableau Cloud, do the following: 1. Add that PingOne user to Tableau Cloud to test the SAML configuration. - To add users in Tableau Cloud, see the [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) topic. - To add users in TCM, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic. 2. Do _one_ of the following: - In Tableau Cloud, under 7\. Test configuration, click the Test Configuration button. - In TCM, on the Authentication page, under 6\. Test configuration, click the Test Configuration button. We highly recommend that you test the SAML configuration to avoid any locked out scenarios. Testing the configuration helps ensure that you have configured SAML correctly before changing the authentication type of your users to SAML. To test the configuration successfully, make sure that there is at least one user who you can sign in as who is already provisioned in the IdP and added to your Tableau Cloud or TCM with SAML authentication type configured. ## Step 5: Add additional users to the SAML-enabled Tableau Cloud site or TCM Use the steps below to add additional users to your site. The procedure described in this section is performed on the Tableau Cloud’s or TCM's Users page. 1. After you complete the steps above, from the left pane, navigate to the Users page. 2. Follow the procedure described in: - [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) topic for Tableau Cloud - [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic for TCM [Skip to main content](#main-content) # Configure SAML with Salesforce If you’ve configured Salesforce as your SAML identity provider (IdP), use the information in this topic alongside the Salesforce documentation to add Tableau Cloud or Tableau Cloud Manager (TCM) to your single sign-on applications. **Notes:** - These steps reflect the Salesforce application and can change without our knowledge. If the steps described here do not match the screens you see in Salesforce, you can use the general [SAML configuration steps](https://help.tableau.com/current/online/en-us/saml_config_site.htm#SAML), along with the Salesforce documentation. - Beginning February 2022, multi-factor authentication (MFA) with Salesfoce is a Tableau Cloud and Salesforce requirement. - The configuration steps in the IdP may be in a different order than what you see in Tableau Cloud or TCM. ## Step 1: Configure SAML in Tableau Cloud or TCM To configure the Salesforce application, you'll need to use information in the Tableau Cloud or TCM SAML settings. 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. On the Authentication tab, click the New Configuration button, select SAML from the Authentication drop-down, and then enter a name for the configuration. ![Screen shot of Tableau Cloud site authentication settings -- new configuration page](/tableau/next/en-us/online/en-us/Img/saml_config_site3.png) **Note:** Configurations created before January 2025 (Tableau 2024.3) can't be renamed. Alternatively, in TCM, do the following: 1. Sign in to TCM as a cloud administrator, and select Settings > Authentication. 2. Select the Enable an additional authentication method check box, and select SAML from the Authentication drop-down. 3. Click the Configuration (required) drop-down arrow. ## Step 2: Configure "Tableau Cloud application" in your IdP To integrate a service provider with your Salesforce org, use an external client app that implements SAML 2.0. For more information, see [Configure the External Client App's SAML 2.0 Settings and Policies](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_saml.htm&type=5) in the Salesforce Help. Alternatively, you can follow the steps described in [Configure SSO from Salesforce to Tableau Cloud](https://help.salesforce.com/articleView?id=identity_provider_examples_tableau_online.htm&type=5) (deprecated) if Salesforce connected apps are still available to you. ## Step 3: Add users to the SAML-enabled Tableau Cloud site or TCM 1. After you complete the Salesforce configuration steps, return to your Tableau Cloud site or TCM. 2. Complete the SAML configuration by adding the users you assigned in the Salesforce Application Profile Assignment page to Tableau Cloud or TCM by selecting existing Tableau Cloud or TCM users, or add new users you want to approve for SAML. When you add or import users, you also specify their authentication type. On the Users page, you can change users’ authentication type any time after adding them. For more information, see one of the following: - [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) or [Import Users](https://help.tableau.com/v0.0/online/en-us/users_import.htm) topic for Tableau Cloud - [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic for TCM [Skip to main content](#main-content) # Configure SCIM with Microsoft Entra ID You can configure user management through Microsoft Entra ID (also known as Azure Active Directory (AD)), provision groups, and assign Tableau Cloud site roles. While you complete the following steps, it will help to have the Entra ID documentation at hand. See the tutorial, [Configure Tableau Cloud for automatic user provisioning](https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/tableau-online-provisioning-tutorial). **Notes:** - If you have already enabled provisioning for your application and would like to update to use the Tableau SCIM 2.0 endpoint, see the Microsoft article [Update a Tableau Cloud application](https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/tableau-online-provisioning-tutorial#update-a-tableau-cloud-application-to-use-the-tableau-cloud-scim-20-endpoint). If you are setting up provisioning for a new instance of the Tableau Cloud application, follow the steps below. - These steps reflect a third-party application and are subject to change without our knowledge. If the steps described here do not match the screens you see in your IdP account, you can use the general [SCIM](https://help.tableau.com/v0.0/online/en-us/scim_config_online.htm) topic along with the IdP’s documentation. - The configuration steps in the IdP may be in a different order than what you see in Tableau. ## Step 1: Perform prerequisites The SCIM functionality requires that you configure your site to support SAML, OIDC, or Google single sign-on (SSO). 1. If using SAML authentication, complete the section "Add Tableau Cloud to your Microsoft Entra ID applications" in [Configure SAML with Microsoft Entra ID](https://help.tableau.com/v0.0/online/en-us/saml_config_azure_ad.htm). 2. If using OIDC authentication, complete [Configure Tableau Cloud or TCM for OpenID Connect](https://help.tableau.com/v0.0/online/en-us/openid_auth_server_config.htm). 3. After adding Tableau Cloud from the Azure Marketplace, remain signed in to both the Entra portal and Tableau Cloud, with the following pages displayed: - In Tableau Cloud, the Settings > Authentication page. - In the Entra portal, the Tableau Cloud application > Provisioning page. ## Step 2: Enable SCIM support Use the following steps to enable SCIM support with Microsoft Entra ID. See also [Notes and limitations for SCIM support with Azure Active Directory](#azure-ad-support-notes) section below. **Note:** For the steps in the Entra portal, make sure you're using Tableau Cloud app from the gallery. ### In Tableau Cloud 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. Do the following: 1. On the Authentication page, under System for Cross-domain Identity Management (SCIM), click the **New Configuration** button. 2. In the New SCIM Configuration dialog box, do the following: 1. Enter a name for the SCIM configuration. 2. Copy the Base URL to use in your IdP's SCIM settings. 3. From the Authentication drop-down, select the authentication configuration to associate with SCIM. 4. Click **Save**. **Note:** This populates the SCIM token section. ![A new SCIM configuration](/tableau/next/en-us/online/en-us/Img/scim_config_new.png) 3. Under SCIM token, do the following: 1. Click the New Secret button. 2. In the New Secret dialog box, click the New Secret button again. A newly generated secret will display. ![](/tableau/next/en-us/online/en-us/Img/scim_config_newsecret_newsecret.png) 3. Copy the secret and store it in a safe location. **Important:** - If you close the SCIM configuration before you can add the secret to your IdP's SCIM settings, you can edit SCIM configuration but will be required to click New Secret again to generate a new secret. - The secret is tied to the Tableau site administrator user who created the SCIM configuration. If that user’s site role changes or the user is no longer a member of the site, the secret becomes invalid. In this case, another site administrator can generate a new secret for the existing SCIM configuration and add it to the IdP's SCIM settings or create a new SCIM configuration ensuring the base URL and secret is added to the IdP's SCIM settings. ![](/tableau/next/en-us/online/en-us/Img/scim_config_secret.png) 4. Click **Close**. ### In Microsoft Entra 1. On the Provisioning page in your Entra portal, do the following: - For Provisioning Mode, select Automatic. - For Authentication Method, select Bearer Authentication. - For Tenant URL, copy and paste the Base URL shown in the Tableau Cloud SCIM settings. - For Secret Token, copy and paste the Tableau Cloud SCIM secret that was generated. ![A configuration screen with settings to provision Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/scim-azure-ad-configure-provisioning.png) 2. Click the Test Connection button to verify the credentials are working as expected, and then click Save. 3. In the Mappings section, verify that Provision Microsoft Entra ID Groups and Provision Microsoft Entra ID Users are enabled. ![A settings page to define how data should flow between Microsoft Entra ID and Tableau Cloud SCIM.](/tableau/next/en-us/online/en-us/Img/scim-azure-ad-mappings.png) 4. Select Provision Microsoft Entra ID Groups, and on the Attribute Mappings page, review the attributes synchronized from Entra ID to Tableau Cloud. To save any changes, click Save. ![Tableau Cloud SCIM attribute mappings to Microsoft Entra ID attribute.](/tableau/next/en-us/online/en-us/Img/scim-azure-ad-groups.png) 5. Select Provision Microsoft Entra ID Users, and on the Attribute Mapping page, review the attributes synchronized from Entra ID to Tableau Cloud. To save any changes, click Save. ![A table to show the attribute mappings that define synchronization.](/tableau/next/en-us/online/en-us/Img/scim-azure-ad-users.png) ## Step 3: Assign groups to the Tableau Cloud app Use the following steps to assign groups to the Tableau Cloud gallery app in Microsoft Entra ID. 1. From the application page, select Enterprise Apps > Users and groups. 2. Click Add user/group. 3. On the Add Assignment page, select a group and assign one of the following site roles: - _Creator_ - _SiteAdministratorCreator_ - _Explorer_ - _SiteAdministratorExplorer_ - _ExplorerCanPublish_ - _Viewer_ - _Unlicensed_ **Note:** You'll receive an error if you select a role that is not in the above list. For more information about site roles, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm). 4. Click Assign. ### Create groups for site roles A user can be a member of multiple groups in Entra ID , but they will only receive the most permissive site role in Tableau Cloud. For example, if a user is a member of two groups with site roles Viewer and Creator, Tableau will assign the Creator site role. To keep track of role assignments, we recommend creating role-specific groups in Entra ID, such as _“Tableau - Creator”_, _“Tableau - Explorer”_, etc. You can then use the groups to quickly provision new users for the correct role in Tableau Cloud. Site roles are listed below in order from most permissive to least permissive: - Site Administrator Creator - Site Administrator Explorer - Creator - Explorer (Can Publish) - Explorer - Viewer **Note:** Users and their attributes should be managed through Entra ID. Changes made within Tableau Cloud directly may result in unexpected behavior and overwritten values. ## Step 4: Provision groups After you have enabled SCIM support and assigned groups to the Tableau Cloud application in Entra ID, the next step is to provision users to your Tableau Cloud site. 1. On the Provisioning page, expand the Settings section, and define the groups you want to provision to Tableau Cloud in Scope. ![A settings menu to opt in to email notifications on failures and to establish the parameters for syncing users and groups.](/tableau/next/en-us/online/en-us/Img/scim-azure-ad-enable.png) **Note:** The Entra ID setting "Sync all users and groups" is not supported with Tableau Cloud. 2. Toggle Provisioning Status to On. 3. Click Save. Saving starts the initial synchronization of the groups defined in Scope. Synchronization occurs approximately every 40 minutes as long as the Entra ID provisioning service runs. To manually provision users outside of the schedule, select Provision on demand. For more information about on demand provisioning, see the Microsoft article [On-demand provisioning in Microsoft Entra ID](https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/provision-on-demand). After provisioning is complete, you should see the groups from Entra ID on the Site Users page in Tableau Cloud. ### Change user authentication in Tableau Cloud By default, provisioned users are assigned the authentication type you associated with SCIM. To change the authentication type for users, use the steps below. 1. In Tableau Cloud, select Users. 2. On the Site Users page, select the check boxes next to the users you want to assign an authentication type. 3. On the Actions menu, select Authentication. 4. In the Authentication dialog, select the preferred authentication type for the user. For more information about the different authentication types in Tableau Cloud, see [Authentication](https://help.tableau.com/v0.0/online/en-us/security_auth.htm). ## Notes for SCIM support with Azure Active Directory - You must add a separate Tableau Cloud app for each site you want to manage using SCIM. - When deprovisioning a user in the Tableau Cloud application in Azure AD or if a user is deleted from Azure AD entirely, the user is converted to an Unlicensed site role in Tableau Cloud. If the user owns any content, you must first reassign ownership of those content assets before you can manually delete the user in Tableau Cloud. - Beginning in February 2024 (Tableau 2023.3), the use of SCIM with [Grant License on Sign In](https://help.tableau.com/v0.0/online/en-us/grant_role.htm) (GLSI) is supported. GLSI requires the following: 1\. Manually enabling the option for a group and selecting the minimum site role for the users who are members of the group _directly_ in Tableau Cloud. It is not possible to set a group with the GLSI attribute in Azure AD, but you can set the attribute for the group you have provisioned from Azure AD in Tableau Cloud. 2\. The user must be provisioned as _unlicensed_ from the IdP. [Skip to main content](#main-content) # Configure SCIM with Okta You can configure user management through Okta, provision groups, and assign Tableau Cloud site roles. If you’re not yet familiar with Tableau site roles and the capabilities each allows, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm). Notes: - These steps reflect a third-party application and are subject to change without our knowledge. If the steps described here do not match the screens you see in your IdP account, you can use the general [SCIM](https://help.tableau.com/v0.0/online/en-us/scim_config_online.htm) topic along with the IdP’s documentation. - The configuration steps in the IdP may be in a different order than what you see in Tableau. ## Step 1: Perform prerequisites The SCIM functionality requires that you configure your site to support SAML, OIDC, or Google single sign-on (SSO). 1. If using SAML authentication, complete the following sections in [Configure SAML with Okta](https://help.tableau.com/v0.0/online/en-us/saml_config_okta.htm): - [Step 1: Get started](https://help.tableau.com/v0.0/online/en-us/saml_config_okta.htm#enable-saml-online-site) - [Step 3. Configure "Tableau Cloud application" in your IdP](https://help.tableau.com/v0.0/online/en-us/saml_config_okta.htm#add_cloud_to_okta) 2. If using OIDC authentication, complete [Configure Tableau Cloud or TCM for OpenID Connect](https://help.tableau.com/v0.0/online/en-us/openid_auth_server_config.htm). 3. After you finish the steps in these two sections, remain signed in to both the Okta administrator console and Tableau Cloud, with the following pages displayed: - In Tableau Cloud, the Settings > Authentication page. - In the Okta administrator console, Applications > Applications > Tableau Cloud > Provisioning. ## Step 2: Enable SCIM support Use the following steps to enable SCIM support with Okta. See also the [Notes for SCIM support with Okta](#okta-support-notes) section below. ### In Tableau Cloud 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. Do the following: 1. On the Authentication page, under System for Cross-domain Identity Management (SCIM), click the **New Configuration** button. 2. In the New SCIM Configuration dialog box, do the following: 1. Enter a name for the SCIM configuration. 2. Copy the Base URL to use in your IdP's SCIM settings. 3. From the Authentication drop-down, select the authentication configuration to associate with SCIM. 4. Click **Save**. **Note:** This populates the SCIM token section. ![A new SCIM configuration](/tableau/next/en-us/online/en-us/Img/scim_config_new.png) 3. Under SCIM token, do the following: 1. Click the New Secret button. 2. In the New Secret dialog box, click the New Secret button again. A newly generated secret will display. ![](/tableau/next/en-us/online/en-us/Img/scim_config_newsecret_newsecret.png) 3. Copy the secret and store it in a safe location. **Important:** - If you close the SCIM configuration before you can add the secret to your IdP's SCIM settings, you can edit SCIM configuration but will be required to click New Secret again to generate a new secret. - The secret is tied to the Tableau site administrator user who created the SCIM configuration. If that user’s site role changes or the user is no longer a member of the site, the secret becomes invalid. In this case, another site administrator can generate a new secret for the existing SCIM configuration and add it to the IdP's SCIM settings or create a new SCIM configuration ensuring the base URL and secret is added to the IdP's SCIM settings. ![](/tableau/next/en-us/online/en-us/Img/scim_config_secret.png) 4. Click **Close**. ### In Okta 1. In the Okta administrator console, do the following: 1. From the left pane, select Application > Application, click the Tableau Cloud app, and then click the Provisioning tab. 2. Click Enable API Integration button. 3. Select the Enable API integration check box and click Save. 4. Do the following: 1. For API Token, paste the Tableau Cloud SCIM secret token you copied in the previous step. 2. For Base URL, copy and paste the Base URL shown in the Tableau Cloud SCIM settings. 2. Click the Test API Credentials button to ensure the configuration was done correctly. If the configuration was done correctly, you see a "Tableau Cloud was verified successfully!" message. 3. When finished, click Save. ## Step 3: Assign groups to the Tableau Cloud app For user provisioning to Tableau, we recommend you manage users in groups for easier management in Tableau. In Okta, assign groups to the Tableau Cloud app so that the users can be provisioned to Tableau Cloud. More specifically, you need two distinct groups, a group assigned to the Assignment tab and a group assigned to the Push Group tab. The group in the Assignments tab is used to create users in Tableau Cloud. The group in the Push Group tab is used to create the group and manage group membership in Tableau Cloud. **Notes:** - Okta requires that you have a group in the Assignments tab and a group for the Push Group tab to prevent a race condition. For more information, see [App assignments and Group Push](https://help.okta.com/en-us/content/topics/users-groups-profiles/app-assignments-group-push.htm) and [About Group Push](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-about-group-push.htm)h in the Okta documentation. - The steps in this procedure assume you’ve already created at least two groups. For more information about creating groups in Okta, see [Create a group](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-groups-create.htm) in the Okta documentation. You can use the procedure below to add a group and assign the group to the Tableau Cloud app. 1. From the left pane, select Application > Application, click the Tableau Cloud app, and then click the Assignments tab. 2. Click on the Assign drop-down and select Assign to Groups. 3. Do the following: 1. Select the relevant group. 2. Select the site role you would like the users to be provisioned with to Tableau. The options are: - Unlicensed - Viewer - Explorer - Explorer (can publish) - Creator - Site Administrator Explorer - Site Administrator Creator 4. When finished, click Save and Go Back button. 5. Repeat steps 1-4 in the Push Group tab and then click the Done button. ## Step 4: Enable group provisioning Okta allows you to push existing groups and their memberships to Tableau Cloud. After a group is pushed, you can manage group membership in Okta to automatically update the corresponding group in Tableau Cloud. Before you follow these steps, we recommend your review [Group Push prerequisites](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-group-push-prerequisites.htm) and [About Group Push](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-about-group-push.htm) in the Okta documentation. **Important:** After enabling SCIM, users and their attributes should be managed through Okta. Changes made within Tableau Cloud directly may result in unexpected behavior and overwritten values. The following procedure continues where you left off in the previous section and assume you are signed in to the Okta administrator console. 1. From the left pane, select **Application** > Application, click the Tableau Cloud app, and then click the Push Groups tab. 2. Click the Push Groups button and then select one of the following options from the drop-down menu: - Find groups by name: Select this option to search groups by name. - Find groups by rule: Select this option to create a search rule that pushes any groups that match the rule. You can deactivate group push, unlink pushed groups, or push group membership immediately by clicking Active or Inactive in the Push Status column. To delete, deactivate, or activate multiple groups, click Bulk Edit. For more information, see [Enable Group Push](https://help.okta.com/en/prod/Content/Topics/users-groups-profiles/usgp-enable-group-push.htm) in the Okta documentation. 5. (Optional) If pushing multiple groups, click the Save & Add Another button, and repeat the previous step. 6. When finished, click Save. ## SCIM and grant license on sign in Beginning in February 2024 (Tableau 2023.3), you can use SCIM with [Grant License on Sign In](https://help.tableau.com/v0.0/online/en-us/grant_role.htm) (GLSI) with Okta. Using SCIM with GLSI for Okta requires the following: 1. In Okta, adding users to the groups in Tableau Cloud app’s Assignment and Push Group tabs. 2. In Tableau Cloud, enabling the GLSI option for the groups and selecting the minimum site role for the users who are members of the groups. **Note:** It’s not possible to set a group with the GLSI attribute in Okta. 3. Users to be provisioned as "Unlicensed" in Okta. ### Enable GLSI To set up and enable GLSI, see [Grant License on Sign In](https://help.tableau.com/v0.0/online/en-us/grant_role.htm). ### Remove SCIM users with GLSI You must first remove SCIM users from their GLSI-enabled groups in Okta before attempting to deactivate them in Okta. Deactivating users will set the users to the "Unlicensed" role in Tableau Cloud. However, users can't get the "Unlicensed" role in Tableau Cloud until they are no longer a member of any GLSI-enabled groups. 1. In Okta, remove the user from the GLSI-enabled group assigned to the Push Group tab first. 2. While still in Okta, deprovision the user by either removing them from the GLSI-enabled group assigned to the Assignments tab or deleting the user in Okta. After you do this, the user will be converted to “Unlicensed” in Tableau Cloud. Deprovisioning a user in Okta only causes the user to be converted to “Unlicensed” in Tableau Cloud and does not delete the user. **Notes:** - If you want to delete a user in Okta, see [Deactivate and delete user accounts](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-deactivate-user-account.htm) in the Okta documentation. - If you want to delete the SCIM user in Tableau Cloud (see [Delete SCIM users](#delete_scim_users), below), you manually delete the user from Tableau Cloud. If you encounter issues, see the [Error "User role was not updated to: Unlicensed (errorCode=10079)" When Attempting to Deprovision Users via SCIM](https://help.salesforce.com/s/articleView?id=002186630&type=1) knowledge article. #### About Tableau Cloud's "All Users" group If you’ve enabled the default “All Users” group with GLSI, you can’t deprovision the users in Okta and therefore unable to get the "Unlicensed" role for any of the users that belong to the GLSI-enabled group in Tableau Cloud. To remove SCIM users in the GLSI-enabled “All Users” group, you must manually delete the users from Tableau Cloud. **Note:** If users have content associated with them, you’ll need to reassign content ownership to other users before you can delete the users. ### Delete SCIM users Deleting SCIM users in Okta will only covert them to the "Unlicensed" role and will not delete them in Tableau Cloud. If you want to delete users, you must manually delete the users in Tableau Cloud. For more information about deleting users, see "Remove users from a site" in the [View, Manage, or Remove Users](https://help.tableau.com/v0.0/online/en-us/users_view.htm) topic. ## Notes for SCIM support with Okta - In the Okta user assignment settings, the values for User Name and Primary email must be identical. - You must add a separate Tableau Cloud Okta app for each site you want to manage using SCIM. - If you want to migrate a site, you will need to re-configure SCIM provisioning for the new site. - When provisioning new users, first name and last name attributes in Okta are not synced to Tableau Cloud. New users must set those fields when they sign in to Tableau Cloud for the first time. - When a user is unassigned from the Tableau Cloud app in Okta or the user is deactivated or deleted from Okta entirely, the user is converted to an "Unlicensed" site role in Tableau Cloud. If the user owns any content, you must first reassign ownership of those content assets before you can manually delete the user in Tableau Cloud. - You can set a user’s site role (such as Creator, Explorer, or Viewer) in Okta at either the user or the group level. We recommend assigning the site role at the group level. If the user is assigned a site role directly, it will override any group settings. - A user can be a member of many groups. Groups can have different site roles. If a user is assigned groups with different site roles, the user will receive the most permissive site role in Tableau Cloud. For example, if you choose Viewer and Creator, Tableau will assign the Creator site role. Site roles are listed below in order from most permissive to least permissive: - Site Administrator Creator - Site Administrator Explorer - Creator - Explorer (Can Publish) - Explorer - Viewer - You can update the site role attribute for a user in Okta and this change will propagate to Tableau Cloud. Other attributes, such as User Name and Primary email, cannot be updated. To change these attributes, remove the user, change the attribute, and then add the user again. - Beginning in February 2024 (Tableau 2023.3), the use of SCIM with [Grant License on Sign In](https://help.tableau.com/v0.0/online/en-us/grant_role.htm) (GLSI) is supported. For more information, see [SCIM and grant license on sign in](#glsi) above. [Skip to main content](#main-content) # Configure SCIM with OneLogin You can configure user management through OneLogin, provision groups, and assign Tableau Cloud site roles. If you’re not yet familiar with Tableau site roles and the capabilities each allows, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm). As you complete the following steps, it might help also to have the OneLogin documentation at hand. Start with [Introduction to User Provisioning](https://onelogin.service-now.com/support?id=kb_article&sys_id=92999903db109700d5505eea4b961934 "Opens OneLogin user provisioning Help in a separate browser tab") in the OneLogin documentation. **Notes:** - These steps reflect a third-party application and are subject to change without our knowledge. If the steps described here do not match the screens you see in your IdP account, you can use the general [SCIM](https://help.tableau.com/v0.0/online/en-us/scim_config_online.htm) topic along with the IdP’s documentation. - The configuration steps in the IdP may be in a different order than what you see in Tableau. ## Step 1: Perform prerequisites The SCIM functionality requires that you configure your site to support SAML, OIDC, or Google single sign-on (SSO). 1. If using SAML authentication, complete the following sections in [Configure SAML with OneLogin](https://help.tableau.com/v0.0/online/en-us/saml_config_onelogin.htm): - [Step 1: Get started](https://help.tableau.com/v0.0/online/en-us/saml_config_onelogin.htm#tol-get-metadata) - [Configure SAML with OneLogin](https://help.tableau.com/v0.0/online/en-us/saml_config_onelogin.htm#add-connector-onelogin) 2. If using OIDC authentication, complete [Configure Tableau Cloud or TCM for OpenID Connect](https://help.tableau.com/v0.0/online/en-us/openid_auth_server_config.htm). 3. After you finish the steps in these two sections, remain signed in to both the OneLogin portal and Tableau Cloud, with the following pages displayed: - In Tableau Cloud, the Settings > Authentication page. - In the OneLogin portal, the Configuration page. ## Step 2: Enable SCIM support Use the following steps to enable SCIM support with OneLogin. See also [Notes and limitations for SCIM support with OneLogin](#onelogin-support-notes) section below. **Note:** Remember to click Save in the upper right corner of the OneLogin portal after making configuration changes. ### In Tableau Cloud 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. Do the following: 1. On the Authentication page, under System for Cross-domain Identity Management (SCIM), click the **New Configuration** button. 2. In the New SCIM Configuration dialog box, do the following: 1. Enter a name for the SCIM configuration. 2. Copy the Base URL to use in your IdP's SCIM settings. 3. From the Authentication drop-down, select the authentication configuration to associate with SCIM. 4. Click **Save**. **Note:** This populates the SCIM token section. ![A new SCIM configuration](/tableau/next/en-us/online/en-us/Img/scim_config_new.png) 3. Under SCIM token, do the following: 1. Click the New Secret button. 2. In the New Secret dialog box, click the New Secret button again. A newly generated secret will display. ![](/tableau/next/en-us/online/en-us/Img/scim_config_newsecret_newsecret.png) 3. Copy the secret and store it in a safe location. **Important:** - If you close the SCIM configuration before you can add the secret to your IdP's SCIM settings, you can edit SCIM configuration but will be required to click New Secret again to generate a new secret. - The secret is tied to the Tableau site administrator user who created the SCIM configuration. If that user’s site role changes or the user is no longer a member of the site, the secret becomes invalid. In this case, another site administrator can generate a new secret for the existing SCIM configuration and add it to the IdP's SCIM settings or create a new SCIM configuration ensuring the base URL and secret is added to the IdP's SCIM settings. ![](/tableau/next/en-us/online/en-us/Img/scim_config_secret.png) 4. Click **Close**. ### In OneLogin 1. In the OneLogin portal, on the Configuration page, do the following: - For API Status, click Enable. - For SCIM Bearer Token, paste the Tableau Cloud SCIM secret token you copied earlier. - For SCIM Base URL, copy and paste the Base URL shown in the Tableau Cloud SCIM settings. ![Image of the OneLogin portal's Configuration page](/tableau/next/en-us/online/en-us/Img/scim-onelogin-portal-configure.png) 2. On the Provisioning page, do the following: - Select Enable provisioning. - Select Suspend for When users are deleted in OneLogin, or the user's app access is removed, perform the below action. ![Image of the OneLogin portal's Provisioning page set for Tableau Cloud](/tableau/next/en-us/online/en-us/Img/scim-onelogin-portal-provisioning.png) 3. Click Save. 4. (Optional) On the Parameters page, map SCIM Username to the Email attribute. If you don’t map SCIM Username to an attribute in email address format, you’ll have to manually populate this field for each user as part of the provisioning process. An error is displayed when provisioning users if the mapped value doesn’t contain the user email address. If you want to complete the steps for provisioning users and groups, stay signed in to the OneLogin portal and proceed to the next section. ## Step 3: Provision users and groups OneLogin gives you a number of ways by which you can assign user attributes such as groups or site roles. You can apply them at the Tableau Cloud app level, create mapping rules, or apply them manually to individual users. Before you begin, it's important to note the OneLogin concept of groups operates differently than the Tableau concept of groups. In OneLogin, groups function as security boundaries to apply specific security policies to users. Because of this, users can only belong to one group at a time. Additionally, OneLogin uses roles as a container for applications that different user cohorts can access. Once you assign users a role, you grant them access to all the applications included in the role. This is similar to the Tableau concept of groups. Users can have multiple roles in OneLogin, which can be mapped to a target application group, such as Tableau Cloud. **Note:** The following steps assume you are signed in to the OneLogin portal and Tableau Cloud app. These steps provide some Tableau-specific information that you can use with the OneLogin documentation for mapping group and site role attributes to users. ### Provision a user Use the following steps to provision individual users to Tableau Cloud through the OneLogin portal. 1. Go to the Users tab and select the user you want to provision. This opens the user settings page. 2. From the left navigation menu, select Applications. 3. On the Applications page, click the plus (+) icon to provision the user for your Tableau Cloud application, and then click Continue. 4. Enter the appropriate Tableau Cloud site role for the user in the Site Role field. For more information about site roles, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm). 5. Click Save. ### Provision multiple users with OneLogin roles You can provision multiple users to Tableau Cloud by assigning roles in OneLogin. Users can be added to roles manually or automatically using mappings. To add users to a role: 1. Go to Users > Roles, and select an existing role or create a New Role. For more information, see the OneLogin article [Roles](https://onelogin.service-now.com/support?id=kb_article&sys_id=ea03f767db889c54d5505eea4b961950&kb_category=fdf52dfcdbd45340d5505eea4b96192b). The following example shows the role “Sales” that we’ll use as a group in Tableau Cloud later on. ![Map login conditions by user.](/tableau/next/en-us/online/en-us/Img/scim-onelogin-role-example.png) 2. On the Applications page, assign the role access to the Tableau Cloud application. This should provision the associated users to the application automatically. 3. On the Users page, you can add users to a role manually by entering their first and last name, or add a mapping to automatically add users to a role based on specific attributes - such as their Active Directory group, for example. ![Map login conditions by role and department.](/tableau/next/en-us/online/en-us/Img/scim-onelogin-mapping-example.png) 4. After adding users to roles, we recommend you create rules within the application to assign the appropriate Tableau Cloud site role based on the OneLogin role. For more information, see the OneLogin article [Configure Apps](https://onelogin.service-now.com/support?id=kb_article&sys_id=9a6708241b7b38106a0b40c8cc4bcb4f&kb_category=e9866930db185340d5505eea4b9619b7). In the image below, users with the “Sales” role will be assigned the Creator site role in Tableau Cloud. Likewise, users with the “Marketing” role will be assigned the Viewer site role. ![SSO rule settings for Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/scim-onelogin-rules-example.png) ### Add users to existing Tableau Cloud groups Import Tableau Cloud groups into OneLogin and specify the groups you want to be selected by default in the user provisioning dialog. 1. On the Parameters page, click Groups, and select the Include in User Provisioning check box. 2. Go to the Provisioning page, and in the Entitlements section, click Refresh. This imports the groups from Tableau Cloud. 3. Go back to the Parameters page, and then select the groups that you want to show as selected values in the user provisioning dialog. ![A form for editing field groups.](/tableau/next/en-us/online/en-us/Img/scim-onelogin-group-provision.png) 4. To change group membership, go to the Users page, select a user, and in the Groups section, modify the available and selected values. You can also create mappings that put users into groups automatically, based on conditions you define. For more information, see the OneLogin article [Mappings](https://onelogin.service-now.com/support?id=kb_article&sys_id=95f649acdb285890d5505eea4b961904 "Link opens article in the OneLogin help center in a new browser tab."). ### Create groups in Tableau Cloud from OneLogin Use the following steps to create Tableau Cloud groups based on attributes in OneLogin mappings. For example, creating a group in Tableau Cloud based on user roles. 1. Go to Applications, select the Tableau Cloud application, and then Rules. 2. On the Rules page, click Add Rule to open the edit mapping window. 3. Under Actions, select Set Groups from the drop-down menu, and then select Map from OneLogin. The conditions field with value that matches uses regular expressions. If you want to create a group in Tableau Cloud that matches the role name in OneLogin, type `.*` in the text field. ![A form for editing the mapping of an application.](/tableau/next/en-us/online/en-us/Img/scim-onelogin-editmapping.png) ### Assign Tableau site roles By default, users are assigned the Viewer site role, which occupies a **Viewer** license type. Whatever method you use in OneLogin to assign site roles, at some point you need to enter the site role name into a text box. For the allowed values you can type, see [Valid Tableau site role values](#site-role-values-onelogin-provision) below. Here are some of the ways you can assign site roles For individual users: 1. On the Users page, select the user, and then navigate to the Applications tab. Select the corresponding Tableau Cloud application. 2. In the user settings, type the site role name in the Site Role text box. For a set of users: 1. On the Parameters page, click Site Role, and then, for Value, select one of the options for assigning the site role attribute For example: - If all users have the same site role, select Macro and enter the site role name. - If the OneLogin user directory contains the site role, select the corresponding attribute. 2. On the Rules page, create a rule that maps a role to a particular role in Tableau Cloud. When you’re done assigning the site role, click Save. ### Valid Tableau site role values On the Provisioning page in your OneLogin portal, the Site Role values you can enter are based on current or legacy license roles. - **Current license roles** include the following site role values: Creator, Explorer, ExplorerCanPublish, ReadOnly, ServerAdministrator, SiteAdministratorExplorer, SiteAdministratorCreator, Unlicensed, or Viewer. - **Legacy (pre-v2018.1) license types** come with the following site roles: Interactor, Publisher, ServerAdministrator, SiteAdministrator, Unlicensed, UnlicensedWithPublish, Viewer, or ViewerWithPublish To learn the effects of changing user attributes, or how to reset individual user attributes you changed manually, see the OneLogin article [Provisioning Attributes: the Effect of Defaults, Rules, and Manual Entry](https://onelogin.service-now.com/support?id=kb_article&sys_id=6ea91d03db109700d5505eea4b96199a "Opens the OneLogin Help article in a new browser tab"). ## Notes and limitations for SCIM support with OneLogin - You must add a separate Tableau Cloud app for each site you want to manage using SCIM. - When deprovisioning or removing an existing users from the Tableau Cloud application in OneLogin, the user is converted to an Unlicensed site role in Tableau Cloud in case they own any content assets. If the user does own content, you must first reassign ownership of those content assets before you can manually delete the user in Tableau Cloud. - Use of SCIM with [Grant License on Sign In](https://help.tableau.com/v0.0/online/en-us/grant_role.htm) is unsupported and may result in incorrectly provisioned site roles for users or groups. [Skip to main content](#main-content) # Configure SCIM with PingFederate You can configure user management, provision groups, and assign Tableau Cloud site roles through PingFederate. While you complete the steps described below, we recommend you have the PingFederate documentation available to you to accompany the procedures described below. **Important:** - These steps reflect a third-party application and are subject to change without our knowledge. If the steps described here do not match the screens you see in your IdP account, you can use the general [SCIM](https://help.tableau.com/v0.0/online/en-us/scim_config_online.htm) topic along with the IdP’s documentation. - The configuration steps in the IdP may be in a different order than what you see in Tableau. ## Step 1: Perform prerequisites To perform the procedures described in this document, you must have the following prerequisites met: - **SCIM Provisioner:** The SCIM Provisioner application installed and configured. For more information, see [SCIM Provisioner](https://docs.pingidentity.com/integrations/scim/pf_scim_connector.html) in the PingIdentity documentation. - **Ping data store:** A data store, like PingDirectory, configured. For more information, see [Configuring an LDAP connection](https://docs.pingidentity.com/pingfederate/12.3/administrators_reference_guide/help_datasourcetasklet_ldapconfigstate.html) in the PingIdentity documentation. - **SAML in Protocol Settings:** Configure protocol settings for SAML federation. ## Step 2: Start configuring SAML in Tableau Cloud The SCIM functionality in Tableau Cloud requires that you configure your site to support SAML single sign-on (SSO). You will return to and update this SAML configuration later on in this topic. 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. On the Authentication tab, click the New Configuration button, select SAML from the Authentication drop-down, and then enter a name for the configuration. ![Screen shot of Tableau Cloud site authentication settings -- new configuration page](/tableau/next/en-us/online/en-us/Img/saml_config_site3.png) **Note:** Configurations created before January 2025 (Tableau 2024.3) can't be renamed. 1. Skip 1\. Export metadata from IdP. You will revisit this step later on in this topic. 2. Under 2\. Upload metadata to Tableau, upload a placeholder .xml metadata file. You’ll replace this file with a valid .xml metadata file from PingFederate later on in this topic. 3. Click Save. ## Step 3: Enable SCIM support in Tableau Cloud Use the following steps to enable SCIM support in Tableau Cloud. You’ll use the information in this section to enable SCIM in PingFederate. 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. On the Authentication page, under System for Cross-domain Identity Management (SCIM), click the New Configuration button. 3. In the New SCIM Configuration dialog box, do the following: 1. Enter a name for the SCIM configuration. 2. Copy the Base URL to use in your IdP's SCIM settings. 3. From the Authentication drop-down, select the SAML authentication configuration to associate with SCIM. 4. Click Save. **Note:** This populates the SCIM token section. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_tableau_config.png) 4. Under SCIM token, do the following: 1. Click the New Secret button. 2. In the New Secret dialog box, click the New Secret button again. A newly generated secret will display. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_tableau_secret.png) 3. Copy the secret and store it in a safe location. We'll use the secret in step 4.2.1. **Important:** - If you close the SCIM configuration before you can add the secret to your IdP's SCIM settings, you can edit SCIM configuration but will be required to click New Secret again to generate a new secret. - The secret is tied to the Tableau site administrator user who created the SCIM configuration. If that user’s site role changes or the user is no longer a member of the site, the secret becomes invalid. In this case, another site administrator can generate a new secret for the existing SCIM configuration and add it to the IdP's SCIM settings or create a new SCIM configuration ensuring the base URL and secret is added to the IdP's SCIM settings. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_tableau_message.png) 4. Click Close. ## Step 4: Enable single sign-on (SSO) in PingFederate To enable SAML SSO in your PingFederate environment, you must do the following: 1. Create an IdP adapter instance 2. Configure an SP connection 3. Map attributes in your Ping data store 4. Configure SAML SSO **Important:** As a reminder, the steps and examples described here are for demonstration purposes only. ### Step 4.1: Create an IdP adapter instance Follow each of the sections below to create the [HTML Form Adapter](https://docs.pingidentity.com/pingfederate/latest/administrators_reference_guide/pf_html_form_adapt.html). PingFederate uses IdP adapters, such as the HTML Form Adapter, to authenticate users. An IdP adapter looks up session information and provides user identification to PingFederate. 1. Sign into the PingFederate administrative console. 2. Select **Authentication** > **IdP Adapters**. 3. On the IdP Adapters page, click **Create New Instance** button to start the Create Adapter Instance configuration. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_adapters_create_new_instance.png) #### Step 4.1.1: Create Adapter Instance (part 1) 1. On the Create Adapter Instance page, on the Type tab, do the following: 1. For INSTANCE NAME, enter a name. For example, "credentialsValidatoreInstance". 2. For INSTANCE ID, enter a value. For example, "3". 3. In the TYPE drop-down list, select HTML Form IdP Adapter. 4. Keep PARENT INSTANCE as-is (None). 5. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_cred_validator_create_new_instance.png) #### Step 4.1.2: Create Credentials Validator 1. On the IdP Adapter tab, do the following: 1. Scroll to the bottom of the page and click the Manage Password Credential Validators button. 2. On the Manage Password Credential Validators page, click the Create New Instance button. 2. On the Create Credentials Validator Instance page, on the Type tab, do the following: 1. For INSTANCE NAME, enter a name. For example, "credentialsValidatorInstance". 2. For INSTANCE ID, enter a value. For example, "3". 3. From the TYPE drop-down list, select LDAP Username Password Credential Validator. 4. Keep PARENT INSTANCE as-is (None). 5. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_cred_validator_type.png) 3. On the Instance Configuration tab, do the following: 1. From the LDAP DATASTORE drop-down, select Ping Directory data source that was previously configured. 2. In the SEARCH BASE field, enter the following: dc=example,dc=com. 3. In the SEARCH FILTER field, enter the following: mail=${username} 4. Keep the other settings as-is. 5. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_cred_validator_instance_config.png) 4. On the Summary tab, review the details and click the Save button. 5. Back on the Manage Password Credential Validators page, click the Done button. 6. Back on the Create Adapter Instance page, under the Password Credential Validator Instance section, do the following: 1. Click the Add a new row to \`Credential Validators\` link. 2. From the drop-down menu that displays, select the newly created validator instance you created. For example, "credentialsValidatorInstance". 3. Click the Update link. 4. Click the Next button. #### Step 4.1.3: Create Adapter Instance (part 2) 1. Back on the Extended Contract tab, do the following: 1. Under the Extended the Contract section, do the following: 1. In the text box, enter "sn" and click the Add button. 2. Click the Next button. 2. On the Adapter Attributes tab, do the following: 1. From the UNIQUE USER KEY ATTRIBUTE drop-down, select username. 2. For username, select the Pseudonym check box. 3. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_adpaters_adapter_attributes.png) 3. On the Adapter Contract Mapping tab, click the Configure Adapter Contract button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_adapters_contract_mapping_configure_adapter_contract.png) #### Step 4.1.4: Configure adapter contract mapping (part 1) 1. On the Adapter Sources & Users Lookup tab, click the Add Attribute Source button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_adapters_add_attribute_source.png) #### Step 4.1.5: Configure attribute sources & user lookup 1. On the Data Store tab, do the following: 1. For ATTRIBUTE SOURCE ID, enter a name. For example, "attributeSourceUserLookup". 2. For ATTRIBUTE SOURCE DESCRIPTION, enter a description. For example, "attributeSourceId". 3. From ACTIVE DATA STORE, select the Ping Directory data store that was previously configured. 4. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_adapters_lookup_data_store.png) 2. On the LDAP Directory Search tab, do the following: 1. For BASE DN, enter the following: dc=example,dc=com 2. Under the Attributes to return from search section, do the following: 1. In the ROOT OBJECT CLASS column, select Show All Attributes. 2. Under the Option column, in the text box, select givenName and then click the Add Attribute button. 3. In the text box, select sn and then click the Add Attribute button. 3. Click the Next button. 3. In the LDAP Filter tab, do the following: 1. In the FILTER text box, enter the following: mail=${username} 2. Click the Next button. 4. On the Summary tab, click the Save button ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_adapters_lookup_summary.png) #### Step 4.1.6: Configure adapter contract mapping (part 2) 1. On the Attribute Sources & User Lookup tab, select the newly created adapter contract you created. For example, "attributeSourceId". ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_adapters_contract_mapping_lookup.png) 2. On the Adapter Contract Fulfillment tab, do the following: 1. For givenName, from the Source drop-down list, select LDAP (attributeSourceId); from the Value drop-down list, select givenName. 2. For policy.action, from the Source drop-down list, leave as-is (Adapter). 3. For sn, from the Source drop-down, select LDAP (attributeSourceId); from the Value drop-down list, select sn. 4. For username, keep the value as-is (Adapter). 5. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_adapters_contract_mapping_fulfillment.png) 3. On the Issuance Criteria tab, click Next button. 4. On the Summary tab, review the details and click the Save button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_adapters_contract_mapping_summary.png) ### Step 4.2: Create an SP connection Follow each of the sections below to create an SP connection. PingFederate uses SP connections for IDP-initiated single sign-on (SSO). 1. From the PingFederate administrative console, navigate to Applications > SP Connections. 2. On the SP Connections page, click the Create Connection button. 3. On the Connection Template tab, keep the setting as-is (DO NOT USE A TEMPLATE FOR THIS CONNECTION) and click the Next button. 4. On the Connection Type tab, do the following: 1. Select the BROWSER SSO Profiles check box. 1. Under PROTOCOL drop-down list, keep the value as-is (SAML 2.0). 2. Select the OUTBOUND PROVISIONING check box. 3. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_connection_type.png) 5. On the Connection Options tab, click the Next button. 6. On the Import Metadata tab, keep the value as-is (NONE), and click the Next button. 7. On the General Info tab, do the following: 1. For PARTNERS ENTITY ID, enter the Tableau Cloud entity ID from the SAML configuration in Tableau Cloud that you started in Step 2. For example, "https://sso.online.tableau.com/public/sp/metadata/25db875a-cace-4769-8429-d7b210879ef2/36673dc4-e2c1-4970-976f-255bda6036cb". ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_tableau_cloud_metadata.png) 2. For CONNECTION NAME, enter a name. For example, "SCIM Connector". 3. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_general.png) 8. On the Outbound Provisioning tab, click the Configure Provisioning button. #### Step 4.2.1: Create Configure Channel 1. On the Target tab, do the following: 1. For SCIM URL, enter the Base URL from the SCIM configuration in Tableau Cloud that you created in Step 3. For example, "https://scim.online.tableau.com/pods/cd-main/sites/25db875a-cace-4769-8429-d7b210879ef2/scim/v2". 2. For SCIM VERSION, keep the value as-is (2.0). 3. From the AUTHENTICATION METHOD drop-down list, select OAUTH 2 BEARER TOKEN. 4. For ACCESS TOKEN, enter the SCIM token secret from the SCIM configuration in Tableau Cloud that you created in Step 3. 5. For UNIQUE USER IDENTIFIER, keep the value as-is (userName). 6. For RESULTS PER PAGE, enter the following value: 25. We recommend changing this value for better performance. 7. For PROVISIONING OPTIONS, ensure the following check boxes are selected: 1. USER CREATE 2. USER UPDATE 3. USER DISABLE /DELETE 4. PROVISION DISABLED USERS 8. For REMOVE USER ACTION, keep that value as-is (Disable). We recommend this option to change the user's role to Unlicensed in Tableau Cloud if they’re removed from PingFederate IdP. 9. For GROUP NAME SOURCE, do the following: 1. In the drop-down list, keep the value as-is (Common Name). 2. Select the USE PATCH FOR GROUP UPDATES check box. 10. For CUSTOM ATTRIBUTE SCHEMA URNS, enter the following value: urn:ietf:params:scim:schemas:extension:tableau:3.0:User,urn:ietf:params:scim:schemas:extension:tableau:3.0 11. Click the Next button. 2. In the Configure Channels page, on the Target tab, click the Create button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_channels_target.png) 3. In the Channel Info tab, for CHANNEL NAME, enter a name and click the Next button. 4. In the Source tab, do the following: 1. From the ACTIVE DATA STORE drop-down list, select the Ping data store. 2. From the TYPE drop-down list, select LDAP. 3. Click the Next button. 5. In the Source Settings tab, validate the following values: 1. For ENTRY GUID ATTRIBUTE, the value is entryUUID. 2. For GROUP MEMBER ATTRIBUTE, the value is uniqueMember. 3. For USER OBJECTCLASS, the value is inetOrgPerson. 4. For GROUP OBJECTCLASS, the value is groupOfUniqueNames. 5. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_channels_source_settings_top.png) ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_channels_source_settings_bottom.png) 6. In the Source Location tab, do the following: 1. For BASE DN, enter the following: dc=example,dc=com 2. Under the Users section, for FILTER, enter the following: objectClass=inetOrgPerson 3. Under the Groups section, for FILTER, enter the following: objectClass=groupOfUniqueNames 4. Click the Next button. 7. In the Attribute Mapping tab, do the following: 1. Edit the userName attribute to "mail" by doing the following: 1. In the userName row, click Edit. 2. Under the Root Object class, select . 3. From the Attributes drop-down list, select mail. 4. Click the Add Attribute button. 5. Next to the uuid attribute, click the Remove link. 2. Keep the remaining attributes as-is. 3. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_channels_attribute_mapping.png) 8. In the Activation & Summary tab, do the following: 1. For Channel Status, select Active. 2. Click the Save Draft button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_channels_summary_top.png) ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_channels_summary_bottom.png) ### Step 4.3: Map SCIM attributes to your Ping data store Follow the steps below to map the SCIM attributes in the Ping data store through the PingData administrative console. 1. Sign in to the PingData administrative console. 2. From the left navigation pane, navigate to LDAP Schema and click the Attribute Types tab. #### Step 4.3.1: Create new attribute types 1. Click the Actions button and select New Attribute Type. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_data_store_attribute_type.png) 2. In the New Attribute Type dialog box, do the following: 1. For Name, enter the following: siteRoles 2. For Description, enter a description. For example, "Custom attribute for site roles on Tableau Cloud." 3. Click Save. 3. Repeat the above step and do the following in the New Attribute Type dialog box: 1. For Name, enter the following: entitlements 2. For Description, enter a description. For example, "Custom attribute for entitlements on Tableau Cloud." 3. Click Save. #### Step 4.3.2: Create new object class 1. From the top of the page, click the Object Class tab, click the Actions button, and then select New Object Class. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_data_store_object_class.png) 2. In the New Object Class dialog box, do the following: 1. For Name, enter the following: Tableau. 2. For Description, enter a description. For example, "Add siteRoles attribute as entitlements". 3. From the Parent drop-down list, select inetOrgPerson. 4. From the Type drop-down list, select Structural. 5. Under the Attributes section, do the following: 1. For Required Attribute, find and select sn and click the Add item arrow button. 2. For Required Attributes, find and select cn and click the Add item arrow button. 3. For Required Attributes, find and select objectClass and click the Add item arrow button. 4. For Optional Attributes, find and select siteRoles and in the click the Add item arrow button. 5. For Optional Attributes, find and select entitlements and click the Add item arrow button. 6. Click Save. ### Step 4.4: Configure SAML Follow the procedure below to edit the SP connection that you created earlier to support SAML SSO. 1. In the PingFederate administrative console, at the top of the page, select Applications > SP Connections. 2. On the SP Connections page, do the following: 1. Click the connection name you created in Step 4.2. 2. Click the Connection tab. 3. On the Connection tab, keep the selections as-is and click the Next button. 4. On the Connections Options tab, keep the selection as-is (BROWSER SSO) and click the Next button. 5. On the Import Metadata tab, keep the selection as-is (NONE) and click the Next button. 6. On the General Info tab, do the following: 1. For PARTNERS ENTITY ID, replace the text with the Tableau Cloud entity ID from the SAML configuration in Tableau Cloud that you started in Step 2. For example, https://sso.online.tableau.com/public/sp/metadata/25db875a-cace-4769-8429-d7b210879ef2/36673dc4-e2c1-4970-976f-255bda6036cb. 2. (Optional) Update the CONNECTION NAME. 3. Click the Next button. 7. On the Browser SSO tab, click the Configure Browser SSO button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_broswer.png) 8. On the SAML Profiles tab, do the following: 1. Under the Single Sign-On (SSO) Profiles section, do the following: 1. Select IDP-INITIATED SSO check box. 2. Select SP-INITIATED SSO check box. 2. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_browser_SAML_profile.png) 9. On the Assertion Lifetime tab, keep the values as-is and click the Next button. 10. On the Assertion Creation tab, click Configure Assertion Creation button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_browser_assertion_creation.png) 11. On the Identity Mapping tab, keep the selection as-is (STANDARD) and click the Next button. 12. On the Attribute Contract tab, do the following: 1. Under Subject Name Format section, keep the value as-is (urn:oasis:names:tc:SAML:nameid-format:unspecified). 2. Under the Extend the Contract section, do the following: 1. In the text box, enter the following: FirstName 2. Under the Attribute Name Format, select urn:oasis:names:tc:SAML:2.0:attrname-format:basic. 3. Click the Add button. 4. In the text box, enter the following: LastName 5. Under the Attribute Name Format, select urn:oasis:names:tc:SAML:2.0:attrname-format:basic. 6. Click the Add button. 3. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_attr_contract.png) 13. On the Authentication Source Mapping tab, click Map New Adapter Instance button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_source_mapping.png) 14. On the IdP Adapter Mapping page, on the Adapter Instance tab, select the adapter you created in Step 4.1.1 and click the Next button. For example, "credentialsValidatorInstance". 15. On the Mapping Method tab, keep the value as-is (USE ONLY THE ADAPTER CONTRACT VALUES IN THE SAML ASSERTION) and click the Next button. 16. On the Attribute Contract Fulfillment tab, do the following: 1. Next to FirstName, do the following: 1. From the Source drop-down, select Adapter. 2. From the Value drop-down list, select givenName. 2. Next to LastName, do the following: 1. From the Source drop-down, select Adapter. 2. From the Value drop-down list, select sn. 3. Next to SAML\_SUBJECT, 1. From the Source drop-down, select Adapter. 2. From the Value drop-down list, select username. 4. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_fulfillment.png) 17. On the Issuance Criteria tab, click the Next button. 18. On the Summary tab, review the details and click the Done button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_idp_summary.png) 19. On the Assertion Creation tab, review the details and click the Done button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_auth_source.png) 20. On the Assertion Creation tab, click the Next button. 21. On the Protocol Settings page, click the Configure Protocol Settings button. 22. On the Protocol Settings page, on the Assertion Consumer Service URL tab, do the following: 1. Under Default, select the check box. 2. Under Binding, select POST. 3. Under Endpoint URL, enter the ACS URL from the SAML configuration in Tableau Cloud that you started in Step 2 and click the Add button. For example, "https://sso.online.tableau.com/public/sp/SSO/25db875a-cace-4769-8429-d7b210879ef2/36673dc4-e2c1-4970-976f-255bda6036cb". 4. Click the Next button. 23. On the Allowable SAML Bindings tab, do the following: 1. Ensure the POST and REDIRECT check boxes are selected and remove selections for the other check boxes. 2. Click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_browser_protocol_settings.png) 24. On the Signature Policy tab, click the Next button. 25. On the Encryption Policy tab, keep the selection as-is (None) and click the Next button. 26. On the Summary tab, review the details and click the Done button. 27. On the Browser SSO page, on the Protocol Settings tab, click the Next button. 28. On the Summary tab, review the details and click the Done button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_browser_summary_top.png) ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_browser_summary_bottom.png) 29. On the SP Connection page, on the General Info tab, click the Next button. 30. On the Configure Browser SSO tab, click the Next button. 31. On the Credentials tab, click the Configure Credentials button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_credentials.png) 32. On the Digital Signature Settings tab, do _one_ the following: - If you already have an existing, valid signing certificate, do the following: 1. From the SIGNING CERTIFICATE drop-down, select the existing certificate and click the Next button. 2. Skip to step 38. - If you don't have an existing, valid signing certificate, do the following: 1. Click the Manage Certificates button. 2. Continue to step 33. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_credentials_digital_sig_settings.png) 33. On the Certificate Management page, click the Create New button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_credentials_certificate_management.png) 34. On the Create Certificate page, on the Create Certificate tab, do the following: 1. For COMMON NAME, enter a name. For example, "PingFedCert". 2. For ORGANIZATION, enter a name. For example, "Tableau". 3. For COUNTRY, enter a country name. 4. Click the Next button. 35. On the Summary tab, ensure that MAKE THIS ACTIVE CERTIFICATE check box is selected, and click the Save button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_credentials_cert_manage_cert_summary.png) 36. On the Certificate Management page, click the Done button. 37. On the Credentials page, do the following: 1. From the SIGNING CERTIFICATE drop-down, select the newly created certificate. 2. Click the Next button. 38. On the Summary page, click the Done button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_sp_connections_sp_credentials_digital_sig_settings_summary.png) 39. On the SP Connection page, on the Outbound Provisioning tab, click the Next button. 40. On the Activation & Summary tab, review the details and click the Done button. ## Step 5: Export metadata from PingFederate To finish setting up SAML in Tableau Cloud, you'll need the SAML metadata file (.xml) from PingFederate to upload to Tableau Cloud. 1. On the PingFederate administrative console, select System > Protocol Metadata > Metadata Export. 2. On the Metadata Export page, on the Metadata Role tab, keep the selection as-is (I AM THE IDENTITY PROVIDER (IDP)) and click the Next button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_metadata_export_role.png) 3. On the Metadata Mode tab, keep the selection as-is (USE A CONNECTION FOR METADATA GENERATION) and click the Next button. 4. On the Connection Metadata tab, from the drop-down, select the SP Connection that you created in Step 4.2, and click the Next button. 5. On the Metadata Signing tab, from the SIGNING CERTIFICATE drop-down list, select the certificate you created in Step 4.4, and then click the Next button. 6. On the Export & Summary tab, click the Export button to download the PingFederate metadata file, and then click the Done button. ![](/tableau/next/en-us/online/en-us/Img/pingfed_scim_metadata_summary.png) ## Step 6: Finish configuring SAML in Tableau Cloud The following steps need to be performed in Tableau Cloud. 1. Back in Tableau Cloud, on the New Configuration page, under 2\. Upload metadata to Tableau, click the Choose a file button and navigate to the SAML metadata file you saved from PingFederate in Step 5. This automatically fills the IdP entity ID and SSO Service URL values. 2. Map the attribute names (assertions) under 3\. Map attributes to the corresponding attribute names in PingFederate. 3. Under 4\. Choose default for embedding views (optional), select the experience you want to enable when users access embedded content. For more information, see the [About enabling iFrame embedding](#enable-iframe-embedding) section below. 4. Click the Save and Continue button. ## About enabling iFrame embedding **Note:** Applies to Tableau Cloud only. When you enable SAML on your site, you need to specify how users sign in to access views embedded in web pages. These steps configure Okta to allow authentication using an inline frame (iFrame) for embedded visualization. Inline frame embedding may provide a more seamless user experience when signing on to view embedded visualizations. For example, if a user is already authenticated with your identity provider and iFrame embedding is enabled, the user would seamlessly authenticate with Tableau Cloud when browsing to pages that contain embedded visualizations. **Caution:** Inline frames can be vulnerable to a clickjack attack. _Clickjacking_ is a type of attack against web pages in which the attacker tries to lure users into clicking or entering content by displaying the page to attack in a transparent layer over an unrelated page. In the context of Tableau Cloud, an attacker might try to use a clickjack attack to capture user credentials or to get an authenticated user to change settings. For more information about clickjack attacks, see [Clickjacking](https://www.owasp.org/index.php/Clickjacking) on the Open Web Application Security Project website. ## Notes for SCIM support with PingFederate - Due to limitations in PingFederate, a siteRole update on a group will not initiate siteRole updates on the users within that group. This could result in a stale siteRole attribute assignment. To work around this issue, you can use a non-custom attribute update alongside the siteRole attribute update to initiate the siteRole update. This can be done manually or automatically using one of the following options: - Manage siteRoles only on the user object. - After a group update, manually update any of the attributes for that user. It doesn't have to be a SCIM supported attribute like the site role. It can be a description or name attribute. - Set up an OGNL expression in PingFederate and perform group membership updates before the Ping Server has started. After you start Ping Server, it will trigger a siteRole attribute update. - Set up an OGNL expression in PingFederate. Additionally, set up an inverted static group and cron job to trigger siteRole updates. - An OGNL expression in PingFederate will evaluate the attributes across the user and their group membership to determine their siteRole. [Skip to main content](#main-content) # Configure Settings for a Tableau Data Story **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). After you [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm), you can configure and edit your Tableau Data Story so it's tailored to your needs–use language specific to your data, specify which analytics are written about, and customize how your Tableau Data Story is displayed. ## Other articles in this section [Skip to main content](#main-content) # Configure Tableau for Snowflake Key-pair Authentication To publish workbooks or flows using Snowflake data sources protected with Key-pair authentication from Tableau Desktop or Tableau Prep to a Tableau Cloud or Tableau Server site, you must also configure that site to support those credentials. This involves adding your new or updated authentication details for Snowflake Key-pair authentication to the Saved Credentials section of your Account Settings. **Notes** - To support using Key-pair authentication to connect to Snowflake, you must install an ODBC driver from Snowflake that is version 3.4.0 or newer. - You need to use OpenSSL version 3.x or newer to create the keys for this authentication. - Each instance of Tableau Desktop that uses Snowflake data protected by Key-pair authentication will require the user to provide the key file as part of connecting to data. For more information, see [Snowflake](https://help.tableau.com/current/pro/desktop/en-us/examples_snowflake.htm). - Workbooks, data sources, and Prep flows that contain key-pair authentication must be published to Tableau Cloud or Tableau Server from Tableau Desktop or Tableau Prep Builder. - Key-pair authentication is currently unsupported for the following: - Workbook or data source web authoring, including editing existing published workbooks or data sources on the web - Prep web authoring, including editing existing Prep flows on the web - Virtual Connections (VConns) ## Add Key-pair Authentication Details 1. Sign in to Tableau Cloud or Tableau Server and navigate to your My Account Settings page. 2. Locate Saved Credentials for Data Sources in the Security section. 3. Next to Snowflake, click Add. 4. In the Add a New Saved Credential window, select Key-pair Authentication, and then click Add. 5. In the Add Key-pair Authentication Credential window, enter your Snowflake server, Role (optional), and Username associated with these credentials. Note: Role and Username are case sensitive and must match what is saved on Tableau Cloud or Tableau Server under My Account Settings > Snowflake key pair information. 6. For Private Key File, click Choose a file and select the .p8 file that contains your private key. 7. (Optional) If the key has a password or passphrase associated with it, enter it in the Password field, and then click Add. You are now ready to share workbooks and flows protected by Key-pair authentication from Tableau Desktop or Tableau Prep Builder to your site. ## See also - [Snowflake](https://help.tableau.com/current/pro/desktop/en-us/examples_snowflake.htm) - Learn how to set up a connection to Snowflake to retrieve and analyze data. [Skip to main content](#main-content) # Configure Tableau Cloud or TCM for OpenID Connect This topic describes how to configure Tableau Cloud or Tableau Cloud Manager (TCM) to use OpenID Connect (OIDC) for single-sign on (SSO). This is one step in a multi-step process. The following topics provide information about configuring and using OIDC with Tableau Cloud or TCM. 1. [OpenID Connect](https://help.tableau.com/v0.0/online/en-us/openid_auth.htm) Overview 2. [Configure the Identity Provider for OpenID Connect](https://help.tableau.com/v0.0/online/en-us/openid_auth_idp_config.htm) 3. Configure Tableau Cloud or TCM for OpenID Connect (you are here) **Notes:** - Before you perform the steps described here, you must configure the OpenID provider as described in [Configure the Identity Provider for OpenID Connect](https://help.tableau.com/v0.0/online/en-us/openid_auth_idp_config.htm). Separate setup and app integration is required to enable OIDC authentication for Tableau Cloud and TCM. - Alternatively, you can configure OIDC authentication for Tableau Cloud using the Tableau REST API using the [OpenID Connect methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_openid_connect.htm). **Note:** Applies to Tableau Cloud only. - For Tableau Cloud, the Tableau REST API and tabcmd do not support OIDC single-sign (SSO). To use [tabcmd](https://help.tableau.com/v0.0/online/en-us/tabcmd.htm) or the [Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/help.htm "Opens REST API help in a new tab"), users must sign in to Tableau Cloud using a personal access token (PAT). - For TCM, the Tableau Cloud Manager REST API does not support OIDC SSO. To use the [TCM REST API](https://help.tableau.com/current/api/cloud-manager/en-us/index.html "Opens the TCM REST API Help in a new tab"), users must sign in to TCM using a PAT. ## Requirements ### Parameters - **Client ID:** This value is issued by the IdP and specifies an identifier for the registered Tableau Cloud or TCM. This enables the IdP to know where the authentication request is coming from. - **Client secret:** This is a token that is used by Tableau Cloud or TCM to verify the authenticity of the response from the IdP. This value should be kept securely. - **Configuration URL:** This value specifies the URL that the IdP redirects to after the user has authenticated. The URL must include the host and protocol (for example, `https://admin.okta.com/oauth2/default/.well-known/openid-configuration`), but Tableau provides the URL endpoint. This URL specifies the location of the provider configuration discovery document that contains the OpenID provider metadata. **Note:** If your IdP does not provide a configuration URL, use a URL that ends with `.well-known/openid-configuration`. For Tableau Cloud, consider using the [OpenID Connect Authentication Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_openid_connect.htm) in the Tableau REST API to configure OIDC. #### Optional parameters **Note:** Applies to Tableau Cloud only. The following optional parameters can be configured using the [OpenID Connect Authentication Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_openid_connect.htm) in the Tableau REST API. - **Prompt:** Prompts the user for re-authentication and consent. By default, user consent is turned on. - **Custom scope:** Custom scope user-related value to query the IdP. - **Client authentication:** Token endpoint authentication method. Default value is `'client_secret_basic'`. The value `'client_secret_post'` is supported. - **Essential ACR values:** List of essential Authentication Context Reference Class values used for authentication. - **Voluntary ACR values:** List of voluntary Authentication Context Reference Class values used for authentication. ### Claims To sign in successfully to Tableau Cloud or TCM, a given user must be provisioned in OpenID Connect (OIDC) IdP and then mapped to a user account on Tableau Cloud or TCM. OIDC uses a method that relies on claims to share user account attributes with other applications. Tableau Cloud or TCM relies on the IdP claim to map user accounts from the IdP to those hosted on Tableau Cloud or TCM. Claims include user account attributes such as email, given name, etc. To understand how Tableau Cloud or TCM maps IdP claims to user accounts, see [Authentication overview](https://help.tableau.com/v0.0/online/en-us/openid_auth.htm#overview). **Note:** Claims are case sensitive. - **Username:** By default, Tableau expects the IdP to pass the username claim. Depending on your IdP, you may need to configure Tableau Cloud to use a different IdP claim. **Note:** The username in Tableau is immutable and cannot be updated at any time. - **Name claim:** You can specify name or given and family name to retrieve DisplayName for the user. - **Email claim:** Optionally, beginning in July 2025, you can specify an email address that is different from the username. The email address claim is used for notifications purposes only and not used for sign-in. ## Enable OIDC single sign-on ### Step 1: Configure OpenID Connect **For Tableau Cloud** 1. Sign in to Tableau Cloud as a site admin and select Settings > Authentication. 2. On the Authentication tab, click the New Configuration button, select OpenID Connect (OIDC), and enter a name for the configuration. 3. Follow the steps to configure Tableau Cloud for OIDC authentication by doing the following: 1. In step 1, enter the required information from your IdP, including client ID, client secret, and configuration URL. 2. In step 2, copy the Tableau Cloud redirect URL that you will paste into your IdP's portal to redirect users after they authenticate. 3. In step 3, enter the claims to ensure the correct mapping of users' username and display name. 4. In step 4, optionally enable single logout (SLO) if your IdP supports it. 5. In step 5, optionally choose how users authenticate when accessing embedded view: in a separate pop-up window or using an inline iFrame. **Note:** You can select the authentication type for embedded views under the Default Authentication Type for Embedded Views section on the Authentication page (below the OIDC configuration steps). 4. When finished, click the Save Changes button. **Note:** When editing the OIDC configuration, the client secret is hidden and needs to be reentered before any changes can be saved. **For TCM** 1. Sign in to TCM as a cloud admin and select Settings > Authentication. 2. On the Authentication tab, select the Enable an additional authentication method check box. 3. Select OpenID Connect (OIDC) from the drop-down menu and click the Configuration (required) drop-down arrow. 4. Follow the steps to configure TCM for OIDC authentication by doing the following: 1. In step 1, enter the required information from your IdP, including client ID, client secret, and configuration URL. 2. In step 2, copy the TCM redirect URL that you will paste into your IdP's portal to redirect users after they authenticate. 3. In step 3, enter the claims to ensure the correct mapping of users' username and display name. 4. In step 4, optionally enable single logout (SLO) if your IdP supports it. 5. When finished, click the Save Changes button. **Note:** When editing the OIDC configuration, the client secret is hidden and needs to be reentered before any changes can be saved. ### Step 2: Test the configuration We highly recommend you test the configuration to avoid any locked out scenarios. Testing the configuration helps ensure that you have configured OIDC correctly before changing the authentication type of your users to OIDC. To test the configuration successfully, make sure that there is at least one user who you can sign in as who is already provisioned in the IdP and added to Tableau Cloud or TCM with OIDC authentication type configured. **Note:** If you’re not sure what the claims are, complete the configuration and test the configuration. Testing the configuration will produce a new window with the claim mappings details, including the username and display name claims. Some IdPs may map email address to the Tableau username. **For Tableau Cloud** 1. On the Authentication tab while OpenID Connect (OIDC) is selected, under step 6, click the Test Configuration button. A new window displays with details about the configuration. 2. When finished, complete the OIDC setup by adding users to your site by following the step below. **For TCM** 1. On the Authentication tab while OpenID Connect (OIDC) is selected, under step 5, click the Test Configuration button. A new window displays with details about the configuration. 2. When finished, complete the OIDC setup by adding users to your tenant by following the step below. ### Step 3: Add users to the OpenID Connect-enabled Tableau site or TCM The steps described in this section are performed on the Tableau Cloud’s or TCM's Users page. 1. After you complete the steps above, return to your Tableau Cloud site or TCM. 2. From the left pane, select the Users page. 3. Follow the procedure described in one of the following topics: - For Tableau Cloud, see [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) - For TCM, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) ### Troubleshoot Use the following sections to troubleshoot OpenID Connect (OIDC) issues in Tableau Cloud or TCM. OIDC protocol is supported by many identity providers. The OIDC protocol is an open and flexible standard, and as such, not all implementations of the standard are identical. Most issues that administrators encounter when configuring Tableau Cloud or TCM for OIDC are the result of how different identity providers implement OIDC. If you encounter errors as you set up OIDC with Tableau, we recommend that you work with your IdP to resolve them. #### Signing in from the command line **For Tableau Cloud** Even if Tableau Cloud is configured to use OIDC, OIDC authentication isn’t used when you sign in to Tableau Cloud using [tabcmd](https://help.tableau.com/v0.0/online/en-us/tabcmd.htm), the [Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/help.htm), or the [Tableau Data Extract command line utility](https://help.tableau.com/current/pro/online/en-us/help.htm) (provided with Tableau Desktop). **For TCM** Similarly, even if TCM is configured to use OIDC, OIDC authentication isn’t used when you sign in [to Tableau Cloud Manager REST API](https://help.tableau.com/current/api/cloud-manager/en-us/index.html "Opens TCM REST API Help in a new tab"). #### Sign-in failed In some cases, sign-in to Tableau Cloud or TCM can fail with the following message: _Login failure: Identity Provider authentication unsuccessful for user . Failed to find the user in Tableau Cloud._ This error typically means that there’s a mismatch between a username stored in Tableau and the username provided by the IdP. To resolve this, make sure the username values match. For example, if Jane Smith's username is stored in the IdP as "jsmith@example.com" it must be stored in Tableau Cloud or TCM as "jsmith@example.com" as well. ## Customize and control data access using user attributes User attributes are user metadata defined by your organization. User attributes can be used to determine access in a typical attribute-based access control (ABAC) authorization model. User attributes can be any aspect of the user profile, including job roles, departmental membership, management level, etc. They might also be associated with run-time user contexts like where the user is signed in or their language preference. By including user attributes in your workflow, you can control and customize the user experience through data access and personalization. - **Data access**: User attributes can be used to enforce data security policies. This ensures that users only see the information they are authorized to see. - **Personalization**: By passing user attributes like location and role, your content can be customized to display only the information relevant to the user accessing it, making it easier for them to find the information they need. **Summary of steps to pass user attributes** The process of enabling user attributes in a workflow is summarized in the following steps: 1. Enable the user attributes setting 2. Include user attributes in the assertion 3. Ensure the content author includes user attribute functions and relevant filters 4. Review the content ### Step 1: Enable the user attributes setting For security purposes, user attributes are only validated in an authentication workflow when the user attribute setting is enabled by a site admin. 1. Sign in to Tableau Cloud and click Settings > Authentication. 2. Under Control User Access in Authentication Workflows heading, select the Enable capture of user attributes in authentication workflows checkbox. For more information about site settings, see [Control User Access in Authentication Workflows](https://help.tableau.com/v0.0/online/en-us/sites_add.htm#user-attributes). ### Step 2: Include user attribute in the assertion Make sure the assertion contains the user attributes. **Note:** Attributes in the SAML response are subject to 4096 character limit, with the exception of `scope` or `scp` attributes. If the attributes in the response, including user attributes, exceed this limit, Tableau removes the attributes and passes the `ExtraAttributesRemoved` attribute instead. The content author can then create a calculation with the `ExtraAttributesRemoved` attribute to determine how to display the content to users when the attribute has been detected. **Example** Suppose you have an employee, Fred Suzuki, who is a manager located in the South region. You want to ensure that, when Fred reviews reports, he is only able to see data for the South region. In a scenario like this, you might include the Region user attribute in the SAML response like in the example below. https://myidp.okta.com/saml South ### Step 3: Ensure the content author includes attribute functions Ensure the content author includes the user attribute functions and related filters to control what data can display in their content. To ensure the user attribute assertions are passed to Tableau, the content must contain one of the following user attribute functions: - `USERATTRIBUTE('attribute_name')` - `USERATTRIBUTEINCLUDES('attribute_name', 'expected_value')` The function that the content author uses depends on whether the user attributes are expected to return a single value or multiple values. For more information about these functions and examples of each, see [User Functions](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_user.htm#user_attributes) in the Tableau Help. **Notes:** - Preview of the content with these functions are not available when authoring in Tableau Desktop or in Tableau Cloud. The function will return NULL or FALSE. To ensure the user functions work as expected, we recommend the author review the functions after making the content available. - To ensure content renders as expected, the content author might consider including a calculation that uses the `ExtraAttributesRemoved` that 1) checks for this attribute and 2) determines what to do with the content if it does, such as show a message. Tableau will only add the `ExtraAttributesRemoved` attribute and removes all other attributes (except `scp` or `scope`) when the attributes in the SAML XML exceed 4096 characters. This is to ensure optimal performance and to respect storage limitations. **Example** Continuing the example introduced in [Step 2: Include user attribute in the assertion](#step_pass_user_attribute) above, to pass the “Region” user attribute assertion to a workbook, the author can include `USERATTRIBUTEINCLUDES`. For example, `USERATTRIBUTEINCLUDES('Region', [Region])`, where ‘Region’ is the user attribute and \[Region\] is a column in the data. Using the new calculation, the author can create a table with Manager and Sales data. When the calculation is added, the workbook returns “False” values as expected. ![](/tableau/next/en-us/online/en-us/Img/uaf_calc_view.png) To show only the data associated with the South region in the embedded workbook, the author can create a filter and customize it to show values when the South region is “True.” When the filter is applied, the workbook becomes blank as expected because the function is returning “False” values and the filter is customized to show “True” values only. ![](/tableau/next/en-us/online/en-us/Img/uaf_filter_view.png) ### Step 4: Review the content Review and validate the content. **Example** To conclude the example from [Step 3: Ensure the content author includes attribute functions](#step_include_uaf) above, you can see the Sales data in the view is customized to Fred Suzuki because his user context is the South region. ![](/tableau/next/en-us/online/en-us/Img/uaf_embedded_view_south.png) Managers from the regions represented in the workbook should see the value associated with their region. For example, Sawdie Pawthorne from the West region sees data specific to her region. ![](/tableau/next/en-us/online/en-us/Img/uaf_embedded_view_west.png) Managers whose regions are not represented in the workbook see a blank workbook. ### Known issues and limitations There are a few known issues and limitations you should consider when working with user attribute functions. #### Blank images using the Tableau REST API Tableau REST API requests [Query Preview Image](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_workbooks_and_views.htm#query_view_with_preview), [Query Workbook Image](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_workbooks_and_views.htm#query_workbook_preview_image), and [Get Custom View Image](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_workbooks_and_views.htm#get_custom_view_image) produce blank images. #### Limitations - User attribute functions in published data sources (.pds) are not supported. - User attribute functions in Tableau Bridge workflows are not supported. [Skip to main content](#main-content) # Configure Tableau Data Story Settings: Analytics **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). Within your Tableau Data Story, you can choose which analytics to write about and when those analytics are written about. Different types of analytics are available depending on your story type and how many dimensions and measures your story has. However, analytics aren't currently supported for scatter plot story types. For more information, see [Choose the Right Story Type for Your Tableau Desktop Data Story](https://help.tableau.com/v0.0/online/en-us/data_stories_story_types.htm). ## Configure analytics for your story 1. [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm). 2. From your dashboard, click the Settings icon at the top-left corner of your Data Story object. 3. In the Data Story dialog box, click the Analytics tab. 4. Click the switches to turn on different types of analytics. 5. For Segments and Trend line, expand Settings to set thresholds for performing those analytics. 6. Click Save. ## Understand different types of analytics ### Correlation Use Correlation to identify true statistical correlations between two series. If you have more than two series, then all combinations are analyzed for correlations. For example, you might turn on Correlation to identify when two products are often purchased together. ### Clustering Use Clustering to identify distinct groups of data points (clusters) using a single statistical analysis. For example, you might turn on Clustering to identify when a product is very popular in a specific geographic region. ### Distribution Use Distribution to rank data points relative to each other using nonstatistical observations, such as mean, median, skew, etc. For example, you might turn on Distribution to identify which product has the highest profit ratio. ### Segments Use Segments to highlight noteworthy changes to data points within a series. First, set the minimum percentage of change that you want to be written about in a segment. Changes that fall below your defined threshold aren't written about. For example, if you set your segment threshold for changes that are greater than 60%, then your story doesn't write about a trough in a time series that features a 30% decrease. After you've set your threshold, choose whether to Apply formatting, and set the minimum percentage of change that you want formatted. ### Trend line Use Trend line to calculate a linear best fit line and identify data that falls within a defined percentage of confidence. Data that has high variability has a lower confidence level than data that's more consistent, and that confidence level affects whether trend lines are written about. You can use trend lines for stories that have one dimension and one measure, or you can use trend lines in a drilldown. For more information about drilldowns, see [Configure Tableau Data Story Settings: Narrative](https://help.tableau.com/v0.0/online/en-us/data_stories_narrative.htm). Set the minimum percentage of confidence for your trend line. If you set your threshold at 95%, but a trend line could be drawn at 90% confidence, then your story doesn't write about trend lines. After you've set your threshold, choose whether to Apply formatting. Then set the minimum percentage of change that you want formatted. Tableau Data Stories about trend lines communicate the absolute change over a period. The story written about your trend line varies depending on the level of verbosity you set for your story. If your story uses high verbosity, then your story writes about the R-squared value, which is a statistical concept that quantifies how well your data fits the trend line. For more information about verbosity settings, see [Configure Tableau Data Story Settings: Narrative](https://help.tableau.com/v0.0/online/en-us/data_stories_narrative.htm). Within the Trend line settings, you can also choose how many periods into the future for which you want your story to write predictions. When you use predictions, your story uses the slope and intercept of the trend line to calculate predicted values for future periods. The confidence of the prediction adds upper and lower bounds to the confidence threshold you set for trend lines. You can use predictions when your story has at least 30 data points that are linear. ### Volatility Use Volatility to analyze standard deviations over time. For example, use Volatility when you want your story to write about values that fall outside the average range for your data. ## Break down how analytics are used to generate stories At this point, you might be wondering how the analytics for different story types work. Let's take a look at an example for each story type and break down each sentence in the story. ### Understand analytics for discrete stories Because continuous stories measure trends over time, Data Stories writes about performance, progression, averages, totals, streaks, volatility, segments, and predictions. The following example of a continuous story is about sales per month: ![An example story with text insights about sales per month. The text in this image is transcribed in the following table.](/tableau/next/en-us/online/en-us/Img/data_stories_continuous_analytics.png)

Example story	Story breakdown
Average Sales was $47,858 across all 48 months. The minimum value was $4,520 (February 2014) and the maximum was $118,448 (November 2017).	The first two sentences use average and range functions to write about the average, maximum, and minimum values across the period you're analyzing.
Sales increased by 489% over the course of the series but ended with a downward trend, decreasing in the final month.	The third sentence is about overall performance of the measure over the period. For example, a sentence can be about whether sales increased, decreased, or trended differently during a specific period.
The largest single increase on a percentage basis occurred in March 2014 (+1,132%). However, the largest single increase on an absolute basis occurred in September 2014 (+$53,868).	The fourth sentence uses progression analysis. This sentence writes about the largest increase and decrease based on the measure during the period using both a percentage basis and absolute basis.
Of the three series, the strongest relationship was between Corporate and Home Office, which had a moderate positive correlation, suggesting that as one (Corporate) increases, the other (Home Office) generally does too, or vice versa.	This sentence is a Correlation insight. This type of analytic insight writes about notable correlations between different series in your data.
Sales experienced cyclicality, repeating each cycle about every 12 months. There was also a pattern of smaller cycles that repeated about every three months. Sales had a significant positive peak between October 2014 ($31,453) and February 2015 ($11,951), rising to $78,629 in November 2014.	This sentence is a Segment insight. This type of analytic insight writes about noteworthy increases and decreases over time.
The overall linear trend of the series rose at $902 per month for an absolute change of $42,394 over the course of the series. If this trend continued for the next one month, Sales is predicted to be about $69,958.	This sentence is a Trend line insight. This type of insight writes about how well trends fit your data with a certain percentage of confidence, and trend lines allow you to make predictions based on historic trends.

### Understand analytics for discrete stories Because discrete stories allow you to compare values and understand the distribution of the data, the story writes about distribution, averages, totals, and groupings or clusters across the data. The following example of a discrete story is about sales by product: ![An example story with text insights about sales by product. The text in this image is transcribed in the following table.](/tableau/next/en-us/online/en-us/Img/data_stories_discrete_analytics.png)

Example story	Story breakdown
Total Sales is $2.3 million across all 17 products.	The first sentence calculates the total value of your measure.
The Sales of $2.3 million was driven by Phones with $330,007, Chairs with $328,449, and Storage with $223,844.	The second sentence writes about the dimension drivers. In this example, the dimension drivers are the products that contributed the most to total sales.
The distribution is positively skewed as the average of $135,129 is greater than the median of $114,880. Sales is relatively concentrated with 78% of the total represented by eight of the 17 products (47%).	The third and fourth sentences analyze the distribution of the data. This analyzes the averages, medians, concentration of data (if any exist), and how the data is skewed. This helps identify how balanced these grouped variables are compared to one another.
The top two products combine for over a quarter (29%) of overall Sales.	This sentence uses Clustering to write about measures that can be grouped. This helps identify whether there are distinct groups that stand out in the data.
Phones ($330,007) is more than two times bigger than the average across the 17 products.	The final sentence writes about notable outliers.

### Understand analytics for scatter plot stories Scatter plot story types are best used to understand the relationship between two measures, and for that reason, scatter plot stories require 2–3 measures. The scatter plot analysis writes about the relationship (regression) between two measures, and it writes about groups (clusters) within the data, if they exist. The following example of a scatter plot story is about profit and sales across a dimension: ![An example story with text insights about profit and sales. The text in this image is transcribed in the following table.](/tableau/next/en-us/online/en-us/Img/data_stories_scatter_analytics.png)

Example story	Story breakdown
As quantity increased and profit increased, sales increased based on the data provided. Specifically, when quantity increased by 1, sales increased $49.55, and when profit increased by $1.00, sales increased $1.20. Few customers deviated from this general relationship, indicating a good fit.	The first two sentences are powered by regression analytics. Regression shows how one measure affects another. Notice that in the first sentence, the story has identified a relationship between profit and sales.
When organized into groups of similar profit, quantity and sales values, one distinct group stands out. There were 651 customers that had values of profit between -$6,626 and $1,488, quantity between 2 and 122 and sales between $4.83 and $5,690.	The third sentence is derived from clustering. Clustering analytics tries to identify key groups or clusters across all the variables in the data.
Tamara Chand, Raymond Buch, and Sanjit Chand, among others were outliers with high profit and sales values. Sean Miller stood out with a low profit and high sales value.	The fourth sentence is written about outliers–values that fall significantly above or below the average.
The minimum value for profit is -$6,626 (Cindy Stewart) and the maximum value is $8,981 (Tamara Chand), a difference of $15,608. The average profit per customer is $361 and the median is $228. The minimum value for quantity is 2 (Anthony O'Donnell) and the maximum value is 150 (Jonathan Doherty), a difference of 148. The average quantity per customer is 47.76 and the median is 44. The distribution of sales ranges from $4.83 (Thais Sissman) to $25,043 (Sean Miller), a difference of $25,038. The average sales per customer is $2,897 and the median is $2,256.	The remaining sentences for scatter plot stories use range and average analysis to write insights.

### Understand analytics for percent of whole stories Percent of whole story types are best for understanding what part of a whole a dimension or measure represents. The following example of a percent of whole story is about sales by segment: ![An example story with text insights about sales by segment. The text in this image is transcribed in the following table.](/tableau/next/en-us/online/en-us/Img/data_stories_pie_analytics.png)

Example story	Story breakdown
Total SUM(Sales) is 2.3 million across all three entities.	The first sentence calculates the total value of your measure.
The SUM(Sales) of 2.3 million was driven by Consumer with 1.2 million, Corporate with 706,146 and Home Office with 429,653.	The second sentence writes about drivers. In this example, the drivers are segments that contributed the most to total sales.
The minimum value is 429,653 (Home Office) and the maximum is 1.2 million (Consumer), a difference of 731,748, averaging 765,734.	The final sentence analyzes the distribution of the data.

[Skip to main content](#main-content) # Configure Tableau Data Story Settings: Characteristics **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). Within your Tableau Data Story, you can configure the characteristics settings to give context to your data, so you get more insightful stories. For example, in your story you can specify that in the context of sales, a higher number is good. But in the context of customer complaints, a higher number is bad. ## Use dimension and measure characteristics Your story and number formatting adjusts based on what the measure is. By default, your story writers all measure values as numbers, and your story won't perform any additional calculations or apply any special rendering rules. 1. [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm). 2. From your dashboard, click the Settings icon at the top-left corner of your Data Story object. 3. In the Data Story dialog box, click the Characteristics tab. 4. Configure your formatting, such as number type, decimal places, and negative values. 5. Click Save. ## Learn more about measure characteristics ### Formatting If values are formatted as Percentages, then the story writes about percentage point differences, rather than percent changes as a story would for number values. When you format a number as a Percentage in the Characteristics tab, the Data Story multiplies the value of the number by 100 to create the percentage that shows in your story. If values are formatted as Currency, then you can specify your preferred currency. You can also specify how you want large values (numbers greater than one million) formatted, for example $1.3 million instead of $1,300,000.00. For both Numbers and Currency, you can specify how you want large values and negative values to be written about. If you choose to have negative values written about in parentheses, you might see nested parentheses in your story when the negative value is written about in a parenthetical phrase. When you choose Number formatting, you can also specify whether you want numbers less than or equal to 10 to be spelled out (rather than using a numeral) in your story. For decimal places, Dynamic is the default option. This means that the story rounds to different decimal places depending on how large or small the number is. If the percent value is less than 10, then the number has two decimal places. If the percent value is greater than 10, then the number rounds to the nearest whole number. You can also specify how many decimal places you want used, which is used consistently throughout your story. ### Content You can assign meaning to larger values. For example, larger values for sales are good, but larger values for losses are bad. In addition, you can choose how to aggregate values by sum or average. It's a best practice to choose the same aggregation method that you're using in the viz. For ratio measures, choose Average and then define the ratio by selecting the component measures of that ratio measure. Measures that are components of a ratio must be summable. ![Settings menu open to Characteristics tab with aggregate set to average, ratio turned on, and a ratio created for profit and sales.](/tableau/next/en-us/online/en-us/Img/data_stories_ratio.png) For cumulative measures (available for continuous stories only), choose **Sum** and then specify that the measure is already cumulative. Continuous stories write about the total of the measure across the series. ### Sorting To sort dimension values, click the arrow up/down icon to sort based on the oldest or newest time values in your dimension. **Note:** Sorting dimension values is available for only continuous stories. [Skip to main content](#main-content) # Configure Tableau Data Story Settings: Display **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). You can configure how the text in your Tableau Data Story is displayed, such as font color and size. You can also choose whether your story uses bulleted lists or paragraphs. ## Configure the display for your story 1. [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm). 2. From your dashboard, click the Settings icon at the top-left corner of your Data Story object. 3. In the Data Story dialog box, click the Display tab. 4. Choose whether you want your story structure to be Bullets or Paragraphs. 5. Choose your Font Size. 6. Pick colors to represent good and bad changes (available for continuous stories). 7. Choose whether to use Dynamic Ordering. 8. Choose whether to use a Condensed View. 9. Click Save. ## Understand when to use story display settings To use color, your story must be continuous. When using color, you can choose colors from the palette to represent good changes and bad changes. For your story to know whether a change is good or bad, you must assign meaning to larger values in the Characteristics tab. For more information, see [Configure Tableau Data Story Settings: Characteristics](https://help.tableau.com/v0.0/online/en-us/data_stories_characteristics.htm). After you configure your display, the styles and colors are applied in your story based on thresholds for trend line or segment analytics. If you turn on Dynamic Ordering, then the insights for measures in a story are dynamically ordered from the best to the worst average value. If you already have an order you want to maintain, turn off Dynamic Ordering. If you turn on Condensed View, then additional space is removed from your story. This is helpful if you don't have much extra space in your dashboard or when you have multiple Data Story objects in a dashboard. [Skip to main content](#main-content) # Configure Tableau Data Story Settings: Drivers **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). Hypothetically, let's say your month-over-month sales increased significantly. What drove that increase in sales? And what might have detracted from (offset) those increased sales? Setting up drivers in your Data Story can answer those questions. In Data Stories, drivers contribute toward a total value. Offseters detract from a total value. You'll find insights about drivers and offsetters in discrete and continuous stories. And these insights make it easy to understand exactly what's going on in the data and why. ## Set dimension drivers 1. [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm). 2. From your dashboard, click the Settings icon at the top-left corner of your Data Story object. 3. In the Data Story dialog box, click the Drivers tab. 4. From the Dimension Drivers section, select the type of driver that has the greatest impact on your analysis: For Count, set the maximum number of contributors and offsetters. For Individual %, set thresholds for writing about individual contributors and offsetters. For Cumulative %, set thresholds for writing about contributors and offsetters based on their collective value. 5. Click Save. ## Understand dimension driver types - Count specifies the number of entities (contributors and offsetters) called out in your story. For example, use Count to see the top three contributors and offsetters in your data. - Individual % sets a threshold, and values higher than that threshold are included in your story. For example, use Individual % to specify that you want to write about only entities that represent more than 5% of the total value. - Cumulative % sets a percentage threshold of the total value that included entities collectively account for. For example, use Cumulative % to specify that you want to write about the entities that contributed to at least 90% of that total value. In this example, entities are written about in order of magnitude until the cumulative value of those entities account for 90% of the total value. ## Use secondary contributors To use secondary contributors, you must have a second dimension that isn't time. When you use secondary contributors, each driver that is written about also has details about and drivers for its secondary contributor. For example, if you are analyzing store sales, a secondary contributor would be a class within a department. Secondary contributors allow for deeper analysis. But secondary contributors can also contain a lot of information to fit into a single sentence in your story. ## Set metric drivers For measures that are composed of other subcategory measures, driver analysis can explain the impact that each measure had on the top-level value. For example, material costs and operating costs contribute to total cost. To use metric drivers, you must have multiple measures for metric analysis. Then, you can specify the relationships between each measure. 1. [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm). 2. From your dashboard, click the Settings icon at the top-left corner of your Data Story object. 3. In the Data Story dialog box, click the Drivers tab. 4. From the Metric Drivers section, first choose the measure that is a subcategory of another measure. 5. Then, choose the measure that is the primary category. 6. Click Save. > [!TIP] > > The verbosity setting also applies to drivers. By changing your story's verbosity setting, you can adjust the way insights are written. If you use high verbosity, then you'll see more information in parentheses. If you use low verbosity, then you'll get a more concisely written insight about your drivers. For more information, see [Configure Tableau Data Story Settings: Narrative](https://help.tableau.com/v0.0/online/en-us/data_stories_narrative.htm). ![Animation of clicking the Settings icon in a Data Story Object, setting dimension drivers, setting metric drivers, and saving.](/tableau/next/en-us/online/en-us/Img/data_stories_drivers.gif) [Skip to main content](#main-content) # Configure Tableau Data Story Settings: Narrative **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). You can customize the narrative settings of your Tableau Data Story. Specifically, you can specify the verbosity and level of analytical detail in your story, and you can add terms that are unique to your data. These settings help you write a story that uses the right language and speaks to the right level of detail for your dashboard. ## Set verbosity Verbosity specifies the length and analytical detail written in your story. If you choose high, then your story has longer insights with more analytic analysis. If you choose low, then your story is more concise with fewer details. If you allow viewers to change verbosity, then viewers of published dashboards can change the level of verbosity in the Data Story object. This is helpful when your dashboard is used by a broader audience with viewers who want varying levels of detail from your story. ## Set drilldowns A drilldown includes two dimensions, and drilldowns describe figures associated with each dimension of your dashboard. Let's say you have a dashboard that has monthly sales by product category. Your story is configured to write about both the **Time** and **Category** dimensions. In this case, this story includes an insight for each Category that describes its performance in and across the **Time** dimension. By setting the maximum number of drilldowns, you can control how many insights are included in your story. Drilldown insights are also ranked based on the meaning assigned to the measure characteristics. As the number of drilldowns is reduced, the lowest performing measures (measures that are assigned a Bad meaning) are eliminated. ## Add dimension terms By adding terms, you can define the way each of your measures and dimensions are labeled and referenced in your story. 1. [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm). 2. From your dashboard, click the Settings icon at the top-left corner of your Data Story object. 3. In the Data Story dialog box, click the Narrative tab. 4. Expand the dimension to see how it will be written about in both singular and plural form. 5. Click Add Term to add another variation for your story to use to describe your dimension. 6. Click Save. Your story uses (at random) the terms you've added when writing about a dimension. ## Manage measure labels Similarly to dimensions, you can manage labels used for measures in your story. 1. From the Narrative tab, expand the measure to see its label. 2. Enter the new label that you want used for your measure. 3. Click Save. [Skip to main content](#main-content) # Configure Tableau Data Story Settings: Relationships **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). The Relationships setting allows you to assign relationships between measures in a Tableau Data Story that has multiple measures. To configure Relationships, your story must have one dimension and multiple measures. For more information, see [Create Custom Measure Relationships in Your Tableau Data Story](https://help.tableau.com/v0.0/online/en-us/data_stories_relationship_story.htm). There are two types of relationships: - Actual vs. Benchmark - Current/Most Recent vs Previous Period Use Actual vs. Benchmark when you want to know if you're performing above or below your performance benchmarks, for example, when performing quota reporting. This type of relationship is also helpful for identifying data points that require additional analysis because they're significantly above or below your benchmark. To use Actual vs. Benchmark, the measures you're comparing must have the same value type. Use Current/Most Recent vs. Previous Period when you want to see if your key performance indicators (KPIs) are increasing, decreasing, or remaining consistent over time. To use Current/Most Recent vs. Previous Period, you must use a discrete story type. For more information, see [Choose the Right Story Type for Your Tableau Desktop Data Story](https://help.tableau.com/v0.0/online/en-us/data_stories_story_types.htm). Additionally, you can use Actual vs. Benchmark and Current/Most Recent vs. Previous Period relationships simultaneously. Measures in your viz that aren't part of the configured relationships are written about in separate paragraphs. ## Create Actual vs. Benchmark relationship for continuous or discrete stories Use the Actual vs. Benchmark relationship when one measure is a benchmark for other measures. For example, you could compare actual sales to a sales target, so your story writes insights about whether you outperformed or underperformed your goal. When you use this type of relationship, the story removes unnecessary content and focuses on what's most important–comparing a metric to its associated benchmark. 1. [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm). 2. From your dashboard, click the Settings icon at the top-left corner of your Data Story object. 3. In the Data Story dialog box, click the Relationships tab. 4. Check the box for Actual vs. Benchmark. 5. First, select the measure that is the benchmark. 6. Then, select the measure that you want to compare against the benchmark. 7. Click Save. ## Create Current/Most Recent vs. Previous Period relationship Use the Current/Most Recent vs. Previous Period relationship to compare the performance of two measures over a period. For example, you could compare two products to see which product generated the most revenue over the last year. 1. [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm). 2. From your dashboard, click the Settings icon at the top-left corner of your Data Story object. 3. In the Data Story dialog box, click the Relationships tab. 4. Check the box for Current/Most Recent vs. Previous Period. 5. First select the measure for the previous period. 6. Then, select the measure for the current period. 7. Enter the label for the period that you're measuring, for example, year. 8. Choose the number of periods to measure. 9. Click Save. [Skip to main content](#main-content) # Configure Tableau Lightning Web Components and Single Sign-On (SSO) with Token Authentication Tableau Lightning web components (LWC) allow Salesforce customers to drag and drop Tableau views and Tableau Pulse metrics onto Salesforce Lightning pages. - The Tableau View component allows you to add embedded views from Tableau Cloud or Tableau Server. - The Tableau Pulse component allows you to add embedded Tableau Pulse metrics from Tableau Cloud. Tableau LWC seamless authentication allows you to view Tableau content using connected app trusted tokens without signing in. Seamless authentication is optional for Tableau View LWC, and is required for Tableau Pulse LWC. > [!IMPORTANT] > > > • [Salesforce Console](https://help.salesforce.com/s/articleView?id=sf.console2_about.htm&type=5) apps do not support the use of Tableau Lightning web components. > • Case Record pages do not support the use of Tableau Lightning web components with Chatter emails. ## Add Trusted URL The Tableau view or Pulse URL that you want to add to your Lightning page must be added as a Trusted URL. 1. From your Salesforce app, select the gear in the top-right corner, and then select Setup. 2. On the left navigation pane, enter “Trusted URLs” in the Quick Find search bar. 3. Select the Trusted URLs settings page. 4. Select New Trusted URL. 5. Enter an API Name and URL, following the instructions on the settings page. **Note**: The URL must begin with https:// 6. For CSP Context, select All. 7. For CSP Directives, check all boxes. 8. Select Save. ## Turn on seamless authentication for Tableau LWCs Tableau View and Tableau Pulse LWCs are available in the Lightning App Builder without any configuration. However, Tableau Pulse LWC requires token authentication to function. ### Configure Salesforce settings The following steps only need to be completed one time by a Salesforce admin: 1. From your Salesforce app, select the gear in the top-right corner, and then select Setup. 2. On the left navigation pane, enter “Tableau” in the Quick Find search bar. 3. Select the Tableau Embedding settings page. 4. Select the checkbox for Turn on token-based single sign-on authentication. **Note**: This box must be checked to configure the Tableau Pulse LWC. For the Tableau View LWC, you can choose not to set up token authentication and instead sign in manually when the component loads. To use Tableau View LWC on Mobile, you must turn on token-based authentication and set up seamless authentication. 5. For Select Tableau User Identity field, set an org-level user field to authenticate the user in Tableau. You must select the Salesforce user field that corresponds with the Tableau username. The dropdown shows the field value for the current user, or null if no value is defined. If none of the user fields match the Tableau username, select an empty field (for example, Federation ID or a custom field). Then, populate the empty field with the Tableau username for your users. **Note**: The Tableau User Identity field setting applies to all users and doesn’t need to be set on an individual basis. 6. Save your changes. 7. If you're the Tableau admin, keep the Salesforce settings Tableau Embedding tab open while you configure Tableau settings in the next section. If you aren’t the admin, share the Issue URL and JWKS URI with your Tableau admin. > [!TIP] > > The Tableau User Identity field setting applies to all users and doesn’t need to be set on an individual basis. ### Configure Tableau settings In one tab, open the Tableau Embedding settings page in your Salesforce org. In another tab, go to your Tableau site and follow these instructions to set up the Connected App. For Tableau Server, follow these steps: 1. As a Tableau Server admin, sign in to the Tableau Services Manager (TSM) web interface. 2. Navigate to User Identity & Access, and then select the Authorization Server tab. 3. Select the checkbox for Enable OAuth access for embedded content. 4. Enter the Issue URL and JWKS URI, which you can find on the Salesforce org Tableau Embedding settings page. Use the Copy button on the Salesforce org settings page to copy the Issuer URL value, and then paste it into the TSM web interface. Repeat this process for the JWKS URI value. **Note**: The JWKS URI field is marked as optional in the TSM web interface, however this value is required to use Tableau LWC seamless authentication. Tableau Server needs to be able to reach the JWKS URI for seamless authentication to succeed. 6. Select Save Pending Changes. 7. Select Pending Changes in the upper-right corner of the page, and then select Apply Changes and Restart to stop and restart Tableau Server. For more information, see [Register your EAS with Tableau Server](https://help.tableau.com/current/server/en-us/connected_apps_eas.htm#step-2-register-your-eas-with--tableau-server). For Tableau Cloud, follow these steps: 1. Open the Tableau Settings page, and then choose the Connected Apps tab. 2. From the New Connected App dropdown, select OAuth 2.0 Trust. 3. On the Create Connected App dialog, enter the Issue URL and JWKS URI, which you can find on the Salesforce org Tableau View Embedding settings page. Use the Copy button on the Salesforce org settings page to copy the Issuer URL value, and then paste it into the Tableau settings page. Repeat this process for the JWKS URI value. > [!IMPORTANT] > > The Create Connected App dialog notes the JWKS URI field as optional, however this value is required to use Tableau LWC seamless authentication. 5. Select the checkbox for Enable connected app. 6. Select Create. **Note:** The Connected App is named External Authorization Server. For more information, see [Register your EAS with Tableau Cloud](https://help.tableau.com/current/online/en-us/connected_apps_eas.htm?_gl=1*1rfpjn7*_ga*NDAxMzE5Mi4xNjg5ODczMzE5*_ga_8YLN0SNXVS*TmVlZHMgR1RNIENvbmZpZ3VyYXRpb24uMi4xLjE2ODk4ODkwMDAuMC4wLjA.#step-2-register-your-eas-with--tableau-cloud). If you want to create a host mapping for this site, leave the Connected Apps tab open. You can use the URL for this page and the Copy Site ID button to populate the host mapping fields in the following section. ## Allow capture of user attributes (Tableau Cloud only) To leverage [user attribute functions](https://help.tableau.com/current/online/en-us/lwc_uaf.htm) with Tableau LWCs, you must enable access in authentication workflows. 1. Open the Tableau Settings page, and then choose the Authentication tab. 2. Navigate to the Control User Access in Authentication Workflows section. 3. Select the checkbox for Enable capture of user attributes in authentication workflows. ## Set up or edit host mapping When setting up Tableau LWC, it’s important to understand how host mapping and Site IDs work, as well as how authentication options affect configuration. Host mapping is optional, but it is a useful feature for first-time users because it allows users to avoid entering a Site ID in the component panel. Essentially, it maps a specific Tableau site to its corresponding Site ID, so when someone embeds a view from a site with an existing host mapping, they do not need to manually enter the Site ID. When both host mapping and a Site ID are specified, host mapping takes precedence. For authentication: - **Tableau server-wide authentication** should not add a Site ID automatically. - **Tableau site-wide authentication** should add a Site ID to ensure proper access. Follow these steps to create or edit a host mapping. ### Create a new host mapping 1. From your Salesforce app, select the gear in the top-right corner, and then select Setup. 2. On the left navigation pane, enter “Tableau” in the Quick Find search bar. 3. Select the Tableau Embedding settings page. 4. From the Tableau Host Mapping section, select Create New. 5. Fill in the host mapping details: 1. **Tableau site URL**: Enter a URL for the Tableau site that you want to map. The URL should contain the site name, unless it’s an on-prem installation using the Default site. Tableau Site URLs should like one of the following: - `https://.online.tableau.com/#/site/SITENAME/` - `https://.online.tableau.com/#/site/SITENAME/Home` - `https://.online.tableau.com/#/site/SITESAML/connectedApplications` 2. **Tableau site ID**: Enter the site ID for the Tableau site that you want to map. You can use the Copy Site ID button on the Connected App settings page or on the Share dialog. 3. **Tableau site host type**: Select either Tableau Cloud, Tableau Server (site-level EAS), or Tableau Server (server-wide EAS). **Note**: If you want to create a host mapping for this site, leave the Connected Apps tab open. You can use the URL for this page and the Copy Site ID button to populate the host mapping fields in the following section. 6. Select Save. Or, if you want to return to the Tableau Embedding settings page without saving, select Cancel. ### Edit a host mapping **Note**: If you’ve saved host mappings from before version 254.10, you must update the Tableau host type. For more information and for remediation instructions, see [Update the host type for saved Tableau host mappings](#Update). You can update the site ID and host type for an existing mapping. If you need to change the site URL, delete the existing mapping, and then create a new one with the correct URL. 1. From the Salesforce app Tableau Embeddings settings page, select Edit next to an existing host mapping. 2. Edit the Tableau site ID or Tableau site host type fields as needed. 3. Select Save. Or, if you want to return to the Tableau Embedding settings page without saving, select Cancel. ## Create user attribute claims definitions You can leverage User Attribute Functions (UAF) with your Tableau View and Pulse Lightning web components (LWC) to surface specific data based on the attributes of the user looking at a visualization. For more information, see [Leverage User Attribute Functions (UAF) with Tableau Lightning Web Components](https://help.tableau.com/current/online/en-us/lwc_uaf.htm). ## Add Tableau LWCs to a Lightning page using Lightning App Builder Tableau LWCs are available on App, Home, and Record Lightning pages only. For more information about Lightning page types and using the Lightning App Builder, see Lightning App Builder in Salesforce Help. **Note:** Case Record pages do not support the use of Tableau Lightning web components with Chatter emails. To add a Tableau View or Tableau Pulse LWC to an existing Lightning page, follow these steps: 1. Navigate to the Lightning page that you want to edit. 2. Select the gear icon in the top right. 3. Select Edit Page. 4. Proceed to the **Add a Tableau LWC to a Lightning page** section below. To add a Tableau View or Tableau Pulse LWC to a new Lightning page, follow these steps: 1. From your Salesforce app, select the gear in the top-right corner, and then select Setup. 2. On the left navigation pane, enter “Lightning App Builder” in the Quick Find search bar. 3. Select the Lightning App Builder setup page. 4. Select New. 5. Select the page type that you want to create. Tableau LWCs are available on App, Home, and Record pages. 6. Select Next. 7. Enter a name and select a layout for the new page, and then select Done. ### Add a Tableau LWC to a Lightning page 1. From the Components list on the left side of the page, drag and drop the Tableau View or Tableau Pulse component onto the page. 2. Configure the LWC: - [Configure a Tableau View Lightning Web Component](https://help.tableau.com/current/online/en-us/lwc_tableau_view.htm) - [Configure a Tableau Pulse Lightning Web Component](https://help.tableau.com/current/online/en-us/lwc_tableau_pulse.htm) ### Save and activate the page 1. When you’ve finished adding and configuring a Tableau View or Tableau Pulse LWC, select Save. 2. If you’ve created a new page, you are prompted to activate the page so that it’s visible to users. Select Activate. 3. On the Page Settings tab of the Activation page, enter a name, choose an icon, and select your visibility preference. 4. (Optional) On the Lightning Experience tab of the Activation page, you can add the page to various Lightning Experience Apps. 5. (Optional): On the Mobile Navigation tab of the Activation page, you can add the page to the Mobile Navigation Menu. 6. Select Save. ## Composable Tableau Lightning Web Component The Tableau Lightning Web Component is now composable, allowing it to be embedded within custom Lightning Web Components and more flexible page layouts. This enables developers to incorporate Tableau visualizations as part of larger, custom-built experiences in Salesforce, rather than being limited to standalone placement on a page. The component can be used within other LWCs and dynamically rendered based on application logic. When using the Tableau LWC in a composable context, ensure that all required configurations for seamless authentication are still in place, including: - Connected App configuration - Trusted URLs - JWT authentication settings - Host Mapping and User Attribute Function (UAF) configuration Composable usage follows the same authentication and data access patterns as standard usage. ## Embed multiple Tableau views You can embed more than one Tableau view on a Salesforce Lightning page as long as all views come from the same site. Tableau only supports a single session, and that session is specific to the site. The most recently granted session will wipe out the previous one. To embed Tableau views from multiple sites, you must create a separate Lightning page that is site-specific. ## Tableau LWC single sign-on for Mobile **Note:** Tableau View and Pulse LWCs are available on iOS 17.2.1+. Consider the following best practices to prevent issues for mobile users: - Lightning page type: Mobile users can access App Pages and Record Pages, but not Home Pages. **Note:** Record Pages must be associated with a specific type of record. - If you use the same page for both desktop and mobile users, select Activation to verify that the Lightning page is set as the Org Default for both desktop and phone form factors. - Consider creating separate Lightning pages for desktop and mobile to provide a tailored visual experience. The height for the Tableau View component is fixed and won’t dynamically adjust to different screen sizes. - To add a scroll bar to a view, select Show Toolbar from the Tableau View component properties pane. - For the App Page type, select Activation, and then select the Lightning Experience tab. Add your page to the LightningBolt list to make the page easier to find on mobile. - On mobile, iOS blocks cross-site traffic by default. Open your mobile settings, select Salesforce settings, and then turn on Allow Cross-Website Tracking. For more information, see [Enable cross-website tracking](https://help.salesforce.com/s/articleView?id=sf.branded_apps_cross_site_tracking.htm&type=5). ## Troubleshooting Tableau LWC SSO with Token Authentication ### Update the host type for saved Tableau host mappings If you’ve saved host mappings from before version 254.10, you must update the Tableau host type. 1. On the Tableau Embedding settings page, verify that your saved host mappings have one of the following Tableau host types: Tableau Cloud, Tableau Server (server-wide EAS), or Tableau Server (site-level EAS). 2. If the mapping has some other Tableau host type (for example, TABLEAU\_CLOUD or TABLEAU\_SERVER), select Edit to edit the host mapping. 3. On the Edit Tableau Host Mapping page, select the appropriate setting from the Tableau site host type dropdown, and then select Save. 4. Repeat steps 1-3 for all saved mappings as necessary. ### Verify the Salesforce and Tableau configuration 1. Verify that the Issuer URL and JWKS URI values match in both Salesforce and Tableau Settings and that JWKS URI ends with id/keys. - For Tableau Cloud, open the Salesforce Settings Tableau Embedding page in one tab. In another tab, open the Tableau Settings Connected Apps tab. On the Connected Apps tab, select External Authorization Server, and then select Edit. Verify that the Issuer URL and JWKS URI values match and that the JWKS URI ends with id/keys. - For Tableau Server, open the Salesforce Settings Tableau Embedding page in one tab. Then, sign in to the Tableau Services Manager (TSM) web interface, navigate to User Identity & Access, and then open the Authorization Server tab. 2. Verify Host Mapping: If you’ve saved a host mapping, verify that it has the correct site ID and host type. ### Verify the JWT token In the Tableau View Lightning web component property editor, select Debug Mode to verify that the JWT token is working as expected. 1. Open the console logs and copy the token. 2. Go to the [jwt.io](https://jwt.io/) website and paste the token into the Encoded field. 3. Verify the following: - The subject (“sub”) matches the Tableau username. - For Tableau Cloudand Tableau Server (site-level EAS), the audience (“aud”) is “tableau: {site ID}”. For Tableau Server (server-wide EAS), the audience (“aud”) is “tableau”. - The scope (“scp”) includes both “tableau:views:embed” and “tableau:insights:embed”. - The issuer (“iss”) EAS server is accurate. ### Verify page activation Sometimes, a user creates a Lightning page, but it hasn’t been activated or assigned anywhere, so users can’t find it. Select Activation to verify that the Lightning page is set as the Org Default for the intended form factors. > [!TIP] > > When debugging, it’s helpful to drag and drop a Rich Text component onto your page. Add a brief description of the page type and the view URL that you’re trying to embed. This allows you to be sure that the page being viewed by the end user is the page that the admin is editing. ### Confirm that Tableau View LWC is working without seamless authentication (Tableau View LWC only) 1. From the Tableau View pane on your Lightning page, clear the checkbox for Enable Single Sign-On, and then save the changes. 2. For Tableau Server, verify that the Site ID field is empty. 3. If you’re signed in to Tableau in another tab, sign out. Ensure that navigating to the View URL redirects you to the Tableau sign-in page. Do not sign in. 4. Navigate to the Lightning page. The Tableau View LWC should display a Sign in to Tableau button. 5. Select Sign in to Tableau, and then enter your Tableau credentials to sign in. **Note**: If the view doesn’t load, this indicates a broader issue with authenticating to Tableau. ### Error: LWC component version no longer supported (Tableau View LWC only) To resolve this error, follow these steps: 1. In the Components list, search for “Tableau”, and then drag and drop a new Tableau View component onto the page. 2. Copy all properties from the Tableau View pane for the old component over to the new component. 3. Select the delete icon on the old component. ### Error: To enable Tableau Pulse LWC, please reach out to your Salesforce admin to configure seamless authentication for Tableau (Tableau Pulse LWC only) To resolve this error, follow the steps on this page to **Turn on seamless authentication for Tableau LWCs**. ## See Also [Troubleshoot Connected Apps](https://help.tableau.com/current/online/en-us/connected_apps_troubleshoot.htm#) [Register EAS to Enable SSO for Embedded Content](https://help.tableau.com/current/server/en-us/connected_apps_eas.htm) [Skip to main content](#main-content) # Configure the Identity Provider for OpenID Connect This topic provides information about configuring an identity provider (IdP) to use OpenID Connect (OIDC) with Tableau Cloud or Tableau Cloud Manager (TCM). This is one step in a multi-step process. The following topics provide information about configuring and using OIDC with Tableau. 1. [OpenID Connect](https://help.tableau.com/v0.0/online/en-us/openid_auth.htm) Overview 2. Configure the Identity Provider for OpenID Connect (you are here) 3. [Configure Tableau Cloud or TCM for OpenID Connect](https://help.tableau.com/v0.0/online/en-us/openid_auth_server_config.htm) Before you can use OpenID Connect with Tableau Cloud and TCM, you must have an account with an identity provider (IdP) and a project or application with the IdP. When you configure Tableau Cloud and TCM, you will need to be able to provide the following information: - **Client ID:** This is the identifier that the IdP assigned to your application. - **Client secret:** This is a token that is used by Tableau to verify the authenticity of the response from the IdP. This value is a secret and should be kept securely. - **Configuration URL:** This is the URL of the provider configuration discovery document that contains the OpenID provider metadata. **Note:** Enabling OIDC authentication for TCM requires a separate setup and app integration from Tableau Cloud. #### Redirect URL Some IdPs will require a redirect URL for Tableau Cloud site or TCM tenant. #### Signing algorithm Tableau Cloud supports RS256 (RSA using SHA-256). [Skip to main content](#main-content) # Connect Tableau Cloud Web Authoring to Salesforce Data Cloud > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. The Salesforce Data Cloud connector was released in Tableau Cloud October 2023. This connector seamlessly connects Tableau to Data Cloud, and is available for Tableau Desktop, Tableau Cloud, Tableau Server, and Tableau Prep. Compared to the older CDP connector, the Salesforce Data Cloud connector is easier to connect with, shows object labels instead of API names, and is powered by accelerated queries. **Note**: Data Cloud was previously called Customer Data Platform (CDP). The Customer Data Platform connector was deprecated in October 2023, was made unavailable for new connections in Tableau Cloud June 2024, and is removed entirely from Tableau Cloud October 2024 and later. Existing assets that use the CDP connector must be recreated using the Salesforce Data Cloud connector. Connect Tableau Cloud Web Authoring to the Customer Data Platform by completing the following steps. 1. From an Explore page, select New, then Workbook. Or select the Data menu, then New Data Source. 2. In the Connect to Data window, select the Connectors tab. 3. Select Salesforce Data Cloud. 4. Log in and allow access when prompted. 5. Select the Data space. Data spaces represent a logical segregation of the data in Data Cloud. Data spaces didn't exist before the Salesforce June' 23 release. 6. Use Object to filter by the type of Data Cloud object, or select All Objects. [Skip to main content](#main-content) # Connect to Data Before you can create a virtual connection, you must connect to data. 1. In the Connections pane, click ![Add Connection](/tableau/next/en-us/online/en-us/Img/ipa_connect_button.png). 2. Choose the connector for your data. 3. Enter the information you’re prompted for. 4. Click Sign In. To add more connections, repeat these steps. Then begin creating a virtual connection. More about [Supported Connectors](https://help.tableau.com/current/pro/desktop/en-us/exampleconnections_overview.htm) ## Related tasks [About the Virtual Connection Editor](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_about_editor.htm) Not finding what you need? Go online to see [all Tableau help](https://www.tableau.com/support/help) [Skip to main content](#main-content) # Connect to Private Cloud Data This topic describes how a data source owner can publish a data source that connects to cloud data, such as Amazon Redshift and Snowflake, that can only be accessed from a private network. Data sources that connect to private cloud data rely on Tableau Bridge to keep data fresh. In most cases, Tableau Cloud will automatically detect that Bridge is required as part of the publishing process. However, in some cases, you might need to manually configure your connection to ensure that Bridge is used. No additional steps are required to use Bridge when publishing [virtual connections](https://help.tableau.com/current/online/en-us/dm_vconn_create_conn.htm) that connect to cloud data. The tasks described in this topic assume Bridge has already been set up and is being maintained by your site admin. Bridge supports keeping data fresh for data sources embedded in workbooks. See [Using Embedded Data Sources](https://help.tableau.com/current/online/en-us/to_bridge_eds.htm). ## Limitations Bridge doesn't support live connections for some private cloud-based data sources. These include Google Drive, Box, OneDrive, Dropbox, and Azure Data Lake Storage Gen2. Use extract connections to keep data fresh. Use Bridge client version 20224.23.0209.1653 or higher when connecting to these private cloud-based data sources. After upgrading the client, republish your data sources. ## Set up schedules for private cloud-based data sources Use the following procedure to ensure that Bridge schedules are used to keep extracts of your private cloud-based data sources up to date. 1. Follow steps 1-7 in the [Publish a Data Source](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources.htm) topic in the Tableau User Help. 2. If not already signed in to Tableau Cloud, sign in and navigate to your data source. 3. From the data source page, click the Connections tab and select the check box next to the connection. 4. From the Actions drop-down menu next to the connection, select Edit Connection. 5. In the dialog box next to Network type, select the Private Network radio button and click Save. ![The Edit Connection dialog with Network Type selections highlighted, including two options: Tableau Online or Private Network.](/tableau/next/en-us/online/en-us/Img/bridge_site_editconnection_private.png) **About switching network types** Changing the network type does not change the network type used by existing schedules for the data source. If you change the network type for a data source that has an existing schedule associated with it, you must create a new schedule. This also means, if you created a refresh schedule prior to changing the network type, you must delete it before using the Run Now option. For more information about deleting a refresh schedule, see [Delete a refresh schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm#schedule_delete). You can proceed to the next step so that a previous Bridge refresh schedule is automatically deleted when you create a new Bridge-dependent refresh schedule. 6. Follow one of the steps below depending on the schedule you need to configure: - For a Bridge refresh schedule, follow the steps described here: [Add or update an existing schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm#new_change_after_publish). - For a Bridge legacy schedule, follow the steps described here: [Add a new or update an existing Bridge legacy schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm#Add). **Note:** If you had previously set up a Tableau Cloud refresh schedule, it will be deleted automatically when you save the Bridge-dependent schedule. 7. Click the Schedule Refresh button. ## Publish private cloud-based data sources that use live connections Use the following procedure to ensure that Bridge live queries are used to keep private cloud-based data sources up to data. Bridge doesn't support refreshing live connections with pools for some private cloud-based data sources. For more information, see [Limitations](#limitations) 1. In Tableau Desktop, create your data source. 2. Select Server > Publish Data Source to begin the publishing process. If you haven't already signed in to Tableau Cloud, you will be prompted to. 3. In the Publish Data Source to Tableau Cloud dialog box, configure the various options for your data source and ensure you do the following: - Under Authentication, click Edit and select Embedded password. - Depending on the data that the data source is connected to or how you've configured the data source, the dialog can default to publishing a live connection or give you the option to publish a live connection or extract. If you are provided with options, select Maintain a live connection. 4. Click the Publish button. This opens a dialog box. 5. In the dialog box, click the Publish with Bridge button. This opens a browser window to Tableau Cloud. ![A Tableau Cloud error message may recommend adding Tableau Cloud to the list of authorized data providers.](/tableau/next/en-us/online/en-us/Img/bridge_publish_vpc_live.png) 6. In the Publishing Complete dialog box, click the Done button. 7. From the data source page, click the Connections tab and select the check box next to the connection. 8. In the dialog box next to Network type, if not selected automatically, select the Private Network radio button and click Save. ![The Edit Connection dialog with Network Type selections highlighted, including two options: Tableau Online or Private Network.](/tableau/next/en-us/online/en-us/Img/bridge_site_editconnection_private.png) ## Publish OAuth enabled private cloud-based data sources Tableau Bridge supports OAuth when connecting to private data that uses OAuth and public data that uses OAuth when it’s joined to private data. For most data sources, live connections and extracted data are supported. For a list of OAuth-supported Bridge connectors see [Authentication](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm#Authenti). **Note**: For Azure data sources, the data source must be published through Tableau Cloud instead of Tableau Desktop when using OAuth as the authentication type. Both saved credentials or managed keychain connectors are supported by OAuth. The type of functionality is dependent on the connector that you use. 1. In Tableau Desktop, connect to your data housed in a private cloud database. 2. Depending on the connector, you may be prompted to choose the authentication type. If you are provided with options, select Sign in using OAuth. 3. The Data Source page opens so that you can prepare the data for analysis and begin building your view. 4. Choose whether to publish as a live connection or an extract. Some data sources, such as Salesforce, don’t support live connections. 5. For extracts, click the Sheet tab to create and save the extract. 6. Select Server > Publish Data Source to begin the publishing process. If you haven't already signed in to Tableau Cloud, you will be prompted to. 7. Under Authentication, click select the authentication type. The options displayed are dependent on the data source. In most cases, Saved Credentials are recommended. For more information, see [Refresh Data Using Saved Credentials](https://help.tableau.com/v0.0/online/en-us/to_fresh_data_saved_credentials.htm). - If you have saved credentials data source in My Account Settings, select Embed <_data source name_\>. - For extracted data, choose whether to allow refresh access. When you allow refresh access for extracts, you are prompted to set up a schedule. To schedule for a refresh, you must use embedded credentials. 9. When Bridge is required, your connection will be detected as Private during the publish operation. To change your network connection status, click the Actions menu, and select Edit Connection. [Skip to main content](#main-content) # Connect to Published Data Sources in Web Authoring The steps below describe how to connect to published data sources when you're signed in to Tableau Server or Tableau Cloud. For details on how to edit workbooks and view on the web, see [Build Views on the Web](https://help.tableau.com/current/pro/desktop/en-us/web_author_build_view.htm) and [Using Tableau on the Web](https://help.tableau.com/current/pro/desktop/en-us/web_author_home.htm). For information about how to connect to a published data source from Tableau Desktop, see [Tableau Server or Tableau Cloud](https://help.tableau.com/current/pro/desktop/en-us/examples_tableauserver.htm) in the Connector Example reference in this help system. ## Connect to a published data source in the web authoring environment You can connect to data if you have permissions to create and edit views. 1. While you're signed in to your Tableau Server or Tableau Cloud site, select a view to edit. 2. In editing mode, click the New Data Source icon ![New Data Source icon.](/tableau/next/en-us/online/en-us/Img/datasource_using1.png). 3. In the Connect to Data dialog box, search for and select a published data source, and then click Connect. You can also connect to a published data source when you're creating a new workbook directly on Tableau Server or Tableau Cloud. 1. When you're signed in to your site, navigate to the Explore page and select All Data Sources. 2. In the list of data sources, select the check box next to the one you want to use, and then click Actions and select New Workbook. ## Other articles in this section [Skip to main content](#main-content) # Connectivity with Bridge When data sources or virtual connections connect to private network data that Tableau Cloud can't reach directly, Tableau Bridge is used to facilitate connectivity. ## Connection types Tableau Bridge supports on-premise data or data in a virtual cloud that is behind the firewall. The data can range from CSV files on your private network or data stored in a data warehouse. For cloud data that Tableau Cloud can reach directly, setting up refresh schedules directly with Tableau Cloud is almost always a better choice. For example, you might be able to connect to a MySQL database hosted on a cloud platform. In a scenario like this, you can set up a refresh schedule for extracts that connect to this type of data directly with Tableau Cloud. **Extract refreshes** When data sources or virtual connections use extracts to connect to private network data, Bridge can be used to perform scheduled refreshes of those extracts. Refreshes can be scheduled, in most cases, by the content owner as part of the publishing process. For extract refresh requirements, see [Additional requirements for extract connections](https://help.tableau.com/current/online/en-us/to_bridge_client.htm#conn_extract). **Live connections** Bridge supports data sources or virtual connections with live connections to private network data using a feature called live queries. If the content owner publishes a data source or virtual connection that uses a live connection to data that Tableau Cloud detects that it can't reach directly, live queries are automatically used. For live query requirements, see [Additional requirements for live connections](https://help.tableau.com/current/online/en-us/to_bridge_client.htm#conn_live). - Bridge doesn't support live connections for some cloud data sources. These include Google Cloud SQL, OData, and Progress OpenEdge. Use extract connections to keep data fresh. - Bridge doesn't support live connections for some private cloud-based data sources. These include Google Drive, Box, OneDrive, Dropbox, and Azure Data Lake Storage Gen2. Use extract connections to keep data fresh. - Live connections to file-based data such as CSV, text, Excel, statistical (.sas7bdat) isn’t supported. **Virtual connections** Bridge supports virtual connections, which provide a sharable central access point to data. - Snowflake isn’t supported when used with virtual connections. - OAuth for virtual connections is not supported when used with Tableau Bridge. **File data** The latest version of Windows client and Bridge for Linux for Containers support extracting file data including CSV, Excel, text, statistical (.sas7bdat), PDF, and spatial files. - Extract refreshes for published data source files are supported. We recommend using the UNC format for file data connectivity. If you are connecting to a local file path, you must use the Default pool. - Extract refreshes for embedded data source files are supported. You must use a configured pool for embedded data sources and the file path must use the UNC format. - Extract refreshes and live query of Hyper files on a file share are not supported. - Extract refreshes are not possible for data sources that connect to flat files when the workbook is uploaded directly from a browser. - Live connections to file-based data aren’t supported. - Refreshing flat file data using Bridge is not supported for Prep Conductor Flows. To enable successful Prep Conductor Flow refreshes, move the flat file to a location that is accessible by Tableau Cloud directly (Google Drive, Box, Dropbox, etc.). **Connections to cube-based data** Cube-based data is not supported. **Embedded data sources** Tableau Bridge supports data sources that are embedded in workbooks. - Live connections for files data such as CSV, text, Excel, statistical (.sas7bdat) aren’t supported. - The default pool does not support embedded data sources. You must use a pool that has been configured. For more information, see [Configure the Bridge Client Pool](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm). **Published data sources** Scheduled extracts of published data sources don’t support multiple pools. **Tableau Prep Builder** Starting in version 2025.1, private network connections for Tableau Prep through Tableau Bridge are supported. The Tableau Bridge client must be configured to use a Bridge Client pool (not the default pool). For more information, see [Configure the Bridge Client Pool](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm). You can use a Tableau Bridge Client to connect to and refresh your data in Tableau Cloud. For more information, see "Databases" in the Tableau Cloud section of [Publish a flow from Tableau Prep Builder](https://help.tableau.com/current/prep/en-us/prep_conductor_publish_flow.htm#publish-a-flow-from-tableau-prep-builder). Starting in version 2026.2, when authoring Tableau Prep flows on Tableau Cloud, you can connect to on-premises SAP HANA data sources that include variables and parameters via Tableau Bridge. For more information, see “Connect to SAP HANA data” in [Connect to Data](https://help.tableau.com/current/prep/en-us/prep_connect.htm#connect-via-builtin-connectors-for-popular-data-types). Bridge does not support the following: - Running Tableau Prep Conductor to refresh Tableau Prep flows that connect to flat files. To enable successful Prep Conductor flow refreshes, move the flat file to a location that is accessible by Tableau Cloud directly (Google Drive, Box, Dropbox, etc.). - [Writing output data to external databases](https://help.tableau.com/current/prep/en-us/prep_save_share.htm#write_to_DB) using Bridge for Prep Conductor flows. **User attribute functions** [User attributes functions](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_user_attributes.html) are not supported in Tableau Bridge workflows. ## Connectors and data types Bridge supports a combination of connectors that [Tableau Desktop](https://help.tableau.com/current/pro/desktop/en-us/exampleconnections_overview.htm) and [Tableau Cloud](https://help.tableau.com/current/online/en-us/to_connect_live_sql.htm#connectors) supports. Unsupported connectors and limitations for connectors and data types are listed below. **Include External Files** Include External Files is not supported. See [Connecting to flat files and file-based extracts](#remote-share), below. **Private cloud data** In most cases, Tableau Cloud will automatically detect the Bridge client. In some cases, you might need to manually configure your connection to ensure that Bridge is used. For more information, see [Connect to Private Cloud Data](https://help.tableau.com/v0.0/online/en-us/to_bridge_vpc.htm). **Unsupported connectors** - Connectors built by third parties that are not on the Tableau Exchange are not supported. - Some Exchange Connectors are not supported. See section below. - AWS S3 - Microsoft Analysis Services. - Microsoft PowerPivot. - Oracle Essbase. - SAP NetWeaver Business Warehouse. **Exchange Connectors** Tableau Bridge can be used to query data using the select connectors available on the [Tableau Exchange connector page](https://exchange.tableau.com/connectors). The Exchange connectors that are supported are as follows: - Actian JDBC - Actian ODBC - Altinity Connector for ClickHouse - AtScale - Clickhouse - Couchbase Analytics - Data Virtuality JDBC - dbt Semantic Layer - Denodo JDBC - Dr.Sum JDBC - Exasol JDBC - Firebolt - Guidanz BI Connector - Incorta - Jethro ODBC - Looker - MongoDB SQL Interface - MotherDuck/DuckDB - Oracle NetSuite - Palantir Foundry - REST API Connector - Salesforce Commerce Cloud Intelligence - Salesforce Marketing Cloud - SAP SuccessFactors - ServiceNow - SharePoint Lists (JDBC) - SingleStoreDB JDBC - StarRocks - Starburst - Stratio Crossdata Actian JDBC, Altinity Connector for ClickHouse, Guidanz BI Connector, Couchbase Analytics, Stratio Crossdata, Data Virtuality JDBC, Jethro ODBC, Oracle NetSuite, SAP SuccessFactors, ServiceNow, and SingleStoreDB JDBC. To use Exchange Connectors with Tableau Bridge, follow these steps for each Exchange connector and each Bridge client in the pool that will access the target data source. 1. Download the .taco file from the [Tableau Exchange connector page](https://exchange.tableau.com/connectors). 2. Add the .taco file to the Tableau repository connector directory: - On Windows: `C:\Users[Windows User]\Documents\My Tableau Bridge Repository\Connectors` - On Linux: `/root/Documents/My_Tableau_Bridge_Repository/Connectors` - For Data Connect, run the following command to create the Connector directory in your base image: `mkdir -p /home/tableau/Documents/My_Tableau_Bridge_Repository/Connectors` 3. Follow the instructions on the Tableau Exchange for your connector to download the required driver. 4. Install the driver on the Bridge client. 5. Restart the Bridge client. **Connectors that don’t support Live connections** - Google Cloud SQL - OData - Progress OpenEdge - Flat files **SAP HANA** Standard configuration is supported. **Snowflake** Snowflake isn’t supported when used with virtual connections. **Data used in a multi-connection data source** Tableau Bridge can be used to refresh cross-database joined data sources. The database connections defined in the workbook or data source determine how you can publish and keep the data fresh on Tableau Cloud. As long as all the individual data connections are of a type that Tableau Bridge can refresh, then the cross-database joined data source can be refreshed. **Other Databases** - Tableau provides limited customer support for connections using JDBC. See [Tableau support for Other Databases (JDBC) connections](https://help.tableau.com/current/pro/desktop/en-us/examples_otherdatabases_jdbc.htm#tableau-support-for-other-databases-jdbc-connections). - Tableau provides limited customer support for connections using ODBC. See [Tableau support for Other Databases (ODBC) connections](https://help.tableau.com/current/pro/desktop/en-us/examples_otherdatabases.htm#tableau-support-for-other-databases-odbc-connections). **Web data connectors** - Bridge is not able to connect to data from Web Data Connector 3.0. For more information, see [Connectors Built with the Web Data Connector 3.0 SDK](https://help.tableau.com/current/pro/desktop/en-us/examples_wdc_connector_sdk.htm). - The Web Data 2.0 is deprecated as of the 2023.1 release. See [Web Data Connector 2.0](https://help.tableau.com/current/pro/desktop/en-us/examples_web_data_connector.htm). - Tableau doesn’t support connectors or other programs written to interface with the WDC API. ## Web Authoring with Tableau Bridge When authoring data views or working directly on the web within Tableau Cloud, Tableau Bridge provides full query support for a wide array of databases and cloud data environments: - **Named connectors**: You can establish brand-new data connections directly during web authoring sessions for any supported named connectors exposed in the Tableau Cloud connection pane. - **Non-named / generic connectors**: Web authoring is fully compatible with certain non-named database connectors when modifying content that already points to a functional, pre-existing Bridge-backed architecture. This includes: - The Edit Data Source option may not be available for all non-named connectors. - Editing an embedded data source inside an existing, functioning cloud workbook. Tableau does not support editing published data sources via web authoring in all scenarios. The limitations are as follows: - The **Edit Data Source** option may not be available for published data sources that use non-named (generic) connectors. The button appears greyed out. - Editing a live published data source that contains multiple connections to Bridge data sources is not currently supported and will result in an error. ### Bridge agent requirements An active Bridge client must be connected and assigned to a pool for web authoring sessions to function. If an agent is unavailable, Tableau Cloud may attempt a direct connection to the database. This fallback behavior can: - Trigger generic connection errors that obscure the true cause (a missing or offline Bridge agent). - Cause unexpected failures for organizations requiring all traffic to route through Bridge for private network security. To prevent unexpected errors, verify that at least one Bridge client is online and pooled before starting a web authoring session. ### Operational prerequisites To ensure seamless web edit functionality, site admins must verify the following baseline prerequisites: - Routing rule alignment: In all scenarios, the targeted database domain or host address must be actively registered within an explicitly defined Bridge named pool. - Driver availability: For database editing scenarios, the matching database drivers required by your target infrastructure must be manually installed directly on the physical host machine running the active Bridge client. - Proxy and network rules: In specialized or restricted private cloud configurations, you may need to publish the data sources. See [Connect to Private Cloud Data](https://help.tableau.com/v0.0/online/en-us/to_bridge_vpc.htm) for more information. - Session timeout limits: All web authoring interactions, data querying sessions, and heavy analytical modifications on the web remain subject to standard Tableau Cloud operational guardrails, including a 2-hour processing timeout. ### Errors during web authoring with Bridge Error messages displayed during web authoring failures may not clearly indicate a Bridge related issue. Common scenarios are as follows: - A network or login timeout error (for example, "A network-related or instance-specific error has occurred" or "Login timeout expired") can indicate that Tableau Cloud fell back to a direct connection attempt instead of routing through Bridge. Verify that your Bridge client is connected and assigned to the correct pool. - A **NO\_POOLED\_AGENTS\_ASSIGNED\_NAMED\_POO**L error indicates that no Bridge agents are assigned to the named pool configured for your site. Assign an active Bridge client to resolve this. - If the **Edit Data Source** button is greyed out, the data source uses a non-named connector for which editing via web authoring is not currently supported. ## Bridge for Linux Tableau Bridge supports a Linux-based operating system designed for container workloads. Limitations and differences include: - Bridge for Linux does not support legacy schedules. - Bridge for Linux runs in the background, which is the equivalent to Service mode in Tableau Bridge on Windows. - To save log files, copy the files or folders between your docker container and your local file system. - Currently, Bridge for Linux is installed by running commands in a running container using Docker executables. - Bridge for Linux does not support Window integrated authentication. - Bridge for Linux only supports Exchange Connectors that have a Linux Driver. ### Connecting to flat files and file-based extracts As of February 2025 release, you can configure Bridge for Linux to connect to remote shares. Unlike workbooks, which can sometimes "Include External Files" as a static upload, published data sources connected to flat files require Tableau Bridge for all refresh activity: - Tableau Cloud does not support embedding physical flat files within a standalone published data source. - When publishing, ensure the data source points to a full UNC path (e.g., \\\\InternalServer\\Data\\file.xlsx). If "Include External Files" is selected during the publishing of a standalone source, it may cause Bridge to look for the file in a temporary cloud directory that does not exist, leading to refresh failures. Always leave "Include External Files" unchecked when publishing standalone data sources intended for Bridge refresh. ![](/tableau/next/en-us/online/en-us/Img/to_bridge_liinux_map_drive_557x470.png "to") #### Configure remote share 1. Create and set access permissions on the remote share. For example, `SharedWB_1`. The resulting UNC path for this computer, host1, would be `//host1/SharedWB_1`. 2. On the host computer where you are running the Bridge client, mount the remote share on the local file system. For example, `/mnt/remotes/H1_WB`. 3. In a text file create a UNC map using the format: `//:/`. For example, `//host1/SharedWB_1:/mnt/remotes/H1_WB`. 4. Configure the remote share for the Docker contain by including the following content in the Docker file. The example remote share configuration below corresponds to the diagram above. dnf install -y cifs-utils export CRED=/mnt/remotes/creds/ mkdir -p $CRED && chmod 700 $CRED # Prepare credential files for host\_1 ($CRED/.h1) and host\_2 ($CRED/.h2) # credential file format should be: # username=... # password=... chmod 600 $CRED/.h1 chmod 600 $CRED/.h2 # Add these CIFS entries to /etc/fstab (this will be automatically mounted on # reboot) cat >> /etc/fstab << EOE //host\_1/SharedWB\_1 /mnt/remotes/H1\_WB cifs credentials=/mnt/remotes/creds/.h1 0 0 //host\_1/SharedDS\_1 /mnt/remotes/H1\_DS cifs credentials=/mnt/remotes/creds/.h1 0 0 //host\_2/SharedWB\_1 /mnt/remotes/H2\_WB cifs credentials=/mnt/remotes/creds/.h2 0 0 //host\_2/SharedDS\_1 /mnt/remotes/H2\_DS cifs credentials=/mnt/remotes/creds/.h2 0 0 EOE # and mount fstab entries mount /mnt/remotes/H1\_WB mount /mnt/remotes/H1\_DS mount /mnt/remotes/H2\_WB mount /mnt/remotes/H2\_DS # Create the UNC map file cat > /mnt/remotes/uncmap << EOM //host\_1/SharedWB\_1:/mnt/remotes/H1\_WB //host\_1/SharedDS\_1:/mnt/remotes/H1\_DS //host\_2/SharedWB\_1:/mnt/remotes/H2\_WB //host\_2/SharedDS\_1:/mnt/remotes/H2\_DS EOM The Bridge client periodically reads from the UNC map file to check for changes. To avoid Bridge restarting after changes, keep your mounted directories and location of the UNC map file in the same directory. 5. Run the following to finish the configuration: docker container run \\ ... -e TABLEAU\_BRIDGE\_UNC\_MAP\_OVERRIDE='/mnt/remotes/uncmap' \\ --mount type=bind,source="/mnt/remotes",target=/mnt/remotes \\ ... ## Authentication The connected client option must be enabled for the site to allow Bridge clients to run unattended and, if enabled, support multi-factor authentication with Tableau authentication. If connected clients are disabled for the site, Bridge can only support Tableau username and password authentication. **OAuth** - Tableau Bridge for Windows and Bridge for Linux do not support OAuth for Azure SQL, Azure Synapse, and Dremio. - OAuth with embedded data sources and published data sources for Google Drive and OneDrive is supported. - When using your own identity provider (IdP) with the Amazon Athena connector, you must set up the OAuth client configuration file. See [Use your own identity provider with Amazon Athena](https://help.tableau.com/current/pro/desktop/en-us/amazon_athena_idp.htm). **Windows Authentication** The Windows user account must be a member of the local admin group to run the client in service mode. If the user isn’t a local admin, they can run the Bridge client in Application mode, but they must remain logged in to the Windows machine. **Kerberos** Bridge on Windows supports Integrated Windows authentication through the "run-as" account, for both files and some databases. **Note:**Tableau Bridge does not support SQL impersonation using Initial SQL. ## Other articles in this section [Skip to main content](#main-content) # Control Access to Explain Data Your access to Explain Data will vary depending on your site role and content permissions. Explain Data is always available to authors in Tableau Desktop. Authors with appropriate permissions can run Explain Data in editing mode in Tableau Cloud and Tableau Server. Authors can also control whether Explain Data is available in viewing mode in published workbooks and which explanation types are displayed. Be aware that Explain Data can surface values from dimensions and measures in the data source that aren't represented in the view. As an author, you should run Explain Data and test the resulting explanations to make sure that sensitive data isn't being exposed in your published workbooks. ## Who can access Explain Data Explain Data is enabled by default at the site level. Server administrators (Tableau Server) and site administrators (Tableau Cloud) can control whether Explain Data is available for a site. For more information, [Disable or Enable Explain Data for a Site](https://help.tableau.com/v0.0/online/en-us/explain_data_enable.htm).

Mode

Who Can Access

Viewing mode

Tableau Viewers, Explorers, and Creators who have the Run Explain Data permission capability can run and explore Explain Data explanations in viewing mode.

Editing mode

Tableau Creators can run Explain Data when editing a view in Tableau Desktop, Tableau Cloud, or Tableau Server. Explorers who have the Run Explain Data permission capability and editing permissions can run Explain Data when editing a workbook in Tableau Cloud or Tableau Server.

Creators and Explorers who have editing permissions can open new worksheets for further analysis.

They also can use Explain Data Settings to control who can use Explain Data and what they can see.

## Control who can use Explain Data and what they can see A combination of settings must be enabled to make Explain Data available in editing mode and viewing mode in Tableau Cloud and Tableau Server. ### Editing mode Requirements for authors to run Explain Data or edit Explain Data settings in editing mode: - Site setting: Availability of Explain Data set to Enable. Enabled by default. - Site role: Creator, Explorer (can publish) - Permissions: Run Explain Data capability set to Allowed. Unspecified by default. If you open a workbook (Tableau version 2022.1 or earlier) that used this permission in Tableau version 2022.2 or later, you will need to reset the Run Explain Data capability to Allowed. **Note:** The Download Full Data capability for a Creator or Explorer (can publish) controls whether they see the View Full Data option in Extreme Values explanations. Viewers are always denied the Download Full Data capability. However, all users can see record-level details when the Extreme Values explanation type is enabled in Explain Data settings. Creators and Explorers with editing permissions and the Run Explain Data permission capability can access **Explain Data Settings**, which provide options for controlling: - The [explanation types that are displayed](#ControlExpTypes) in the Data Guide pane. - The [fields that are included in, or excluded from](#ControlFields) statistical analysis. These options are set for the entire workbook and can only be set in the Explain Data Settings dialog box. ### Viewing mode Requirements for all users to run Explain Data in viewing mode: - Site setting: Availability of Explain Data set to Enable. Enabled by default. - Site role: Creator, Explorer, or Viewer - Permissions: Run Explain Data capability set to Allowed. Unspecified by default. If you open a workbook (Tableau version 2022.1 or earlier) that used this permission in Tableau version 2022.2 or later, you will need to reset the Run Explain Data capability to Allowed. **Note**: To see explanations of Detected Outliers in the Data Guide, users of a viz must have the Explain Data permission allowed for the workbook or view. The owner of the workbook will need to open the permissions settings for this workbook in Tableau Server or Tableau Cloud and allow the Explain Data permission to that user. ### Open the Explain Data Settings dialog box 1. From the Analysis menu, choose Explain Data Settings. Or, in the Data Guide pane, click the settings icon (bottom right). ![Explain Data settings icon, depicted as a gear.](/tableau/next/en-us/online/en-us/Img/explaindata_settingsbutton.png) ### Include or exclude explanation types displayed by Explain Data Creators and Explorers who have editing permissions can choose to exclude (or include) explanation types displayed for all workbook users. 1. In the **[Explain Data Settings](#OpenEXDsettings)** dialog box, click the Explanation Types tab. ![A list of Explain Data explanation types with checkboxes to select or deselect each type.](/tableau/next/en-us/online/en-us/Img/explaindata_explanationtypes.png) 2. In the list of explanation types, select or clear an explanation type. 3. Click OK. Test the setting by saving and closing the published workbook, and then opening a view from the workbook in viewing mode. Select a mark that typically has Extreme Value explanations, and then run Explain Data to check the explanation results. ### Include or exclude fields used for statistical analysis Creators or Explorers who have editing permissions can choose to exclude (or include) fields that are eligible for analysis. 1. In the Data Guide pane (bottom right), choose the settings icon. Or, choose the Edit button in the [Analyzed Fields view](https://help.tableau.com/v0.0/online/en-us/explain_data_lm_status.htm#ViewAnalyzed). ![Edit button on the Analyzed Fields pane.](/tableau/next/en-us/online/en-us/Img/explaindata_editfields.png) 2. In the **[Explain Data Settings](#OpenEXDsettings)** dialog box, click the Fields tab. 3. In the list of fields under Include, click the drop-down arrow and select Automatic to include an eligible field every time Explain Data runs for that workbook. Note that fields must have less than 500 unique values to be included in the analysis. ![Explain Data Settings window with a measure selected and the dropdown menu expanded to reveal options for including or excluding the field.](/tableau/next/en-us/online/en-us/Img/explaindata_excludefield.png) Select Never Include to explicitly exclude the field. Select Include None to run a statistical analysis on the data without considering fields. Select Reset to return to the default settings. 4. Click OK. Test the setting by saving the published workbook. Select a mark, and then run Explain Data to check the explanation results. ## Configure Tableau to allow users to share explanations via email and Slack Tableau administrators can control whether explanations can be shared in viewing mode via email or Slack to other Tableau users. Follow these steps to allow notifications and sharing via email and Slack in Tableau Cloud or Tableau Server: 1. Click Settings. 2. On the General tab, scroll down to Manage Notifications. 3. For Collaboration, select Share for On Tableau, Email, and Slack. To share explanations via Slack, the Tableau app must be set up for your Slack workspace. Sharing explanations with Slack is enabled by default in Tableau Cloud. In Tableau Server, an administrator will need to set up the Tableau app for Slack. For more information, see [Integrate Tableau with a Slack Workspace](https://help.tableau.com/current/server/en-us/slack_admin.htm). [Skip to main content](#main-content) # Create a Data Policy for Row-Level Security Use a data policy to apply row-level security to one or more tables in a virtual connection. A data policy filters the data, ensuring that users see only the data they're supposed to see. Data policies apply to both live and extract connections. ## About data policies A data policy has three main components: ![An example of the three components of a data policy in the virtual connection editor](/tableau/next/en-us/online/en-us/Img/dm_vconn_policy_components.png) 1. The tables it applies to, called policy tables. These are the tables that are filtered. 2. The mapped columns that define the relationships between tables (for example, between entitlement and fact tables) and between table columns and policy columns. A policy column is the column used to filter data. 3. The policy condition, which is an expression or calculation that is evaluated for every row at query time. If the policy condition is TRUE, then the row is shown in the query. When you create a data policy, you need a column you can use to filter the data. This column is called a policy column. Data is filtered by the policy condition, usually using a user function, such as USERNAME() or FULLNAME(). If your policy table includes a column that you can filter on, then use that column as your policy column. When a policy table doesn't include such a column, use an entitlement table with a column you can use to filter the data. An entitlement table is a table that includes both a policy column you can use to filter policy tables and another column you can relate (map) to a column in a policy table (as shown in the data policy example image above). ## Filter with a policy column from a policy table The most common way to filter data is to use a column in the table that has the data that you want to filter on. Use that column as a policy column and then map the appropriate table columns to the policy column. To use a policy column to filter your data, first, add tables to the policy from the left pane. To add a table, do one of the following: - Double-click the table name. - Click the drop-down arrow near the table name and select Manage table with policy. - Or, drag the table to the right and drop it on Add as Policy Table. After a table is added to a policy, a shield icon ![Data policy icon](/tableau/next/en-us/online/en-us/Img/dm_vconn_shield_18.png) appears to the right of the table name in the left pane indicating that it's a policy table. Next, map columns to create a relationship between the column name in the table and the policy column name. Use the policy column name in the data policy condition to control row-level data access for users: 1. Click +Add Column to Map to add one or more columns you'll use to filter data. 2. Name the policy column. You'll use this name in the policy condition. 3. For each table the policy applies to, use the drop-down menu to select the table column that maps to the policy column. 4. Repeat this process for as many policy columns as you want to use in the policy condition. Your browser does not support the video tag. > [!TIP] > > Instead of using the +Add Column to Map button, you can start typing the calculation in the policy condition area and use auto-complete to choose the column name, which will then populate the policy column information under Step 1. Your browser does not support the video tag. ### An example using a policy column from a policy table ![Diagram of a data policy that uses a policy column from a policy table to filter data](/tableau/next/en-us/online/en-us/Img/dm_vconn_policy_table_diagram.png) 1. The Sales table has a \[Salesperson\] column, and the Region table has a \[SalesRep\] column. The Salesperson and SalesRep data matches the full name of Tableau users on your site. 2. You want to filter the Sales and Region data by Salesperson, so you name the policy column "Salesperson" and then map the Salesperson column from Sales and the SalesRep column from Region to the Salesperson policy column. 3. Then write the policy condition to filter both tables. Use the \[Salesperson\] policy column and the FULLNAME() user function so that each user can see only their own data. ## Filter with policy column from an entitlement table Entitlement tables are used when your policy table doesn't contain a column you can filter on. You can use the entitlement table to map a column in the data table to a column in the entitlement table. Note the following: - Be sure to include the entitlement table as a table in the virtual connection. You can use a table from any connection or database as a central entitlement table that secures tables across many other databases. In some cases, an entitlement table that's in the same database as the tables you're securing can be a potential security risk because of the potential for exposing employee data. And having an entitlement table in a different database can make it easier to control permissions, for example, to grant someone access to a database. - If you don't want virtual connection users to see the entitlement table, you can toggle the setting in the Visibility column on the Tables tab to hide it. Once hidden, the entitlement table is still available for policy filtering but can't be used in vizzes or workbook data sources. **Note**: Connecting directly to a flow output (.hyper file) is not supported for the entitlement table. The flow output must write directly to the database. To use an entitlement table to filter your data: 1. Add the data tables that you want the data policy to apply to. Do one of the following: - Double-click the table name. - Click the drop-down arrow near the table name and select Manage table with policy. - Or, drag the table to the right and drop it on Add as Policy Table. 2. After a table is added to a policy, a shield icon ![Data policy icon](/tableau/next/en-us/online/en-us/Img/dm_vconn_shield_18.png) appears to the right of the table name in the left pane indicating that it's a policy table. 3. Select the entitlement table, then either: - Click the drop-down arrow and select Use as entitlement table. - Or, drag the table to the right and drop it on Add as Entitlement Table. 4. For each table that the policy applies to, click the drop-down menu and select the column to map the policy table to the entitlement table. Your browser does not support the video tag. ### An example using a policy column from an entitlement table ![Diagram of a data policy that uses a policy column from an entitlement table to filter data](/tableau/next/en-us/online/en-us/Img/dm_vconn_entitlement_diagram.png) 1. The data you want to filter has an EMP\_ID column, but not an employee name column. However, you have a second table that includes columns for both EMP\_ID and the employee's FULL NAME. And, the values in the employee FULL NAME column match the full name of Tableau users on your site. 2. You can add Employees table to the policy as an entitlement table, and then map the policy table column name EMP\_ID to the entitlement column name EMP\_ID for each table. 3. Then use the FULLNAME() function in your policy condition to match the Tableau Server user's full name with the entitlement table's \[FULL NAME\] column (which is the policy column) so that each user can see only their own data. ## Write a policy condition The last step in creating a data policy is to write a policy condition, which is a calculation or expression used to define row-level access. Policy conditions are often used to limit access to users or groups through user functions. A policy condition: - Is required in a data policy. - Must evaluate to true or false. - Shows rows when the policy condition is true. When you close a policy tab, it doesn't discard your work. ### Policy condition examples Shows only rows where the Region column value is North: `[Region] = "North"` Enables a signed-in user to see the rows where the user's name matches the value in EmployeeName: `FULLNAME() = [EmployeeName]` Enables members of the Managers group to see all rows, while users can see only the rows where their username matches the value in the employee\_name column: `ISMEMBEROF('Managers') OR USERNAME() = [employee_name]` ### Supported Tableau functions in policy conditions Policy conditions support a subset of Tableau functions: - Logical (except null-related) - String - User - Date - Number: MIN, MID, MAX To see which specific functions are supported, in the virtual connection editor, on the Data Policies tab, see the Reference panel on the right. **Note**: If the virtual connection has a data policy that contains [user functions](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_user.htm) (for example, `USERNAME()`) and you connect to it from a workbook or data source and create an extract there, the extract will contain only the rows that match the virtual connection data policy at the time the extract is created. To take advantage of a virtual connection with user functions in the data policy, use a live connection from the workbook or data source to the virtual connection instead of an extract. ## Who can do this To create a data policy, you must - have credentials to the database that the virtual connection connects to, and - be a server or site administrator, or a Creator. ## Next steps After you create a data policy, the next step is to verify that it works as you expect it to. See [Test Row-Level Security with Preview as User](https://help.tableau.com/v0.0/online/en-us/dm_vconn_test_preview.htm). Or, if you're ready to share the virtual connection and its data policies with others, see [Publish a Virtual Connection and Set Permissions](https://help.tableau.com/v0.0/online/en-us/dm_vconn_publish_save.htm). ## Resources For detailed information about calculations, see [Understanding Calculations in Tableau](https://help.tableau.com/current/pro/desktop/en-us/calculations_calculatedfields_understand.htm) in the Tableau Desktop and Web Authoring help. For information about user functions, see [User Functions](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_user.htm) in the Tableau Desktop and Web Authoring help. For information about other row-level security options in Tableau, see [Overview of Row-Level Security Options in Tableau](https://help.tableau.com/current/server/en-us/rls_options_overview.htm) in the Tableau Server help. [Skip to main content](#main-content) # Create a Group and Add Users to It As a site admin, you can organize Tableau Cloud users into groups to make it easier to manage multiple users. Groups can also be used by users (such as site admins, project owners, and content owners) to apply permission rules for Tableau content. Users can belong to multiple groups. ## Create a group 1. On a site, click **Groups**, and then click New Group. 2. Type a name for the group. ![New Group form with options for group name, on demand access, and licensed users.](/tableau/next/en-us/online/en-us/Img/online_new_group.png) 3. Optionally, do one or both of the following: 1. If your site is licensed with the [Embedded Analytics](https://help.tableau.com/v0.0/online/en-us/license_product_keys.htm#embedding) usage-based model, select the Allow on-demand access check box to enable the on-demand access capability for embedding workflows. For more information, see one of the following: [On-demand access using connected apps with direct trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_direct.htm#ondemand) or [On-demand access using connected apps with OAuth 2.0 trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_eas.htm#ondemand). 2. Select Grant role on sign in and select a minimum site role for the group. For more information, see [Grant License on Sign In](https://help.tableau.com/v0.0/online/en-us/grant_role.htm). 4. Click Create. **Note:** Every user (excluding users with on-demand access) added to a Tableau Cloud site becomes a member of the All Users group automatically. The All Users group exists in every site by default. You cannot delete this group, but you can set permissions for it. ## Add users to a group (Users page) - On a site, click Users. - Select the users you want to add to the group, and then select Actions > Group Membership. ![A user list with display names, two of which are selected to be part of a group action.](/tableau/next/en-us/online/en-us/Img/users7.png) - Select the groups and then click Save. ## Add users to a group (Groups page) - From the left navigation pane, click **Groups**, and then click the name of the group. - On the Group's page, click **Add Users**. ![Group page showing the Add Users button.](/tableau/next/en-us/online/en-us/Img/groups_addusers.png) - Select the users to be added, and then click **Add Users**. ![Add Users screen with a checkbox before each user name.](/tableau/next/en-us/online/en-us/Img/groups_addusers2.png) ## Dynamic group membership using assertions Beginning in June 2024 (Tableau 2024.2), if you have OIDC or SAML authentication configured; or use Tableau connected apps or unified access tokens (UATs) for embedding workflows, you can dynamically control group membership through assertions. When configured, at runtime during user authentication, Tableau receives the assertion and then evaluates membership in groups and thus the content whose permissions are dependent on those groups. Users are assigned to group based on the assertion and membership is only effective while the users are signed in. The process to dynamically control group membership through assertions requires 1) enabling the setting and 2) ensuring the group membership claims are included in the assertions. **Note:** Users added dynamically through assertions do not appear as users in Tableau Cloud. ### Step 1: Turn on the setting For security purposes, group membership is only validated in an authentication workflow if the site setting is turned on. 1. Sign in to Tableau Cloud and go to Settings > General. 2. Under Assertions for Group Membership heading, select the Allow group assertions to enable group membership through SAML, OIDC, or JWT assertions check box. ![](/tableau/next/en-us/online/en-us/Img/abac_assertions_setting_cloud.png) 3. Then select the applicable assertion type check box to enable. For more information about site settings, see [Assertions for Group Membership](https://help.tableau.com/v0.0/online/en-us/sites_add.htm#assertions). ### Step 2: Ensure group membership claims are included in the assertion Two custom group membership claims must be included in the respective OIDC, SAML or JWT assertion (using Tableau connected apps or unified access tokens) to specify group membership. The two custom group membership claims are: - Group: `https://tableau.com/groups` - Group names. These names should match local group names in Tableau Cloud exactly. **Note:** Group sets can't be asserted. For example assertions, refer to one of the following sections: - [Dynamic group membership in OIDC claims](https://help.tableau.com/v0.0/online/en-us/openid_auth.htm#assertions) - [Dynamic group membership using SAML assertions](https://help.tableau.com/v0.0/online/en-us/saml_online_requ.htm#assertions) - Connected apps - direct trust: [Example JWTs](https://help.tableau.com/v0.0/online/en-us/connected_apps_direct.htm#example) - Connected apps - OAuth 2.0 trust: [Step 1: Before you begin](https://help.tableau.com/v0.0/online/en-us/connected_apps_eas.htm#jwt) [Skip to main content](#main-content) # Create a Subscription to a View or Workbook Subscriptions email you an image or PDF snapshot of a view or workbook at regular intervals—without requiring you to sign in to Tableau Cloud. **Note**: If Tableau Catalog is turned on for a site, administrators can determine whether subscription emails include relevant upstream data quality warnings. Tableau Catalog is available as part of the Data Management offering. For more information, see [About Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_overview.htm). ## Tableau Cloud SMTP addresses To ensure subscription emails are delivered successfully, your company's security software and policies must allow emails from the domain `@cloudmail.tableau.com` and IP addresses 54.240.86.205, 54.240.86.204, 54.240.119.142, and 54.240.119.141. Subscriptions that can't be delivered may result in the recipient being temporarily blocked. If your Tableau site uses a custom SMTP server, have your site administrator confirm that your company allows emails from the specified email and domain values in site settings, in addition to IP addresses 155.226.128.24/32, 155.226.128.25/32, and 155.226.128.26/32. ## Set up a subscription for yourself or others When you open a view in Tableau Cloud, if you see a subscription icon (![Subscribe icon.](/tableau/next/en-us/online/en-us/Img/subscribe_icon.png)) in the toolbar, you can subscribe to that view or to the entire workbook. You can subscribe other users who have permission to view the content if you own a workbook, if you are a project leader with an appropriate site role, or if you are an administrator. **Note:** Data refresh-initiated subscription emails are not supported for views or workbooks that rely on data sources that use Bridge to keep data fresh. 1. From the Explore section of your site, select All Workbooks or All Views, or open the project that contains the view you want to subscribe to. ![Content type menu](/tableau/next/en-us/online/en-us/Img/subscribe_content_1a.png) 2. Open a view either directly, or after opening the containing workbook. Any filters you apply to the view won't be reflected in the subscription. To subscribe users to a filtered view, save a custom view with those filters, then subscribe users to that view. For information about creating custom views, see [Use Custom Views](https://help.tableau.com/v0.0/online/en-us/customview.htm). 3. On the view toolbar, select Watch > Subscriptions. ![Subscription path on the Tableau Cloud toolbar.](/tableau/next/en-us/online/en-us/Img/subscribe_toolbar.png) 4. Add the Tableau users or groups you want to receive the subscription. To receive a subscription, users must have the View and Download Image/PDF permissions. If you own the workbook, select Subscribe me. Notes: - When you subscribe a group, each user is added individually at the time the subscription is created. If more users are added to the group later, you must re-subscribe the group for those new users to receive the subscription. Likewise, users later removed from the group will not have their subscriptions removed automatically unless their permissions to the subscribed view are removed. - You can't subscribe a group set. 5. Choose whether subscription emails include the current view or the entire workbook. If the view contains data only when high-priority information exists, select Don't send if view is empty. 6. Choose the format for your snapshot: as a PNG image, a PDF attachment, or both. Note that Pulse metrics are included in PNG snapshots but not in PDFs. - If PDFs, choose the paper size and orientation you'd like to receive. ![A PDF format menu with dropdown lists for paper size and orientation.](/tableau/next/en-us/online/en-us/Img/subscription_paper.png) 7. To clarify subscription emails, customize the subject line, and add a message. **Note:** To update the subscription message, you must unsubscribe from the existing subscription and create a new subscription with a different message. For more information, see [Update or unsubscribe from a subscription](#Unsubscribe). 8. When the workbook uses one data extract on a published connection, you can pick a frequency: - When Data Refreshes: Sends only when data in the view or workbook is refreshed by running refresh schedules. - On Selected Schedule: Pick a schedule for the subscription. 9. If frequency is not set to When Data Refreshes, click the drop-down arrow to the left of the current settings to pick a schedule: ![The schedule is five days a week at 8:00.](/tableau/next/en-us/online/en-us/Img/subscribe_options_online_sched.png) Then specify a custom schedule that sends subscription emails whenever you wish. (The precise delivery time may vary if server load is high.) ![A scheduler configured to repeat every hour, Monday through Friday, from 9:00 to 17:00.](/tableau/next/en-us/online/en-us/Img/self_subscribe_topic.png) To change the time zone, click the Time Zone link it to go to your account settings page. 10. Click Subscribe. When you receive a subscription email, you can select the image (or the link in the message body for PDF subscriptions) to be taken to the view or workbook in Tableau Cloud. ## Update or unsubscribe from a subscription You can unsubscribe from an existing subscription, or make changes to a subscription’s format, schedule, subject, or empty view mode. 1. Access your Tableau Cloud account settings by doing one of the following: - Click Manage my subscriptions at the bottom of a subscription email. ![Link to manage your subscription.](/tableau/next/en-us/online/en-us/Img/subscribe_remove.png) - Sign in to Tableau Cloud. At the top of the page, select your user icon, and then select My Content. ![Subscription menu with options for My Content.](/tableau/next/en-us/online/en-us/Img/subscribe_remove2.png) 2. Click Subscriptions. 3. Select the check box next to the view you want to unsubscribe from, click Actions, and then click Unsubscribe, or select the subscription option you'd like to change. ## Resume or delete suspended subscriptions Sometimes, subscriptions fail because of an issue with the workbook or a problem loading the view. If a subscription fails more than five times, you'll receive a notification email that your subscription has been suspended. There are a few ways to resume a suspended subscription if you're a subscription owner or administrator: - From the My Content area of Tableau web pages, an icon appears in the Last update column to indicate that the subscription is suspended. Select ... > Resume Subscription to resume. - From the Subscriptions tab of the affected workbook, an icon appears in the last update column to indicate that the subscription is suspended. Select ... > Resume Subscription to resume. You'll receive an email notification when the subscription is working again. ## See also [Change subscription settings](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm#change-subscription-settings) in the Tableau Desktop and Web Authoring Help. [Project-level administration](https://help.tableau.com/current/online/en-us/projects.htm#project-admin "Link opens article in a new browser tab") in the Tableau Cloud Help, to learn which site roles allow full Project Leader capabilities. [Skip to main content](#main-content) # Create a Tableau Data Story (English Only) **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). If you've ever written an executive summary of your Tableau dashboard, then you know it can be time-consuming. It takes time to choose which insights to share, and you have to rewrite your summaries each time the data is updated. Tableau Data Stories automatically generates narrative insights within your dashboard, saving time and surfacing relevant insights. As you explore the vizzes in your dashboard, the stories written by Data Stories adjust, allowing you to dive deeper into data and identify key insights faster. From where you're already working in Tableau, you can quickly add the Data Story object to your dashboard. And you can customize the terms and metrics used in your story, so Data Stories speaks the language used by your business. Today, you can write and view a Tableau Data Story anywhere you use Tableau. After you create your story, you can also view your Data Story in Tableau Mobile. However, Data Stories aren't included if you export your dashboard, for example to a PDF. ## Understand how Data Stories handles data To write Data Stories, Tableau uses a service hosted in your Tableau Cloud or Tableau Server environment. When you [Add a Tableau Data Story to a Dashboard](https://help.tableau.com/v0.0/online/en-us/data_stories_create.htm) or view a Data Story from a dashboard, Tableau sends associated worksheet data to the environment that you're logged in to (i.e., your Tableau Cloud site or your Tableau Server instance), using the security standards outlined in [Security in the Cloud](https://help.tableau.com/current/online/en-us/to_security.htm) and [Security in Tableau Server](https://help.tableau.com/current/server/en-us/security.htm). Data Stories can be written and viewed from anywhere you use Tableau. ## Learn about how Data Stories are written Tableau Data Stories is powered by rules-based templated natural language generation (NLG). Data Stories performs automated analytics to determine relevant and accurate facts about the underlying data–from basic calculations to more advanced statistics. To write a story, Data Stories uses a library of predefined language templates to synthesize these facts into natural language insights. Data Stories processes these templates at run-time, using the most up-to-date summary data from the Tableau worksheet it is connected to. You can leverage the [custom language feature](https://help.tableau.com/current/pro/desktop/en-us/data_stories_customize.htm) to generate your own language templates, add functions, and define business rules, helping you build a more relevant and contextual Data Story. **Note:** Data Stories doesn't use generative AI, large language models (LLMs), or machine learning to write insights and stories. ## Manage Data Stories for your site Tableau administrators can choose whether Tableau Data Stories are available for their site. Data Stories are turned on by default. 1. Sign in to your Tableau site. 2. From the left pane, choose **Settings**. 3. From the **General** tab, scroll to the **Availability of Data Stories** section. 4. Choose whether you want to **Turn on** or **Turn off** Data Stories. **Note:** If Data Stories are turned off, then turning the feature back on restores Data Stories that were already in dashboards. ## Other articles in this section [Skip to main content](#main-content) # Create a Virtual Connection A virtual connection is a Tableau content type that provides a sharable central access point to data, and supports row-level security at the connection level. Creating a virtual connection is a multi-step process. This topic covers connecting to the data you want to share and working in the Tables tab of the virtual connection editor. ## Connect to data To create a virtual connection in Tableau Cloud or Tableau Server: 1. From the Home or Explore page, click New \> Virtual Connection. 2. In the Connect to Data dialog box, select the connector for your data. For a list of supported connectors for virtual connections, see [Creators: Connect to Data](https://help.tableau.com/current/pro/desktop/en-us/creator_connect.htm#connector_list) in the Tableau Desktop and Web Authoring help. 3. Enter the information you're prompted for. The credentials you enter are saved in the virtual connection, so connection users don't have to enter credentials to connect to the data. 4. Click Sign In if prompted. To add another connection, click ![The add a connection plus sign in the virtual connection editor](/tableau/next/en-us/online/en-us/Img/ipa_vconns_add_connection_plus.png) and select a connector, enter credentials, and sign in. A virtual connection can have multiple connections. Each connection accesses one database or file. **Note:** For Tableau Cloud, virtual connections that connect to private network data use Tableau Bridge to keep data fresh. For information about configuring Tableau Bridge, see [Configure and Manage the Bridge Client Pool](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm). For information about supported connections, see [Connectivity with Bridge](https://help.tableau.com/current/online/en-us/to_sync_local_data.htm). ## Add another connection As needed, add another connection to a virtual connection and connect to more than one database by clicking ![The add a connection plus sign in the virtual connection editor](/tableau/next/en-us/online/en-us/Img/ipa_vconns_add_connection_plus.png) next to **Connections**. You can add a connection to a different server or database, or to the same server or database. With multiple connections, you can: - Use a table from any connection or database as an entitlement table in a data policy that secures tables from other connections and databases. - Add or replace tables in a virtual connection with tables from a different database. For example, say you migrate data from one database to another. In the virtual connection editor, you can add a connection to the second database and replace the existing tables from the first database with tables from the second one. - Add multiple connections to the same server or database. This can be helpful when you need to for example access data from the same database but with different credentials. - Share a group of tables that are related or meant to be used together, no matter where they're physically located. For example, from multiple databases you can group tables related to employee information. When you open a virtual connection to edit it, if prompted you must authenticate connections in sequence. If any connections fail to authenticate, you can't edit the virtual connection. ## Select tables to include in the connection If necessary, select a database to view the tables in it. 1. On the left, under Tables, select the tables and click or drag them to the Tables tab on the right. You can include tables from different connections. Include an entitlement table, if you're using one. 2. (Optional) Click New Custom SQL to create a custom table schema. **Note:** Virtual connections don't support tables with a spatial data type. ## Select live or extract mode for tables You can set individual tables—whether they're from multiple connections or not—to either live or extract mode in the same virtual connection. - Live\- Tables are queried directly from the database. (Live is the default.) - Extracts\- Tables are extracted and saved to Tableau. As an example, you can set some tables to extract mode so that they're not impacted by report generation or heavy customer traffic. Under Tables, select the table or tables you want to change the mode for and select Actions, and Change to Live or Change to Extract. Alternatively, select the Actions Menu (...) in the table's row and select Live or Extract. ### Incremental Extracts Starting in Tableau Cloud June 2024 and Tableau Server 2024.2, you can configure table extracts for incremental refresh. When configuring an incremental extract, you specify a key column that is used to identify new rows. When the incremental extract is refreshed, only the rows where the key column has increased will be added to the extract. Fewer rows processed means a faster extract refresh job and less load on the database. For example, suppose we have an extract for the **Batters** table, and the data in the extract is:

Year	Team
1978	Lions
1979	Tigers

The **Batters** table is configured for incremental extract refresh, and the key column is **Year**. The live table is updated with a new row for **1980**:

Year	Team
1978	Lions
1979	Tigers
1980	Bears

When the **Batters** table's extract is refreshed incrementally, only rows that exceed the greatest value in the extract's key column are added. In this case, that means that the **1980** row is added to the extract. Instead of refreshing the entire extract file, only 1 row is processed and appended. You can still do a full refresh on an extract configured for incremental refresh if you want to refresh the entire extract. To configure incremental refresh for a table extract: 1. Change the table from Live to Extract. 2. Select the Actions Menu (...) in the table's row and select Extract Settings.... 3. Check Enable incremental refresh. 4. Select an incrementing column to use when determining which rows to add. 5. Select Save Settings. ![Extract settings dialog with incremental refresh enabled](/tableau/next/en-us/online/en-us/Img/vconn-extract-settings.png) ### Convert to Custom SQL Starting in Tableau Cloud June 2024 and Tableau Server 2024.2, you can approximate the SQL used to connect to a table and use that as a starting point for your own custom SQL. Custom SQL allows you to filter or make other query changes that can modify the result set. Creating custom SQL this way instead of using New Custom SQL in the data pane is less impactful to existing virtual connections. Downstream assets see the table as the same table instead of a new one. To convert a table to custom SQL: 1. Select the Actions menu (...) in the row for the table. 2. Select Convert to Custom SQL. 3. In the Edit Custom SQL dialog, edit the SQL as needed. 4. Select Generate Table. Note: The SQL that first appears in the dialog should be considered a starting point, and may not work without modification. The virtual connection editor lacks nuanced information about the specific SQL syntax used in the connection. If you encounter errors when selecting the Generate Table button, try removing or changing single quotes, double quotes, back quotes, and square brackets to make the SQL compliant with the database you're using. To edit the custom SQL: 1. Select the Actions menu (...) in the row for the table. 2. Select Edit Custom SQL. 3. In the Edit Custom SQL dialog, edit the SQL. 4. Select Generate Table. To return the table to its default state, without custom SQL: 1. Select the Actions menu (...) in the row for the table. 2. Select Replace. 3. In the replace table dialog, select the original table name. 4. Select OK. ### Extract table data After a table or tables are changed from live to extract but haven't been extracted yet, click Create Pending Extracts to run the pending extracts. After all pending extracts are run, click Refresh All Extracts to extract all table data at that time. Alternatively, in Tableau Cloud June 2024 or Tableau Server 2024.2 and later, select the Actions Menu (...) in the table's row and select Refresh Extract.... If incremental refresh is not configured for the table, you can only select Refresh (Full). If incremental refresh is configured, you can choose either Refresh (Full) to refresh the extract completely, or Refresh (Incremental) to incrementally refresh the extract. You must run any pending extracts before you publish the virtual connection. You can't edit the connection while extracts are generated. Schedule extract refreshes of the tables in your virtual connection on the virtual connection page after you publish the connection. See [Schedule Extract Refreshes for a Virtual Connection](https://help.tableau.com/v0.0/online/en-us/dm_vconn_extract.htm). ## Set the table visibility state Use the Visibility toggle on the Tables tab to show or hide tables and their data from users. ![Check mark means show](/tableau/next/en-us/online/en-us/Img/ipa_vconn_check_mark_show.png) Users can see table data. You can create a data policy to govern which data users can see. (Visible is the default.) ![X means hide](/tableau/next/en-us/online/en-us/Img/ipa_vconn_x_hide.png) Users can't see table data. You can use hidden tables in a data policy and as an entitlement table. ## See table details Click a table at the top of the Tables tab to see its details. You can make simple edits in the Table Details section, such as change a table name, hide or rename a column, or change a data type. Switch the table information you see using these icons:

	A list of columns in the table and each column's data type.
	Sample data for each column and linked keys, if available. Linked keys show which columns link to other tables. They're visible only when databases have primary and foreign key information.
	The range of values in a histogram for each column selected.

Your browser does not support the video tag. ## Refresh data from the database Click the refresh icon ![The refresh icon on the virtual connection editor toolbar](/tableau/next/en-us/online/en-us/Img/ipa_vconns_refresh_icon.png) in the toolbar to get the latest data from the database for all the connections in a virtual connection, including: - The lists of databases, tables, and columns. Both the tables included in a virtual connection and not included are refreshed. - Table and histogram data. For tables in live mode, refreshing retrieves the latest list of databases, tables, and columns and the most recent table and histogram data. For tables in extract mode, refreshing retrieves the updated list of tables and columns. But to see the most recent table and histogram data, you must start a new extract. For example, when there's a new column in a database table and you click the refresh icon, the new column appears in the editor but its data does not. To see the most current data, you must start a new extract. Refreshing data invalidates any currently cached data. Closing and reopening the editor, switching tables from extract to live mode, and changing a connection credential like username or password also refreshes data. ## Who can do this To create a virtual connection, you must - have credentials to the database that the virtual connection connects to, and - be a server or site administrator, or a Creator. ## Next steps After tables have been added and configured on the Tables tab, you can choose to [Create a Data Policy for Row-Level Security](https://help.tableau.com/v0.0/online/en-us/dm_vconn_create_rlspolicy.htm) or [Publish a Virtual Connection and Set Permissions](https://help.tableau.com/v0.0/online/en-us/dm_vconn_publish_save.htm). ## See also [Use a .properties file to customize a JDBC connection](https://help.tableau.com/current/pro/desktop/en-us/connect_customize.htm) — If you're customizing a JDBC-based connection, you can also make customizations in a .properties file [Skip to main content](#main-content) # Create and Edit Private Content in Personal Space Personal Space is a private location for all Explorers and Creators to save content to when working in a Tableau Site. Content saved in Personal Space can’t be shared with other users but can be moved to a project when you’re ready for others to see it. Within Personal Space, you can create a new workbook or save a workbook to Personal Space as a separate copy. You can also move existing content you own into Personal Space for editing, then move it back to a project later. Explorers can download workbooks in Personal Space, including all data included in the workbook. Data sources and flows can't be saved to your Personal Space. ## Privacy in Personal Space Content saved to your Personal Space is only visible to you and site administrators. Site administrators can’t directly access any user’s Person Space or edit content in someone else's Personal Space, but they can view and manage Personal Space workbooks. Personal Space workbooks appear in administrator search results and as a workbook location on the Explore page. In addition, the permissions menu is unavailable when a workbook is in Personal Space because the workbook is private. ### Tableau Catalog and Personal Space Starting in 2019.3, Tableau Catalog is available with Data Management in Tableau Server and Tableau Cloud. For more information, see "About Tableau Catalog" in the Tableau Server or Tableau Cloud Help. When Tableau Catalog is enabled in your work environment, the information about workbooks you save in your Personal Space is indexed by Catalog. These workbooks are included in lineage counts, however, only you can see the workbooks. Furthermore, users who browse through the lineage tool see Permissions required instead of information about workbooks in your Personal Space. ### Collaboration tools When a workbook is in Personal Space, some functionality is disabled, including share, metrics, comments, alerts, and subscriptions. Existing alerts and subscriptions to you will continue running, but alerts and subscriptions to others will fail, since the content is now private. Metrics can’t be created in Personal Space but will continue to work if a connected workbook is moved there. (The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm).) These limitations are removed when the workbook is moved or saved to another location. For example, if a workbook contains comments and moves to Personal Space, existing comments are hidden. Comments restore when the workbook is moved to another location. ### Extract refreshes in Personal Space To limit resource consumption, existing extract refreshes continue to run if they’ve been scheduled, but new extract refreshes can't be scheduled while a workbook is in Personal Space. ## Find content in Personal Space You can access Personal Space from the left navigation menu to see all your Personal Space content or create a new workbook, and you can save to Personal Space when creating or editing a workbook anywhere on the site. ![Personal Space tab in Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/ps-navigation.png) ![Path to publish a workbook to your personal space.](/tableau/next/en-us/online/en-us/Img/ps-save.png) You can also see workbooks in Personal Space from the Explore page when All Workbooks is selected, and you can filter down to Personal Space content. ![Tableau cloud Explore tab dropdown with a list of workbooks and projects.](/tableau/next/en-us/online/en-us/Img/ps-explore.png) ## Publish a workbook to Personal Space Personal Space works much like a private project for you to publish a new or existing workbook to from Tableau Cloud, Tableau Server, or Tableau Desktop. If Personal Space is enabled, drafts are automatically saved in Personal Space regardless of which project the new workbook is created in. If Personal Space is _not_ enabled, drafts of new workbooks are saved within the project. However, if a new workbook is created at the top-level project, the draft isn't saved anywhere. ### Publish a workbook to Personal Space on Tableau Server or Tableau Cloud 1. With the workbook open, select File > Publish As. 2. Under Location, select Personal Space. ![Path to publish a workbook to your personal space.](/tableau/next/en-us/online/en-us/Img/ps-save.png) **Note:** Explorers can only save workbooks to Personal Space and may not see a location selection dialog. ### Publish a workbook to Personal Space from Tableau Desktop Starting in 2023.1, you can publish a workbook to Personal Space from Tableau Desktop. 1. With the workbook you want to publish open in Tableau Desktop, select Server > Publish Workbook. 2. Under Project, select Personal Space. 3. Under Data Sources, select Edit. 4. In the Manage Data Sources popup under Publish type, select Embedded in workbook for all data sources. You must embed data sources when publishing from Tableau Desktop, because you can’t publish data sources separately to Personal Space. 5. Fill out the remainder of the publishing options as usual. For more information, see [Comprehensive Steps to Publish a Workbook](https://help.tableau.com/current/pro/desktop/en-us/publish_workbooks_howto.htm). ## Move workbooks to Personal Space You can move an existing workbook to Personal Space if you are the owner of the workbook and there is room in your Personal Space. Personal Space storage limits are set by administrators. To move a workbook to Personal Space: - Select a workbook, then click the Actions drop-down menu. - Select Move. - Under Location, Select Personal Space. **Note:** Explorers can only save workbooks to Personal Space and may not see the move action or location selection dialog. For more information, see [Perform actions](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm#perform-actions) in the Manage Web Content help topic. When you move an existing workbook or data source to Personal Space, tools like share, alerts, and subscriptions become hidden. Existing extract refreshes continue to run if they’ve been scheduled, but users can’t schedule new extract refreshes within their Personal Space. Existing subscriptions and alerts also continue but can’t be edited from Personal Space and will fail if other users are recipients. Existing connected metrics will continue to refresh, but the connected view will not be visible to other users. ## Move workbooks from Personal Space When you move a workbook out of Personal Space, collaboration tools like share, alerts, and subscriptions become visible, and any existing comments reappear. [Skip to main content](#main-content) # Create and Interact with Flows on the Web Starting in version 2020.4, you can create and interact with flows on Tableau Cloud to clean and prepare your data. Connect to your data, build a new flow, or edit an existing flow and your work is automatically saved every few seconds as you go. Create draft flows that are only available to you or publish your flow to make it available for others. Run your individual flows right from the web or run your flows automatically on a schedule using Tableau Prep Conductor if Data Management is licensed. For more information, see [Tableau Prep on the Web](https://help.tableau.com/v0.0/online/en-us/prep_web_auth.htm). ## Turn flow web authoring on or off for a site Enabled by default, this option controls whether users can create and edit flows on Tableau Server or Tableau Cloud **Note:** You can only change this setting in Tableau Server. Web authoring is automatically enabled for Tableau Cloud and can't be turned off. 1. In a web browser, sign in to the server as an administrator, go to the site and click Settings. 2. In the **Web Authoring** section, clear or select Flows. Let users edit flows in their browser. to turn the functionality off or on. ![The web authoring settings, and the box for “Flows. Let users edit flows in their browser.” is checked and highlighted.](/tableau/next/en-us/online/en-us/Img/prep_pwa_admin.png) 3. If you want the change to take effect immediately, restart the server. Otherwise, the change takes effect after server session caching expires or the next time users sign in after signing out. ## Enable linked tasks _Supported in Tableau Cloud and Tableau Server version 2021.3 and later._ Use the Linked Tasks option to schedule up to 20 flows to run sequentially, one after the other. Linked tasks can only be run on schedules with the Linked Tasks option selected. For more information about setting up linked tasks, see Schedule Linked Tasks. Starting in version 2022.1, Linked Tasks is enabled by default on the Server Settings and for any new flow schedules that you create. In prior versions, administrators must first enable the option. If you have multiple sites, you can turn off Linked Tasks for individual sites by clearing the check boxes described below. If the setting is turned off after linked tasks are scheduled, any tasks that are running will complete and the scheduled linked tasks are hidden and no longer show on the Scheduled Tasks tab. **Enable Linked Tasks** (version 2021.4 and earlier) 1. In a web browser, sign in to the server as an administrator and go to the site in which you want to enable Linked Tasks for flows. In that site, click Settings. 2. In the **Linked Tasks** section, select Let users schedule linked tasks to enable administrators to configure schedules to run linked tasks. 3. Select Let users run linked tasks manually using Run Now to enable users to run linked flow tasks using Run Now. ![The site setting with two checkboxes to enable scheduling or manual running of linked tasks.](/tableau/next/en-us/online/en-us/Img/prep_linked_tasks_settings.png) ## Enable flow parameters Enable users to schedule and run flows that include parameters. Parameters enable users to scale their flows by building them once, then changing the parameter values to accommodate different data scenarios. Parameters can be entered in an input step for file name and path, table name, or when using custom SQL queries, in an output step for file name and path and table name, and in any step type for filters or calculated values. Starting in Tableau Prep Builder and Tableau Cloud version 2023.2, you can add system parameters to flow output names to automatically include the flow run start date and time. Flow parameter settings can be applied at the server level to include all sites on Tableau Server. The settings can be disabled at the site level to include only specific sites. For more information about using parameters in flows, see [Create and Use Parameters in Flows](https://help.tableau.com/current/prep/en-us/prep_parameters.htm) in the Tableau Prep help. 1. In a web browser, sign in to the server as an administrator and go to the site in which you want to enable Flow Parameters. In that site, click Settings. 2. In the **Flow Parameters** section, select Let users run and schedule flows that use parameters to enable the functionality. 3. (version 2023.2 and later) Select Allow system generated parameters like timestamps to be applied to output names to enable users to add a date or time stamp to the flow output name at runtime for file and published data source output types. 4. Select Allow parameters that can accept any input to enable anyone running the flow to enter any parameter value in the flow at run time. > [!IMPORTANT] > > Setting this option enables any flow user to enter any value in a parameter, potentially exposing data that the user should not have access to. If this option is not selected, users can only select from predefined list of parameter values and any flows that include parameters that accept any value cannot be run or scheduled to run. ![The Flow Parameters dialog box. All boxes are checked: Let users run and schedule flows that use parameters, allow system generated parameters like timestamps to be applied to output names, and Allow parameters that can accept any input. ](/tableau/next/en-us/online/en-us/Img/prep_parameters_settings.png) ## Enable Tableau Prep Conductor If Data Management is licensed, enable this option to let users schedule and track flows in Tableau Server and Tableau Cloud. For information about the additional configuration requirements for Tableau Prep Conductor, see [Tableau Prep Conductor](https://help.tableau.com/current/server/en-us/server_process_prep_conductor.htm). 1. In a web browser, sign in to the server as an administrator and go to the site in which you want to enable Tableau Prep Conductor. In that site, click Settings. 2. In the **Tableau Prep Conductor** section, select Let users schedule and monitor flows to enable the functionality. ![Under Tableau Prep Conductor settings, a box for “Let users schedule and monitor flows.” is checked.](/tableau/next/en-us/online/en-us/Img/prep_pwa_admin3.png) ## Enable Run Now Control whether users or only administrators can run flows manually using the Run Now option. Data Management is not required to run flows manually. 1. In a web browser, sign in to the server as an administrator and go to the site in which you want to enable Run Now for flows. In that site, click Settings. 2. In the **Run Now** section, select Let users run jobs manually using Run Now to enable the functionality. ![Under Run Now settings, the box for "Let users run jobs manually using Run Now." is checked.](/tableau/next/en-us/online/en-us/Img/prep_pwa_admin2.png) Clear the check box if only Server Administrators can run flows manually. ## Flow Subscriptions Control whether users can receive flows notifications about scheduled tasks for successful flow runs. Data Management is required to enable notifications. 1. In a web browser, sign in to the server as an administrator and go to the site in which you want to enable flow subscriptions. In that site, click Settings. 2. In the **Flow Subscriptions** section, select Let users send or receive emails that include flow output data to enable the functionality. ![The Flow Subscriptions site setting showing the check box for sending and receiving email notifications selected.](/tableau/next/en-us/online/en-us/Img/prep_conductor_subscribe_site.png) **Note**: The option to attach either a .csv or .xlsx file type to the email is only available for on-premise environments. ## Enable Tableau Prep Extensions _Supported in Tableau Server and Tableau Cloud starting in version 2021.2.0_ Set this option to control whether users can connect to Einstein Discovery to run predictive models against data in their flow. You can use Einstein Discovery-powered models to bulk score predictions for the data in your flow when authoring flows on the web. Predictions can help you make better informed decisions and take actions to improve your business outcomes. You'll need to configure additional settings to include predictions in our flow. For more information, see [Add Einstein Discovery Predictions to your flow](https://help.tableau.com/current/prep/en-us/prep_predictions.htm) and [Configure Einstein Discovery Integration](https://help.tableau.com/current/server/en-us/config_einstein_extensions.htm#einstein-discovery-tableau-prep-extensions). 1. In a web browser, sign in to the server as an administrator and go to the site in which you want to enable Tableau Prep Extensions. In that site, click Settings > Extensions. 2. In the **Tableau Prep Extensions** section, select Let users connect to Einstein Discovery to enable the functionality. ![A text box that describes Tableau Prep Extensions. The box for “Let user connect to Einstein Discovery” is checked.](/tableau/next/en-us/online/en-us/Img/prep_pwa_admin_einstein_discovery.png) ## Turn autosave off or on Enabled by default, this feature automatically saves a user's flow work every few seconds. While not recommended, administrators can disable autosave on a site using the Tableau Server REST API method "Update Site" and `flowAutoSaveEnabled` setting. For more information, see [Tableau Server REST API Site Methods: Update Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_sites.htm#update_site). For more information about autosave on the web, see [Turn autosave off or on](#autosave). For more information about configuring site settings, see [Site Settings Reference](https://help.tableau.com/current/server/en-us/sites_add.htm) in the Tableau Server help. ## Other articles in this section [Skip to main content](#main-content) # Create and Test Data Policies Use a data policy to filter data in any view, data source, or flow that uses the virtual connection. Use a column in a policy table or an entitlement table to filter the data to only what a user should see. - **Policy table** - the tables that are filtered. - **Policy column** - column used to filter the data. - **Entitlement table** - a table that includes a column you can use to filter the data. Use when policy tables don't include a policy column. Add tables to the policy To create a data policy: 1. Click ![Create New Policy button](/tableau/next/en-us/online/en-us/Img/ipa_Create_New_Policy_btn.png) 2. Click the default name on the tab to rename the policy. 3. Double-click the table name in the left pane to add tables to the data policy. [Read full topic](https://help.tableau.com/current/online/en-us/dm_vconn_create_conn.htm#select-tables-to-include-in-the-connection) Map table columns For each policy table, map a column in the policy table to either a policy column or an entitlement table. ### Map to a policy column 1. Click ![The Add Column to Map button.](/tableau/next/en-us/online/en-us/Img/ipa_vconn_add_col_map_btn.png) to add one or more columns to use to filter data. 2. Name the policy column. You'll use this name in the policy condition. 3. For each policy table, use the drop-down menu to select the table column that maps to the policy column. 4. Repeat this process for as many policy columns as you want to use in the policy condition. **Quick clip:** Map a table column to a policy column and write a policy condition for a data policy that filters invoices by Salesperson. Your browser does not support the video tag. [Read full topic](https://help.tableau.com/current/online/en-us/dm_vconn_create_rlspolicy.htm#filter-with-a-policy-column-from-a-policy-table) ### Map to an entitlement table 1. Select the entitlement table, drag it to the right and drop it on Add as Entitlement Table. You can use a table from any connection or database as a central entitlement table that secures tables across many other databases. 2. For each policy table, click the drop-down menu and select the columns to map the policy table to the entitlement table. **Quick clip:** Map an entitlement table (with EmployeeId and Full Name columns) to policy table columns and write a policy condition for the data policy. Your browser does not support the video tag. [Read full topic](https://help.tableau.com/current/online/en-us/dm_vconn_create_rlspolicy.htm#filter-with-policy-column-from-an-entitlement-table) Write a policy condition A policy condition is a calculation that often uses a user function to define row-level access. More about [User Functions](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_user.htm) in help online. A policy condition: - Is required in a data policy. - Must evaluate to true or false. - Shows rows when the policy condition is true. Example: `FULLNAME() = [EmployeeName]` [Read full topic](https://help.tableau.com/current/online/en-us/dm_vconn_create_rlspolicy.htm#write-a-policy-condition) Test your data policy using Preview as user Test your policy to see the data as the user sees it and ensure that your policy is working as expected. 1. Select a table. 2. In the Table Details section, select ![A checkbox labeled "With policy applied".](/tableau/next/en-us/online/en-us/Img/ipa_vconns_with_policy_applied.png) 3. Click Preview as user, select a Group (optional) and a User. 4. Verify the policy shows the correct data for that user in the table details. 5. Repeat for other users as needed. [Read full topic](https://help.tableau.com/current/online/en-us/dm_vconn_test_preview.htm) Publish the connection and set permissions ### Save a draft or publish a connection Your connection is automatically saved as a draft while you work. Manually save the draft by clicking ![Save icon](/tableau/next/en-us/online/en-us/Img/ipa_Save_16px_medium.png). To share a new virtual connection with other users, you need to publish it. 1. Click ![Publish button](/tableau/next/en-us/online/en-us/Img/ipa_vconn_publish_btn.png) in the upper right corner of the editor. 2. Type a name for the connection in the Name field. 3. Select a project to save the connection to. 4. Click ![Publish button](/tableau/next/en-us/online/en-us/Img/ipa_vconn_publish_btn.png) When you edit an existing connection, it remains available to users in its current published state. - To save updates to a draft, click ![Save icon](/tableau/next/en-us/online/en-us/Img/ipa_Save_16px_medium.png). - To make the updated connection available to users, click ![Publish button](/tableau/next/en-us/online/en-us/Img/ipa_vconn_publish_btn.png) ### Set permissions so others can use the connection You've published the connection, and you're ready to let others use it. To do this, set the Connect capability to Allowed. 1. Navigate to the virtual connection. 2. Open the Actions menu (...) and click Permissions. 3. Select the box under the Connect icon so that connect is allowed for all users. ![Connect capability check box under Permissions Rules](/tableau/next/en-us/online/en-us/Img/ipa_vconn_connect_capability.png) 4. Click Save. [Read publish and permissions topic](https://help.tableau.com/current/online/en-us/dm_vconn_publish_save.htm) ## Related tasks [About the Virtual Connection Editor](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_about_editor.htm) [Add Tables to the Connection](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_add_tables.htm) [About Data Policies](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_about_data_policy.htm) Not finding what you need? Go online to see [all Tableau help](https://www.tableau.com/support/help) [Skip to main content](#main-content) # Create and Troubleshoot Metrics (Retired) ## Retirement of legacy metrics This article is about Tableau's legacy metrics feature, which was retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. In October 2023, Tableau retired the ability to embed legacy metrics in Tableau Cloud and in Tableau Server version 2023.3. Tableau Pulse introduces a new way to track metrics. With Tableau Pulse, the metrics you create are used to generate insights about your data. These data insights are sent directly to users who follow the metrics, so they can learn about changes to their data in their flow of work. For more information, see [Create Metrics with Tableau Pulse](https://help.tableau.com/current/online/en-us/pulse_create_metrics.htm). If you have legacy metrics that you want to keep, note the data source, measure, and time dimension for those metrics and recreate them in Tableau Pulse. Legacy metrics won't be automatically migrated to Tableau Pulse. Metrics provide a fast way to stay informed about your data. Because metrics update automatically and display their current value in the grid and list view of your content, you can check all the key numbers you care about in seconds. ![Grid of profit metrics with good and bad statuses](/tableau/next/en-us/online/en-us/Img/metrics_grid.png) At their most basic level, metrics show the value of an aggregate measure, like the sum of sales. More complex metrics can include timelines, comparisons, and statuses that provide an easy to understand indicator of how you’re performing relative to a prior point in time or a value you have defined. If you have a set of dashboards that you regularly check, create metrics for the numbers that you want to monitor, then track them in one place by adding them to your favorites or a collection, or by creating them in the same project. That way, you don’t need to load and filter the dashboards unless you want to dig deeper into your data. ## Find metrics on your site There are a few ways to find metrics on your Tableau site. To browse all the metrics that you have permission to view, navigate to the Explore page, then select All Metrics from the content type menu. If you’re looking for metrics related to a particular view or workbook, check the connected metrics for that content. To see connected metrics for a view, open the view, then click Watch > Metrics in the view toolbar. The metrics displayed are ordered from the newest creation date to the oldest. ![View toolbar and metrics connected to the view](/tableau/next/en-us/online/en-us/Img/metrics_connected_view.png) To see connected metrics for all the views in a workbook, navigate to the workbook, then click the Connected Metrics tab. You can sort these metrics using the Sort By menu. ![Workbook page and metrics connected to the workbook](/tableau/next/en-us/online/en-us/Img/metrics_connected_workbook.png) ## Components of a metric The only data required to define a metric is an aggregate measure. Metrics are created from a mark in a view, and the measure associated with that mark defines the metric. The measure must be aggregated, because an unaggregated mark will not change over time. For information about dimensions and measures in Tableau, see [Dimensions and Measures, Blue and Green](https://help.tableau.com/current/pro/desktop/en-us/datafields_typesandroles.htm). A metric can optionally be defined by a date dimension, and you can configure a comparison and a status for your metric. Each of these components will add context to the data presented on the metric card. Metrics that have only a measure defining them will appear as a single number. This number will update when the data updates, but there will be no timeline on the card. ![A single-number metric](/tableau/next/en-us/online/en-us/Img/metrics_single_number.png) ### Timeline When you select a mark to define a metric, if the mark has a date dimension associated with it, that dimension becomes part of the metric definition. Metrics with a date dimension show a timeline, and you can configure the historical comparison for the metric. By default, the historical comparison is to the previous mark. When you open a metric’s details page, the timeline shows the value of the measure based on the granularity of the date dimension, for example, daily sales or monthly users. Hover over the points on the timeline to see historical values. ![Timeline of monthly sales values](/tableau/next/en-us/online/en-us/Img/metrics_timeline.gif) ### Comparison There are two types of comparisons that you can configure for metrics: historical comparisons and constant comparisons. You can configure a historical comparison only if a metric has a date dimension associated with it, but constant comparisons can be added for any type of metric. A historical comparison is a relative comparison between the current value and a specified number of hours, days, or other unit of time previous. For example, you could set a comparison between the current value for monthly sales and the value from 12 months ago. Every time data is added to a metric, the historical comparison will adjust relative to the date or time of the new data. ![Metric up 20% over comparison period](/tableau/next/en-us/online/en-us/Img/metrics_historical_comp.png) Constant comparisons are to a single value that doesn’t change as new data is added. You might set a comparison to represent a threshold to stay above, for example, if you need to maintain a 90% on-time delivery rate. Or you might define a cumulative goal you are working toward, for example, a monthly sales target. ![Metric $4640 above comparison value](/tableau/next/en-us/online/en-us/Img/metrics_constant_comp.png) ### Status For metrics with a constant comparison, you can define whether being above, below, or at the comparison value is good, bad, or neutral. A metric with a “good” status will display a check mark next to the comparison value, and the metric card will have a green band at the top. A metric with a “bad” status will display an X next to the comparison value, and the metric card will have a red band at the top. Metrics with a “neutral” status appear the same as metrics without a status indicator; there is no icon or color applied to the card. ![Metrics with neutral, bad, and good statuses](/tableau/next/en-us/online/en-us/Img/metrics_status.png) ## Create a metric from a view If you have a site role of Creator or Explorer (can publish), and you have the Create/Refresh Metric capability on the relevant workbook, you can create metrics on Tableau Cloud or Tableau Server. Before you create a metric, check the connected metrics for the view to make sure that the metric you are planning to create doesn’t already exist. Instead of creating a duplicate metric, open the existing metric and add it as a favorite. ### Select the mark to define your metric 1. Navigate to the view that you want to create a metric from. 2. On the view toolbar, select Watch > Metrics. ![View toolbar with metrics button highlighted](/tableau/next/en-us/online/en-us/Img/metrics_toolbar.png) The metrics pane opens. 3. If the pane shows connected metrics, select the Create button to enter authoring mode. 4. Select a mark. If you encounter an error, see [When you can’t create a metric](#when-you-cant). ![Selecting a mark on a multi-chart view](/tableau/next/en-us/online/en-us/Img/metrics_mark_selection.png) The measure associated with this mark defines your metric. Any filters you apply to the mark are applied to your metric. If this mark has a date dimension associated with it, that date dimension also defines your metric, and your metric will display a timeline. The metrics pane shows a preview of your metric. The value in the preview is the most recent value for the metric, which may differ from the value of the mark you selected if it was not the most recent in the time series. The preview updates as you try different configurations. ![Preview of metric configurations](/tableau/next/en-us/online/en-us/Img/metrics_preview.gif) ### Describe and configure your metric The options available to configure your metric depend on the mark you select and on the type of comparison you choose. 1. The Name field is pre-populated based on the mark you select. You can give the metric a different name. A metric must have a unique name within the project it belongs to. 2. Under Description, enter an optional message to help others understand your metric. For example, describe filters applied to the metric or indicate the data source used by the metric. 3. For the Date Range (only for metrics with a date dimension), select one of the default options, or set a custom range. If your metric has a large number of marks, limiting the date range can make it easier to read the timeline. 4. Select the Comparison Type for the metric: historical or constant. 5. For Historical comparisons: - Enter how far prior you want to compare against. The unit of time for the comparison is the same as the granularity of your data, such as hours or months. - Select Show Comparison Line to include a second line for the comparison period on the timeline. 6. For Constant comparisons: - Enter the value to compare against. Don’t include commas or symbols in this field. To enter a percentage, simply type the number without the percent sign, for example, enter 25 instead of 0.25 for a target of 25%. When you enter a valid target value, the preview updates to show how far above or below the target the current value is. - Set the Status for the comparison to indicate whether being above, at, or below the value is good, bad, or neutral. By default, the status is set to neutral. Check the metric preview to see how different statuses affect your metric. 7. Under Definition > Measure, select the measure to use for your definition from the drop-down. This option appears only if the mark you select has more than one measure associated with it. ![Selecting measure from dropdown](/tableau/next/en-us/online/en-us/Img/metrics_disambiguate.png) ### Finalize your metric 1. Under Project, select Change Location to choose a different project for the metric. By default, your metric will be added to the same project that the view belongs to. Every metric in a project must have a unique name. Because a metric’s name and project are initially set based on the mark you select, you might run into a conflict when you try to save your metric, if another user has already created a metric from that mark. Either choose a different project or name for your metric or, if you want to overwrite the existing metric, see [Overwrite a metric](#overwrite). 2. Click the Create button. A message appears with a link to the metric in the project you added it to. ![Success message](/tableau/next/en-us/online/en-us/Img/metrics_success.png) 3. Verify that the permissions for your metric are correct, following the guidance in [Set permissions](https://help.tableau.com/current/server/en-us/permissions.htm#set-permissions). By default, a metric inherits the permissions of the project it is created in. Anyone with access to your metric will be able to see the metric's data, even if they don’t have permission to access the connected view or data source. Now that you’ve created a metric, you can manage the metric the same way you manage other independent pieces of content on your Tableau site. Though metrics are created from a view, they exist independently of that view, unlike data driven alerts or subscriptions. You can move the metric to a different project without moving the connected view. For information about managing content on your Tableau site, see [Manage Web Content](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm). ### Overwrite a metric Once a metric is created, you can change the name, description, and configuration of the metric, but you can’t change how the metric is defined. If you want to change the data that the metric uses, you must overwrite it. In order to overwrite a metric, you need to be the metric owner or be granted the correct permission capability. 1. To overwrite a metric, create a metric with the same name in the same project as the metric you want to overwrite. The Overwrite Metric dialog appears. 2. Click the Overwrite button. When you overwrite a metric, the metric continues to appear for those who have added it to their favorites, and any changes made to permissions for the previous metric will apply to the new metric. ### When you can’t create a metric If you select a mark on a chart that doesn’t support metrics, you’ll get an error message explaining why you can’t create a metric. The table below summarizes these scenarios.

Reason	Scenarios
You don’t have the correct permissions.	The workbook owner or an administrator has denied the Create/Refresh Metric capability. For more information, see Permissions.
You can’t access the complete data.	Row level security or user filters limit the data you can see. For more information, see Restrict Access at the Data Row Level.
The password for the workbook’s data source is not embedded or is no longer valid.	The workbook prompts for a password. For more information, see Set Credentials for Accessing Your Published Data.
The data isn’t at the correct level of granularity.	The data in the chart isn't aggregated. Metrics use aggregations, such as sum or average. For more information, see Data Aggregation in Tableau. There are multiple values per cell of data—a result of data blending. For more information, see Troubleshoot Data Blending.
The date dimension is not supported.	The chart includes both date parts and date values. For more information, see Change Date Levels. The date dimension uses the ISO 8601 calendar rather than the standard Gregorian calendar. For more information, see ISO-8601 Week-Based Calendar. The date dimension is aggregated at the custom level of Month / Year or Month / Day / Year. For more information, see Custom Dates.

## Edit a metric's configuration Starting in 2022.2, you can change the configuration for a metric. A metric's configuration includes the comparison, date range, and status indicator. The configuration options available depend on the type of metric. Metrics with a timeline allow you to set a historical comparison or a constant comparison. Single number metric support only a constant comparison. A metric's configuration does not include the metric definition (the measure and date dimension that generate the metric value). If you want to change the definition, overwrite the metric with a new metric. To edit a metric's configuration, you must have the overwrite capability for the metric. 1. Open the metric details page for the metric you want to edit. 2. Mouse over the configuration section. Click anywhere on the section to enter editing mode. ![Metrics configuration section on mouse over](/tableau/next/en-us/online/en-us/Img/metrics_edit_config.png) 3. For a timeline metric, set the date range to display on the metric card and details. 4. Select the comparison type. For a constant comparison, set a comparison value and status. For a historical comparison, set how far prior you want to compare against and choose whether to show a comparison line on the timeline. 5. Click Save. Your configuration changes will appear to anyone who views the metric. ## How metrics refresh When a metric refreshes, it checks the connected view (the view the metric was created from) for new data. A refresh doesn’t necessarily update the value of a metric, because there may be no changes to the data. Metrics refresh at a frequency either based on an extract’s refresh schedule or, for live data, every 60 minutes. The time of the last refresh is displayed on the metric. ## Fix failing refreshes If a metric isn’t able to access the connected view or its underlying data, the refresh will fail. If the refresh for your metric fails, you’ll receive a notification, which notes the time of the failure and the affected metric. Metric refreshes may fail for one of the following reasons. - The connected view was deleted or modified. - Permissions changed for the connected view. - The password for the data source is no longer embedded or is no longer valid. - The metric owner doesn’t have the required site role to refresh the metric. A site role of Creator or Explorer (can publish) is required. - There was a temporary connectivity issue, which will resolve itself. To identify the cause of the failure, look at the metric details. Make sure that the metric owner has the required site role to refresh the metric. Then inspect the Connected View. ![Metric connected view highlighted under Metric Details](/tableau/next/en-us/online/en-us/Img/metric_details.png) ### If the connected view is still listed Open the view to investigate the cause of the failure. If the view loads, check that the measure and (optional) date dimension that define the metric are still present in the view. - If the view appears to be unchanged, you might no longer have permission to refresh metrics from it. The content owner or a Tableau administrator can change the Create/Refresh Metric permission capability. For more information, see [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm). - If the measure is no longer present, the view has been modified so the metric can't connect to the data needed to refresh. The content owner or a Tableau administrator can check the revision history and restore previous versions. For more information, see [View Revision History](https://help.tableau.com/current/pro/desktop/en-us/qs_revision_history.htm#view-revision-history). If the view doesn’t load, but instead prompts for a password or displays an error when connecting to the data source, the password for the data source is not embedded or is no longer valid. The content owner or a Tableau administrator can edit the data source connection to embed the password. For more information, see [Edit Connections](https://help.tableau.com/current/online/en-us/to_connections_modify.htm). ### If there is no connected view listed The view was deleted or you no longer have permission to access the view. Contact your Tableau administrator for assistance. ## Resume suspended refreshes If a refresh fails enough times, the refresh is suspended. You’ll receive a notification if the refresh for your metric is suspended. When a metric refresh is suspended, Tableau no longer attempts to get new data for the metric. Metrics with suspended refreshes continue to present historical data. If the cause of the failure is fixed, you can resume the refresh. 1. Open the affected metric. 2. On the warning message, click Resume refresh. Tableau attempts to perform the refresh. If this attempt succeeds, you’ll receive a notification, and the refresh will resume on schedule. If the attempt doesn’t succeed, your refresh remains suspended. Try overwriting the metric if the connected view is still available. For more information, see [Overwrite a metric](#overwrite). Otherwise, you can keep the metric to reference past data or delete the metric. **Note:** If the metric refresh is suspended because you don’t have the required site role for it to refresh, you won’t be able to resume the refresh or delete the metric. ## Metrics appear in Tableau Catalog Starting in 2019.3, Tableau Catalog is available with Data Management in Tableau Cloud and Tableau Server. When the Tableau Catalog is enabled in your environment, you can see metrics in the Catalog lineage tool, and metrics affected by data quality warnings display those warnings. For more information about Tableau Catalog, see "About Tableau Catalog" in the [Tableau Server](https://help.tableau.com/current/server/en-us/dm_catalog_overview.htm) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/dm_catalog_overview.htm) Help. When you have metrics defined for the numbers you want to monitor, it's important to know if the data that the metrics rely on are impacted in any way. You can use Catalog in a couple of ways to know this. First, data quality warnings set on the data your metric is based on show on the metric. These warnings appear when you open a metric in Tableau Mobile, and in Tableau Server and Tableau Cloud when you hover over a metric in grid view and on the metric details page, as shown below: ![Metric with data quality warning](/tableau/next/en-us/online/en-us/Img/dm_dqw_metrics.png) For more information, see "Set a Data Quality Warning" in the [Tableau Server](https://help.tableau.com/current/server/en-us/dm_dqw.htm) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/dm_dqw.htm) Help. You can also use the lineage tool in Tableau Catalog to see the upstream sources that your metric relies on. When doing an impact analysis, you can see which metrics are affected if a certain column or a table is changed or deprecated, or if certain workbooks are removed. Including metrics in the lineage means that Catalog gives a full picture of the impact changes can have on the assets in your environment. ![Impact on lineage when filtered by a field](/tableau/next/en-us/online/en-us/Img/dm_lineage_filter.png) For more information, see "Use Lineage for Impact Analysis" in the [Tableau Server](https://help.tableau.com/current/server/en-us/dm_lineage.htm) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/dm_lineage.htm) Help. [Skip to main content](#main-content) # Create Custom Measure Relationships in Your Tableau Data Story **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). You can create a relationship story in your Tableau Data Story to see how data compares to another set of data. To build a relationship story, you must have at least two measures and one dimension. Data that you'd like to compare is often grouped into one column of data named something such as "Year" or "Month," with values such as "2022" or "March." You can [Create a Simple Calculated Field](https://help.tableau.com/current/pro/desktop/en-us/calculations_calculatedfields_formulas.htm) to separate "2022" from "2021" (or March from February), so that you can compare the two time periods in a relationship story. 1. Start in the sheet that you want to use in your Data Story. 2. Click Analysis, and select Create a Calculated Field. 3. Create a calculated field such as "Current Period." ![A calculated field that reads: If DATETRUNC ('year', \[Year\])= {MAX(DATETRUNC('year', \[Year\]))} THEN \[Number of Records\] END](Img/data_stories_calcfield_current.png) > [!TIP] > > Follow the structure of the calculated field shown here, but substitute your own dimension or measure names (orange text). 1. Create a calculated field such as "Previous Period." ![A calculated field that reads: If DATETRUNC ('year', \[Year\])= DATEADD('year', -1, {MAX(DATETRUNC('year', \[Year\]))}) THEN \[Number of Records\] END](Img/data_stories_calcfield_previous.png) 1. Drag the new measures onto the Detail mark. 2. From your dashboard, click the story and add the two new measures into your Data Story. ![Data Story dialog box open to the Field tab with available dimensions and measures.](/tableau/next/en-us/online/en-us/Img/data_stories_calcfield_addnew.png) 1. From your dashboard, click the Settings icon at the top-left corner of your Data Story object. 2. In the Data Story dialog box, click the Relationships tab. 3. Set up a relationship story with the two custom measures. ![The Data Story settings dialog box open to the Relationships tab. The Current/Most Recent vs Previous Period box is checked. The related measures are SUM(Previous Period) and SUM(Current Period).](/tableau/next/en-us/online/en-us/Img/data_stories_set_relationship.png) 1. Click Save. Your story now writes sentences that compare the custom measures. [Skip to main content](#main-content) # Create Extracts on the Web You can extract your data sources on the web (without using Tableau Desktop) to improve data source performance and support additional analytical functions. When you extract your data source, Tableau will copy the data from your remote data store to Tableau Server or Tableau Cloud. To learn more about the benefits of extracting your data, see [Extract Your Data](https://help.tableau.com/current/pro/desktop/en-us/extracting_data.htm). On the web, you can extract while in Web Authoring or while in Content Server. ## Create extracts in Web Authoring You can create extracts directly in web authoring with default extract settings. ### Extract an Embedded Data Source in Web Authoring ![Data source page showing the extract connection type](/tableau/next/en-us/online/en-us/Img/datasource_extract1w_border.png) Complete the following steps to create an extract in web authoring. > [!TIP] > > It's recommended to finalize your data model before you create the extract. Extract creation may take a long time and any changes to your data model, such as adding new logical tables, will invalidate the extract. 1. Select the Data Source tab in the bottom left corner of the web authoring pane. For new workbooks, you will start in the Data Source tab. 2. In the top-right corner, change the connection type from Live to Extract. 3. Select Create Extract. You will see the Creating Extract dialog box. Extract creation might take a long time and you can close your authoring session while the extract is being created. To ensure your extract creation isn't lost, in the dialog box, choose Notify Me When Complete to specify a location for the extracted workbook to be saved. If your extract succeeds, your workbook will be saved to the specified location and you will be notified that you can continue your web authoring session. If your extract creation fails, you will be notified that the extract couldn't be created and you can restore your unsaved changes by reopening the original workbook in web authoring. ### Define your Extract Settings You can configure one or more of the following options to tell Tableau how to store, define filters for, and limit the amount of data in your extract. ![Extract Data page showing the selection for logical or physical tables](/tableau/next/en-us/online/en-us/Img/incremental_refresh_extract_data.png) **Decide how the extract data should be stored** You can choose to have Tableau store the data in your extract using one of two structures (schemas): logical tables (denormalized schema) or physical tables (normalized schema). For more information about logical and physical tables, see [The Tableau Data Model](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel.htm). The option you choose depends on what you need. Logical Tables Logical Tables store data using one extract table for each logical table in the data source. Physical tables that define a logical table are merged and stored with that logical table. For example, if a data source was made of a single logical table, the data would be stored in a single table. If a data source was made of three logical tables (each containing multiple physical tables), the extract data would be stored in three tables—one for each logical table. Select Logical Tables when you want to limit the amount of data in your extract with additional extract properties like extract filters, aggregation, Top N, or other features that require denormalized data. Also use when your data uses pass-through functions (RAWSQL). This is the default structure Tableau uses to store extract data. If you use this option when your extract contains joins, the joins are applied when the extract is created. Physical Tables Physical Tables stores data using one extract table for each physical table in the data source. Select Physical Tables if your extract is comprised of tables combined with one or more equality joins and meets the conditions for using the Physical Tables option listed below. If you use this option, joins are performed at query time. This option can potentially improve performance and help reduce the size of the extract file. For more information about how Tableau recommends you use the Physical Tables option, see [Tips for using the Physical Tables option](https://help.tableau.com/current/pro/desktop/en-us/extracting_data.htm#noramlized_tips) in the Tableau Desktop help. In some cases, you can also use this option as a workaround for row-level security. For more information about row-level security using Tableau, see [Restrict Access at the Data Row Level](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters.htm) in the Tableau Desktop help. ### Conditions for using the Physical Tables option To store your extract using the Physical Tables option, the data in your extract must meet all of the conditions listed below. - All joins between physical tables are equality (=) joins. - Data types of the columns used for relationships or joins are identical. - No pass-through functions (RAWSQL) used. - No incremental refresh configured. - No extract filters configured. - No Top N or sampling configured. - When the extract is stored as physical tables, you can't append data to it. - For logical tables, you can't append data to extracts that have more than one logical table. **Note:** Both the Logical Tables and Physical Tables options only affect how the data in your extract is stored. The options don't affect how tables in your extract are displayed on the Data Source page. **Determine how much data to extract** Select Add to define one or more filters to limit how much data gets extracted based on fields and their values. **Aggregate the data in the extract** Select Aggregate data for visible dimensions to aggregate the measures using their default aggregation. Aggregating the data consolidates rows, can minimize the size of the extract file, and increase performance. When you choose to aggregate the data, you can also select Roll up dates to a specified date level such as Year, Month, etc. The following examples show how the data will be extracted for each aggregation option you can choose.

Original data		Each record is shown as a separate row. There are seven rows in your data.
Aggregate data for visible dimensions (no roll up)		Records with the same date and region have been aggregated into a single row. There are five rows in the extract.
Aggregate data for visible dimensions (roll up dates to Month)		Dates have been rolled up to the Month level and records with the same region have been aggregated into a single row. There are three rows in the extract.

Choose the rows to extract Select the number of rows you want to extract. You can extract All rows or the Top N rows. Tableau first applies any filters and aggregation and then extracts the number of rows from the filtered and aggregated results. The number of rows options depend on the type of data source you are extracting from. **Notes:** - Not all data sources support sampling. So, you might not see the Sampling option in the Extract Data dialog box. - Any fields that you hide first in the Data Source page or on the sheet tab will be excluded from the extract. Configure Incremental Refresh Settings Most data sources support an incremental refresh. Rather than refreshing the entire extract, you can configure a refresh to add only the rows that are new since the previous time you extracted the data. For example, you may have a data source that is updated daily with new sales transactions. Rather than rebuild the entire extract each day, you can just add the new transactions that occurred that day. To have incremental refresh as an option when you schedule a refresh you must first define the settings. Periodically you might want to do a full refresh to ensure you have the most up to date data. **Note:** If the data structure of the source data changes (for example, a new column is added), you will need to do a full extract refresh before you can start doing incremental refreshes again. ### Set up Incremental Refresh Follow the steps below to set up an extract to be refreshed incrementally. Ensure you've selected All rows in the Number of Rows section. Incremental refreshes can only be defined when you are extracting from all rows in the database. You can't incrementally refresh a sample extract. 1. Expand the Incremental Refresh section. 2. Check the **Incremental refresh** box. 3. Choose a table to refresh. 4. Select a column to use for identifying new rows. 5. (Optional) Enter an amount of time and unit of time in the Minimum date range to refresh fields to extract new data added since the last refresh, and also replace a subrange of existing data in the extract to capture changes that may have occurred in the data source. You have the option to define the length of time in multiple ways from seconds to years within this field. For example, you could enter "2" and "months" to have the extract refresh get all new rows, plus refresh the previous two months worth of data. **Note**: Configuring extract refreshes along with a minimum date to refresh can be complex to understand. Before you use it, see [Configure an incremental extract refresh](https://help.tableau.com/current/pro/desktop/en-us/extracting_refresh.htm#configure-an-incremental-extract-refresh). ![](/tableau/next/en-us/online/en-us/Img/subrange_incremental_refresh.png) ### Use Advanced Settings You can expand **Advanced Settings** to establish how new rows are retrieved. **Note:** If you have set a Minimum date range for refreshing, the Advanced Settings feature won't be accessible. Advanced Settings allow you to either replace the last rows added by refreshing values equal to or greater than the last recorded value, or retain the last rows added by only refreshing the extract with values greater than the last recorded value. In the first approach, Tableau allows users to incrementally refresh extracts with a non-unique key column such as date, datetime, or ID. This method adds a new step when performing an incremental refresh. Tableau will first delete rows in the extract that are equal to the previous highest value seen. Tableau then queries for all rows that are higher than or equal to the previous highest value which will pick up all the deleted rows and any new ones. Conversely, you can still opt to not replace the last rows added and only add rows with values greater than the last recorded value. To finish, select **Create Extract**. #### Considerations when refreshing extracts **Editing an extract:** If you're editing an existing extract, the last refresh is shown so you can be sure you are updating the extract with the correct data. **Full Refresh:** A Full Refresh replaces all of the rows with the data in the original data source every time you refresh the extract. A Full Refresh can take longer and be expensive on the database. **Date/Time precision and extracts:** The data engine, which is the underlying mechanism that Tableau uses to create extracts, stores time values with a precision of up to 3 decimal places. If you specify a datetime or timestamp column for Identify new rows using column, and your database uses a higher precision than Tableau, you can end up with duplicate rows after an incremental refresh. For example, if the database has two rows, one with a datetime value of 2015-03-13 17:30:56.502352 and one with a datetime value of 2015-03-13 17:30:56.502852, Tableau will store both rows using a datetime value of 2015-03-13 17:30:56.502 thereby creating duplicate rows. ### Limitations - You can't create extracts for embedded data sources that reference published data sources. As a workaround, create the extract directly on the published data source. For more information, see Extract a Published Data Source on Content Server. - You can't create extracts for file-based data sources. File-based data sources already have special performance features and adding extraction will have no performance benefit. - This feature doesn't apply to bridge-based data sources in Tableau Cloud. - Custom SQL Limitation: Custom SQL queries aren't supported with Advanced Settings. Users relying on custom SQL will need to adjust their approach if they wish to use the Advanced Settings for incremental refresh. ## Create extracts in Content Server ### Extract a Published Data Source on Content Server ![Data sources page showing the extract option in the menu](/tableau/next/en-us/online/en-us/Img/datasource_extract2_wborder.png) Complete the following steps to extract a published data source. 1. Sign in as an administrator or as the owner of the data source. 2. On the Content tab, select Explore, and then select Data sources. 3. Select a data source by clicking on the Data Source name. 4. At the top of the screen, under the Data Source name, select the drop-down menu that says **Live**. 5. Change the connection type from **Live** to **Extract**. If the extract encryption at rest feature is enabled on the site, select either **Encrypted** or **Unencrypted**. 6. If you see an error message about embedded credentials, embed your credentials in the data source. To do this, choose **Edit Connection**. Select "Embedded password in connection" and then choose **Save**. ### Extract an Embedded Data Source on Content Server ![The extract option in the actions menu on the data sources page](/tableau/next/en-us/online/en-us/Img/datasource_extract3w_border.png) Complete the following steps to extract one or more data sources that are embedded in a published workbook. 1. Sign in as an administrator or as the owner of the data source. 2. Navigate to the published workbook. 3. Navigate to the Data Sources tab 4. Select one or more of the data sources. 5. Choose the **Action** button. 6. Select **Extract**. If the extract encryption at rest feature is enabled on the site, select either **Encrypted** or **Unencrypted**. ### Limitations - Your connection credentials must be embedded in the data source. - You can't create extracts for embedded data sources that reference published data sources. As a workaround, [create the extract directly on the published data source](#extract-published-data-source). - You can't create extracts for file-based data sources. File-based data sources already have special performance features and adding extraction will have no performance benefit. - Starting with version 2023.1, changing a live connection to an extract on Content Server will remove any extract filters that were previously created on Tableau Desktop or Web Authoring. - This feature doesn't apply to bridge-based data sources in Tableau Cloud. ## Keep Extracted Data Fresh After data is extracted, you can optionally set up an extract refresh schedule to keep the data fresh. For more information, see [Schedule Refreshes on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/schedule_add.htm). ## Monitor and Manage Extracts Server administrators can monitor extract creation on the **Background Tasks for Extracts** admin view. For more information, see [Background Tasks for Extracts](https://help.tableau.com/v0.0/online/en-us/adminview_backgrnd.htm). Server administrators can manage extracts on the Jobs page. For more information, see [Managing Background Jobs in Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/server_backgrounder_job_management.htm). [Skip to main content](#main-content) # Create Lenses that Focus Ask Data for Specific Audiences **Important changes for Ask Data and Metrics** Tableau's Ask Data and Metrics features were retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau AI and Tableau Pulse are reimagining the data experience.](https://www.tableau.com/blog/tableau-pulse-and-tableau-gpt) Most people don't need information from an entire data source but instead want data visualizations relevant to their job function, like sales, marketing, or support. To optimize Ask Data for different audiences like these, Tableau authors create separate Ask Data _lenses_, which query a selected subset of fields. For the selected fields, authors can specify synonyms for field names and values, reflecting terms the lens audience uses in common language (for example, "SF" for "San Francisco"). Lens authors then customize the recommended visualizations that appear below the Ask Data query box, which provide answers to users with a single click. **Note:** Ask Data lenses can be created only for data sources published separately to a Tableau site. Lenses can't be created for data sources embedded in workbooks or those with a virtual connection. ## Create or configure a lens page on your Tableau site On your Tableau site, each lens has a separate page where users can query Ask Data and authors can configure lens fields, synonyms, and suggested questions. ![An Ask Data lens](/tableau/next/en-us/online/en-us/Img/ask_data_lens_page.png) A lens page on a Tableau site 1. To create a lens page on your Tableau site, go to a data source page, and choose New > Ask Data Lens. To configure an existing lens, go to the lens page on your site. (From an Ask Data object in a dashboard, you can click the pop-up menu in the upper corner and choose Go to Lens Page.) 2. If you're creating a new lens, enter a name, description, and project location, and then click Publish Lens. 3. At the top of the Fields pane at left, click the pencil icon. Then select the relevant fields for lens users, and click Save. ![An Ask Data lens with the number of fields highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_lens_fields.png) 4. At left, hover over individual tables or fields, and click the pencil icon: ![A list of fields with the edit icon next to one value.](/tableau/next/en-us/online/en-us/Img/ask_data_synonyms.png) Then do any of the following: - Provide a more representative name by clicking the pencil icon to the right. ![Field details with an edit icon.](/tableau/next/en-us/online/en-us/Img/ask_data_rename.png) - Add common synonyms for field names and values that lens users may enter in their queries. - Edit descriptions that appear when users hover over fields. ## Change the list of recommended visualizations To address common queries from lens users, you can customize the recommended visualizations that appear below the query box. ### Add or replace a recommended visualization 1. Enter a query into the text box, and press Enter or Return. 2. After the visualization appears, from the pin icon in the toolbar, choose either Pin to Recommended Visualizations or Replace Recommendation. ![Dropdown menu with two options: "Pin to recommended visualizations" and "Replace recommendation".](/tableau/next/en-us/online/en-us/Img/ask_data_pin_recommended.png) 3. For a new recommendation, enter a name, and choose the section in which you want it to appear. For a replacement recommendation, choose the existing one you want to overwrite. ### Edit section titles and recommendation names, or delete recommendations - To edit a section title, click the pencil icon ![Pencil icon.](/tableau/next/en-us/online/en-us/Img/ask_data_edit_pencil.png) to the right of the title. - To change the name of a recommendation, hover over it and click the pencil icon ![Pencil icon.](/tableau/next/en-us/online/en-us/Img/ask_data_edit_pencil.png). To delete a recommendation, click the X. ![Recommended visualizations](/tableau/next/en-us/online/en-us/Img/ask_data_lens_questions.png) ## Add an Ask Data lens to a dashboard On a dashboard, you can add an Ask Data object that lets users query a published data source via a lens on your Tableau site. 1. While editing a dashboard in Tableau Cloud or Tableau Server, drag the Ask Data object to the canvas. **Note:** In Tableau Desktop, you can also drag an Ask Data object to the canvas for placement purposes. But to select a lens, you will need publish to Tableau Cloud or Tableau Server and edit the object there. 2. ![The objects area with Ask Data emphasized.](/tableau/next/en-us/online/en-us/Img/ask_data_extension_to_canvas.png) 3. Select a published data source previously connected to the workbook. 4. To use an existing lens, select it, and click Use Lens. Or, to create a new lens, do one of the following: - If there are no lenses for the data source, click Go to Data Source Page. - If lenses already exist, click the data source name at the bottom of the dialog. 5. (New lenses only) Complete the steps in [Create or configure a lens page on your Tableau site](#Create). 6. Under Toolbar Options for Lens Users, select the buttons you want available to users. - Add Visualization to Pins lets users [add to the Recommended Visualizations list](#Change), which appears just below the query box. - Publish as Workbook lets users [save visualizations as workbook sheets](https://help.tableau.com/current/pro/desktop/en-us/ask_data_share.htm#Save) to their Tableau site. - Share Visualization lets users [share via email, Slack, or a link](https://help.tableau.com/v0.0/online/en-us/ask_data.htm#Share). In the lens, the publish (save icon), pin, and share options appear in the upper right corner: ![Save, Pin, and Share options highlighted in the Ask Data toolbar.](/tableau/next/en-us/online/en-us/Img/ask_data_toolbar_options.png) 7. (New lenses only) After you finish creating the lens, return to the Lens object in your dashboard, and click Refresh. Then select the new lens, and click Use Lens. ## Apply a different lens to an Ask Data dashboard object 1. From the pop-up menu at the top of the object, choose Configure. ![Portion of a viz with the Ask Data configure option highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_dashboard_configure.png) 2. Go to [Add an Ask Data lens to a dashboard](#Add), and repeat steps 2 onward. ## Change a lens name, description, or project location 1. Navigate to the lens page on Tableau Cloud or Tableau Server. 2. To the right of the lens name at the top of the page, click the three dots (...), and choose Edit Workbook. 3. Click Edit Lens Details. ## See how people use Ask Data with a lens For data source owners and lens authors, Ask Data provides a dashboard that reveals the most popular queries and fields, the number of visualization results that users clicked, and other helpful information. Filters let you narrow data down to specific users and time ranges. These stats help you further optimize a lens to increase the success of your users. **Note:** If you use Tableau Server, you can access this data in the Tableau Server Repository to create custom dashboards. 1. In Tableau Server or Tableau Cloud, navigate to a lens page. 2. To the left of the Ask Data text box, click the "Ask Data tips" icon. ![Hovered over information icon showing the Ask Data tips tooltip.](/tableau/next/en-us/online/en-us/Img/ask_data_tips_button.png) 3. In the lower-left corner of the tips dialog, click Usage Analytics. ## Let users email you questions about a lens As a lens owner, you can allow users to email you with questions about data structure, expected results, and more. This option is on by default, but you can turn it off using the steps below. 1. In Tableau Server or Tableau Cloud, navigate to a lens page. 2. To the left of the Ask Data text box, click the "i" shown above in [See how people use Ask Data with a lens](#See). 3. At the bottom of the tips dialog, click the eye icon next to "Contact the Lens Author" to enable or disable feedback. ![Optimize for Ask Data dialog with the eye icon highlighted to shown the option to show or hide the option to contact the lens author.](/tableau/next/en-us/online/en-us/Img/ask_data_disable_feedback.png) ## Permissions for publishing and viewing lenses For Ask Data objects in dashboards, no change to permissions should be required: by default, existing workbook authors can create lenses, and existing dashboard audiences can view them. But for reference, here's a detailed outline of required lens permissions for both dashboards and direct access via a data source page. To create and publish a lens, a user needs: - The Creator or Explorer user role - Lens Creation permission for the data source (inherited by default from the Connect permission) - Write permission for the parent project to which the lens is published To access and interact with a published lens, a user needs: - The Viewer role or above - Connect permission for the data source - View permission for the lens **Note:** By default, lens permissions like View reflect a project's permissions for workbooks. If Tableau administrators want to change default lens permissions, they can do so either individually for each project, or in bulk using the permissions API. [Skip to main content](#main-content) # Create Metrics with Tableau Pulse Tableau Pulse provides insights about your data based on metrics that you define. After you create a metric, you can add members of your organization as followers, and they'll receive regular email or Slack digests about their data. This digest surfaces trends, outliers, and other changes, keeping followers up to date on the data relevant to their work. To learn more about the data, these users can investigate a metric on Tableau Cloud and see how different factors contribute to changes in the data. These insights give them the information they need to make data-driven decisions without requiring them to do complex analysis in Tableau. ![Pulse home page](/tableau/next/en-us/online/en-us/Img/pulse_home.png) ## Metric definitions and metrics Behind every metric in Tableau Pulse is a metric definition. Viewers interact with metrics. Metric definitions specify the core metadata for those metrics. ![Parent-child relationship between definitions and metrics](/tableau/next/en-us/online/en-us/Img/pulse_metric_definition_diagram.png) **Metric definitions** are the set of metadata that functions as the single source of truth for all the metrics based on them. Defined by a user with a Creator, Site Administrator Explorer, or Explorer (can publish) site role. The following table provides an example of the metadata captured by a metric definition.

Metric definition for Superstore Sales
Definition field	Example value
Name	Superstore Sales
Measure and aggregation	Sum of Sales
Time dimension	Order Date
Compared to	Prior year
Adjustable metric filters	Region, Category
Number format	Currency
Data source goal measure	Sales Target
Granularity of goal measure	Daily
Value going up is	Favorable

**Metrics** are the interactive objects that sit in front of a definition. Created when users adjust filters or time options, which means that there can be many metrics based on a definition. Users follow and explore metrics to get insights. The following tables provide an example of the options configured for metrics. These options are applied on top of the core value that is specified by the metric definition.

Metric for Superstore Sales - Technology
Metric option	Example value
Time period	Quarter to date
Filters	Category: Technology
Manual goal	80K

Metric for Superstore Sales - Office Supplies
Metric option	Example value
Time period	Year to date
Filters	Category: Office Supplies
Manual goal	200K

To get started in Tableau Pulse, you create a metric definition that captures the core value that you want to track. At its most basic level, this value is an aggregate measure tracked based on a time dimension. The definition also specifies options such as the dimensions that viewers are able to filter by, the way the value is formatted, and the types of insights displayed. When you create this definition, Tableau automatically creates an initial metric and sends you to that metric's page. The initial metric created for a definition has no filters applied, but any time you or another member of your organization adjusts the metric filters or time options in a new way, Tableau Pulse creates an additional metric. People in your organization follow metrics, not metric definitions. By following individual metrics, they get insights specific to the dimensions that matter to them. The definition exists in order to let you manage the data for metrics from a single parent object. If a field in your data source changes, you can update the definition to reflect this change, and all metrics based on that definition will also reflect the change. Say that you're a member of a sales organization, and that organization needs to track metrics across different territories and product lines. In Tableau Pulse, you would create a metric definition that includes the core value of the sum of daily sales with adjustable metric filters for region and product line. Then, you would create metrics for each region and product line. Finally, you would add members of your organization as followers to the metrics that cover where and what they sell. ## What makes Tableau Pulse different Tableau Pulse presents a simplified way to create metric definitions, so that with only a few selections, you can make a definition that would normally require complex calculations to build in traditional Tableau viz authoring. Members of your organization use that metric definition as a jumping off point to make metrics relevant to their needs, by slicing the data based on different dimensions or time options. Because insights about these metrics are sent directly to followers, your colleagues get the data they need in their flow of work. With Tableau Pulse, users have an easy, self-service way to take part in guided data exploration. They can ask suggested questions to see how different dimensions affect the data. This guided exploration complements the more free-form analysis that's possible with the traditional Tableau viz authoring experience and allows users unfamiliar with Tableau analysis to understand their data. ![Questions and answers about metric data](/tableau/next/en-us/online/en-us/Img/pulse_qa.png) Note that though some parts of Tableau Pulse are similar to other Tableau features, Tableau Pulse combines metrics and insights in a simplified experience. In February 2024, with the release of Tableau Pulse, Ask Data and Tableau's legacy Metrics feature were retired. Like Ask Data, Tableau Pulse lets you ask questions of your data, so you can learn the how and why behind the numbers you see. Tableau Pulse also lets you create and track metrics, like the legacy Metrics feature, but Tableau Pulse metrics don’t stand alone. These metrics are the source of insights about your data. ## Data source requirements for metric definitions You create a metric definition by connecting to a published data source. For information about how to structure that data source, see [Set Up Your Data for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_data_source_requirements.htm). ## Configure the core definition After making sure that your data source will work with Tableau Pulse, you're ready to start creating your definition. The definition editor is optimized for larger screens, so you should create your definition using a desktop or laptop computer rather than a mobile device. To create metric definitions, you need a Creator, Site Administrator Explorer, or Explorer (can publish) site role on Tableau Cloud. If you have a Viewer site role, you can follow metrics and discover insights, but you can't create metric definitions. 1. From the Tableau Pulse home page, select New Metric Definition. 2. Select a data source to connect to, then select Connect. 3. For the Name, enter a name that isn't in use by other metric definitions. This name appears on all metrics based on the definition, so choose a name that's easy for others to understand. 4. For the Description (optional), provide brief details to help others make sense of the data. The description appears on the definition page. On the insights exploration page for each metric, the description shows when users select the info icon. 5. For Links (optional), add up to five links. These links appear on a metric’s insights exploration page. The links must begin with `https://`. 6. For Tags, add up to 10 tags. You can reuse tags that exist for other Tableau content or create new tags. These tags appear on the metric definition and on all metrics based on the definition. On the Tableau Pulse home page, users can sort their followed metrics and filter metric definitions by tag. ### Define the metric value 1. For the Measure, select the field to track. You can select a measure or a dimension, but dimensions must be aggregated as a count or count (distinct) so that they result in a measure that can be tracked. 2. For the Aggregation, select how Tableau Pulse should aggregate the field you're tracking. If you require a more complex aggregation, see [Create an advanced definition](#advanced). 3. For the Temporality, select Over time or Latest point in time. The temporality setting controls whether the metric value and the value for the points on a metric chart are cumulative over the period or a snapshot value for the latest date. For example, a metric with a month-to-date time period and an over-time temporality would, on the 15th day of the month, show a cumulative value for days 1–15. That same metric with a point-in-time temporality would show a value that captures the data as it stands on the 15th. This setting also affects the options that are available for the Show sparkline values to date setting. Metrics with a point-in-time temporality always have a non-cumulative chart. In addition to the overall chart being non-cumulative, for a point-in-time temporality, each point on the metric chart shows the value for the latest date in the period covered by that point. So for a chart where each point represents a week of data, the value is for the last date in that week. 4. For Show sparkline values to date as, select whether you want the points on the metric chart to display as a running total or as non-cumulative values. This setting applies to the sparkline, the overview line chart, and applicable insights. For metrics that are sums, the current value shown at the top of the metric will always be a running total for the period you're tracking. 5. For the Definition filters (optional), select values to limit the metric data. Definition filters affect the data for all metrics based on the definition and aren't adjustable by the viewer. Fields added as definition filters change the meaning of the definition. For example, a definition filter might exclude returned orders to define net sales. If you simply want to use a field to segment the data, add an adjustable metric filter, available under the Options section. For more information, see [Define metric options](#options). 6. For the Time dimension, select the field to define the time series. In March 2025, the advanced time settings moved to the Time step. To configure those options, see [Configure time settings](#time-settings). #### How fiscal calendars work with metrics If your time dimension is configured to use a fiscal calendar, Tableau Pulse uses that calendar. The metrics based on a definition with a fiscal calendar show fiscal years and fiscal quarters on charts and insights. When you create a definition, the fiscal start month is listed under the time dimension field, if one is set. You can't adjust the fiscal calendar in Tableau Pulse. To change it, edit the data source used by the definition. For more information, see [Fiscal Dates](https://help.tableau.com/current/pro/desktop/en-us/dates_fiscal.htm). #### Create an advanced definition If you prefer the flexibility of working in the traditional Tableau viz authoring environment, or if you need to create calculated fields, use the advanced analytics editor. Using the advanced analytics editor is optional. 1. On the definition panel, select Create Advanced Definition. 2. Add fields to the measure, time dimension, and filters shelves. Only the fields, including calculated fields, that you add to these shelves are saved by the editor. Number format changes, granularity adjustments, or table calculations made in the advanced editor don't carry over. Instead, use the definition settings to set a [minimum time granularity](#minimum-time) or [change the number format](#number-format). 3. Select Apply. The fields you added in the editor replace the equivalent fields in the definition panel. To edit these fields, reopen the editor. You can't edit fields configured in the advanced analytics editor in the definition panel. ### Define metric options 1. For Adjustable metric filters, add at least one option. These filter options appear on metrics and allow users to scope the data to meet their needs. Filtering creates additional metrics from a definition. The first 20 fields that you add as adjustable metric filters also determine the dimensions used to generate insights about the data. If you add more than 20 fields, those options still appear as filters, but they aren't used to generate insights or available as breakdown options. 2. For the Number format, you can specify custom units to show for the value, or you can set the value to display as currency or as a percentage. 3. For Decimal places, select the number of decimal places to show for metric values. By default, Tableau Pulse automatically determines the number of decimal places to show. As numbers get larger, Tableau Pulse shows fewer decimal places. ## Configure time settings The time settings are optional and let you adjust the time series and comparisons for metrics so that they fit your data. ### Set a date offset A date offset changes the final point in a metric’s time series from today to a day in the past. An offset is useful if the data in the metric’s data source refreshes at a delay. Otherwise, if there isn’t any data for the final point in the time series, a metric shows a null value. There are two types of offsets: fixed and dynamic. A fixed offset shifts the end of the time series a specified number of days. A metric with a fixed offset of 2 days shows the time period “2 Days Ago” instead of “Today.” A dynamic date offset automatically adjusts to show the most recent date with data instead of “Today.” So if the data source doesn’t update for several days, the offset increases to continue showing the most recent date with data. 1. For the Date offset, select Fixed or Dynamic. 2. For a fixed offset, enter the number of days to shift the time series by. #### Write calculated fields that work with dynamic offsets If the measure for a metric definition uses a calculation to aggregate multiple fields, any of those fields having a null value for a date will result in the aggregate value for that date being null. A dynamic offset skips dates that have a null value to find the most recent date with data. To make sure that Tableau Pulse doesn’t skip over dates that do have data, use an IF statement in the calculation to identify any dates that have at least one non-null field, and then apply the ZN (zero if null) function. The ZN function transforms the null values to zeroes so that they can be aggregated with the other fields that do have data, and the dynamic offset then identifies that date as having data. For more information about these functions, see [Number Functions (ZN)](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_number.htm#zn) and [Logical Functions (IF)](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_logical.htm#if). ### Set the minimum granularity The minimum granularity controls the time options available when users filter metrics. That way, users can’t select options that have no data. 1. For the Minimum time granularity, select a larger granularity if smaller units like day or week don’t make sense based on your data. ### Customize the comparison 1. For Time comparison > Primary, select Prior period to compare to the prior day, week, month, quarter, or year, or select Prior year to compare to the same time range a year ago. The primary time comparison is displayed in digests and insights and on the metric overview card. 2. For Time comparison > Secondary, if you don't want metrics to show a secondary comparison, select None. The secondary comparison appears in addition to the primary comparison on a metric's insights exploration page. #### Set a custom daily comparison A custom daily comparison allows you to override the standard comparison for metrics that have a time range of “Today” or “Yesterday.” A custom comparison requires two fields in your data source: the custom daily comparison and the reference date. The reference date defines which dates show a custom comparison, and the custom daily comparison supplies the alternative dates. The fields for the reference date and the custom daily comparison must belong to the same table in the data source. Use this setting to compare events that don’t fall on a consistent date each year. For example, you can compare Black Friday this year to Black Friday a year ago. Without a custom comparison, a metric showing data for November 28, 2025 shows a prior year comparison to November 28, 2024. With a custom comparison, you can specify a daily comparison of November 29, 2024 for the reference date of November 28, 2025. That way, Tableau Pulse compares sales data for the same event. 1. For Custom daily comparison, select a date field. This field contains the alternative dates for the daily comparison. 2. For Reference date, select a date field. This field determines which dates show a custom comparison. You can reuse the time dimension from the core definition as long as it belongs to the same data table as the custom daily comparison. ### Set a custom calendar The calendar must be defined in your data source, and all of the calendar fields must come from the same table. For more information, see [Data source requirements for metric definitions](#ds-requirement-calendar). 1. Under Calendar, select Set Calendar. 2. Select the fields in your data source that define the custom calendar. - Day of year (data type: number) - Week of year (data type: number) - Month of year (data type: number) - Month name (data type: string) - Quarter (data type: number) - Year (data type: number) - Reference date (data type: date) 4. Select Apply. ## Configure data source goals and thresholds Configuring a data source goal or threshold is optional. For information about structuring your data source for goals and thresholds, see [Data source requirements for metric definitions](#ds-requirement-goals). A data source goal or threshold uses a field from your data source to show dynamic goal or threshold values on metrics. For goals, Tableau Pulse shows a metric’s progress toward the goal value. If the pace to goal insight is turned on, you also see whether the metric is expected to meet the goal by the end of the period. For thresholds, Tableau Pulse shows how far the metric is from the threshold value. Data source goals or thresholds appear on all metrics based on a definition. The goal or threshold value is filtered by the filters applied to a metric if data exists for that level of granularity. If data doesn’t exist for specific values or dimensions, Tableau Pulse displays the goal or threshold value for a higher level of detail that does have data. That higher-level goal or threshold value might not be relevant for the filtered metric, so make sure that your data source has data of the appropriate granularity. 1. On the Goal and Threshold step, select the Type. You can configure either a goal or a threshold, but not both. 2. For Measure, select the field from your data source to use for the goal or threshold value. 3. Data source goals and thresholds inherit the definition filters from the core definition unless those filters were set in the advanced editor. If the definition filters weren’t inherited, add any relevant filters. 4. For Aggregation, select how the data is aggregated for time periods that are greater than the goal granularity. 5. For Time dimension, select the field to use for the time series. 6. For Minimum granularity, select the level of detail represented by each row of the measure. Metrics with time ranges smaller than this granularity don’t show a goal or threshold. 7. If you’re setting a threshold, for the Unfavorable Range, select whether above or below the threshold is unfavorable. The unfavorable range is shaded red on the metric chart. When the aggregate metric value crosses into this range, followers receive an alert. For more information, see [Get Tableau Pulse Alerts](https://help.tableau.com/v0.0/online/en-us/pulse_alerts.htm). 8. To change the label for the goal or threshold, under Custom goal label, enter a name. This custom label appears on the goal progress indicator, chart, and in insights. ### Advanced goals and thresholds To configure a data source goal or threshold that uses calculated fields, create an advanced goal or threshold. The advanced analytics editor lets you use the familiar Tableau viz authoring environment to create calculations that define your goal or threshold. With the advanced editor, you can write calculations using fields from your data source, or you can write calculations that define static numeric values for goals or thresholds. These static values appear on all metrics based on the definition. If you define static values, you can use logical functions to define how the values correspond to different conditions. For example, use if statements to define the goals or thresholds that appear for specific filter values. For more information about writing logical calculations, see [Logical Functions](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_logical.htm). ### Manual goal and threshold overrides A manual goal or threshold is a single number that anyone with permission can set on an individual metric. If someone sets a manual goal or threshold on a metric, that value overrides any data source goal or threshold. If the manual override is removed, the data source goal or threshold appears again. To learn about manual goals and thresholds, see [Set Manual Goals and Thresholds with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_goals.htm). ## Configure insights On the Insights tab, the fields under Insight dimensions are the same fields that you added as adjustable metric filters. Tableau Pulse uses these dimensions when monitoring your data to surface relevant insights, as shown in the insights preview. ### Add dimension links A metric page shows a breakdown chart for each insight dimension. The dimension links that you add appear on this breakdown chart as well as on the bar charts for metric insights. Viewers can explore dimension links by clicking the bars on the chart. 1. Under Dimension links, select Add Link. 2. For Dimension, select the dimension to add the link to. You can select only dimensions that you added as adjustable metric filters under the Core Definition step. This is because the adjustable metric filters determine the insight dimensions for metrics. 3. For the Text, enter the label that will appear on the chart for this link. This text is the same for all dimension members, so choose a label that makes sense for every member. 4. For the Link, enter a URL that begins with `https://`. You can insert up to three dimensions as variables in this URL to make the link dynamic. 5. Select Apply to add the link. You can add up to 20 dimension links. ### Set the sentiment 1. For Value going up is, select whether the change is neutral, favorable, or unfavorable. This option controls the color for the change value: blue for neutral, green for favorable, and red for unfavorable. It also affects the language used in insights that refer to the change. ### Turn insight types on or off You can select which insights are shown for metrics by turning them on or off. For an overview of insight types and the insights platform, see [The Insights Platform and Insight Types in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_insights_platform_insight_types.htm). 1. Under Insight types, select Turn On or select the … menu then select Turn Off to adjust the types of insights shown. Hover over the info icon for a description of each type. #### Correlated Metrics When this insight is turned on, you will need to select up to five metric definitions that can be considered for correlation with the metric you are defining. The correlated metrics insight appears only for a metric designated as a correlation candidate if the correlation coefficient between two metrics is 0.7 or greater. Additionally, the correlation must be found in the period that the metric covers or that you are asking about, in the case of Tableau Agent in Pulse. 1. Select Add Candidates. 2. In the Manage Correlation Candidates dialog box, select metric definitions that you want Tableau Pulse to watch for correlations. Try to select metric definitions of interest that don't already have an obvious causal relationship. 3. Select Apply when you are done. #### Record-level Outlier When this insight is turned on, it requires additional configuration. 1. For the Record identifier, select a field in your data that has a unique value for every record, for example, Order ID. 2. For the Record identifier name (optional), select a field in your data that has a name that corresponds to the record identifier, for example, Order Name. 3. For Singular and Plural (optional), add names for the records as they should appear in insights text, for example Order and Orders. ## Configure governance The governance settings for a metric definition are optional. ### Certify the definition Metrics based on certified definitions show a badge that indicates their trusted and recommended status. Certify a metric to tell others that they can rely on that data to make business decisions. 1. Under Endorsement, turn on the Certified definition toggle. To certify a metric definition, you must have the Create Metric Definitions permission capability for the data source that the definition is connected to. Certifying a metric definition is a separate action from certifying a data source, and data source certification doesn’t appear on metrics. To learn about certified data sources, see [Use Certification to Help Users Find Trusted Data](https://help.tableau.com/v0.0/online/en-us/datasource_certified.htm). ### Restrict editing for definitions and manual goals and thresholds By default, any user with the correct site role can edit or delete a metric definition. All users can set, edit, or delete manual goals or thresholds for the metrics based on that definition. You can restrict these actions to specific users and groups. Tableau administrators always have permission to edit because their site role gives them access. Users with the site role of Creator, Site Administrator Explorer, or Explorer (can publish) can edit metric definitions. If you give a Viewer access to edit a definition, that user won’t be able to edit the definition because the site role doesn’t allow it. The ability to edit manual goals and thresholds isn't limited by site role. 1. Under Edit definition or Edit manual goals and thresholds, select Anyone Can Edit. 2. Select the Restrict editing toggle. 3. Enter the users and groups to add as editors. 4. Select Add. 5. Close the Manage Editors dialog. ### Save the metric definition 1. Verify that the metric and insights previews look as expected, then select Save Definition. Tableau Pulse creates the definition along with the initial metric based on that definition, which has no adjustable metric filters applied. You can find your definition under the Browse Metrics tab on the Tableau Pulse home page. ## Create metrics After you create your definition, you’ll be taken to the initial metric for that definition. This page is the insights exploration page for that metric. On it, you can see insights based on dimensions that you select, and you can create more metrics by adjusting filters. 1. On a metric for your definition, select Filter. The filter labels become interactive. 2. Select the buttons to change the time and filter options. 3. Select the check mark button. If a metric with that combination of filters doesn’t yet exist, Tableau Pulse creates one. To learn how viewers interact with these metrics, see [Explore Metrics with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm). ### Why is the chart for a metric incomplete? When you create metrics with different time periods, it can reveal issues with your data. If there’s missing data for the period that the chart covers, then the metric value or the expected range might appear incomplete. #### The metric value is incomplete or missing If the metric value is incomplete, it might indicate an issue with the data, or it might be a normal consequence of the time period that the chart covers. At the beginning of the period for a period-to-date metric, the chart shows only a single point of data. If you instead want to see the most recent 7, 30, or 90 days of data, filter to show a rolling time window. If there’s no data for the current period but there’s data for previous periods, then the data source that the metric is connected to might refresh at a delay. You can set a date offset to account for this delay. #### The expected range is incomplete The expected range appears for points on the chart that have data. On non-cumulative charts, both the metric value and the expected range are missing for points without data. For metrics that show a running total, if there’s data for at least two points in the period, the chart shows a cumulative line for the metric value, but the points without data don’t have an expected range. For metrics with a quarter-to-date time range, the quarter might start in the middle of a week. If the first week of the quarter is a partial week, then an expected range isn’t shown for that week. ## Manage followers For information about adding and removing followers from metrics, see [Follow Metrics and Manage Followers in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_manage_followers.htm). ## Edit a metric definition If your data source changes, and the metrics that are based on it break, edit the metric definition to account for these changes. Any changes that you make to the definition will affect all metrics based on it. 1. Open a metric for the definition you want to edit. 2. Select the actions menu, then select Edit Definition. ![Edit definition button](/tableau/next/en-us/online/en-us/Img/pulse_edit_definition.png) ### How editing a definition affects metrics and goals When you edit a definition, your changes might affect the metrics based on the definition and the goals based on those metrics.

Changed field	Affected feature	Impact
Definition filters, adjustable metric filters	Metrics	If you remove an adjustable metric filter or add a definition filter that excludes a value used in a metric filter, metrics using that filter aren’t deleted. Existing followers of an affected metric are able to adjust the filter and add other followers. However, users who aren't already followers can’t follow that metric on their own. To make it so users no longer see metrics that are based on eliminated filters, remove the followers from those metrics. Alternatively, if you want to get rid of all of the metrics for a definition, delete the definition.

## Clone a metric definition If you need to create multiple similar metric definitions, clone an existing definition. Cloning a metric definition copies all of the configuration from the original definition except for the governance step. Because you can’t have two identical metric definitions in Tableau Pulse, you must adjust the cloned definition before you save it. 1. On a metric definition page, select Clone Definition. You can also select Clone Definition from the actions (⋯) menu on a metric’s insights exploration page. 2. On the Core Definition step for the cloned definition, change at least one of the measure, aggregation, time dimension, or adjustable metric filters. 3. Review the other steps and make any adjustments needed. 4. Select Save. A cloned definition doesn’t persist until you save it. ## Delete a metric definition Deleting a metric definition also deletes all of the metrics based on it. 1. On the Tableau Pulse home page, select the Browse Metrics tab. 2. On the metric definition that you want to delete, select the actions (...) menu, then select Delete. ## Add metrics to dashboards and create metrics from dashboards For information about the Pulse metric dashboard object and recommendations for metrics based on dashboard data, see [Work with Tableau Pulse Metrics and Dashboards](https://help.tableau.com/v0.0/online/en-us/pulse_dashboard.htm). ## Embed metrics You can use the Embedding API to embed Tableau Pulse metrics in web pages. For more information, see [Embed Tableau Pulse](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_pulse.html). [Skip to main content](#main-content) # Create Views and Explore Data on the Web You can create and interact with views on Tableau Cloud. For more information, see the following topics in the Tableau Help for users. [Using Tableau on the Web](https://help.tableau.com/current/pro/desktop/en-us/web_author_home.htm) [Tour your Tableau Site](https://help.tableau.com/current/pro/desktop/en-us/navigating.htm) [Edit Views on the Web](https://help.tableau.com/current/pro/desktop/en-us/web_author_build_view.htm) [Join your Data](https://help.tableau.com/current/pro/desktop/en-us/joining_tables.htm) [Create a Dashboard](https://help.tableau.com/current/pro/desktop/en-us/dashboards_create.htm) [Create a Story](https://help.tableau.com/current/pro/desktop/en-us/story_create.htm) [Embed Views and Dashboards in Web Pages](https://help.tableau.com/current/pro/desktop/en-us/embed_landing.htm) [Make Workbooks Compatible Between Versions](https://help.tableau.com/current/pro/desktop/en-us/publish_version_compatibility.htm) ## Alerts and subscriptions [Troubleshoot Subscriptions](https://help.tableau.com/current/server/en-us/subscribe_trouble.htm) [Send Data-Driven Alerts from Tableau Cloud or Tableau Server](https://help.tableau.com/current/pro/desktop/en-us/data_alerts.htm) ## Other articles in this section [Skip to main content](#main-content) # Create Workbooks with Salesforce Data You can quickly author and analyze Salesforce data in Tableau. Sign in to Salesforce directly from your Tableau Cloud site and select the clouds you want to explore. Tableau integrates your Salesforce data to create a project with ready-to-use starter workbooks and data sources - choose to explore them on your own or share them with other users on your site. ## What’s included with the Salesforce project The Salesforce project includes starter workbooks and data sources, all built using your Salesforce data. Use the starter workbooks to quickly answer questions about your Nonprofit, Sales, and Service Clouds, or connect to Salesforce Admin Insights to see usage trends in your organization. ![A dashboard with charts and filters that display the open sales pipeline for a team.](/tableau/next/en-us/online/en-us/Img/connect_salesforce_starter.png) ### Nonprofit Cloud Connect to Nonprofit Cloud to analyze your organization's programs and drive impact. Includes starter workbooks for: _Nonprofit Case Management - Service Delivery and Staff Capacity_, _Nonprofit Case Management Assessments_, _Nonprofit Case Management Enrollment_, _Nonprofit Case Management Intake_, and _Nonprofit Fundraising Overview_. ### Sales Cloud Connect to Sales Cloud to visualize your sales funnel and better support your sales team. Includes starter workbooks for: _Account Tracking_, _Open Pipeline_, _Opportunity Overview_, _Opportunity Tracking_, _Quarterly Sales Results_, _Top Accounts_, and _Marketing Leads_. ### Salesforce Admin Insights Connect to Salesforce Admin Insights to visualize usage trends and engagement with your organization. Includes starter workbooks for: _Salesforce Admin Insights_. ### Service Cloud Connect to Service Cloud to analyze and explore your critical service metrics and cases. Includes starter workbooks for: _Service Overview_ and _Case Tracking_. ## Connect to Salesforce Connecting to your Salesforce data is simple. Once you sign in and select the Clouds to explore, Tableau creates a new project and publishes workbooks and data sources on your site. When the publishing process is complete, you can [edit the resulting workbooks](https://help.tableau.com/current/pro/desktop/en-us/help.htm#web_author_build_view.htm) just like any other, quickly customizing them for your needs. To connect to Salesforce, you must be an administrator with the Site Administrator Creator site role and have API access to your Salesforce instance. API access requires Salesforce Professional Edition or higher. For more information, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm). 1. Sign in to your Tableau Cloud site as an administrator, and select Settings > Integrations. 2. On the Integrations tab, click Connect to Salesforce Data and complete prompts to authorize access to Salesforce. 3. In the Connect to Salesforce dialog window, select the Clouds you want to explore. 4. Specify a name and initial permissions for the project. You can set permissions for **Only administrators**, or choose to **Inherit permissions from the Default project**. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). 5. Review your selections and click Publish. At this point, you’ve created a new project and published starter workbooks. While Tableau prepares extracts of your Salesforce data, sample data appears in the workbooks so you can explore the layout. You’ll receive an email when your Salesforce data is refreshed and added to the workbooks. **Note:** Depending on the size of your data source, it may take some time to create extracts. You can view the status of your Salesforce extracts on the [Background Tasks for Extracts](https://help.tableau.com/v0.0/online/en-us/adminview_backgrnd.htm) administrative view. To see your project and other content you have access to, from the navigation menu, click Explore. ![Salesforce project folder in Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/connect_salesforce_project.png) ### Use existing Salesforce credentials If you've already connected to Salesforce, you can use existing credentials to create additional starter workbooks. From the Integrations tab, click Connect to Salesforce Data, and select the Salesforce credentials you want to use from the drop-down menu. Tableau creates a new project every time workbooks publish on your site. **Note:** Workbooks will publish on the site with your Salesforce credentials embedded. All users with permission to view the workbook will be able to see data based on these credentials. ![Option to connect to Salesforce data.](/tableau/next/en-us/online/en-us/Img/connect_salesforce_credentials.png) ## Schedule refreshes to keep data fresh To make sure you see the latest information when viewing workbooks or connecting to data sources, you’ll need to schedule refreshes. By default, the Salesforce data extracts created when publishing starter workbooks will not refresh automatically. For more information about refresh schedules, see [Schedule Refreshes on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/schedule_add.htm). Follow the steps below to schedule extract refreshes: 1. In Tableau Cloud, navigate to the project containing your Salesforce content. 2. Select the data source you want to refresh, click Actions, and choose Refresh Extracts... 3. In the Create Extract Refresh dialog window, select the **Refresh Type** and **Refresh Frequency**, and click Create. ## Subscriptions You’re automatically subscribed to Salesforce workbooks and will receive notification emails every time the data is refreshed. If you want to update your subscription preferences, see [Create a Subscription to a View or Workbook](https://help.tableau.com/v0.0/online/en-us/subscribe_user.htm). ## Change permissions for projects, workbooks, and data sources After connecting to your Salesforce data, you can choose how users interact with the Salesforce project, workbooks, and data sources published on your site. Permissions are a great way to make sure the right users have access to the starter content and enable them to build workbooks of their own. For more information about configuring permissions on your site, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). ## Create workbooks in Tableau Cloud With your Salesforce data sources, you can create new workbooks through web authoring in Tableau Cloud or use Ask Data to query and create visualizations automatically. - **Web Authoring:** Connect to your data directly in Tableau Cloud to explore and create custom data visualizations of your own. For more information, see [Creators: Get Started with Web Authoring](https://help.tableau.com/current/pro/desktop/en-us/getstarted_web_authoring.htm) in Tableau Desktop help. - **Ask Data:** Interact with your data by simply typing a question and see automatic data visualizations in response. For more information, see [Automatically Build Views with Ask Data](https://help.tableau.com/current/pro/desktop/en-us/ask_data.htm) in Tableau Desktop help. ## Fix grayed-out views by replacing field names If your organization has customized the data structure of your Salesforce data, you may need to match those changes in the starter workbooks after your data loads in them. For example, if your organization has renamed the Salesforce “Account” field to “Customer”, you'll need to make a corresponding change in workbooks to avoid grayed-out views like this: ![A grayed out sales performance dashboard.](/tableau/next/en-us/online/en-us/Img/jumpstarts_grayed_out.png) To fix grayed-out views: 1. Above the dashboard, click Edit. 2. Navigate directly to the grayed-out sheet. 3. In the Data pane at the left, look for red exclamation points (!) next to field names, which indicate that your organization uses different names. 4. Right-click each of those fields, and choose Replace References. Then select the correct field name from the list. ![Context menu expanded from a measure with the option to replace references highlighted.](/tableau/next/en-us/online/en-us/Img/jumpstarts_replace_references.png) [Skip to main content](#main-content) # Creators: Connect to Data on the Web Before you can create a workbook and build a view on the web to analyze your data on the web, you must connect to your data. Tableau supports connecting to data sources on the web published through Tableau Desktop, or, connecting to data directly through Tableau Cloud, Tableau Server, or Tableau Public. Starting in 2019.3, Tableau Catalog is available as part of the Data Management offering for Tableau Server and Tableau Cloud. When Tableau Catalog is enabled in your environment, in addition to navigating and connecting to data from Explore, you can navigate and connect to more kinds of data, like databases and tables, from Tableau Catalog For more information about Tableau Catalog, see "About Tableau Catalog" in the [Tableau Server](https://help.tableau.com/current/server/en-us/dm_catalog_overview.htm) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/dm_catalog_overview.htm) Help. Starting in 2021.4, Data Management includes virtual connections, a central access point to data. For more information, see "About Virtual Connections and Data Policies" in the [Tableau Server](https://help.tableau.com/current/server/en-us/dm_vconn_overview.htm) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/dm_vconn_overview.htm) help. ## Open the Connect to Data page On the web, you use the Connect to Data page to access data to connect to. After you sign in to Tableau Server or Tableau Cloud, you can open this page two ways: - Home \> New > Workbook - Explore > New > Workbook If you’re on Tableau Public, you can open this page from your author profile: - My Profile \> Create a Viz The Connect to Data dialog displays a scrollable list of mixed content that’s popular. If you have a Data Management license, you can connect to data with a virtual connection, and if you have Data Management with Tableau Catalog enabled, you can also connect to external assets, like databases, files, and tables. The responsive search field shows a list of suggestions that updates as you enter text. Filter search results by type of data, certification status, or other filters that depend on the type of data selected. For example, some types of data may allow you to filter based on tags, connection type, data quality warnings, or other criteria. Older versions of the dialog look and function slightly differently, but the overall function is similar. ![Connect to data on Tableau Cloud with options to connect to data sources, virtual connections, databases and files, or tables.](/tableau/next/en-us/online/en-us/Img/connect_to_data.png) On the Connect to Data page, the tabs you see depend on the product you have. On Tableau Server, select from the following tabs to connect to data: On this site, Files, and Connectors. ### Connect to data On this site 1. Select On this site to browse to or search for published data sources. 2. Select the data source under Name and click the Connect button. **Note:** In addition to connecting to data sources, when you have Data Management, you can use On this site to connect to data using a virtual connection. When Tableau Catalog is enabled you can also connect to databases, files, and tables. ### Connect to files Tableau supports uploading Excel, text-based data sources (.xlsx, .csv, .tsv), and spatial file formats that only require one file (.kml, .geojson, .topojson, .json, and Esri shapefiles and Esri File Geodatabases packaged in a .zip) directly in your browser. In the Files tab of the Connect to Data pane, connect to a file by dragging and dropping it into the field or clicking Upload from Computer. The maximum file size you can upload is 1 GB. ### Use connectors From the Connectors tab, you can connect to data housed in a cloud database or on a server in your enterprise. You must supply connection information for each data connection that you make. For example, for most data connections, you must supply a server name and your sign-in information. [Supported Connectors](https://help.tableau.com/current/pro/desktop/en-us/exampleconnections_overview.htm) has information on how to connect Tableau to each of these connector types to set up your data source. If the connector you need doesn't appear in the Connectors tab, you can connect to data through Tableau Desktop and publish your data source to Tableau Cloud or Tableau Server for web authoring. Learn more about how to [Publish a Data Source](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources.htm) in Tableau Desktop. When Tableau successfully connects to your data, the Data Source page opens so that you can prepare the data for analysis and begin building your view. To learn more, see [Creators: Prepare Data on the Web](https://help.tableau.com/current/pro/desktop/en-us/creator_data_prep.htm). #### Tableau Server connectors

Actian Matrix*

Alibaba AnalyticDB for MySQL‡

Alibaba Data Lake Analytics‡

Alibaba MaxCompute‡

Amazon Athena‡

Amazon Aurora for MySQL‡

Amazon EMR Hadoop Hive‡

Amazon Redshift‡

Apache Drill‡

Aster Database*

Azure Data Lake Storage Gen2‡

Box‡

Cloudera Hadoop‡

Databricks‡

Datorama by Salesforce‡

Denodo‡

Dremio by Dremio‡

Dropbox‡

Esri Connector‡

Exasol‡

Google BigQuery**‡

Google BigQuery JDBC**‡

Google Cloud SQL‡

Google Drive‡

Impala‡

Kognito*

Kyvos‡

Hortonworks Hadoop Hive

IBM BigInsights

IBM DB2‡

IBM PDA (Netezza)*

Kyvos‡

MariaDB‡

MarkLogic*

Microsoft Azure SQL Database‡

Microsoft Azure Synapse Analytics‡

Microsoft SQL Server‡

MonetDB*

MongoDB BI Connector‡

MySQL‡

OData‡

OneDrive‡

Oracle‡

Pivotal Greenplum Database‡

PostgreSQL‡

Progress OpenEdge*

Presto‡

Qubole Presto‡

SAP HANA (for virtual connections only)‡

SAP Sybase ASE*

SAP Sybase IQ*

Salesforce‡

SharePoint Lists‡

SingleStore (formerly MemSQL)‡

Snowflake‡

Spark SQL‡

Teradata***‡

Vertica‡

\*Not available on Linux servers. \*\*Google BigQuery needs OAuth when creating data sources from the web. Learn more about how server administrators can [Set up OAuth for Google.](https://help.tableau.com/current/server/en-us/config_oauth_google.htm) \*\*\*Teradata web authoring currently doesn’t support query banding functionality. See [Teradata](https://help.tableau.com/current/pro/desktop/en-us/examples_teradata.htm) for details. ‡Supports virtual connections if you have Data Management. See [About Virtual Connections and Data Policies](https://help.tableau.com/current/server/en-us/dm_vconn_overview.htm) in the Tableau Server help for details. #### Tableau Catalog Supported Connectors Tableau Catalog supports making a connection with a subset of the data connectors that Tableau Server supports. If a data source, database, file, or table is grayed out, you can't connect from Tableau Server. You can, however, connect from the Tableau Desktop Connect pane, if you have the correct permissions. On Tableau Cloud, select from the following tabs to connect to data: On this site, Files, Connectors, and Dashboard Starters. ### Connect to data On this site 1. Select On this site to browse to or search for published data sources. 2. Select the data source under Name and click the Connect button **Note:** In addition to connecting to data sources, when you have Data Management, you can use On this site to connect to data using a virtual connection. When Tableau Catalog is enabled you can also connect to databases, files, and tables. ### Connect to files Tableau supports uploading Excel or text-based data sources (.xlsx, .csv, .tsv) directly in your browser. In the Files tab of the Connect to Data pane, connect to an Excel or text file by dragging and dropping it into the field or clicking Upload from Computer. The maximum file size you can upload is 1 GB. ### Use connectors From the Connectors tab, you can connect to data housed in a cloud database or on a server in your enterprise. You must supply connection information for each data connection that you make. For example, for most data connections, you must supply a server name and your sign-in information. [Supported Connectors](https://help.tableau.com/current/pro/desktop/en-us/exampleconnections_overview.htm) has information on how to connect Tableau to your data using connectors. If the connector you need doesn't appear in the Connectors tab, you can connect to data through Tableau Desktop and publish your data source to Tableau Cloud or Tableau Server for web authoring. Learn more about how to [Publish a Data Source](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources.htm) in Tableau Desktop. **Note**: If you’re unable to connect to your data from Tableau Cloud, check to see if the database is publicly accessible. Tableau Cloud can only connect to data that's accessible from the public internet. If your data is behind a private network, you can connect using Tableau Bridge. To learn more, see [Publishers: Use Tableau Bridge to Keep Tableau Cloud Data Fresh](https://help.tableau.com/current/online/en-us/qs_refresh_local_data.htm). #### Tableau Cloud Connectors

Alibaba AnalyticsDB for MySQL‡

Alibaba Data Lake Analytics‡

Amazon Athena‡

Amazon Aurora for MySQL‡

Amazon EMR Hadoop Hive‡

Amazon Redshift‡

Apache Drill‡

Azure Data Lake Storage Gen2‡

Azure Synapse Analytics (SQL Server compatible)

Box‡

Cloudera Hadoop‡

Databricks‡

Datorama by Salesforce‡

Denodo‡

Dremio by Dremio‡

Dropbox*‡

Esri Connector‡

Exasol‡

Google BigQuery*‡

Google Cloud SQL (MySQL compatible)‡§

Google Drive‡

Hortonworks Hadoop Hive

Impala‡

Kyvos‡

MariaDB‡

Microsoft Azure SQL Database‡

Microsoft Azure Synapse Analytics‡

Microsoft SQL Server‡

MongoDB BI Connector‡

MySQL‡

OData‡

OneDrive*‡

Oracle‡

Pivotal Greenplum Database‡

PostgreSQL‡

Presto‡

Qubole Presto‡

Salesforce‡

SAP HANA (for virtual connections only)‡

SharePoint Lists‡

SingleStore (formerly MemSQL)‡

Snowflake‡

Spark SQL‡

Teradata**‡

Vertica‡

\*For more information about using OAuth 2.0 standard for Google BigQuery, OneDrive, and Dropbox connections in Tableau Cloud, see [OAuth Connections](https://help.tableau.com/current/online/en-us/protected_auth.htm). \*\*Teradata web authoring currently doesn’t support query banding functionality. See [Teradata](https://help.tableau.com/current/pro/desktop/en-us/examples_teradata.htm) for details. ‡Supports virtual connections if you have Data Management. See [About Virtual Connections and Data Policies](https://help.tableau.com/current/online/en-us/dm_vconn_overview.htm) in the Tableau Cloud help for details. §Tableau Cloud doesn't support SSL using Google Cloud SQL. #### Tableau Catalog Supported Connectors Tableau Catalog supports making a connection with a subset of data connectors that Tableau Cloud supports. If a data source, database, file, or table is grayed out, you can't connect from Tableau Cloud. You can, however, connect from the Tableau Desktop Connect pane, if you have the correct permissions. ### Use Dashboard Starters On Tableau Cloud, you can author and analyze data from LinkedIn Sales Navigator, Oracle Eloqua, Salesforce, ServiceNow ITSM, and QuickBooks Online using Dashboard Starters. On the Dashboard Starter tab, from the list of pre-built designs, select an option and click Use Dashboard. See [Dashboard Starters for Cloud-based Data Sources](https://help.tableau.com/current/pro/desktop/en-us/starters.htm) for details. ### Web Authoring with Tableau Bridge When authoring data views or working directly on the web within Tableau Cloud, Tableau Bridge provides full query support for a wide array of databases and cloud data environments: - **Named connectors**: You can establish brand-new data connections directly during web authoring sessions for any supported named connectors exposed in the Tableau Cloud connection pane. - **Non-named / generic connectors**: Web authoring is fully compatible with certain non-named database connectors when modifying content that already points to a functional, pre-existing Bridge-backed architecture. This includes: - The Edit Data Source option may not be available for all non-named connectors. - Editing an embedded data source inside an existing, functioning cloud workbook. Tableau does not support editing published data sources via web authoring in all scenarios. The limitations are as follows: - The **Edit Data Source** option may not be available for published data sources that use non-named (generic) connectors. The button appears greyed out. - Editing a live published data source that contains multiple connections to Bridge data sources is not currently supported and will result in an error. For more information, see [Connectivity with Bridge](https://help.tableau.com/current/online/en-us/to_sync_local_data.htm). On Tableau Public, you can connect to data by uploading a supported file. ### Connect to files Tableau supports uploading Excel or text-based data sources (.xlsx, .csv, .tsv) directly in your browser. In the Files tab of the Connect to Data pane, connect to an Excel or text file by dragging and dropping it into the field or clicking Upload from Computer. The maximum file size you can upload is 1 GB. If you don’t have a data set, check out the free [sample data sets](https://public.tableau.com/en-us/s/resources?qt-overview_resources=1#qt-overview_resources) on the Tableau Public website. ### Use connectors From the Connectors tab, you can connect to data housed in a cloud database. You must supply connection information for each data connection that you make. For example, for most data connections, you must supply your sign-in information. [Supported Connectors](https://help.tableau.com/current/pro/desktop/en-us/exampleconnections_overview.htm) has information on how to connect Tableau to your data using connectors. If the connector you need doesn't appear in the Connectors tab, you can connect to data through Tableau Desktop and create an data extract. **Note**: If you’re unable to connect to your data from Tableau Public, check to see if the database is publicly accessible. Tableau Public can only connect to data that's accessible from the public internet. #### Tableau Public Connectors

Google Drive

OData

## After you connect When Tableau connects to your data, the Data Source page opens so that you can prepare the data for analysis and begin building your view. To learn more, see [Creators: Prepare Data on the Web](https://help.tableau.com/current/pro/desktop/en-us/creator_data_prep.htm). ## Keep data fresh in web authoring **Update uploaded files in Tableau Cloud or Tableau Server**: If you manually upload a file (Excel or text) for web authoring, Tableau can’t refresh the file automatically. To update your data, select “Edit Connection” to upload a new version of the file. In Tableau Public, go to your viz and click Request Update. You can also keep your data fresh automatically by selecting “Keep this data in sync” in Tableau Desktop Public Edition. **Update file-based published data sources in Tableau Cloud**: If you have a published data source in Tableau Cloud (published through Tableau Desktop) that uses file-based data, you can keep it fresh using Tableau Bridge. For more information, see [Expand Data Freshness Options by Using Tableau Bridge](https://help.tableau.com/current/online/en-us/to_sync_local_data.htm). Editing a published data source via web authoring is not supported in all scenarios. The limitations are as follows: - The Edit Data Source option is not available for published data sources that use non-named (generic) connectors. The button may appear greyed out. - Editing a live PDS— whether created via web authoring or published from Tableau Desktop—may result in a connection error. Tableau Cloud may attempt a direct connection to the database instead of routing through Bridge, causing the request to fail. - Editing a live PDS that contains multiple connections to Bridge data sources is not currently supported and will result in an error. Understanding errors during web authoring with Bridge Error messages displayed during web authoring failures may not clearly indicate a Bridge-related issue. Common scenarios and what they mean: - A network or login timeout error (e.g., "A network-related or instance-specific error has occurred" or "Login timeout expired") can indicate that Tableau Cloud fell back to a direct connection attempt instead of routing through Bridge. Verify that your Bridge client is connected and assigned to the correct pool. - A NO\_POOLED\_AGENTS\_ASSIGNED\_NAMED\_POOL error indicates that no Bridge agents are assigned to the named pool configured for your site. Assign an active Bridge client to resolve this. - If the Edit Data Source button is greyed out, the data source uses a non-named connector for which editing via web authoring is not currently supported. [Skip to main content](#main-content) # CSV Import File Guidelines You can bulk add users by creating a comma-separated values (CSV) file with user information and then importing the file. You can include attributes in the CSV file, such as license level and the publishing access, to apply to the users at the same time you import them. This topic covers the details of the CSV file itself. To import users using the CSV, you can: - Use the site administration page. For information, see [Import Users](https://help.tableau.com/v0.0/online/en-us/users_import.htm) - Use the `tabcmd` utility. For information, see [createsiteusers filename.csv](https://help.tableau.com/v0.0/online/en-us/tabcmd_cmd.htm#idd1b7729f-dd20-475a-96f6-17fcd2577894). - Use Tableau Cloud Manager. For more information, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm). ## CSV file format requirements The CSV file for importing users has the following formatting requirements: - No column headings. Tableau Cloud assumes that every line in the file represents a user. - UTF-8 format with the byte-order mark (BOM) is only supported when importing to sites. If you're importing to Tableau Cloud Manager, use UTF-8 format and remove any BOM from your files. - Character encodings such as BIG-5 must be converted to UTF-8. You can do this by opening the file in a text editor and using the Save As command. - If the `@` character is present in the **username** field for anything other than a domain separator, it must be in hexadecimal format: `\0x40`. For example, `user@fremont@mycompany.com` should be `user\0x40fremont@mycompany.com`. ## Required column structure in the CSV file The file shouldn't contain a header row. Not all columns need to be filled out, but the required column structure must be preserved by including all the expected comma delimiters. The column structure varies by product and by import tool. Make sure you're using the appropriate structure for your environment: - **Tableau Cloud:** username, password, display name, license level, administrator level, publishing capability, email address - **Tableau Cloud with Tableau Cloud Manager (TCM):** tenant or site URI, username, password, display name, license level, administrator level, publishing capability, email address, authentication type - **Tableau Server:** username, password, display name, license level, admin level, publishing capability, email address - **Tableau Server using identity pools:** username, password, display name, license level, admin level, publishing capability, email address, identity pool name, identifier See the column details section below for more information on the possible values for each column. > [!WARNING] > > **Important:** The order of the columns is significant. The first column is treated as the user name, the second as the password, the third as display name, and so on, regardless of the content in the columns. If you omit values for a field, you must still include the field's comma delimiter. ## Column details for Tableau Cloud CSV If the CSV file contains only username values (email addresses), the users will receive an email invitation to the site. Users can join the site to create their accounts, but the accounts remain unlicensed until an administrator configures the accounts (display name, license level, and so on). A user's email address on the site may display on the site with a leading period (such as `.user@domain.com`) until they log in for the first time. Column structure for the CSV file: _username, password, display name, license level, administrator level, publishing capability, email address_ ### Column details Any columns left blank must still be delimited with commas to preserve the column structure. **Username:** _Required_. The user's email address. **Password:** _Ignored_. As a best practice, leave this column blank. - New users must select a password and a display name when they first sign in to Tableau Cloud. If a user already has a Tableau account they may already have a password. **Display name:** _Ignored_. As a best practice, leave this column blank. **License level:** This can be **Creator**, **Explorer**, **Viewer**, or **Unlicensed**. If left blank, the license level will be Unlicensed. **Administrator level:** This can be **Site** or **None**. If left blank, the administrator level will be None. - Site = Site administrator, None = Not an administrator. - **Note**: Cloud is only a relevant value when using Tableau Cloud Manager. For more information, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm). **Publishing capability:** This can be **Yes/True/1** or **No/False/0**. If left blank, the publishing capability will be false. - If the license level is Creator, the publishing capability must be Yes/True/1 - If the license level is Explorer, the publishing capability value is what distinguishes the site role between Explorer (can publish) and Explorer - If the license level is Viewer or Unlicensed, the user will not be able to publish regardless of the value of this column **Email address:** Starting in July 2025 (Tableau 2025.2), you can specify an email address if different than username. Email addresses are used for notifications purposes only. If no email address value is provided, Tableau Cloud uses the value in the required username field to send notifications to. For security purposes, you can only specify the email address of a user who is a member of only one site. ### Authentication type without TCM If you aren't using Tableau Cloud manager, you can only set a single default authentication type during the upload. You can change authentication type for individual users afterward. - When uploading a CSV file directly in Tableau Cloud, specify the authentication type when you import the file and that type applies to all imported users. - When using `tabcmd` to import users, set the authentication type and site role that applies to all users in the CSV file during upload. For information, see [createsiteusers filename.csv](https://help.tableau.com/v0.0/online/en-us/tabcmd_cmd.htm#idd1b7729f-dd20-475a-96f6-17fcd2577894). To set a specific authentication type per user at the time of upload, you must use Tableau Cloud Manager. For more information, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm). ### Tableau Cloud CSV example structure > [!TIP] > > Remember, the structure is: `username, password, display name, license level, administrator level, publishing capability, email address` with nothing between the commas when a column is left blank. The following example shows a user who is granted the Explorer (can publish) site role, won't be a site administrator, and will be able to publish to projects to which they have the appropriate content permissions. user1@domain.com,,,Explorer,None,true,user1@domain2.com By changing the administrator-level column, you can import the following user as a site administrator with the Site Administrator Explorer site role. adminuser@domain.com,,,Explorer,Site,true,adminuser@domain2.com ## Column details for TCM CSV If the CSV file contains only user name (email address) values, the users will receive an email invitation to the site. Users can join the site to create their accounts, but the accounts remain unlicensed until an administrator configures the accounts (display name, license level, and so on). Remember that columns left blank must still be delimited with commas to preserve the column structure. Column structure for the CSV file: `tenant or site URI, username, password, display name, license level, administrator level, publishing capability, authentication type` ### Column details **Tenant or site URI:** The uniform resource identifier for the tenant or site. **Username:** _Required_. The user's email address. **Password:** _Ignored_. As a best practice, leave this column blank. - New users must select a password and a display name when they first sign in to Tableau Cloud. If a user already has a Tableau account they may already have a password. **Display name:** _Ignored_. As a best practice, leave this column blank. **License level:** This can be **Creator**, **Explorer**, **Viewer**, or **Unlicensed** for the site. If left blank, the license level will be Unlicensed. **Administrator level:** This can be **Site**, **Cloud**, or **None**. If left blank, the administrator level will be None. - Site = Site administrator, None = Not an administrator, Cloud = Cloud administrator. **Publishing capability:** This can be **True** or **False** for the site. If left blank, the publishing capability will be false. - If the license level is Creator, the publishing capability must be True - If the license level is Explorer, the publishing capability value is what distinguishes the site role between Explorer (can publish) and Explorer - If the license level is Viewer or Unlicensed, the user will not be able to publish regardless of the value of this column **Authentication type**: The user authentication type for accessing the tenant or site. This can be **Google**, **OpenID**, **Salesforce**, **SAML**, **TableauIDWithMFA**, or **DEFAULT**. ### TCM CSV example structure > [!TIP] > > Remember, the structure is: `tenant or site URI, username, password, display name, license level, administrator level, publishing capability, authentication type` with nothing between the commas when a column is left blank. The following example shows a user who is granted the cloud administrator role in Tableau Cloud Manager, and authenticates using Tableau with MFA. TCM,cloudadminuser@domain.com,,,,Cloud,,TableauIDWithMFA By changing the authentication column, you can import the following user with an alternative authentication type if configured in Tableau Cloud Manager settings. TCM,cloudadminuser@domain.com,,,,Cloud,,Salesforce In the following example, you can import the user with Explorer - can publish site role with Tableau with MFA authentication. MySite,user1@domain.com,,,Explorer,None,True,TableauIDWithMFA ## CSV settings and site roles The license level, administrator, and publishing settings for a user determine how the user's site role is set during the import process. The following shows how site roles should be captured in the CSV.

Site Role	License level	Administrator level	Publishing capability
Cloud Administrator This role is valid only if you are importing users while signed in to Tableau Cloud Manager (that is, not signed in to a specific site).	Unlicensed	Cloud	False
Site Administrator Creator or Site Administrator Explorer These roles are valid only if you are importing users while signed in to a specific site.	Creator or Explorer	Site	True
Creator	Creator	None	True
Explorer (can publish)	Explorer	None	True
Explorer	Explorer	None	False
Viewer	Viewer	None	False
Unlicensed	Unlicensed	None	False

[Skip to main content](#main-content) # Custom Date Formats This article discusses using the custom date format field to format dates in a view. For an overview of how Tableau works with dates, see [Dates and Times](https://help.tableau.com/current/pro/desktop/en-us/dates.htm), or [Changing Date Levels](https://help.tableau.com/current/pro/desktop/en-us/dates_levels.htm). For setting date properties for a **data source**, see [Date Properties for a Data Source](https://help.tableau.com/current/pro/desktop/en-us/date_properties.htm). ## How to find the custom date format field ### Format a date field in a view (Tableau Desktop) To format a date field in the view in Tableau Desktop, right-click (Control-click on a Mac) the field and choose Format. ![Context menu from a view showing the format option highlighted.](/tableau/next/en-us/online/en-us/Img/date_format_view.png) This opens the Format panel to the left of your view. Select the Dates field. ![Header pane with the date formatting dropdown menu highlighted.](/tableau/next/en-us/online/en-us/Img/date_format_pane.png) Tableau presents a list of available formats. If you're working with a discrete date part, you'll see the options relevant to that date part (such as automatic, two digit, and four digit as the options for **YEAR(\[Order Date\])**). For continuous or Exact Date discrete dates, the last item in the list is Custom. You can specify a custom date using format symbols listed in the Supported date format symbols table, either alone or in combination. ### Format a date field in a view (Tableau Cloud and Tableau Server) To format a date field in the view in Tableau Cloud and Tableau Server, right-click (Control-click on a Mac) the field and choose Format Date. ![](/tableau/next/en-us/online/en-us/Img/CustomDate_Cloud.png) ### Format a date field in the Data pane (Tableau Desktop only) To format a date field in the Data pane, right-click the field and choose Default Properties > Date Format. ![Default date format window with various date format options, and the custom option selected.](/tableau/next/en-us/online/en-us/Img/date_format_custom.png) The date formats in the table are supported when your workbook is connected to a Tableau extract or has a live connection to a data source that also supports the date format. (Refer to your data source's documentation to verify that the date format you want is supported.) Tableau retrieves date formats from the data source. Tableau Server can also retrieve date formats from the Run As user account on the server that’s running Tableau Server. **Note:** The following date formats might not be the same as those used with the [Type Conversion](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_typeconversion.htm) function. See [Convert Strings to Date Fields](https://help.tableau.com/current/pro/desktop/en-us/data_dateparse.htm) for more information about using the DATEPARSE function. ## Supported date format symbols Use the following symbols to construct a custom date format.

Symbol	Description
(:)	Time separator. In some locales, a different character is used to represent the time separator. The time separator separates hours, minutes, and seconds when time values are formatted. The actual character used as the time separator in formatted output is determined by your system settings.
(/)	Date separator. In some locales, a different character is used to represent the date separator. The date separator separates the day, month, and year when date values are formatted. The actual character used as the date separator in formatted output is determined by your system settings.
c	Display the date as `ddddd` and display the time as `ttttt`, in that order. Display only date information if there’s no fractional part to the date serial number; display only time information if there’s no integer portion.
d	Display the day as a number without a leading zero (1-31).
dd	Display the day as a number with a leading zero (01-31).
ddd	Display the day as an abbreviation (Sun, Sat).
dddd	Display the day as a full name (Sunday, Saturday).
ddddd	Display the date as a complete date (including day, month, and year), formatted according to your system's short date format setting. The default short date format is `m/d/yy`.
dddddd	Display a date serial number as a complete date (including day, month, and year) formatted according to the long date setting recognized by your system. The default long date format is `mmmm dd, yyyy`.
aaaa	The same as dddd, only it's the localized version of the string.
w	Display the day of the week as a number (1 for Sunday through 7 for Saturday).
ww	Display the week of the year as a number (1-54).
M	Display the month as a number without a leading zero (1 12). If `m` immediately follows `h` or `hh`, the minute rather than the month is displayed.
MM	Display the month as a number with a leading zero (01-12). If `m` immediately follows `h` or `hh`, the minute rather than the month is displayed.
MMM	Display the month as an abbreviation (Jan-Dec).
MMMM	Display the month as a full month name (January-December).
MMMMM	Display the month as a single letter abbreviation (J-D)
oooo	The same as MMMM, but localized.
q	Display the quarter of the year as a number (1- 4).
y	Display the day of the year as a number (1-366).
yy	Display the year as a 2-digit number (00-99).
yyyy	Display the year as a 4-digit number (100-9999).
h	Display the hour as a number without leading zeros (0-23).
Hh	Display the hour as a number with leading zeros (00-23).
N	Display the minute as a number without leading zeros (0 59).
Nn	Display the minute as a number with leading zeros (00 59).
S	Display the second as a number without leading zeros (0 59).
Ss	Display the second as a number with leading zeros (00 59).
000	Display milliseconds. Use a period character as a separator before specifying milliseconds.
t t t t t	Display a time as a complete time (including hour, minute, and second), formatted using the time separator defined by the time format recognized by your system. A leading zero is displayed if the leading zero option is selected and the time is before 10:00 A.M. or P.M. The default time format is `h:mm:ss`.
AM/PM	Use the 12-hour clock and display an uppercase AM with any hour before noon; display an uppercase PM with any hour between noon and 11:59 P.M.
am/pm	Use the 12-hour clock and display a lowercase AM with any hour before noon; display a lowercase PM with any hour between noon and 11:59 P.M.
A/P	Use the 12-hour clock and display an uppercase A with any hour before noon; display an uppercase P with any hour between noon and 11:59 P.M.
a/p	Use the 12-hour clock and display a lowercase A with any hour before noon; display a lowercase P with any hour between noon and 11:59 P.M.
AMPM	Use the 12-hour clock and display the AM string literal as defined by your system with any hour before noon; display the PM string literal as defined by your system with any hour between noon and 11:59 P.M. AMPM can be either uppercase or lowercase, but the case of the string displayed matches the string as defined by your system settings. The default format is AM/PM.

## Custom date format examples Any of the date format symbols in the table above can be used alone or in combination. Specifying a custom format yyyy-MM-dd HH:mm:ss.000 would produce dates in the format 2015-05-10 11:22:16.543. Such a format might be appropriate for scientific data. Specifying a custom format DDDD DD would produce dates that show the Weekday and the Day, as shown below. ![](/tableau/next/en-us/online/en-us/Img/FormattingNumbersDates_CustomDateFinal.png) Specifying a custom format `yy-mm-dd (dddd)` would produce dates in the format **18-01-04 (Thursday)**. Specifying a custom format `"Q"1 YYYY` would produce dates that show **Q1 2018**. ## Support for Japanese era-based date formats Tableau supports Japanese emperor-era-based date (Wareki) formats. Here’s how to apply an era-based date format to a field in your view: 1. Set your workbook locale to Japanese. 2. Right-click the field in the view for which you want to set a date format. 3. Choose Format. 4. In the Format pane, from the Dates drop-down list, select a format. If the format that you want isn’t listed, you can construct your own date format. To do this, choose Custom format in the Dates box, then type your format using the Tableau date placeholders. The following era-based year placeholders are available:

Symbol	Description
g	Short era name (such as H for the Heisei era).
gg	Era name (such as 平成).
ggg	Long era name (for Japanese, this is the same as the regular era name).
e	Era-based year, such as 1 for the first year of an era.
ee	Era-based year, such as 01 for the first year of an era. If there’s only one digit, then the era-based year will have a zero added to the front.

If your workbook locale isn’t Japanese, you can create a custom date format, then insert the language code !ja\_JP! in front of your format, so that it looks like this: `!ja_JP! gg ee"年"mm"月"dd"日"` The language code forces the date to be treated as if it’s a Japanese date. Era-based dates aren’t fully supported by the Tableau Server browser view. In particular, if you publish a workbook that contains an interactive filter, the e and g placeholders won’t be filled in: ![ ](/tableau/next/en-us/online/en-us/Img/japaneseEra.png) To avoid this issue, don’t show era-based dates in interactive filters if your workbook will be viewed in a browser. ## Using literal text in a date format You may want your date format to include some words or phrases, such as **Fiscal Quarter q of yyyy**. However, if you type that text directly into the Tableau format box, it may treat the letters like date parts: ![ ](/tableau/next/en-us/online/en-us/Img/dateFormatEscape.png) To prevent Tableau from doing this, put double quotes around the letters and words that shouldn’t be treated as date parts: `"Fiscal Quarter" q "of" yyyy`. If you want a literal quote inside of a quoted section, insert this code: `"\""`. For example, the format `"Fiscal "\"" Quarter"` would be formatted as **Fiscal " Quarter**. ## Format syntax in DATEPARSE function for extract data sources If you're using the DATEPARSE function in an extract, use the syntax defined by the Unicode Consortium. This table lists the formats supported by the DATEPARSE function.

Date Part	Symbol	Example Output
Year	yy y, yyyy Y	26 2026 2026 (used for Week of Year based calendars)
Quarter of year	Q QQ QQQ QQQQ	2 02 Q2 2nd quarter
Month	M MM MMM MMMM	9 09 Sep September
Week of year	w, ww	47
Day of week	E, EE, EEE EEEE EEEEE	Mon Monday M
Day of month	d dd	1, 15 01, 15
Day of year (1-365)	D	23, 143
Hour (1-12)	h hh	8 08
Hour (0-23)	H HH	8 08
Minute	m mm	8 08
Second in a minute	s ss	5 05
Fractional second	S SS SSS SSSS	2 23 235 2350
Milliseconds in day	A	34532
Period (am/pm marker)	a, aa, aaa	AM, am, PM
Time Zone	z, zz, zzz zzzz Z, ZZ, ZZZ ZZZZ	PDT Pacific Daylight Time -0800 PST-08:00

For a more complete list of date symbols, please see the [Formatting Date and Times Overview on the International Components](https://unicode-org.github.io/icu/userguide/format_parse/datetime/) for Unicode page. **Note:** Some date formats are not supported by all databases and file types. ### Notes on date formats in .hyper extracts

Unit of time	Notes
Era	n/a
Year	All symbols are supported in .hyper extracts except for "U". Notes: Negative values denote a year before Christ (BC). For example, `DATEPARSE('y','-10'`) returns the first January of 11BC and `DATEPARSE('y','-0')` returns the first January of 1BC. When working with the calendar year "y", the pattern "yy" requests the two low-order digits of the year. For numbers < 70, the DATEPARSE function returns the year 2000+x. For numbers >=70, the DATEPARSE function returns the year 1900+x. When working with "Y" in "ISO week date" based calendars, the year transition occurs on a week boundary and may differ from the calendar year transition. The "Y" designation is used in conjunction with pattern character "w" in ISO year-week calendar. The ISO week date system is effectively a leap week calendar system that is part of the ISO 8601 date and time standard. Similar to "y", negative values for "Y" denote a year before Christ (BC).
Month	All symbols are supported in .hyper extracts except for "I". Notes: The month designations are used in conjunction with "d" for the day number. In contrast to ICU, .hyper extracts allow values 1–12. Other values cause an error.
Week	All symbols are supported in .hyper extracts except for "W". Notes: When working with "w", in contrast to ICU, .hyper extracts allow only valid weeks. A year has 52 or 53 weeks (ISO 8601). The DATEPARSE function validates the input. For example, an error occurs for the 53rd week of 2016 because the 53rd week doesn’t exist for 2016. When working with "W", ICU doesn’t support this designation, but it's useful for dates like 1st Monday of September.
Day	Notes: When working with "d", in contrast to ICU, .hyper extracts only allow valid day numbers. For example, an error occurs for the 31st of February. When working with "D", in contrast to ICU, .hyper extracts only allow valid day numbers. For example, an error occurs for the 366th day of 2017.
Hour	Only "h" and "H" symbols are supported in .hyper extracts. Notes: When working with "h", .hyper extract don't allow negative values for this field. Negative values cause an error. When working with "H", .hyper extracts don't allow negative values for this field. Negative values cause an error.
Minute	Note: In contrast to ICU, .hyper extracts don't allow negative values for this field. Negative values will cause an error.
Second	Notes: In contrast to ICU, .hyper extracts don't allow negative values for this field. Negative values will cause an error. When working with "S", `DATEPARSE('ss.SSSS', '12.3456')` returns 1990-01-01 00:00:12:3456 AD.
Quarter	Note: In contrast to ICU, .hyper extracts only allow values 1–4. All other values cause an error.
Weekday	Notes: When working with "e" and "ee", in contrast to ICU, .hyper extracts only allow values 1–7. All other values cause an error. When working with "c..cc", in contrast to ICU, .hyper extracts only allow values 1–7. All other values cause an error.
Period	n/a

[Skip to main content](#main-content) # Customer-Managed Encryption Keys Customer-Managed Encryption Keys gives you an extra level of security by allowing you to encrypt your site data extracts with a customer managed site-specific key. The Salesforce Key Management System (KMS) instance stores the default site-specific encryption key for anyone who enables encryption on a site. To use an external key management system instead of Salesforce's, see [Use an External KMS for Extract Encryption Keys](https://help.tableau.com/v0.0/online/en-us/to_external_kms_extracts.htm). ## Encryption process The encryption process follows a key hierarchy. First, Tableau Cloud encrypts an extract. Next, Tableau Cloud KMS checks its key caches for a suitable data key. If a key isn’t found, one is generated by the KMS GenerateDataKey API, using the permission granted by the key policy that's associated with the key. KMS uses the CMK to generate a data key and returns a plaintext copy and encrypted copy to Tableau Cloud. Tableau Cloud uses the plaintext copy of the data key to encrypt the data and stores the encrypted copy of the key along with the encrypted data. ## Enable encryption After you enable encryption, Tableau Cloud will create a job for every extract on your site to get encrypted. These jobs are the lowest priority. Any previously set extract job runs before the encrypted extracts job. When there are extra resources, these jobs run encryption on all extracts without needing to be refreshed. ##### To enable encryption complete the following steps. 1. Log in to your Tableau Cloud site. 2. Select Settings in the left navigation pane 3. Select the Security tab. 4. Under the Extract Encryption section, select Encrypt Extracts. 5. Select Use the Salesforce KMS. 6. Read the warning about enabling encryption and then select **Enable Encryption**. **Note:** Once you enable encryption, you can't disable it. If at some point you no longer have Tableau +, Tableau Enterprise, or Advanced Management, working with your encrypted extracts will still work, but you won't be able to manage keys. ## Generate and rotate a key You can rotate a key on your company’s schedule for extra security. Rotating a key creates a key based on the original key. **Note:** If there’s a long refresh rate or if the extract isn’t refreshed, the extract is encrypted with the last active key instead of the new key. ##### To rotate a key complete the following steps. 1. Select the **Security** tab. 2. Under **Extract Encryption**, select **Generate Key**. ## Disable encryption Once you enable encryption, you can't disable it. If at some point you no longer have Tableau +, Tableau Enterprise, or Advanced Management, working with your encrypted extracts will still work, but you won't be able to manage keys. ## Delete a key (non-recoverable data extracts) > [!IMPORTANT] > > **Warning:** If you delete a key, there isn't a way to regain access to the data extracts. Delete the key only if there’s a dire security incident. You can’t access your data extracts after you’ve deleted the key. Any data extracts tied to the deleted key are permanently unavailable. ##### To delete a key complete the following steps. 1. Select the **Security** tab. 2. Under **Extract** **Encryption**, in **Actions**, select **Delete Key...**. 3. In the text field, enter **Delete Key**. > [!IMPORTANT] > > **Warning:** You can’t access your data extracts after you’ve deleted the key. Delete the key only if there’s a dire security incident. 4. Select **Delete Key** or **Cancel**. ## Audit logs You can download audit logs to review operations performed on your keys including creation, rotation, deletion, decryption, and downloading logs. The audit log also includes the following information. - Date and Time - Event Type - Success or Failure - Authenticated Identity of calling service - User - Key name ## Frequently asked questions (FAQ) Question: What happens if I don’t renew my Advanced Management license? Answer: If you don’t renew the Advanced Management license, the Customer-Managed Encryption Keys feature automatically changes to a disabled state. Question: What happens to my key data if I stop being a Tableau Cloud customer? Answer: Per the Tableau Cloud data policy, there’s a 90-day wait period before your key data gets deleted. Question: What happens if I move to a different Tableau Cloud region? Answer: The key data is in the Salesforce (KMS) instance that’s in the same region as your Tableau Cloud pod. If you want to move to another region, you must turn off the feature and run your extracts first. [Skip to main content](#main-content) # Customize Your Tableau Data Story **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). You can use custom language, tailored to your audience, to supplement your Tableau Data Stories with insights specific to your business. Identify the analytics and data from the Data Story that matters most to your audience, and use your own language to create the most impactful story. As with the overall Tableau Data Story, data and variables used in custom content are dynamic, adjusting along with the dashboard. ## Add your own insights 1. In your Data Story, click Edit to open the Edit dialog box. 2. Find the section you want to write about and click Add Custom Item. ![Edit story dialog box that allows users to choose which sentences appear in a story](/tableau/next/en-us/online/en-us/Img/data_stories_custom_add.png) 3. Enter your custom text in the field that appears. 4. Click Save. ## Add headers and footers You can insert custom text at the top and bottom of your Data Story. With headers and footers, you can add your own qualitative analysis to stories, include additional explanations of data trends, or append legal and privacy disclaimers. 1. In your Data Story, click Edit to open the Edit dialog box. 2. Click the Show note switch. 3. Enter your custom note. ![Edit story dialog box with the Show note switch in the On position. The custom note says “This is my custom note.”](/tableau/next/en-us/online/en-us/Img/data_stories_custom_note.png) 4. Click Save. Your note now shows at the top or bottom of your Data Story. ## Add functions Using a function in your Data Story is a great way to customize your story and find the insights that are most important to you and your business. For example, if you want to know the average sum of tourism revenue over a period, select Average as your function and then designate the measure as SUM(Tourism Inbound). This returns the average sum of inbound tourism. 1. In your Data Story, click Edit to open the Edit dialog box. 2. Click the menu in the right side of the box and select Add Function. ![Edit story dialog box where one story sentence is selected, so the menu is open. The “Add Function” option is highlighted.](/tableau/next/en-us/online/en-us/Img/data_stories_custom_add_function.png) 3. Select a Data Story Function and fill in the required fields. ![An open field for typing the function, and drop-down menus for defining a custom function, dimension, measure, and filter dimension value.](/tableau/next/en-us/online/en-us/Img/data_stories_custom_add_function_complete.png) 4. Click Add to Section. 5. Click Save. ![An example story that has a custom note in the footer. The custom note is highlighted, and the rest of the story is in shadow. The note says “Average Sum per Year 434.09 billion.”](/tableau/next/en-us/online/en-us/Img/data_stories_function_story.png) The custom content now shows in your Data Story. ## Add conditions For each custom sentence you write, you can add a condition that determines whether the sentence renders in your Data Story. If the condition is met, the custom sentence appears in your story. If the condition isn't met, the custom sentence doesn't appear. You can apply multiple conditions to each custom sentence, and the conditions can be combined using the Any or All buttons within the Add a condition dialog box. Conditional statements are most often used with numerical comparisons, but the function also supports string matching using the equal (=) or not equal (!=) symbols. 1. In your Data Story, click Edit to open the Edit dialog box. 2. Enter your custom sentence. 3. Click the menu on the right side of the box and select Add Condition. 4. Define the custom function to be used to inform the conditional logic. In this example, the sentence "We have met our quota" shows if the Sum of Tourism Inbound is greater than 5 trillion. ![A text field where you can enter a condition. There is a button to “Add condition” and two formula fields to define when the condition is met.](/tableau/next/en-us/online/en-us/Img/data_stories_custom_add_condition.png) 5. Click Add to Section. 6. Click Save. The custom sentence now appears in your Data Story only if the conditions are met. ## Duplicate custom content You can easily duplicate custom content added to your Data Story, making it easier to build different variations of a sentence. We recommend copying a fully built custom sentence when applying thresholds, building in language variation, and creating different logical variations. 1. In your Data Story, click Edit to open the Edit dialog box. 2. Create a custom sentence, complete with functions and conditions, if desired. 3. In the completed sentence box, Click the menu in the right side of the box and select Duplicate. ![Edit story dialog box where one story sentence is selected, so the menu is open. The “Duplicate” option is highlighted.](/tableau/next/en-us/online/en-us/Img/data_stories_custom_duplicate.png) 4. Click into your duplicated sentence, update as desired, and click Add to Section. 5. Click Save. When you copy a sentence, all functions and conditional statements also copy over. The copied bullet appears directly below the original bullet in the same section. **Note**: Copied bullets can only be added to the section that the original bullet is in. ## Add custom content in drilldown sections For stories that have two dimensions, each section after the first section is called a drilldown section. Drilldown sections focus on an individual primary dimension entity (i.e. The Americas in the following example). Because the drilldown sections have the same content structure, custom content added in the first section (i.e., Europe) are applied to each additional section (i.e., The Americas). You can only create or edit content in the first drilldown section. 1. In your Data Story, click Edit to open the Edit dialog box. 2. In the first drilldown section, click Add Custom Item to each entity. 3. Enter your custom content. 4. Click Save. ![Edit story dialog box that has a button that says “Add Custom Item to each entity”](/tableau/next/en-us/online/en-us/Img/data_stories_custom_drilldown_after.png) Custom content in drilldown sections already has a context variable called Current Category value (dynamic). This creates a dimension value option called Current Category value (dynamic) which always represents the section that the drilldown section is about. > [!TIP] > > To create content that only appears in a single specific drilldown section, you can use conditional logic to ensure it only writes where appropriate. ## Other articles in this section [Skip to main content](#main-content) # Customize Your Tableau Data Story: Context Variables **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). Context variables are functions that can be referenced by other functions. In other words, you can use context variables to nest functions within other functions. After you define your context variable, it appears as a function that you can use when adding new functions to your Tableau Data Story. **Note:** You can have multiple context variables set for each custom sentence, but you must define each context variable separately for each piece of custom content. ## Set a context variable 1. In your Data Story, click Edit to open the Edit dialog box. 2. Click Add Custom Item. 3. Click the menu in the right side of your custom content box and select Set context. ![Edit story dialog box where one story sentence is selected, so the menu is open. The “Set context” option is highlighted.](/tableau/next/en-us/online/en-us/Img/data_stories_context_set.png) 4. Click Add context. 5. Name the context variable and click Set Function. 6. Define your custom function and choose a dimension. ![An open field for naming a context variable, an “Add context” button, and fields for defining the custom function.](/tableau/next/en-us/online/en-us/Img/data_stories_context_add.png) 7. Click Add to Section. 8. Click back into the sentence where you set your context variable. 9. Follow the steps to [Add functions](https://help.tableau.com/v0.0/online/en-us/data_stories_customize.htm#Add). ![The function dialog box is open, and the field for defining the custom function has the custom context options listed.](/tableau/next/en-us/online/en-us/Img/data_stories_context_shows.png) Now, your context variable is listed as an option in the Dimension Value drop-down list when adding your function. ## When to use a context variable: reference two or more measures Let’s say that you want to refer to two or more measures in one analytical sentence in your Data Story. Without a context variable, we can write a sentence for only one measure at a time. But if we use a context variable, we can reference more than one measure in one sentence. To reference two or more measures with a context variable, your Data Story must have: > - 1 dimension > - 2 or more measures 1. In your Data Story, click Edit to open the Edit dialog box. 2. Click Add Custom Item. 3. Click the menu in the right side of your custom content box and select Set context. 4. Click Add context. 5. Name the context variable and click Set Function. 6. Define your custom function and choose a dimension. 7. Click Add to Section. ![Image that shows a context variable with a defined function of sort descending label, measure of SUM(GDP), Rank 1, and Dimension of Country/Region](/tableau/next/en-us/online/en-us/Img/data_stories_context_setfuction.png) 8. Click back into the sentence where you set your context variable. 9. Add your first function and fill in the required fields. In this example, we selected DimensionValueLabel, and then chose Country/Region from Dimension, and then country with the highest GDP (our context variable) from Dimension Value. ![The function dialog box is open, and the options listed in step 9 are selected.](/tableau/next/en-us/online/en-us/Img/data_stories_custom_context_func1.png) 1. Click Add to Section. 2. Add your second function and fill in the required fields. In this example, we selected Value, and then chose Country/Region from Dimension, SUM(Lending Interest) from Measure, and country with the highest GDP (our context variable) from Dimension Value. ![The function dialog box is open, and the options listed in step 10 are selected.](/tableau/next/en-us/online/en-us/Img/data_stories_custom_context_func2.png) 1. Click Add to Section. 2. Click Save. Your Data Story writes a sentence that gives us insight into a secondary measure (Lending Interest) for the country that we're interested in (the country with the highest GDP). ![Image that shows a sentence rendered in the data story stating that the United States has the highest AVG (GDP) and a lending interest of $0.7B in this data set.](/tableau/next/en-us/online/en-us/Img/data_stories_context_sentence.png) ## When to use a context variable: period-over-period analysis A context variable is helpful when you want to analyze performance over two different periods in your Data Story. You can create a custom sentence that writes about a measure displayed in your drilldown section and compares the measure against different periods, such as year over year or month over month. To set up a period-over-period analysis, your Data Story must have: > - 2 dimensions: 1 time period dimension (primary) and 1 non-time period dimension (secondary) > - 1–3 measures 1. Create your Data Story. 2. In the Fields dialog box, make sure your time period dimension is ordered first and click Next. 3. In the Story dialog box, select Continuous and click Done. 4. Open the Edit dialog box, and select Add Custom Item in the first drilldown area. 5. Create two context variables that represent your time periods. For example, "Current Quarter" and "Previous Quarter." ![Image that shows two context variables set, one for a current quarter and one for a previous quarter](/tableau/next/en-us/online/en-us/Img/data_stories_context_quarters.png) 6. Create an _increased_ sentence by adding custom language and functions. The content of this sentence results in "\[CurrentDimensionValueLabel\] increased \[X%\] over the quarter." 7. Type in the function followed by the word "increased" in the custom text box. 8. Add the function that returns the percent change of your measurement during your time period. ![The function dialog box is open, and the options listed in step 1 through 8 are chosen.](/tableau/next/en-us/online/en-us/Img/data_stories_context_increased.png) 9. Click Add to Section. 10. [Duplicate custom content](https://help.tableau.com/v0.0/online/en-us/data_stories_customize.htm#Duplicat) and create a _decreased_ version by replacing the word "increased" with "decreased." The functions stay the same. ![Edit story dialog box where one story sentence is selected, so the menu is open. The “Duplicate” option is highlighted.](/tableau/next/en-us/online/en-us/Img/data_stories_context_duplicate.png) 11. [Add conditions](https://help.tableau.com/v0.0/online/en-us/data_stories_customize.htm#Add2) for each sentence so that only one is written, depending on the data. ![The condition dialog box is open, and custom content is entered for the increase from the previous quarter.](/tableau/next/en-us/online/en-us/Img/data_stories_context_addcondition.png) 12. For the _increased_ sentence, set conditions in line with the following example: > Left Argument = Value function > > Dimension = Quarter(OrderDate). Select your time period dimension > > Measure = SUM(Total Orders). Select the measure you used for the calculation > > Dimension Value = Current Quarter. One of the context variables > > Filter Dimension Value = Current Region value (dynamic). This is the preset context variable > > Middle Argument = > (greater than) > > Right Argument = Value function > > Dimension= Quarter(OrderDate). Select your time period dimension > > Measure = Total(Total Orders). Select the measure you used for the calculation > > Dimension Value = Previous Quarter. One of the context variables > > Filter Dimension Value = Current Region value (dynamic). This is the preset context variable > > ![The condition dialog box is open, and custom content is entered as described in step 12.](/tableau/next/en-us/online/en-us/Img/data_stories_context_period_analysis.png) 1. For the _decreased_ sentence, set the same conditions, but replace the > (greater than) sign with the < (less than) sign. The right and left arguments remain the same. 2. Click Save, and your Data Story writes a sentence that includes the insights from analyzing the two time periods. [Skip to main content](#main-content) # Customize Your Tableau Data Story: Functions **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). If you'd like to customize your Tableau Data Story with a function, it helps to know what functions you can use, what each function does, and what dimensions and measures you'll need for each function. Learn how to [Add functions](https://help.tableau.com/v0.0/online/en-us/data_stories_customize.htm#Add) to your Data Story. Click a letter to see functions that begin with that letter. If no functions start with that letter, the functions that start with the next letter in the alphabet are shown. You can also press Ctrl+F (Command-F on a Mac) to open a search box that you can use to search the page for a specific function. [A](#A) [B](#C) [C](#C) [D](#D) [E](#E) [F](#F) [G](#G) [H](#H) [I](#I) [J](#L) [K](#L) [L](#L) [M](#M) [N](#N) [O](#P) [P](#P) [Q](#R) [R](#R) [S](#S) [T](#T) [U](#U) [V](#V) [W](#W) [X](#X) [Y](#Y) [Z](#Z) #### Average Description: The average value of the given measure. Syntax: Average(dimension, measure, filterDimensionValue) #### Count Description: The number of dimension values within a given dimension. Syntax: Count(dimension) #### Difference Description: The difference in measure values between the two provided dimension values. Syntax: Difference(dimension, measure, firstDimensionValue, secondDimensionValue, filterDimensionValue) #### DifferenceFromMean Description: The difference between the mean and the measure value for the given dimension value. Syntax: DifferenceFromMean(dimension, measure, firstDimensionValue, filterDimensionValue) #### Direction Description: Language describing the direction (e.g., increase or decrease) between measure values for the two provided dimension values. Syntax: Direction(dimension, measure, firstDimensionValue, secondDimensionValue, filterDimensionValue, phrase) #### Ending Label Description: The name of the last period in the series. Syntax: Label(measure) #### EndingValue Description: The value at the last period in the series for the given measure. Syntax: EndingValue(measure, filterDimensionValue) #### Label Description: The label for the given measure. Syntax: Label(measure) #### LargestNegativeChangeDifference Description: The value of the largest negative period-over-period difference, on an absolute basis, in the given series. Syntax: LargestNegativeChangeDifference(measure, filterDimensionValue) #### LargestNegativeChangeEndingLabel Description: The name of the ending period for the largest negative period-over-period difference, on an absolute basis, in the given series. Syntax: LargestNegativeChangeEndingLabel(measure, filterDimensionValue) #### LargestNegativeChangeEndingValue Description: The ending value of the largest negative period-over-period difference, on an absolute basis, in the given series. Syntax: LargestNegativeChangeEndingValue(measure, filterDimensionValue) #### LargestNegativeChangePercentDifference Description: The percent change of the largest negative period-over-period difference, on an absolute basis, in the given series. Syntax: LargestNegativeChangePercentDifference(measure, filterDimensionValue) #### LargestNegativeChangeStartingLabel Description: The name of the starting period for the largest negative period-over-period difference, on an absolute basis, in the given series. Syntax: LargestNegativeChangeStartingLabel(measure, filterDimensionValue) #### LargestNegativeChangeStartingValue Description: The starting value of the largest negative period-over-period difference, on an absolute basis, in the given series. Syntax: LargestNegativeChangeStartingValue(measure, filterDimensionValue) #### LargestNegativePercentChangeDifference Description: The value of the largest negative period-over-period difference, on a percentage basis, in the given series. Syntax: LargestNegativePercentChangeDifference(measure, filterDimensionValue) #### LargestNegativePercentChangeEndingLabel Description: The name of the ending period for the largest negative period-over-period difference, on a percentage basis, in the given series. Syntax: LargestNegativePercentChangeEndingLabel(measure, filterDimensionValue) #### LargestNegativePercentChangeEndingValue Description: The ending value of the largest negative period-over-period difference, on a percentage basis, in the given series. Syntax: LargestNegativePercentChangeEndingValue(measure, filterDimensionValue) #### LargestNegativePercentChangePercentDifference Description: The percent change of the largest negative period-over-period difference, on a percentage basis, in the given series. Syntax: LargestNegativePercentChangePercentDifference(measure, filterDimensionValue) #### LargestNegativePercentChangeStartingLabel Description: The name of the starting period for the largest negative period-over-period difference, on a percentage basis, in the given series. Syntax: LargestNegativePercentChangeStartingLabel(measure, filterDimensionValue) #### LargestNegativePercentChangeStartingValue Description: The starting value of the largest negative period-over-period difference, on a percentage basis, in the given series. Syntax: LargestNegativePercentChangeStartingValue(measure, filterDimensionValue) #### LargestPositiveChangeDifference Description: The value of the largest positive period-over-period difference, on an absolute basis, in the given series. Syntax: LargestPositiveChangeDifference(measure, filterDimensionValue) #### LargestPositiveChangeEndingLabel Description: The name of the ending period for the largest positive period-over-period difference, on a absolute basis, in the given series. Syntax: LargestPositiveChangeEndingLabel(measure, filterDimensionValue) #### LargestPositiveChangeEndingValue Description: The ending value of the largest positive period-over-period difference, on an absolute basis, in the given series. Syntax: LargestPositiveChangeEndingValue(measure, filterDimensionValue) #### LargestPositiveChangePercentDifference Description: The percent change of the largest positive period-over-period difference, on an absolute basis, in the given series. Syntax: LargestPositiveChangePercentDifference(measure, filterDimensionValue) #### LargestPositiveChangeStartingLabel Description: The name of the starting period for the largest positive period-over-period difference, on an absolute basis, in the given series. Syntax: LargestPositiveChangeStartingLabel(measure, filterDimensionValue) #### LargestPositiveChangeStartingValue Description: The starting value of the largest positive period-over-period difference, on an absolute basis, in the given series. Syntax: LargestPositiveChangeStartingValue(measure, filterDimensionValue) #### LargestPositivePercentChangeDifference Description: The value of the largest positive period-over-period difference, on a percentage basis, in the given series. Syntax: LargestPositivePercentChangeDifference(measure, filterDimensionValue) #### LargestPositivePercentChangeEndingLabel Description: The name of the ending period for the largest positive period-over-period difference, on a percentage basis, in the given series. Syntax: LargestPositivePercentChangeEndingLabel(measure, filterDimensionValue) #### LargestPositivePercentChangeEndingValue Description: The ending value of the largest positive period-over-period difference, on a percentage basis, in the given series. Syntax: LargestPositivePercentChangeEndingValue(measure, filterDimensionValue) #### LargestPositivePercentChangePercentDifference Description: The percent change of the largest positive period-over-period difference, on a percentage basis, in the given series. Syntax: LargestPositivePercentChangePercentDifference(measure, filterDimensionValue) #### LargestPositivePercentChangeStartingLabel Description: The name of the starting period for the largest positive period-over-period difference, on a percentage basis, in the given series. Syntax: LargestPositivePercentChangeStartingLabel(measure, filterDimensionValue) #### LargestPositivePercentChangeStartingValue Description: The starting value of the largest positive period-over-period difference, on a percentage basis, in the given series. Syntax: LargestPositivePercentChangeStartingValue(measure, filterDimensionValue) #### LongestStreakDifference Description: The difference over the longest streak of consecutive increases or decreases for the given series. Syntax: LongestStreakDifference(measure, filterDimensionValue) #### LongestStreakDirection Description: The direction (positive or negative) of the longest streak of consecutive increases or decreases for the given series. Syntax: LongestStreakDirection(measure, filterDimensionValue) #### LongestStreakEndingLabel Description: The name of the ending period for the longest streak of consecutive increases or decreases for the given series. Syntax: LongestStreakEndingLabel(measure, filterDimensionValue) #### LongestStreakEndingValue Description: The ending value of the longest streak of consecutive increases or decreases for the given series. Syntax: LongestStreakEndingValue(measure, filterDimensionValue) #### LongestStreakLength Description: The largest number of periods of consecutive increase or decrease for the given series. Syntax: LongestStreakLength(measure, filterDimensionValue) #### LongestStreakPercentDifference Description: The percent difference over the longest streak of consecutive increases or decreases for the given series. Syntax: LongestStreakPercentDifference(measure, filterDimensionValue) #### LongestStreakStartingLabel Description: The name of the starting period for the longest streak of consecutive increases or decreases for the given series. Syntax: LongestStreakStartingLabel(measure, filterDimensionValue) #### LongestStreakStartingValue Description: The starting value of the longest streak of consecutive increases or decreases for the given series. Syntax: LongestStreakStartingValue(measure, filterDimensionValue) #### MaxLabel Description: The name of the entity with the maximum value for the given measure. Syntax: MaxLabel(dimension, measure, filterDimensionValue) #### MaxValue Description: The maximum value for the given measure. Syntax: MaxValue(measure) #### Median Description: The median value for the given measure. Syntax: Median(dimension, measure, filterDimensionValue) #### MinLabel Description: The name of the entity with the minimum value for the given measure. Syntax: MinLabel(dimension, measure, filterDimensionValue) #### MinValue Description: The minimum value for the given measure. Syntax: MinValue(dimension, measure, filterDimensionValue) #### PercentDifference Description: The percent difference in measure values between the two provided dimension values. Syntax: PercentDifference(dimension, measure, firstDimensionValue, secondDimensionValue, filterDimensionValue) #### PercentOfWhole Description: The percent in measure values for a given dimension value over the total measure values for that dimension. Syntax: PercentOfWhole(dimension, measure, dimensionvalue, filterDimensionValue) #### PeriodLabel Description: The name of the nth period in the series, starting at 1. Syntax: PeriodLabel(index) #### PeriodLabelNewest Description: The name of the nth period in the series, starting at the newest and counting back. Syntax: PeriodLabelNewest(index) #### PeriodValue Description: The value of the given measure at the nth period in the series, starting at 1. Syntax: PeriodValue(measure, index, filterDimensionValue) #### PeriodValueNewest Description: The value of the given measure at the nth period in the series, starting at the newest and counting back. Syntax: PeriodValueNewest(measure, index) #### Range Description: The difference between the maximum and minimum values for the given measure. Syntax: Range(dimension, measure, filterDimensionValue) #### SortAscendingLabel Description: The entity name of the given measure sorted in descending order at the given rank (starting at 1). Syntax: SortAscendingLabel(measure, rank, dimension, filterDimensionValue) #### SortAscendingValue Description: The value of the given measure sorted in ascending order at the given rank (starting at 1). Syntax: SortAscendingValue(measure, rank, dimension, filterDimensionValue) #### SortDescendingLabel Description: The entity name of the given measure sorted in descending order at the given rank (starting at 1). Syntax: SortDescendingLabel(measure, rank, dimension, filterDimensionValue) #### SortDescendingValue Description: The value of the given measure sorted in descending order at the given rank (starting at 1). Syntax: SortDescendingValue(measure, rank, dimension, filterDimensionValue) #### StartingLabel Description: The name of the first period in the series. Syntax: StartingLabel() #### StartingValue Description: The value at the first period in the series for the given measure. Syntax: StartingValue(measure, filterDimensionValue) #### StartToFinishDifference Description: The difference between the values for the first and last periods in the given series. Syntax: StartToFinishDifference(measure, filterDimensionValue) #### StartToFinishPercentDifference Description: The percent difference between the values for the first and last periods in the given series. Syntax: StartToFinishPercentDifference(measure, filterDimensionValue) #### StdDev Description: The standard deviation value for the given measure. Syntax: StdDev(dimension, measure, filterDimensionValue) #### Sum Description: The sum of measure values for the two provided dimension values. Syntax: Sum(dimension, measure, firstDimensionValue, secondDimensionValue, filterDimensionValue) #### Total Description: The sum total value for the given measure. Syntax: Total(dimension, measure, filterDimensionValue) #### Value Description: The metric value for a given dimension, measure, and dimension value. Syntax: Value(dimension, measure, dimension value, filterDimensionValue) #### Z-Score Description: The z-score for the given measure. Syntax: Z-Score(dimension, measure, firstDimensionValue, filterDimensionValue) [Skip to main content](#main-content) # Customize Your Tableau Data Story: Hide and Reorder Content **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). Customize your Tableau Data Story with the content that is most important to you and your audience by hiding or reordering content within your story. ## Hide content and sections 1. Create your Data Story and click Edit to open the Edit dialog box. 2. Set sections to show or hide by clicking the Show section switch to the on or off position. 3. Hover over the blue box to the right of each individual sentence, and click the box to show or hide from view. 4. Click Save. ![Edit story dialog box where three sentences are hidden.](/tableau/next/en-us/online/en-us/Img/data_stories_custom_hideshow.png) Now, only the sentences and sections that are set to Show appear in your Data Story. ## Reorder content within a section 1. Create your Data Story and click Edit to open the Edit dialog box. 2. Hover over the left-side menu of the content you want to reorder. Your cursor turns into a hand icon. 3. Click the item with your cursor and drag it anywhere within the same section. 4. Click Save. ![Edit story dialog box with a cursor (hand) icon hovering over a sentence to be clicked and dragged.](/tableau/next/en-us/online/en-us/Img/data_stories_custom_reorder.png) Now, the sentences appear in your Data Story in the order that you set them to. **Note:** Currently, content can only be moved within the same section. Moving entire sections isn't yet supported. [Skip to main content](#main-content) # Dashboard-based Custom Portals **Note:** This overview was inspired by the work of Tableau Visionary Mark Jackson. For more details about the process, [check out Mark's blog](http://ugamarkj.blogspot.sg/2013/12/customizing-tableau-server-experience.html). The [standard Tableau Cloud or Tableau Server interface](https://help.tableau.com/current/pro/desktop/en-us/navigating.htm) works great for many organizations, but if you want to create a company-branded experience and don't have API developer skills, consider creating a custom portal based on a Tableau dashboard. A custom portal lets you organize content around specific departments or job roles, and you can even incorporate training that helps people interact with data more fully. As the volume of Tableau content grows, a custom portal guides your users directly to the data they need, while providing ready access to related views and Tableau Cloud search so they can easily explore further. ## Sketch out a portal design Begin outside of Tableau, on paper or in a wireframing application. Consider the structure of your organization and the number of Tableau views that apply to each group of users. Do you simply need one level of navigation that points immediately to content? Or might you need to start with a main page that provides navigational links for separate groups of users or report types, followed by a second level with related dashboards and views? ![A diagram that illustrates the interconnectedness of medical personnel, facilities, and their associated data.](/tableau/next/en-us/online/en-us/Img/portal_sketch.png) After you get buy-in on your design from key stakeholders and data consumers, you're ready to move on to the next phase. ## Gather images for logos and navigation elements Start thinking about images while refining your initial mockup, and then gather them from libraries of clip-art or approved brand graphics, or create them from scratch in an application like Photoshop or SnagIt. PowerPoint can also be a good source if you plan to create navigation thumbnails of common chart types. ![Health Group portal logo.](/tableau/next/en-us/online/en-us/Img/portal_logo.png) ## Lay out text, images, and selected sheets on a dashboard Create a workbook with a dashboard for the portal, using a [tiled layout](https://help.tableau.com/current/pro/desktop/en-us/dashboards_organize_floatingandtiled.htm#Tiled_vs._Floating_Layouts) for more predictable positioning and scaling of elements on different devices. Then start adding Text and Image objects, as well as any sheets for data views you want to highlight right up front in your portal. To refine spacing between these dashboard elements, insert Blank objects and adjust their size. For more information, see [Create a Dashboard](https://help.tableau.com/current/pro/desktop/en-us/dashboards_create.htm#Add_objects). ## Link dashboard elements to content If you have a second level of navigation in your portal, use [filter actions](https://help.tableau.com/current/pro/desktop/en-us/actions_filter.htm) to point to a secondary dashboard from the main one. To create links that directly open data views, right-click Image objects and choose Set URL. (In our example below, each colored arrow and accompanying text is an image that links to a view URL.) You can even point to empty views with preloaded data sources, encouraging users to create new Tableau content in the web-authoring workspace. **Tip:** To add hyperlinks to text objects, include the full URL (for example, `http://www.tableau.com`). ![A web page displaying a data portal for a health group, providing the ability to explore geo data and create custom views.](/tableau/next/en-us/online/en-us/Img/portal_final.png) ## Publish, test, and refine your portal Publish the workbook to your server and distribute the dashboard URL to your users. Portal design, like data analysis itself, is a cyclical process. Now that your portal is out in the wild, start gathering user feedback so you can continuously improve the experience **Tip:** As a finishing touch, hide the Tableau toolbar to give your portal a custom feel. After the question mark at the end of the dashboard URL, add `:embed=y&:toolbar=n` [Skip to main content](#main-content) # Data Connect for Private Network Data As of September 2025, Tableau Data Connect is no longer available for new deployments. We recommend that existing customers migrate their Data Connect deployment to [Private Connect](https://help.tableau.com/current/online/en-us/private_connect_migrate_from_bridge.htm) or [Tableau Bridge](https://help.tableau.com/current/online/en-us/data_fresh_sync_section.htm). Data Connect will be retired in the future. Data Connect is a paid subscription service available to Tableau Cloud Enterprise and Tableau+ customers. After you have purchased Data Connect, the site admin will be able to configure the service in the settings page of Tableau Cloud. Tableau Bridge provides a way to access private network data that is behind a corporate firewall, or locked down inside a virtual private cloud. After a connection is established to Tableau Cloud, Bridge queries your local data as requests arrive and sends the private results back to Tableau Cloud. Similar to Tableau Bridge, Data Connect provides access to private network data, but provides a remotely managed, monitored, and streamlined solution for connecting to your on-premise data. ![Various components of the Data Connect environment and the responsibility for managing those components.](/tableau/next/en-us/online/en-us/Img/data_connect-security_656x447.png) Data Connect operates as a shared responsibility model. With this model, you supply the compute resources, which consist of a Data Connect Kubernetes cluster that is hosted in your environment and Tableau is responsible for managing the cluster. Tableau reduces the overhead of administration by remotely managing, monitoring, and maintaining the Kubernetes cluster. With the ability to perform remedial actions to enable continuous availability, Tableau eliminates the need to monitor traffic and connection status. In addition, to reduce latency and lower network congestion, Data Connect allows you to determine the data center, and edge locations and environments that best meet your requirements for performance. ## Other articles in this section [Skip to main content](#main-content) # Data Connect Security As of September 2025, Tableau Data Connect is no longer available for new deployments. We recommend that existing customers migrate their Data Connect deployment to [Private Connect](https://help.tableau.com/current/online/en-us/private_connect_migrate_from_bridge.htm) or [Tableau Bridge](https://help.tableau.com/current/online/en-us/data_fresh_sync_section.htm). Data Connect will be retired in the future. Data Connect operates as a shared responsibility model. With this model, you supply the physical or virtual compute resources, and Tableau hosts and manages the Data Connect Kubernetes cluster on those resources. Tableau reduces the overhead of administration by remotely managing, monitoring, and maintaining the Kubernetes cluster. With the ability to perform remedial actions to enable continuous availability, Tableau eliminates the need to monitor traffic and connection status. In addition, to reduce latency and lower network congestion, Data Connect allows you to determine the data center, edge locations and environments that best meet your requirements for performance. In this model, Tableau is responsible for operating the Data Connect service securely and you are responsible for managing the infrastructure and networking layers. ![Various components of the Data Connect environment and the responsibility for managing those components.](/tableau/next/en-us/online/en-us/Img/data_connect-security_894x611.png) ## Security designs Data Connect applies the following security designs: - The Data Connect service is a control plane service and does not have access to your data. The underlying component for Data Connect service is Tableau Bridge. - To facilitate secure data transfer, Data Connect uses Tableau Bridge which leverages secure web sockets to establish persistent connections with Tableau Cloud. - The Data Connect service does not interact with database credentials or database access. Database credentials are securely stored on Tableau Cloud and are passed on to the Tableau Bridge client that is selected to perform the refresh. - All communication is initiated from behind your firewall and therefore does not require any additional explicit inbound firewall rules to manage exceptions. Among other operations, the Bridge client is responsible for accessing your data and establishing secure web socket connections with Tableau Cloud. See [Bridge Security](https://help.tableau.com/v0.0/online/en-us/to_bridge_security.htm). ## Architecture ![](/tableau/next/en-us/online/en-us/Img/data_connect_setup_579x566.png) 1. Tableau Cloud communicates with the Kubernetes orchestration service to deploy, monitor and manage the Kubernetes orchestration. 2. When you initialize Data Connect, a secure connection is established with the orchestration provider service over port 443. 3. After the service is configured, a Kubernetes cluster deploys a container(s) with Bridge client(s). These Bridge clients will be responsible for executing Tableau workloads. 4. Tableau Cloud users sign in to Tableau Cloud to interact with the Data Connect service. 5. On setup, Bridge clients initialize a connection with Tableau Cloud using HTTPS. After successful connection, Bridge clients initiate a secure, bidirectional communication to your Tableau Cloud environment using a WebSocket (wss://) connection. 6. Queries initiated from Tableau Cloud are run against your database to support end user analysis. ## Security Layers There are three layers to the Data Connect solution. The _application_ that is installed in your infrastructure, the _orchestration_ layer that is used to deploy and manage application(s) and the supporting network and hardware _infrastructure_. - Application layer: Database authentication, sending data to Tableau Cloud, and networking considerations, see [Bridge Security](https://help.tableau.com/v0.0/online/en-us/to_bridge_security.htm). - Orchestration layer: See the section, [Container orchestration](#orchestration), below. - Infrastructure layer: In the Data Connect shared responsibility model, the security of the infrastructure itself will be your responsibility. Security details about how the Data Connect orchestration layer interacts with your infrastructure are covered in the sections below. ## Service configuration During the configuration of Data Connect, you will be responsible for configuring and initiating the service from within your network. This process provides the correct level of access and specifies which Data Access nodes to integrate with your Tableau Cloud site. For details describing service configuration for Data Connect, see [Step 1: Set up your cluster](https://help.tableau.com/v0.0/online/en-us/data_connect_setup.htm#setup-cluster). On initialization of the Data Connect solution, the following takes place: - Data Connect node health is validated. - A secure connection is established with the orchestration provider service over port 443. - Kubernetes operations software is downloaded and installed onto the computer. This software allows Tableau to remotely deploy and manage Data Connect. - Data Connect node information is queried over the secure connection to maintain the health of the service. Your data is never transferred over the orchestration connection. ## Tableau Cloud communication All communication from your infrastructure to Tableau Cloud is initiated from behind your firewall. You do not have to manage additional exceptions. For more information about Data Connect communication and your infrastructure configurations, see [Networking specifications](https://help.tableau.com/v0.0/online/en-us/data_connect_get_started.htm#Networki). ## Tableau Cloud authentication Data Connect creates authentication tokens that are used to secure Tableau Bridge's connection to Tableau Cloud. These tokens are site-specific and are used by the pool of Bridge clients that they are associated with. The tokens are stored in [Kubernetes Secrets](http://kubernetes.io/docs/concepts/configuration/secret/) on the cluster, which is managed by Data Connect. The Bridge clients that are deployed on that cluster access these tokens to log in to Tableau Cloud, but the tokens are not stored on the clients. To keep the Data Connect service running smoothly, Site Administrators for all sites using Data Connect need to refresh the token for their Pool every 90 days in Tableau Cloud. If the tokens aren't refreshed, Bridge clients in that pool will not be able to authenticate to the Tableau Cloud site and the jobs using that pool will fail. ## Database authentication You can find more details about Authentication in [Bridge Security](https://help.tableau.com/v0.0/online/en-us/to_bridge_security.htm). In the context of database authentication, it's important to understand that Data Connect only supports Bridge refresh schedules and does not support Bridge legacy schedules. ## Container orchestration The orchestration layer is exclusively a control layer and does not have access to the data layer and therefore does not interact with customer data. The only aspect of Data Connect that interacts with the data layer is the application installed on your infrastructure. This application is the Bridge client. ## Security FAQ ### What code is provisioned onto containers? In addition to software required for Kubernetes operations (kops), Tableau Bridge for Linux for Containers is deployed. You must provision database drivers when you create the base image. ### How can I manage detected vulnerabilities on the software deployed by Data Connect? You supply all of the software deployed by Data Connect through the base image. To change the software deployed, you supply a new base image. The image will then be deployed to all Data Connect nodes in that pool. ### What level of computer access does Data Connect require? Data Connect requires administrative level access to your infrastructure. This access allows Tableau to update and maintain the service. [Skip to main content](#main-content) # Data Labels Data labels are metadata that you can attach to data assets. Data labels help classify data and pass information to users. For example: - One published data source is more authoritative than other, similarly named ones. The certification data label can help you inform users which data source is recommended. - A column in a database contains outdated information. A warning data label can help you tell workbook authors and viewers that the data isn't up to date. - A table of employee income contains sensitive information that shouldn't be shared. A sensitivity data label can inform users that they must take care when using data from the table. - Some published data sources can be grouped based on the department that published them. A custom label category with custom labels can identify the departments responsible for the data sources. Note: Data labels are a more recent and extensible way of thinking about ways to classify metadata. Certifications and data quality warnings, which were part of the Data Management license long before the term "data labels" existed, are now considered categories in the broader data label concept, along with the Sensitivity Labels released in Tableau Cloud June 2023 and Tableau Server 2023.3. A Data Management license is required for all data label operations except for ones related to the certification of published data sources. ## Assets you can label You can add labels to the following Tableau content and external assets: - Databases - Tables - Columns (except for certification) _(column labels introduced in Tableau Cloud October 2022 / Server 2022.3)_ - Data sources - Flows - Virtual connections - Virtual connection tables ## Label names and categories Each label has a name and category. The names and categories built-into Tableau are:

Name	Category
Certified	Certification
Deprecated	Data Quality Warning
Stale data	Data Quality Warning
Under maintenance	Data Quality Warning
Warning	Data Quality Warning
Extract refresh failed	Data Quality Warning
Flow run failed	Data Quality Warning
Sensitive data¹	Sensitivity

1_In Tableau Cloud March 2023 / Server 2023.1 and earlier, the Sensitive data label uses the Data Quality Warning category._ Starting with Tableau Cloud October 2023 and Tableau Server 2023.3, using the label manager on the Data Labels page or the REST API, an administrator can customize the built-in labels or create new label names and categories. (Using the REST API, Tableau Cloud Administrators have been able to modify some built-in labels and add others in certain categories since June 2023.) For more information, see [Manage Data Labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_manage.htm). ## Label categories A label's category affects where and how the label appears, whether it appears on downstream assets, and which parts are customizable, among other things. ### Certification In a self-service environment with multiple publishers and numerous assets, it can be difficult to find recommended content. Using certification, you can mark assets as trusted, and the assets display badges in various places across Tableau. For complete information, see [Use Certification to Help Users Find Trusted Data](https://help.tableau.com/v0.0/online/en-us/datasource_certified.htm). ### Data quality warnings Identifying problematic data is important for building trust with users. Data quality warnings allow you to mark data assets that have known issues. When you attach a data quality warning to an asset, a warning shows on it and any downstream assets that use it, making data consumers aware of problems with the source data. For example, if you mark a database table as deprecated, users viewing workbooks based on that table may see a warning. Furthermore, data quality warnings can be set automatically when an extract refresh or flow run fails, and removed again when it succeeds. And using the Data Labels page or the REST API, administrators can create new, customized data quality warning labels, adding nuance and specificity to the warnings that users can choose from. For complete information, see [Set a Data Quality Warning](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm) ### Sensitivity labels Some data needs to be handled differently. Using Sensitivity labels, you can relay data sensitivity information to consumers of that data. When you mark an asset as sensitive, users browsing Tableau Cloud see badges on it and any downstream assets that use it. For example, if you mark a table column as sensitive, a user authoring a new workbook based on that table may see a warning. Furthermore, using the Data Labels page or the REST API, administrators can create customized sensitivity labels, adding nuance and specificity to the range of classifications that users can choose from when using sensitivity labels. Note: Sensitivity labels were introduced in Tableau Cloud June 2023 and Tableau Server 2023.3. Earlier versions of Tableau Cloud and Tableau Server relay data sensitivity through the "Sensitive data" data quality warning instead of using a dedicated sensitivity category. For complete information, see [Sensitivity Labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_sensitivity.htm). ### Custom label categories Sometimes you need to classify data in a way that isn't covered by certification, data quality warnings, or sensitivity labels. Using custom categories that administrators define, you can use labels to categorize assets in any way that your organization sees fit. For example, an administrator in your organization might create a category called "Department" with labels in it for sales, marketing, and other departments, ready to be applied to assets on your site. For complete information, see [Labels with Custom Categories](https://help.tableau.com/v0.0/online/en-us/dm_labels_custom_categories.htm). Note: The ability for administrators to create label names and categories through the label manager was released with Tableau Cloud October 2023 and Tableau Server 2023.3. Tableau Cloud administrators could use the REST API in a more limited way to create custom label names with built-in categories in June 2023. ## Where data labels appear Data labels appear in various places, such as - the tops of asset pages (workbooks, data sources, tables, and so forth) ![Labels on asset page](/tableau/next/en-us/online/en-us/Img/dm_label_labels_masthead.png) - lists of assets (Explore pages, External Assets page, and so forth) ![Labels on asset page](/tableau/next/en-us/online/en-us/Img/dm_label_labels_list_view.png) - the Desktop Data pane ![Label in the Desktop data pane](/tableau/next/en-us/online/en-us/Img/dm_label_labels_desktop_data_pane.png) - the web authoring Catalog Details window ![Labels in Web Authoring catalog details](/tableau/next/en-us/online/en-us/Img/dm_label_labels_web_authoring_catalog_details.png) - the Data Details pane ![Labels in the Data Details pane](/tableau/next/en-us/online/en-us/Img/dm_label_labels_data_details_pane.png) Color indicates the category and visibility level of a label: - **Green** indicates the asset is certified - **Blue** indicates a standard visibility quality warning - **Yellow** indicates a high visibility quality warning - **Gray** indicates a standard visibility sensitivity label or label with a custom category - **Purple** indicates a high visibility sensitivity label Select a label badge to see details for labels of that category on the asset. In the case of quality warning labels and sensitivity labels, the details will include labels inherited from upstream assets. If you're examining quality warning labels or sensitivity labels on a table, the details will include labels on downstream columns. To go to the related asset's page, select it. Certification labels and custom category labels are not inherited from upstream assets. There's a single indicator for each label category, no matter how many labels of that category are on the asset or inherited by it. The indicator is colored for high visibility if one or more of the labels it represents are high visibility labels. For example, suppose that a table has a standard visibility quality warning on it, and the table's upstream database has a high visibility quality warning on it. You'll see a yellow Quality Warning (2) indicator because the indicator represents two quality warnings, one of which is high visibility. ![Asset with labels both on it and inherited by it](/tableau/next/en-us/online/en-us/Img/dm_label_labels_on_asset_and_inherited.png) High visibility quality warnings and high visibility sensitivity labels that affect views and web authoring sessions cause alerts to be shown. ![A high visibility sensitivity label alert](/tableau/next/en-us/online/en-us/Img/dm_label_sensitivity_hv_alert.png) These alerts inform users that the data they're seeing needs to be treated with care. Selecting the Open Data Details link shows more information on the labels affecting the data. ## The Data Labels dialog Starting in Tableau Cloud February 2024 and Tableau Server 2024.2, you add, remove, and modify data labels on assets using the consolidated Data Labels dialog. (Extract refresh monitoring and flow refresh monitoring are still controlled through separate dialogs.) To open the Data Labels dialog for an asset, select the actions (...) menu next to the asset, then select Data Labels. Choose Certification, Data Quality Warning, Sensitivity Label, or All Labels to open the Data Labels dialog with the appropriate tab showing. ![The Data Labels dialog](/tableau/next/en-us/online/en-us/Img/dm_label_data_labels_dialog.png) The vertical tabs on the dialog's left side correspond to data label categories, except for the All labels and Selected labels tabs at the top of the list. - The All labels tab lists all the site's data labels across all categories. Each label selected for the asset is checked. This includes data labels that were selected for the asset when the dialog was opened, in addition to any labels that have been selected since then. - The Selected labels tab lists all the data labels that have been selected for the asset. This includes data labels that were selected for the asset when the dialog was opened, in addition to any labels that have been selected since then. - The other tabs correspond to data label categories. Those tabs list all data labels associated with the category. Each label selected for the asset is checked. This includes data labels that were selected for the asset when the dialog was opened, in addition to any labels that have been selected since then. The search bar at the top of the dialog returns data labels that match the search term you provide. You can select or deselect any labels you want from the results. To change the data labels on an asset: 1. Navigate to the label by using the search bar or vertical tabs to find the label. 2. To add a data label to the asset, check the box next to it. 3. Select a visibility level (if applicable) and a message if desired. 4. To remove a data label from an asset, clear the box next to it. 5. Add, remove, or modify more labels for the asset by repeating these steps 6. To commit your changes to the data labels on the asset and close the dialog, click Save. Or, if you want to abandon all your changes since the dialog opened, click Cancel and confirm you want to abandon the changes. Note: Selecting the data label instead of the check box next to it will show details about the label without changing the status of the check box. This action is useful for seeing the label description or making changes to the message without changing the status of the label on the asset. The consolidated Data Labels dialog isn't available in Tableau Server. For detailed information on the labels in specific categories, see the appropriate topic: - [Use Certification to Help Users Find Trusted Data](https://help.tableau.com/v0.0/online/en-us/datasource_certified.htm) - [Set a Data Quality Warning](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm#dm_dqw) - [Sensitivity Labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_sensitivity.htm) - [Labels with Custom Categories](https://help.tableau.com/v0.0/online/en-us/dm_labels_custom_categories.htm) ## Permissions required to interact with data labels on assets Permissions required to view, add, update, and delete labels on assets are as follows: - To view a data label, you must have read permissions on the associated asset. - To add, update, or delete a data label other than a certification label, you must have write permission on the associated asset. - To add, update, or delete a certification label, you must be an administrator, or else you must be a project leader or product owner for the project the asset is in. - To add, update, or delete a certification label for an external asset _not_ in a project, you must have the change permissions permission on the associated asset. ## Comparison of data labels and tags Tableau Cloud and Tableau Server also feature another solution for asset classification: Tags. Data labels and tags differ in significant ways:

Area	Data Labels	Tags
Structure and control	Administrators control the range of data labels	No administrative control over the range of tags users add
Permissions	Ability to add/update/remove data labels is controlled through asset permissions	Explorers and Creators can tag any assets that they can view
Appearance	Data label iconography is easily seen and color-coded by category and visibility level	Tags appear in fewer places than data labels and have no iconography
Inheritance	Some data labels (like warnings and sensitivity labels) show on downstream assets	No inheritance
Searching/Filtering	Certification and quality warnings can be used as filters in some asset lists	Search results return assets with matching tags, and tags can be used as filters in some asset lists
API accessible	Access via REST API and Metadata API is possible	Access via REST API and Metadata API is possible
License requirements	Requires a Data Management license (except for the certification of published data sources)	No licensing requirements
Use	Structured categorization focused on providing important information that can influence users' use of data	Open-ended method to categorize assets

For more information on tags, see [Use Tags](https://help.tableau.com/current/pro/desktop/en-us/tags.htm) in the Tableau Desktop and Web Authoring Help. ## Other articles in this section [Skip to main content](#main-content) # Data Quality Warning History When Tableau Catalog is enabled in your environment, site administrators can see how data quality warnings are being used on the site using the pre-built admin view, Data Quality Warning History. For more information about Tableau Catalog, part of Data Management, see "About Tableau Catalog" in the [Tableau Server](https://help.tableau.com/current/server/en-us/dm_catalog_overview.htm) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/dm_catalog_overview.htm) Help. From the Site Status page, select the Data Quality Warning History dashboard: ![Data Quality Warning History Admin View](/tableau/next/en-us/online/en-us/Img/dm_dqw_admin_view0.png) The dashboard shows how many data quality warnings are active over a period of time. It also shows how many warnings have been changed (created, updated, and deleted) over that same time period. ## See warning details Under the line charts are the details about the data quality warnings, including: - **Date and Time** - When the warning was created or last changed. - **Content Type** - The type of asset the warning is set on, such as a database, table, or data source. - **Content Name** \- Name of the asset the warning is set on. - **Changed By** - Name of the person who created or last changed the warning. - **Status** \- If the warning is active or inactive. - **Type** \- Warning type can be Stale data, Warning, Deprecated, Sensitive data, or Under maintenance. - **Visibility** \- The warning can be configured to have normal (the default) or high visibility. - **Message** \- The message the warning creator wrote to display to users when they see the details of the warning. ## Filter warning history When you review data quality warning history, you can click a mark on the view to filter the details shown below the view. ![Data Quality Warning History dashboard that displays the quantity of active and modified data quality alerts across time](/tableau/next/en-us/online/en-us/Img/dm_dqw_admin_view.png) The numbers on the Day axis represent the date within the time range. For example, if today is November 18, and you filter for the last 7 days, the Day axis shows 12-18. More filters are available when you click the filter icon in the upper right corner: filter by time range and by content type. ### Filter by time range The maximum time range you can configure is the past 30 days. ![A filter menu that enables you to select a time range](/tableau/next/en-us/online/en-us/Img/dm_dqw_admin_view_filter_time.png) ### Filter by content type You can see all the data quality warnings on your site, or you can filter to see warnings for specific types of assets, like data source or table: ![A filter menu with options for time range and content type](/tableau/next/en-us/online/en-us/Img/dm_dqw_admin_view_filter_type.png) ## Who can do this To set a data quality warning, you must be a server or site administrator. [Skip to main content](#main-content) # Delete Groups You can delete any group with the exception of the All Users group. When you delete a group, the users are removed from the group but they are not deleted from the site. 1. Sign in to Tableau Cloud as site admin. 2. From the left navigation pane, click Groups. 3. On the Groups page, select one or more groups to delete. 4. Select Actions \> Delete. ![Groups page showing two groups selected and the Delete Group action highlighted.](/tableau/next/en-us/online/en-us/Img/groups6.png) ## Effects of deleting groups ### Groups with on-demand access Beginning in October 2023, some sites can enable the on-demand access capability for groups. When you delete one or more groups with the on-demand access capability enabled, any embedded Tableau content that was accessible to users not provisioned on your site can no longer access the content. ### Groups in group sets Beginning in June 2024 (Tableau 2024.2), groups can be added to group sets. When content permissions are dependent on a group set, content capabilities are evaluated when users belong to all groups in the group set. If a group that belongs to a group set is deleted then it can change user access to Tableau content when content permissions are dependent on the group set. [Skip to main content](#main-content) # Deploy Data Connect As of September 2025, Tableau Data Connect is no longer available for new deployments. We recommend that existing customers migrate their Data Connect deployment to [Private Connect](https://help.tableau.com/current/online/en-us/private_connect_migrate_from_bridge.htm) or [Tableau Bridge](https://help.tableau.com/current/online/en-us/data_fresh_sync_section.htm). Data Connect will be retired in the future. Before you deploy Data Connect in your organization verify that you have met the prerequisites: - The person or team responsible for deploying Data Connect should have experience with the Linux operating system, shell scripting, Docker, and Kubernetes. - Minimum hardware requirements as specified in [Plan Your Data Connect Deployment](https://help.tableau.com/v0.0/online/en-us/data_connect_get_started.htm). - Networking specification and database access as specified in [Plan Your Data Connect Deployment](https://help.tableau.com/v0.0/online/en-us/data_connect_get_started.htm). ## Step 1: Set up your cluster ![](/tableau/next/en-us/online/en-us/Img/data_connect_setup_569x543.png) Verify the following connectivity and access: - Data Connect infrastructure, cluster, and container require networking access to the orchestration provider services (#2 in the image above) and to Tableau Cloud (outbound only, #5). - Data Connect infrastructure, cluster, container, and Agent require networking access to your database (#6). See [Networking specifications](https://help.tableau.com/v0.0/online/en-us/data_connect_get_started.htm#Networki). ### Deploy and configure Run the following procedure on each computer in your organization where you want to run the Kubernetes cluster. 1. Verify that your secondary volume is unformatted. On the Linux node, run the following command: `lsblk -f` The following image shows an example where the extra volume `nvme1n1` on a cluster node is unformatted and the `FSTYPE` is empty: ![](/tableau/next/en-us/online/en-us/Img/data_connect_kub.png) 2. On the Data Connect tab, under Pools, click New Pool. In the New Pool window, enter a pool name and then click Create. 3. On the Data Connect tab, under Cluster and Nodes, click New Cluster. In the New Cluster window, enter a cluster name and then click Create. 4. On the cluster you just created, click the Actions column and then click New Node. In the Add New Node window, click Download File. A _cluster.tar_ file is downloaded to your Downloads folder. This file contains the bootstrapping scripts that you will run on the node. 5. Copy the cluster.tar file onto your computer. The following example shows how to copy the tar file, extract the files, change the script to an executable file, and then run the script. The example shows this in the context of AWS. Change the file paths for your environment. Run the following commands as root or sudo user, replacing `` and ` with your values: `> scp -i .pem /Downloads/cluster.tar ec2-user@ip-.us-west-2compute.internal:~/` `> ssh -i .pem ex2-user@ip-.us-west-2compute.internal` `> tar -xvf cluster.tar` `> chmod +x onboard_node.sh preflight_check.sh` `> ./onboard_node.sh` **Note**: bzip2 is not installed with Ubuntu by default. To install it, run `apt install bzip2 -y`. After the script is successfully run, you will see `Successfully performed all operations` in the terminal window and the Tableau team will begin the provisioning process. If you encounter an error, verify that your deployment meets the minimum hardware requirements and networking specifications described in [Plan Your Data Connect Deployment](https://help.tableau.com/v0.0/online/en-us/data_connect_get_started.htm). 6. On the Data Connect tab for your site, find in the pool you created in step 2. Under the Actions column, click Assign Cluster and then select the cluster you created in step 3. 7. Click the chevron (⌄) on the cluster to see the host name and available actions. If this information isn't displayed, you may need to reload the page. After confirming the hostname is the target node, click Accept Node and then click Confirm. The cluster node will transition to Provisioning status. Provisioning the node may take an hour or more. 8. When the status on your node changes to Available, navigate to the pool to which you assigned the cluster and click the actions button (...), and then click Refresh Tokens. Verify that you are refreshing tokens for the correct pool, and then click Confirm. 9. Wait for the token refresh to complete. When complete, the pool status is set to Available. Navigate back to the cluster and click the chevron (⌄) to collapse the cluster name section. Click the actions button for the cluster (...) and then click Get Container Registry Information. - If you receive an error when attempting this step, the registry is not yet deployed and the provisioning process may still be finalizing. Wait a few minutes and try again. - When the registry information (server name, user name, and password) is displayed, copy it for the next step. ## Step 2: Build your base image and publish In this step, you will build your base image with the drivers you need, then publish the image to your Docker container registry. Before you begin: - Verify that you have your Docker container registry information from the previous step. - Each pool can have its own unique base image and set of drivers. - If you plan to connect using a TDC file, you will need to include this file in your base image. The system user, `tableau`, must have read access to this file. For more information about how to create and store this file, see the Tableau Desktop help topic, [Customize and Tune a Connection](https://help.tableau.com/current/pro/desktop/en-us/connect_customize.htm). **Important** Base images will vary according to different drivers and platforms. The examples that follow are intended to illustrate the process of building a base image. You must adapt the build process for your particular environment. ### Build the container The following procedure shows an example of building a container. You may need to install package manager tools or other tools specific to your deployment. Please note that the docker image you build must be from Red Hat because the Tableau Bridge installer is a Red Hat installer (\*.rpm file). 1. Log in to any node in the Data Connect cluster. Copy the cluster.tar file onto your computer. The following example shows how to copy the tar file, extract the files, change the script to an executable file, and then run the script. The example shows this in the context of AWS. Change the file paths for your environment. Run the following commands as root or sudo user, replacing and with your values: scp -i .pem /Downloads/cluster.tar ec2-user@ip-.us-west-2compute.internal:~/ ssh -i .pem ec2-user@ip-.us-west-2compute.internal tar -xvf clustertar.tar chmod +x onboard\_node.sh preflight\_check.sh ./onboard\_node.sh 2. Install Docker and supporting tools as required: #RedHat sudo dnf install -y container-tools podman-docker #Ubuntu sudo apt-get update -y sudo apt-get install -y docker.io 3. Create the Dockerfile: touch Dockerfile 4. Update the Dockerfile to include the drivers to support your connections. The commands specified in this Dockerfile will run during build time for your base image. For example: \# example base FROM registry.access.redhat.com/ubi8 RUN yum -y update WORKDIR / # Go to https://tableau.com/support/drivers # Follow the instructions to install your drivers for linux CMD \["/bin/bash"\] The target directory for driver files will vary. See [Tableau Driver Download](https://www.tableau.com/support/drivers) for more details. **Note**: Data Connect supports Exchange Connectors that have a Linux driver and are labeled, "_Works with Tableau Cloud via Bridge_." For more information, see [Tableau Exchange Connectors](https://exchange.tableau.com/en-US/connectors). Example Dockerfile lines for public JDBC driver, using curl command to download the driver: RUN mkdir -p /opt/tableau/tableau\_driver/jdbc RUN curl --location --output /opt/tableau/tableau\_driver/jdbc/ Example Dockerfile lines for non-public JDBC driver, using copy: RUN mkdir -p /opt/tableau/tableau\_driver/jdbc COPY /opt/tableau/tableau\_driver/jdbc Example Dockerfile lines for taco driver, using copy: RUN mkdir -p /home/tableau/Documents/My\_Tableau\_Bridge\_Repository/Connectors COPY /home/tableau/Documents/My\_Tableau\_Bridge\_Repository/Connectors 5. While you are still logged into your Kubernetes cluster node, set the variable POOL\_ID with the value of your pool id. To display the pool id value, open the Data Connect tab and click the pool name. - Set the registry value that you copied to the respective values. REGISTRY\_HOSTNAME=registry\_host\_name\_you\_copied REGISTRY\_USERNAME=registry\_user\_name\_you\_copied REGISTRY\_PASSWORD=registry\_password\_you\_copied - Set the pool ID value: POOL\_ID= 6. Build the container, which is used as your base image. docker build -f -t $REGISTRY\_HOSTNAME/bridge-base:$POOL\_ID . 7. Sign in to your existing Kubernetes node and push the image to the local container registry. docker login --username $REGISTRY\_USERNAME $REGISTRY\_HOSTNAME docker push $REGISTRY\_HOSTNAME/bridge-base:$POOL\_ID 8. Under the pool you are configuring, click the actions button (...) and click Refresh Base Image. This action will initiate a deployment using the base image and may take up to 10 minutes. **Note**: Whenever a new base image is created and refreshed, a new deployment will be created. The bridge agent used for the prior base image will persist as an unassigned asset. Do not delete unassigned bridge agents. ## Step 3: Map a domain to a pool The domain names that you specify in the allowlist are the server names used for the data source connection. 1. While on the Data Connect tab, under the pool and private network allowlist section, select the pool you have assigned and click New Domain in the Actions column. 2. In the Domain text box, enter the URI of the domain using the information described in [Allowlist registry rules](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm). The domain URI that you specify will be scoped only to the pool you are configuring. 3. Under Domain permissions, confirm that the Allow radio button is selected. 4. When finished, click Save. ### Troubleshooting connection errors You must configure your network infrastructure so that the Data Connect can reach all required data sources that you would like to connect to. To verify that Data Connect can reach your data sources, run the following curl command from the nodes where Data Connect will run: $ curl -v $DB\_HOSTNAME:$DB\_PORT If you have successfully set up your connection, you should see a collection of responses. Some examples are shown here: - `Host $DB_HOSTNAME:$DB_PORT was resolved`: Confirms the DNS servers successfully resolved the hostname. - `Connected to $DB_HOSTNAME`: Confirms the node has network connection. - `Empty reply from server. Closing connection`: This is expected since curl is not a database client. - `Could not resolve host: $DB_HOSTNAME`: There is an issue with DNS resolution. - `Trying $DB_IP_ADDRESS:$DB_PORT`: When this message is followed by a hanging result, there is a network problem. If you are using a third party for the Data Connection infrastructure, ensure that networking logic is not being disrupted by the third party. ## (Optional) Step 4: Share clusters across sites By default, Data Connect Clusters and their corresponding nodes are used only by the site where they were originally created. But Data Connect clusters can be shared across all sites within your Tableau Cloud Manager tenant. Sharing clusters allows queries on different sites within the tenant to use the same node infrastructure. To ensure data privacy across the sites, no data about your shared cluster is available to any other sites on your tenant. **Note**: Sharing a cluster is a permanent operation. To unshare a cluster you will have to remove and reinstall a cluster. Clusters can only be shared after they are successfully accepted on the original site where they were created. To share a Data Connect cluster: - Navigate to the cluster you would like to share, click the action ellipsis (...), and then click Share. After you have shared the cluster, site admins on other sites within your tenant will be able to use the cluster with any pools they create in their site. ## (Optional) Step 5: Creating a pool on a shared cluster as a cluster recipient Before you creating your pool as a recipient on a shared cluster verify the following: - The shared cluster has networking connectivity to the databases used by your site - All database drivers required by the database in your site must be installed on the cluster To begin using a shared cluster as a cluster recipient you will need to communicate with the cluster owner to have your pool's base image added to the cluster: 1. On the Data Connect tab, under Pools, click New Pool. 2. In the New Pool window, enter a pool name and then click Create. 3. In the new pool, click Assign Cluster, select the shared cluster, click the action ellipsis (...), and then click Refresh Tokens. 4. Verify that you are refreshing tokens for the correct pool, and then click Confirm. 5. When the pool status is set to Available, copy the Pool\_ID of your pool.. To display the Pool\_ID value, click the pool name. 6. Add a base image for your site. See [Step 2: Build your base image and publish](#build-base), above. The admin with access to the cluster will need to build a new container with the `Pool_ID` value as part of adding the base image. You will also need the registry values on the site that originally created the cluster, which can be provided by the cluster owner. 7. After the base image has been published to the local container registry, navigate to the pool on the share site and then click, Refresh Base Image. 8. To complete setup see, [Step 3: Map a domain to a pool](#map-pool), above. ## Add a node from an existing cluster 1. Navigate to the cluster and click New Node. 2. Follow steps 4, 5, 7, 8, 9 in the procedure above, [Step 1: Set up your cluster](#setup-cluster). Omit step 6 since you will not need to assign the cluster. 3. After the refresh token step is complete, go to the pool associated with the cluster and click Refresh Base Image. **Note**: When a new base image is created and refreshed, a new deployment will be created. The Bridge client used for the prior base image will persist as an unassigned asset. Do not delete unassigned Bridge clients. ## Remove a node from an existing cluster After a node is removed from a cluster the Bridge client will no longer be accessible by Tableau Cloud. Any jobs running on Data Connect at the time the node is deleted will fail. However, no additional jobs will be routed to those Bridge clients. To remove a node, navigate to the cluster, click the action ellipsis (...), and select Delete. ## Updating base images for existing pools If you decide to utilize a new database or update a driver that your Data Connect cluster will use, you can make changes to existing base images to accommodate those changes. To do so, update the container file with the changes as explained in [Step 2: Build your base image and publish](#build-base). After you have updated the container file, click **Refresh Base Image**. Deploying the new base imager may take up to 15 minutes. Your previous base image will be used until the new base image has been successfully deployed. ## Troubleshooting Database Connectivity Start by validating that your domains adhere to the allowlist registry rules. See [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm). Next, confirm that you have configured your network infrastructure so that the Data Connect can reach all required data sources that you would like to connect to. To verify that Data Connect can reach your data sources, run the following curl command from the nodes where Data Connect will run: $ curl -v $DB\_HOSTNAME:$DB\_PORT If you have successfully set up your connection, you should see a collection of responses. Some examples are shown here: - `Host $DB_HOSTNAME:$DB_PORT was resolved`: Confirms the DNS servers successfully resolved the hostname. - `Connected to $DB_HOSTNAME`: Confirms the node has network connection. - `Empty reply from server. Closing connection`: This is expected since curl is not a database client. - `Could not resolve host: $DB_HOSTNAME`: There is an issue with DNS resolution. - `Trying $DB_IP_ADDRESS:$DB_PORT`: When this message is followed by a hanging result, there is a network problem. If you are using a third party for the Data Connection infrastructure, ensure that networking logic is not being disrupted by the third party. [Skip to main content](#main-content) # Set Credentials for Accessing Your Published Data When you publish a workbook to Tableau Cloud or Tableau Server, you can publish the data source it connects to as part of the workbook (_embedded_ into the workbook), or as a separate, standalone data source. In addition, if the data source you’re publishing requires authentication, you can customize how credentials are obtained. The type of authentication to your data source is independent of how people sign in to your Tableau Cloud or Tableau Server site. For example, to give people direct access to the data in a workbook, you would embed a database user’s credentials into the data source’s connection. But anyone viewing the workbook would still need to be able to sign in to the site on Tableau Cloud or Tableau Server to open your workbook. This topic describes how to set authentication on data connections as part of the publishing process. **Note:** This topic doesn’t apply to connections to that don’t require authentication, such as text files or Excel files. ## Set the authentication type For many types of connection you can embed a database user’s name and password, or use single sign-on (SSO). Specific exceptions are described later in this topic. The following steps describe how to set authentication as part of publishing a data source or workbook. You can do this for each connection in the data source. 1. In the Publish Workbook dialog box, go to the Data Sources area, which lists the workbook’s connections, and select Edit. 2. In the Manage Data Sources popup, after you decide whether to publish the data source separately or as part of the workbook, select an authentication type for each connection in the data source. The available authentication types depend on the connection type, and they can include one or more of the following: - Prompt user: Users must enter their own database credentials to access the published data when the view or workbook loads. - Embedded password: The credentials you used to connect to the data will be saved with the connection and used by everyone who accesses the data source or workbook you publish. - Server run as account: A single Kerberos service account is used to authenticate the user. On Windows this is the account that Tableau Server runs as. On Linux it can be any Kerberos account. - Viewer credentials: The viewer’s credentials are passed through to the database using SSO (usually Kerberos). - Impersonate with embedded account or Impersonate with server Run As service account: Impersonation using embedded credentials connects with the embedded credentials and then switches to the viewer’s identity (only for databases that support this). Impersonation using the Run As service account is similar but first, connects with the Kerberos service account before switching to the viewer’s identity. - Refresh not enabled or Allow refresh access: These options appear when you publish an extract of cloud data such as from Salesforce, and database credentials are needed to access the underlying data. Allow refresh access embeds the credentials in the connection, so that you can set up refreshes of that extract on a regular schedule. **Important:** How you want to keep extracted data fresh is also a factor: - If you want to set up an automatic refresh schedule, you must embed the password in the connection. - If you’re publishing a cloud data connection to Tableau Cloud, the publishing steps alert you if you must add Tableau Cloud to the data provider’s authorized list. - You can’t publish an extract that’s created from a Kerberos-delegated, row-level-secure data source. ### Dropbox, OneDrive connections For Dropbox and OneDrive, when you publish a data source or workbook and select Embedded password, Tableau creates a saved credential and embeds it in the data source or workbook. ### Workbook connections to Tableau data sources When you publish a workbook that connects to a Tableau Cloud or Tableau Server data source, rather than setting the credentials to access the underlying data, you set whether the workbook can access the published data source it connects to. Regardless of the original data type, the choice for server data sources is always Embedded password or Prompt users. If you select to prompt users, a user who opens the workbook must have View and Connect permissions on the data source to see the data. If you select embed password, users can see the information in the workbook even if they don’t have View or Connect permissions. ### Virtual connections As of Tableau Cloud and Tableau Server 2022.3 and Tableau Desktop 2022.4, when you publish Tableau content like a data source or workbook that uses a virtual connection and select Embed password or Embed credentials, the viewer of the content will have your permissions to connect to and query the virtual connection. However, any data policies associated with the virtual connection are always evaluated using the viewer’s identity–not yours. For example, you publish a workbook that uses a virtual connection. To let viewers of the workbook connect to and query data by way of the virtual connection, you embed your permissions to connect to and query the virtual connection. Then, any data policies associated with the virtual connection prevent the viewers of the workbook from accessing any sensitive data. When evaluating whether the tables in a virtual connection can be viewed and accessed, the identity of the content creator is used. However, when evaluating any data policies associated with the tables in a virtual connection, the viewer’s identity is used. And the content creator can only ever embed connect permissions to the virtual connection–not edit permissions. If you choose not to embed permissions, then only users with permissions to access the workbook or data source and with connect permissions to the virtual connection can access the workbook or data source. The embed password and embed credentials options for virtual connections don’t work in Tableau Cloud 2022.2, Tableau Server 2022.1, and Tableau Desktop 2022.3 and earlier. If you select these options before you upgrade to 2022.3 (for Tableau Cloud and Tableau Server) or 2022.4 (for Tableau Desktop), the options will work as expected after you upgrade. Then, you’re able to embed your permissions for querying a virtual connection. ## See also - If you publish to Tableau Server, see [Edit Connections](https://help.tableau.com/current/server/en-us/help.htm#connections_modify.htm) in the Tableau Server Help. - If you publish to Tableau Cloud and the workbook connects to Salesforce, Google Analytics, Google Sheets, Google BigQuery, OneDrive, Dropbox, and QuickBooks Online data, see [Refresh Data Using Saved Credentials](https://help.tableau.com/current/online/en-us/to_fresh_data_saved_credentials.htm) in the Tableau Cloud Help. - If you’re a Tableau Server administrator looking for more information about authentication, see the Tableau Server help topics, "Authentication" ([Windows](https://help.tableau.com/current/server/en-us/security_auth.htm) | [Linux](https://help.tableau.com/current/server-linux/en-us/security_auth.htm)) and "Data Connection Authentication" ([Windows](https://help.tableau.com/current/server/en-us/security_data_connection_auth.htm) | [Linux](https://help.tableau.com/current/server-linux/en-us/security_data_connection_auth.htm)). [Skip to main content](#main-content) # Developer Resources The [Tableau Developer Portal](https://www.tableau.com/developer) is the place to go for everything related to extending and automating Tableau. There you can get access to the following: - **JavaScript API**—Integrate Tableau views into your own web applications. - **Tableau Cloud Manager REST API**—Centrally administer and configure multiple Tableau Cloud sites and their users in at the tenant. - **Tableau REST API**—Manage provisioning, permissions, and publishing on Tableau Server or Tableau Cloud via HTTP. The REST API gives you access to the functionality behind the data sources, projects, workbooks, site users, and sites. You can use this access to create custom applications or to script interactions with server resources. - **Tableau SDK**—Use C, C++, Java, or Python to create extracts from any data and then to publish your extracts. - **Tableau Metadata API**—Using GraphQL, you can discover and query Tableau content and related external assets and metadata.. - **Web Data Connector**—Create a Tableau connection in JavaScript to almost any data that's accessible over HTTP. This can include internal web services, JSON data, XML data, REST APIs, and many other sources. - ODBC connector—Create a connection using ODBC (Open Database Connectivity), which is a data-access protocol that's supported by a wide array of data sources. In Tableau Desktop, you can connect to any ODBC-compliant source using the built-in ODBC connector. In addition to these resources, you can get complete documentation and examples, and collaborate with the Tableau developer community. ### **Notes for Tableau Cloud users** - When you make REST API calls to Tableau Cloud, you need to use the URL for the instance on which your site exists. For example, https://10ay.online.tableau.com/ For information, see **Specifying Resources for Tableau Cloud** under [Using URIs to Specify Resources](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_fundamentals.htm#using_uris_for_resources). - Not all of the methods provided in the Tableau REST API are applicable to Tableau Cloud. For information, see the API listing by category in the [API Reference](https://help.tableau.com/current/api/rest_api/en-us/help.htm#REST/rest_api_ref.htm). [Go to the developer community](https://community.tableau.com/s/topic/0TO4T000000QF8eWAG/developers) [Skip to main content](#main-content) # Disable or Enable Ask Data for a Site **Important changes for Ask Data and Metrics** Tableau's Ask Data and Metrics features were retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau AI and Tableau Pulse are reimagining the data experience.](https://www.tableau.com/blog/tableau-pulse-and-tableau-gpt) Ask Data is enabled for sites by default, but Tableau administrators may disable it. 1. Go to the General site settings. 2. (Tableau Server only) In the Web Authoring section, select Let users edit workbooks in their browser. 3. In the Availability of Ask Data section, choose from these options: - Enabled enables creation of Ask Data lenses for all published data sources. - Disabled hides Ask Data throughout the site, while preserving information about previously created lenses so they can be restored if Ask Data is re-enabled. [Skip to main content](#main-content) # Disable or Enable Explain Data for a Site Explain Data is enabled for sites by default, but Tableau administrators may disable it. 1. Go to the General site settings. 2. (Tableau Server only) In the Web Authoring section, select Let users edit workbooks in their browser. 3. In the Availability of Explain Data section, select from these options: - Enable lets Creators and Explorers with the appropriate permissions run Explain Data in editing mode. Lets all users with appropriate permissions run Explain Data when it is enabled for viewing mode. - Disable prevents all users from running Explain Data or accessing Explain Data settings in workbooks. 4. In Tableau Cloud and Tableau Server 2023.3 or later, to use Explain Data: - In the Availability of Data Guide section, select Show. For more information about Data Guide, see [Explore Dashboards with Data Guide](https://help.tableau.com/v0.0/online/en-us/data_guide.htm). [Skip to main content](#main-content) # Discover Insights Faster with Explain Data Explain Data in the Data Guide helps you to inspect, uncover, and dig deeper into the marks in a viz as you explore your data. You can use Explain Data to analyze dashboards, sheets, or selected marks for possible outliers and correlations in the underlying data. Explain Data builds statistical models and proposes possible explanations for individual marks in a viz, including potentially related data from the data source that isn't used in the current view. For information on running Explain Data and exploring explanations, see [Get Started with Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm). **Note**: This topic describes how Explain Data works in Tableau 2021.2 and later versions. If you have a previous version of Tableau, read this topic in [version 2021.1 of Explain Data help](https://help.tableau.com/v2021.1/pro/desktop/en-us/explain_data.htm "Link to previous version of this help topic in Tableau version 2021.1"). As you build different views, use Explain Data as a jumping-off point to help you explore your data more deeply and ask better questions. For more information, see [How Explain Data helps to augment your analysis](#How). For information on what characteristics make a data source more interesting for use with Explain Data, see [Requirements and Considerations for Using Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_requirements.htm). ## Access to Explain Data Explain Data is enabled by default at the site level. Server administrators (Tableau Server) and site administrators (Tableau Cloud) can control whether Explain Data is available for a site. For more information, [Disable or Enable Explain Data for a Site](https://help.tableau.com/v0.0/online/en-us/explain_data_enable.htm). Authors who can edit workbooks and have the Run Explain Data permission capability for a workbook can run Explain Data in editing mode. All users with the Run Explain Data capability can run Explain Data in viewing mode in Tableau Cloud and Tableau Server. When allowed by site administrators, explanations can be shared in viewing mode via email or Slack with other Tableau Cloud and Tableau Server users. For more information, see [Configure Tableau to allow users to share explanations via email and Slack](https://help.tableau.com/v0.0/online/en-us/explain_data_control_access.htm#ConfigureSlackEmail). Authors can use Explain Data Settings to control which explanation types are displayed in the Data Guide pane. For information on controlling access to Explain Data, explanation types, and fields, see [Control Access to Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_control_access.htm). ## How Explain Data helps to augment your analysis Explain Data is a tool that uncovers and describes relationships in your data. It can't tell you what is causing the relationships or how to interpret the data. **You are the expert on your data.** Your domain knowledge and intuition are key in helping you decide what characteristics might be interesting to explore further using different views. For related information, see [How Explain Data Works](https://help.tableau.com/v0.0/online/en-us/explain_data_explained.htm) and [Requirements and Considerations for Using Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_requirements.htm). For more information on how Explain Data works and how to use Explain Data to augment your analysis, see these Tableau Conference presentations: - [From Analyst to Statistician: Explain Data in Practice (1 hour)](https://www.tableau.com/events/tc/2019/analyst-statistician-explain-data-practice) - [Leveraging Explain Data (45 minutes)](https://www.tableau.com/events/tc/2019/leveraging-explain-data) ## Other articles in this section [Skip to main content](#main-content) # DNS for Inbound Private Connect This topic explains how to set up DNS for Inbound Private Connect. Set up the connection and security groups first. For more information, see Steps 1, 2, & 3 in [Setup Inbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_inbound_setup.htm). ## Step 4: Create private hosted DNS zones A Private Hosted DNS Zone in your VPC ensures that your Tableau Cloud traffic routes through the VPC endpoint instead of the public internet. For more information, see Working with Private Hosted Zones and Creating a private hosted zone in the AWS documentation. Create Private Hosted Zones for: 1. `cloudmanager.tableau.com` 2. `{pod_name}.online.tableau.com` `{pod_name}` is the Tableau Cloud pod name you recorded during the [Setup Inbound Private Connect prerequisites](https://help.tableau.com/v0.0/online/en-us/private_connect_inbound_setup.htm#prerequisites). 3. `bridge-{pod_name}.online.tableau.com` `{pod_name}` is the Tableau Cloud pod name you recorded during the [Setup Inbound Private Connect prerequisites](https://help.tableau.com/v0.0/online/en-us/private_connect_inbound_setup.htm#prerequisites). 4. `sso.online.tableau.com` When creating each zone: - For Domain name, enter the private hosted zone (domain) you're creating. (Zone #2 example: `10ay.online.tableau.com`) - For Type, select Private hosted zone. - In the VPC ID list, select the VPC that you want to associate with the hosted zone. ## Step 5: Create DNS records in the private zones Add DNS records that point Tableau Cloud hostnames to the VPC endpoint. For more information, see [Creating records by using the Amazon Route 53 console](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-creating.html) in the AWS documentation. #### DNS records common to all 4 zones Create the following DNS records in each of the private hosted zones from [Step 4](#step-four): - _(Leave Record name blank)_ - Record type: A - Enable the Alias toggle. - Route traffic to: Select Alias to VPC endpoint. - Select the VPC Endpoint's region. - Search for and select the VPC endpoint DNS Name you recorded at the end of [Setup Inbound Private Connect Step 1](https://help.tableau.com/v0.0/online/en-us/private_connect_inbound_setup.htm#step-one). - Routing Policy: Select Simple routing. - Evaluate target health: Leave as No. - Select Create records. Repeat the process for **each** remaining private hosted zones from [Step 4](#step-four). #### Additional DNS record for cloudmanager.tableau.com Create one additional DNS record in the `cloudmanager.tableau.com` zone: - Record Name: `*` The asterisk is a wildcard that will match any host in the `cloudmanager.tableau.com` domain. - Record type: A - Enable the Alias toggle. - Route traffic to: Select Alias to VPC endpoint. - Select the VPC Endpoint's region. - Search for and select the VPC endpoint DNS Name you recorded at the end of [Setup Inbound Private Connect Step 1](https://help.tableau.com/v0.0/online/en-us/private_connect_inbound_setup.htm#step-one). - Routing Policy: Select Simple routing. - Evaluate target health: Leave as No. - Select Create records. Once the DNS records have had a chance to propagate, test your connectivity by logging into Tableau Cloud from a host within your VPC. ## DNS Considerations - Inbound Private Connect will not fail over if you use a disaster-recovery region with your Tableau Cloud pod. - For hosts inside the VPC, private hosted zones take precedence over public zones with the same name. Only the records in the private hosted zone will resolve. - If users in the VPC need to reach Tableau Cloud sites on other pods through the public hostname, plan an alternate DNS strategy before you create the private hosted zone. For help choosing an approach, contact your account team. [Skip to main content](#main-content) # Drain a Bridge Linux Client Before Shutdown When you run Tableau Bridge on Linux in containers or clusters, use the draining feature to finish active extract refreshes before stopping the client. Draining is optional. Turn it on in the Bridge client configuration. When draining is enabled, stopping the container gracefully tells the client to complete current published data source extract work and then shut down, up to a time limit you set. A force stop (for example, `docker kill` or a `SIGKILL`) does not drain. It stops the process immediately. When draining is enabled and you issue a graceful stop command, the client enters the draining state and immediately stops accepting, queuing, or scheduling any new extract refresh tasks. The client continues processing all published data source extract refreshes that are currently in progress or already sitting in the queue. If all running and queued refreshes finish before the timeout, the Bridge process exits right away. If the timeout is reached first, Bridge stops waiting and exits. The refreshes that were still running at that point do not complete, and Tableau Cloud shows them as failed so you can rerun them. To avoid incomplete refreshes at shutdown, set the timeout to be longer than your longest typical refresh. For general information about managing Bridge clients and pools, see [Manage Pools](https://help.tableau.com/v0.0/online/en-us/to_bridge_manage.htm). For client issues, see [Troubleshoot Tableau Bridge Client Issues](https://help.tableau.com/v0.0/online/en-us/to_bridge_troubleshoot.htm). ## Prerequisites Draining a Bridge Linux client requires: - Running the Bridge Linux client on the machine or container image. - Having write access to the client configuration JSON file (`TabBridgeClientConfiguration.txt`, located in the client's Configuration folder). - Stopping the container or pod via your container runtime or orchestrator (for example, `docker stop`, `podman stop`, or Kubernetes pod deletion or scale-down). - Setting a container stop timeout (grace period) that exceeds your configured draining timeout. It is recommended to exceed the draining timeout by a few minutes to prevent interrupted refreshes. If the grace period is shorter than `drainingTimeOutInSeconds`, the runtime force-stops the container before draining finishes and any running refreshes are cancelled. ## Drain the client ### Step 1: Turn on draining and set a timeout 1. Open the Bridge Linux client configuration file (`TabBridgeClientConfiguration.txt`) for your deployment. 2. Add or edit a `drainingSettings` object. - Set `enableDraining` to `true`. - Set `drainingTimeOutInSeconds` to the maximum time in seconds that the client can spend draining before it exits. Allowed values are 60 through 14400 (1 minute through 4 hours). Values below 60 seconds are automatically adjusted to 60 seconds. Values above 14400 seconds (4 hours) are automatically adjusted to 14400 seconds. A warning is logged when this adjustment occurs. 3. Save the file. 4. Restart or redeploy the Bridge client. Example `{ "drainingSettings": { "enableDraining": true, "drainingTimeOutInSeconds": 1800 } }` Default value when the feature is not configured:

Setting	Default
`enableDraining`	false (draining off)
`drainingTimeOutInSeconds`	1,800 (30 minutes)

### Step 2: Stop the client to start draining Draining starts when the Bridge process receives a `SIGTERM` or `SIGINT` signal. Commands such as `docker stop`, `podman stop`, and Kubernetes pod deletion send `SIGTERM` for you. If you run Bridge directly on a host instead of in a container, send `SIGTERM` to the Bridge process directly to trigger draining. **Note:** Forced terminations (such as `docker kill`, `kill -9`, or setting a grace period of `0`) send a `SIGKILL` signal. `SIGKILL` cannot be handled by the application, which bypasses draining and immediately cancels running extract refreshes. Default orchestrator grace periods are short, therefore, you must explicitly increase them to exceed your `drainingTimeOutInSeconds`. The recommendation is to increase by a few minutes to allow for clean exit after the last job finishes: - **Docker** or **Podman**: Pass the `--time ` flag (default is 10 seconds). - **Kubernetes**: Set `terminationGracePeriodSeconds` in the pod specification (default is 30 seconds). ### Step 3: Verify draining execution To verify that draining is successful, use one of these methods: - **Client Logs**: Check `TabBridgeClientConfiguration.txt` log output for these entries: - `enableDraining=true; beginning graceful drain`: Confirms that draining started. If you see `enableDraining=false` instead, the setting was not applied and Bridge stopped immediately without draining. - `BridgeDrainMetrics: outcome=natural`: Indicates that every job finished before the timeout and the process exited cleanly. - `BridgeDrainMetrics: outcome=wait_elapsed`: Indicates that the timeout was reached before all jobs finished. Any refreshes still running at that point didn't complete. Also, check for any logged warnings about automatic timeout adjustments if your configured `drainingTimeOutInSeconds` was outside the allowed range. - **Bridge Status**: Review the Jobs page or Bridge Extracts in Tableau Cloud to verify that in-flight jobs completed before the client shut down. Jobs that did not complete before exit appear as failed and can be rerun manually. For troubleshooting draining, see [Troubleshooting Draining Issues.](https://help.tableau.com/v0.0/online/en-us/to_bridge_troubleshoot.htm#Troubleshooting_Draining_Issues) [Skip to main content](#main-content) # Dynamic Color Ranges With dynamic color ranges, you can link color ranges to a parameter's value, enabling you to visualize data trends more effectively. By using parameter actions, you can dynamically update color ranges based on selections or mark hovers, and you can link the start, center, and end points of the color range to a parameter. This not only allows for customization but also helps to ignore outlier data that might skew the color palette. You can also synchronize range values across visualizations on a dashboard, leading to faster insights. ## Use supported field and color palette types You can use a dynamic color range with continuous fields, typically measures. They can be applied to quantitative color palettes in Tableau, including sequential and diverging color palettes. ### Sequential color palettes Typically, a sequential palette shows a single color, varying in intensity. You must specify at least the two end colors in the sequential color range. ![An orange sequential color palette option.](/tableau/next/en-us/online/en-us/Img/dcr_sequential.png) ### Diverging color palettes A diverging color palette is like two sequential palettes that share a color in the middle but have different extremes. This type of palette shows two ranges of values using color intensity (how dark or light) to show the magnitude of the number and the actual color (orange or blue) to show which range the number is from. Diverging palettes are most commonly used to show the difference between positive and negative numbers. ![A red and blue diverging color palette option in Tableau.](/tableau/next/en-us/online/en-us/Img/dcr_divergeng.png) ## Configure a dynamic color range based on mark selection Starting in Tableau 25.3, you can automatically update the color range based on selected marks, eliminating the need for separate parameter and parameter action workflows. To configure the Start, Center, or End points of your color range: 1. On the Marks card, select Color, then choose Edit Colors… 2. From the dropdown menu for the desired range point (Start, Center, or End), select Update on interaction. 3. Return to your visualization and click on a mark to set the corresponding value for the chosen range point. Repeat this process for any other range points you wish to dynamically update. ![Edit colors dialog box with option to set start, center, and end to update on interaction.](/tableau/next/en-us/online/en-us/Img/dynamic_color_selection.png) ## Configure a dynamic color range with an existing parameter You can also configure a dynamic color range on any quantitative, continuous field used in an existing parameter. 1. After your parameter has been set up, select Colors on the Marks card. 2. Select Edit Colors… 3. In the Edit Colors dialog box, expand the dropdown next to the start and end point. You can choose Automatic or Custom, or you can use a parameter to set the color range to update dynamically with parameter actions. ![Configure a dynamic color range with the edit color dialog box.](/tableau/next/en-us/online/en-us/Img/dcr_edit_colors.png) ## Connect a dynamic color range to a parameter action You can type in any value you want in a parameter control to ensure a more efficient color contrast. For a more interactive solution, you can configure the parameter so that the color range point is tied to a parameter action. 1. To do this, [create a parameter action](https://help.tableau.com/current/pro/desktop/en-us/actions_parameters.htm#Create) with these properties: 2. Set the Source Sheet to the worksheet or a sheet on a dashboard. 3. Set the Target Parameter to the parameter that you want to be tied to the dynamic color range. 4. Set the Source Field to a continuous measure used to encode color. 5. Set the Aggregation: - Use Minimum or First Quartile for the start of the color range. - Use Maximum or Third Quartile for the end of the color range. 6. Make sure that Clearing the selection will is set to Keep current value. This ensures that your color palette changes persist between interactions. ![Add a parameter action dialog with a dynamic color range set to a continuous field.](/tableau/next/en-us/online/en-us/Img/dcr_parameteraction.png) With this parameter action, your color range dynamically updates as you interact with marks on the viz. ## Understand limitations and edge cases Dynamic color ranges aren’t updated within [Stories](https://help.tableau.com/current/pro/desktop/en-us/stories.htm). If you delete the parameter used for the dynamic color range, then the range value will be set to the most recent parameter value. The next time you edit the color, you'll receive a message to choose a new parameter for the dynamic color range. [Skip to main content](#main-content) # Edit a Published Data Source Imagine that you’ve published a data source, and your team is using the data source across a number of workbooks. This is a good start, but you have some changes in mind that will make your data source great. Before you implement these changes, you want to see how your proposed changes look in Tableau. And most importantly, you need to test your changes to ensure they won’t negatively impact any existing workbooks that use the data source. Editing a published data source allows you to test changes and make improvements to your data source while maintaining it as a single source of data. **Note**: Only users with a site role of Creator can edit publish data sources in the browser. Alternatively, you can _extend_ a published data source by making your changes in a new data source. An extended published data source layers your overrides in a new data source without changing the original and maintains a connection to that original data source. For more information, see [Expand Published Data Sources](https://help.tableau.com/current/pro/desktop/en-us/datasource_extend_compose.htm). ## Edit and test changes Whether you’re creating a new published data source or editing an existing published data source, you can create relationships and modify the data model from the Data Source page without leaving your browser. Then use the Scratchpad to test your changes, create folders, organize hierarchies, and rename fields and aliases before publishing your data source. While editing your data source, you’ll have all the same features and functionality that you have when authoring in Tableau Cloud. For more information, see [Web Authoring and Tableau Desktop Feature Comparison](https://help.tableau.com/current/pro/desktop/en-us/server_desktop_web_edit_differences.htm). To edit a published data source: 1. From the Start or Explore page, navigate to the data source you want to edit. 2. Click Edit Data Source. ![Edit Data Source button](/tableau/next/en-us/online/en-us/Img/edit_published_data_source.png) 3. Click the Data Source page to make joins or edit the schema. 4. Click the Scratchpad sheet. 5. From the Data pane, create folders, organize hierarchies, rename fields and their aliases, or update metadata that are saved with the published data source. 6. Drag and drop fields onto the scratchpad to make sure your changes are working as expected. 7. Click Publish. Just like you can with workbooks, you can also Publish As if you want to make a copy of the data source. **Note:** Personal Spaces don’t support published data sources. ## Roll back changes To revert to the last version of the published data source: 1. Navigate to the data source that you want to revert. 2. Click File. 3. Choose Revert to Published. ![File dropdown menu, Revert to Published option](/tableau/next/en-us/online/en-us/Img/revert_to_published.png) This reverts to the latest published version of that data source. ## Understand supported connections Editing published data sources doesn’t support data sources that use embedded passwords in Tableau Cloud and Tableau Server. Also, the Data Source page isn’t available for published data source connection types that aren’t supported, including but not limited to .hyper file types. To see which connection types are supported, see [Creators: Connect to Data on the Web](https://help.tableau.com/v0.0/online/en-us/creator_connect.htm). ## Learn about permissions To edit a published data source, you’ll need a Creator license that has Save or Save As permissions for data sources in the respective folder. For more information, see [Permissions](https://help.tableau.com/current/online/en-us/permissions.htm). ## Edit data sources published by a flow If you make edits to a data source that was published by a flow, the changes will be overwritten during the next scheduled flow. Instead, edit the data source in the flow. For more information, see [Publish a Flow to Tableau Server or Tableau Cloud](https://help.tableau.com/current/prep/en-us/prep_conductor_publish_flow.htm). [Skip to main content](#main-content) # Edit Connections on Tableau Cloud Administrators and data source owners can manage a published data source's connection information. The connection information describes the data source, its owner, and how to access the data. You can embed database credentials in the connection to allow users to access the data directly or to enable scheduled refreshes for extracts. Alternatively, you can set the connection so that users are prompted to sign in. You can also change the server name for cloud-based data. The data source owner or a site administrator can manage this information directly on the site. For example, you can update tags or change the data source owner, without having to republish the data source. 1. On the site that has the data source you want to modify, open the Explore page, then filter to show All Data Sources. ![Explore filtered to data sources](/tableau/next/en-us/online/en-us/Img/connections1.png) If there are a large number of data sources, use filters to narrow the list. ![Filter options](/tableau/next/en-us/online/en-us/Img/connection_filter.png) 2. Select the check box next to the data source you want to update, and on the Actions menu, select Edit Connection. **Note:** To edit the connection type of extract refreshes for online schedules to use Tableau Cloud instead of Bridge, see [Change the connection type of a refresh to use Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_sync_signout_unlink.htm#use_cloud). 3. Update the connection information and click Save. For connections that support using saved credentials to refresh the data, see [Refresh Data Using Saved Credentials](https://help.tableau.com/v0.0/online/en-us/to_fresh_data_saved_credentials.htm). **Note**: The Test connection button doesn't support Bridge connections. As an alternative to testing your connection with this button, consider running a manual refresh to test the connection instead. For more information about running a manual refresh, see [Start a Refresh Task Manually](https://help.tableau.com/v0.0/online/en-us/to_refresh_extract_manual.htm). 4. Refresh the Data Connections page (press F5 or Ctrl+R) for your changes to take effect. [Skip to main content](#main-content) # Effective permissions A permission rule establishes who is impacted (a group set, group, or user) and what [Capabilities](https://help.tableau.com/v0.0/online/en-us/permissions_capabilities.htm#Capabili) they are **Allowed**, **Denied**, or **Unspecified**. While it seems straightforward to simply set a permission rule and have that be the whole story, whether a user has a capability may be unclear because of membership in multiple groups and the interplay of site roles and ownership with permission rules. Multiple factors are evaluated in a specific order, yielding _effective permissions_ on a piece of content. > [!TIP] > > To help keep things as straightforward as possible, we recommend (1) setting permission rules for groups instead of users, (2) managing permissions locked at the project level instead of setting permissions on individual content, and (3) deleting the All User group’s permission rule or setting all capabilities to None. A capability is allowed for a user if and only if the following three conditions are all met: - The capability is within the scope of their site role. - They have that capability: - based on a specific user scenario (such as being the content owner or a project leader, or they’re an administrator site role), OR - because they have been allowed the capability as a user, OR - because they are both in a group that has been allowed the capability and no rules deny them the capability as a user or member of another group. - There is no conflicting permissions settings at another content level that takes precedence. Any other situation denies the user the capability. Hovering over a capability brings up a tooltip that explains the effective permission. Here are some common examples of why effective permissions—what the user can or can’t do in actuality—might appear different than what a given permission rule states: - A user might have a capability they are denied in a permission rule because their site role includes it (administrators). - A user might have a capability they are denied in a permission rule because their user scenario allows it (because they own the content or are a project owner or leader). - A user might lack a capability they are allowed in a permission rule because their site role doesn’t allow it. - A user might lack a capability they are allowed in a permission rule because a conflicting group or user rule denied it. - A user might lack a capability they are allowed in a permission rule at one level of content (such as a workbook) because another level of content denied it (such as a view). ## Evaluate permission rules Permissions in Tableau are restrictive. Unless a capability is granted to a user, they are denied permission. The following logic evaluates if a capability is allowed or denied for an individual: ![Flow chart of the rules for how permissions are evaluated](/tableau/next/en-us/online/en-us/Img/perms_evalflow_basic.png) 1. **Site role:** If a site role doesn’t permit a capability, the user is denied. If the user's site role does permit the capability, then specific user scenarios are evaluated. - For example, a Viewer site role can’t web edit. See [General capabilities allowed with each site role](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm#site-role-capabilities-summary) for more information on what each site role can do. 2. **Specific user scenarios:** - If the user is an admin they have all capabilities on all content. - If the user is a project owner or project leader, they have all capabilities on all content in their projects. - If the user is the content owner, they have all capabilities\* on their content. - If these scenarios do not apply to the user, then user rules are evaluated. \*Exception: Content owners won’t have the **Set Permissions** capability in projects where permissions are locked. Only administrators, project owners, and project leaders can set permission rules in locked projects. 3. **User rules:** If the user is denied a capability, it is denied. If they are allowed a capability, it is allowed. If a capability is unspecified, then group rules are evaluated. 4. **Group rules:** If the user is in _any_ group that is denied a capability, it is denied. If the user is in a group that is allowed a capability (and not in any groups that are denied that capability), it is allowed. - That is to say, if a user is a member in two groups, and one is allowed a capability and one is denied the same capability, the denial takes precedence for that user and they are denied. 5. **Group set rules:** If a user is a member of a group in a group set, any group in the group set that is denied a capability, is then denied. 6. If none of the above conditions apply, the user is denied that capability. In effect, this means that capabilities left as unspecified will result in denied. A final effective permission of **Allowed** therefore occurs in three circumstances: - Allowed by site role (Server Administrator, Site Administrator Creator, Site Administrator Explorer) - Allowed because the user is the content owner, project owner, or project leader - Allowed by a group, group set, or user rule (and not denied by a rule of higher precedence) **Denied** occurs in three circumstances: - Denied by site role - Denied by a rule (and not allowed by a rule of higher precedence) - Not granted by any rule ## Evaluate permissions set at multiple levels If Asset permissions are set to Customizable, it’s possible to configure permission rules in multiple places. There are specific rules that determine what permissions are applied on the content. - If there are nested projects, permissions set at the child level take precedence over permissions set at the parent level. - Changes to permissions at the project level are not enforced for existing content. - If there are permissions set on content (workbook, data source, or flow) during or after publication, these take precedence over rules set at the project level. - If a workbook doesn’t show navigational sheet tabs, any changes to the workbook-level permissions _won’t_ be inherited by the views and any changes to permissions must be done on the view. - Configuring the workbook to show navigational sheet tabs will override existing view-level permissions and sync them with the workbook-level permissions. See [Show or Hide Sheet Tabs](https://help.tableau.com/v0.0/online/en-us/permissions.htm#sheettabs). ![Flow chart of the rules for how permissions are evaluated with nested projects](/tableau/next/en-us/online/en-us/Img/perms_evalflow_total.png) This image shows how capabilities are evaluated through multiple levels of content. ## Permissions on views In a workbook that is not in a locked project and does not show sheets as tabs for navigation, views (sheets, dashboards, stories) inherit the workbook permissions at publication, but any changes to permission rules must be made on individual views. View capabilities are the same as those for workbooks, except for **Overwrite**, **Download Workbook/Save a Copy**, and **Move** which are only available at the workbook level. We recommend showing navigational sheet tabs whenever possible so views continue to inherit their permissions from the workbook. For more information, see [Show or Hide Sheet Tabs](https://help.tableau.com/v0.0/online/en-us/permissions.htm#sheettabs). ## Effective permissions and on-demand access When on-demand access is enabled for a group, you’ll see an inline alert. On-demand access indicates that when permissions for Tableau content are dependent on the group, there might be users who are not provisioned on the site that can access the content. Users who might be accessing the content are not provisioned on the site and do not have effective permissions. As a result, these users are not listed in the Effective Permissions area. For more information, see [On-demand access using connected apps with direct trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_direct.htm#ondemand) or [On-demand access using connected apps with OAuth 2.0 trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_eas.htm#ondemand). [Skip to main content](#main-content) # Notify Owners When Extract Refreshes Fail A scheduled extract refresh can fail to complete for a variety of reasons, such as outdated embedded credentials or file path. For scheduled refreshes that run directly from Tableau Cloud, after a refresh has failed five consecutive times, Tableau Cloud suspends the schedule until a site admin or the data source owner takes an action to address the cause. A site admin can enable Tableau Cloud to send email to the owner of a data source when its scheduled extract refresh does not complete successfully. The data source owner can then opt out individually in their account settings. The email contains the following information: - Extract or workbook name. - The date and time of the last successful refresh. Or, if the last refresh was longer than 14 days ago, the email shows “not in the last _N_ days.” - The number of consecutive times the refresh has failed. - A suggested action to take to address the cause of the failure, such as updating embedded credentials or a file path, and a link to Tableau Cloud to take the action. When receiving email about data sources refreshed by Tableau Bridge, there will be some differences. For more information, see [Differences for Tableau Bridge refreshes](#sync) later in this topic. ## Enable refresh failure emails As a site admin, you have the ability to enable (or disable) refresh failure emails for your site using the procedure below. 1. Sign in to Tableau Cloud as a site admin and click Settings. 2. Under Manage Notifications , select or clear the check boxes to allow or disable notifications for all of your site users. If you enable refresh failure emails, individual users can opt out of receiving refresh failure emails in their individual account settings. ## Refresh failure emails for content owned by others **Note:** This option is not available for published data sources created or refreshed from Bridge. By default, only content owners receive notifications if there is a problem refreshing an extract. However, other users can also choose to receive notifications when an extract refresh fails. If another user wants to enable email notifications when an extract fails, they open the context menu (**...**) in the extract dashboard, select Extract Failure Notification, and select **Yes** to receive notifications, or **No** to stop notifications. ![Menu containing extract failure notification](/tableau/next/en-us/online/en-us/Img/extract_failure_notify_menu.png "context menu") **Note**: If the current user is an owner of the extract, the ability to opt in or out of failure notifications is not available using the context menu. ## Differences for Tableau Bridge refreshes For data sources that are refreshed through Tableau Bridge, notifications will vary. For more information, see [Manage Alerts for Tableau Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_alerts.htm). [Skip to main content](#main-content) # Enable SAML Authentication on a Site or TCM This topic explains how to enable SAML on the site or Tableau Cloud Manager (TCM) and select single sign-on (SSO) users. It also provides steps for switching from SAML to the default Tableau authentication. Before you enable SAML, we recommend that you review the [SAML Requirements for Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/saml_online_requ.htm), including [Effects of changing authentication type on Tableau Bridge](https://help.tableau.com/v0.0/online/en-us/saml_online_requ.htm#bridge-consequences). **Note:** Enabling SAML authentication for TCM requires a separate setup and app integration from Tableau Cloud. This topic assumes you are familiar with the information in [Authentication](https://help.tableau.com/v0.0/online/en-us/security_auth.htm) and [How SAML Authentication Works](https://help.tableau.com/v0.0/online/en-us/saml.htm). ## IdP-specific configuration information The steps in the sections later in this topic provide basic steps that you can use with your IdP’s documentation to configure SAML for your Tableau Cloud site or TCM. You can get IdP-specific configuration steps for the following IdPs: - [Configure SAML with Microsoft Entra ID](https://help.tableau.com/v0.0/online/en-us/saml_config_azure_ad.htm) - [Configure SAML with AD FS](https://help.tableau.com/v0.0/online/en-us/saml_config_adfs.htm) - [Configure SAML with OneLogin](https://help.tableau.com/v0.0/online/en-us/saml_config_onelogin.htm) - [Configure SAML with PingOne](https://help.tableau.com/v0.0/online/en-us/saml_config_pingone.htm) - [Configure SAML with Okta](https://help.tableau.com/v0.0/online/en-us/saml_config_okta.htm) - [Configure SAML with Salesforce](https://help.tableau.com/v0.0/online/en-us/saml_config_salesforce.htm) ## Enable SAML **For Tableau Cloud** 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. On the Authentication tab, click the New Configuration button, select SAML from the Authentication drop-down, and then enter a name for the configuration. ![Screen shot of Tableau Cloud site authentication settings -- new configuration page](/tableau/next/en-us/online/en-us/Img/saml_config_site3.png) **Note:** Configurations created before January 2025 (Tableau 2024.3) can't be renamed. **For TCM** Alternatively, in TCM, do the following: 1. Sign in to TCM as a cloud administrator, and select Settings > Authentication. 2. Select the Enable an additional authentication method check box, and select SAML from the Authentication drop-down. 3. Click the Configuration (required) drop-down arrow. ## SAML configuration steps This section takes you through the configuration steps that appear on the Authentication tab in the Tableau Cloud or TCM Settings page. **Note:** To complete this process, you will also need the documentation your IdP provides. Look for topics that refer to configuring or defining a service provider for a SAML connection, or adding an application. Step 1: Export metadata from IdP Go to your IdP, sign in to your IdP account, and use the instructions provided by the IdP’s documentation to download your IdP's metadata. The IdP's metadata enables Tableau Cloud or TCM to connect to your IdP. For step 1, the IdP’s documentation will guide you also in how to provide metadata to a service provider. It will instruct you to download a SAML metadata file, or it will display XML code. If it displays XML code, copy and paste the code into a new text file, and save the file with a .xml extension. Step 2: Upload metadata to Tableau For Tableau Cloud, in the New Configuration page in Tableau Cloud, import the metadata (.xml) file that you downloaded from the IdP or configured manually from the XML it provided. For TCM, in the Authentication page in TCM, import the metadata (.xml) file that you downloaded from the IdP or configured manually from the XML it provided. **Notes:** - After uploading the IdP metadata, both the IdP entity ID and IdP SSO service URL fields populate automatically. - If editing the configuration, you will need to upload the metadata file so Tableau knows to use the correct IdP entity ID and SSO service URL. - You can use the Clear IdP Metadata button if you need to upload a new metadata file. Step 3: Map attributes Attributes contain authentication, authorization, and other information about a user. **Note:** Tableau Cloud or TCM requires the **NameID** attribute in the SAML response. You can provide other attributes to map user names in Tableau, but the response message must include the **NameID** attribute. - Username: (Required) Enter the name of the attribute that stores users’ usernames (email addresses). - **Email address:** (Optional) Enter the name of the attribute that contains the email address that the IdP uses during the authentication process to enable users to receive notifications at an email address that is different from the username. The email address attribute is used for notifications purposes only and not used for sign-in. - **Display name:** (Optional but recommended) Some IdPs use separate attributes for first and last names, and others store the full name in one attribute. Select the button that corresponds to the way your IdP stores the names. For example, if the IdP combines first and last name in one attribute, select Display name, and then enter the attribute name. ![Screen shot of step 3 for configuring site SAML for Tableau Cloud -- map attributes](/tableau/next/en-us/online/en-us/Img/saml_config_site_match_assertions.png) Step 4: Choose default for embedded views **Note:** Applies to Tableau Cloud only. Select the method by which users sign in to embedded views. The options are to open a separate pop-up window that displays the IdP’s sign-in form, or to use an inline frame (iframe). **Important:** Because iframes can be vulnerable to _clickjacking_ attacks, not all IdPs support signing in through an iframe. With clickjacking, the attacker tries to lure users into clicking or entering content. They do this by displaying the page to attack in a transparent layer over an unrelated page. For Tableau Cloud, an attacker might try to capture user credentials or to get an authenticated user to change settings. For more information, see [Clickjacking](https://www.owasp.org/index.php/Clickjacking) on the Open Web Application Security Project website. If your IdP doesn’t support signing in through an iframe, select Authenticate in a separate pop-up window. Step 4: Get Tableau metadata (TCM) To create the SAML connection between TCM and your IdP, you need to exchange required metadata between the two services. To get metadata from TCM, choose one of the following methods. See the IdP’s SAML configuration documentation to confirm the correct option. - Select Export Metadata button to download an XML file that contains the Tableau Cloud SAML entity ID, Assertion Consumer Service (ACS) URL, and X.509 certificate. - Select Download Certificate if your IdP expects the required information in a different way. For example, if it wants you to enter the Tableau Cloud entity ID, ACS URL, and X.509 certificate in separate locations. Step 5: Get Tableau metadata (Tableau Cloud) To create the SAML connection between Tableau Cloud and your IdP, you need to exchange required metadata between the two services. To get metadata from Tableau Cloud, choose one of the following methods. See the IdP’s SAML configuration documentation to confirm the correct option. - Select Export Metadata button to download an XML file that contains the Tableau Cloud SAML entity ID, Assertion Consumer Service (ACS) URL, and X.509 certificate. - Select Download Certificate if your IdP expects the required information in a different way. For example, if it wants you to enter the Tableau Cloud entity ID, ACS URL, and X.509 certificate in separate locations. ![Guidelines for exporting or copying metadata from Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/saml_site_auth_step1_online.png) Step 5: Configure IdP (TCM) For step 5, use the instructions provided by the IdP’s documentation to submit the TCM metadata. Step 6: Configure IdP (Tableau Cloud) For step 6, use the instructions provided by the IdP’s documentation to submit the Tableau Cloud metadata. Step 6: Test configuration and troubleshoot SAML (TCM) We highly recommend that you test the SAML configuration to avoid any locked out scenarios. Testing the configuration helps ensure that you have configured SAML correctly before changing the authentication type of your users to SAML. To test the configuration successfully, make sure that there is at least one user who you can sign in as who is already provisioned in the IdP and added to your Tableau Cloud or TCM with SAML authentication type configured. If you can't successfully sign in to TCM, start with the troubleshooting steps suggested on the Authentication page. If those steps do not resolve the issue, see [Troubleshoot SAML](https://help.tableau.com/v0.0/online/en-us/saml_trouble.htm). Step 7: Test configuration and troubleshoot SAML (Tableau Cloud) We highly recommend that you test the SAML configuration to avoid any locked out scenarios. Testing the configuration helps ensure that you have configured SAML correctly before changing the authentication type of your users to SAML. To test the configuration successfully, make sure that there is at least one user who you can sign in as who is already provisioned in the IdP and added to your Tableau Cloud or TCM with SAML authentication type configured. If you can't successfully sign in to Tableau Cloud, start with the troubleshooting steps suggested on the New Configuration page. If those steps do not resolve the issue, see [Troubleshoot SAML](https://help.tableau.com/v0.0/online/en-us/saml_trouble.htm). Manage users Select existing Tableau Cloud or TCM users, or add new users you want to approve for single sign-on. When you add or import users, you also specify their authentication type. On the Users page, you can change users’ authentication type any time after adding them. For more information, see one of the following: - [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) or [Import Users](https://help.tableau.com/v0.0/online/en-us/users_import.htm) topic for Tableau Cloud - [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) topic for TCM Default authentication type for embedded views **Note:** Applies to Tableau Cloud only. - Let users to choose their authentication type When this option is selected, only a pop-up window will be supported. In this pop-up window, two sign-in options appear where a view is embedded: a sign-in button that uses single sign-on (SSO) authentication and a link to use Tableau credentials as the alternative. **Tip:** With this option, users need to know which sign-in option to choose. As part of notification you send your users after you add them to the single sign-on site, let them know which type of authentication to use for a variety of sign-in scenarios. For example, embedded views, Tableau Desktop, Tableau Bridge, Tableau Mobile, and so on. - Tableau with MFA This option requires users to sign in using Tableau credentials with multi-factor authentication even if SAML is enabled on the site. Signing in with Tableau with MFA requires users to set a verification method to confirm the identity each time the user signs in to Tableau Cloud. For more information, see [Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_security_mfa.htm). - List of authentication configurations When a specific configuration option is selected, the way users can sign in to embedded views is determined by the setting you configured in step 6 above for the named configuration. ## Use Tableau authentication If a site or tenant is configured for SAML, you can change the settings to require some or all users to sign in using Tableau credentials. - If you no longer want an identity provider to handle authentication , or require all users to sign in with their Tableau credentials, you can change authentication type at the site or tenant level. See [Change the site’s authentication type](#auth_type_site) section, below. - If you want to keep SAML enabled for some users, but require others to use Tableau, you can change authentication type at the user level. For more information, see [Set the User Authentication Type](https://help.tableau.com/v0.0/online/en-us/users_set_auth_type.htm). ### Change the site’s authentication type **For Tableau Cloud** Beginning in January 2025 (Tableau 2024.3), you can enable multiple authentication types and methods on a site. To change what authentication you want available on the site, enable or disable the authentication configurations. 1. Sign in to the Tableau Cloud site as a site administrator. 2. Select Settings > Authentication. 3. Disable or enable authentication configurations for the site by clicking the Actions menu and selecting Disable or Enable. After you make the SAML configuration inactive, the metadata and IdP information are preserved so that if you want to enable it again, you do not need to set up the SAML connection with the IdP again. **For TCM** 1. Sign in to the TCM as a cloud administrator. 2. Select Settings > Authentication. 3. Remove the selection from the Enable an additional authentication method check box. ## Update SAML certificate The certificate used for Tableau site metadata is provided by Tableau and not configurable. To update the certificate for SAML, you must upload a new certificate to your IdP and re-exchange the metadata with Tableau Cloud. **For Tableau Cloud** 1. Sign in to the site as a site administrator, and select Settings > Authentication. 2. Under Authentication types, go to the SAML configuration you want to update, and click the Actions menu and select Edit. 3. Open a new tab or window, and sign in to your IdP account. 4. Use the instructions provided by the IdP’s documentation to upload a new SAML certificate. 5. Download the new XML metadata file to provide to Tableau Cloud. 6. Return to the Edit Configuration page in Tableau Cloud, and in step 2, upload the metadata file that you downloaded from the IdP. 7. Scroll down the page and click the Save and Continue button. **For TCM** 1. Sign in to the TCM as a cloud administrator, and select Settings > Authentication. 2. From the Authentication drop-down, select SAML > Configuration (required). 3. Open a new tab or window, and sign in to your IdP account. 4. Use the instructions provided by the IdP’s documentation to upload a new SAML certificate. 5. Download the new XML metadata file to provide to TCM. 6. Return to the Authentication page in TCM, and in step 2, upload the metadata file that you downloaded from the IdP. 7. Scroll down the page and click the Save and Continue button. ## Customize and control data access using user attributes User attributes are user metadata defined by your organization. User attributes can be used to determine access in a typical attribute-based access control (ABAC) authorization model. User attributes can be any aspect of the user profile, including job roles, departmental membership, management level, etc. They might also be associated with run-time user contexts like where the user is signed in or their language preference. By including user attributes in your workflow, you can control and customize the user experience through data access and personalization. - **Data access**: User attributes can be used to enforce data security policies. This ensures that users only see the information they are authorized to see. - **Personalization**: By passing user attributes like location and role, your content can be customized to display only the information relevant to the user accessing it, making it easier for them to find the information they need. **Summary of steps to pass user attributes** The process of enabling user attributes in a workflow is summarized in the following steps: 1. Enable the user attributes setting 2. Include user attributes in the assertion 3. Ensure the content author includes user attribute functions and relevant filters 4. Review the content ### Step 1: Enable the user attributes setting For security purposes, user attributes are only validated in an authentication workflow when the user attribute setting is enabled by a site admin. 1. Sign in to Tableau Cloud and click Settings > Authentication. 2. Under Control User Access in Authentication Workflows heading, select the Enable capture of user attributes in authentication workflows checkbox. For more information about site settings, see [Control User Access in Authentication Workflows](https://help.tableau.com/v0.0/online/en-us/sites_add.htm#user-attributes). ### Step 2: Include user attribute in the assertion Make sure the assertion contains the user attributes. **Note:** Attributes in the SAML response are subject to 4096 character limit, with the exception of `scope` or `scp` attributes. If the attributes in the response, including user attributes, exceed this limit, Tableau removes the attributes and passes the `ExtraAttributesRemoved` attribute instead. The content author can then create a calculation with the `ExtraAttributesRemoved` attribute to determine how to display the content to users when the attribute has been detected. **Example** Suppose you have an employee, Fred Suzuki, who is a manager located in the South region. You want to ensure that, when Fred reviews reports, he is only able to see data for the South region. In a scenario like this, you might include the Region user attribute in the SAML response like in the example below. https://myidp.okta.com/saml South ### Step 3: Ensure the content author includes attribute functions Ensure the content author includes the user attribute functions and related filters to control what data can display in their content. To ensure the user attribute assertions are passed to Tableau, the content must contain one of the following user attribute functions: - `USERATTRIBUTE('attribute_name')` - `USERATTRIBUTEINCLUDES('attribute_name', 'expected_value')` The function that the content author uses depends on whether the user attributes are expected to return a single value or multiple values. For more information about these functions and examples of each, see [User Functions](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_user.htm#user_attributes) in the Tableau Help. **Notes:** - Preview of the content with these functions are not available when authoring in Tableau Desktop or in Tableau Cloud. The function will return NULL or FALSE. To ensure the user functions work as expected, we recommend the author review the functions after making the content available. - To ensure content renders as expected, the content author might consider including a calculation that uses the `ExtraAttributesRemoved` that 1) checks for this attribute and 2) determines what to do with the content if it does, such as show a message. Tableau will only add the `ExtraAttributesRemoved` attribute and removes all other attributes (except `scp` or `scope`) when the attributes in the SAML XML exceed 4096 characters. This is to ensure optimal performance and to respect storage limitations. **Example** Continuing the example introduced in [Step 2: Include user attribute in the assertion](#step_pass_user_attribute) above, to pass the “Region” user attribute assertion to a workbook, the author can include `USERATTRIBUTEINCLUDES`. For example, `USERATTRIBUTEINCLUDES('Region', [Region])`, where ‘Region’ is the user attribute and \[Region\] is a column in the data. Using the new calculation, the author can create a table with Manager and Sales data. When the calculation is added, the workbook returns “False” values as expected. ![](/tableau/next/en-us/online/en-us/Img/uaf_calc_view.png) To show only the data associated with the South region in the embedded workbook, the author can create a filter and customize it to show values when the South region is “True.” When the filter is applied, the workbook becomes blank as expected because the function is returning “False” values and the filter is customized to show “True” values only. ![](/tableau/next/en-us/online/en-us/Img/uaf_filter_view.png) ### Step 4: Review the content Review and validate the content. **Example** To conclude the example from [Step 3: Ensure the content author includes attribute functions](#step_include_uaf) above, you can see the Sales data in the view is customized to Fred Suzuki because his user context is the South region. ![](/tableau/next/en-us/online/en-us/Img/uaf_embedded_view_south.png) Managers from the regions represented in the workbook should see the value associated with their region. For example, Sawdie Pawthorne from the West region sees data specific to her region. ![](/tableau/next/en-us/online/en-us/Img/uaf_embedded_view_west.png) Managers whose regions are not represented in the workbook see a blank workbook. ### Known issues and limitations There are a few known issues and limitations you should consider when working with user attribute functions. #### Blank images using the Tableau REST API Tableau REST API requests [Query Preview Image](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_workbooks_and_views.htm#query_view_with_preview), [Query Workbook Image](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_workbooks_and_views.htm#query_workbook_preview_image), and [Get Custom View Image](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_workbooks_and_views.htm#get_custom_view_image) produce blank images. #### Limitations - User attribute functions in published data sources (.pds) are not supported. - User attribute functions in Tableau Bridge workflows are not supported. ## See also [Access Sites from Connected Clients](https://help.tableau.com/v0.0/online/en-us/to_connected_clients.htm) [Skip to main content](#main-content) # Enable Support Access Tableau Cloud administrators can allow approved Tableau Support technicians to access their Tableau Cloud site to help troubleshoot a customer support case. By default, this feature is disabled for all sites. Enable the feature to allow support access. 1. In a web browser, sign in to Tableau Cloud as a site administrator and go to the site in which you want to enable support access. 2. From the navigation panel, click Settings. 3. Under Tableau Support Access, select **Let Tableau Support access your site**. 4. Click Save. When enabled, Tableau Support technicians are assigned the **Support User** role and granted administrator-level access to your site and its content. Tableau Support technicians use this access to gather information to diagnose and reproduce issues. Tableau Support technicians do not make changes to your site unless you authorize them to do so. Only Tableau Support technicians can be assigned the Support User role. You cannot add this role to new or existing site users. Users assigned the Support User role do not count against the site's user limit. To view users who have the Support User role on the site, click the **Users** tab. ## Disable Support Access When you disable support access, users with the Support User role who are signed on to the site are automatically signed out. If you do not disable support access, any users with the Support User role are required to delete themselves before a maximum of 16 days elapse. Any content owned by the Support User will be reassigned to the longest-tenured site administrator. [Skip to main content](#main-content) # Enable Tableau Catalog [Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_overview.htm) discovers and indexes all of the content on your Tableau Cloud site or Tableau Server, including workbooks, data sources, sheets, metrics, and flows. (The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm).) Indexing is used to gather information about the content, or metadata, about the schema and lineage of the content. Then from the metadata, Catalog identifies all of the databases, files, and tables used by the content on your Tableau Cloud site or Tableau Server. Catalog is available with the Data Management license. For more information, see [About Data Management](https://help.tableau.com/v0.0/online/en-us/dm_overview.htm). In addition to Catalog, metadata about your content can also be accessed from both the [Tableau Metadata API](https://help.tableau.com/current/api/metadata_api/en-us/index.html) and the Tableau REST API using [Metadata Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_metadata.htm). ## Catalog on Tableau Cloud Catalog is automatically enabled if your Tableau Cloud site has Data Management. If you have Tableau Cloud Standard and upgrade to an edition that includes Data Management, a site admin must turn on Catalog once: 1. Sign in to Tableau Cloud using your admin credentials. 2. From the left navigation pane, click Settings. 3. On the General tab, under Tableau Catalog, select the Turn on Tableau Catalog check box. When your Tableau Cloud site has Data Management, the content that exists on your Tableau Cloud site is indexed. The time it takes to index the content depends on the amount of content you have. After the content is initially indexed, Catalog monitors newly published content and other changes to assets and continues to index in the background. If your site is downgraded to Standard, Catalog is turned off. ## Troubleshoot Catalog You or your users might encounter one of the following issues when using Catalog. #### Timeout limit and node limit exceeded messages To ensure that Catalog tasks that have to return a large number of results don’t take up all system resources, Catalog implements both timeout and node limits. - **Timeout limit** When tasks in Catalog reach the timeout limit, you and your users see the following message: “_Showing partial results, Request time limit exceeded. Try again later._” or TIME\_LIMIT\_EXCEEDED - **Node limit** When tasks in Catalog reach the node limit, you and your users see the following message: NODE\_LIMIT\_EXCEEDED [Skip to main content](#main-content) # Enable Tableau Prep Conductor on your Tableau Cloud Site Prep Conductor is automatically enabled on your Tableau Cloud site after you purchase Data Management. For information on how to purchase Data Management, contact your account manager. ## Verify Tableau Prep Conductor is enabled 1. From Tableau Prep Builder, sign in to Tableau Cloud by selecting **Server** >**Sign In**. If your site is set up to use Tableau authentication, enter your user name (email address) and password you use for Tableau Cloud, and then click Sign In. If multi-factor authentication (MFA) is enabled with Tableau authentication, you are prompted to verify your identity using the verification you selected during the MFA registration process. If you are signing in to Tableau Cloud or registering for MFA for the first time, see [Register for multi-factor authentication](https://help.tableau.com/v0.0/online/en-us/to_signin.htm#mfa_register_user). After verifying your identity, you are redirected to your site. 2. Open any of your flows. 3. Verify if there is a **Scheduled Tasks** tab. If the tab is there, then Prep Conductor is enabled. [Skip to main content](#main-content) # Entity Snapshots Reference This topic describes the entity snapshot tables and fields available through the Tableau Cloud Manager REST API. For more information about entity snapshots, see [Use Entity Snapshots](https://help.tableau.com/v0.0/online/en-us/activity_log_entity_snapshots.htm) and [Platform Data](https://help.tableau.com/current/api/cloud-manager/en-us/docs/platform_data.html). ## Entity snapshot tables Use the alphabetically sorted list of entity tables on the right, or **ctrl/cmd-f** to go directly to keywords you have in mind. **Note:** Timestamps are recorded in ISO 8601 UTC. ## capabilities The `capabilities` entity type contains information about the capabilities that can be granted or denied by permissions.

Field Name	Type	Description
description	string	A description of what the capability allows a user to do.
display_name	string	The name of the capability as it appears to users.
display_order	integer	The order in which capabilities are listed in the interface.
id	integer	The unique identifier for the record.
name	string	The name or ID used to refer to the capability in code.
site_luid	string	The LUID of the site.

## data\_connections The `data_connections` entity type contains information about the connections used by workbooks and data sources.

Field Name	Type	Description
authentication	string	The authentication method used for the data connection.
caption	string	The name of the connection as it appears in the Data pane.
cloud_file_request_url	string	The request URL for a cloud file associated with the data connection. This value can be null.
created_at	timestamp	The date and time this record was created.
datasource_id	integer	The ID of the data source that owns this data connection.
db_subclass	string	A subclass of the database class. For example, if the database class is web-data-direct, the subclass is intuit-quickbook.
dbclass	string	The type of data connection, such as MySQL, PostgreSQL, or SQL proxy.
dbname	string	The name of the database for this connection.
has_extract	boolean	Indicates whether the data connection is an extract.
id	integer	The unique identifier for the record.
keychain	string	An encoded string in YAML format.
luid	uuid	The unique identifier used to identify the connection in the Tableau REST API. Tableau automatically generates this value.
name	string	The unique name for the data connection.
owner_id	integer	The ID of the workbook or data source that created the data connection.
owner_type	string	The type of content that created the data connection. Either workbook or data source.
password	boolean	Indicates whether the password is embedded in the owner.
port	integer	The port number for the connection.
query_tagging_enabled	boolean	Indicates whether queries for this data connection are tagged with information about their origin in Tableau.
server	string	The name of the server for the connection.
site_id	integer	The ID of the site where the data connection is located.
site_luid	string	The LUID of the site.
state	string	The publication state. Either active or archived.
tablename	string	The name of the database table for the connection.
updated_at	timestamp	The date and time the record was last updated.
username	string	The user name used for the connection.
using_remote_query_agent	boolean	Indicates whether the data connection uses Tableau Bridge.

## datasources The `datasources` entity type contains information about published data sources.

Field Name	Type	Description
certification_note	string	The explanation for the certification status.
certifier_details	string	A snapshot of the certifier information.
certifier_user_id	integer	The ID of the user who certified the data source. This value is null if the data source isn't certified.
connectable	boolean	Indicates whether the data source supports connections through Data Server.
content_version	integer	The version number of the data source updated with each publication.
created_at	timestamp	The date and time this record was created.
data_engine_extracts	boolean	Indicates whether the data is provided as a Tableau data extract.
db_class	string	The type of data connection, such as Excel or Oracle.
db_name	string	The name of the database or the file path for the data source.
description	string	A description of the data source.
document_version	string	The internal version of the .tds file for this record.
extracts_incremented_at	timestamp	The date and time of the last incremental extract refresh.
extracts_refreshed_at	timestamp	The date and time of the last full extract refresh.
first_published_at	timestamp	The date and time the data source was first published.
hidden_name	string	The auto-generated name for the data source extracted from the file.
id	integer	The unique identifier for the record.
incrementable_extracts	boolean	Indicates whether incremental extracts are allowed for the published data source.
is_certified	boolean	Indicates whether the data source is certified.
is_hierarchical	boolean	If true, the source is a hierarchical (cube) database.
last_published_at	timestamp	The date and time the data source was last published.
luid	string	The unique identifier for the data source.
modified_by_user_id	integer	The ID of the user who last modified and published the data source. For older records, this value is the same as owner_id.
name	string	The name of the published data source.
owner_id	integer	The user ID of the owner or uploader of the data source.
parent_type	string	The parent type of the data source. Either datarole, workbook, or null.
parent_workbook_id	integer	The ID of the workbook that contains this data source. This is null for published data sources.
refreshable_extracts	boolean	Indicates whether refreshable extracts are available for the published data source.
remote_query_agent_id	integer	The ID of the agent used for remote queries.
repository_url	string	A unique name for the data source used in URLs.
revision	string	The version number of the data source, which increments each time it is published.
site_id	integer	The ID of the site associated with the data source.
site_luid	string	The LUID of the site.
size	long	The size of the data source in bytes.
state	string	The publication state. Either active or archived.
table_name	string	The name of the table or worksheet associated with the published data source.
updated_at	timestamp	The date and time the record was last updated.
using_remote_query_agent	boolean	Indicates whether queries to this data source use a remote agent.

## flows The `flows` entity type contains information about published flows.

Field Name	Type	Description
content_version	integer	The version number of the flow updated with each publication.
created_at	timestamp	The date and time this record was created.
data_engine_extracts	boolean	Indicates whether the data is provided as a Tableau data extract.
description	string	The description of the flow.
document_version	string	The internal version of the .tfl file for this record.
file_type	string	The file type. Either .tfl or .tflx.
hidden	boolean	Indicates whether the flow is hidden from the content management system.
id	integer	The unique identifier for the flow.
is_deleted	boolean	Indicates whether the flow is in the Recycle Bin. Deleted flows aren't visible to active jobs or user requests until restored.
kind	string	The type of flow.
last_published_at	timestamp	The date and time the flow was last published.
luid	uuid	The unique identifier for the flow.
name	string	The name of the published flow.
owner_id	integer	The user ID of the owner or publisher of the flow.
project_id	integer	The ID of the project associated with the flow.
site_id	integer	The ID of the site associated with the flow.
site_luid	string	The LUID of the site.
size	long	The size of the flow file in bytes.
state	string	The state of the flow. Either active or archived. The default is active.
updated_at	timestamp	The date and time the record was last updated.

## group\_users The `group_users` entity type contains information about the users assigned to groups.

Field Name	Type	Description
group_id	integer	The ID of the group.
id	integer	The unique identifier for the record.
site_id	integer	The ID of the site for the group users.
site_luid	string	The LUID of the site.
user_id	integer	The ID of the user.

## groups The `groups` entity type contains information about user groups.

Field Name	Type	Description
created_at	timestamp	The date and time this record was created.
domain_id	integer	The ID of the domain associated with the group.
external_user_enabled	boolean	Indicates whether external users can be added to the group.
grant_license_mode	string	Indicates when to grant a license to group members. Either ON_SYNC or ON_LOGIN.
id	integer	The unique identifier for the record.
last_synchronized	timestamp	The date and time the Active Directory group was last synchronized.
luid	uuid	An identifier that is unique when combined with the site ID.
minimum_site_role	string	The minimum site role assigned to members of the Active Directory group.
minimum_site_role_id	integer	The ID of the minimum site role for the group.
name	string	The name of the group.
owner_id	integer	The ID of the user who owns the group.
site_id	integer	The ID of the site the group belongs to.
site_luid	string	The LUID of the site.
system	boolean	Indicates whether the group was created by Tableau or a user.
updated_at	timestamp	The date and time the record was last updated.

## next\_gen\_permissions The `next_gen_permissions` entity type contains information about permissions assigned to users, groups, and groupsets.

Field Name	Type	Description
authorizable_id	integer	The ID of the content for which permissions are specified.
authorizable_type	string	The type of content for which permissions are specified. Either Project, Workbook, DataSource, View, or NamedResource.
capability_id	integer	The ID of the capability being granted or denied.
grantee_id	integer	The ID of the user, group, or groupset being granted permissions.
grantee_type	string	The type of grantee. Either User, Group, or GroupAND.
id	integer	The unique identifier for the record.
permission	integer	The permission level indicating whether the capability is granted or denied to a user or group. The value 1 = grant to group, 2 = deny to group, 3 = grant to user, and 4 = deny to user. Higher values take precedence. For example, a user-specific grant can override a group-level deny.
site_id	integer	The ID of the site where the permissions belong.
site_luid	string	The LUID of the site.

## projects The `projects` entity type contains information about projects used to organize content.

Field Name	Type	Description
admin_insights_enabled	boolean	Indicates whether the project is an Admin Insights project.
controlled_permissions_enabled	boolean	Indicates whether permissions are controlled at the project level.
controlling_permissions_project_id	integer	The ID of the ancestor project that controls permissions for this project.
created_at	timestamp	The date and time this record was created.
description	string	A description of the project.
id	integer	The unique identifier for the record.
luid	uuid	The unique identifier for the record.
name	string	The name of the project.
nested_projects_permissions_included	boolean	Indicates whether permissions for nested projects are controlled at the project level.
owner_id	integer	The ID of the user who owns the project.
parent_project_id	integer	The ID of the parent project. This is null for top-level projects.
site_id	integer	The ID of the site that contains the project.
site_luid	string	The LUID of the site.
special	integer	Indicates whether this is a system-created project, such as the Default project. The value is 1 for system-created projects, otherwise, the value is null.
state	string	The state of the project. Either active or inactive.
updated_at	timestamp	The date and time the record was last updated.

## projects\_contents The `projects_contents` entity type contains information about content stored in projects.

Field Name	Type	Description
content_id	integer	The ID of the content stored in the project, denoted by project_id. Use with content_type to uniquely identify the content.
content_type	string	The type of content in the project. Use with content_id to uniquely identify the content.
id	integer	The unique identifier for the record.
project_id	integer	The ID of the project associated with the record.
site_id	integer	The ID of the site associated with the record.
site_luid	string	The LUID of the site.

## published\_connection\_revision\_tables The `published_connection_revision_tables` entity type contains information about tables associated with published connection revisions.

Field Name	Type	Description
created_at	timestamp without time zone	The date and time this record was created.
id	integer	The unique identifier for the record.
published_connection_table_luid	uuid	The ID of the associated published connection table.
revisable_properties	jsonb	Properties that users can revise.
revision_id	integer	The ID of the associated revision.
site_id	integer	The ID of the associated site.
site_luid	string	The LUID of the site.
system_properties	jsonb	System metadata.
updated_at	timestamp without time zone	The date and time the record was last updated.

## published\_connection\_revisions The `published_connection_revisions` entity type contains information about revisions of published connections.

Field Name	Type	Description
created_at	timestamp without time zone	The date and time this record was created.
id	integer	The unique identifier for the record.
luid	uuid	The unique identifier for the revision within a site.
owner_id	integer	The ID of the user who owns the revision.
published_at	timestamp without time zone	The date and time this revision was published.
published_connection_id	integer	The ID of the associated published connection.
revisable_properties	jsonb	Properties that users can revise.
revisable_properties_updated_at	timestamp without time zone	The date and time the revisable properties were last updated.
revisable_properties_version	integer	A number that increments each time revisable properties are updated.
revision_type	integer	The type of revision. The value 0 = draft, 1 = active, 2 = historical.
site_id	integer	The ID of the associated site.
site_luid	string	The LUID of the site.
system_properties	jsonb	System metadata.
updated_at	timestamp without time zone	The date and time the record was last updated.
version_number	integer	The incrementing version number for the revision.

## published\_connection\_tables The `published_connection_tables` entity type contains information about tables associated with published connections.

Field Name	Type	Description
created_at	timestamp without time zone	The date and time this record was created.
description	string	The description of the published connection table.
id	integer	The unique identifier for the record.
luid	uuid	The unique identifier for the table within a site.
name	string	The name of the published connection table.
published_connection_id	integer	The ID of the associated published connection.
site_id	integer	The ID of the associated site.
site_luid	string	The LUID of the site.
updated_at	timestamp without time zone	The date and time the record was last updated.

## published\_connections The `published_connections` entity type contains information about published connections.

Field Name	Type	Description
activated	boolean	Indicates whether the published connection was made available for use.
created_at	timestamp	The date and time this record was created.
description	string	The description of the published connection.
id	integer	The unique identifier for the record.
luid	uuid	The unique identifier for the connection within a site.
name	string	The name of the published connection.
owner_id	integer	The ID of the user who owns the connection.
project_id	integer	The ID of the associated project.
site_id	integer	The ID of the associated site.
site_luid	string	The LUID of the site.
updated_at	timestamp	The date and time the record was last updated.

## schedules The `schedules` entity type contains information about schedules used to run tasks.

Field Name	Type	Description
actionable	boolean	Indicates whether the schedule is actionable.
active	boolean	Indicates whether the schedule is active. If false, no tasks run when the schedule triggers.
created_at	timestamp without time zone	The date and time this record was created.
day_of_month_mask	integer	An encoded value that indicates the days of the month the schedule runs. Convert the value to binary to interpret it, where each binary position represents a day of the month. The value 1 = 1st, 10 = 2nd, 100 = 3rd, and so on.
day_of_week_mask	integer	An encoded value that indicates the days of the week the schedule runs. Convert the value to binary to interpret it, where each binary position represents a day of the week. The value 1 = Sunday, 10 = Monday, 100 = Tuesday, 1000 = Wednesday, 10000 = Thursday, 100000 = Friday, 1000000 = Saturday.
defined_by	integer	The type of mechanism that created the schedule, such as 0 for system administrator and 1 for self-service.
end_at_minute	integer	The minute the schedule stops triggering within its frequency period.
end_schedule_at	timestamp without time zone	The date and time after which the schedule no longer triggers.
hidden	boolean	Indicates whether the schedule is visible in the interface.
id	integer	The unique identifier for the record.
linked_task_enabled	boolean	Indicates whether users can create linked tasks on this schedule.
luid	uuid	The unique identifier for the schedule used in the REST API.
minute_interval	integer	The interval at which the schedule retriggers after starting. Defined by schedule_type, end_at_minute, or end_schedule_at.
name	string	The name of the schedule.
priority	integer	The priority of the schedule from 1 (highest) to 100 (lowest).
run_next_at	timestamp without time zone	The date and time the schedule will next trigger.
schedule_type	integer	The frequency of the schedule. The value 0 = Hourly, 1 = Daily, 2 = Weekly, and 3 = Monthly.
scheduled_action	integer	The type of task assigned to the schedule. The value 0 = Extracts, 1 = Subscriptions, 2 = Active Directory synchronization, 3 = Auto Refresh Extracts, and 4 = Flows.
serial_collection_id	integer	The ID used to prevent simultaneous processing of linked jobs. Jobs with the same serial_collection_id can't run at the same time.
site_luid	string	The LUID of the site.
start_at_minute	integer	The minute the schedule starts within its frequency period. For example, with a daily schedule, this is the number of minutes past midnight.
timezoneid	string	The IANA time zone for the schedule, such as America/Los_Angeles.
updated_at	timestamp without time zone	The date and time the record was last updated.

## subscriptions The `subscriptions` entity type contains information about subscriptions configured for users.

Field Name	Type	Description
attach_image	boolean	Indicates whether to attach images to the subscription email.
attach_pdf	boolean	Indicates whether to attach a PDF to the subscription email.
content_has_user_references	boolean	Indicates whether the subscription content includes user references. Null means the subscription hasn't run yet.
created_at	timestamp without time zone	The date and time this record was created.
creator_id	integer	The ID of the user who created the subscription.
data_condition_type	string	The type of data condition that triggers the subscription. The default is Always. Other values include DataPresent, Constant, Band, and more.
id	integer	The unique identifier for the record.
is_refresh_extract_triggered	boolean	Indicates whether the subscription is triggered by an extract refresh.
last_sent	timestamp without time zone	The date and time the subscription was last sent.
luid	uuid	The unique identifier for the subscription used in the REST API.
schedule_id	integer	The ID of the schedule that triggers the subscription.
site_id	integer	The ID of the site where the subscription is located.
site_luid	string	The LUID of the site.
subject	string	The subject line or description of the subscription.
subscription_message_id	integer	The ID for the subscription message.
target_id	integer	The ID of the content being subscribed to.
target_type	string	The type of content being subscribed to. Either View or Workbook.
user_id	integer	The ID of the user who receives the subscription.

## system\_users The `system_users` entity type contains information about system-level user accounts.

Field Name	Type	Description
admin_level	integer	Indicates whether the user is a system administrator. The value 10 = system administrator and 0 = not a system administrator.
created_at	timestamp without time zone	The date and time this record was created.
custom_display_name	boolean	Indicates whether to prevent the friendly name from being overwritten by Active Directory.
domain_id	integer	The ID of the domain for the user.
email	string	The user's email address.
failed_login_attempts	integer	The number of failed login attempts since the last successful login.
force_password_update	boolean	Indicates whether the user must reset their password at the next login.
friendly_name	string	The name used in the interface to refer to the user.
id	integer	The unique identifier for the record.
last_failed_login	timestamp without time zone	The date and time of the user's last unsuccessful login.
last_password_update	timestamp without time zone	The date and time the user last updated their password.
name	string	The user name.
site_luid	string	The LUID of the site.
updated_at	timestamp without time zone	The date and time the record was last updated.

## taggings The `taggings` entity type contains information about the relationship between tags and tagged content.

Field Name	Type	Description
id	integer	The unique identifier for the record.
site_id	integer	The ID of the site the tagging belongs to.
site_luid	string	The LUID of the site.
tag_id	integer	The ID of the tag.
taggable_id	integer	The ID of the tagged item.
taggable_type	string	The type of item being tagged. This value identifies which table to join to.
user_id	integer	The ID of the user who owns the tag.

## tags The `tags` entity type contains information about tags used to label content.

Field Name	Type	Description
created_at	timestamp without time zone	The date and time this record was created.
id	integer	The unique identifier for the record.
name	string	The name of the tag.
site_id	integer	The ID of the site the tag belongs to.
site_luid	string	The LUID of the site.
updated_at	timestamp without time zone	The date and time the record was last updated.

## tasks The `tasks` entity type contains information about scheduled tasks.

Field Name	Type	Description
active	boolean	Indicates whether the task is active. If false, the task doesn't run when the schedule triggers.
args	string	Task parameters formatted as YAML.
consecutive_failure_count	integer	The number of times this task has failed.
created_at	timestamp without time zone	The date and time this record was created.
creator_id	integer	The ID of the user who created the task.
historical_queue_time	integer	The historical queue time of the task in seconds.
historical_run_time	integer	The historical run time of the task in seconds.
id	integer	The unique identifier for the task.
last_success_completed_at	timestamp without time zone	The date and time the task last completed successfully.
luid	uuid	The unique identifier for the task used in the REST API.
obj_id	integer	The ID of the workbook or data source associated with the task.
obj_type	string	The type of object associated with the task. Either Workbook or Data Source. Use with obj_id to uniquely identify the object.
priority	integer	The priority of the task where 0 is the highest priority and 10 is the default.
run_count	integer	The number of times this task has run since this field was added. This value might not be accurate for tasks created before the field existed.
schedule_id	integer	The ID of the schedule linked to the task. When the schedule's run_next_at time arrives, linked tasks run.
site_id	integer	The ID of the site associated with the task. Used for site-specific tasks.
site_luid	string	The LUID of the site.
state	integer	The current state of the task. The value 0 = active, 1 = suspended, and 2 = disabled.
subtitle	string	Additional information about the task.
title	string	Additional information about the task.
type	string	The type of task.
updated_at	timestamp without time zone	The date and time the record was last updated.

## users The `users` entity type contains information about site users.

Field Name	Type	Description
created_at	timestamp without time zone	The date and time this record was created.
id	integer	The unique identifier for the record.
login_at	timestamp without time zone	The date and time of the user's most recent login.
luid	uuid	The unique identifier for the record.
site_id	integer	The ID of the site the user belongs to.
site_luid	string	The LUID of the site.
site_role_id	integer	The ID of the site role for the user. The value 0 = SiteAdministrator, 1 = SupportUser, 2 = Publisher, 3 = Interactor, 4 = ViewerWithPublish, 5 = Viewer, 6 = UnlicensedWithPublish, 7 = Guest, 8 = Unlicensed, and 9 = BasicUser.
system_admin_auto	boolean	Indicates whether the user is a system administrator not explicitly assigned to the site.
system_user_id	integer	The ID of the system user associated with this user.
updated_at	timestamp without time zone	The date and time the record was last updated.

## views The `views` entity type contains information about views in workbooks.

Field Name	Type	Description
caption	string	The description of the worksheet based on the workbook definition.
created_at	timestamp without time zone	The date and time this record was created.
description	string	The description of the view.
fields	string	The fields extracted from the workbook's .twb file.
first_published_at	timestamp without time zone	The date and time the view was first published. This value doesn't change if the workbook containing the view is republished.
id	integer	The unique identifier for the record.
index	integer	The index number of the view within its workbook.
is_deleted	boolean	Indicates whether the view is in the Recycle Bin.
luid	uuid	The unique identifier for the record.
name	string	The name of the view.
owner_id	integer	The ID of the user who owns the view.
repository_url	string	A unique name for the view used in URLs.
revision	string	The version number of the view. The value starts at 1.0 and increments by 0.1 with each republication
sheet_id	string	The identifier for the sheet.
sheettype	string	The type of sheet. Either story, dashboard, or view.
site_id	integer	The ID of the site the view belongs to.
site_luid	string	The LUID of the site.
state	string	The state of the view. Either active or disabled.
title	string	The title of the worksheet extracted from the workbook's .twb file.
updated_at	timestamp without time zone	The date and time the record was last updated.
workbook_id	integer	The ID of the workbook that contains the view.

## workbooks The `workbooks` entity type contains information about published workbooks.

Field Name	Type	Description
content_version	integer	The version number of the workbook updated with each publication.
created_at	timestamp	The date and time this record was created.
data_engine_extracts	boolean	Indicates whether the workbook has associated data engine extracts.
default_view_index	integer	Indicates which view is shown by default.
display_tabs	boolean	If true, sheets appear as tabs in the workbook.
document_version	string	The version of the document description used when the workbook was saved.
first_published_at	timestamp	The date and time the workbook was first published. This value doesn't change when the workbook is republished.
id	integer	The unique identifier for the record.
incrementable_extracts	boolean	Indicates whether incremental extract refreshes are possible for this workbook.
is_deleted	boolean	Indicates whether the workbook is in the Recycle Bin. Deleted workbooks aren't visible to active jobs or user requests until restored.
last_published_at	timestamp	The date and time the workbook was last published.
luid	uuid	The unique identifier for the record.
modified_by_user_id	integer	The ID of the user who last modified and published the workbook. For older records, this value is the same as owner_id.
name	string	The name of the workbook.
owner_id	integer	The ID of the user who owns this workbook.
published_all_sheets	boolean	Indicates whether all sheets in the workbook were published.
refreshable_extracts	boolean	Indicates whether extracts in the workbook can be refreshed.
repository_url	string	A unique name for the workbook used in URLs.
revision	string	The version number of the workbook. The value starts at 1.0 and increments by 0.1 with each republication
site_id	integer	The ID of the site where the workbook was published.
site_luid	string	The LUID of the site.
size	bigint	The size of the workbook in bytes.
thumb_user	integer	The ID of the user used to generate the thumbnail image. This value is null unless specified.
updated_at	timestamp	The date and time the record was last updated.
view_count	integer	The total number of views associated with the workbook.

[Skip to main content](#main-content) # Example: Scripting Migration Plans **Note:** This topic includes a sample script you can use as the basis for scripting a multi-plan migration that satisfies your needs and environment. This script is intended to be used as a sample only, and not to be run as-is. For detailed instructions on using the console runner, see [Using the Tableau Content Migration Tool Console Runner](https://help.tableau.com/v0.0/online/en-us/cmt-deployment_console_runner.htm). Tableau Content Migration Tool command line utility for running migrations can be used to automate the running of a migration plan from an external scheduler (such as Windows Task Scheduler) or from a custom script. The console runner only runs one migration plan (stored in a .edt file) at a time. If you have a group of migration plans you want to run as a group, then you can use a custom script in combination with the Content Migration Tool console runner. The example below is written in PowerShell and uses the console runner to execute a list of migration plans as a group. The following example code demonstrates: - Running multiple migration plans as a group using the console runner. - Optionally halting deployment of the group of plans immediately when any single migration in the group fails. - Using the console runner's exit code to determine whether the migration failed or logged warnings. \# List of migration plans to execute as a group. $planFiles = @( 'customer 1.tcmx', 'customer 2.tcmx' ) # True of false whether to continue with the next plan if a migration fails. $continueOnFailure = $false # Path to the CMT console runner executable $runnerExe = 'C:\\Program Files (x86)\\Tableau\\Tableau Content Migration Tool\\tabcmt-runner.exe' # Store the exit code from the previously run migration plan. $lastResult = -1 # Loop through and run each migration plan one at a time. $planFiles | % { $file = $\_ if ($lastResult -ge 2 -and -not($continueOnFailure)) { Write-Warning "Skipping plan because previous migration failed. \`nSkipped plan: $file" return } Write-Verbose "Running migration plan: $file" & $runnerExe $file $lastResult = $LASTEXITCODE if ($lastResult -ge 2) { Write-Error "Migration failed. See output or log file for error details.\`nPlan: $file" -ErrorAction 'Continue' } elseif ($lastResult -eq 1) { Write-Warning "Migration completed with warnings. See output or log file for warning details.\`nPlan: $file" } } ## Who can do this To script migration plans, you must have all the following: - Administrator permissions on the Content Migration Tool machine. - Tableau site user account with an Explorer role or higher. - View and Download Workbook/Save a Copy permissions on the source site. - Publishing rights for the destination site. [Skip to main content](#main-content) # Explanation Types in Explain Data Each time you select a new mark in a viz or dashboard and run Explain Data, Tableau runs a new statistical analysis considering that mark and the underlying data in the workbook. Possible explanations are displayed in expandable sections for the Data Guide pane. For information about how Explain Data analyzes and evaluates explanations, see [How Explain Data Works](https://help.tableau.com/v0.0/online/en-us/explain_data_explained.htm). ## Explore underlying values This section lists explanations for each measure that can be explained (referred to as _target measures_). Each explanation listed here describes a relationship with the values of the target measure that are tested on the analyzed mark. Use your real-world, practical understanding of the data to determine if the relationships found by Explain Data are meaningful and worth exploring. ![Explain Data details about an analyzed mark, with text highlighted that describes a higher than expected trip distance sum value of 8,800.](/tableau/next/en-us/online/en-us/Img/explaindata_targetmeasure.png) In this example, Trip Distance is the target measure ### Underlying Characteristics These explanations describe how underlying records of the marks in the view may be contributing to the aggregated value of the measure being explained. Mark attributes can include [Extreme Values](#MA-Extreme), [Null Values](#MA-Null), [Number of Records](#MA-NR), or the [Average Value](#MA-AVG) of the mark. **Note**: For definitions of common terms used in explanations, see [Terms and concepts in explanations](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm#TermsToKnow "Link to definitions of Tableau terms and concepts used in explanations."). #### Extreme Values This explanation type indicates if one or more records have values that are significantly higher or lower than most records. If the explanation is supported by a model, it indicates the extreme value is affecting the target measure of the analyzed mark. When a mark has extreme values, it doesn't automatically mean it has outliers or that you should exclude those records from the view. That choice is up to you depending on your analysis. The explanation is simply pointing out an extreme value in the mark. For example, it could reveal a mistyped value in a record where a banana cost 10 dollars instead of 10 cents. Or, it could reveal that a particular sales person had a great quarter. **Note**: This explanation must be enabled by the author to be visible in viewing mode for a published workbook. For more information, see [Control Access to Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_control_access.htm).

This explanation shows:

The number of underlying records in the analyzed mark.
The extreme value or values contributing to the value of the target measure.
The distribution of values in the mark.
The record details that correspond to each distribution value.

Exploration options:

Hover over a circle in the chart to see its corresponding value.
Select the left or right arrow below the details list to scroll through record details.
If available, select View Full Data, and then select the Full Data tab to see all records in a table.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

If the number of records is low, examine these values compared to the extreme value.
If the extreme value is significantly higher or lower than the other record values, exclude it and consider how it changes the value of the analyzed mark.
When considering the data with and without the extreme value, use this as an opportunity to apply your practical knowledge about the data.

In this example, a single extreme value of 463 hours rented is contributing to the higher than expected sum of Total Time Rented of 613 hours.

A likely reason for this high value could be that someone forgot to dock the bike when they returned it. In this case, the author might want to exclude this value for future analysis.

Visualize the Difference

This section shows:

How the analyzed mark value changes when the extreme value is excluded.

Exploration options:

Select the Open icon to see a larger version of the visualization.
Explore the difference with and without the extreme value (or values).
Authors can open the view as a new sheet and apply a filter to exclude the extreme value.

Next steps for analysis:

If the extreme value is significantly higher or lower than the other record values, exclude it and see how it changes the value of the analyzed mark.
When considering the data with and without the extreme value, use this as an opportunity to apply your practical knowledge about the data.

Visualize the Difference header displays with a snapshot of a map, and explanatory text indicating that when the extreme value is excluded, the value changes from 619.3 to 155.5.

In this example, when the extreme value of 483 is excluded, the analyzed mark is no longer high compared to other marks in the view.

In this example, when the extreme value of 483 is excluded, the analyzed mark is no longer high compared to other marks in the view. Other marks now stand out. The author might want to explore the other marks to consider why these other locations have higher hours for bike rentals.

#### Null Values The Null Values explanation type calls out situations where there is a higher than expected amount of missing data in a mark. It indicates the fraction of target measure values that are null and how the null values might be contributing to the aggregate value of that measure.

This explanation shows:

The percent of values that are null in the target measure for the analyzed mark (blue circle).

Exploration options:

Hover over each circle in the scatter plot to see its details.
Scroll to see more of the chart.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Optionally exclude null values in the mark for further analysis.

A scatter plot with Explain Data text explaining that the percentage of null values may be contributing to the average value.

In this example, the percent of null values in the target measure is shown as a blue circle.

#### Number of Records This explanation type describes when the count of the underlying records is correlated to the sum. The analysis found a relationship between the number of records that are being aggregated in a mark and the mark's actual value. While this might seem obvious, this explanation type helps you explore whether the mark's value is being affected by the magnitude of the values in its records or simply because of the number of records in the analyzed mark.

This explanation shows:

The number of records in the target measure for the analyzed mark (dark blue bar).
The number of records in the target measure for other marks in the source visualization (light blue bar).

Exploration options:

Hover over each bar to see its details.
Scroll to see more of the chart.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Compare whether the individual values of records are low or high, or the number of records in the analyzed mark is low or high.
Authors, if you are surprised by a high number of records, you might need to normalize the data.

A scatter plot showing the relationship between the count and sum of trip distances, with Explain Data text explaining that the sum of trip distance may be high because of the high number of records in August.

In this example, the number of records for Trip Distance is listed for each value of Ride Month, which is a dimension in the original visualization. August has the highest total trip distance value.

You might explore whether August has the highest value for trip distance because more rides occurred in August, or if it has the highest trip distance because some rides were longer.

#### Average Value of Mark This explanation type describes when the average of a measure is correlated to the sum. Compare whether the average value is low or high, or the number of records is low or high.

This explanation shows:

The average of the target measure for each value of a dimension used in the source visualization.

Exploration options:

Hover over each bar to see its details.
Scroll to see more of the chart.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Compare whether the average value is low or high, or the number of records is low or high. For example, are profits high because you sold a lot of items or because you sold expensive items?
Try to figure out why the analyzed mark has a significantly higher or lower average value.

Average Trip Distance dimension selected with an explanation that the average trip distance is increasing the expected sum of trip distance for the explained mark.

In this example, the average trip distance for August is not significantly higher or lower than most months. This suggests that trip distance is higher for August because there were more rides in August, rather than from people taking longer rides.

### Contributing Single Value Use this explanation to understand the composition of the record values that make up the analyzed mark. This explanation type identifies when a single value in an unvisualized dimension may be contributing to the aggregate value of the analyzed mark. An unvisualized dimension is a dimension that exists in the data source, but isn't currently being used in the view. This explanation indicates when every underlying record of a dimension has the same value, or when a dimension value stands out because either many or few of the records have the same single value for the analyzed mark. **Note**: For definitions of common terms used in explanations, see [Terms and concepts in explanations](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm#TermsToKnow "Link to definitions of Tableau terms and concepts used in explanations.").

This explanation shows:

The percent of the number of records for a single value of a dimension for the analyzed mark (blue bar) versus all marks (gray bar) in the source visualization.
The percent of the number of records for all other values of a dimension for the analyzed mark (blue bar) versus all marks (gray bar) in the source visualization.
The average of the target measure for the single value of a dimension in the analyzed mark (blue bar) versus all marks (gray bar).
The average of the target measure for all other values of a dimension for the analyzed mark (blue bar) versus all marks (gray bar) in the source visualization.

Exploration options:

Hover over each bar to see its details.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Use this explanation to understand the composition of the record values that make up the analyzed mark.
Authors might want to create a new visualization to explore any unvisualized dimension surfaced in this explanation.

Explain Data details for a selected mark with bar charts showing records that impact the value.

In this example, the statistical analysis has exposed that many of the rides come from the station neighborhood of Back Bay. Note that Station Neighborhood is an unvisualized dimension that has some relationship to Trip Distance in the underlying data for the source visualization.

### Top Contributors Use this explanation to see the values that make up the largest fraction of the analyzed mark. For a COUNT aggregation, the top contributors show dimension values with the most records. For SUM, this explanation shows dimension values with the largest partial sum. ### Contributing Dimensions Use this explanation to understand the composition of the record values that make up the analyzed mark. This explanation type shows that the distribution of an unvisualized dimension may be contributing to the aggregate value of the analyzed mark. This type of explanation is used for target measure sums, counts, and averages. An unvisualized dimension is a dimension that exists in the data source, but isn't currently being used in the view. **Note**: For definitions of common terms used in explanations, see [Terms and concepts in explanations](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm#TermsToKnow "Link to definitions of Tableau terms and concepts used in explanations.").

This explanation shows:

The percent of the number of records for all values of a dimension for the analyzed mark (blue bar) versus all values of a dimension for all marks (gray bar) in the source visualization.
The average of the target measure for all values of a dimension for the analyzed mark (blue bar) all values of a dimension for all marks (gray bar).

Exploration options:

Hover over each bar to see its details.
Scroll to see more of the chart.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Use this explanation to understand the composition of the record values that make up the analyzed mark.
Authors might want to create a new visualization to explore any unvisualized dimensions surfaced in this explanation.

Explain Data details for a selected mark and its distribution.

In this example, the statistical analysis has exposed that more rides were taken from South Station and MIT and fewer rides were taken from Charles Circle and Kendall, compared to rides taken for marks overall.

Note that Station Name is an unvisualized dimension that has some relationship to Trip Distance in the underlying data for the source visualization.

### Contributing Measures This explanation type shows that the average of an unvisualized measure may be contributing to the aggregate value of the analyzed mark. An unvisualized measure is a measure that exists in the data source, but isn't currently being used in the view. This explanation can reveal a linear or quadratic relationship between the unvisualized measure and the target measure. **Note**: For definitions of common terms used in explanations, see [Terms and concepts in explanations](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm#TermsToKnow "Link to definitions of Tableau terms and concepts used in explanations.").

This explanation shows:

The relationship between the sum of the target measure and the average of an unvisualized measure for the analyzed mark (blue circle) and all marks (gray circles) in the view.
If the sum of the target measure is high or low because the average value of the unvisualized measure is high or low.

Exploration options:

Hover over each circle to see its details.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Authors might want to create a new visualization to explore any unvisualized measures surfaced in this explanation.

Explain Data details for a selected measure.

In this example, one possible reason why trip distance is high is because the average total time rented is also high.

## Other things to explore This section provides possible reasons why the analyzed mark is unique or unusual. These explanations: - Do not explain why the value of this mark is what it is. - Are not related in any way to the value of the measures in the source visualization. - Do not take any target measures into account. ### Other Dimensions of Interest Use this explanation to understand the composition of the record values that make up the analyzed mark. The distribution of an unvisualized dimension in the analyzed mark is unusual compared to the distribution of values for all other marks in the view. An unvisualized dimension is a dimension that exists in the data source, but isn't currently being used in the view. **Note**: For definitions of common terms used in explanations, see [Terms and concepts in explanations](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm#TermsToKnow "Link to definitions of Tableau terms and concepts used in explanations.").

This explanation shows:

The percent of the number of records for all values of a dimension for the analyzed mark (blue bar) versus all values of a dimension for all marks (gray bar) in the source visualization.

Exploration options:

Hover over each bar to see its details.
Scroll to see more of the chart.
Select the Open icon to see a larger version of the visualization.

Next steps for analysis:

Use this explanation to understand the composition of the record values that make up the analyzed mark.
Authors might want to create a new visualization to explore any unvisualized dimensions surfaced in this explanation.

Explain Data details for other dimensions of interest.

In this example, a high percentage of records are associated with overcast weather. Because the data is about bike rentals in Boston, and the analyzed mark is Trip Distance for August, we can assume that the weather is typically warm and humid. People might have rented bikes more often on overcast days to avoid the heat. It's also possible there were more overcast days in August.

[Skip to main content](#main-content) # Explore Dashboards with Data Guide Have you ever discovered a new Tableau dashboard and wondered what data means or how to use it? Or, have you ever published a new dashboard and wished that you could include instructions about how to use your dashboard? Data Guide provides helpful information about a dashboard and insights about the data behind it. Data Guide allows dashboard creators to provide more explanatory context for end users–like descriptions and links to resources–directly in the dashboard. And Data Guide automatically surfaces insights powered by [Explain Data](https://help.tableau.com/current/pro/desktop/en-us/explain_data.htm) to help users find outliers and learn about explanations for a mark. Explain the Viz (powered by Explain Data) identifies outlier measures and potential key drivers behind them. These contextually relevant details can help dashboard users navigate and use new dashboards more easily, allowing users to find insights faster, trust that they're looking at the right data, provide context for data, and establish confidence in their understanding of the viz. Alternatively, if you have a Tableau Cloud site with Tableau+, you can use Tableau Agent's Dashboard Narratives feature to explore your dashboard using AI. For more information, see [Create Dashboard Narratives with Tableau Agent (Beta)](https://help.tableau.com/current/pro/desktop/en-us/dashboard-narratives.htm). ## Customize Data Guide as an author 1. From your dashboard, choose the Edit button. 2. Choose Data Guide in the toolbar. 3. In the Data Guide pane, type a description to help your end users understand the purpose of your dashboard. 4. Select Add link, and enter a descriptive label for your link text and the URL. 5. Choose OK. 6. Select a viz (a sheet in the dashboard). Data Guide updates automatically so you can add a description and resources that are relevant to each viz in your dashboard. 7. Type a description, and add links relevant to the viz. 8. Choose OK. > [!TIP] > > To use Data Guide to write custom alt text to improve the accessibility of your vizzes, see [Show more text and make it helpful](https://help.tableau.com/v0.0/pro/desktop/en-us/accessibility_create_view.htm#show-more-text-and-make-it-helpful). ## Explore Data Guide as a dashboard user 1. From the dashboard, choose Data Guide in the toolbar. 2. Read the description of the dashboard and explore resources provided by the dashboard author. 3. Expand Data in This Dashboard and Detected Outliers to learn more about the underlying data used in the dashboard. 4. Select a viz (an object in the dashboard). 5. Read the description of the viz and explore resources provided by the dashboard author. 6. Expand Data Summary and Detected Outliers to learn more about data in that viz. 7. Select a mark or multiple marks, such as a bar on a chart or a region on a map, to see information about Data in This Mark and Applied Filters. Select a single mark to see possible Explanations for its value. ![Short animation showing how the Data Guide displays different information when you click on a dashboard, viz, or mark](/tableau/next/en-us/online/en-us/Img/data_guide_ovw.gif) ## Explore Data Guide at different levels By default, Data Guide is closed when you open a workbook. And you can open Data Guide in the toolbar. At the top of the Data Guide pane, you see the name of the dashboard or viz that you selected. As a dashboard author, you can write descriptions for both the dashboard and for individual vizzes that make up your dashboard. ### Understand dashboard-level details At the dashboard level, Data Guide: - Displays the dashboard's name, author, and last published date. - Can include a description written by the dashboard author and links to related resources, such as videos or wiki pages. - Lists the data sources used by the dashboard and details about the data, such as which dimensions and measures are used. - Reveals detected outliers in the dashboard that are identified by Explain Data. For more information, see [Get Started with Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm). ![The Data Guide pane at the dashboard level](/tableau/next/en-us/online/en-us/Img/data_guide_dashboard_level.png) ### Understand viz-level details When a user selects a specific viz (dashboard object), Data Guide: - Displays the viz's name. - Can include a description written by the dashboard author and links to related resources, such as videos or wiki pages. - Lists the data sources used by the dashboard, including the dimensions and measures used. - Lists applied filters and data used in the viz, so you can identify how the data is being influenced by filters that users interact with. Only filters that a user can change are shown. - Has a summary of the data used in the viz, including the number of data points and sorting details. - Reveals detected outliers in the viz that are identified by Explain Data. For more information, see [Get Started with Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm). ![The Data Guide pane at the viz level](/tableau/next/en-us/online/en-us/Img/data_guide_viz_level.png) ### Understand mark-level details When a user selects a mark (or marks) such as region on a map, Data Guide: - Displays the name of the mark. - Lists applied filters and data used in the viz, so you know what's included and what's excluded. - Reveals detected outliers in the viz that are identified by Explain Data. For more information, see [Get Started with Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm). ![The Data Guide pane at the mark level](/tableau/next/en-us/online/en-us/Img/data_guide_mark_level.png) ### Get Tableau Pulse metric recommendations In Tableau Cloud, when a user selects a viz, Data Guide shows recommended metrics based on the fields used in that viz. Users can select a recommendation to continue configuring it in Tableau Pulse. For more information, see [Create Metrics with Tableau Pulse](https://help.tableau.com/current/online/en-us/pulse_create_metrics.htm). If there are no fields that can be recommended, but the data source used by the viz is a published data source, users can select the data source to connect to in Tableau Pulse. If Data Guide can't recommend metrics, fields, or a data source, users can still open Tableau Pulse to create metrics from scratch. ![The Data Guide pane showing recommended metrics](/tableau/next/en-us/online/en-us/Img/pulse_data_guide_bootstrapping.png) ## Control Data Guide visibility By default, Data Guide is closed when you open a workbook. When you open or close Data Guide, it remains in this state for all workbooks on the site. In 2023.1 or later, a site administrator can hide Data Guide for all users. This removes the Data Guide button from the Tableau toolbar on all workbooks on the site. To hide Data Guide: 1. From the left pane, choose Settings. 2. From the General tab, scroll to Availability of Data Guide. 3. Choose Hide. 4. Choose Save. [Skip to main content](#main-content) # Explore Metrics with Tableau Pulse Tableau Pulse allows you to make data-driven decisions right in your flow of work by sending you insights about metrics that you follow. For example, if you regularly report on a metric, Tableau Pulse can send you insights about important changes to your data. With Tableau Pulse, users who have Creator, Site Administrator Explorer, or Explorer (can publish) site roles can create a metric definition that provides the metadata for all related metrics. All users can follow and interact with metrics, which use the core definition plus optional filters to scope the data for different audiences and purposes. When you follow a metric, insights about your data are delivered directly where you’re working–in email or Slack. Each digest includes contextual insights about the metrics you follow, and you can explore individual metrics for further insights. To learn more about AI in Tableau, see [Einstein Generative AI for Tableau](https://help.tableau.com/current/tableau/en-us/about_tableau_gai.htm). ## Get started with Tableau Pulse 1. From the Tableau Cloud home page, expand the left side pane, and choose Pulse. 2. From Tableau Pulse, [Create Metrics with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm), if metrics haven’t been created yet. 3. Use the Search bar or Browse Metrics tab to find existing metrics, and choose Follow to start receiving insights about specific metrics. 4. From the More Actions menu (...) of a metric card, you can manage followers, see details, or view related metrics (metrics that share a core metric definition but have different filters or time contexts). For a detailed explanation and example of how metric definitions and metrics work, see [Metric definitions and metrics](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#Metric). ## Explore metrics in detail, adjust the time range, or apply filters From the Insights Exploration page, you can understand the metric at a glance, including: - The current metric value. - The percentage change from the prior period being compared. - Filters applied to the metric definition. - And insights about that metric. From the metric page, choose Filter to change the time period being analyzed. You can also adjust the filtered values applied to the metric. All users can adjust filter values and follow different metrics based on the same definition. When a user follows a metric, the time period and filter selections are preserved in their home page and digests. The Overview tab shows a line chart of your metric’s performance, including the direction the metric is trending. Hover over different points of the line chart to see the metric’s value at different points in time. ![The Insights Exploration page showing a line chart of Super Store sales.](/tableau/next/en-us/online/en-us/Img/pulse_explore_insights.png) The Breakdown tab shows you how different values in your metric are contributing to the total value. And you can choose the dimension by which you see your metric broken down. For example, this metric displays Region by default, but you can also break down the metric by Regional Manager or Segment. ![The Breakdown tab showing a bar chart of Super Store sales by region. ](/tableau/next/en-us/online/en-us/Img/pulse_breakdown.png) If there's a data source goal or threshold set on the definition for a metric, you can adjust the chart details to show goal or threshold data for each contributor. By default, the breakdown chart shows a comparison to data from the prior period. The chart details option doesn’t appear for metrics with manual goals or thresholds set. ![Chart details options](/tableau/next/en-us/online/en-us/Img/pulse_chart_detail.png) Tableau Pulse provides a path for exploring your data by surfacing questions for each insight that it detects for a metric. As you click through the suggested questions about your data, answers are revealed in easy-to-read charts with insights about the underlying data. ![A guided question-and-answer experience with a bar chart that shows top sales by regional manager.](/tableau/next/en-us/online/en-us/Img/pulse_q_and_a.png) If you don't see an insight you are looking for, click the Ask button to the left of the available questions, and then enter a new question about the metric. Based on your question, Tableau Pulse will look for and rank semantic matches for insights that it detects for the same metric you're investigating. It then lists a question for each detected insight. The filter settings and data available for the metric affect the insights that Tableau Pulse can detect. When Tableau Agent in Pulse is turned on in Tableau Pulse, you can see suggested questions in the Tableau Pulse home page based on metrics grouped by data source, definition, or time range. Selecting a question takes you to a page with key insights, relevant visualizations, source references, and suggested follow-up questions to help you dig deeper. Tableau Agent in Pulse is powered by AI in Tableau, so you can ask questions in your own words to get natural language answers about your data. For more information, see [Ask Questions and Discover Insights in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm). ## Follow metrics Follow a metric to keep track of it on your Tableau Pulse home page and in digests. For information about following metrics, see [Follow Metrics and Manage Followers in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_manage_followers.htm). ## Share metrics in Slack Paste the link for a metric into a Slack direct message, channel, or canvas, and the metric unfurls to show a snapshot of the metric, the metric value and comparison, the top insights, and any alerts. Click on the metric snapshot to view more details about the metric. In the same pane as the details, the Conversations tab lists every public thread where the metric has been shared in Slack. To get more insights about the metric, click the link to open the metric in Tableau. You can also select the More actions (⋮) menu for direct links to set a goal or threshold or manage followers for the metric. **Note:** For a metric to unfurl, the Slack workspace that you are sharing the metric in must be connected to your Tableau site. ### How user filters affect shared metrics The metric snapshot image shown in the message that you share reflects the metric as you see it. If there are any user filters on the data, other Slack users see your filtered view of the data. When another person opens the details pane for a metric, the metric snapshot is generated based on that person’s permissions. If there are user filters, and that person’s filters differ from your filters, the metric snapshot might be different. ## Customize your home page and digests Customize your Tableau Pulse home page by sorting, grouping, or filtering metrics. Sort metrics by time range or recently followed. Group metrics that share a metric definition or a data source. Filter metrics to show only your favorites. 1. On your Tableau Pulse home page, select Sort by or Filter by. 2. Select how you want your metrics to be filtered or sorted, for example, grouped by metric definition. 3. For the sort order, choose Set as Default Order to apply this to your Tableau Pulse home page, Tableau Mobile Pulse tab, Slack digest, and email digest. To filter the metrics that you receive in digests, see [Manage your Tableau Pulse digest](#manage-digest). You can also mute metrics from your insight summary without unfollowing the metric. Your insight summary appears at the top of your home page and in your digests. The cards for muted metrics still appear on your Tableau Pulse home page and in your digests. 1. Open your Tableau Pulse home page. 2. From the metric you want to mute, select the More actions option (three vertical dots). 3. Select Mute from Insights Summary. To unmute a metric, find the metric on your Tableau Pulse home page, and select the More actions option (three vertical dots). Then select Include in Insights Summary. **Note:** Your insight summary generates when you follow two or more metrics. If your insight summary isn’t generating, follow more metrics or unmute followed metrics. ## Manage your Tableau Pulse digest You can choose the channels where you receive Tableau Pulse digests and how frequently you receive digests. By default, digests are sent weekly. Digests include insights into important changes in your data so you can stay up to date. 1. From Tableau Pulse, select your user icon in the upper-right corner, then select Preferences. 2. Choose how you want to receive digests (email, Slack, and Microsoft Teams). If your administrator has turned off digests for a particular channel, you won’t be able to turn on that channel. 3. Choose how frequently you want to receive digests (daily, weekly, or monthly). 4. Choose whether to receive all of the metrics that you follow or only favorites. This setting affects only the metric cards that appear in digests. You continue to receive alerts for all of the metrics that you follow. 5. Select Save. Email and Slack digests are sent to the email address associated with your Tableau site. Teams digests are sent to the Teams account that has been mapped to your Tableau account. This mapping is done by your Teams admin when they set up the Tableau app for Microsoft 365. To receive Tableau Pulse digests in Slack, your administrator must first [Integrate Tableau with a Slack Workspace](https://help.tableau.com/v0.0/online/en-us/slack_admin.htm). You receive Tableau Pulse digests in the Tableau App for Slack automatically. These digests appear in the Messages tab of the Tableau App for Slack. To experience all that the Tableau App for Slack has to offer–such as searching for vizzes, sharing vizzes, and receiving notifications–you must connect the Tableau App for Slack to your Tableau site. For more information about the Tableau App for Slack, see [Receive Notifications, Search, and Share Using the Tableau App for Slack](https://help.tableau.com/v0.0/online/en-us/slack_tableau.htm). To receive Tableau Pulse digests in Microsoft Teams, your administrator must first set up the Tableau app for Microsoft 365. Additionally, you must open the Tableau app at least once and follow at least one metric to receive digests. These digests appear in the Activity tab of the Tableau app for Microsoft Teams. For information about accessing the Tableau app in Teams, see [Use the Teams app](https://help.tableau.com/v0.0/online/en-us/teams_explore.htm#explore). For information about setting up the app as an admin, see [Set Up the Tableau App for Microsoft 365](https://help.tableau.com/v0.0/online/en-us/teams_set_up.htm). ## Troubleshoot Tableau Pulse Tableau Pulse is available on Tableau Cloud only. If you don’t have insights generated by AI in your Tableau Pulse summaries, your administrator might not have turned on these features for your site. For more information, see [Set Up Your Site for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm). Confirm that your preferred channels (email, Slack, and Microsoft Teams) are turned on to receive your Tableau Pulse digest. Email and Slack digests are sent to the email address associated with your Tableau account. If you’re not receiving your digest, check the email address associated with your account. Tableau Pulse email digests might not be formatted properly if you're using certain email clients, such as Thunderbird or older versions of Outlook. You can also check your Tableau Pulse preferences to confirm that your digest is being sent at the desired frequency (daily, weekly, or monthly) via email, Slack, and Microsoft Teams. If your Tableau Pulse digest wasn’t ready in time, then you can view your metrics on the Tableau Pulse homepage. If a metric you followed is no longer in your digest or on your Tableau Pulse home page, then the metric was deleted. [Skip to main content](#main-content) # Explore Your Data with Tableau Agent > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. Tableau Agent is a generative AI feature that helps you explore your data, create visualizations, and uncover insights with the help of a conversational assistant. Connect to a workbook or data source and use natural language to perform visual analysis. Use Tableau Agent and the Tableau UI together to get to insights faster. With Tableau Agent, staring at a blank canvas becomes a thing of the past. In the Tableau authoring experience, you can open the Tableau Agent conversation pane in a worksheet. Tableau Agent can help with tasks like: - **Jumpstart your analysis**: Tableau Agent can suggest analytical questions based on your data - **Build a viz**: "How many action movies did each director make?" - **Choose the best chart type for an analysis**: "Show me the distribution of student's grades" - **Perform time series analysis**: "What month had the largest growth in number of donors compared to the previous month?" - **Create calculated fields**: "Create a field that calculates the difference between case open and closed dates and round up to weeks" - **Explain calculations**: "Explain the "Days to Ship Actual" calculation" - **Filter and sort data**: "Only look at Saltwater and show me the fish with the smallest tank options" Tableau Agent creates visualizations based on your data, just like Show Me in Tableau. Chart types that Tableau Agent can currently support include: - Text - Heatmap - Bar - Stacked bar - Line - Dual line - Area - Gantt - Box plot - Scatter plot - Histogram - Symbol map - Filled map - Tree map - Pie - Bullet - Bubble For more information about Tableau chart types, see [Choose the Right Chart Type for Your Data](https://help.tableau.com/current/pro/desktop/en-us/what_chart_example.htm). **Note**: To use this feature you must sign into a Tableau Cloud site that has Tableau+ and AI in Tableau must be turned on in your site settings. If you don't have Tableau+, but want to try Tableau Agent features, you can sign up for a Tableau Cloud free trial which now includes Tableau Agent features. To start your trial, fill out this [form](https://www.tableau.com/products/trial), or contact your Account Executive. For more information about the free trial or to configure AI in Tableau, see [Turn on AI in Tableau for Your Site](https://help.tableau.com/current/online/en-us/setup_tabAI_site_setting.htm). Starting in version 2025.3, you can also use Tableau Agent if you are signed into a Tableau Server site with AI in Tableau turned on. For more information, see [Turn on AI in Your Tableau Server Site](https://help.tableau.com/current/server/en-us/sites_gai_server.htm). ## Tableau Agent and Trust Tableau Agent in Tableau Cloud is built on top of the [Einstein Trust Layer](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust_layer.htm) and inherits all of its security, governance, and Trust capabilities. As you interact with Tableau Agent, neither your data nor your conversations that are sent to the Large Language Model (LLM) are saved to the LLM, and no customer data is ever used to train the model. Tableau Agent only works with the data sources your workbook is connected to. It isn’t aware of any other Tableau data sources, so it can’t suggest relevant content, answer data lineage questions, or answer general-knowledge questions. User-defined policies for row and column level security are respected. The data a user has access to while using Tableau Agent conforms to any row or column-level security policies that you have in place. When you first open Tableau Agent, it indexes your data to understand the context. This helps Tableau Agent return relevant results based on your questions and your data source. The information it indexes includes field metadata such as field captions, field descriptions from comments(first 150 characters) in Tableau Desktop or from Tableau Catalog, data roles, and data types. It also samples up to 1000 unique field values if the data type is string (text). Tableau Agent uses the field caption or alias, not the original field name. For example, if you rename "Host" to "Owner", Tableau Agent will recognize "Owner" but might not recognize "Host". Similarly, if you [create an alias](https://help.tableau.com/current/pro/desktop/en-us/datafields_fieldproperties_aliases_ex1editing.htm) like "Breakout"' for "SessionType1", it will recognize "Breakout" but not "SessionType". Tableau Agent can index field descriptions included as comments. For details on adding comments, see [Add default comments for specific fields](https://help.tableau.com/current/pro/desktop/en-us/datafields_fieldproperties.htm?#add-default-comments-for-specific-fields). The Einstein Trust Layer can be used to mask Personally Identifying Information (PII) before it is sent to the LLM using pattern-based data masking. Using machine learning and pattern matching techniques, PII in prompts are replaced with generic tokens and then unmasked with original values in the response. For more information about how to configure data masking, see [Select What Data to Mask](https://help.salesforce.com/s/articleView?id=ai.generative_ai_mask_select.htm&type=5) or [Large Language Model Data Masking](https://help.salesforce.com/s/articleView?id=ai.generative_ai_mask_data.htm&type=5) in the Salesforce help. For an additional layer of protection, the Einstein Trust Layer guarantees that after the prompt and response are processed by the LLM, the LLM forgets both the prompt and the response. If you're using Tableau Agent in Tableau Server (version 2025.3 and later), it doesn't use the Einstein Trust Layer. Instead you connect directly to your Large Language Model provider. For more information, see [AI in Tableau and Trust](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust.htm). ## Tableau Agent billing considerations **Note**: Starting October 2025, AI in Tableau no longer consumes Einstein Request credits for AI usage. Other services, such as Data 360 services, can still consume other types of credits. Data 360 credits include Data Service credits and Flex credits. The type and number of credits consumed varies based on the credit model you have chosen for your Salesforce org. For more information, see [Einstein Request & Flex Credit Rate Card Updates FAQ](https://help.salesforce.com/s/articleView?id=005197697&type=1) and [Billing Considerations for Audit and Feedback](https://help.salesforce.com/s/articleView?id=ai.generative_ai_audit_feedback_usage_types.htm&type=5) in the Salesforce Help Center. When you use generative AI features when connected to Tableau Cloud, it may consume Data 360 credits if you're using the Einstein data collection and Storage (also known as Audit Trail) feature as part of your AI in Tableau setup. For more information, see [AI in Tableau Usage](https://help.tableau.com/current/tableau/en-us/tableau_gai_usage.htm). You can view your credit consumption in your Salesforce org using pre-built dashboards and Digital Wallet, or connect to your Data 360 data from Tableau and build visualizations using the data from Digital Wallet tables. For more information, see [View Credit Consumption](https://help.tableau.com/current/tableau/en-us/tableau_gai_usage_view.htm). ## Get started with Tableau Agent **Note**: Tableau Agent is not supported if you are using a Salesforce Government Cloud Org. Tableau Agent is available through a conversation pane in the web authoring environment when AI in Tableau is turned on for your site. In Tableau Cloud, you can choose to turn it on for a single group of users or for all users on your site. For more information, see [Configure AI in Tableau](https://help.tableau.com/current/online/en-us/setup_tabAI_site_setting.htm#configure-ai-in-tableau). Use Tableau Agent in: - Tableau Cloud (requires Tableau+) - Tableau Server (version 2025.3 and later) - Tableau Desktop (version 2025.1 and later) when signed into a Tableau Cloud or Tableau Server site with AI in Tableau turned on for web authoring In Tableau Cloud, you also must have the site role of Creator or Explorer to use this feature. Tableau Agent in now also available for dashboards in Beta. This feature enables Tableau Agent to: - Review your dashboards and quickly give a summary to tell dashboard consumers what the dashboard is about - Create insights based on the charts in the dashboard - Let you dive deeper into your data by asking questions using natural language For more information, see [Tableau Agent in Dashboards (Beta)](https://help.tableau.com/current/pro/en-us/dashboard_narratives_overview.htm). Starting in version 2025.1, Tableau Agent supports English (en\_US) and a subset of other languages. If your Cloud site, Server site, or Tableau Desktop application is set to a language that isn't supported, Tableau Agent responses will be in English (en\_US). For more information about supported languages, see [AI in Tableau supported languages and locales](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust.htm#supported_language). Start by creating a new workbook or opening an existing one. For new workbooks, you start by connecting to your data. For faster results, we recommend using Tableau Agent with extracts. However, you can also use Tableau Agent with live database connections, and uploaded files with the following file types: - .hyper - .csv - .txt - .xlsx Tableau Agent doesn't support cubes. Also, if you're using data blending, Tableau Agent can only be used with the primary data source. ### Launch Tableau Agent To open the Tableau Agent conversation pane, do the following: 1. Select the Tableau Agent icon in the toolbar next to Show Me. ![A blank Tableau worksheet with the Tableau Agent button highlighted](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_icon_webauth.png) 2. When the pane opens, select Got It to acknowledge the disclaimer and get started. ![A blank worksheet with the Tableau Agent conversation pane open showing disclaimer text and a Got It button](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_gotit.png) ### Build and change a viz Tableau Agent isn't an open-ended chatbot‌. It can only work within your data set and perform a specific set of actions around analysis and viz creation. To understand your data, Tableau Agent starts by indexing the data set you’re connected to. If you’re connected to more than one data set, it will work with the selected data set shown in the Data pane. Tableau Agent only works with the primary data source in a data blend. **Note**: If you switch to a different data source while Tableau Agent is processing your request, this can cause an error. Wait until Tableau Agent responds before changing data sources; then make a new request using that data source. Indexing scans the field names, data types (such as dates, text, or number fields), and samples 1000 unique field values to get a sense of what kind of data is in that field. Re-indexing occurs periodically when a change is made, such as renaming a field or creating a new calculated field. After indexing is complete, Tableau Agent provides some suggested questions you could ask about your data to help you get started, or type your own questions into the text box using natural language to describe what you want. ![A worksheet showing a viz built by Tableau Agent. The conversation pane is open and and shows highlighted questions.](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_web_auth_questions.png) After Tableau Agent creates the viz, you can interact and modify it, just like if an analyst built and shared a viz with you. Ask more questions with Tableau Agent to iterate and explore your data further, use Suggestions to get more ideas about questions you can ask, or take the reins and continue your analysis on your own directly in the Tableau interface. If the viz that Tableau Agent created isn't what you're expecting, you can either provide additional information by typing what you want in the text box, or try selecting the Retry with Tableau Agent ![Button with a curved arrow to regenerate suggested questions](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_retry_button.png) and Tableau Agent will query the LLM again and provide a new response to your request. ### Use suggestions to jump start your analysis Whether you're facing a blank canvas or are deeper into your analysis, Tableau Agent can help by suggesting questions you can ask to dig deeper into your data. Before you begin, select the Suggestions button and Tableau Agent will create three questions you might ask based on your data source. To see more questions, select Retry with Tableau Agent ![Button with a curved arrow to regenerate suggested questions](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_retry_button.png) . Select a question, and Tableau Agent creates the corresponding viz for you. ![A blank canvas with the Tableau Agent pane open displaing the Suggestions button.](/tableau/next/en-us/online/en-us/Img/tab_gai_blank_slate.png) Use suggestions to dive deeper into your analysis as you interact with vizzes Tableau Agent has created. Also, starting in version 2025.1, when you use Tableau Agent to create or modify a calculation and accept the calculation, Tableau Agent offers suggestions about how you might use the calculation in your analysis. At the bottom of the confirmation response from Tableau Agent, select the Suggestions button and Tableau Agent will suggest some actions you might take to discover more insights about your data. When you do this, the Suggestions button is converted to a Recreate button so that you can go back and recreate the previous viz if needed. Simply select an option to apply the suggested action to your viz. If you don't like those suggestions, just select Retry with Tableau Agent ![Button with a curved arrow to regenerate suggested questions](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_retry_button.png) to see more options. ![A viz with the Tableau Agent pane open, showing suggestions for next steps for analysis. ](/tableau/next/en-us/online/en-us/Img/tab_gai_viz_suggestions.png) ### Create calculations Building calculations in Tableau can sometimes be tricky. If you're new to Tableau, you might not know the right syntax to use or how to properly format your calculation. Tableau Agent can do the heavy lifting for you, keeping you in the flow of your analysis. Simply ask Tableau Agent to help you create a calculation using natural language to describe what you want to do. Tableau Agent does the following: - Opens the Calculation Editor - Adds the suggested syntax - Names the calculation - Provides an explanation of the calculation in the Tableau Agent pane to help you evaluate it for accuracy and build proficiency Review the calculation, edit it if needed, and accept it. Tableau Agent adds the new calculated field to the Data pane and it’s ready to use in your analysis. There are two ways to ask for help with calculations: 1. **In the conversation pane**: Ask Tableau Agent to create calculations for you as part of the flow of your conversation. Just describe your calculation using natural language, and Tableau Agent does the rest. ![A worksheet with a bar chart and the calcuation editor dialog open, showing a calculation created by Tableau Agent.](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_calc.png) 2. **In the Calculation Editor**: Open the Calculation Editor and select the Tableau Agent ![Tableau Agent icon](/tableau/next/en-us/online/en-us/Img/tab_gai_desktop_agent_icon.png) icon. This opens the conversation pane if it isn’t already open. If the conversation pane is open, just type your calculation description in the text box, and Tableau Agent adds the suggested syntax right into the open Calculation Editor. ![The Calculation Editor dialog with the Einstein icon highlighted](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_calc_editor.png) #### Tips for creating calculations To get the best results when asking Tableau Agent to help you create a calculation, be specific. When your goal is to have Tableau Agent write a calculation for you, use that specific language. For example, “Create a calc…”, “Write a calc…”, “Create a calculated field…”, or simply just “Calculate…” It's also important to avoid being too generic. For example, instead of saying “Identify my most profitable products”, try “Calculate the profit ratio by product name”. This helps Tableau Agent understand both your intent (to create a calculation) as well as what you mean by the fields you want to calculate. #### Calculation Descriptions Understanding what a calculation does is just as important as creating the calculation itself. Tableau Agent can help with that. Whether it’s a calculation that Tableau Agent created for you or one that exists as part of your data set, you can ask Tableau Agent to explain the calculation. For example, “Explain the Business Days Between Order and Ship calculation.” Not only can this help you verify that the calculation does what you need, this feature can also help you build proficiency in using calculated fields in your Tableau analysis. ![Tableau Agent conversation pane showing calculation description.](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_calc_description_extended.png) #### Edit calculations You can edit any calculation that Tableau Agent created for you at any time. You can manually edit the calculation, or you can ask Tableau Agent to help you. To edit a calculation, do the following: 1. In the conversation pane, find the calculation you want to edit. 2. Click Edit. 3. Manually make your changes in the Calculation Editor and click OK or describe the changes you want to make in the Tableau Agent conversation pane, and let Tableau Agent make the changes for you. ![A viz showing a bar chart with the calculation editor and the Tableau Agent conversation pane open. In the conversation pane, the Edit button is highlighted.](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_calc_edit.png) To ask Tableau Agent to update an existing calculation in the Data pane, open the calculation in the Calculation Editor first. 1. Right-click or Cmd+Click (MacOS) on the field in the Data pane. 2. Select Edit… 3. Manually make your changes in the Calculation Editor and click OK or describe the changes you want to make in the Tableau Agent conversation pane, and let Tableau Agent make the changes for you. #### Calculation limitations When creating calculations using Tableau Agent, the following functionality is not yet supported: - When creating a calculation, Tableau Agent can't yet ask clarifying questions. You might need to be specific or iterate, such as specifying "change the field FIRST NAME into proper capitalization" if there is more than one field with the word "name" in its name. - Available calculations can vary by connection type. For example, certain date functions such as [DATEPARSE](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_date.htm#dateparse) are only supported by data extracts and a subset of possible connectors. If your request involves a function that isn't supported by your live data connection, Tableau Agent may create the calculation for you but it will be in an error state. To use the calculation, you'll need to take an extract of your data source first. In some cases there may be alternative functions you can request, such as using DATE instead of DATEPARSE. For more information about these alternatives, see the [functions documentation](https://help.tableau.com/current/pro/desktop/en-us/functions_all_categories.htm). - Tableau Agent can’t create a calculation and then automatically use it in the viz. Instead do this as a two-step process. Ask for the calculation and add it to the Data pane; then ask for the viz and reference the new calculated field by name. ### Working with filters You can ask Tableau Agent to filter your viz using natural language. While Tableau Agent does its best to understand your request and return a solution, sometimes it might need your help to return the response that you're looking for. For example, if you have high cardinality fields, fields with a lot of values, Tableau Agent might ask you to select the values you want. In cases like this, you can select Add Filter in the Tableau Agent pane, and Tableau Agent opens the Filter dialog for you. Just select the values you want and select OK to add your filter to the viz. ![A visulization canvas with the Tableau Agent pane describing how to add a filter and an open filter dialog.](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_filter.png) ### Conversation history and viz recreation You interact with Tableau Agent in the conversation pane. The pane is where Tableau Agent offers suggestions for analysis and maintains your conversation history for that session. If you ask a new question, the viz itself updates, but the conversation pane maintains a history of all your requests and Tableau Agent’s responses. It also has interactive elements such as Retry with Tableau Agent ![Button with a curved arrow to regenerate suggested questions](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_retry_button.png) to ask Tableau Agent to query the LLM again with the same request and create another version of the viz or Recreate ![Recreate button](/tableau/next/en-us/online/en-us/Img/tab_gai_recreate_button.png) to go back to return to a previous viz without querying the LLM, maintaining the same results. If you close and reopen the conversation pane while still in your same session, your conversation history persists. If you close your workbook, this clears the conversation with Tableau Agent. The conversation history isn’t saved and doesn’t appear the next time you open the published or saved workbook. Tableau Agent is a per-sheet experience. There’s no awareness of other worksheets in your workbook and conversations can’t be shared between worksheets. If you change to a new sheet, this starts a new conversation. If you want Tableau Agent to forget the context of what you’ve done so far, start a new sheet so there’s no history in the conversation pane. ## Tips for getting the best results from Tableau Agent Tableau Agent does its best to understand your intent and your data. But it’s still learning. Use the following tips to help Tableau Agent do its best and deliver great results for you.

Tip	Problem	What to Do
Use clean data	Messy data is hard to analyze and Tableau Agent won’t know how to clean and prep your data for you.	Use certified data sources. The better the data quality, the better results Tableau Agent can return. Clean and prep your messy data before analysis. Make sure field names are descriptive and unique.
Hide irrelevant fields	Similarly named fields in your data set can be confusing to Tableau Agent.	Hide fields you don’t need and Tableau Agent won’t use these hidden fields.
Be careful with synonyms	Tableau Agent does a good job of understanding common synonyms. For example, it would know that “titles” and “films” could apply to a field called “movies.” However, it doesn’t know about any of your company specific terminology or acronyms that you may use.	Refer to the specific fields you’re interested in to help Tableau Agent be more accurate.
Be explicit with your intent	Tableau Agent does its best to infer your intent, but it might not always get it right.	If you know you want Tableau Agent to generate a viz, use clues in your request like “show me,” “create a viz,” “build a bar chart.” Alternatively, if you want Tableau Agent to create a calculation, try starting your request with the phrase “Create a calc that...”
Specify how to evaluate “top”	Requests like “top products,” “best salespeople,” “highest quarter” can be ambiguous to Tableau Agent and it might not know how to evaluate what “top,” “best,” or “highest is.”	State how “top” should be measured and displayed. For example, try asking Tableau Agent to show you the “top 10 products based on profit” or "top 3 products based on sales volume".
Use specific terminology in your requests	Tableau Agent can scan your data source for the field names and data in those fields, but it doesn't truly understand the data the way a human can.	The more descriptive you are in your request, the better Tableau Agent is at providing a relevant visualization. If you know your data should be evaluated with an aggregation of MEDIAN instead of AVERAGE, specify that.
Break down complex tasks	Tableau Agent can’t update the data model and generate a visualization as part of a single step.	Break down your tasks into parts and iterate. For example: <Task 1> "Create a calc called profit" <Task 2> "Show me how profit has varied over time"
Only asks questions about your data	Tableau Agent isn’t a general-purpose chatbot. It can’t answer consulting questions like “how should I analyze my data?” or general questions like “which cat breed makes the best pet?”	Ask questions targeted at analyzing your data and iterating and digging deeper into the viz results.

## Be the human in the loop As with all AI, its important to review the results you get when using Tableau Agent. Tableau Agent will do it’s best to understand your data and your intent when asking questions, but it might not always get it right. For example, Tableau Agent tries to pick a default for things like date granularity (such as year, month, or day) or aggregation (such as median or average). If you know the aggregation you want, it's better to specify this in your request. If Tableau Agent gets it wrong, you can either restate your request and clarify what you want, or you can interact directly with the viz. After all, you're in the standard authoring environment and have access to all of Tableau's functionality. You can also provide feedback at any time on the results with the thumbs up or thumbs down buttons that show up with every Tableau Agent response. ![Einstein Copilot conversation pane showing the feedback buttons highlighted](/tableau/next/en-us/online/en-us/Img/tab_gai_feedback1.png) If you click the thumbs down option, provide additional feedback to help improve Tableau Agent’s responses. ![Dialog showing Einstein Copilot feedback options](/tableau/next/en-us/online/en-us/Img/tab_gai_feedback2.png) ## Tableau Agent limitations Tableau provides powerful tools for the human analyst, and Tableau Agent is no different. AI in Tableau isn't meant to replace analysts and data explorers; it's here to give you a boost. Your participation in the process is crucial. ### Types of analysis Tableau Agent can't yet manage consultative questions like "how should I analyze my data?" or "Is there seasonality in this data?". Instead, you need to specify what you'd like to see, such as "What are my sales over time?" ### Unsupported features Tableau Agent doesn't have access to all of Tableau's authoring features‌ — ‌yet. It is currently available in web authoring and Tableau Desktop (starting in version 2025.1) if you are connected to a Tableau Cloud site with Tableau+ and AI in Tableau turned on in site settings, or if you are connected to a Tableau Server site (version 2025.3 and later) with AI in Tableau turned on. Some things that Tableau Agent is currently unable to do include: - Choose a data source for you or do data modeling (such as creating joins or relationships) - Change data types, field roles, or caption names - Format a viz. Such as adding fields to the Marks card properties. For example detail or tooltips. - Add reference lines - Organize or customize fields using groups, sets, or parameters - Create interactivity with elements such as filter controls, parameters, and actions - Build dashboards - Analyze large data sets. Tableau Agent will not work as well if you have hundreds or thousands of fields in your data set, especially if they are similarly named. If you try to filter against fields that are high-cardinality (many distinct values for a single field), Tableau Agent might need you to manually perform your filter operations. - Block indexing refreshes after data model changes - Support all languages. Tableau Agent supports English (en\_US) and a subset of other languages. If your data source field names and values are not in the same language as your user language settings or not the same as the language you are interacting with Agent in, use the exact field name and values in your requests. For information about the languages Tableau Agent currently supports, see [AI in Tableau supported languages and locales](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust.htm#supported_language). ## Other articles in this section [Skip to main content](#main-content) # External OAuth for Snowflake Starting in Tableau 2024.3, you can use OAuth 2.0/OIDC to federate identity from an external identity provider to Snowflake. Depending on the identity provider, there are different steps needed to configure the integration. This is a high-level overview intended to guide your configuration without providing the necessary details you'll find in your identity provider documentation. It is assumed you are familiar with configuring OAuth and understand the technical details required in setting up authentication with an external identity provider. ## Configure IDP on Snowflake For information on configuring your IDP, see [External OAuth overview](https://docs.snowflake.com/en/user-guide/oauth-ext-overview) in Snowflake's help system. ## Configure the IDP on Tableau 1. Create OAuth clients on the IDP for Tableau Desktop, and for Tableau Cloud or Tableau Server. The Desktop client enables [PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce) and uses `http://localhost` redirects. 2. Create the Tableau OAuth configuration file. For details on how to do this, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) on [github](https://tableau.github.io/connector-plugin-sdk/docs/oauth), and examples [here](https://github.com/tableau/connector-plugin-sdk/tree/master/samples/components/oauth). We welcome additional examples for other IDPs. - Be sure to prefix the Tableau OAuth configuration IDs with “custom\_”. **Note:** OAuth config IDs have a maximum limit of 36 characters. IDs longer than this may not generate an error, but will not work. - If your IDP supports dynamic localhost port, disable `OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL`. If your IDP does not support this, make sure to add several localhost callback URLs to the allowlist in the configuration file and on the IDP. 3. Install the new Tableau OAuth configuration file in the OAuthConfigs folder associated with each application on desktop hosts (Tableau Desktop, Tableau Prep Builder, Tableau Bridge), and on each Tableau Server and Tableau Cloud site that will be using OAuth via site settings page. For more details, see [Custom OAuth Configs on Tableau Desktop](https://tableau.github.io/connector-plugin-sdk/docs/oauth#custom-oauth-configs-on-desktop) and [Site Level OAuth Clients](https://tableau.github.io/connector-plugin-sdk/docs/oauth#site-level-oauth-clients). ## Connect to Snowflake When connecting, you must select OAuth and choose the OAuth configuration installed earlier. ![](/tableau/next/en-us/online/en-us/Img/snowflake_connect_oauth.png) ## Okta If using Okta, it’s better to use a “custom authorization server” rather than the “org authorization server.” The custom authorization servers are more flexible. There’s a custom authorization server created by default, which is called “default”. The authorization URL should look like this: `https://${yourOktaDomain}/oauth2/{authServerName}/v1/authorize` ![okta dashboard](/tableau/next/en-us/online/en-us/Img/athena_okta.png) [Skip to main content](#main-content) # Features Introduced in Previous Versions of Tableau Cloud > [!TIP] > > To see the latest Tableau Cloud additions since June 2022, use the Tableau Release Navigator in [Tableau Cloud Release Notes](https://help.tableau.com/v0.0/online/en-us/whatsnew_online.htm). Browse summaries of features for previously released versions. [All Tableau Cloud Release Notes](https://www.tableau.com/support/releases/online "All Tableau Cloud Release Notes") | [All Known Issues](https://issues.salesforce.com/ "All Known Issues") ## Added in previous versions Added in June 2022 ### Provision users and groups with Azure Active Directory Site administrators can now automate user management, provision groups, and assign Tableau Cloud site roles through Azure Active Directory. For more information, see [Configure SCIM with Microsoft Entra ID](https://help.tableau.com/v0.0/online/en-us/scim_config_azure_ad.htm). ### Authorize access to Tableau REST API using Tableau connected apps Using connected apps, you can programmatically authorize access to the REST API on users’ behalf using JSON web tokens (JWTs). For more information, see [Access Scopes for Connected Apps](https://help.tableau.com/v0.0/online/en-us/connected_apps_scopes.htm). ### Enable Explain Data by default per site Site admins can enable Explain Data by default using site settings and the Explain Data permission. Authors no longer need to set the workbook option Allow Explain Data to be used in this workbook when viewed online in the Explain Data Settings dialog box (the workbook setting has been removed). Access to Explain Data in viewing mode is based on site setting, site role, and the Explain Data permission. For more information, see [Control Access to Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_control_access.htm). ### Adjust the comparison and date range for metrics You can now edit a metric's configuration to change the comparison, date range, and status indicator. Previously, you could only configure these options when you created a metric. For more information, see [Edit a metric's configuration](https://help.tableau.com/v0.0/online/en-us/metrics_create.htm#config). ### Add a Tableau Data Story to your dashboard You can now create a Data Story in Tableau Cloud and in English only. Data Stories automatically generates narrative insights within your dashboard, saving time and surfacing relevant insights. As you interact with your dashboard, the stories written by Data Stories adjust allowing you to dive deeper into data and identify key insights faster. For more information, see [Create a Tableau Data Story (English Only)](https://help.tableau.com/v0.0/online/en-us/data_stories.htm). ### Edit published data sources As of June, you can now edit more types of connections, including Amazon Athena, OData, Databricks, and SharePoint lists. For more information, see [Edit a Published Data Source](https://help.tableau.com/v0.0/online/en-us/edit_datasources.htm). ### Suspend accelerated views automatically You can now automatically suspend acceleration for views that are consuming unnecessary resources. Set a threshold for the number of times an acceleration task can fail per day, week, or month before the acceleration is automatically suspended. For more information, see [View Acceleration](https://help.tableau.com/current/server/en-us/data_acceleration.htm). ### Understand the ICU 68.2 upgrade For improved security and better language support, we're upgrading to the current International Components for Unicode (ICU) library, 68.2. This update resolves issues with ordering and better handles new Unicode characters. This update can impact dashboard sorting, filtering, and calculations. If you use string comparisons in calculated fields, confirm that your calculations are still working as expected. For more information, see [String Functions](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_string.htm). ### Tableau Catalog - part of Data Management **Ask Data Lenses appear in lineage** - The lineage pane now contains lens information. For more information, see [Use Lineage for Impact Analysis](https://help.tableau.com/v0.0/online/en-us/dm_lineage.htm). ### Virtual connections - part of Data Management **Virtual connections support revision history** - Revision history lets you view the changes to the connection, delete a revision, or restore the connection to a previous version. **Enhanced filter features for data policy testing** - In the virtual connection editor, when you preview the data with your data policy applied, you can now see the values that are allowed by the policy and the values that are filtered out. ### Tableau Bridge support for OAuth Tableau Bridge now supports OAuth as an authentication method for connections to: Snowflake, Google BigQuery, Google Drive, Salesforce, and OneDrive. Using OAuth provides better security than basic username and password authentication and is easier to manage. For more information, see [Publish OAuth enabled private cloud-based data sources](https://help.tableau.com/v0.0/online/en-us/to_bridge_vpc.htm#oauth_bridge). Added in May 2022 ### Admin Insights Job Performance data source Get more visibility into your site with Admin Insights. You can now connect to the Job Performance data source to see events and runtime information for background jobs on the site. Jobs include extracts refreshes, Bridge refreshes, and flow runs. For more information, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). Added in March 2022 ### IPv4 address support for Bridge pools When mapping domains to Bridge pools, site admins can specify IPv4 addresses in the Private Network allowlist to refresh data sources and virtual connections that use IPv4 addresses in their connections. For more information, see [IP addresses](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#ip). ### Accelerate load time for your view Workbook owners, site administrators, and server administrators can now accelerate load time for their views. View Acceleration precomputes long-running queries, so accelerated workbooks load faster. For more information, see [View Acceleration](https://help.tableau.com/current/server/en-us/data_acceleration.htm). ![View Acceleration window](/tableau/next/en-us/online/en-us/Img/view_acceleration.png) ### Customize the View Data window In a worksheet, you can customize the tabular display of your data in the View Data window. Remove columns from the default view, change the column order, sort columns, or add columns to provide deeper context. You can then download the customized view of the underlying data as a CSV file to share with your team. **Note**: When you customize the View Data window, the changes remain only while the View Data window is open. The new View Data window and customization options are available in Tableau Cloud, Tableau Server, and Tableau Desktop. For more information, see [View Underlying Data](https://help.tableau.com/current/pro/desktop/en-us/inspectdata_viewdata.htm). The View Data window and its options are accessible for keyboard navigation and screen readers in Tableau Cloud, Tableau Server, and Tableau Desktop. For more information, see [View Data Window](https://help.tableau.com/current/pro/desktop/en-us/access_keyboard_navigation.htm#view-data-window) in "Keyboard Accessibility for Tableau". ### Open the Sheet Description for a workbook on the web Sheet Description is now available in Tableau Cloud and Tableau Server. While editing a workbook on the web, in the Worksheet menu, select Sheet Description. Field descriptions are also available on the web. For more information, see [Get Details About Fields and Sheets in a Workbook](https://help.tableau.com/current/pro/desktop/en-us/inspectdata_describe.htm). ### Change to Search behavior in Tableau Beginning with the 2022 Spring release, the Search functionality on the Search Results page in Tableau has changed. Prior to this release, content was indexed to allow “partial token matching.” This meant that you could search for a partial string. For example, if you searched for “super” the results could include content that contained the word “Superstore” in the title, description or columns, even if the word “super” was not present by itself. As of Spring 2022, indexing is done in a new way that supports both “full token matching” and “fuzzy token matching.” This means that the results you see will be based on complete strings, and will not do partial matches. Fuzzy matching provides partial matching on complete strings. To find "Superstore", you need to search for “superstore” or some variation of that entire string, for example “supertor”, “sperstore”, or “superstores”. Searching on just “super” will not return that match. The goal and benefit of this approach is to reduce noise, limiting the results to content that more closely matches your search string. Recommendations for taking advantage of this change: - Use complete words in your query - Search for words that are present in the title or description of the content #### Quick Search The behavior of Quick Search has not changed, so partial token matching is still supported, but this means that the results in Quick Search will likely not be the same as the results in the Search Results page. ### Tableau Catalog - part of Data Management **Certifications and data quality warnings for virtual connections** - You can now certify and set data quality warnings on virtual connections. **Virtual connections appear in lineage** - The lineage pane now contains both virtual connection and virtual connection table information. For more information, see [Use Lineage for Impact Analysis](https://help.tableau.com/v0.0/online/en-us/dm_lineage.htm). #### Developer Resources **Virtual connections in the Metadata API** - Virtual connections and virtual connection tables are now addressable using the Metadata API, and can appear in output when using it. For more information, see [Understand the Metadata Model](https://help.tableau.com/current/api/metadata_api/en-us/docs/meta_api_model.html) in the Tableau Metadata API Reference. ### Virtual connections - part of Data Management **Salesforce connector supports virtual connections** - You can connect Tableau to your Salesforce data and create virtual connections and data policies that implement row-level security. See [About Virtual Connections and Data Policies](https://help.tableau.com/v0.0/online/en-us/dm_vconn_overview.htm) for details about virtual connections. **Virtual connections added to space usage view** - Virtual connections are added as an Object Type in the Stats for Space Usage view so administrators can see how much disk space virtual connections use. Added in January 2022 ### Set up OAuth for Salesforce CDP As a Tableau Cloud site admin, you can set up OAuth for Salesforce CDP. For more information, see [Connect Tableau Cloud Web Authoring to Salesforce Data Cloud](https://help.tableau.com/v0.0/online/en-us/config_oauth_sfdc_cdp_online.htm). ### Update Admin Insights data sources As a Tableau Cloud site admin, you can now specify how often Admin Insights data sources are updated on your site. For more information, see [Manage Admin Insights](https://help.tableau.com/v0.0/online/en-us/adminview_insights_manage.htm). ### Tableau Cloud sign-in updates For users added to multiple Tableau Cloud sites, the sign-in process will now prompt users to enter the site URI of the site they are attempting to access. For more information, see [Sign In to Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_signin.htm). ### Get view load times with Admin Insights Get more visibility into your Tableau Cloud site with a new Admin Insights data source. You can now connect to Viz Load Times to see load time information for views published on your site. For more information, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). Added in December 2021 ### Reset MFA verification methods Site admins can now reset MFA for users who lose all their usual MFA verification methods and are locked out of the site. For more information, see [Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_security_mfa.htm#mfa_locked_out). ### Support for IdP-initiated SLO In addition to supporting service provider (SP)-initiated single log out (SLO), Tableau Cloud supports identity provider (IdP)-initiated SLO. For more information about SAML configuration and requirements, see [SAML Requirements for Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/saml_online_requ.htm). ### Use Tableau connected apps to enable SSO for embedded content In early January 2022, as a site admin, you can use Tableau connected apps to create and manage explicit trust relationships between your Tableau Cloud site and custom applications where Tableau content is embedded. With connected apps, you can restrict which content can be embedded and where the content can be embedded, and provide users the ability to access embedded content using single sign on (SSO) without having to integrate with an identity provider (IdP). For more information, see [Use Tableau Connected Apps for Application Integration](https://help.tableau.com/v0.0/online/en-us/connected_apps.htm). ### Keep more data fresh across multiple private networks Site admins can now configure multiple Bridge pools to load balance data freshness tasks. Pools can be mapped to domains, giving you the ability to dedicate pools to keeping specific data fresh and maintain security by restricting access to protected domains in your private network. For more information, see [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm). ### Schedule and manage refreshes for file-based data sources directly in Tableau Cloud Beginning with Bridge version 2021.4.3, refreshes for file-based data sources using Bridge will be integrated with Online schedules. Publishers can schedule and manage refresh schedules for file-based data sources directly from Tableau Cloud. For more information, see [Set Up a Private Network Refresh Schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm). **Note:** Your site admin must have at least one Bridge 2021.4.3 client in a pool mapped to the domain where your file-based data sources are located. ### Data freshness support for virtual connections Keep new virtual connections that connect to private network data fresh using Bridge. Data Management must be enabled for your site to create and use virtual connections. For more information about virtual connections, see [About Virtual Connections and Data Policies](https://help.tableau.com/v0.0/online/en-us/dm_vconn_overview.htm). ### Edit published data sources In Tableau Cloud, you can now edit published data sources. Previously, only data sources embedded in workbooks could be edited. Whether you’re creating a new published data source or editing an existing published data source, you can create joins and edit the schema from the Data Source page. Then use the Scratchpad to test your changes, create folders, organize hierarchies, and rename fields and aliases before publishing your data source—all without ever leaving Tableau. For more information, see [Edit a Published Data Source](https://help.tableau.com/v0.0/online/en-us/edit_datasources.htm). ![Edit Data Source button](/tableau/next/en-us/online/en-us/Img/edit_published_data_source.png) ### Copy and paste dashboard objects You can now copy and paste objects either within the current dashboard, or from dashboards in other sheets and files. Note that you can't, however, copy sheets in a dashboard, items that rely on a specific sheet (such as filters), or objects on a device layout. For the complete list of unsupported items and detailed instructions, see [Copy objects](https://help.tableau.com/current/pro/desktop/en-us/dashboards_create.htm#Copy). ![Dashboard object context menu expanded with the Copy Dashboard Item option selected.](/tableau/next/en-us/online/en-us/Img/dashboard_copy_object.png) ### Replay animations in dashboards, stories, and worksheets You can now replay animations in dashboards, stories, and worksheets wherever you use Tableau. Click the Replay button to rewind and replay the most recent animation. You can also choose the speed at which you want to replay the animation: actual speed, 2x speed, or 1/2 speed. Animations help you see how your data is changing in context, so you can make better conclusions about your data. For more information, see [Format Animations](https://help.tableau.com/v0.0/online/en-us/formatting_animations.htm). ![Animation of clicking Replay button and changing Replay speed](/tableau/next/en-us/online/en-us/Img/replay_animations.gif) ### Share Ask Data vizzes with Slack If your Tableau administrator has configured Slack integration, you can quickly share Ask Data vizzes with anyone who has access to a lens. In the upper right corner of the browser, click the Share icon, then enter specific user names in the text box. ![Share icon](/tableau/next/en-us/online/en-us/Img/ask_data_link.png) For more information, see [Share Ask Data vizzes via email, Slack, or a link](https://help.tableau.com/v0.0/online/en-us/ask_data.htm#Share). ### Use terms previously reserved for analytical functions in Ask Data Previously, analytical terms found in data source field names and values were ignored by Ask Data. But now it treats terms like "average," "group," "filter," "limit," "sort," and "date" just like any other form of data, letting you analyze data sources without needing to revise their contents. ### Query fields with table calculations in Ask Data Ask Data now lets you query fields with table calculations. Be aware that you cannot include filters, limits, or "year over year difference" comparisons in your query expressions for these calculations. ### Add Ask Data lenses to Favorites You can now add Ask Data lenses to your Favorites list for a site, helping you easily return to them. ### Provide feedback to Ask Data lens authors If you have questions about the structure of a lens or how best to use it with Ask Data, you can send feedback directly to the author. To the left of the query box for Ask Data, click the "i" icon. ![Hovered over information icon showing the Ask Data tips tooltip.](/tableau/next/en-us/online/en-us/Img/ask_data_tips_button.png) Then, at the bottom of the tips dialog, click Contact the Lens Author. This option is enabled by default, but lens authors can hide it by following the steps in [Let users email you questions about a lens](https://help.tableau.com/v0.0/online/en-us/ask_data_lenses.htm#Let). ### Rename fields and tables when authoring Ask Data lenses If field and table names in a data source don't reflect terms your users would recognize, lens authors can now rename these items for each lens. At left, hover over individual tables or fields, and click the pencil icon: ![A list of fields with the edit icon next to one value.](/tableau/next/en-us/online/en-us/Img/ask_data_synonyms.png) Then provide a more representative name by clicking the pencil icon to the right. ![Field details with an edit icon.](/tableau/next/en-us/online/en-us/Img/ask_data_rename.png) For more information, see [Create or configure a lens page on your Tableau site](https://help.tableau.com/v0.0/online/en-us/ask_data_lenses.htm#Create). ### Embed metrics into webpages Include metrics on the webpages and apps where they are relevant by embedding them. To embed a metric, copy the embed code provided on your Tableau site or write your own embed code. An embedded metric follows the same sign in and permission restrictions as the site the metric is embedded from on Tableau Cloud or Tableau Server, so your metric's data is secure. For more information, see [Embed Metrics into Webpages](https://help.tableau.com/current/pro/desktop/en-us/embed_metrics.htm). ### Configure new comparisons and statuses for metrics When you create a metric, you can now adjust the date range, configure the historical comparison, and set status indicators. The comparison and status you set are displayed on the metric card, giving users an easy to understand indicator of how the metric is performing compared to a prior point in time or a specific value you’ve defined. For more information see, [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/v0.0/online/en-us/metrics_create.htm). ![Grid of profit metrics with good and bad statuses](/tableau/next/en-us/online/en-us/Img/metrics_grid.png) ### Salesforce Admin Insights and Nonprofit Cloud After connecting to Salesforce, you can now publish additional workbooks and data sources for Salesforce Admin Insights and Nonprofit Cloud. The content is customized for your organization and allows you to explore your Salesforce data in Tableau Cloud. For more information, see [Create Workbooks with Salesforce Data](https://help.tableau.com/v0.0/online/en-us/to_connect_salesforce.htm). ### Data Management ### Virtual connections and data policies - part of Data Management Virtual connections and data policies are included in the separately licensed Data Management capabilities for Tableau Cloud. These new data management features enable you to provide a single, centralized connection to a database for your users, as well as define row-level security on the tables in the connection using a data policy. For more information, see [About Virtual Connections and Data Policies](https://help.tableau.com/v0.0/online/en-us/dm_vconn_overview.htm). #### With virtual connections you get Quick Help As you create and test your new virtual connection, help is just a click away. Delivered in the product, Quick Help shows relevant just-in-time help content based on where you are or what you're doing in the virtual connection editor. Simply click the ? icon on the top right of your screen to open the movable help window. ![Quick help pane appears in the product](/tableau/next/en-us/online/en-us/Img/dm_vconn_quick_help.png) ### Tableau Catalog - part of Data Management **Custom SQL information on content lineage pages** - Catalog lineage pages show information that helps users understand more about custom SQL in their content. - A banner on lineage pages identifies content that uses custom SQL. - You can review the custom SQL query. - A warning is shown for custom SQL queries that could result in incomplete lineage. For more information, see [Supported lineage](https://help.tableau.com/current/pro/desktop/en-us/customsql.htm#supported-lineage) in the Tableau Desktop and Web Authoring Help. **Tableau Catalog supports the T-SQL dialect in custom SQL queries** - Support for the T-SQL dialect means Tableau Catalog can provide more complete lineage when custom SQL is used. For more information, see [Supported queries](https://help.tableau.com/current/pro/desktop/en-us/customsql.htm#supported-queries) in the Tableau Desktop and Web Authoring Help. **Data quality warnings links in email automatically open the Data Details pane** - When you click a data quality warning in a subscription email, the view opens with the Data Details pane shown. Also, a new embed parameter, showDataDetails, is available to open the view with the Data Details pane shown. For more information, see [Parameters for Embed Code](https://help.tableau.com/current/pro/desktop/en-us/embed_list.htm) in the Tableau Desktop and Web Authoring Help. **Inherited descriptions appear in the fields list on lineage pages** - When a description for a field exists upstream from the field, it now appears in the fields list on lineage pages with information about where the description is inherited from. For more information, see [How field descriptions are inherited](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm#how-field-descriptions-are-inherited-if-tableau-catalog-is-enabled) in the Tableau Desktop and Web Authoring Help. **Easily create Prep flows based on external assets** - Now you can use databases and tables as starting points for new flows in Prep web authoring. For more information, see [Start a new flow](https://help.tableau.com/current/prep/en-us/prep_startflow.htm#start-a-new-flow) in the Tableau Prep Help. Added in September 2021 ### Share, collaborate, and keep up with your data in Slack You can now see Tableau notifications in Slack with the Tableau for Slack app, which lets Tableau Cloud site administrators connect with a Slack workspace. Once connected, licensed Tableau users can receive notifications in Slack when they’re mentioned in a comment, when teammates share content with them, or when data meets a specified threshold in a data-driven alert. For more information, see [Integrate Tableau with a Slack Workspace](https://help.tableau.com/v0.0/online/en-us/slack_admin.htm). ### Save workbooks in Personal Space Creators and Explorers can now edit and save content to Personal Space, a private location for each web author on a Tableau site. Content saved to Personal Space is private to the user and controlled by added resource governance. In Settings, you can enable Personal Space and set user storage limits. Administrators can continue to access and manage all content, including Personal Space content. For more information, see [Create and Edit Private Content in Personal Space](https://help.tableau.com/v0.0/online/en-us/personal_space.htm). ### Set your workbook data freshness policy Strike a balance between performance and data freshness by using workbook data freshness policies. While cached data is great for the performance of live-connection workbooks, seeing stale cached data in a viz can cause confusion and frustration for workbook users. Now with data freshness policies, workbook owners or administrators can choose granular data freshness policies, so the freshest data appears when your business needs it. From the Workbook Details dialog in Tableau Cloud or Tableau Server, choose **Edit Data Freshness Policy**. Then, choose one of the following: - **Site default** (12 hours in Tableau Cloud) - **Always live** (Tableau will always get the latest data.) - **Ensure data is fresh every**...then, set your interval, such as every 12 hours. - **Ensure data is fresh at**...then set your days and times, such as Monday, Wednesday, and Friday. at 09:00 AM Pacific time. Data freshness policies allow you to optimize workbook performance on a schedule that meets the needs of your business. For more information, see [Set a Data Freshness Policy for Query Caches](https://help.tableau.com/v0.0/online/en-us/data_freshness_policy.htm). ![Animation of editing a data freshness policy](/tableau/next/en-us/online/en-us/Img/data_freshness.gif) ### Rename published data sources In Tableau Cloud and Tableau Server, you can now rename a published data source for which you have **Save** permissions. To rename a published data source, click the **More actions** menu, and choose **Rename**—just like renaming workbooks. You can also rename a published data source using the [Update Data Source REST API](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#update_data_source). When a published data source is renamed, all workbooks that use that data source will use the new name after the next data source refresh is complete. For more information, see [Best Practices for Published Data Sources](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources_about.htm). ### Use axes animations to see and understand changes in scale Axes animations are now available in Tableau Desktop, Tableau Cloud, and Tableau Server. For example, when you filter your viz to include a new data group, you’ll see that the scale of the axis changes because a new value was added. Axes animations allow you to see changes of scale in context so you can make better conclusions about your data. For more information, see [Format Animations](https://help.tableau.com/current/pro/desktop/en-us/formatting_animations.htm). ![Animation of axes changing when categories are filtered](/tableau/next/en-us/online/en-us/Img/axes_animations.gif) ### Use advanced filtering From wherever you use Tableau, you can now use advanced filtering that was previously available only in Tableau Desktop. Use Wildcard filtering to filter for strings that match your filter criteria. Or, author Formulas that work with Conditions or Top N filters. For more information, see [Filter categorical data (dimensions)](https://help.tableau.com/current/pro/desktop/en-us/filtering.htm#filter-categorical-data-dimensions). ### Set new permission capability for metrics The Create/Refresh Metrics permission capability has been added for workbooks. For more information, see [Permission Capabilities and Templates](https://help.tableau.com/v0.0/online/en-us/permissions_capabilities.htm) in the Permissions topic. Prior to 2021.3, the Create/Refresh Metrics capability was controlled by the Download Full Data capability. On workbooks created prior to 2021.3, users who had the Download Full Data capability will have the Create/Refresh Metrics capability. This new capability provides finer-grained control over your data, allowing you to grant users the ability to create metrics while denying the ability to view or download the full data for the view. ### Control access to Explain Data with new site setting and Run Explain Data permission capability Tableau administrators can now control the availability of Explain Data in site settings. Prior to 2021.3, the ability to enable or disable Explain Data was controlled at the server level only using the tsm configuration set option ExplainDataEnabled. Authors can now control the availability of Explain Data at the workbook level using the Run Explain Data permission capability. For more information, see [Explain Data](https://help.tableau.com/v0.0/online/en-us/permissions.htm#explain-data) in the Permissions topic. **Note**: To make Explain Data available in viewing mode, a workbook author must also select the option **Allow Explain Data to be used in this workbook when viewed online** in the Explain Data Settings dialog box. For more information, see [Control Access to Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_control_access.htm). ### Limit the number of tags per item A new setting allows you to limit the number of tags that users can add to Tableau content, such as workbooks and metrics, and external assets, such as databases and tables. This setting ensures that tags don’t pose resource consumption problems. When you lower the tag limit, it prevents new tags from being added above the limit, but it doesn’t remove existing tags on items in excess of the limit. For more information, see [Site Settings Reference](https://help.tableau.com/v0.0/online/en-us/sites_add.htm). ### Ensure JDBC or ODBC connection customizations are used by Bridge If a [Tableau Datasource Customization (TDC) file](https://help.tableau.com/current/pro/desktop/en-us/connect_customize.htm) is used to customize your generic JDBC or ODBC connections, you can use the steps described in [Use .tdc files for generic JDBC or ODBC connections](https://help.tableau.com/v0.0/online/en-us/to_sync_client_settings.htm#tdc) to ensure those customizations are used by Bridge as well. ### Monitor Bridge refreshes using JSON logs Create data sources and views to monitor refresh jobs by connecting to a Bridge client’s JSON log files. For more information, see [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#json). ### Provide feedback to Ask Data lens authors If you have questions about the structure of a lens or how best to use it with Ask Data, you can send feedback directly to the author. 1\. To the left of the query box for Ask Data, click the "i" icon. ![Hovered over information icon showing the Ask Data tips tooltip.](/tableau/next/en-us/online/en-us/Img/ask_data_tips_button.png) 3\. At the bottom of the tips dialog, click Contact the Lens Author. This option is enabled by default, but lens authors can hide it by following the steps in [Let users email you questions about a lens](https://help.tableau.com/v0.0/online/en-us/ask_data_lenses.htm#Let). ### Use terms previously reserved for analytical functions in Ask Data Previously, analytical terms found in data source field names and values were ignored by Ask Data. But now it treats terms like "average," "group," "filter," "limit," "sort," and "date" just like any other form of data, letting you analyze data sources without needing to revise their contents. ### Access table calculations in Ask Data If a published data source contains calculated fields with table calculations that aggregate or sort, Ask Data now indexes and analyzes those just like other fields. (Table calculations that filter or limit data are not supported.) ### Use longer field values in Ask Data Ask Data now indexes field values with lengths of up to 200,000 characters, far above the previous limit of 10,000. ### Set up custom OAuth for Dremio Beginning with version 2021.3, you can set up custom OAuth for Dremio. For more information, see [OAuth Connections](https://help.tableau.com/v0.0/online/en-us/protected_auth.htm#custom). ### Data Management #### Tableau Catalog - part of Data Management **Inherited descriptions appear in web authoring** - When a description for a field exists upstream from the field, it now appears in web authoring with information about where the description is inherited from. For more information, see [Describe fields in a published data source](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm) in the Tableau Desktop and Web Authoring Help. **Assets in personal spaces are indexed** - Tableau Catalog indexes assets in personal spaces, but users who browse through the lineage tool see **Permissions required** instead of information about workbooks in personal spaces. **Data quality warnings appear in subscription emails** - Subscription emails can include data quality warnings for workbooks or views if their upstream assets have warnings. For more information, see [Data quality warnings in subscriptions](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm#subscriptions). Added in August 2021 ### See color-coded data types and simplified phrasing for limiting and sorting in Ask Data As you create queries in Ask Data, you'll see helpful color-coded icons that identify data types such as numbers, text strings, tables, and so on. Phrasing for limiting filters and sorting has been simplified too, making Ask Data's interpretations of your queries more clear. ![Ask Data UI showing modular phrasing with field names. ](/tableau/next/en-us/online/en-us/Img/ask_data_simple_phrasing.png) ### Identify elements used in interpretations for Ask Data Ask Data has added visual feedback on how your inputs are used in interpretations. Ignored words are grayed out; hovering over remaining words highlights how they're incorporated in the interpretation above. ![Ask Data mapping.](/tableau/next/en-us/online/en-us/Img/ask_data_mapping.gif) ### Edit field descriptions for Ask Data lenses Lens authors can now customize the description that appears when users hover over a field, better explaining its purpose to the audience of lens users. To change a Description entry, click the pencil icon to the right of a field name. ![A dashboard with the Order Profitable? value selected and the following description highlighted: a level of detail expression that calculates profitability for each order.](/tableau/next/en-us/online/en-us/Img/ask_data_description.png) Added in June 2021 ### Tableau with MFA As the security landscape evolves and threats that can compromise user credentials grow more common, it's important to implement strong security measures to protect your organization and users. If your organization doesn’t work directly with an single sign-on (SSO) identity provider (IdP), you can enable multi-factor authentication (MFA) with Tableau authentication to better secure your user sign-in process. For more information, see one of the following: - If you’re a site admin, see [About multi-factor authentication and Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/security_auth.htm#mfa_requirement). - If you’re a user, see [Register for multi-factor authentication](https://help.tableau.com/v0.0/online/en-us/to_signin.htm#mfa_register_user). ### Streamlined site settings for Ask Data Streamlined site settings for Ask Data now disable or enable the feature site-wide for all data sources. If it's enabled site-wide, indexing frequency remains customizable for each data source. For more information, see [Disable or Enable Ask Data for a Site](https://help.tableau.com/v0.0/online/en-us/ask_data_enable.htm). ### Organize items in a collection Collections are like playlists that let users organize content in a way that is meaningful to them. Viewers, Explorers, and Creators can all create and share collections. For more information, see [Organize Items in a Collection](https://help.tableau.com/current/pro/desktop/en-us/collections.htm). Note that if you participated in the limited preview for collections, the site setting to control public collections no longer exists. Now, permissions for collections are controlled the same way as other types of content. For more information, see [Permissions for Collections](https://help.tableau.com/current/online/en-us/permissions.htm#collections). ### Create workbooks with Salesforce data You can now integrate Salesforce data into Tableau Cloud to create starter content for users on your site. Once you connect to Salesforce, Tableau publishes ready-to-use workbooks and data sources to help jumpstart analysis into your Sales and Service Clouds. For more information, see [Create Workbooks with Salesforce Data](https://help.tableau.com/v0.0/online/en-us/to_connect_salesforce.htm). ### Configure settings for extracts in web authoring You can now configure settings for extracts that you create in Web Authoring. Optionally, configure options to tell Tableau how to store, define filters for, and limit the amount of data in your extract. For more information, see [Create Extracts on the Web](https://help.tableau.com/v0.0/online/en-us/datasource_extract.htm) . ### Bring Einstein Discovery predictions into your Prep flows on the web Beginning with version 2021.2, you can bring prediction models built in Einstein Discovery directly into your Prep flows on the web. **Note**: You must have a Salesforce license and user account that is configured to access Einstein Discovery to use this feature. With the power of machine learning and artificial intelligence, you can bulk score your flow data and generate new fields for predicted outcomes at the row level, as well as add top predictors and recommended improvement fields to include data about which fields contributed to the predicted outcome. Add a Prediction step to your flow, sign into Einstein Discovery and choose from deployed models, and apply them to your flow data. Then generate your flow output and use the new data source to analyze the predicted outcomes in Tableau. This feature was first introduced in Tableau Prep Builder in version 2021.1.3. For more information, see [Add Einstein Discovery Predictions to your flow](https://help.tableau.com/current/prep/en-us/prep_predictions.htm) in the Tableau Prep help and [Create and Interact with Flows on the Web](https://help.tableau.com/v0.0/online/en-us/web_author_flows.htm). ### Multiple analytics extensions in a site Beginning with version 2021.2, you can now create multiple analytics extensions connections for each site. This means that organizations with different language or connection requirements can use analytics extensions on the same Tableau Server site, with different workbooks using different connections. For more information on configuring analytics extensions for your site, see [Configure Connections with Analytics Extensions](https://help.tableau.com/v0.0/online/en-us/config_r_tabpy.htm). For details on using analytics extensions, see [Pass Expressions with Analytics Extensions](https://help.tableau.com/current/pro/desktop/en-us/r_connection_manage.htm) (Tableau Desktop and Web Authoring Help). **Note:** As of 2021.2, Einstein Discovery analytics extensions are still limited to one per site. ### Share explanations from Explain Data in published dashboards Explain Data has a reimagined user interface optimized for a broader audience of business users. Authors (Creators or Explorers with editing permissions) can now enable Explain Data for viewers of dashboards and sheets in published workbooks. Viewers can select a mark of interest in the view and run Explain Data to explore their data more deeply than before. Access to Explain Data in viewing mode is not enabled by default, so authors will need to enable this option. For information on how to enable Explain Data in viewing mode, see [Control Access to Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_control_access.htm#EnableExplainData). For more information on Explain Data, see [Discover Insights Faster with Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data.htm), [Get Started with Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_basics.htm), and [Requirements and Considerations for Using Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_requirements.htm#Control). ### Configure custom OAuth As a site admin, you can now configure custom OAuth clients for your site to override default OAuth clients. For more information, see [Configure custom OAuth](https://help.tableau.com/v0.0/online/en-us/protected_auth.htm#custom_oauth_server). ### Keep more data fresh using Bridge Bridge adds support for the following connectors: - Alibaba AnalyticsDB for MySQL - Alibaba Data Lake Analytics - Databricks - Denodo - Impala - Kyvos For more information about Bridge connectivity, see [Connectivity with Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm). ### Explore new Admin Insights data sources Get more visibility into your Tableau Cloud site with new Admin Insights data sources. You can now connect to the Groups data source to identify the group membership of users or the Site Content data source for governance information about content items on your site. For more information, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Tableau Catalog - part of Data Management **Add Field Descriptions** - You can add descriptions for fields in a published data source that then display in the Description column on the data source page Lineage tab. You can also see the description on the Data tab when you build a visualization. For more information, see [Describe fields in a published data source](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm#describe-fields-in-a-published-data-source) in the Tableau Desktop and Web Authoring Help. **Data Quality Warning Updates** - **Formatted text support for warning messages** - When you create or edit a data quality warning message, you can format the text with bold, underline, and italics, and include a link or an image. For more information, see [Set a Data Quality Warning](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm#how-to-set-a-quality-warning). - **Message required for warnings** - When you create a data quality warning, you're now required to enter a message to display to users. (This doesn't apply to warnings generated when you set Tableau to monitor for extract refresh or flow failures.) For more information, see [Set a Data Quality Warning](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm#how-to-set-a-quality-warning). **Inherited descriptions appear in Tableau Desktop** - When a description for a field exists upstream from the field, it now appears in Tableau Desktop with information about where the description is inherited from. For more information, see [Describe fields in a published data source](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm#describe-fields-in-a-published-data-source) in the Tableau Desktop and Web Authoring Help. **Full table name appears** - The table's full name has been added to the table page. **Filter by tags** \- You can now filter databases, files, and tables by tags in the Connect To dialog box. **Filter by embedded or non-embedded** - On the External Assets page, you can filter databases, files, and tables by asset category: embedded or non-embedded. ### Create parameter actions on the web You can now create parameter actions in both Tableau Cloud and Tableau Server. When you create a parameter action, you customize how data is displayed in your viz. And users can change a parameter value by interacting directly with your viz. For more information, see [Parameter Actions](https://help.tableau.com/current/pro/desktop/en-us/actions_parameters.htm). ### Create set actions on the web You can now create set actions in both Tableau Cloud and Tableau Server. Use sets to define a subset of data, and then use set actions to control how members in a set compare to other data in the view. For more information, see [Set Actions](https://help.tableau.com/current/pro/desktop/en-us/actions_sets.htm). Added in April 2021 ### Salesforce Authentication If your organization uses Salesforce, you can enable Tableau Cloud to use Salesforce accounts for single sign-on with OpenID Connect. When you enable Salesforce authentication, users are directed to the Salesforce sign-in page to enter their credentials, which are stored and managed in Salesforce. Minimal configuration may be required. See [Salesforce Authentication](https://help.tableau.com/v0.0/online/en-us/security_auth_sfdc.htm). Added in March 2021 ### See new comment and share notifications in redesigned notification center Users can now see notifications for new comments and shares by selecting the bell icon in the top right corner of their Tableau site. The redesigned notification center also displays updates for flows and extract jobs. With this update, old notifications will continue to be sent by email, but will not appear in the notification center. To continue receiving older notifications via email, navigate to site settings. Under Manage Notifications, select Email for each notification type. For more information, see [Tour Your Tableau Site](https://help.tableau.com/current/pro/desktop/en-us/navigating.htm). For settings information, see [Site Settings Reference](https://help.tableau.com/v0.0/online/en-us/sites_add.htm). ### Tableau Catalog - part of Data Management **Automated data quality warning** - You can set Tableau to monitor for extract refresh failures and for flow run failures. When a failure occurs, Tableau generates a data quality warning that displays to users. For more information, see [Set a Data Quality Warning](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm). **Quick search results expanded** - Quick search results now include tags on external assets. #### Add Einstein Discovery predictions to Tableau dashboards With the new Einstein Discovery dashboard extension, as users select marks in a view, they see dynamic updates to predictions and suggestions to improve predicted outcomes. Authors can drag the Extension object onto the dashboard canvas, select Einstein Discovery from the extensions gallery, and then configure the extension in Tableau Cloud. For more information, see [Explore Predictions in Tableau with the Einstein Discovery dashboard extension](https://help.tableau.com/current/pro/desktop/en-us/einstein_discovery_dashboard_extension.htm). For information on required licenses, access, and permissions in Salesforce and Tableau, see [Requirements for access](https://help.tableau.com/current/pro/desktop/en-us/einstein_discovery_predictions.htm#Requirem). For an introduction to Einstein Discovery in Tableau, see the [Einstein Discovery in Tableau](https://www.tableau.com/products/add-ons/einstein-discovery) page and [demo](https://www.tableau.com/learn/webinars/einstein-discovery-tableau-demo) on [tableau.com](https://www.tableau.com/). For details on configuration steps required in order to enable the Einstein Discovery dashboard extension, see [Configure Einstein Discovery Integration](https://help.tableau.com/v0.0/online/en-us/config_einstein_extensions.htm). Added in December 2020 ### Create extracts on the web Now you can create extracts directly in web authoring, without using Tableau Desktop. For more information, see [Create Extracts on the Web](https://help.tableau.com/v0.0/online/en-us/datasource_extract.htm) . You can extract new workbooks in addition to existing workbooks. Optionally, the extract creation can run in the background and you can be notified when it's completed. This will let you close your authoring session while the extract is being created, which can be helpful with large extracts that might take a long time. ### Create and interact with flows on the web You can now create flows to clean and prepare your data using either Tableau Prep Builder, Tableau Server, or Tableau Cloud. Connect to your data, build a new flow, or edit an existing flow and your work is automatically saved every few seconds as you go. Create draft flows that are only available to you or publish your flow to make it available for others. Run your individual flows right from the web or run your flows automatically on a schedule using Tableau Prep Conductor if you have Data Management capabilities. For more information, see [Create and Interact with Flows on the Web](https://help.tableau.com/v0.0/online/en-us/web_author_flows.htm). ### Organize items in a collection (limited preview) Collections are like playlists that let you organize your Tableau content. Create a private collection for personal reference, or make a public collection that can be viewed by other users on your site. For more information, see [Organize Items in a Collection](https://help.tableau.com/current/pro/desktop/en-us/collections.htm). As a Tableau administrator, you can control whether users can set collections to public by changing the site setting Allow public collections. Collections are available as a limited preview for Tableau Cloud. You won’t see collections unless your site is part of the preview. If you’re a Tableau administrator who would like to join the preview, [sign up here](https://www.surveymonkey.com/r/WPJSL6D). ### Tableau Catalog updates - part of Data Management Tableau Catalog is included in the separately licensed Data Management capabilities for Tableau Server and Tableau Cloud. For more information, see [About Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_overview.htm). The following features are included in this release: **Data Quality Warning History admin view** - Site administrators can see how data quality warnings are being used on the site using the pre-built admin view, Data Quality Warning History. For more information see [Data Quality Warning History](https://help.tableau.com/v0.0/online/en-us/dm_adminview_dqw.htm). **See quality warning details in Tableau Desktop** - Tableau Desktop users can hover over the warning icon on the Data tab to see details about the data quality warnings affecting the data in their workbook. For more information, see [Set a Data Quality Warning](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm). **Metrics appear in lineage and show data quality warnings** - Data quality warnings now appear on metrics affected by a warning. Metrics also appear in the Lineage tool, enabling you to see how a metric might be affected by data changes when performing impact analysis. For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/v0.0/online/en-us/metrics_create.htm#metrics-appear-in-tableau-catalog). ### Tableau Prep Conductor updates - part of Data Management Now, Data Management is only needed to schedule and monitor flows with Tableau Prep Conductor. Other flow-related tasks no longer require you to have Data Management. For more information, see [Tableau Prep Conductor](https://help.tableau.com/v0.0/online/en-us/prep_conductor_online_intro.htm). ### Analytics extensions Analytics extensions allow you to extend Tableau dynamic calculations in a workbook with languages like R and python, and with other tools and platforms. These settings endpoints enable you to configure analytics extensions on your site in Tableau Cloud. See [Configure Connections with Analytics Extensions](https://help.tableau.com/v0.0/online/en-us/config_r_tabpy.htm). ### Ask Data Usage and Adoption admin view You can now see how users engage with Ask Data on a site, using the new Ask Data Usage admin view. The dashboard highlights the top Ask Data users, data sources, and data source owners, along with headline value metrics. For more information, see [Ask Data Usage](https://help.tableau.com/v0.0/online/en-us/adminview_ask_data_usage.htm). Added in September and October 2020 ### Bridge (legacy) schedules have moved to a new location For an extract data source that needs to use a Bridge (legacy) schedule to keep data fresh, you can find and configure a Bridge (legacy) schedule from its new location in the actions menu on the data source page. For more information, see [Set Up a Private Network Refresh Schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm). ![Tableau Bridge dropdown menu with option to schedule with Bridge.](/tableau/next/en-us/online/en-us/Img/bridge_schedule_leg_actions_menu.png) **Note:** Recommended schedules have not changed location and continue to be integrated with Online refresh schedules. However, Recommended schedules is no longer labeled as "Recommended" to better reflect the integration. All the Bridge-related updates described here have been made to support the new Online [scheduling experience](https://help.tableau.com/v0.0/online/en-us/schedule_add.htm#Add). ### Custom Extract Refresh schedules Extract refresh scheduling is now fully customizable and no longer need to be selected from an pre-populated list of schedules. You now have the ability to create and manage customized hourly, daily, weekly, and monthly schedules for the extract refreshes. For more information, see [Schedule Refreshes on Tableau Cloud](https://help.tableau.com/current/online/en-us/schedule_add.htm). ### Turn off Web Page objects To prevent Web Page objects in dashboards from displaying target URLs, deselect Enable Web Page Objects in the site settings. Added in August 2020 ### Set the Site Time Zone for Extracts The default time zone for extract-based data sources in a site is Coordinated Universal Time (UTC). Site administrators can now choose to set a different time zone. For more information, see [Change Time Settings](https://help.tableau.com/v0.0/online/en-us/tz_for_extracts.htm). ### Automatically Suspend Extract Refreshes for Inactive Workbooks To save resources, Tableau can automatically suspend extract refresh tasks for inactive workbooks. This feature applies to full extract refreshes only, not to incremental extract refreshes. This feature only applies to refresh schedules that run weekly or more often. For more information, see [Automatically Suspend Extract Refreshes for Inactive Workbooks and Data Sources](https://help.tableau.com/v0.0/online/en-us/extract_auto_suspend.htm). ### Manage Licenses for User Groups with Grant Role on Sign In Administrators can set a minimum site role for user groups and choose Grant role on sign in when creating or modifying that user group. Enabling Grant role on sign in reduces manual work to manage licenses, since administrators can designate site role capabilities by group, and provision licenses when a user actually needs it. By waiting to grant licenses until users sign in, administrators can streamline license provisioning, without granting licenses to inactive users. For more information, see [Grant License on Sign In](https://help.tableau.com/v0.0/online/en-us/grant_role.htm). ### Tag Stale Content for Archiving The Stale Content Admin view that was introduced in 2020.2, now has an added functionality that allows you to tag content as stale. You can then choose to archive the tagged content. For more information, see Stale Content. ### Tableau Catalog updates - part of Data Management Tableau Catalog is included in the separately licensed Data Management for Tableau Server and Tableau Cloud. For more information about Tableau Catalog, see [About Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_overview.htm). The following features are included in this release: **See data quality warnings in Tableau Desktop** - When you open a workbook in Tableau Desktop that has a data quality warning, the warning icon (either a blue circle or a yellow triangle with an exclamation point) appears on the Data tab on the sheet page of the workbook. For more information, see [Set a Data Quality Warning](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm) **'Sensitive data' warning type added** - You can use this new warning type to set a data quality warning for sensitive data in your organization. For more information, see [Set a Data Quality Warning](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm) **Embedded assets are listed in External Assets** - You can now see embedded assets listed in the External Assets page. For more information, see [Use Lineage for Impact Analysis](https://help.tableau.com/v0.0/online/en-us/dm_lineage.htm#embedded-asset-appears-in-external-assets). **Tag external assets** - Add tags to databases, tables, and columns, which enables you to, among other things, tag tables and columns with personally identifiable information (PII). For more information, see [Tag Items](https://help.tableau.com/current/pro/desktop/en-us/tags.htm) in Tableau Desktop and Web Authoring Help. ### Web authoring and interaction with views New features and enhancements related to web authoring and interacting with views on the web are listed in [What's New in Tableau for Users](https://help.tableau.com/current/pro/desktop/en-us/whatsnew_previous_versions_desktop_webauthor.htm#version-20203) and [Web Authoring and Tableau Desktop Feature Comparison](https://help.tableau.com/current/pro/desktop/en-us/server_desktop_web_edit_differences.htm). For topics related to web authoring and interacting with views, see [Using Tableau on the Web](https://help.tableau.com/current/pro/desktop/en-us/web_author_home.htm). Added in June 2020 ### Tableau Bridge **No Bridge upgrade or installation required – for publishers** For publishers working exclusively with data sources that connect to on-premises relational data, you no longer need to maintain your current client or upgrade to the latest. As long as you migrate your refresh schedules using Recommended schedules (next bullet), and your admin has installed and set up at least one Bridge 2020.2 client, you’re all set. For more information, see [Set Up a Private Network Refresh Schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm). **Integrated refresh schedules** Refresh schedules for Bridge are now integrated with Tableau Cloud refresh schedules. For publishers, integrated refresh schedules, called Recommended schedules, mean: - You have more control and flexibility to manage your own data sources. - Your dependence on site admins is reduced for certain data source management tasks like updating connections credentials. ![The Schedule an Extract Refresh dialog with recommended refresh schedules.](/tableau/next/en-us/online/en-us/Img/bridge_schedule_rec.png) For more information, see [Bridge refresh schedules versus Bridge legacy schedules](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm#schedules). **Keep private cloud data fresh** Use Bridge to keep cloud data, accessible only from inside a private network, fresh. For more information, see [Connect to Private Cloud Data](https://help.tableau.com/v0.0/online/en-us/to_bridge_vpc.htm). **Pooling enabled for extract refreshes** Clients can pool extract refreshes, in addition to live queries, across all 2020.2 clients in the network. For site admins, pooling of extract refreshes means: - You can focus on providing availability, throughput, and latency. - You can optimize the composition of your client pool to match the characteristics of your live query and extract refresh workloads. For more information, see [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm). **Updated Settings page** For site admins, the simplified Bridge Settings page allows you to configure which clients to include or exclude from the pool and displays a warning icon to make it easier to know which clients need to be upgraded to the latest version. For more information, see [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#registered). ![A table displaying clients connection status.](/tableau/next/en-us/online/en-us/Img/bridge_settings_pooling_warning.png) **Note:** The warning icon shows only when there is a newer client available for download. The warning icon is not an indication that there are issues with the client or related Bridge data sources. Added in May 2020 ### Site Capacity Updates for Extract Refreshes To improve site performance and ensure a consistent scheduling experience, sites are allocated daily and concurrent extract refresh capacity. For more information, see [Tableau Cloud Capacity](https://help.tableau.com/v0.0/online/en-us/to_site_capacity.htm). ### Use relationships to combine data for multi-table analysis Relationships are a new, flexible way to combine data for multi-table analysis in Tableau. Data sources now support multi-table data models in a new logical layer. Tableau recognizes the separate tables in your data source and performs aggregations at the native level of detail for each table. Creators can combine tables using relationships. Using relationships between logical tables makes it easier to explore and analyze multi-table data at the right level of detail, without having to write specialized calculations to control aggregations like averages and totals. You do not need to specify join types for relationships; during analysis Tableau automatically selects the appropriate join types based on the fields and context of analysis in the worksheet. **Note**: Your workbook must use an embedded data source for you to be able to edit relationships in the Data Source page in web authoring in Tableau Server or Tableau Cloud. You cannot edit the data model of a published data source. In support of multi-table analysis, several parts of the Tableau interface have changed. The Data Source page (canvas, data grid), View Data window, and the Data pane in the worksheet have all been updated to support a multi-table analysis experience. For more information, see [Changes to different parts of the interface](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_whatschanged.htm#data-source-page-changes). **Note**: View Data column order has changed in Tableau 2020.2 and later. This change is required to support relationships and logical tables. For details, see [View Data column order changes in Tableau 2020.2 and later](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_whatschanged.htm#ViewDataColOrderChange). For more information about relationships and changes to data sources, see these topics: - [What's Changed with Data Sources and Analysis in 2020.2](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_whatschanged.htm) - [Questions about Relationships, the Data Model, and Data Sources in 2020.2](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_faq.htm) - [The Tableau Data Model](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel.htm) - [Relate Your Data](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm) and [Optimize Relationships Using Performance Options](https://help.tableau.com/current/pro/desktop/en-us/datasource_relationships_perfoptions.htm) - [How Analysis Works for Multi-table Data Sources that Use Relationships](https://help.tableau.com/current/pro/desktop/en-us/datasource_multitable_analysis_overview.htm) - [Troubleshoot Multi-table Analysis](https://help.tableau.com/current/pro/desktop/en-us/datasource_multitable_analysis_overview.htm#Troubles) - [Walkthrough: Don't Be Scared of Relationships](https://help.tableau.com/current/pro/desktop/en-us/datasource_dont_be_scared.htm) Also see this Tableau blog post: [Relationships, part 1: Introducing new data modeling in Tableau](https://www.tableau.com/about/blog/2020/5/relationships-part-1-meet-new-tableau-data-model) ### Create metrics to track data Metrics help users track changes to their data. Users can create metrics from a view and use them to monitor key numbers like daily sales. For information on how users create metrics, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/v0.0/online/en-us/metrics_create.htm). ![Multiple metrics in a grid](/tableau/next/en-us/online/en-us/Img/metrics_grid.png) Tableau Cloud administrators can ensure that users are able to create metrics or disable metrics for the site. For more information, see [Set Up for Metrics](https://help.tableau.com/v0.0/online/en-us/metrics_admin.htm). ### Add a Set Control to let users quickly modify the members of a set With a Set Control, your audience can select the members of a set without necessitating edit mode. Users can simply add or remove set members by interacting directly with the card in the view. Coupled with Set Actions, you have two powerful, complementary features that make it easy to visualize the set you’re interested in. For more information, see [Create Sets](https://help.tableau.com/current/pro/desktop/en-us/sortgroup_sets_create.htm), or check out this blog post, [Powerful analytics in a user-friendly package with the set control](https://www.tableau.com/about/blog/2020/4/powerful-analytics-user-friendly-package-set-control). ### Add or remove values from a set by interacting directly with the viz Now, using Set Actions, you and your audience can use the viz itself to incrementally add values to or remove values from a set. Simply interact with the viz and choose which marks to include or exclude. Coupled with the new Set Control feature, you have two powerful ways to gain deeper insights into your data. For more information, see [Set Actions](https://help.tableau.com/current/pro/desktop/en-us/actions_sets.htm). ### Upload and open workbooks with a browser Users can now upload a Tableau workbook to your Tableau site without publishing through Tableau Desktop, the REST API, or TabCmd. In a Tableau site, users with a Creator or Explorer (can publish) site role can select New > Workbook Upload to upload a .twb or .twbx file (up to 50 MB) to a project. For more information, see [Upload Workbooks to a Tableau Site](https://help.tableau.com/current/pro/desktop/en-us/upload.htm). ![A menu with options to create a new project, workbook, or flow, or to upload an existing workbook.](/tableau/next/en-us/online/en-us/Img/uploadworkbook.png) ### Access Dashboard Starters from Home in Tableau Cloud Site Administrator Creators can now access Dashboard Starters from the Home page in Tableau Cloud. Use these pre-designed dashboards to quickly visualize data from common business applications like Salesforce or ServiceNow ITSM. For more information, see [Use Accelerators to Quickly Visualize Data](https://help.tableau.com/v0.0/online/en-us/accelerators.htm). ### Tableau Catalog updates - part of Data Management Tableau Catalog is included in separately licensed Data Management capabilities for Tableau Server and Tableau Cloud. For more information about Tableau Catalog, see [About Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_overview.htm). The following features are included in this release: **Raise the visibility of important warnings** \- You can set a data quality warning to be highly visible, so that users of a visualization that's affected by the warning see a notification, and the warning displays in a more prominent yellow color elsewhere in Tableau. For more information, see [Set a Data Quality Warning](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm) and "Use Data Details to see visualization information" in [Explore and Analyze Data in a View](https://help.tableau.com/current/pro/desktop/en-us/data_explore_analyze_interact.htm#use-data-details-to-see-visualization-information) in the Tableau Desktop and Web Authoring Help.. **Dashboards appear in the Lineage pane** - When you select the Dashboards item in the lineage, you can see a list of downstream dashboards. For more information, see [Use Lineage for Impact Analysis](https://help.tableau.com/v0.0/online/en-us/dm_lineage.htm). **Filter external assets on Certified and data quality warnings** - In addition to using search to narrow down your choices on External Assets, you can now filter databases, files, and tables by Certified and by data quality warnings. **More filters when connecting** \- When you connect to data, you can filter databases and table on connection type. ### More information on what's new Other new features and enhancements related to web authoring and interacting with views on the web are listed in [What's New in Tableau for Users](https://help.tableau.com/current/pro/desktop/en-us/whatsnew_previous_versions_desktop_webauthor.htm#version-20202) and [Web Authoring and Tableau Desktop Feature Comparison](https://help.tableau.com/current/pro/desktop/en-us/server_desktop_web_edit_differences.htm). For topics related to web authoring and interacting with views, see [Using Tableau on the Web](https://help.tableau.com/current/pro/desktop/en-us/web_author_home.htm). Added in February 2020 ### Refresh parameters automatically with dynamic parameters Now you can set a parameter’s current value to be the result of a single-value, view-independent calculation. In addition, you can refresh a parameter's list of values (or domain) based on a data source column. This means that each time the workbook is opened and Tableau connects to the data source referenced by the parameter, every place in the workbook that references the parameter will use the latest value or domain. For more information, see [Create Parameters](https://help.tableau.com/current/pro/desktop/en-us/parameters_create.htm). ### Automate user provisioning and group synchronization through an external identity provider You can automate adding or removing users from Tableau Cloud or adding or removing members from groups using your identity provider (IdP). Tableau Cloud IdP user management uses the System for Cross-domain Identity Management (SCIM) standard, which is an open standard for automating the exchange of user identity information. Currently we support SCIM with the following IdPs: - Okta - OneLogin SCIM is used to provision users in cloud applications such as Tableau Cloud. Cloud IdPs centrally manage user identities, including assigning users to applications and groups. The IdP uses the SCIM standard to ensure that “downstream” applications are kept in sync with the provisioning assignments set up with the IdP. Managing users in this way improves security, and can greatly reduce the amount of manual work that Tableau Cloud site administrators need to do to manage site users and group membership. For more information, see [SCIM](https://help.tableau.com/v0.0/online/en-us/scim_config_online.htm). ### Support for login-based license management Login-based license management, helps you manage licensing for users with Creator roles on Tableau Server and Tableau Cloud. Users with Explorer or Viewer roles cannot use this feature. If you’re using Role Based Subscriptions with Tableau Server or Tableau Cloud, you can simplify your license management using login-based license management to eliminate separate Tableau Desktop and Tableau Prep Builder product keys. You only need to manage one or more product keys for on-premises Tableau Server, or in the case of Tableau Cloud, you don’t need to manage any product keys at all. For more information, see [Activate Tableau using Login-based license management](https://help.tableau.com/current/online/en-us/license_lblm.htm). ### Updates for Permission Dialog Set permissions faster with the new permissions dialog. New permission [templates](https://help.tableau.com/current/online/en-us/permissions.htm#templates) and capability groupings match common user scenarios. Editing permission rules is easier than ever with direct editing—double click to enter edit mode. Search for groups and users simultaneously without preselecting your choice. [Copy](https://help.tableau.com/current/online/en-us/permissions.htm#copy-and-paste-permissions) a custom permission rule and paste it for another group or user. And hand off project management to [Project Leaders](https://help.tableau.com/current/online/en-us/permissions.htm#set-a-project-leader) more intuitively with the new setting. For more information on permissions, see [Permissions](https://help.tableau.com/current/online/en-us/permissions.htm). ### Lock nested projects Regulating permissions is now more flexible. Project permissions can be locked independently for nested projects. Top-level projects can act as organizational containers for projects with different permission models. Non-admins can create new locked projects. For more information, see [Lock content permissions](https://help.tableau.com/current/online/en-us/permissions.htm#lock-content-permissions). ### **Run Now** Setting This new setting allows Administrators to configure whether to allow or block users from manually running extract refreshes, flows runs, and subscriptions. The Run Now settings are on the General settings page, and by default, is selected to allow users to run jobs manually. ### Tableau Catalog updates - part of Data Management Tableau Catalog is included in the separately licensed Data Management capabilities for Tableau Server and Tableau Cloud. For more information about Tableau Catalog, see [About Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_overview.htm). The following features are included in this release: **Added connectors** - Connect to more data from external assets. We've added support for the following connectors: Google Big Query, Google Drive, Google Sheets, Box, Dropbox, and OneDrive. **Create workbooks** - Create a workbook from the External Assets page or from a database or table page for Catalog-supported connections. For more information, see "Tableau Catalog users create workbooks from external assets" in [Creators: Get Started with Web Authoring](https://help.tableau.com/current/pro/desktop/en-us/getstarted_web_authoring.htm#tableau-catalog-users-create-workbooks-from-external-assets) in the Tableau Desktop and Web Authoring Help. **Filter on Certified and data quality warnings** - Filter data sources, databases, files, and tables by Certified, filter data sources by connections, and filter databases and tables by data quality warnings. For more information, see "Open the Connect to Data page" in [Creators: Connect to Data on the Web](https://help.tableau.com/current/pro/desktop/en-us/creator_connect.htm#open-the-connect-to-data-page), or "Connect from Tableau Desktop" in [Connect to Data by Using Tableau Server or Tableau Cloud](https://help.tableau.com/current/pro/desktop/en-us/examples_tableauserver.htm#connect-from-tableau-desktop) in the Tableau Desktop and Web Authoring Help. **Enhanced Data Details pane** - - See a sparkline with the number of times a sheet or dashboard was viewed over the last 12 weeks. - Easily see that there are Warnings on a view. - Expand a field to see its metadata, such as a description or calculation. - When a field in a workbook inherits its description, see where the description comes from. For more information, see "Use Data Details to see visualization information" in [Explore and Analyze Data in a View](https://help.tableau.com/current/pro/desktop/en-us/data_explore_analyze_interact.htm#use-data-details-to-see-visualization-information) in the Tableau Desktop and Web Authoring Help. Added in October 2019 ### Web authoring and interaction with views For a comprehensive list of new features and enhancements related to web authoring and interacting with views on the web, see the features listed under "Prepare, Author, and View Data on the Web" in [What's New in Tableau for Users](https://help.tableau.com/current/pro/desktop/en-us/help.htm#whatsnew_desktop.htm) and [Web Authoring and Tableau Desktop Feature Comparison](https://help.tableau.com/current/pro/desktop/en-us/help.htm#server_desktop_web_edit_differences.htm). For topics related to web authoring and interacting with views, see [Using Tableau on the Web](https://help.tableau.com/current/pro/desktop/en-us/help.htm#web_author_home.htm). ### Recommendations for views Tableau Cloud now provides recommendations for views to help users discover relevant content. To learn more about these recommendations, see [Discover Recommended Views](https://help.tableau.com/current/pro/desktop/en-us/recommendations.htm). You can control whether recommendations appear on your site, or whether user names appear on recommendation tooltips, by adjusting the options under Recommendations for Views on the Settings page. ### Table visualization enhancements Authors can now create wide tables with up to 50 columns. Wide tables with discrete fields can also now be scrolled horizontally. For more details, see [Define Table Structure](https://help.tableau.com/current/pro/desktop/en-us/formatting_tableoptions.htm). Also, see this post on [50-column tables](https://datavis.blog/2019/10/07/50-column-tables/) from Tableau Public Ambassador Marc Reid on the [datavis.blog](https://datavis.blog/). ### Create extracts on the web Now you can create extracts in the browser, without using Tableau Desktop. For more information, see [Create Extracts on the Web](https://help.tableau.com/v0.0/online/en-us/datasource_extract.htm) . You can also use the new `createextracts` and `deleteextracts` commands in tabcmd to create or delete extracts for a published workbook or data source. For more information, see [tabcmd Commands](https://help.tableau.com/v0.0/online/en-us/tabcmd_cmd.htm). ### Get view load times with Admin Insights (beta) Included with the latest version of Admin Insights, is the Viz Load Time Drilldown dashboard and the TS Web Requests data source. You can use both resources to help users who are authoring views better understand the experience of the users who are consuming those views. For more information, see [Explore the pre-built workbook](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm#dashboards) and [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm#datasources). The dashboard and data source are available to you as in-release beta features _by request_. To join the beta or provide thoughts and ideas about the new Admin Insights content, sign in to the [Early Feedback](https://prerelease.tableau.com/key/online_admin) site. ### Disable email notifications when Tableau Bridge clients aren't running If scheduled refreshes appear to be running outside of schedule or if you want to stop notifications you receive about clients not running, you can disable email notifications. For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#notrunning). ### Request access Users can now request access to see a project, workbook, or view when they don’t have viewing permission. When someone requests access to content, Tableau routes an email to the person who controls permissions for that content with information about the request and instructions on making access changes. For information on managing permissions, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). ### Limit visibility of user information The User Visibility site setting lets administrators manage if users with Viewer and Explorer site roles see other users and groups on the site, which can be important for sites used by multiple clients. When User Visibility is set to Limited, Explorers and Viewers cannot see information about other users, including aliases, project ownership, comments, and more. Creators and administrators (including Site Administrator Explorers) can still view user information. By default, User Visibility is set to Full. For more information, see [Manage Site User Visibility](https://help.tableau.com/v0.0/online/en-us/user_visibility.htm). ### Enable or disable Ask Data for a site As a site administrator, you can control the availability of Ask Data in the General area of site settings. For more information, see [Disable or Enable Ask Data for a Site](https://help.tableau.com/v0.0/online/en-us/ask_data_enable.htm). ### Manage Sandboxed Extensions Tableau now supports Sandboxed extensions, which are a new type of dashboard extension that run in a protected environment hosted by Tableau. Like Network-enabled extensions, Sandboxed extensions are web applications that run in custom dashboard zones and can interact with the rest of the dashboard using the [Tableau Extensions API](https://tableau.github.io/extensions-api/). While Network-enabled extensions have full access to the web, Sandboxed extensions can’t share data or make network calls outside of Tableau. Sandboxed extensions provide a new level of security for Tableau users and administrators. To learn more about controlling extensions, see [Manage Dashboard and Viz Extensions in Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/dashboard_extensions_server.htm). To learn more about extension security and strategies for deployment, see [Extension Security](https://help.tableau.com/current/server/en-us/security_extensions.htm) in Tableau Server Help. Added in September 2019 ### Support for Italian added Tableau has added support for Italian. You can now set Tableau to display the user interface in one of eleven languages: - Chinese (Simplified) - Chinese (Traditional) - English (United Kingdom) - English (United States) - French - German - Italian - Japanese - Korean - Portuguese - Spanish For more information, see [Change language and locale](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm#change-language-and-locale) in the Tableau User Help. In addition to supporting Italian in all Tableau products, the Help is also available in these languages. To read the help in your preferred language, navigate to the bottom of the [Tableau Help](https://www.tableau.com/support/help) page on the Tableau website, and select the language from the footer. ![Menu of language options](/tableau/next/en-us/online/en-us/Img/language_footer_generic.png) ### Tableau Data Management Data Management capabilities are available through a new license that helps customers manage Tableau content and data assets in their Tableau Server or Tableau Cloud environment. Tableau Prep Conductor and Tableau Catalog are included with Data Management. For more information, see [About Data Management](https://help.tableau.com/v0.0/online/en-us/dm_overview.htm). ### Tableau Prep Conductor—part of the Data Management Tableau Prep Conductor is included in the separately licensed Data Management capabilities for Tableau Server and Tableau Cloud. Tableau Prep Conductor leverages the scheduling and tracking functionality of Tableau Cloud so you can automate running flows to update the flow output instead of logging into Tableau Prep to manually run individual flows as your data changes. For more information, see [Tableau Prep Conductor](https://help.tableau.com/v0.0/online/en-us/prep_conductor_online_intro.htm). ### Tableau Catalog features—part of the Data Management Tableau Catalog is included in the separately licensed Data Management capabilities for Tableau Server and Tableau Cloud, making a variety of features available to you in the data management space. You can use Tableau Catalog to discover data, curate data assets, communicate data quality, perform impact analysis, and trace the lineage of data used in Tableau content. For more information, see [About Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_overview.htm). ### Tableau Metadata API If you're a developer and interested in accessing metadata indexed by or surfaced through Tableau Catalog, see the [Tableau Metadata API Help](https://help.tableau.com/current/api/metadata_api/en-us/index.html). ### Explore and inspect views with Explain Data Inspect, uncover, and dig deeper into marks in a viz using Explain Data. Explain Data gives you a new window into your data by proposing statistical explanations for a selected mark, including potentially related data from the data source that isn't in the current view. Creators and Explorers with editing permissions can use Explain Data when editing a view in Desktop, or editing a view on the web in Tableau Cloud or Tableau Server. Explanations give you information and visualizations on the data points might be affecting the mark value. You can then open visualizations for further exploration. For more information, see [Inspect a View using Explain Data](https://help.tableau.com/current/pro/desktop/en-us/explain_data.htm) in Tableau User help. ![Select a mark and choose Explain Data to learn more about the underlying data.](/tableau/next/en-us/online/en-us/Img/explaindata_overview.gif) ### Ask Data improvements Users can now embed Ask Data into HTML pages, adjust relative date filters, and see top and bottom outliers in context. For more information, see [Automatically Build Views with Ask Data](https://help.tableau.com/current/pro/desktop/en-us/ask_data.htm) in the Tableau User Help. ![Embed icon highlighted in a portion of a dashboard.](/tableau/next/en-us/online/en-us/Img/ask_data_embed.png) Data source owners and Tableau administrators can now add synonyms for field values, in addition to field names. For more information, see [Optimize Data for Ask Data](https://help.tableau.com/current/pro/desktop/en-us/ask_data_optimize.htm) in the Tableau User Help. ![Industry field details window with 85 unique values expanded to show examples of industry values and their synonyms. For example, lenders and credit unions are shown as synonyms for the banking industry.](/tableau/next/en-us/online/en-us/Img/ask_data_value_synonyms_expanded.png) ### Job Management Site administrators can now view, monitor, and manage jobs. For more information, see [Managing Background Jobs in Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/server_backgrounder_job_management.htm). Added in May 2019 ### Select from ten different languages for Tableau Tableau has added support for two new languages, Chinese (Traditional) and English (United Kingdom). You can now set Tableau to display the user interface in one of ten languages: - Chinese (Simplified) - Chinese (Traditional) - English (United Kingdom) - English (United States) - French - German - Japanese - Korean - Portuguese - Spanish For more information, see [Change language and locale](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm#change-language-and-locale) in the Tableau User Help. In addition to supporting two new languages in all Tableau products, the Help is also available in these languages. To read the help in your preferred language, navigate to the bottom of the [Tableau Help](https://www.tableau.com/support/help) page on the Tableau website, and select the language from the footer. ![Menu of language options](/tableau/next/en-us/online/en-us/Img/language_footer.png) ### Help Design A blue Send feedback icon is displayed in the bottom right corner of every Help page to make it easier for you to send feedback about the content in a topic. Click the icon to let us know if a topic is helpful to you, and also to comment on what needs improvement. ### Use Admin Insights to create custom admin views Enable the Admin Insights project for your site to create custom admin views about Tableau Cloud adoption, site traffic, license allocation, and more. For more information, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Configure email alerts for incomplete extract refreshes As an extract data source owner whose scheduled refreshes are performed by Tableau Bridge, you can configure Tableau Cloud to send you email alerts for incomplete refreshes. For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#refresh-alert). ### Tableau Bridge improvements Here are some additional improvements made to the Tableau Bridge client and workflow. - Access Tableau Bridge-related admin views from the client menu. - Quickly identify whether live queries are supported directly from the client. ![A Tableau Bridge linked to your data sources with live connections disabled on site.](/tableau/next/en-us/online/en-us/Img/bridge_client_livequery_disabled.png) - Receive email alerts when a scheduled refresh cannot start because the client is not running. **Note:** After Tableau Cloud's upgrade to 2019.2, some data source owners might see an influx of notifications about Tableau Bridge clients not running. For more information, see [Scheduled refreshes appear to be running outside of schedule:](https://help.tableau.com/v0.0/online/en-us/to_bridge_troubleshoot.htm#notrunning). ### Ask Data improvements For users, Ask Data now lets you ask questions in a conversational style, apply simple calculations, and create multiple sheets. For more information, see [Automatically Build Views with Ask Data](https://help.tableau.com/current/pro/desktop/en-us/ask_data.htm) in the Tableau User Help. ![Search field for adding fields or filters to a visualization.](/tableau/next/en-us/online/en-us/Img/ask_data_adjust_textbox.png) For data managers and site administrators: - Words like "year" and "date" are reserved for analytical functions and should be avoided in field names. - The ability to add synonyms for field names is now limited to data source owners and Tableau administrators, providing a more consistent experience for users. - A Usage Analytics dashboard reveals the most popular queries, top users, and other helpful information. ![A dashboard presents Ask Data usage analytics, such as unique users, user queries, suggested results, usage over time, top users, and top fields.](/tableau/next/en-us/online/en-us/Img/ask_data_usage_viz.png) For more information, see [Optimize Data for Ask Data](https://help.tableau.com/current/pro/desktop/en-us/ask_data_optimize.htm) in the Tableau User Help. ### Home page and navigation improvements For users and administrators, new navigation changes and pages make it easier to get started and locate relevant content: - Use the new Home page to access recent views, find favorite content, and see what's popular on the site. The welcome banner and actions are tailored by site role to help users get started. ![Home page content overview](/tableau/next/en-us/online/en-us/Img/home_overview.png) - Dedicated Favorites and Recents pages give users access to all of their most-important content. Use the sort and filter options on the right side of each page to find relevant content. - New left navigation panel lets users quickly jump between important pages on the site, including the Explore page, where they can see all site content in one place. The panel is responsive to screen sizes and can be collapsed. ![Navigation panel collapsing](/tableau/next/en-us/online/en-us/Img/Site_menu.gif) - When users are viewing or creating a visualization, the left navigation panel disappears to make more room for analysis. The compact header makes it easy to navigate through project hierarchy, search the site, and access favorites as needed. To learn more, see [Tour Your Tableau Site](https://help.tableau.com/current/pro/desktop/en-us/navigating.htm) in the Tableau User Help. ### Alert side panel When users select Alerts in any view, a new panel shows alerts that already exist for the viz. To create an alert that is visible for others, select Make visible to others when creating the alert. Alerts created prior to 2019.2 are not visible to others, but can be updated to be. To learn more, see [Send Data-Driven Alerts from Tableau Cloud or Tableau Server](https://help.tableau.com/current/pro/desktop/en-us/data_alerts.htm) in the Tableau User Help. ### Custom views supported for Viewer role Previously, creating custom views required a Creator or Explorer license, but now Viewers can create them too. For more information, see [Use Custom Views](https://help.tableau.com/current/pro/desktop/en-us/customview.htm) in the Tableau User Help. ### Set a default site start page Administrators can set a default start page for everyone on a site. When a site user signs into Tableau Cloud, they will land on the start page set by an administrator. For more information, see [Set the Default Start Page for All Users](https://help.tableau.com/v0.0/online/en-us/maintenance_startpg.htm). ### Web authoring improvements - Add a stored procedure with parameters when creating a data source. - See the status bar in web authoring to find information about your view, including selected marks compared to total marks, rows and columns, and aggregations. For more information on the status bar, see [Status Bar Information](https://help.tableau.com/current/pro/desktop/en-us/environment_workspace.htm#StatusBar) in the Tableau User Help. - Change aggregation of a field using the drop field menu. Right-click+drag (on macOS, left-click+Option+drag) a field on any card or shelf and select an aggregation type. This drops the field onto the card or shelf with the aggregation selected. - Create, edit, and remove parameters. Added in February 2019 ### Improved content browsing You have a new way to browse shared content. When you open a project, you will be able to see all the content that project contains—workbooks, views, data sources, flows, and nested projects—in a single grid or list. Locating content is easier, because you no longer need to navigate separate pages for different content types. For more information, see [Tour Your Tableau Site](https://help.tableau.com/current/pro/desktop/en-us/navigating.htm). ![Project showing a mixture of content types](/tableau/next/en-us/online/en-us/Img/mycontent_project.png) ### Ask Data to automatically create a viz Ask Data introduces an entirely new way to interact with your data, letting you type a question and instantly get a response right in Tableau. Answers come in the form of automatic data visualizations, with no need to manually drag-and-drop fields or understand the nuances of your data’s structure. Ask Data lets you ask sophisticated questions naturally, with support for key analytical concepts like time series and spatial analysis, and an understanding of conversational phrases like “last year”, “earliest”, and “most popular”. Ask Data is available for all user roles with direct access to data sources: Creators, Explorers, and Interactors. For more information, see [Automatically Build Views with Ask Data](https://help.tableau.com/current/pro/desktop/en-us/ask_data.htm) in Tableau User Help. ![A treemap of total price of wine by country and by variety.](/tableau/next/en-us/online/en-us/Img/ask_data_intro.png) ### Vector tile background maps Maps created on or published to Tableau Cloud or Tableau Public now use vector tiles for quicker geographic data exploring. Maps now appear sharper and smoother when you pan and zoom, and labels and icons dynamically resize or reshape to fit your view. The new vector tile maps replace the underlying technology that powers Tableau background maps for a smoother and crisper experience. The background cartography for Tableau maps has also been updated. ![Zoom in on a map.](/tableau/next/en-us/online/en-us/Img/MapZoom.gif) ### New cloud connectors for web authoring Use the Box, Dropbox, Google Drive, Google BigQuery, and OneDrive connectors to connect Tableau Cloud or Tableau Server to your data. For more information, see [Creators: Connect to Data on the Web](https://help.tableau.com/v0.0/online/en-us/creator_connect.htm). ### Project card images Project card images will no longer appear on the project card unless they are added as the last item in the project description and encapsulated with **!** (exclamation marks). For more information, see [Add a Project Image](https://help.tableau.com/v0.0/online/en-us/custom_projectimage.htm). ### Suspended subscription notifications When you subscribe to a view or a workbook, you receive an email snapshot of that content at regular intervals. Now, you'll receive an email notification if something caused your subscription to fail, with links to resume or delete the failing alert. For more information, see [Create a Subscription to a View or Workbook](https://help.tableau.com/v0.0/online/en-us/subscribe_user.htm). ### See new demographic data in Tableau Cloud and Tableau Public Tableau Cloud and Tableau Public have a new, different source of demographic data than Tableau Desktop. If your map uses a demographic data layer in Tableau Desktop, you may notice some slight differences when that map is published to Tableau Cloud or Tableau Public, including the time period and value breaks in a legend. In addition, maps that use the “Block Group” Data Layer option in Tableau Desktop will be automatically updated to “Census Tract” when published to Tableau Cloud or Tableau Public. Six demographic data layers that appear in Tableau Desktop will be absent when maps are published to Tableau Cloud or Tableau Public: - Population growth projections - Household growth projections - Housing units growth projections - Effective Buying Income (median) - Year structure built (median) - Length of Residence (average in years) Publishing maps from Tableau Desktop to Tableau Server will not result in any discrepancies. ### Filter improvements Use Ctrl-click (control-click on a Mac) to select multiple values in a multi-value filter in the view. The selected values can be non-contiguous and are indicated with a gray highlight. When the values are selected, you can then click any one of their check boxes to clear or choose the values at the same time. ### Web authoring enhancements - New cloud connectors for web authoring: Use the Box, Dropbox, Google Drive, Google BigQuery, and OneDrive connectors to connect Tableau Cloud or Tableau Server to your data. - Data improvements: Authors connecting to a new data source in Tableau Cloud or Tableau Server can now Run Initial SQL, connect to a custom SQL query, and add a join calculation to resolve mismatches between fields in a join. - To better distinguish between dashboard items, you can now rename them using the Item hierarchy area of the Layout pane or the drop-down menu for each object on the canvas. - After publishing to the web, click Preview device layouts in the browser to see how your designs look on desktop computers, tablets, and phones. For related information on new features, also see [What's New](https://help.tableau.com/current/pro/desktop/en-us/whatsnew_desktop.htm) in Tableau Desktop and Web Authoring Help. ### Review and monitor Tableau Bridge extract refresh tasks using admin views Review and monitor extract refresh tasks performed by Tableau Bridge using admin views. For more information, see [Bridge Extracts](https://help.tableau.com/v0.0/online/en-us/adminview_bridge_extract.htm). ### Configure a timeout limit for extract refreshes in Tableau Bridge To ensure that long running refresh tasks don't prevent other extracts from refreshing, you can enforce a timeout limit for refresh tasks performed by a Tableau Bridge client. For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#timeout). ### Find the Tableau Bridge client version number on Tableau Cloud As a site admin, you can check Tableau Cloud for the version numbers of the Tableau Bridge clients associated with your site. ![Client Status table with the Version column highlighted. ](/tableau/next/en-us/online/en-us/Img/to_sync_admin_client_version.png) **Note:** If the version number for a client is missing, log on to the computer where the client is installed and sign in to Tableau Cloud from the client. If the version number doesn't display after that, consider upgrading to the latest client. ### Help Design Updates have been made to help you navigate our content, including a new right-hand menu to quickly scan and select different topics on a page. Added in October 2018 ### Web authoring enhancements - Build density maps and charts. Use the density mark to create maps and charts that can help you identify "hot spots" in your data. - Add image objects to your dashboards. Easily adjust your image, add a target URL, and add alt-text to improve the accessibility of your dashboard. - Add navigation buttons to dashboards. Buttons can help users navigate to another dashboard, a sheet, or a story. Optionally customize the button with an image of your own, or add guiding tooltip text. - Make worksheets transparent by setting the worksheet background color to None. - Select Duplicate as Crosstab to insert a new worksheet into your workbook and populate the sheet with a cross-tab view of the data from the original worksheet. - Create, move, and resize point, mark, and area annotations. For related information on new features, also see [What's New](https://help.tableau.com/current/pro/desktop/en-us/whatsnew_desktop.htm) in Tableau Desktop and Web Authoring Help. ### Product help search, navigation, and layout improvements Search results within the product help have been expanded to include results for all Tableau products and help articles. Help layout and navigation, such as table of contents placement and breadcrumbs, have been updated to create a more consistent cross-product help experience. ### Secure extract data at the row level Secure your extract data at the row level using existing approaches for implementing row-level security in Tableau. For more information, see [Restrict Access at the Data Row Level](https://help.tableau.com/current/pro/desktop/en-us/help.htm#publish_userfilters.htm) in the Tableau User Help. Added in July 2018 Tableau Cloud migrated to Linux servers. For more information, see [Tableau Cloud Pod Migrations](https://www.tableau.com/support/online-upgrade#tpVxeRf3YBvOXQLW.99) on the Tableau website. ### Changes to Tableau Help Search results within the product help have been expanded to include results for all Tableau products and help articles. Help layout and navigation, such as table of contents placement and breadcrumbs, have been updated to create a more consistent cross-product help experience. ### Install Tableau Bridge separately from Tableau Desktop Beginning with the 2018.2 release, you can install Tableau Bridge separately from Tableau Desktop. For more information about Tableau Bridge requirements, compatibility with previous version of Tableau Desktop, and Tableau Bridge client installation, see [Install Tableau Bridge](https://help.tableau.com/current/online/en-us/to_bridge_install.htm). ### No auto-restart for Tableau Bridge The standalone Tableau Bridge client does not use an auto-restart interval to restart itself automatically. For more information about the auto-restart interval required by previous versions of Tableau Bridge, see [Tableau Bridge Frequently Asked Questions](https://kb.tableau.com/articles/HowTo/tableau-online-sync-client-frequently-asked-questions) in the Tableau Knowledge Base. **Note:** If you upgrade from Tableau Bridge 2018.1 and earlier to Tableau Bridge 2018.2, the auto-restart interval that remains in the configuration file is ignored. ### Font support in Tableau Cloud Tableau Cloud includes the following "web safe" fonts: Arial, Courier New, Georgia, Tableau, Times New Roman, Trebuchet MS, and Verdana. If a visualization uses a font that is not available on Tableau Cloud, Tableau Cloud displays the visualization using a default system font instead. For more information, see [Fonts Not Displaying as Expected After Publishing](http://kb.tableau.com/articles/Issue/fonts-not-displaying-as-expected-after-publishing-to-public) knowledge base article on the Tableau website. ### Validate live connections in Tableau Bridge using Application mode You can now quickly validate live connections in Tableau Bridge using Application mode. This means you can also choose to run live queries only when you are logged on to Windows if the site administrator has enabled the option. For more information, see [How Tableau Bridge Works](https://help.tableau.com/current/online/en-us/to_sync_local_data.htm#how-sync-works). ### Manage dashboard extensions in Tableau Cloud Dashboard extensions are web applications that provide users new ways to interact with data from other applications directly in Tableau. You can control the dashboard extensions that you allow to run in Tableau and can manage the extension's access to data. To learn more about controlling extensions, see [Manage Dashboard and Viz Extensions in Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/dashboard_extensions_server.htm). ### Include colleagues on data conversations with @mentions To engage people in a conversation about compelling data you find in a view, @mention them in comments. As you begin to type a name, matching people with Tableau accounts at your organization appear in a list you can choose from. For more information, see [Comment on Views](https://help.tableau.com/current/pro/desktop/en-us/help.htm#comment.htm?) in Tableau User Help. ![Field for adding the name of an individual to mention in a comment.](/tableau/next/en-us/online/en-us/Img/comment_mention.png) Site administrators can disable @mentions in the General section of site settings. ### Web authoring enhancements - Enhance dashboard functionality by connecting to external applications with dashboard extensions. See [Use Dashboard Extensions](https://help.tableau.com/current/pro/desktop/en-us/dashboard_extensions.htm) in Tableau User Help. - Align dashboard items with a visual grid. See [Size and Lay Out Your Dashboard](https://help.tableau.com/current/pro/desktop/en-us/dashboards_organize_floatingandtiled.htm#Grid) in Tableau User Help. - Use keyboard shortcuts to quickly create and edit views on the web. See [Keyboard Shortcuts](https://help.tableau.com/current/pro/desktop/en-us/shortcut.htm#Shortcuts_webauth) in Tableau User Help. - Create multi-connection data sources and join data from different databases (cross-database joins). See [Join Your Data](https://help.tableau.com/current/pro/desktop/en-us/joining_tables.htm) in Tableau User Help. ![A list of connections and a diagram that shows how the Orders data source is connected to a data source with sales data.](/tableau/next/en-us/online/en-us/Img/online_crossjoin.png) - Union data from the same data connection on the web. See [Union Your Data](https://help.tableau.com/current/pro/desktop/en-us/union.htm) in Tableau User Help. - When working with file-based data sources, you can pivot data from crosstab format into columnar format. See [Pivot Data from Columns to Rows](https://help.tableau.com/current/pro/desktop/en-us/pivot.htm) in Tableau User Help. - Copy selected values in your data grid by pressing Ctrl+C (Windows) or (Command+C) (macOS). Alternatively, to copy selected values in the metadata grid, right-click, and select Copy. - Find fields in the Data pane using schema search. ![Search functionality on the data pane.](/tableau/next/en-us/online/en-us/Img/search_schema_web.png) - Better control over sorting. Use nested sort to sort dimension values within the context of each pane. You no longer need to create calculated fields or combine dimensions. For more information, see [Sort Data in a Visualization](https://help.tableau.com/current/pro/desktop/en-us/help.htm#sortgroup_sorting_computed_howto.htm#nested) in Tableau User Help. Also, you can now access the Sort dialog box by right-clicking a dimension field on the Rows or Columns shelves in a view. - If you've changed a view (for example, by adjusting filters), you can now create data alerts without first saving a custom view. - You now have two ways to open the Edit Axis dialog box. Hover near the top of the axis (vertical axis) or to the right (horizontal axis) and click the drop-down arrow that appears. Or, double-click the axis. ![Cursor hovering over the downward pointing arrow icon on a scatter plot's axis.](/tableau/next/en-us/online/en-us/Img/editaxis_web_arrow1.png) ![Downward pointing arrow icon expanded to show the Edit Axis option.](/tableau/next/en-us/online/en-us/Img/editaxis_web_arrow.png) - When you select Logarithmic scale for an axis, you now have the option to specify Symmetric to display data that contains 0 or negative values on a log scale axis. For details, see [Edit Axes](https://help.tableau.com/current/pro/desktop/en-us/help.htm#formatting_editaxes.htm#Scale) in Tableau User Help. ![A scatter plot illustrating the correlation between sales and profit, accompanied by the Edit Axis dialog in which the Scale options are highlighted.](/tableau/next/en-us/online/en-us/Img/editaxis_symlog.png) - Create and delete annotations by right-clicking the view (in a worksheet or dashboard), and then selecting point or mark annotation. Right-click the annotation again to edit or remove the annotation. ![A map with marks and points displays with the options to annotate mark or annotate point.](/tableau/next/en-us/online/en-us/Img/annotate_web1.png) ![An annotated icon on a map is highlighted with the option to delete or edit the annotation.](/tableau/next/en-us/online/en-us/Img/annotate_web.png) ### Materialize calculations in extracts already published to Tableau Cloud If you need to retroactively materialize calculations in extracts that have already been published to Tableau Cloud, you can use tabcmd to refresh the published extract with the `--addcalculations` option. For more information about materializing calculations in extracts, see [Materialize Calculations in Your Extracts](https://help.tableau.com/current/pro/desktop/en-us/help.htm#extracting_optimize.htm#materialize_on_server) in the Tableau User Help. For more information about the tabcmd option, see [refreshextracts workbook-name or datasource-name](https://help.tableau.com/v0.0/online/en-us/tabcmd_cmd.htm#id4cdb3410-1c41-4dad-b1d2-306542ac9b32). Added in April 2018 ### New user-based term licenses are now available Tableau now offers different types of user-based term licenses that grant a range of web authoring and other capabilities at various price points. This gives organizations more flexibility to fit licenses to the data analysis and visualization needs of different users. To learn more, see [User-based licenses](https://help.tableau.com/current/server/en-us/license_server_overview.htm#user-based), or to see the capabilities of each license, see [Tableau Pricing](https://www.tableau.com/pricing). ### Quickly analyze cloud-based data with Dashboard Starters Dashboard Starters help you quickly author and analyze data from cloud-based systems like Salesforce, ServiceNow, Oracle Eloqua, and Marketo. Simply create a new workbook and choose from several beautiful, informative designs that are tailor-made for key business metrics. For more information, see [Use Accelerators to Quickly Visualize Data](https://help.tableau.com/v0.0/online/en-us/accelerators.htm) ### Configure additional Tableau Bridge clients to load balance live connections Site administrators can configure additional Tableau Bridge clients on different computers to load balance live queries. For more information, see [Allow Publishers to Maintain Live Connections to On-Premises Data](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm#set-up-more-clients). ### Cancel a scheduled extract refresh that's in progress using Tableau Bridge There may be situations where you need to cancel an in-progress extract refresh. You can cancel an in-progress extract refresh if you have configured the extract to refresh on a schedule using Tableau Bridge. For more information, see [Create a Schedule for a Tableau Bridge Data Source](https://help.tableau.com/current/online/en-us/to_sync_schedule.htm#cancel). ![A Tableau Bridge window with options for site, orders, and mode.](/tableau/next/en-us/online/en-us/Img/bridge_cancelrefresh.png) ### Connect to data on the web With a Creator user license, you can connect to data directly in your browser. Upload Excel or text-based data sources, connect to data housed in a cloud database or on a server in your enterprise, or connect to published data saved to your site. For more information, see [Creators: Connect to data on the web](https://help.tableau.com/current/pro/desktop/en-us/help.htm#creator_connect.htm). ### Prepare your data on the web With a Creator user license, use the Data Sources tab to prepare your data for analysis. Create joins, add new data sources, clean your data using the Data Interpreter, and more. For more information, see [Creators: Prepare Data on the Web](https://help.tableau.com/current/pro/desktop/en-us/help.htm#creator_data_prep.htm). ### Add an accessible toolbar to an embedded view Authors can enable an accessible toolbar so that all users can add comments, download the view, or share it with others. For more information, see [Publish and embed the view](https://help.tableau.com/current/pro/desktop/en-us/accessibility_create_view.htm#Publish) in [Author Views for Accessibility](https://help.tableau.com/current/pro/desktop/en-us/accessibility_create_view.htm). ### Download your workbook in an earlier version of Tableau ![Download icon with option to choose a format to download.](/tableau/next/en-us/online/en-us/Img/export1_92.png) You may need to download your workbook to a different version of Tableau, for example, if the workbook needs to be opened in an earlier version of Tableau Desktop. You have the option of downloading your workbook in its current version, or downgrading it to an earlier version. For more information about version compatibility, see [Make Workbooks Compatible Between Versions](https://help.tableau.com/current/pro/desktop/en-us/publish_version_compatibility.htm). ### Web Authoring Enhancements - When editing a view on the web, you can resize the width of row headers and the height of column headers. ![Tableau Cloud resize header icon resizing the header left to right.](/tableau/next/en-us/online/en-us/Img/online_resizeheader2.png) ![Tableau Cloud resize header icon resizing the header up and down.](/tableau/next/en-us/online/en-us/Img/online_resizeheader1.png) - Show Me is now available for dashboards. - Double-click an annotation to edit its text. - Hide or show a Viz in Tooltip worksheet. In the target worksheet that is the Viz in Tooltip, click Hide. To show the Viz in Tooltip worksheet again, in the source worksheet, click Unhide All Sheets. - Filter hierarchical data in views by using the All Values in Hierarchy filter option. - Change the Line mark type to a step line or a jump line by clicking the Path property in the Marks card. - Double-click an axis to edit axis settings. Added in February 2018 ### Streamline discussion threads by deleting comments If a comment is unnecessary or inaccurate, you can quickly delete it. Just click the X in the upper-right corner. For more information, see [Comment on Views](https://help.tableau.com/current/pro/desktop/en-us/help.htm#comment.htm) in Tableau User Help. Added in January 2018 Tableau Cloud servers were upgraded to version 10.5. ### Recommended data sources Recommended data sources show Tableau Desktop users relevant data sources published to Tableau Server and Tableau Cloud. These recommendations are based on published data sources used by other users in your organization with similar usage behavior as the current user. To keep the recommendations accurate and up to date, the server checks for the following each day: - New content - for example, new or updated data sources. - New usage information - for example, Laura Rodriquez used the Food Catering data source and Henry Wilson used the Monthly Sales data source. For information on recommended data sources, see [Use Certified and Recommended Data Sources and Tables](https://help.tableau.com/current/pro/desktop/en-us/help.htm#datasource_recommended.htm) in Tableau User Help. ### Nested projects You can now create project hierarchies when you want to segment content into sub-sections within a larger area. For example, you might create a project for each department. In each of those top-level projects, you can separate content based on how the audience uses it, such as connecting to certified data versus in-progress collaboration. For more information, see the following articles: - [Use Projects to Manage Content Access](https://help.tableau.com/current/online/en-us/projects.htm) - **Navigate projects** in the article [Navigate Tableau on the Web](https://help.tableau.com/current/pro/desktop/en-us/help.htm#navigating.htm "Opens article in a separate browser tab") ### Extracts use the new .hyper format When you create an extract, it uses the new .hyper format. Extracts in this new format take advantage of the improved data engine, which supports the same analytical and query performance as the data engine before it, but for even larger extracts. Similarly, when you perform an extract task on a .tde extract, the extract is upgraded to a .hyper extract. For more information, see [Extract Upgrade to .hyper Format](https://help.tableau.com/current/online/en-us/extracting_upgrade.htm). ### Changes to the way values are computed To improve data source efficiency and scalability, and produce results that are consistent with commercial databases, values in your data source can be computed differently in version 10.5. In some cases, these changes can cause differences with the values and marks in your view between version 10.4 (and earlier) and version 10.5 (and later). This applies to extract data sources, and can apply to multi-connection data sources, data sources that use live connections to file-based data, data sources that connect to Google Sheets data, cloud-based data sources, extract-only data sources, and WDC data sources. For more information, see [Changes to values and marks in the view](https://help.tableau.com/current/pro/desktop/en-us/help.htm#extracting_data.htm#semantics) in the Tableau User Help. ### Desktop operating system requirements (64-bit replaces 32-bit) Starting with version 10.5, Tableau Desktop, Tableau Reader, and Tableau Public (desktop) run only on 64-bit operating systems. Version 10.4 is the last version of Tableau Desktop, Tableau Reader, and Tableau Public to support 32-bit Windows operating systems. ### New in Web Authoring - Add text objects to dashboards and edit them. - Edit worksheet and dashboard titles. Double-click the title to open the Edit Title dialog box. - Edit trend lines and view a description of the trend model. To view the trend model, hover over any part of the trend line. To edit a trend line on the web, click a trend line and hold the cursor in place, and then click the Edit menu. - Trend lines now include a Power option. - Create hierarchies by dragging one dimension onto another in the Data pane. - Set the default color property for a field. - For quantitative color legends, advanced settings are available (dates not included). - Edit axes on the web. To open the Edit Axis dialog box on the web, double-click an axis in the view. Options available from the Edit Axis dialog box include **Synchronize dual axes**, clearing the axis range (**Reset**), and editing tick marks. You can also enable or disable **Dual axis** in a field context menu (right-click a measure field on Rows or Columns shelf). ### Filtered search hidden by default Filtered search options are now located on the right side of pages, and are hidden by default. The toggle is a dark icon (![Filter type slider icon.](/tableau/next/en-us/online/en-us/Img/qs_content_filters_icon01.png)) when the Filters pane is open and a light icon (![Filter type slider icon.](/tableau/next/en-us/online/en-us/Img/qs_content_filters_icon02.png)) when the Filters pane is closed. For details on searching, see [Search Content](https://help.tableau.com/current/pro/desktop/en-us/help.htm#search.htm). To use filtered search, click ![Filter type slider icon.](/tableau/next/en-us/online/en-us/Img/qs_content_filters_icon02.png). ![Toggle filters to show search box.](/tableau/next/en-us/online/en-us/Img/filtered_search_toggle.gif) Added in 2017 ## Added in September 2017 Tableau Cloud servers were upgraded to version 10.4. ### Data-driven alerts When data reaches important thresholds for your business, data-driven alerts automatically send email notifications to key people users specify. For information on how to create and manage these alerts, see [Send Data-Driven Alerts](https://help.tableau.com/current/pro/desktop/en-us/help.htm#data_alerts.htm) in Tableau User Help. ### Data source certification Certification offers a way to promote data sources through curation. Site administrators and project leaders can certify data sources that meet your organization’s security and compliance standards, or any other standards you define. For more information, see [User Certification to Help Users Find Trusted Data](https://help.tableau.com/current/online/en-us/datasource_certified.htm). ### Tableau Bridge support for live connections Live query functionality in Tableau Bridge can now be enabled by site administrators without requesting access from Tableau. Use Tableau Bridge to maintain live connections to on-premises relational data, and to perform scheduled extract refreshes. For more information, see [Use Tableau Bridge to Expand Data Freshness Options](https://help.tableau.com/current/online/en-us/to_sync_local_data.htm). ### Enhanced commenting on views Commenting has been completely redesigned to inspire conversations about data discoveries. The new Comments pane appears to the right of views, rather than at the bottom, so you can see the discussion and the data at the same time. Profile images automatically appear too, helping you quickly identify other users. To share filtered views with them, add interactive snapshots along with your comments to highlight the data you're describing. Any comments you add in a desktop browser also appear in Tableau Mobile, and vice versa, so you can easily communicate with colleagues on the go. Comments remain with a view even if you revise the containing workbook (as long as the view name remains the same). For more information, see [Comment on Views](https://help.tableau.com/current/pro/desktop/en-us/help.htm#comment.htm). ### Learn who has seen a view If you own a view, you can quickly find out who at your organization has seen it. At the top of a main site page, click Views. Then hover over the specific view you're interested in, and select Who Has Seen This View? from the menu at upper-right. ### WCAG-conformant drop-down filters in embedded views Single Value (drop-down) and Multiple Values (drop-down) filters are now WCAG-conformant when accessed in embedded views. For more information, see [Build Data Views for Accessibility](https://help.tableau.com/current/pro/desktop/en-us/help.htm#accessibility_overview.htm) and [Author Views for Accessibility](https://help.tableau.com/current/pro/desktop/en-us/help.htm#accessibility_create_view.htm). ### New to Web Authoring #### Precise dashboard spacing, with border and background color controls If you previously used blank objects to refine dashboard layouts, you'll really appreciate the new spacing controls. Padding lets you precisely position items on dashboard, while borders and background colors let you visually highlight them. For more details, see [Add padding, borders, and background colors around items](https://help.tableau.com/current/pro/desktop/en-us/help.htm#dashboards_organize_floatingandtiled.htm). #### Turn on the View Toolbar on the web In prior releases, when authoring on the web, you could only see and use the View Toolbar when working with map views. Now you can turn on the View Toolbar for any view or dashboard in your workbook in web authoring. From the top menu, select Worksheet > Show View Toolbar and select an option. #### Edit groups Starting with Tableau version 10.4, you can edit groups. To edit a group, in the Data pane, right-click a group field and select Edit Group. In the Edit Group dialog box that opens, you can add or remove members from an existing group, as well as create new groups in the group field. You can also choose to Include an Other group. For more information, see [Group Your Data](https://help.tableau.com/current/pro/desktop/en-us/help.htm#sortgroup_groups_creating.htm). #### Create aliases Starting with Tableau version 10.4, you can create aliases for members in a dimension so that their labels appear differently in the view. To create aliases for a field, in the **Data** pane, right-click a dimension and select Aliases. In the Edit Aliases dialog box, under **Value (Alias)**, select a member and enter a new name. For more information, see [Create Aliases to Rename Members in the View](https://help.tableau.com/current/pro/desktop/en-us/datafields_fieldproperties_aliases_ex1editing.htm). #### Format lines When you are authoring on the web, you can quickly change all the lines in your workbook. Select Format > Workbook, then expand the Lines section on the Format Workbook and make your selections. For more information, see [Format at the Workbook Level](https://help.tableau.com/current/pro/desktop/en-us/help.htm#formatting_workbook.htm). ## Added in July 2017 ### User-specific time zones for subscription schedules Subscription schedules were previously limited to one time zone, but now users can choose any time zone. At the top of the browser window, click your name, and select **My Account Settings**. Then, under **Subscription time zone**, select the time zone for schedules you create. ## Added in June 2017 ### Default task priority for all extract refreshes To ensure fair distribution of processing for all Tableau Cloud customers, we're removing the ability for site administrators to set task priority for scheduled extract refreshes. All previously set priorities will return to the default value. ## Added in May 2017 Tableau Cloud servers were upgraded to version 10.3. ### Tableau Cloud sync client evolves into Tableau Bridge **Limited release, by request.** The Tableau Online sync client has gained some new functionality and a new name to go with it. Use Tableau Bridge to maintain live connections to on-premises relational data. Bridge also takes on all of the functionality that was provided in the sync client for scheduling extract refreshes. Your existing schedules will continue to run as previously defined in the sync client. Live query functionality is currently available to site administrators by request only. For more information, see [Use Tableau Bridge to Expand Data Freshness Options](https://help.tableau.com/current/online/en-us/to_sync_local_data.htm). ### Encrypted SAML assertions from Identity Providers Tableau Cloud now supports encrypted SAML assertions from Identity Providers. To learn more about configuring SAML single-sign-on, see [Enable SAML Authentication on a Site](https://help.tableau.com/current/online/en-us/saml_config_site.htm). ### Site access for support users Tableau Cloud administrators can allow approved Tableau support technicians to access their Tableau Cloud site to help troubleshoot a customer support case. To learn more, see [Enable Support Access](https://help.tableau.com/current/online/en-us/enable_support_access.htm). ### Help Redesign Starting with version 10.3, Tableau Desktop Help is now known as Tableau Help. Tableau Help contains all help topics related to analyzing and consuming data in Tableau Desktop, Tableau Server, and Tableau Cloud. This help is for people who create workbooks or data sources and publish them, and for people who want to see, interact with, and share views in Tableau. We welcome your feedback on this change, as well as any feedback or ideas you might have on how to make our content better. Please use the feedback bar on the top of any page ("Was this page helpful?") to open the comment field and submit your feedback. [Using Tableau on the Web](https://help.tableau.com/current/pro/desktop/en-us/help.htm#web_author_home.htm) provides links to the topics that used to be located in Tableau Server and Tableau Cloud help. ### New to Web Authoring Web authoring topics for Tableau Server and Tableau Cloud are now located in [Tableau Help](https://help.tableau.com/current/pro/desktop/en-us/help.htm), starting with version 10.3. #### Save data source You now have the option to save a data source that is embedded with a published workbook, as a separate, published data source on Tableau Server and Tableau Cloud that other users can connect to. When you save the data source, you can choose to update the workbook to connect to the newly saved data source. ![A dropdown menu with options to refresh, close, save, and view the current dimension.](/tableau/next/en-us/online/en-us/Img/datasource_saveonweb1.png) ![A dialog box asking if you want to save the data source "Sales Target" for shared use on the server.](/tableau/next/en-us/online/en-us/Img/datasource_saveonweb2.png) #### Edit quantitative color legends You can now edit the color palette for continuous color legends in web authoring. You can open the Edit Colors dialog box from the Marks card or by clicking the drop-down arrow on the legend.

Marks card:	Legend:

You can also set a custom color for the start and end colors by entering the Hex value. ![Edit Colors dialog box with options for customizing colors in a profit chart.](/tableau/next/en-us/online/en-us/Img/editquantiativecolors_hex.png) #### Edit colors on separated legends When you create separate color legends for measures in your view, you are no longer restricted to using only the default color palette or the color palette assigned to each color legend when the view was published from Tableau Desktop. In web authoring mode, you can now select different color palettes for each legend. Click the drop-down arrow on the legend to open the Edit Colors dialog box and then select the color palette. You can also set custom start and end colors using Hex values. ![Legend context menu expanded to show options for editing the legend's color palette.](/tableau/next/en-us/online/en-us/Img/LPM_separatecolor.png) #### Customize how people interact with your map In web authoring mode, you can now customize how your audience interacts with your map view in the following ways using the Map Options dialog box: - Show a map scale - Hide map search - Hide the view toolbar - Turn off pan and zoom For more information, see [Customize How People Interact with your Map](https://help.tableau.com/current/pro/desktop/en-us/help.htm#maps_customize_interaction.htm). #### Format numbers on the web You can now specify basic number formatting for measures in the view on Tableau Server and Tableau Cloud. For more information, see Format Numbers and Null Values on Tableau Server or Tableau Cloud. ![A dropdown menu with options for formatting numbers as automatic, standard number, custom number, standard currency, custom currency, percentage, scientific, or custom.](/tableau/next/en-us/online/en-us/Img/format_numbers_web2.png) #### Create stories In web authoring, you can now create a story to tell a data narrative, provide context, demonstrate how decisions relate to outcomes, or to simply make a compelling case. See [Create a Story](https://help.tableau.com/current/pro/desktop/en-us/help.htm#story_create.htm) for details. ![A Story on Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/story_web.png) #### Create and edit bins Create bins from continuous measures and edit them in Tableau Server and Tableau Cloud, similar to how you do it in Tableau Desktop. For details, see [Create Bins from a Continuous Measure](https://help.tableau.com/current/pro/desktop/en-us/help.htm#calculations_bins.htm). #### Drag fields to Show Me in the view Select and drag dimensions and measures of interest to the view area. A "Show Me" view is automatically created. You can then click other Show Me options to try different view types. ![Drag fields onto a view to see the Show Me box.](/tableau/next/en-us/online/en-us/Img/showme_drag_web.gif) #### Drill up and down a continuous hierarchy in the view In a view with a continuous hierarchy, hover near the headers on a continuous axis to display the + and - controls. Click to drill down or up. ![Drill up and down on the web.](/tableau/next/en-us/online/en-us/Img/drillupdown_web1.gif) ## Added in March 2017 ### Google authentication Google authentication gives you the convenience of using your Google ID and password with Tableau Cloud, thus reducing the number of sign-in prompts when accessing Tableau Cloud. Your site administrator can manage these credentials in a central location so that you no longer need to reset multiple passwords. For more information about Google authentication, see [Authentication](https://help.tableau.com/current/online/en-us/security_auth.htm). ### Custom schedules for subscriptions Subscription schedules used to be limited to a set of standard options, but now you can receive emails on whatever schedule works best for you. To learn more, see [Subscribe to Views](https://help.tableau.com/current/pro/desktop/en-us/help.htm#subscribe_user.htm). ![A form for data subscription, offering various options for subscription frequency.](/tableau/next/en-us/online/en-us/Img/self_subscribe_whatsnew.png) ## Added in February 2017 Tableau Cloud servers were upgraded to version 10.2. The following items in [What’s New in Tableau Server](https://help.tableau.com/current/server/en-us/whatsnew_server.htm) also apply to Tableau Cloud. - Support for accessibility compliance The functionality referred to in this item is for Tableau Desktop authors who want to create accessible views that they publish to Tableau Cloud or Tableau Server. - Web authoring enhancements Added in 2016 ## Added in November 2016 Tableau Cloud servers were upgraded to version 10.1. ### Web authoring enhancements - Show or hide headers in a view. - View read-only device layouts for dashboards. ### Full-screen views To expand a view, click Full Screen at the far right of the toolbar. To return to the view to its previous size, press Esc. ![Option to extend your window to fill your screen.](/tableau/next/en-us/online/en-us/Img/full_screen.png) ### Send subscriptions for high-priority alerts If you’ve configured a view to contain data only when high-priority information exists, select the new subscription option, Don’t send if view is empty. For more information, see [Subscribe to Views](https://help.tableau.com/current/pro/desktop/en-us/help.htm#subscribe_user.htm) and [Manage Your Subscription Settings](https://help.tableau.com/current/pro/desktop/en-us/help.htm#useracct.htm). ### New location for downloading tabcmd The tabcmd installer is now available from the [Tableau Server Releases](https://www.tableau.com/support/releases/server) page on the Tableau website. In this location, you can always find the latest version of tabcmd. The tabcmd download is on the release notes, under the version number. The link from the Tableau Cloud Help has changed, too. If you bookmark this link, you can update it at [Install tabcmd](https://help.tableau.com/current/online/en-us/tabcmd.htm#tabcmd-install). [Skip to main content](#main-content) # Find Admin Views The Site Status page contains an embedded Tableau workbook with various admin views. These views help you to monitor different types of site activity. - Allows you to access the Admin Insights project, which you can use to build custom admin views about your site. - Shows you general site activity for Tableau Cloud. - Shows you general Tableau Bridge activity. ## Navigate to admin views To see the Admin Insights project or admin views, click Site Status. Site administrators can see administrative views for their site. [Skip to main content](#main-content) # Follow Metrics and Manage Followers in Tableau Pulse You keep track of Tableau Pulse metrics by following them. Followers are specific to each metric, not to a metric definition. That way, you can follow the metrics that are scoped to your role and receive only relevant insights. Any time you filter a metric, you create a new metric if one doesn't already exist with that unique set of filters. Followers don’t carry over from the previous metric that you were viewing, so you need to follow the new metric. For information about creating metrics, see [Create metrics](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#create-metrics). ## Follow metrics 1. Open the metric that you want to track. 2. Select Follow. You can also select the More Actions menu (...) from a metric card and choose Follow. You'll see this metric on your Tableau Pulse home page and in digests. For information about configuring your digests, see [Manage your Tableau Pulse digest](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#manage-digest). When you follow two or more metrics, Tableau Pulse provides an insight summary in digests and on the Tableau Pulse home page to help you quickly get the latest updates for your metrics. For these summaries to appear, your Tableau administrator must turn on the site setting for insight summaries. For more information, see [Turn on metric insight summaries](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#pulse-insight-summaries). ## Unfollow metrics 1. Open the metric that you no longer want to follow. 2. Select Following. You can also select the More Actions menu (...) from a metric card and choose Unfollow. When you unfollow a metric, it no longer appears on your Tableau Pulse home page or in digests. If you follow a metric as part of a user group, then you can’t unfollow the metric individually. The group must be removed from the follower list. For more information, see [Remove followers](#remove). ## Add followers You can add other users or groups as followers to a metric. 1. Open the metric that you want to add followers to. 2. Select the Followers button. 3. In the search box, enter the name of the user or group that you want to add. 4. Select Add. If you add users to a metric as part of a group, those users won’t be able to remove themselves individually. If you want users to have control over the metrics they follow, add them as individuals. ## Remove followers 1. Open the metric that you want to remove followers from. 2. Select the Followers button. 3. Next to the follower's name, select Remove. Followers aren't notified if they're removed from a metric, so be careful removing groups of followers. If users within a group are receiving more digests than they want from Tableau Pulse, they can turn off digests for a channel or decrease the digest frequency by adjusting their preferences. Users can also turn off alerts for individual metrics. For more information, see [Manage your Tableau Pulse digest](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#manage-digest) and [Turn off alerts for a metric](https://help.tableau.com/v0.0/online/en-us/pulse_alerts.htm#turn-off). [Skip to main content](#main-content) # Format Animations Animate visualizations to better highlight changing patterns in your data, reveal spikes and outliers, and see how data points cluster and separate. Animations visually transition between filter, sort, and zoom settings, different pages, and changes to filter, parameter, and set actions. As visualizations animate in response to these changes, viewers can more clearly see how data differs, helping them make better informed decisions. ## Understanding simultaneous and sequential animations When you author animations, you can choose between two different styles: simultaneous or sequential. Here are examples of each type. ### Simultaneous animations The default simultaneous animations are faster and work well when showing value changes in simpler charts and dashboards. ![A Tableau animation.](/tableau/next/en-us/online/en-us/Img/animations.gif) Click the image above to replay the animation. ### Sequential animations Sequential animations take more time but make complex changes clearer by presenting them step-by-step. ![A sequential animation.](/tableau/next/en-us/online/en-us/Img/animations_sequential.gif) Click the image above to replay the animation. ## Animate visualizations in a workbook When you create a new workbook, Tableau enables animations for your viz by default. You can turn animations on or off at the user and workbook level. 1. Choose Format > Animations. 2. If you want to animate every sheet, under Workbook Default, click On. Then do the following: - For Duration, choose a preset, or specify a custom duration of up to 10 seconds. - For Style, choose Simultaneous to play all animations at once or Sequential to fade out marks, move and sort them, and then fade them in. 3. To override workbook defaults for a particular sheet, change the settings under Selected Sheet. **Note:** In the Selected Sheet section, “(Default)” indicates a setting that automatically reflects the related Workbook Default setting. ![Animations pane with options to configure animations at the workbook or sheet level.](/tableau/next/en-us/online/en-us/Img/animations_pane.png) To replay an animation, click the Replay button in the toolbar. From the Replay button, you can also choose the speed at which the animation replays: actual speed, 2x speed, or 1/2 speed. ![Replay button dropdown menu for choosing replay speed](/tableau/next/en-us/online/en-us/Img/replay_speed.png) ## Reset animation settings for a workbook You can reset animations to return an entire workbook to the default animation settings. Be aware that this turns animations off by default. 1. Choose Format > Animations. 2. In the middle of the Animations pane, click Reset All Sheets. ## Completely disable all animations When you create a new workbook, animations are enabled by default. If you find animations distracting while viewing vizzes, you can completely disable them so they never play. (This isn't a system-wide setting; each user needs to apply it separately.) - In Tableau Desktop, choose Help > Settings and Performance, and deselect Enable Animations. - In Tableau Cloud or Tableau Server, click your profile image or initials in the top right corner of the browser, and choose My Account Settings. Then scroll down to the bottom of the page, deselect Enable animations, and click Save Changes. **Note:** When animations are disabled, you can still choose Format > Animations in authoring mode and adjust settings—but they will have no effect. ## Format decimals for axes animations If the number of decimal places for a measure is set to the default, then the number of decimals shown during the axis animation might fluctuate during the axes animation. To avoid this, format the number of decimal places displayed for a measure. For more information, see [Format Numbers and Null Values](https://help.tableau.com/current/pro/desktop/en-us/formatting_specific_numbers.htm). ## Why animations won't play ### Server rendering Animations won't play if a viz is server-rendered. To ensure that vizzes render on a client computer or mobile device, use these techniques: - If you're a viz author, [reduce viz complexity](https://help.tableau.com/current/pro/desktop/en-us/perf_visualization.htm). - If you're a Tableau Server administrator, [increase the complexity threshold for client-side rendering](https://help.tableau.com/current/server/en-us/browser_rendering.htm). **Note:** On computers with lower processing power, animations may appear choppy, but users can continue to interact with vizzes without any delays in responsiveness. ### Unsupported browsers and features Animations are supported by all web browsers except Internet Explorer. The following Tableau features don't animate: - Maps, polygons, and density marks in web browsers - Pie and text marks - Headers - Forecasts, trends, and reference lines - Page history trails (If a viz includes these, turn off animations to avoid unexpected behavior.) [Skip to main content](#main-content) # Format Numbers and Null Values You can specify the format for numeric values that display in your viz, including measures, dimensions, parameters, calculated fields, and axis labels. When specifying a number format, you can select from a set of standard formats, such as number, currency, scientific, and percentage. You can also define a custom number format with the option to include special characters. When a measure contains null values, you can use formatting to handle the null values in a different way, such as replacing nulls with zeros or hiding them. ## For Tableau Desktop ### Specify a number format 1. Right-click (control-click on Mac) a number in the view and select Format. 2. In the Format pane, click the Numbers drop-down menu. 3. Select a number format. Some formats require additional settings. For example, if you select Scientific, you must also specify the number of decimal places. ![Formatting pane with options to select how many decimal points for scientific numbers.](/tableau/next/en-us/online/en-us/Img/numbers1.png) Here are the number formats and associated options available in Tableau.

NUMBER FORMAT	FORMAT OPTIONS
Automatic: format is automatically selected based on either the format specified by the data source or the data contained in the field.	None.
Number (Standard): format is based on locale selected.	Locale: number format changes based on the geographical location selected.
Number (Custom): format is customized to your choice.	Decimal Places: the number of decimal places to display. Negative Values: how negative values are displayed. Units: the number is displayed using the specified units. For example, if the number is 20,000 and the units are thousands, the number will be displayed as 20K. Prefix/Suffix: characters that precede and follow each displayed number. Include thousands separators: whether the number shows separators every thousand (example: 100,000 vs. 100000).
Currency (Standard): format and currency symbol is based on locale selected.	Locale: currency format based on the geographical location selected.
Currency (Custom): format and currency symbol is customized to your choice.	Decimal Places: the number of decimal places to display. Negative Values: how negative values are displayed. Units: the number is displayed using the specified units. For example, if the number is 20,000 and the units are thousands, the number is displayed as 20K. Prefix/Suffix: characters that precede and follow each displayed number. Include thousands separators: whether the number shows separators every thousand (example: 100,000 vs. 100000).
Scientific: numbers are displayed in scientific notation.	Decimal: the number of decimal places to display.
Percentage: numbers are displayed as a percentage with the percent symbol. The value of 1 is interpreted as 100% and 0 as 0%	Decimal: the number of decimal places to display.
Custom: format is based entirely on what is specified in the format options.	Custom: type in the format you want to use, including special characters (optional). See "Define a custom number format" in this topic for details.

### Scale values automatically With the `[scale]` token, you can format custom number strings to dynamically scale values and append the appropriate International System of Unit (SI) suffixes based on their magnitude. This token is ideal when a single field spans multiple magnitudes (such as thousands and millions), which ensures that each value is displayed clearly in a readable format, avoiding the need for a uniform unit across the column. While Display Units (such as Thousands, Millions, or Billions) enforce a single fixed unit across all values in a field, the `[scale]` token applies dynamic scaling per individual value. - **Display Units**: Best for enforcing uniform units across all numbers. - **`[scale]` token**: Best for adaptive, value-level formatting within a single field. #### How the `[scale]` token works Applying `[scale]` to a custom format triggers the following process: - Tableau evaluates every data point individually. - Values are divided by powers of 1,000 as appropriate. - The output is appended with a matching SI suffix. #### Scaled value formatting examples Using 0.0`[scale]`: - 12 renders as 12.0 - 1,000 renders as 1.0k - 1,500,000 renders as 1.5M - 2,300,000,000 renders as 2.3G - 0.004 renders as 4.0m #### Use `[scale]` in a custom value string 1. Right-click (or Control-click on macOS) the target number in your view and choose Format. 2. Navigate to the Format pane, open the Numbers dropdown menu, and select Custom. 3. Insert the `[scale]` token into the Format input box (for example, `0.0[scale]`). #### Important notes on suffixes and units - `[scale]` utilizes standard SI prefixes, including `k`, `M`, `G`, and `T` for larger numbers, and `m`, `µ`, and `n` for smaller numbers. - SI unit prefixes differ from standard Display Units labels. For instance, 1,000,000,000 displays using `G` (giga) rather than `B` (billions). - The `[scale]` tag is typed directly into the custom number formatting text string. ### Define a custom number format To apply a custom number format in your viz: 1. Right-click (control-click on Mac) a number in the view and select Format. 2. In the Format pane, click the Numbers drop-down menu and select Custom. 3. In the Format field, define your formatting preferences using the following syntax: `Positive number format;Negative number format;Zero values`. When defining your number format code, keep in mind that: - You can specify the formatting for up to three types of numbers in the following order: positive numbers, negative numbers, and zeros. - Each number type must be separated by a semicolon (;). - If you specify only one number type, the format for that type is used for all numbers. - If you specify two number types, the format for the first type is applied to positive numbers and zeros, while the format for the second type is applied to negative numbers. - If you skip types in your number format code, you must include a semicolon (;) for each of the missing types. #### Custom number format examples Refer to the following table for examples of commonly used custom number format codes that you can use in your viz. The syntax has three portions: `;;` separated by semicolons.

USE CASE	NUMBER CODE SYNTAX	EXAMPLE OUTPUT
Show only positive values	#,##; ; (note a blank space after the 2nd and 3rd semicolon)	Positive values: 1,234 Negative values: (only the blank space displays) Zero values: (only the blank space displays)
Show only negative values	;-#,##;	Positive values: (nothing displays) Negative values: -1,234 Zero values: (nothing displays)
Show only zero values	;;0;	Positive values: (nothing displays) Negative values: (nothing displays) Zero values: 0
Hide zero values	#,###;-#,###;;	Positive values: 1,234 Negative values: -1,234 Zero values: (nothing displays)
Show negative values in parentheses	#,###;(#,###);;	Positive values: 1,234 Negative values: (1,234) Zero values: (nothing displays)
Add a character prefix to a value	$#,###.##;-$#,###.##;$0;	Positive values: $1,234.56 Negative values: -$1,234.56 Zero values: $0
Add a character suffix to a value	#%;-#%;0%;	Positive values: 12% Negative values: -34% Zero values: 0%
Add text descriptors	"$"#,#" Surplus";"$"-##" Shortage"; "$"0;	Positive values: $1,234 Surplus Negative values: $-1,234 Shortage Zero values: $0

There are several ways to customize your number format to meet your needs. For more code guidance and examples, see [Review guidelines for customizing a number format](https://support.microsoft.com/en-us/office/review-guidelines-for-customizing-a-number-format-c0a1d1fa-d3f4-4018-96b7-9c9354dd99f5) in the Microsoft Knowledge Base. **Note:** There are slight deviations between the options described by Microsoft and those available in Tableau. For example, custom number formats that align text within columns aren't relevant in Tableau. Additionally, custom number formats to color code text aren't applicable because you can apply color to text using the Marks card. (For more information on applying color, see [Control the Appearance of Marks in the View](https://help.tableau.com/current/pro/desktop/en-us/viewparts_marks_markproperties.htm).) Be sure to only use custom number formats that apply in Tableau. #### Include special characters in a custom number format One of the benefits of custom number formatting is the ability to include special characters or symbols. Symbols can make it easier to quickly understand comparisons between measures and calculations in your viz. For example, let’s say you want to show a month-over-month comparison of profits for three of your company’s top-selling products. Rather than using the standard label to show that the profit for these products changed +5%, -2%, and 0% label from last month, you can set the custom number format as follows to show these changes as ▲5%,▼2%, and ►0. ![Custom number format defined using special characters ](/tableau/next/en-us/online/en-us/Img/CustomNumberFormatCode.png) ### Set the default number format for a field Right-click (control-click on Mac) the field in the Data pane and select Default Properties \> Number Format. In the subsequent dialog box, specify a number format to be used whenever the field is added to the view. The default number format is saved with the workbook. It’s also exported when you export the connection information. **Note:** Formatting numbers using the Format pane overrides any number formatting applied elsewhere. ### Format a measure as currency The view in the following image shows profit over time. Notice that the profit figures on the vertical axis aren’t formatted as currency. ![ ](/tableau/next/en-us/online/en-us/Img/FormattingNumbersDates_InitialView.png) **To format the numbers as currency:** 1. Right-click the Profit axis and choose **Format**. ![ ](/tableau/next/en-us/online/en-us/Img/FormattingNumbersDates_FormatAxis.png) 2. On the Axis tab in the Format pane, under Scale, select the **Numbers** drop-down list, and then select one of the following: **Currency (Standard)** to add a dollar sign and two decimal places to the figures. ![ ](/tableau/next/en-us/online/en-us/Img/FormattingNumbersDates_FormatCurrency.png) **Currency (Custom)** to specify the number of decimal places, how to show negative values, the units, whether to include a prefix or suffix, and whether to include a separator character. ### Use locale to specify number formats By default, Tableau uses your computer's locale and language settings to format numbers. But you can explicitly set a different locale in the **Format** pane. The following steps show how to set Swiss German currency, using the same view as in the previous section. 1. Right-click the Profit axis and select **Format**. 2. On the Axis tab, under Scale, select the **Numbers** drop-down list and then select **Currency (Standard)**. 3. In the **Locale** drop-down list, items appear in a **Language (Country)** format. For this example, select **German (Switzerland)**. The view updates to show the sales figures as Swiss Francs, formatted for the German language. **Tip:** You can change the default currency setting so that every time you drag the Profit measure to a view it uses the settings you want. In the Data pane, right-click **Profit** (or other monetary measure), and select **Default Properties** > **Number Format**. Then format the field as shown above. ### Format null values When a measure contains null values, they’re usually plotted in a view as zero. However, sometimes that changes the view and you’d rather just suppress null values altogether. You can format each measure to handle null values in a unique way. **To format null values for a specific field:** 1. Right-click the field in the view that has the null value (Control-click on a Mac) and choose Format. 2. Go to the **Pane** tab. 3. In the Special Values area, specify whether to show the null value using an indicator in the lower right corner of the view, plot it at a default value (such as zero for number fields), hide the value but connect the line, or hide and break the line to indicate that a null value exists. ![Formatting pane with options on how to show null values.](/tableau/next/en-us/online/en-us/Img/nullvalues3.png) 4. If you specify text in the **Text** field, it appears in the view for a null value when mark labels are turned on. See [Show and Hide Mark Labels](https://help.tableau.com/current/pro/desktop/en-us/annotations_marklabels_showhideworksheet.htm#show-and-hide-individual-mark-labels). **Note**: The Special Values area isn’t available for dimensions or discrete measures. ## For Tableau Server or Tableau Cloud ### Specify a number format When authoring a view on the web, you can specify the number format for a field used in the view. 1. In web editing mode, right-click a measure in the view and select **Format Number**. ![Measure context menu with option to format numbers.](/tableau/next/en-us/online/en-us/Img/format_numbers_web1.png) 2. In the dialog box that appears, select a number format. Some formats provide additional settings. For example, if you select Currency, you can also specify the number of decimal places, as well as the units, and whether or not to include separators, such as commas. In this example, Sales is formatted as a Currency with zero decimal places and thousand (k) units. Sales numbers in the view update with these settings. Labels and tooltips update as well. ![A dropdown menu with options for formatting numbers as automatic, standard number, custom number, standard currency, custom currency, percentage, scientific, or custom.](/tableau/next/en-us/online/en-us/Img/format_numbers_web2.png) Here are the number formats and associated options available in Tableau.

NUMBER FORMAT	FORMAT OPTIONS
Automatic: format is automatically selected based on either the format specified by the data source or the data contained in the field.	None.
Number (Custom): format is customized to your choice.	Decimal Places: the number of decimal places to display. Units: the number is displayed using the specified units. For example, if the number is 20,000 and the units are thousands, the number is displayed as 20K. Include separators: whether the number shows separators every thousand (example: 100,000 vs. 100000).
Currency (Custom): format and currency symbol is customized to your choice.	Decimal Places: the number of decimal places to display. Units: the number is displayed using the specified units. For example, if the number is 20,000 and the units are thousands, the number is displayed as 20K. Include separators: whether the number shows separators every thousand (example: 100,000 vs. 100000).
Percentage (Custom): numbers are displayed as a percentage with the percent symbol. The value of 1 is interpreted as 100% and 0 as 0%	Decimal Places: the number of decimal places to display.
Scientific (Custom): numbers are displayed in scientific notation.	Decimal Places: the number of decimal places to display.

[Skip to main content](#main-content) # Get Started Tableau Cloud is a secure, cloud-based solution for authoring, sharing, distributing, and collaborating on content created in Tableau Cloud. For a brief overview, watch the [Getting Started with Tableau Cloud and Tableau Server](https://www.tableau.com/learn/tutorials/on-demand/getting-started-tableau-cloudserver?playlist=509087) training video (2 mins). ## Other articles in this section [Skip to main content](#main-content) # Get Started with Explain Data Use Explain Data in your flow of analysis as you are exploring the marks in a viz. Explain Data runs automatically when the Data Guide pane is open and updates based on the current selection (dashboard, sheet, or mark).

Use Explain Data

Run Explain Data on a dashboard, sheet, or mark
Drill into explanations
View analyzed fields
Terms and concepts in explanations
Explanation Types

Author Workbooks and Control Access

## Run Explain Data on a dashboard, sheet, or mark These are the basic steps to run Explain Data in Tableau Desktop, Tableau Cloud, and Tableau Server: 1. Open a dashboard or sheet in a workbook. 2. In the view toolbar, select Data Guide ![Data Guide icon](/tableau/next/en-us/online/en-us/Img/data_guide_icon.png) to open the Data Guide pane. 3. If you open a dashboard, Explain Data will analyze it for outliers. ![Detected Outliers showing in the Data Guide for a dashboard](/tableau/next/en-us/online/en-us/Img/explaindata_dg_dashboard.png) If you select a sheet in the dashboard, Explain Data analyzes the marks in that sheet for outliers. ![Explain Data detailed explanation for a selected sheet.](/tableau/next/en-us/online/en-us/Img/explaindata_dg_sheet.png) If you select a mark in the dashboard, Explain Data specifically analyzes that mark for explanations. ![Explain Data detailed explanation for a selected mark.](/tableau/next/en-us/online/en-us/Img/explaindata_dg_mark.png) The marks that are being explained are highlighted in the viz as you select corresponding explanations. Optionally, you can select a mark in a viz, hover the cursor over the mark. In the tooltip menu, select **Data Guide** ![Data Guide icon](/tableau/next/en-us/online/en-us/Img/data_guide_icon.png). ![Image of mark tooltip with Data Guide icon selected](/tableau/next/en-us/online/en-us/Img/explaindata_tooltip_dg2.png) In Tableau Public, select the lightbulb in the tooltip menu to run Explain Data. ![Click the lightbulb icon in a mark tooltip menu to run Explain Data.](/tableau/next/en-us/online/en-us/Img/explaindata_tooltip_button.png) Possible explanations for the value of the analyzed mark are displayed in the Data Guide pane. Select different explanation names to expand the details and start exploring. ### Explain Data permissions required for seeing explanations If you see Detected Outliers with a note to contact the owner of the viz, it is because you need permission to see these types of explanations. Select the owner name to go to their Tableau content page with their email address. Contact the owner to ask them to give you Explain Data permissions for the workbook or view. If you are the owner of the workbook, for more information on setting permissions, see [Control who can use Explain Data and what they can see](https://help.tableau.com/v0.0/online/en-us/explain_data_control_access.htm#Control). ### Tips for using Explain Data - Multiple marks can't be selected for comparison with each other. - The view must contain marks that are aggregated using SUM, AVG, COUNT, COUNTD, or AGG (a calculated field). - When Explain Data cannot analyze the type of mark selected, a message is displayed to indicate why. For more information, see [Situations where Explain Data is not available](https://help.tableau.com/v0.0/online/en-us/explain_data_requirements.htm#NotAvailable). - The data you analyze must be drawn from a single, primary data source. Explain Data does not work with blended or cube data sources. - For information on what characteristics make a data source more interesting for use with Explain Data, see [Requirements and Considerations for Using Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_requirements.htm). ## Drill into explanations 1. In the Data Guide pane, select an explanation name to see more details. Select an explanation to expand or contract its details. 2. Scroll to see more explanation details. 3. Hover over charts in the explanations to see details on different data points. Select the Open ![Open View icon.](/tableau/next/en-us/online/en-us/Img/explaindata_openviewicon.png) icon to see a larger version of the visualization. Creators or Explorers who open the view for editing can select the Open ![Open View icon.](/tableau/next/en-us/online/en-us/Img/explaindata_openviewicon.png) icon to open the visualization as a new worksheet and explore the data further. **Note**: Creators and Explorers who have editing permissions can also control Explain Data Settings. For more information, see [Control Access to Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_control_access.htm). 4. Hover over a Help icon ![Explain Data Help icon.](/tableau/next/en-us/online/en-us/Img/explaindata_helpicon.png) to see tooltip help for an explanation. Select the Help icon ![Explain Data Help icon.](/tableau/next/en-us/online/en-us/Img/explaindata_helpicon.png) to keep the tooltip open. Select a **Learn More** link to open the related help topic. ## View analyzed fields 1. [Run Explain Data on a dashboard, sheet, or mark](#RunExD). 2. In the Data Guide pane, under **Explore underlying values for**, select a target measure name. ![Explain Data details about an analyzed mark, with text highlighted that describes a higher than expected trip distance sum value of 8,800.](/tableau/next/en-us/online/en-us/Img/explaindata_viewfields1.png) 3. Select the _number-of-fields_ link at the bottom of the pane. ![Explain Data details about an analyzed mark, with text highlighted that reads "14 of 23 fields".](/tableau/next/en-us/online/en-us/Img/explaindata_viewfields2.png) Authors have the option to open Explain Data Settings to control which fields are included in the analysis. For more information, see [Change fields used for statistical analysis](https://help.tableau.com/v0.0/online/en-us/explain_data_lm_status.htm#IncludeExcludeFields). ## Terms and concepts in explanations The following terms and concepts appear frequently in explanations. You may find it helpful to become acquainted with their meaning in the context of using Explain Data. What is a mark? A mark is a selectable data point that summarizes some underlying record values in your data. A mark can be made of a single record or multiple records aggregated together. Marks in Tableau can be displayed in many different ways such as lines, shapes, bars, and cell text. Tableau gets the records that make up the mark based on the intersection of the fields in the view. The **analyzed mark** refers to a mark in a dashboard or sheet that was analyzed by Explain Data. For more information on marks, see [Marks](https://help.tableau.com/current/pro/desktop/en-us/view_parts.htm#Marks). What does expected mean? The expected value for a mark is the median value in the expected range of values in the underlying data in your viz. The expected range is the range of values between the 15th and 85th percentile that the statistical model predicts for the analyzed mark. Tableau determines the expected range each time it runs a statistical analysis on a selected mark. If an expected value summary says the mark is _lower than expected_ or _higher than expected_, it means the aggregated mark value is outside the range of values that a statistical model is predicting for the mark. If an expected value summary says the mark is _slightly lower_ or _slightly higher_ than expected or _within the range of natural variation_, it means the aggregated mark value is within the range of predicted mark values, but is lower or higher than the median. For more information, see [What is an expected range?](https://help.tableau.com/current/pro/desktop/en-us/explain_data_explained.htm#ExpectedRangeLM) What are dimensions and measures? Each column name in a database is a field. For example, Product Name and Sales are each fields. In Tableau, fields like Product Name that categorize data are called dimensions; fields with quantifiable data like Sales are called measures. Tableau aggregates measures by default when you drag them into a view. Some explanations describe how the underlying record values and the aggregations of those values may be contributing to the value of the analyzed mark. Other explanations may mention the distribution of values across a dimension for the analyzed mark. When you run Explain Data on mark, the analysis considers dimensions and measures in the data source that aren't represented in the view. These fields are referred to as unvisualized dimensions and unvisualized measures. For more information on dimensions and measures, see [Dimensions and Measures](https://help.tableau.com/current/pro/desktop/en-us/datafields_typesandroles.htm). What is an aggregate or aggregation? An aggregate is a value that is a summary or total. Tableau automatically applies aggregations such as SUM or AVG whenever you drag a measure onto Rows, Columns, a Marks card option, or the view. For example, measures are displayed as SUM(Sales) or AVG(Sales) to indicate how the measure is being aggregated. To use Explain Data, your visualization must use a measure that is aggregated with SUM, AVG, COUNT, COUNTD, or AGG. For more information about aggregation, see [Data Aggregation in Tableau](https://help.tableau.com/current/pro/desktop/en-us/calculations_aggregation.htm). What is a record value? A record is a row in a database table. A row contains values that correspond to each field. In this example, Category, Product Name, and Sales are fields (or columns). Furniture, Floor Lamp, and $96 are the values.

Category	Product Name	Sales
Furniture	Floor Lamp	$96.00

What is a distribution? A distribution is a list of all the possible values (or intervals) of the data. It also indicates how often each value occurs (frequency of occurrence). [Skip to main content](#main-content) # Get Started with Tableau Knowledge Use this guide to get up and running with Tableau Knowledge. The procedures explained in this guide take you through the initial setup steps and explain how to create your first knowledge graph. **Note:** Tableau Knowledge is currently available in English only. ## Licensing and roles Tableau Knowledge is available on Tableau Cloud+ and Tableau+. Your Tableau Cloud site role determines the actions that you can perform: | Task | Required Tableau Cloud site role | | --- | --- | | Create, change, or delete a knowledge graph | Tableau Cloud Site Administrator Creator, Tableau Cloud Site Administrator Explorer, and Tableau Cloud Creator | | Query a knowledge graph as a user or through an agent | Tableau Cloud Explorer or Tableau Cloud Viewer | **Note:** If a user doesn’t have view permissions for a specified asset, it doesn’t appear on their knowledge graph. ## Turn on Tableau Knowledge Tableau Cloud includes Tableau Knowledge as a feature, but Tableau Cloud hides it until you turn it on. To turn on Tableau Knowledge: 1. If you do not have a Salesforce org, create one now. For information about setting up a Salesforce org, see [Turn On AI in Your Tableau Cloud Site](https://help.tableau.com/v0.0/online/en-us/setup_tabAI_site_setting.htm). 2. From Tableau Cloud, click Settings. 3. Locate the AI Settings by Feature section. 4. Find the row that says Tableau Knowledge. 5. In the Actions column (…), click the ellipsis and turn Tableau Knowledge On. 6. At the top of the Settings page, Save your settings. 7. Tableau Knowledge tab appears in the left navigation pane. ## Open the Tableau Knowledge Home page To open the Tableau Knowledge Home page, click Tableau Knowledge in the left navigation pane. If it is not there, see [Turn on Tableau Knowledge](#turn-on). Tableau Knowledge opens in a new window. To return to Tableau Cloud, click the Return to Tableau Cloud button at the bottom of the page. ## Explore the Tableau Knowledge Home page When you open the Tableau Knowledge Home page, you see an overview of the health of your graphs. The metrics are relevant _only_ to the selected Knowledge Graph. The dashboard shows no data if you haven't created or activated a graph yet. This dashboard has several sections: 1. **Knowledge Graph Selector**—the selector shows up to 5 knowledge graphs. The default knowledge graph is first. Selecting a graph changes the rest of the page to be relevant for the graph selected. Only one knowledge graph can be the default knowledge graph. For more information, see [Default knowledge graph](https://help.tableau.com/v0.0/online/en-us/tableau_knowledge_about.htm#default-graph). **Note:** Only the nodes you have permission to view appear in the knowledge graph. 2. **Metrics**—in the metrics section, you find these data points: - **Context Coverage**—the percentage of entities that have minimum business context for an AI agent to interpret and answer questions about them. - **Total Nodes**—the total number of nodes included in the graph. - **Relationships**—the total number of edges included in the graph across all nodes in the graph. - **Issues**—the number of issues raised for the Knowledge Graph. Use the Tableau Agent for Knowledge for suggestions or the Chat menu to fix these issues and to keep this number as low as possible. For more information, see [Tableau Agent for Knowledge](https://help.tableau.com/v0.0/online/en-us/tableau_knowledge_about.htm#assistant). 3. **Health Score**—a percentage that indicates how healthy your knowledge graph is. The higher this number is, the better. The system calculates this percentage by averaging the completion rate of each item in the Quality Scorecard section. 4. **Quality Scorecard**—provides a breakdown of the health score. These metrics compose the health score: - **Certification**—published data sources require review and certification, so they’re trusted. This graph indicates the percentage of certified sources. - **Ownership**—every entity type requires an owner. The graph represents the percentage of owned assets. - **Descriptions**—when entities have descriptions, agents understand what it is for. This graph represents the percentage of nodes that have descriptions. - **Connected Nodes**—orphaned nodes confuse agents, while connected nodes help agents understand relationships between nodes. The graph represents the percentage of connected nodes. 5. **Recommended Actions**—an AI-generated list of suggestions proposed by the Tableau Agent for Knowledge, for improving your knowledge graph performance. Click any of the buttons to view the issue requiring your attention. ## Create your first knowledge graph 1. From the Tableau Knowledge Home page, click Manage Graphs. 2. From the top of the Knowledge Graph page, click \+ Create Graph. 3. Your first step is to select the workbooks to include in the graph. To include a workbook, click the Workbooks tab. Available workbooks appear in the widget. You can also search or filter the results in the widget. To select a workbook, click the checkbox. 4. The next step is to select published data sources to include in the graph. To include a source, click the Published Data Sources tab. Available published data sources appear in the widget. You can also search or filter the results in the widget. To select a source, click the checkbox. 5. When you're done selecting, click Continue. 6. In the Graph Name field, give the graph a unique name. 7. Add an optional description. 8. Click Create Graph at the bottom of the page. 9. Refresh the Knowledge Graphs page. Your new knowledge graph appears. Wait until it’s ready. After it’s ready, proceed to the next step: [Set the knowledge graph as default](#set-as-default). ## Set the knowledge graph as default As you only have one graph created, make the graph your default knowledge graph. For more information, see [Default knowledge graph](https://help.tableau.com/v0.0/online/en-us/tableau_knowledge_about.htm#default-graph). Without setting a default knowledge graph, you see an error message. To remove it, set the knowledge graph as default. To set the knowledge graph as default: 1. From the Tableau Knowledge Home page, click Manage Graphs. 2. The page shows a tile with the knowledge graph that you created. 3. On that tile, click the More menu (3 vertical dots). 4. Select Set as default. 5. Confirm that from the Manage Graphs page, the knowledge graph tile shows a Default icon. ## Navigate around your knowledge graph The graph and explorer views allow you to navigate the knowledge graph and also to search for a specific node or drill down into the graph and explore individual nodes. **When in Graph View** To search for a node: From the search bar, enter the name of a node. As you type, the search results appear. Click on one, and jump straight to the node. To zoom in: From the navigation bar, click the + icon. To zoom out: From the navigation bar, click the - icon. To drill down: Double-click on a node. **When in Explorer View** To explore the graph: The graph is represented as a vertical tree with each node collapsed. To drill down, expand the relevant node. To search for a node: From the search bar, enter the name of a node. As you type, the search results appear. Click on one, and jump straight to the node. ## Add global business preferences Global business preferences are applicable to the entire knowledge graph. Adding global business preferences allows agents to: - Understand how data is used across the organization - Clarify specific terminology - Align and explain principles the company works You can either build a business preference by creating a single natural language instruction, or you can upload a file with your business preferences. For every preference in the file, Tableau Knowledge generates a business preference. If you are using a file, adhere to the following guidelines: - Separate each business preference with a blank line—one preference per paragraph. - Save the file in any of the supported formats: PDF, DOCX, TXT, MD, or CSV. To add a global business preference: 1. From Tableau Knowledge, click Manage Graphs in the left-side navigation menu. 2. Click the Add + button. 3. Select Add Business Preferences. 4. Choose how you want to proceed. You can either select Add Preference to add a single instruction, or you can select Upload File to upload a preferences file. 5. If you chose, Add Preference, fill in the fields as follows: 1. Title\- you can give the business preference a title for easier identification. 2. Scope - this field cannot be changed. It should say All entities (global) 3. Preference - add instructions for the agent. For example “When asking about Revenue, always sum the TOTAL\_AMOUNT.” Save your preferences. 6. If you chose Upload a Document: 1. Drag and drop a file into the upload window or use the Browse button to locate your file. 2. Fill in the fields as follows: 1. Title - you can give the business preference a title for easier identification. 2. Scope - do not change, it should say All entities (global) Save your preferences. ## Connect your knowledge graph to Tableau Model Context Protocol (MCP) Connecting your knowledge graph to the Tableau MCP server enables Tableau Agent and other agents to query your knowledge graph. To get started with a Tableau MCP server, read the [Getting Started](https://tableau.github.io/tableau-mcp/docs/getting-started) guide. ## Learn more When you are on the Home page, click the Start Tour button, which opens a Screen tour of all the menu elements and provides contextual help for Tableau Knowledge pages. ## See also - [About Tableau Knowledge](https://help.tableau.com/v0.0/online/en-us/tableau_knowledge_about.htm) - [Tableau Cloud Help](https://help.tableau.com/current/online/en-us/tableau-online-home.htm) - [Tableau Cloud: Tableau MCP Server](https://tableau.github.io/tableau-mcp/docs/intro) - [Salesforce Help: Tableau](https://help.salesforce.com/s/articleView?id=analytics.tableau.htm&type=5) [Skip to main content](#main-content) # Get Tableau Pulse Alerts Tableau Pulse alerts you when a metric you follow crosses into an unfavorable threshold range or has a new unfavorable trend. These alerts appear in your email and Slack digests and are sent as mobile notifications so that you don’t miss important changes to your data. If you have your digest frequency set to weekly or monthly, Tableau Pulse sends an email and Slack message with any alerts found on days that you don’t receive a digest. ## How Tableau Pulse identifies alerts Once every 24 hours, Tableau Pulse checks for alerts. This check occurs at the same time that Tableau Pulse generates email and Slack digests. If a threshold or trend alert is found, the alert is included in that day’s digest. If you aren’t scheduled to receive a digest that day, Tableau Pulse sends an alert email and Slack message. These off-cycle messages are sent at the same time of day when digests are normally sent. An alert badge also appears for the next 24 hours on the impacted metric card and on that metric’s Insights Exploration page, until the next time that Tableau Pulse checks for alerts. ### Threshold crossed alerts For metrics with an unfavorable threshold range defined, Tableau Pulse alerts you when the aggregate metric value crosses into the unfavorable range. The aggregate metric value is the value for the entire time range that the metric is scoped to, such as the sum of a measure for the month. This aggregate value appears at the top of the metric card and the Insights Exploration page. Some metrics have charts that show non-cumulative values. If one of the non-cumulative values crosses into the unfavorable threshold range, it doesn’t trigger an alert unless that change causes the aggregate value to enter the unfavorable range. Tableau Pulse notifies you only when the metric initially crosses into the unfavorable range. You don’t continue to receive notifications while the value stays in the unfavorable range. However, if the aggregate value goes back into a favorable range and then again crosses into an unfavorable threshold range, you receive another alert. ### Trend change alerts The Tableau Pulse insights platform monitors metrics to detect important changes to the data. The trend change alert is one of the insight types that the insights platform looks for. For more information about Tableau Pulse insights, see [The Insights Platform and Insight Types in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_insights_platform_insight_types.htm). A trend change alert is triggered if there is a new unfavorable trend for a metric. - To qualify as new, a trend must vary significantly from the current trend. This change could be the steepening, flattening, or reversal of the previous trend. - There must be a sentiment set on the metric definition to determine if the value going up or down is unfavorable. - The trend change must occur over at least three periods. A single-day change from a favorable to an unfavorable direction doesn’t constitute a trend. Tableau Pulse alerts you only on the day when the trend is initially identified. You won’t continue to receive alerts while the same trend continues. Because the insights platform takes patterns in your data into account when identifying trends, you don’t get alerts for expected seasonal changes. On a metric page, select the trend change badge, then select Go to Insight to see details about the trend. ![Trend change badge](/tableau/next/en-us/online/en-us/Img/pulse_trend_change_badge.png) Explore the chart for the insight to see the data points that make up the unfavorable trend. ![Trend change chart](/tableau/next/en-us/online/en-us/Img/pulse_trend_change_chart.png) ## See new alerts Alerts appear in email and Slack, on the metrics that you follow, and as mobile notifications.

Location	Alert description
Email and Slack digests	Alerts are listed at the top of your digest. The alerts shown in a digest are those that were found at the time that the digest was generated. Alerts aren’t aggregated in weekly or monthly digests.
Email and Slack	If Tableau Pulse finds alerts on a day that you aren’t scheduled to receive a digest, you receive an email and Slack message with those alerts.
Tableau home page	Alerts appear in the Tableau Pulse Alerts center at the top of the home page. Alerts appear for 24 hours, until the next time that Tableau Pulse checks for new unfavorable trends. Alert badges also appear on the metrics that you follow. You don’t see alerts as you browse or search for metrics that you aren’t following.
Tableau Mobile	You receive a mobile notification for an alert if Tableau Mobile is running on your device. If you fully quit the Tableau Mobile app, you don’t get a notification. To turn off the notification on your mobile device, adjust your device’s notification settings for Tableau Mobile.

## Turn off alerts for a metric You receive alerts for all of the metrics that you follow. You can turn off alerts for individual metrics. 1. Open the metric that you want to turn off alerts for. 2. Select the actions (⋯) menu, then select Turn Off Alerts. You can turn alerts on again by selecting the actions menu, then selecting Turn On Alerts. ## Control whether Tableau Pulse checks for threshold and trend changes There's no separate set up for alerts in Tableau Pulse. If a metric has an unfavorable threshold range defined, Tableau Pulse alerts when that metric crosses into the unfavorable range. The Trend Change Alert insight setting controls whether Tableau Pulse generates insights for new trends and whether new unfavorable trends are shown as alerts to followers. To learn how to turn off insight types, see [Configure insights](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#configure-insights). If you turn off this insight type on a metric definition, the changes apply to all metrics based on that definition. The setting also turns off trend insights on a metric’s Insights Exploration page. There isn’t a way to turn off the alert without turning off the insight. Turning off the insight type doesn’t immediately remove the alert from impacted metrics. The alerts are removed the next time that Tableau Pulse checks for alerts and generates digests, which can take up to 24 hours. [Skip to main content](#main-content) # Getting Started with Tableau Cloud+ Edition Tableau Cloud+ edition is available for Tableau Cloud. It is tailored for wall-to-wall adoption of AI-powered, self-service analytics. It encompasses premium features tailored for larger or more complex deployments like premium AI functionality with Tableau Agent, a 50 site limit, Release Preview and Premier Success for Tableau Cloud. Tableau Cloud+ edition includes some features that require configuration, and this topic describes what you need to do for each of them. Some are unique to Tableau Cloud+ while others are shared with other editions of Tableau Cloud. A few require configuration in Salesforce. Initial steps depend on what type of customer you are: - New Tableau customers As a new Tableau Cloud customer you should get familiar with Tableau Cloud before you explore the unique features of the Tableau Cloud+ edition. See [Get Started](https://help.tableau.com/v0.0/online/en-us/to_get_started.htm) and [About Tableau Cloud+ Edition](https://help.tableau.com/v0.0/online/en-us/to_tab_cloud_plus_features.htm) to begin, then follow the configuration steps below. - Existing Tableau Cloud customers For existing Tableau Cloud customers who upgrade to Tableau Cloud+, there is little to do regarding “migrating.” Your existing sites remain (there’s no need to “migrate” them), but unique Tableau Cloud+ features require some configuration. ## Configure Tableau Cloud and Salesforce for Tableau Cloud+ features These Tableau Cloud+ features require configuration before you can use them: - **Tableau Pulse**: [Set Up Your Site for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm) (**Note:** Be sure to enable Tableau Pulse summaries of key metrics, which is described in the same topic, here: [AI in Tableau for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-ai).) - **Tableau Agent** in Prep, Catalog, and Web authoring: [Turn On AI in Your Tableau Cloud Site](https://help.tableau.com/v0.0/online/en-us/setup_tabAI_site_setting.htm) to enable Tableau Agent. This requires configuration on each Tableau Cloud site _and_ in a Salesforce org that has Einstein generative AI configured. It also requires a Data 360 instance. - A Data 360 instance is provided to Tableau Cloud+ customers who do not have one. - For those that do not have an Enterprise edition level or higher Salesforce org, one will be provided as part of the Tableau Cloud+ license. - **Data 360** Configure Data 360 by setting up an admin user and turning Data 360 on: [Step 2: Set up a Data Cloud Architect User](https://help.tableau.com/v0.0/online/en-us/setup_tabAI_site_setting.htm#setup_dc_permissions). The following features are not unique to Tableau Cloud+ but provide additional important functionality in your Tableau Cloud instance: - **Data Management**: [About Data Management](https://help.tableau.com/v0.0/online/en-us/dm_overview.htm) (comes with one resource block. For more information, see [Resource Blocks](https://help.tableau.com/v0.0/online/en-us/to_resource_blocks.htm)). - **Advanced Management**: [About Tableau Advanced Management on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/itm_intro.htm) - **Tableau Cloud Manager**: Manage multiple Tableau Cloud sites using TCM. Tableau Cloud+ customers get up to 50 sites. For details about using TCM, see [Use Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_intro.htm). - [Premier Success](https://www.salesforce.com/services/success-plans/overview/premier-success-plans/): Get maximum value from Tableau with expert guidance and expedited support. - [eLearning](https://www.tableau.com/learn/training/elearning): Learn Tableau on your own schedule using self-paced online courses. [Skip to main content](#main-content) # Getting Started with Tableau Content Migration Tool This article will help you get started with the Tableau Content Migration Tool. It contains links to other articles about information you need to prepare before installing the Content Migration Tool, and steps to design a migration plan and upgrade existing installations. ## Pre-installation ### Installation requirements The Content Migration Tool can only be installed on Windows operating systems. Before installing, you must be able to connect to the Tableau source site (the site you are migrating from) and the destination site (the site you are migrating to) from the computer where Content Migration Tool is installed. Both the source and destination sites must have a valid [Advanced Management](https://help.tableau.com/v0.0/online/en-us/itm_intro.htm) license. For more information about installing and upgrading Content Migration Tool, see [Install Tableau Content Migration Tool](https://help.tableau.com/v0.0/online/en-us/cmt-install.htm). ### Compatibility with Tableau Cloud Content Migration Tool version 2022.2.1 and later support content migration for all Tableau Cloud deployments. We recommend installing the most recent version from the [Tableau Advanced Management](https://www.tableau.com/support/releases/advanced-management) downloads page to take advantage of the latest features and fixes. ### Compatibility with Tableau Server The Content Migration Tool supports content migration for Tableau Server versions 2019.3 and later. The table lists compatible versions of Tableau Server based on the installed version of Content Migration Tool. | CMT Version | Tableau Server Version | | --- | --- | | 2025.2x | 2023.3x - 2025.1.x | | 2025.1x | 2023.3x - 2025.1.x | | 2024.3x | 2022.3x - 2024.2.x | | 2024.2x | 2022.3x - 2024.2.x | | 2024.1x | 2022.1x - 2024.1.x | | 2023.3.x | 2021.4.x - 2023.3.x | | 2023.2.x | 2021.3.x - 2023.2.x | | 2023.1.x | 2021.2.x - 2023.1.x | | 2022.4.x | 2021.1.x - 2022.4.x | | 2022.3.x | 2020.4.x - 2022.3.x | | 2022.2.x | 2020.3.x - 2022.2.x | | 2022.1.x | 2020.2.x - 2022.1.x | | 2021.4.x | 2020.1.x - 2021.4.x | | 2021.3.x | 2019.4.x - 2021.3.x | | 2021.2.x | 2019.3.x - 2021.2.x | | 2021.1.x | 2019.3.x - 2021.1.x | | 2020.4.x | 2019.3.x - 2020.4.x | | 2020.3.x | 2019.3.x - 2020.3.x | **Note:** If you have a Tableau Server deployment, you can migrate content between projects on a Tableau Server installation and a Tableau Cloud site. Both sites must have a valid Advanced Management license. ### Compatibility with Tableau content The Content Migration Tool supports migrating workbooks and published data sources saved in the eight most recent versions of Tableau. While you can migrate existing data sources, only data sources that use the connection types in the table below can be changed and modified during migration. For more information, see Data Source Transformations in [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm) and [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm).

Actian Matrix

Actian Vectorwise

Amazon Athena

Amazon Aurora

Amazon EMR

Amazon Redshift

Apache Drill

Aster Database

Box

Cloudera Hadoop

Delimited Text File

EXASOL

Firebird

Google Analytics

Google BigQuery

Google Cloud SQL

Google Drive

HortonWorks Hadoop Hive

HP Vertica

IBM DB2

IBM Netezza

Map R Hadoop Hive

Microsoft Access

Microsoft Analysis Services

Microsoft Excel

Microsoft Excel Direct

Microsoft OneDrive

Microsoft SQL Server

MySQL

OData

Oracle

Oracle Essbase

Pivotal Greenplum Database

PostgreSQL

Progress OpenEdge

Salesforce

SAP HANA

SAP Sybase ASE

SAP Sybase IQ

Snowflake

Spark SQL

Statistical File

Tableau Extract

Tableau Published Data Source

Teradata

Text File

Web Data Connector

Other Databases (ODBC)

## Post-installation ### Limitations when migrating content Before you start, make sure you understand the limitations when migrating content using the Content Migration Tool. For more information, see [Migration Limitations](https://help.tableau.com/v0.0/online/en-us/cmt-migration_limitations.htm). ### Create a migration plan The Content Migration Tool walks you through migrating content across projects on a single site, to a new site on the same Tableau Server instance, and to sites that exist on different Tableau Server instances. The plan you create can be saved and used again for future migrations. For more information, see [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm). [Skip to main content](#main-content) # Getting Started with Tableau+ Bundle Tableau+ Bundle is a comprehensive package tailored for wall-to-wall adoption of self-service, agentic analytics in Tableau Cloud and Tableau Next. It encompasses premium features tailored for larger or more complex deployments like Release Preview and a 50 site limit, premium AI functionality like Tableau Agent, and Premier Success for Tableau Cloud. With the Tableau+ Bundle, customers also get access to the world’s first agentic analytics platform, Tableau Next Tableau+ Bundle includes some features that require configuration, and this topic describes what you need to do for each of them. Some are unique to the Tableau+ Bundle while others are shared with editions of Tableau Cloud. A few require configuration in Salesforce. Initial steps depend on what type of customer you are: - New Tableau customers As a new Tableau Cloud customer you should get familiar with Tableau Cloud before you explore the unique features of Tableau+ Bundle. See [Get Started](https://help.tableau.com/v0.0/online/en-us/to_get_started.htm) and [About Tableau+ Bundle](https://help.tableau.com/v0.0/online/en-us/to_tab_plus_features.htm) to begin, then follow the configuration steps below. - Existing Tableau Cloud customers For existing Tableau Cloud customers who upgrade to Tableau+ Bundle, there is little to do regarding “migrating.” Your existing sites remain (there’s no need to “migrate” them), but unique Tableau+ Bundle features require some configuration. ## Configure Tableau Cloud and Salesforce for Tableau+ Bundle features These Tableau+ Bundle features require configuration before you can use them: - **Tableau Pulse**: [Set Up Your Site for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm) (**Note:** Be sure to enable Tableau Pulse summaries of key metrics, which is described in the same topic, here: [AI in Tableau for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-ai).) - **Tableau Agent** in Prep, Catalog, and Web authoring: [Turn On AI in Your Tableau Cloud Site](https://help.tableau.com/v0.0/online/en-us/setup_tabAI_site_setting.htm) to enable Tableau Agent. This requires configuration on each Tableau Cloud site _and_ in a Salesforce org that has Einstein generative AI configured. It also requires a Data 360 instance. - A Data 360 instance is provided to Tableau+ Bundle customers who do not have one. - For those that do not have an Enterprise edition level or higher Salesforce org, one will be provided as part of Tableau+ Bundle. - **Data 360** Configure Data 360 by setting up an admin user and turning Data 360 on: [Step 2: Set up a Data Cloud Architect User](https://help.tableau.com/v0.0/online/en-us/setup_tabAI_site_setting.htm#setup_dc_permissions). The following features are not unique to Tableau+ Bundle but provide additional important functionality in your Tableau Cloud instance: - **Data Management**: [About Data Management](https://help.tableau.com/v0.0/online/en-us/dm_overview.htm) (comes with one resource block. For more information, see [Resource Blocks](https://help.tableau.com/v0.0/online/en-us/to_resource_blocks.htm)). - **Advanced Management**: [About Tableau Advanced Management on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/itm_intro.htm) - **Tableau Cloud Manager (TCM)**: Manage multiple Tableau Cloud sites using TCM. Tableau+ Bundle customers get up to 50 sites. For details about using TCM, see [Use Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_intro.htm). - [Premier Success](https://www.salesforce.com/services/success-plans/overview/premier-success-plans/): Get maximum value from Tableau with expert guidance and expedited support. - [eLearning](https://www.tableau.com/learn/training/elearning): Learn Tableau on your own schedule using self-paced online courses. [Skip to main content](#main-content) # Google Authentication If your organization uses Google, you can enable Tableau Cloud or TCM to use Google accounts for single sign-on (SSO) with multi-factor authentication (MFA) using OpenID Connect. Tableau supports Google authentication as an authentication type. When you enable Google authentication, users are directed to the Google sign-in page to enter their credentials, which are stored and managed by Google. ## Configure authentication type If your organization already uses Google, then set the authentication type to Google in Tableau Cloud or TCM. **For Tableau Cloud** 1. Sign in to Tableau Cloud as a site admin. 2. Select Settings > Authentication, click the New Configuration button, and select Google from the Authentication drop-down. **Note:** If Google is not on the list of available options, then Google authentication is already enabled for your site. 3. Enter a name for the configuration, and click Save Changes. ![](/tableau/next/en-us/online/en-us/Img/to_site_auth_google.png) **Note:** Configurations created before January 2025 (Tableau 2024.3) can't be renamed. 4. Add new users (or update any previous users) to use Google as their configured authentication type. - To add users, see [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm). - To update a user's authentication method, see [Set the User Authentication Type](https://help.tableau.com/v0.0/online/en-us/users_set_auth_type.htm). **For TCM** 1. Sign in to TCM as a cloud admin. 2. Select Settings > Authentication and select the Enable an additional authentication method check box. 3. From the Authentication drop-down menu, select Google. 4. Add new users (or update any previous users) to use Google as their configured authentication type. - To add users, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm). - To update a user's authentication method, see [Set the User Authentication Type](https://help.tableau.com/v0.0/online/en-us/users_set_auth_type.htm). [Skip to main content](#main-content) # Grant License on Sign In Grant license on sign in (Grant role on sign in) lets unlicensed users in specific groups become licensed when they sign into a Tableau site. This streamlines license provisioning for administrators and removes the user’s need to request a license before using Tableau. For more information about site role capabilities and minimum site roles, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm). For example, imagine that your company has 100 people in the Marketing group, but only 25 members need to access Tableau Cloud. The Tableau Cloud site administrator isn't sure which 25 need Tableau. That administrator can create a Marketing user group with an Explorer minimum site role, select Grant role on sign in, and add all 100 Marketing members to the group. Instead of provisioning licenses to the entire group, the 25 Tableau users in Marketing are provisioned Explorer licenses when they sign in to their Tableau Cloud site. Those who don't need Tableau Cloud remain unlicensed unless they sign in. **Note**: For more information about benefits and best practices, see [Grant Role on Sign In](https://help.tableau.com/current/blueprint/en-us/bp_license_management.htm#grant-role-on-sign-in) in Tableau Blueprint, Tableau's planning tool for data-driven organizations. ## Activate Grant role on sign in You can enable Grant role on sign in on new or existing groups. The following steps walk through how to use Grant role on sign in to add new users that are eligible for a license but may not consume one. This may be the case when your company has a lot of eligible users, but limited Tableau licenses. 1. On a site, add a new group: 1. From the left navigation pane, click **Groups**, and then click New Group. 2. Enter a group name. ![New Group form with options for group name, on demand access, and licensed users.](/tableau/next/en-us/online/en-us/Img/online_new_group.png) 3. Optionally and if your site is licensed with [usage-based model](https://help.tableau.com/v0.0/online/en-us/license_product_keys.htm#embedded-analytics-usagebased-license-model), select the Allow on-demand access check box. For more information, see one of the following: [On-demand access using connected apps with direct trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_direct.htm) or [On-demand access using connected apps with OAuth 2.0 trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_eas.htm). 4. Select Grant role on sign in and select a minimum site role for the group. This setting means licenses and site roles will only be provisioned to group users who sign into this Tableau Cloud site. 5. Click Create. 2. Add users to a site by entering users’ usernames (in email address format) individually or bulk import users using a CSV file. If bulk adding users, follow the steps described in [Import Users](https://help.tableau.com/v0.0/online/en-us/users_import.htm) via a CSV file that you create using the [CSV Import File Guidelines](https://help.tableau.com/v0.0/online/en-us/csvguidelines.htm). ![A Site Admin can add users by email or import from a file.](/tableau/next/en-us/online/en-us/Img/users_add_online.png) If adding users by username, do the following 1. On the Users page, click the Add Users button. 2. Enter usernames (in email address format). For information on assigning Google, OIDC, SAML, or Salesforce authentication when adding users, see [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm). If you add more than one user, separate username with a semicolon (;). For example, _tdavis@example.com; jjohnson@example.com; hwilson@example.com_ 3. Set the site role for those users to Unlicensed. 4. Click Add Users. 3. Add those new, unlicensed users to the new group. - From the left navigation pane, click **Groups**, and then click the name of the group. - On the Group's page, click **Add Users**. ![Group page showing the Add Users button.](/tableau/next/en-us/online/en-us/Img/groups_addusers.png) - Select the users to be added, and then click **Add Users**. For more information, see [Create a Group and Add Users to It](https://help.tableau.com/v0.0/online/en-us/to_add_users_groups.htm). ## Modifying user roles with Grant role on sign in If a user is part of a group using Grant role on sign in, then that user role can't be set to unlicensed or downgraded to a role lower than the minimum site role set for the group, whether or not they sign in. Administrators can upgrade a user’s site role manually, however. To downgrade a user’s site role, or unlicense the user from the site, remove the user from the group(s) that have Grant role on sign in enabled. In accordance with the terms of the [End User License Agreement](https://mkt.tableau.com/legal/tableau_eula.pdf), licenses granted on an Authorized User basis may be permanently reassigned to new users. Users may only be downgraded to a lower site role (including Unlicensed) when they will permanently discontinue access to Server Software at the higher role. ## Removing users affected by Grant role on sign in You can remove a user from a site only if the user does not own content. If you attempt to remove a user who owns content, the user site role will be set to Unlicensed and removed from all groups, but the user will not be removed from the site. To remove content owners, remove owners from group with Grant site role enabled or reassign content ownership to another user. For more information, see Remove users from a site in the [View, Manage, or Remove Users](https://help.tableau.com/v0.0/online/en-us/users_view.htm) Help topic. If the default All Users group has Grant site role enabled, users who own content can't be removed from the site or unlicensed. To remove or unlicense these users, reassign content ownership to another user, then remove or unlicense the user. Tableau REST API can be used to reassign content ownership of a workbook. For more information, see [Update Workbook](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_workbooks_and_views.htm#update_workbook) method in the REST API Help. REST API can also be used to remove users from the site and transfer content ownership to another user. For more information, see [Remove User from Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#remove_user_from_site) method in the REST API Help. For more information on reassigning content ownership in Tableau Cloud, see [Manage Content Ownership](https://help.tableau.com/v0.0/online/en-us/owner.htm#change-the-owner-of-a-content-resource). [Skip to main content](#main-content) # Groups Data Source The Groups data source identifies group membership of users on the site. There's one row of data for each unique combination of group and user pairing. Groups without members, and users not in a group, are included as a row of data with null values represented as "NULL". ## Create custom views If you're a site admin or someone who has been granted access to the Admin Insights project, you can access the Admin Insights data sources directly from Tableau Cloud using Web Authoring or through Tableau Desktop to build custom views. For more information about connecting to Admin Insights data sources, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Example: Which users are in a given group? Use the following steps to create a view that displays the users in a group. 1. Connect to the Groups data source. 2. From the Data pane, drag Group Name to the Rows shelf. 3. (Optional) In the view, select the groups you want to explore, and then select Keep Only. 4. From the Data pane, drag User Email to the Rows shelf, placing it to the right of the Group Name field. ## Do more with your data Using Tableau Prep, you can join Groups with other Admin Insights data sources on the following fields to get more visibility into your site. If you're analyzing data from multiple Tableau Cloud sites, you must also join on "Site LUID = Site LUID". - Join Groups to TS Users on "User LUID = User LUID" For more information, see [Aggregate, Join, or Union Data](https://help.tableau.com/current/prep/en-us/prep_combine.htm) in Tableau Prep Help. ## Data schema The following table lists the fields included in the Groups data source. Each row of data corresponds to a unique combination of group and user pairing.

Folder	Field Name	Type	Description
Group	Group Is Licensed On Site	Boolean	Whether or not Grant License on Sign In is enabled
	Group LUID	String	LUID of the group associated with the user. Primarily useful for referencing a group in the REST API.
	Group Minimum Site Role	String	Minimum site role associated with the group. Will be null if Grant License on Sign In is not enabled.
	Group Name	String	Name of the group
Site	Site LUID	String	LUID of the site associated with the user. Primarily useful for referencing a site in the REST API.
Site	Site Name	String	Name of the site associated with the user
User	User Email	String	Email address associated with the user's account
User	User LUID	String	LUID of the user. Primarily useful for referencing users in the REST API
-	Admin Insights Published At	Date-time	Date and time the Admin Insights data source was last published in UTC
	Count of Distinct Groups	Number	Distinct count of groups on the site
	Count of Distinct Users	Number	Distinct count of users on the site

[Skip to main content](#main-content) # How Explain Data Works Use Explain Data as an incremental, jumping-off point for further exploration of your data. The possible explanations that it generates help you to see the different values that make up or relate to an analyzed mark in a view. It can tell you about the characteristics of the data points in the data source, and how the data might be related (correlations) using statistical modeling. These explanations give you another tool for inspecting your data and finding interesting clues about what to explore next. **Note**: Explain Data is a tool that uncovers and describes relationships in your data. It can't tell you what is causing the relationships or how to interpret the data. **You are the expert on your data.** Your domain knowledge and intuition is key in helping you decide what characteristics might be interesting to explore further using different views. For related information on how Explain Data works, and how to use Explain Data to augment your analysis, see these Tableau Conference presentations: - [From Analyst to Statistician: Explain Data in Practice (1 hour)](https://www.tableau.com/events/tc/2019/analyst-statistician-explain-data-practice) - [Leveraging Explain Data (45 minutes)](https://www.tableau.com/events/tc/2019/leveraging-explain-data) ## What Explain Data is (and isn’t) Explain Data is: - A tool and a workflow that leverages your domain expertise. - A tool that surfaces relationships in your data and recommends where to look next. - A tool and a workflow that helps expedite data analysis and make data analysis more accessible to a broader range of users. Explain Data is not: - A statistical testing tool. - A tool to prove or disprove hypotheses. - A tool that is giving you an answer or telling you anything about causality in your data. When running Explain Data on marks, keep the following points in mind: - **Use granular data that can be aggregated**. This feature is designed explicitly for the analysis of aggregated data. This means that your data must be granular, but the marks that you select for Explain Data must be aggregated or summarized at a higher level of detail. Explain Data can't be run on disaggregated marks (row-level data) at the most granular level of detail. - **Consider the shape, size, and cardinality of your data**. While Explain Data can be used with smaller data sets, it requires data that is sufficiently wide and contains enough marks (granularity) to be able to create a model. - **Don't assume causality**. Correlation is not causation. Explanations are based on models of the data, but are not causal explanations. A correlation means that a relationship exists between some data variables, say A and B. You can't tell just from seeing that relationship in the data that A is causing B, or B is causing A, or if something more complicated is actually going on. The data patterns are exactly the same in each of those cases and an algorithm can't tell the difference between each case. Just because two variables seem to change together doesn't necessarily mean that one causes the other to change. A third factor could be causing them both to change, or it may be a coincidence and there might not be any causal relationship at all. However, you might have outside knowledge that is not in the data that helps you to identify what's going on. A common type of outside knowledge would be a situation where the data was gathered in an experiment. If you know that B was chosen by flipping a coin, any consistent pattern of difference in A (that isn't just random noise) must be caused by B. For a longer, more in-depth description of these concepts, see the article [Causal inference in economics and marketing](https://www.pnas.org/content/pnas/113/27/7310.full.pdf) by Hal Varian. ## How explanations are analyzed and evaluated Explain Data runs a statistical analysis on a dashboard or sheet to find marks that are outliers, or specifically on a mark you select. The analysis also considers possibly related data points from the data source that aren't represented in the current view. Explain Data first predicts the value of a mark using only the data that is present in the visualization. Next, data that is in the data source (but not in the current view) is considered and added to the model. The model determines the range of predicted mark values, which is within one standard deviation of the predicted value. ### What is an expected range? The expected value for a mark is the median value in the expected range of values in the underlying data in your viz. The expected range is the range of values between the 15th and 85th percentile that the statistical model predicts for the analyzed mark. Tableau determines the expected range each time it runs a statistical analysis on a selected mark. Possible explanations are evaluated on their explanatory power using statistical modeling. For each explanation, Tableau compares the expected value with the actual value. | value | Description | | --- | --- | | Higher than expected / Lower than expected | If an expected value summary says the mark is _lower than expected_ or _higher than expected_, it means the aggregated mark value is outside the range of values that a statistical model is predicting for the mark. If an expected value summary says the mark is _slightly lower_ or _slightly higher_ than expected, or _within the range of natural variation_, it means the aggregated mark value is within the range of predicted mark values, but is lower or higher than the median. | | Expected Value | If a mark has an expected value, it means its value falls within the expected range of values that a statistical model is predicting for the mark. | | Random Variation | When the analyzed mark has a low number of records, there may not be enough data available for Explain Data to form a statistically significant explanation. If the mark’s value is outside the expected range, Explain Data can’t determine whether this unexpected value is being caused by random variation or by a meaningful difference in the underlying records. | | No Explanation | When the analyzed mark value is outside of the expected range and it does not fit a statistical model used for Explain Data, no explanations are generated. | ### Models used for analysis Explain Data builds models of the data in a view to predict the value of a mark and then determines whether a mark is higher or lower than expected given the model. Next, it considers additional information, like adding additional columns from the data source to the view, or flagging record-level outliers, as potential explanations. For each potential explanation, Explain Data fits a new model, and evaluates how unexpected the mark is given the new information. Explanations are scored by trading off complexity (how much information is added from the data source) against the amount of variability that needs to be explained. Better explanations are simpler than the variation they explain.

Explanation type	Evaluation
Extreme values	Extreme values are aggregated marks that are outliers, based on a model of the visualized marks. The selected mark is considered to contain an extreme value if a record value is in the tails of the distribution of the expected values for the data. An extreme value is determined by comparing the aggregate mark with and without the extreme value. If the mark becomes less surprising by removing a value, then it receives a higher score. When a mark has extreme values, it doesn't automatically mean it has outliers, or that you should exclude those records from the view. That choice is up to you depending on your analysis. The explanation is simply pointing out an interesting extreme value in the mark. For example, it could reveal a mistyped value in a record where a banana cost 10 dollars instead of 10 cents. Or, it could reveal that a particular sales person had a great quarter.
Number of records	The number of records explanation models the aggregate sum in terms of the aggregate count; average value of records models it in terms of the aggregate average. The better the model explains the sum, the higher the score. This explanation describes whether the sum is interesting because the count is high or low, or because the average is high or low.
Average value of the mark	This type of explanation is used for aggregate marks that are sums. It explains whether the mark is consistent with the other marks because in terms of its aggregate count or average, noting the relation SUM(X) = COUNT(X) * AVG(X). This explanation describes whether the sum is interesting because the count is high or low, or because the average is high or low.
Contributing Dimensions	This explanation models the target measure of the analyzed mark in terms of the breakdown among categories of the unvisualized dimension. The analysis balances the complexity of the model with how well the mark is explained. An unvisualized dimension is a dimension that exists in the data source, but isn't currently being used in the view. This type of explanation is used for sums, counts and averages. The model for unvisualized dimensions is created by splitting out marks according to the categorical values of the explaining column, and then building a model with the value that includes all of the data points in the source visualization. For each row, the model attempts to recover each of the individual components that made each mark. The analysis indicates whether the model predicts the mark better when components corresponding to the unvisualized dimension are modeled and then added up, versus using a model where the values of the unvisualized dimension are not known. Aggregate dimension explanations explore how well mark values can be explained without any conditioning. Then, the model conditions on values for each column that is a potential explanation. Conditioning on the distribution of an explanatory column should result in a better prediction.
Contributing Measures	This explanation models the mark in terms of this unvisualized measure, aggregated to its mean across the visualized dimensions. An unvisualized measure is a measure that exists in the data source, but isn't currently being used in the view. A Contributing Measures explanation can reveal a linear or quadratic relationship between the unvisualized measure and the target measure.

[Skip to main content](#main-content) # How Relationships Differ from Joins Relationships are a dynamic, flexible way to combine data from multiple tables for analysis. You don't define join types for relationships, so you won't see a Venn diagram when you create them. Think of a relationship as a contract between two tables. When you are building a viz with fields from these tables, Tableau brings in data from these tables using that contract to build a query with the appropriate joins. - **No up-front join type**. You only need to select matching fields to define a relationship ([no join types](#WhereAreJoins)). Tableau first attempts to create the relationship based on existing key constraints and matching field names. You can then check to ensure they are the fields you want to use, or add more field pairs to better define how the tables should be related. - **Automatic and context-aware**. Relationships defer joins to the time and context of analysis. Tableau automatically selects join types based on the fields being used in the visualization. During analysis, Tableau adjusts join types intelligently and preserves the native level of detail in your data. You can see aggregations at the level of detail of the fields in your viz rather than having to think about the underlying joins. You don't need to use LOD expressions such as FIXED to deduplicate data in related tables. - **Flexible**. Relationships can be many-to-many and support full outer joins. When you combine tables using relationships, it's like creating a custom, flexible data source for every viz, all in a single data source for the workbook. Because Tableau queries only tables that are needed based on fields and filters in a viz, you can build a data source that can be used for a variety of analytic flows. For more information, see [Relate Your Data](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm) and [Don't Be Scared of Relationships.](https://help.tableau.com/current/pro/desktop/en-us/datasource_dont_be_scared.htm) > [!TIP] > > **Joins are still available as an option for combining your data**. Double-click a logical table to go to the join canvas. For more information, see [Where did joins go?](#WhereAreJoins) **Watch a video**: For an introduction to using relationships in Tableau, see this 5-minute video. **Note**: The interface for editing relationships shown in this video might differ slightly from the current release but has the same functionality. Also see video podcasts on relationships from [Action Analytics](https://action-analytics.com/library/), such as [Why did Tableau Invent Relationships?](https://action-analytics.com/ep-1-why-did-tableau-invent-relationships/) Click "Video Podcast" in the [Library](https://action-analytics.com/library/) to see more. For related information about how relationship queries work, see these Tableau blog posts: - [Relationships, part 1: Introducing new data modeling in Tableau](https://www.tableau.com/about/blog/2020/5/relationships-part-1-meet-new-tableau-data-model) - [Relationships, part 2: Tips and tricks](https://www.tableau.com/about/blog/2020/5/relationships-part-2-tips-and-tricks) - [Relationships, part 3: Asking questions across multiple related tables](https://www.tableau.com/about/blog/2020/6/relationships-part-3-asking-questions-across-multiple-related-tables) ## Characteristics of relationships and joins Relationships are a dynamic, flexible way to combine data from multiple tables for analysis. We recommend using relationships as your first approach to combining your data because it makes data preparation and analysis easier and more intuitive. [Use joins only when you absolutely need to](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_faq.htm#can-i-use-joins-between-logical-tables). Here are some advantages to using relationships to combine tables: - Make your data source easier to define, change, and reuse. - Make it easier to analyze data across multiple tables at the correct level of detail (LOD). - Do not require the use of LOD expressions or LOD calculations for analysis at different levels of detail. - Only query data from tables with fields used in the current viz. ### Relationships - Are displayed as flexible noodles between logical tables - Require you to select matching fields between two logical tables - Do not require you to select join types - Make all row and column data from related tables potentially available in the data source - Maintain each table's level of detail in the data source and during analysis - Create independent domains at multiple levels of detail. Tables aren't merged together in the data source. - During analysis, create the appropriate joins automatically, based on the fields in use. - Do not duplicate aggregate values (when Performance Options are set to Many-to-Many) - Keep unmatched measure values (when Performance Options are set to Some Records Match) ### Joins Joins are a more static way to combine data. Joins must be defined between physical tables up front, before analysis, and can't be changed without impacting all sheets using that data source. Joined tables are always merged into a single table. As a result, sometimes joined data is missing unmatched values, or duplicates aggregated values. - Are displayed with Venn diagram icons between physical tables - Require you to select join types and join clauses - Joined physical tables are merged into a single logical table with a fixed combination of data - May drop unmatched measure values - May duplicate aggregate values when fields are at different levels of detail - Support scenarios that require a single table of data, such as extract filters and aggregation ## Requirements for using relationships - When relating tables, the fields that define the relationships must have the same data type. Changing the data type in the Data Source page does not change this requirement. Tableau will still use the data type in the underlying database for queries. - You can't define relationships based on geographic fields. - Circular relationships aren't supported in the data model. - You can't define relationships between published data sources. ### Factors that limit the benefits of using related tables - Dirty data in tables (i.e. tables that weren't created with a well-structured model in mind and contain a mix of measures and dimensions in multiple tables) can make multi-table analysis more complex. - Using data source filters will limit Tableau's ability to do join culling in the data. Join culling is a term for how Tableau simplifies queries by removing unnecessary joins. - Tables with a lot of unmatched values across relationships. - In versions 2020.2 through 2024.1: Interrelating multiple fact tables with multiple dimension tables (attempting to model shared or conformed dimensions). In version 2024.2 and later, you can use multi-fact relationships to address these cases. For more information, see [Multi-fact analysis with relationships](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel.htm#multifact-analysis) and [About Multi-fact Relationship Data Models](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm). ## Where did joins go? You can still specify joins between tables in the physical layer of a data source. Double-click a logical table to go to the Join/Union canvas in the physical layer and add joins or unions. Every top-level, logical table contains at least one physical table. Open a logical table to view, edit, or create joins between its physical tables. Right-click a logical table, and then click Open. Or, just double-click the table to open it. ![Data model with two joins.](/tableau/next/en-us/online/en-us/Img/data_model_singletable_joins.gif) When you create a data source, it has two layers. The top-level layer is the logical layer of the data source. You combine data between tables in the logical layer using relationships. The next layer is the physical layer of the data source. You combine data between tables at the physical layer using joins. For more information, see [Logical and physical tables in the data model](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel.htm). ![A data model diagram displays a logical layer with two tables linked by a relationship, and a physical layer that illustrates how the logical tables are constructed from physical tables.](/tableau/next/en-us/online/en-us/Img/data_model_layers_sm.png) [Skip to main content](#main-content) # Import Users To automate the process of adding users to a site, you can create a CSV file that contains user information, and then import the file. When you import the CSV file, you also specify the users’ authentication type. This topic is intended for site administrators and discusses how to import users to a particular site. For information on how to import users at the tenant level in Tableau Cloud Manager as a cloud administrator, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm). **Note:** This topic contains the steps for importing, assuming that you have already created the CSV file. If you have not created the file yet, see [CSV Import File Guidelines](https://help.tableau.com/v0.0/online/en-us/csvguidelines.htm) for a list of file format requirements and import options. ## Add users from a CSV file 1. When you’re signed in to the Tableau Cloud site, select **Users**. 2. Click Add Users, and then click Import Users from File. ![A Site Admin can add users by email or import from a file.](/tableau/next/en-us/online/en-us/Img/users_add_online.png) The options you have in the Import Users dialog box depend on how users sign in to the site. 3. If you haven't already created or enabled an authentication configuration on the site, skip to the next step. If you've created or enabled an authentication configuration on the site, you can select one authentication method for the new users. - Select the authentication method if you have created and enabled Google, OIDC, SAML, or Salesforce authentication and want the imported users to sign in to Tableau Cloud through that external identity provider (IdP). - Select Tableau with MFA if you want these users to have the default username (email address) and password authentication. 4. For File name, click Browse, navigate to the CSV file, and click **Open**. 5. To see account-specific information, select View Details. To continue, click Import Users, and then click Exit in the final dialog box. If a user already exists in the Tableau Cloud site, and the import file defines a different site role for them, they will get the new site role as defined in the CSV file, even if it is more restrictive than their current site role. This includes existing site administrators. [Skip to main content](#main-content) # Inbound Private Connect Inbound Private Connect for AWS allows organizations to create secure, private, and dedicated connections from their network directly to Tableau Cloud. By provisioning these connections on top of AWS PrivateLink, traffic between your environment and Tableau Cloud uses private IP address space and never traverses the public internet. The private and secure nature of Inbound Private Connect can address a key requirement for working with your analytical data, helping you meet stringent data privacy and compliance regulations, such as GDPR, HIPAA, and CCPA. Inbound Private Connect is available starting with Tableau Cloud 262, and requires a Tableau Cloud deployment with an Enterprise or Tableau+ license edition. Organizations purchase an add-on Private Connect Endpoint product for each private connection established. ## Supported Interactions After you create the private connection and configure DNS, users and API clients interact with Tableau Cloud normally, but traffic doesn't cross the public internet. Supported interactions include: - **Web browsers**: Accessing Tableau Cloud sites and Tableau Cloud Manager (TCM). - **Tableau Desktop**: Publishing workbooks and data sources. - **Tableau Bridge**: Bridge clients connecting securely to a Tableau Cloud site. - **APIs**: Tableau REST API, TCM REST API, and the Metadata API. Note: - Your AWS Virtual Private Cloud (VPC) your Tableau Cloud pod must be in the same region. - Features like SCIM, Tableau ID authentication, TabGPT, and CloudFront static assets aren't supported and require standard internet routing. ## Example Use Cases ### Scenario 1: Avoid public internet for compliance Your organization is in a highly regulated sector and must adhere to strict data privacy rules. Network security policy prevents user browser sessions and API calls from reaching Tableau Cloud over the public internet. **With Inbound Private Connect** Data travels securely and privately between your network edge and Tableau Cloud entirely over the AWS backbone. ### Scenario 2: Complete network isolation Your organization wants to make sure that external actors can't access your Tableau Cloud login page from the public web. **With Inbound Private Connect** You establish an inbound private connection and configure a Custom Domain for your Tableau Cloud site, hosted in a Private Hosted Zone within your VPC. Tableau blocks all access through the default public path-based URL, ensuring the site is exclusively accessible from within your private corporate network. ## High-Level Setup Overview Setting up Inbound Private Connect requires coordination between your AWS Administrator and your Tableau Cloud Administrator. The process involves: 1. Creating an Interface VPC Endpoint in AWS targeting the Tableau service. 2. Registering the Endpoint ID in Tableau Cloud Manager for approval. 3. Configuring AWS Security Groups to allow HTTPS traffic. 4. Creating Private Hosted Zones in AWS Route 53 5. Creating DNS records in your Private Hosted Zones to securely route traffic through your Private Connect endpoint. For more information, see: [Setup Inbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_inbound_setup.htm). ## Other articles in this section [Skip to main content](#main-content) # Install Bridge Tableau Bridge is software that you can install and use in conjunction with Tableau Cloud. Always install the latest version of Bridge to take advantage of the latest security and feature updates. Tableau Bridge is available for Windows installations and Linux for Docker containers. **Note**: Support for single use refresh tokens (sometimes called one-time use refresh tokens, rolling refresh tokens, or refresh token rotation) for OAuth connections was added in Tableau Cloud with the 2025.2 (Summer 2025) release and added in Tableau Server with the 2025.3 release if the IDP of the data source provider supports it. These are not yet supported on Tableau Bridge connections to Tableau Cloud. If you use the external OAuth configuration for the connection, please see the [OAuth Configuration and Usage documentation](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth Config docs") in GitHub for more information. ## Before installing Bridge You do not need a product key to use Bridge. Use of Bridge is subject to your End User License Agreement (EULA). Users of Bridge must be authorized users of Tableau Cloud. You can find all available versions on the [Tableau Bridge](https://www.tableau.com/support/releases/bridge) Product Download and Release Notes page. ### Network access Because Bridge facilitates connections between your private network data and Tableau Cloud, it requires the ability to make outbound connections through the internet. After the initial outbound connection, communication is bidirectional. #### Required ports Tableau Bridge uses port 443 to make outbound internet requests to Tableau Cloud and port 80 for certificate validation. ### Tableau with MFA Bridge supports multi-factor authentication (MFA). For more information about Tableau with MFA, see [About multi-factor authentication and Tableau Cloud](https://help.tableau.com/current/online/en-us/security_auth.htm#mfa_requirement). ### Database drivers Bridge uses Tableau connectors to connect to different databases to maintain data freshness. Some of those connectors require drivers to communicate with the databases. To get drivers for connectors that the client supports, go to the [Driver Download](http://www.tableau.com/support/drivers) page on the Tableau website. Make sure to filter the list for the operating system and use the instructions listed for the data source. ## Other articles in this section [Skip to main content](#main-content) # Install Bridge for Linux for Containers Bridge for Linux provides the scalability and streamlined management capabilities of containerized workloads. The following instructions describe a lightweight way to run Bridge for Linux and assumes you have basic knowledge of Docker and the key terms used in the ecosystem. ## Install and run Bridge from a Docker container To use Bridge on Linux you must create a customized Docker image, install the RPM package, and then run Bridge from inside the container image. Installation notes: - You can deploy multiple Bridge on Linux containers on a single computer. - Serverless solutions with dynamic IPs are not supported. - Bridge legacy schedules are not supported. See [Migrate from Bridge (legacy) to Online schedules](https://help.tableau.com/current/online/en-us/to_sync_schedule.htm) for more information. ### Prerequisites - Installed Docker Engine. For the base image of the docker container, Bridge on Linux is supported on: - Amazon Linux 2023 - Red Hat Enterprise Linux 8 - Red Hat Enterpirse Linux 9 **Note**: CentOS is not supported. - The latest Tableau Bridge RPM package from the [Downloads](https://www.tableau.com/support/releases/bridge) page on the Tableau website. - Experience with the Linux operating system. - Basic shell scripting. - Docker experience. - Tableau Site admin [Personal Access Token](https://help.tableau.com/current/online/en-us/security_personal_access_tokens.htm) (PAT) or [Unified Access Token](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html) (UAT). You must use a dedicated PAT or UAT for each Bridge client. Tableau supports 104 PAT tokens per user. - If your Bridge host will connect to a remote share, you will need to create a section for UNC mapping in your Docker file. See [Connecting to flat files and file-based extracts](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm#remote-share). - Bridge for Linux doesn't support Bridge (legacy schedules). See [Migrate from Bridge (legacy) to Online schedules](https://help.tableau.com/v0.0/online/en-us/%3Chttps://help.tableau.com/current/online/en-us/to_sync_schedule.htm#Migrate from Bridge $legacy$ to Online schedules>). ### Step 1: Create a Bridge container image The following steps are the basic instructions for building a Bridge on Linux base image. For more information, see [Docker overview.](https://docs.docker.com/get-started/overview/) When Docker is installed, the only user with permission to run commands is root. You can run Docker commands with `sudo` or by a user who is a member of the docker group. **Important** Base images will vary according to different drivers and platforms. The examples that follow are intended to illustrate the process of building a base image. You must adapt the build process for your particular environment. 1. Download the Bridge`.rpm` package from the [Downloads](https://www.tableau.com/support/releases/bridge) page on the Tableau website. 2. (Optional) You can edit the configuration settings to change how the client will run. See [Change the Bridge Client Settings](https://help.tableau.com/current/online/en-us/to_sync_change_computer_site.htm) for more information. 3. Create a working directory and move the `.rpm` package into the directory. `cd ~` `$ mkdir Docker` `$ cd Docker` `$ mv .rpm .` 4. Create a Docker file in the working directory. For example: `$ touch Dockerfile` 5. Edit the Docker file and add the commands to run `yum update.` **Red Hat Example** For Red Hat 8: `FROM registry.access.redhat.com/ubi8/ubi:latest` `RUN yum -y update` 6. Edit the Docker file and then enter the commands to copy, install, and remove the bridge RPM package from the image: - **Option 1**: Use `--mount`, for example: FROM registry.access.redhat.com/ubi8/ubi:latest RUN --mount=type=bind,source=.rpm,target=/tmp/bridge.rpm \\ set -eux; \\ yum -y update; \\ ACCEPT\_EULA=y yum install -y /tmp/bridge.rpm; \\ yum -y clean all; \\ rm -rf /var/cache/yum - **Option 2**: Download the rpm directly>, for example: FROM registry.access.redhat.com/ubi8/ubi:latest RUN set -eux; \\ yum -y update; \\ curl -fsSL https://repo.example.com/bridge.rpm -o /tmp/bridge.rpm; \\ ACCEPT\_EULA=y yum install -y /tmp/bridge.rpm; \\ rm -f /tmp/bridge.rpm; \\ yum -y clean all; \\ rm -rf /var/cache/yum 7. Build a new container image using the `docker` build command. For example, the following command builds an image in the current directory, tagging it with the word `"bridge_base"`: `docker buildx build --platform=linux/amd64 -t bridge_base .` 8. Check that the base image you created is displayed in the list of images: `docker images | grep bridge` ### Step 2: Install the drivers The Bridge client requires drivers to facilitate connectivity between private network data and Tableau Cloud. For drivers, go to [Driver Download](https://www.tableau.com/support/drivers), select the data source, and then select Linux for the Operating system. 1. Installation can be done interactively after the base image is launched, or separate Dockerfiles can be written as a layer on top of the base image. **Example** With the MySQL driver RPM copied into the directory, you can create a separate working directory for layering MySQL drivers using the following Dockerfile: `# Using previously built bridge_base image` `FROM bridge_base` `COPY mysql-connector-odbc-8.0.26-1.el8.x86_64.rpm` `RUN yum install -y mysql-connector-odbc-8.0.26-1.el8.x86_64.rpm` **Note:** A requirement for MySQL and Amazon Aurora MySQL drivers is to configure the locale and install langpacks in the image: Example: `RUN yum install -y glibc-langpack-en` `ENV LANG=en_US.UTF-8 LANGUAGE=en_US:en LC_ALL=en_US.UTF-8` **Example** Install a postgres JDBC driver. This can also be done in a separate Dockerfile. `# Using previously built bridge_base image` `FROM bridge_base` `COPY postgresql-42.3.3.jar /opt/tableau/tableau_driver/jdbc/` **Example** Install the Amazon Redshift driver. `# Using previously built bridge_base image` `FROM bridge_base` `yum install -y unixODBC` `yum --nogpgcheck localinstall -y` `AmazonRedshiftODBC-64-bit-2.1.7.0.x86_64.rpm` `odbcinst -i -d -f /opt/amazon/redshiftodbcx64/odbcinst.ini` 2. Create a new image: `docker image build -t bridge_final .` The `bridge_final` image uses the cached image from the previous step and automates the driver installation for all your Bridge instances. If you have an image repository, you can publish the image to the repository and distribute the image to all the machines you want to run Bridge on. ### Step 3: Install language packs and set the locale in Docker 1. Install language packs in your Docker containers: `RUN yum install -y glibc-langpack-en` 2. Set the locale in Docker using `ENV LC_ALL en_US.UTF-8`. You can also set the locale by adding the following to the `/etc/profile` file: `export LANG="en_US.utf8"` `export LANGUAGE="en_US.utf8"` `export LC_ALL="en_US.utf8"` **Note**: If your Bridge host will connect to a remote network share for file-based extracts (Excel, CSV), see [Configure file-based extract refreshes for shared files (Optional)](#Configur). ### Step 4: Run the Bridge container Now that you have a base image built, you can deploy it using a variety of methods. The basic steps are: 1. Create tokens 2. Start the instance of the Bridge container. 3. Assign the agent to a pool. #### Create tokens Before you start deploying the container, create a [Personal Access Token](https://help.tableau.com/current/online/en-us/security_personal_access_tokens.htm) (PAT) or a [Unified Access Token](https://help.tableau.com/current/api/cloud-manager/en-us/docs/unified_access_tokens.html) (UAT). A PAT or a UAT is required to log in to the agent. **Considerations and requirements**: - Tableau Cloud supports 104 PATs per user. We recommend that you use one PAT or UAT per client. - The following token names must match: The `patTokenId` or `jwTokenFile` (used when running the `run-bridge.sh` command), the token name in the JSON file, and the token name that you specify when you generate the token. - If using a UAT, you must include the required Oauth scopes: `"tableau:remote_agents:*"`, `"tableau: jobs:read"`, `"tableau:file_uploads:*"`, `"tableau:datasources:*"` #### Start instance The interactive method in this procedure illustrates the steps necessary to start the worker. When you exit, the container stops running. - Run this command to move to the shell prompt for the container as `root`: `docker container run -it bridge_final /bin/bash` The rest of the commands are executed in the context of this interactive session of the container. 1. Add the PAT or UAT token to a flat file in JSON format. For example: `/home/jSmith/Documents/MyTokenFile.txt` 2. Example token syntax: `{"MyToken" : "uLICC7e8SUS8ZNGe8RIFn4u==:lRihmYHI0XBKle7e8S4uSORXGqAkAl4"}` 3. Change the file permissions to restrict access to the current user. For example: `chmod 600 MyTokenFile.txt` 4. Start an instance of the Bridge container by running the `run-bridge.sh` command . The process differs according to the token type you are using: **PAT command example** /opt/tableau/tableau\_bridge/bin/run-bridge.sh -e --patTokenId="Mytoken" --userEmail="admin@tableau.com" --client="myBridgeAgent" --site="mySite" --patTokenFile="/home/jSmith/Documents/MyTokenFile.txt" --poolId="1091bfe4-604d-402a-b41c-29ae4b85ec94" **UAT command example** /opt/tableau/tableau\_bridge/bin/run-bridge.sh -e --userEmail="admin@tableau.com" --client="myBridgeAgent" --site="mySite" --jwTokenFile="jwTokenFile.txt" --poolId="1091bfe4-604d-402a-b41c-29ae4b85ec94" run-bridge.sh parameters

Global parameters
`--client`	(Required) The name that you want to give to the Worker.
`--site`	(Required) Site name as it appears in the URI. Don’t include the URI path.
`--userEmail`	(Required) User email associated with the token.
`-e`	(Optional) By default, the Bridge client worker runs as a background service. To run the worker in the foreground, include the -e argument.
`--poolId`	(Optional) Pool Id that is assigned to the client. See Using a pool ID.

PAT: required parameters
`--patTokenId`	The ID of the PAT. See Personal Access Tokens for more information.
`--patTokenFile`	File name and path to the PAT text file.

UAT: required parameter
`--jwTokenFile`	File name and path to the UAT text file.

**Note**: If you are installing older versions of the Bridge for Linux, you must run a different command to start the worker. For versions 2024.2 and older, start the worker with the `TabBridgeClientWorker` command (not the `run-bridge.sh` command. All of the command options are the same. **Agent started** The following message indicates the agent is started. `“Service started: ...”` **Stop the worker** Use `Control-C` to stop the worker. Rather than restart the worker, you can start a new worker for the container image. #### Default pool assignment If you didn’t assign a pool using the command option `--poolId`, the client is assigned to the default pool. If you want to use the client with specific domains or VConns, you can assign the client to a named pool using the UI. The menu for this on Tableau Cloud Home \> Settings \> Bridge. For more information, see [Configure the Bridge Client Pool](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm). #### Using a pool ID When starting the Bridge worker with the `run-bridge.sh` command, the `poolId` is optional. However, the behavior of the client depends on whether the client is registered to a site, and whether the client is assigned to a pool. Tableau Bridge can only connect or register to one Tableau Cloud site at any given time. The client is registered to a site when you log off and log back in. **If a pool ID isn’t provided** - If the Bridge client has been registered, the client status remains the same: - If the client is assigned to a pool, it remains assigned to the pool, regardless of whether it’s a named pool or default pool. - If the client isn’t assigned to a pool, it will remain unassigned. - If the Bridge client is new (you never signed in to Tableau Cloud), the client is assigned to the default pool. **If a pool ID is provided** - If the pool ID is provided and is correct, the Bridge client is assigned to the named pool. - If the pool ID is provided and incorrect: - If the Bridge client isn’t t registered, then the client is assigned to the default pool. - If the Bridge client is registered, the client status remains the same, regardless of named pool, default pool, or unassigned. #### Finding the Pool ID To find the pool ID, go to the Settings \> Bridge page and click on the name of the pool. For example: ![](/tableau/next/en-us/online/en-us/Img/bridge_pool_id.png) ## Upgrading Bridge for Linux client Staying in sync with the latest version of Bridge ensures that you can take advantage of the latest features and fixes included with each new version of the Bridge client. You can not run an in-place upgrade for the container. Instead, you must build a new container image with the latest Bridge binaries and then add the Bridge client to the pool side-by-side with the previous version. After you validate functionality, you then remove the previous Bridge client. Follow these steps: 1. Install and configure the new Tableau Bridge client as documented in the sections above. 2. Add the new Bridge client to the relevant pool. See [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm). 3. Monitor the health of the Bridge jobs to validate stability before continuing to the next step. 4. Remove the previous Bridge client(s) from the pool. Open the pool, identify the client machine to be removed, and click **Delete**. 5. Wait for the extract refresh timeout process to finish on the Bridge client. The default timeout is 24 hours. For more information, see [dataSourceRefreshSettings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#dataSourceRefreshSettings). 6. After refresh timeout period has elapsed, you may remove the previous instance of Bridge client. ### Configure file-based extract refreshes for shared files (Optional) **Note**: Complete these steps only if your Tableau Bridge on Linux container needs to refresh extracts from shared file-based data sources (such as Excel or CSV files located on network shares). This setup handles both Published Data Sources (PDS) and Embedded Data Sources (EDS). While Tableau Cloud uses UNC map files to translate network paths (`\\fileserver\share\data.xlsx`) for PDS, Linux containers require additional directory symlinks inside the container to handle EDS refreshes, which reach the container filesystem as literal paths (`/fileserver/share/data.xlsx`). #### Step 1: Mount the share on the host machine Mount the remote file share under `/mnt/remotes` (Tableau recommended parent directory): sudo mkdir -p /mnt/remotes/ sudo mount -t cifs /// /mnt/remotes/ \\ -o Persist this mount in `/etc/fstab` so it remounts automatically after system reboots. Confirm access by running `ls` `/mnt/remotes/`. #### Step 2: Create the UNC map file Create a mapping file at `/mnt/remotes/uncmap` using colon-delimited forward slashes. Include entries for both fully qualified and bare hostnames: `///:/mnt/remotes/` `///:/mnt/remotes/` #### Step 3: Launch the Bridge container Run the container using the mount bind and environment variable: `docker run -d \` `--mount type=bind,source=/mnt/remotes,target=/mnt/remotes \` `-e TABLEAU_BRIDGE_UNC_MAP_OVERRIDE=/mnt/remotes/uncmap \` `... ... \` `` #### Step 4: Add symlinks inside the container Add symlinks so the literal UNC path resolves correctly. This is required for EDS refresh on Linux. Extend the Bridge Dockerfile as follows: FROM : \# Make the literal UNC path resolvable at the filesystem level. \# Add one symlink per case variant your workbooks embed \# (Linux is case-sensitive; Windows-authored workbooks may embed either). RUN mkdir -p // \\ && ln -sf /mnt/remotes/ /// && ln -sf /mnt/remotes/ /// **Note**: If rebuilding the container image is not an option, execute the `mkdir` and `ln -sf` commands inside the running container via docker exec after every container start.4. #### Step 5: Follow required publishing workflows in Tableau Desktop Ensure workbooks and data sources meet these publishing prerequisites: - Use UNC Paths: Always connect and publish using a UNC path (for example, `\\\\.xlsx`). Do not use mapped drive letters (`Z:\`) or local paths (`C:\`). - Uncheck External Files: Clear the Include External Files checkbox in Tableau Desktop before publishing. - Assign to a Configured Pool: Assign your Bridge client to a configured client pool. The Default pool does not support embedded data source refreshes. Map the pool to the domain of your file share. #### Troubleshooting file-based refreshes Refer to the following table to resolve issues with file-based refreshes:

Symptom	Likely cause	Recommended check
PDS succeeds, but EDS fails at 0 ms with NOT_FOUND	Literal UNC path is not resolvable inside the container filesystem.	Verify symlink creation inside the container (see Step 4: Add symlinks inside the container).
EDS fails and Bridge client is in Default pool	Default pool doesn't support EDS	Move client to a configured pool.
Both PDS and EDS fail	Host mount broken or files not readable by the mount user	Run `ls /mnt/remotes/<share-leaf>` from the host.

## Troubleshooting ### Installing older versions If you are installing older versions of the Bridge for Linux, you must run a different command to start the worker. For versions 2024.2 and older, start the worker with the `TabBridgeClientWorker` command (not the `run-bridge.sh` command). All of the command options are the same as documented above in [Step 4: Run the Bridge container](#runBridgeContainer) . For example: /opt/tableau/tableau\_bridge/bin/TabBridgeClientWorker -e --patTokenId="Mytoken" --userEmail="admin@tableau.com" --client="myBridgeAgent" --site="mySite" --patTokenFile="/home/jSmith/Documents/MyTokenFile.txt" --poolId="1091bfe4-604d-402a-b41c-29ae4b85ec94" ### Worker start up error In some cases, the following error will be displayed after running the `run-bridge.sh` command: `Missing log in parameters. Aborting the attempt to start service worker.` In most cases, re-running the command with the original options and the `-e` option fixes the issue. The `-e` option runs the Bridge worker service in the foreground. If you are running the Bridge client in background mode and you see a start up error, verify that all the input parameters include paths to any required files. For example, in background mode, the user context is not provided to resolve a path to the token file. ### Working with log files Log files are stored in the user's `My_Tableau_Bridge_Repository/Logs` folder. To save logs in a `tmp` folder, run the following command: docker container run --volume /tmp/bridge\_logs:/root/Documents/My\_Tableau\_Bridge\_Repository/Logs -it bridge\_final /bin/bash In this example, the location is specified by /tmp/bridge\_logs. Using the docker command simplifies saving the log files and avoids having to manually copy the Bridge logs files from the container to your local file system. ### MySQL driver fails If `LC_MESSAGES` aren’t set with `UTF-8` locales, you may experience read and display issues. You can edit the `/etc/profile` file, or relaunch the worker using the following command: LC\_ALL=en\_US.UTF-8 /opt/tableau/tableau\_bridge/bin/run-bridge.sh -e ### Bridge Client stops unexpectedly due to Personal Access Token expiration When a Personal Access Token (PAT) expires it will cause the Bridge Client to become disconnected from Tableau Cloud and may cause the container to shut down. From the Bridge Client you can validate if your PAT has expired by executing the Start command in the foreground. If the PAT is expired you will see the following error: `The client credentials are invalid. To complete the request, reset the credentials, and sign in to the Tableau Bridge client.` If you are the original PAT owner, you can also verify if the PAT is expired by visiting Manage Account Settings in Tableau Cloud. To resolve the issue, you will need to generate a new PAT and follow the steps above, [Step 4: Run the Bridge container](#runBridgeContainer) . ### Embedded extract and embedded live connection timeout errors The 24.3 release of Bridge on Linux provided significant performance improvements for embedded extracts and embedded live connections. If you experience timeout errors on prior releases, we recommend upgrading to a 24.3+ release of Bridge on Linux. If this does not resolve the issue, Publish the Data Source separately from the workbook. [Skip to main content](#main-content) # Install Switches and Properties for tabcmd (Windows) **Important:** Between August 2024 and March 2025, Tableau Cloud sites were migrated to Salesforce's [Hyperforce](https://help.salesforce.com/s/articleView?id=000388902&type=1). As a result of the migration, tabcmd 1.0 is no longer supported. Plan your migration to tabcmd 2.0 as soon as possible to ensure you will not be impacted. This retirement does not impact Tableau Server. **Note:** In most cases, you must use tabcmd command-line utility 2.0 (tabcmd 2.0) with Tableau Cloud. Tabcmd 2.0 is available at [Tableau tabcmd](https://tableau.github.io/tabcmd). This new version allows you to: run tabcmd commands on MacOS and Linux, authenticate using personal access tokens (PATs), and allows you to be multi-factor authentication (MFA) compliant. Version 2.0 is built on public endpoints available in the Python-based Tableau Server Client (TSC). You can use the following switches when installing the Tableau Server Command Line Utility (tabcmd) version 2019.4.0 or later from the command line on Windows. **Note:** There are no equivalent switches for the Linux version of the tabcmd installer.

Switch	Description	Comments
`/install` \| `/repair` \| `/uninstall` \| `/layout` "`<directory>`"	Run Setup to either install, repair, or uninstall tabcmd, or with `/layout`, create a complete local copy of the installation bundle in the directory specified.	Default is to install, displaying UI and all prompts. If no directory is specified on a fresh install, `C:\Program Files\Tableau\Tableau Server\<version>\extras\Command Line Utility` is assumed.
`/passive`	Run Setup with minimal UI and no prompts.
`/quiet` \| `/silent`	Run Setup in unattended, fully silent mode. No UI or prompts are displayed.	Note: Use either `/silent` or `/quiet`, not both.
`/norestart`	Run Setup without restarting Windows, even if a restart is necessary.	Note: In certain rare cases, a restart cannot be suppressed, even when this option is used. This is most likely when an earlier system restart was skipped, for example, during installation of other software.
`/log "<log-file>"`	Log information to the specified file and path. By default log files are created in the user's `%TEMP%` folder with a naming convention of `Tableau_Server_Command_Line_utility_<version_code>.log`.	If no file location is specified, the log file is written to the user's TEMP folder (`C:\Users\<username>\AppData\Local\Temp`). Check this log file for errors after installation. Example: `<Setup file> /silent /log "C:\Tableau\Logs\tabcmd-Install" ACCEPTEULA=1`

Properties Description Comments

ACCEPTEULA=1|0

Accept the End User License Agreement (EULA). Required for quiet, silent, and passive install. 1 = accept the EULA, 0 = do not accept the EULA.

If not included when using /passive, /silent or /quiet, Setup fails silently.

If included but set to 0, Setup fails.

INSTALLDIR="<path\to\installation\directory>"

Install tabcmd to the specified non-default install location.

Specifies the location to install tabcmd. If not used, tabcmd is installed to C:\Program Files\Tableau\Tableau Server\<version_code>\extras\Command Line Utility

Example: <Setup file> /silent INSTALLDIR="C:\tabcmd"

[Skip to main content](#main-content) # Install Tableau Content Migration Tool Installing Tableau Content Migration Tool is straightforward and easy. ## Installation requirements The Content Migration Tool tool is run from a Windows computer and can connect to Tableau Cloud sites and Tableau Server 19.3 and later with a valid Advanced Management license. For more information about compatible versions, see [Getting Started with Tableau Content Migration Tool](https://help.tableau.com/v0.0/online/en-us/cmt-getting-started.htm). The computer that you install Content Migration Tool on must meet the requirements below: - Microsoft Windows 10 or newer (x64) - Intel Core i3 or AMD Ryzen 3 (Dual Core) - 4 GB memory or larger - Can connect to the source and destination sites. Both sites must have a valid [Advanced Management](https://help.tableau.com/v0.0/online/en-us/itm_intro.htm) license to migrate content. - 2 GB HDD or larger. The drive where the `\temp` folder resides must have enough disk space to hold a copy of all content being migrated in a single migration. All content is stored locally on the disk and deleted when the migration is complete. - Have enough free disk space to hold the application and its logs. In addition, confirm that the REST API is enabled on Tableau Server (this is the default). Use the `tsm configuration get -k api.server.enabled` command to confirm this. A return value of `true` means the REST API is enabled. To enable the REST API, use the `tsm configuration set` command. For more information, see [api.server.enabled](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm#rest_api_enabled) in Tableau Server help. ## Install Content Migration Tool To install the Content Migration Tool: 1. Download the Content Migration Tool installer (`Tabcmt-64bit-.exe`) from the [Tableau Advanced Management](https://www.tableau.com/support/releases/advanced-management) downloads page. 2. Run the Content Migration Tool Setup program. **Note:** Running the Content Migration Tool Setup program overwrites the previous version. 3. After reading the EULA, select I agree to the license terms and conditions, and click Install. 4. If the User Account Control dialog opens, click Yes to allow the installer to make changes. ## Upgrade Content Migration Tool Upgrading to the latest version of Content Migration Tool ensures that you can take advantage of the latest features and fixes included with each new version. **Important:** - Running the Content Migration Tool Setup program overwrites the previous version. - Content Migration Tool doesn't support side-by-side installation of previous versions. To upgrade Content Migration Tool: 1. Log on to the machine where Content Migration Tool is installed. If there are instances of Content Migration Tool open, save your migration plan and exit the application. 2. Follow the steps listed in [Install Content Migration Tool](#install-cmt) to download the latest installer and complete the upgrade. ## Install Content Migration Tool from the command line You can install Content Migration Tool from the command line if you're a local administrator on the machine. ### Install switches Specify one or more switches in the command line for the installer. For example: `Tabcmt-64bit-2022-3-0.exe /quiet /norestart`

Switch	Description	Comments
`/install` \| `/repair` \| `/uninstall` \| `/layout` "`<directory>`"	Run Setup to either install, repair, or uninstall Content Migration Tool, or with `/layout`, create a complete local copy of the installation bundle in the directory specified.	Default is to install, displaying UI and all prompts. If no directory is specified on a fresh install, `C:\Program Files\Tableau\Tableau Content Migration Tool` is assumed. If Content Migration Tool is already installed, Setup assumes the same location as the current installation.
`/passive`	Run Setup with minimal UI and no prompts.	Content Migration Tool doesn't start automatically when installed in `/passive` mode. To start Content Migration Tool, open the application manually.
`/quiet` \| `/silent`	Run Setup in unattended, fully silent mode. No UI or prompts are displayed.	Content Migration Tool doesn't start automatically when installed in `/silent` or `/quiet` mode. To start Content Migration Tool, open the application manually. Note: Use either `/silent` or `/quiet`, not both.
`/norestart`	Run Setup without restarting Windows, even if a restart is necessary.	Note: In certain rare cases, a restart cannot be suppressed, even when this option is used. This is most likely when an earlier system restart was skipped, for example, during installation of other software.

## Who can do this A user with Administrator access on the machine. [Skip to main content](#main-content) # Install the Windows Client For Windows installations Tableau recommends installing the Bridge client on a dedicated machine behind your firewall so that it doesn’t compete with resources from other applications. Only one client can be installed on a machine. ### Bridge client requirements The following are the admin and access requirements for the Bridge client. - The Bridge client UI is required to perform interactive login to Tableau Cloud. - A _User profile_ on the boot drive for storing the contents of `My Tableau Bridge Repository.` - The login user must be, or the equivalent of, the local admin of the machine to run Bridge client in Service mode. - Access to the OS vault specific to the current login user for storing: - Online server login tokens specific to the current login user of the Windows session. - Data connection credentials (simple login info) for Remote extract requests. ### System recommendations Bridge is available for the Windows operating system. You can also install the client on a virtual machine. For more information about which versions of Windows are supported and other recommendations, review [Plan Your Bridge Deployment](https://help.tableau.com/v0.0/online/en-us/to_bridge_scale.htm) ## Install Bridge Follow the procedure below to install a Windows Bridge client. You don’t need a Tableau product key to install or use the client. 1. Download the installer from the [Downloads](https://www.tableau.com/support/releases/bridge) page on the Tableau website. We recommend downloading the latest version listed on the page to take advantage of the latest security and feature updates. 2. Run the installer. You can install the client using a shared Windows service account. The account that is used to run the client is the account that is logged into Windows at the time of configuration. If the client is set up with an individual local user account, you can't change the account to a shared service account without reinstalling Bridge. To change the account, uninstall Bridge as the current user, sign into the shared service account, then reinstall and configure Bridge. For Service mode, the Windows user account must be a member of the local Administrators group on the machine. In addition, to refresh file-based data sources, the account must have domain access to the network shared drive where the file data is hosted. 3. When prompted, accept the license agreement to continue. 4. (Optional) Customize the installation by clicking Customize. You can change any of the following options: - **Install location:** You can specify a different location to install the client. Unless the Windows administrator has explicitly changed the user's default profile settings, the TEMP directories and user profiles will reside on the system drive (e.g., C:), even if the Bridge Client is installed on a separate drive (e.g., D:). This is an important consideration for hard disk capacity and performance planning. For more information, see [Disk space planning for Windows](https://help.tableau.com/v0.0/online/en-us/to_bridge_scale.htm#disk-windows). - **Create a desktop shortcut:** Clear the check box if you don't want to automatically create a desktop shortcut for Bridge. - **Create a Start menu shortcut:** Clear the check box if you don't want to automatically add a shortcut for Bridge to the Start menu - **Enable error reporting:** If Bridge has a problem and closes unexpectedly, crash dump files and logs are generated and sent to Tableau. To turn off this option, clear this check box during installation. You can also turn off this option (or back on) in the client after installation. For more information, see [Error reports](#error_reports). 5. Click Install to begin the client installation. After the client is installed, you can start the client by double-clicking the Bridge shortcut on your desktop or from Tableau Desktop (if it's installed on the same machine as Bridge). ### About My Tableau Bridge Repository As part of the Bridge installation, a folder called **My Tableau Bridge Repository** is created on the machine where the client is installed. This repository folder contains critical subfolders, such as **Logs** and **Configuration**, that Bridge needs to operate properly. The repository folder is created under the Documents folder: _\\Users\\\\Documents\\My Tableau Bridge Repository_. **Important:** We strongly recommend that you don’t change the folder that Bridge uses as its repository. ## Upgrade Bridge Staying current with the latest version of Bridge ensures you can leverage new features, security updates, and performance fixes. Depending on your environment and redundancy needs, choose one of the three upgrade methods below. ### Method 1: Parallel Upgrade (Recommended) Use this method for pools with a single Bridge client when you need to minimize downtime and ensure a fallback state. This involves installing the new version on separate hardware. **To perform a parallel upgrade:** 1. **Install the new client**: Install the latest Tableau Bridge client on a new machine (refer to the [Install Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm) section). 2. **Join the Pool**: Add this new client to the same pool as your existing client. (See [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm)). 3. **Stop the old client**: On the old machine, stop the Bridge client: - If running in **Service mode**: Change the mode to **Application** in the lower-left corner to ensure the service stops completely. - Select **Settings** > **Exit**. 1. **Validate**: Monitor the health of your Bridge jobs to ensure the new client is stable. 2. **Decommission**: Once stability is confirmed, remove the old client from the pool: - Open the pool settings in Tableau Cloud, identify the old machine, and click **Delete**. - **Cleanup**: Wait for the extract refresh timeout period to elapse (default is 24 hours) before decommissioning or repurposing the old hardware. ### Method 2: Upgrading a Pool with Multiple Clients If your pool already contains multiple active clients, the pool's inherent redundancy allows you to upgrade in place without additional hardware. **To upgrade safely:** 1. **Upgrade one client**: Select one machine in the pool and follow the **Non-parallel upgrade** steps below. 2. **Isolate for testing**: Once the first client is upgraded and back online, temporarily stop the other (older) clients in the pool to force jobs through the new version. **Note:** To stop them, switch from **Service** to **Application** mode, then select **Settings** > **Exit**. 1. **Monitor**: Validate the health of the Bridge jobs on the upgraded client. 2. **Complete the pool**: Once stability is confirmed, repeat the upgrade process on the remaining machines in the pool. ### Method 3: Non-parallel Upgrade (Single Machine) If you cannot use separate hardware and must upgrade on the existing machine, follow these steps. **Warning:** Bridge jobs will not run during this process, and you will not have a side-by-side comparison for stability. **To upgrade on a single machine**: 1. **Exit the current client**: \* If running in **Service mode**, switch to **Application** mode first to stop the background service. - Select **Settings** > **Exit**. 1. **Install the update**: Run the installer for the new Tableau Bridge version. It will overwrite the existing version while maintaining your configuration. 2. **Restart**: After installation, the client will start automatically. If you previously used **Service mode**, switch the toggle back to **Service**. ### Post-Upgrade Verification Regardless of the method used, always verify the following after an upgrade: - **Mode**: Ensure the client is in the correct mode (Service vs. Application). - **Status**: Confirm the client shows "Connected" and "Ready" in the Bridge interface. - **Timeouts**: For removed clients, refer to your [dataSourceRefreshSettings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm) if you have customized the default 24-hour timeout. ## Error reports You can help improve Bridge by automatically sending error reports to Tableau. Error reports are composed of crash dump files that are sent to Tableau when the Bridge client has to close unexpectedly (crash). These files are used by Tableau to identify and address issues that can cause the client to close unexpectedly. **Important:** Turn off this option if your data is subject to any privacy regulations. ### What's in an error report The encrypted package is made up of the following files: crash and core dump files and manifest files related to the crash. The files can contain data that include: - Machine-specific information. For example: hardware, operating system, domain, and so on. - Snapshot of the memory contents at the time of the crash. For example: which data sources had extracts refreshed, which data sources had live queries, and so on. - Information that Bridge was processing at the time of the crash, including customer-identifiable information that might be used to correct the error. For example: who is using Bridge with which site, the name of the client that the user is signed in to, and so on. For more information about how Tableau treats sensitive information, see the [Tableau privacy policy](https://www.tableau.com/privacy) on the Tableau website. ### Configure automatic error reporting You can configure Bridge to send error reports automatically in one of two places: During the client installation process or after installation directly in the client. #### Enable the automatic error reporting option during client installation During installation, the option to automatically send error reports from the client is selected by default. However, you can remove the selection. ![A Tableau Bridge installation screen with options to create desktop shortcuts and enable error reporting.](/tableau/next/en-us/online/en-us/Img/bridge_installer_error_reporting_WOdriver.png) #### Disable the automatic error reporting option in the client If you decided to use the default setting during the installation process and decide later on that you don't want to allow error reports to be sent automatically, you can modify the option from the client menu. ![The Tableau Bridge settings menu providing the option to send error reports.](/tableau/next/en-us/online/en-us/Img/bridge_send_error_reports.png) ## Install Bridge from the command line You can install the Bridge client from the command line if you're a local administrator on the machine. ### General command line syntax The syntax for running the Bridge installer from the command line is the following: `tableauBridge.exe /option1 /option2 PROPERTY1 PROPERTY2` A few notes about the syntax: - The `tableau.exe` file is the client installer for the product and version you're installing. - The options specify how the installation process should run. For example, whether it should display output while installing and whether it should create log files. - The properties settings specify configuration settings that the installer should make during the installation process. #### Example installer command The following example shows an installer command with some options and property settings. `TableauBridge-20232.23.0611.2007-x64.exe/quiet /passive ACCEPTEULA=1` You must run the command from the directory where the .exe file is located or specify a full path to the location of the .exe file on the machine. Don’t run the installer from a shared directory on your network. Instead, download the .exe file to a directory on the machine where you want to install the client. ### Installer options and properties You can specify one or more options in the command line for the installer. #### Installer options A couple of notes about the options: - Each option is prefixed with a slash (/). - Options must come before properties.

Option	Description
`quiet`	Run the installer without messages (status or installation progress) and without requiring user interaction. The client doesn't launch after installation is complete.
`passive`	Run the installer and display dialog boxes and installation status. Doesn’t prompt the user for input. The client launches after installation is complete.
`norestart`	Suppress any attempts to restart. By default, the installer prompts you before restart unless you run the installer in quiet mode.
`log "logfile.txt"`	Log installation information to the specified path and file. Specify the path and file name, such as `/log "c:\logs\logfile.txt"`. The default log file is the system `%TEMP%` directory.
`repair`	Run the installer to repair an existing installation of Bridge.
`h`	Help—lists options and properties for the installer.

#### Installer properties You can also include one or more properties in the command line for the installer. Some notes about the properties: - All of these properties can be used for the initial installation of the client. They can't be used to update any settings after initial installation. - Property names are case-sensitive. - There are no spaces on either side of the equal sign. - Each property set is delimited with a space. - Properties must go after options.

Property	Description	Value
`ACCEPTEULA`	Accept the End User License Agreement (EULA). If you don't set this option to `1`, Bridge can’t be installed using quiet mode.	1=Accept 0=Don't accept (default)
`CRASHDUMP`	You can set this option to "1" to help improve Bridge by sending error reports to Tableau automatically when the client crashes. For more information, see Error reports.	1=Yes (default) 0=No
`DESKTOPSHORTCUT`	Create a desktop shortcut.	1=Yes (default) 0=No
`DRIVERDIR`	Specify an installation directory (other than the default) for the database drivers. This option creates the directory and creates an entry in the HKEY_LOCAL_MACHINE\ registry. The default location for drivers is C:\Program Files\Tableau\Drivers.	A path such as `D:\Drivers`
`INSTALLDIR`	Specify an installation directory other than the default. If you specify a custom directory for the installation location and plan to install future releases to this same location, you must specify a version-specific subfolder to install to. Otherwise, you must uninstall the previous version first. Side-by-side installations of multiple versions in the same subdirectory isn’t supported.	A path such as `D:\Software\Tableau Bridge`.
`SKIPAPPLICATIONLAUNCH`	You can set this option to "1" to prevent the new application from opening automatically when the installation process is complete. This option applies to manual installation. This option doesn't apply to quiet installations because Tableau Bridge doesn't open automatically when using that option.	1=Yes 0=No (default)
`STARTMENUSHORTCUT`	Create a Tableau Bridge entry on the Windows Start menu.	1=Yes (default) 0=No

## Uninstall Bridge Although it's not necessary to uninstall previous versions of the Bridge client when installing a newer version, you can uninstall Bridge 2018.2 and later if you no longer need it on your machine. The primary method for uninstalling the client is through the Windows Control Panel. Alternatively, you can use the following procedure to uninstall Bridge from the command line. 1. Open the Command Prompt as an administrator. 2. In the location where the .exe was installed, run the following command: `tableau.exe /uninstall /quiet` [Skip to main content](#main-content) # Integrate External Actions **Note:** External Actions in Tableau rely on functionality provided by Salesforce Flow. The feature sends your selected data to Salesforce Flow, which runs on separate Salesforce infrastructure. Use of Salesforce Flow and other Salesforce products and services is subject to your agreement with Salesforce. After seeing and understanding your data in Tableau, what’s next? Typically, taking action from data insights involves pivoting from one application to another, often copying and pasting data and losing context along the way. With the Tableau External Actions feature, you can create and interact with data-driven workflows directly from Tableau dashboards and automate your next steps using Salesforce Flow. ## About Salesforce Flow If you’re not familiar with [Salesforce Flow](https://help.salesforce.com/s/articleView?language=en_US&id=sf.flow_concepts.htm&type=5), it’s a no-code tool that provides time-saving process automations. A flow is a component of Salesforce Flow that collects data and performs actions in your Salesforce org. There are several [flow types available in Salesforce Flow](https://help.salesforce.com/s/articleView?id=sf.flow_concepts_type.htm&type=5), but External Actions workflows in Tableau are only compatible with autolaunched flows. **Note:** To learn more about flows, check out [Build Flows with Flow Builder](https://trailhead.salesforce.com/en/content/learn/trails/build-flows-with-flow-builder) on Trailhead. ## How External Actions work ![Dashboard with mark selected and workflow button in available state with arrow indicating transmission of data to Salesforce Flow](/tableau/next/en-us/online/en-us/Img/workflow_overview_callouts.png) When an External Actions workflow is configured for a viz on a Tableau dashboard, a customized button appears on the corresponding viz in an unavailable (grayed out) state. When you select a relevant mark on the viz (1), the button becomes available. Then, when you click the button (2), data from the selected mark is sent directly to a flow that was built and configured in [Salesforce Flow](https://help.salesforce.com/s/articleView?language=en_US&id=sf.flow_concepts.htm&type=5) (3). As the author of an External Actions workflow, you determine: - Which flow the data is sent to - Which dashboard the data comes from - The text and appearance of the dashboard button that triggers the workflow **Note:** You can add multiple External Actions workflows to a dashboard, but each of the corresponding flows must be deployed in the same Salesforce org. ## Ways to use External Actions workflows There are endless ways to use External Actions workflows to automate existing processes in your organization. For example, think of the effort saved by a workflow that lets accounting team members send customer invoices directly from the same dashboard they use to track unpaid orders. Or maybe you’re looking for ways to streamline your support team’s case management. A workflow that lets support team members escalate cases directly from the dashboard they use to track cases could be a significant time-saver. External Actions workflows help keep users in the flow of work, and enables your organization to benefit from increased efficiencies. When you create an External Actions workflow, you’re essentially building a bridge that connects any type of data source in Tableau with a flow at Salesforce. Your data source doesn’t need to be connected to a Salesforce database because the workflow itself creates that connection. This is particularly useful when there are multiple groups using separate data sources to complete different steps of the same process. For example, think about the different teams and tools involved when a customer places an order at an ecommerce site. Ecommerce sales reps might use Salesforce to track the sale while supply chain managers use a supply chain management tool to deduct the purchased item from overall product inventory. Support teams that help the customer troubleshoot any issues that arise when they receive their product might be logged in Salesforce or analyzed in a Tableau dashboard. With an External Actions workflow, you can connect all of this data from each of these teams to streamline processes and even automate some of the existing steps. ## Best practices for External Actions workflow authors **Important:** Dashboard authors using the External Actions feature to connect dashboard data with flows built in Salesforce Flow should closely collaborate with the Salesforce admins and architects who created the flows. Flows built in Salesforce Flow are sophisticated business automation programs. Although your organization can greatly benefit from these automations, it’s important to understand how flows work before deploying External Actions workflows that use them. Be sure to complete the [Salesforce Flow training on Trailhead](#https://trailhead.salesforce.com/content/learn/modules/business_process_automation) and review the [Flows documentation](https://help.salesforce.com/s/articleView?id=sf.flow.htm). Consider [Flow Best Practices](https://help.salesforce.com/s/articleView?id=sf.flow_prep_bestpractices.htm&type=5&language=en_US) in your design, and keep [Flow Limits and Considerations](https://help.salesforce.com/s/articleView?id=sf.flow_considerations.htm&type=5) in mind. **Note:** There are several [flow types](https://help.salesforce.com/s/articleView?id=sf.flow_concepts_type.htm&type=5) available in Salesforce Flow, but External Actions workflows are only compatible with autolaunched flows. External Actions workflows must be carefully implemented to align with the architectural constraints of flows built in Salesforce Flow. Flows are powerful, but they can also be resource-intensive and complex. There are potential licensing, execution throttling, and concurrency issues to consider, and database read/write limits that must be evaluated and tested. There are also important security considerations related to flows. Users with the Manage Flows permission can view and change all data and resources in the corresponding Salesforce org. Users with the Run Flows permission can run nearly any active flow in the Salesforce org. To restrict access to only those users who require it (such as dashboard authors and workflow users), your Salesforce admin can enable the override default behavior setting for a flow. For more information, see [How Does Flow Security Work?](https://help.salesforce.com/s/articleView?id=sf.flow_distribute_security.htm&type=5) Dashboard authors who are creating External Actions workflows should communicate with their Salesforce admins before implementing workflows to prevent undesired results. ## Create a workflow Before creating an External Actions workflow, dashboard authors should collaborate with their Salesforce admins to find or create a flow that meets their needs. For example, perhaps your goal is to help your accounting team send invoices directly from an unpaid orders dashboard. To accomplish this goal, you need a flow that can retrieve the customer contact information and order details from the dashboard and populate the invoices. After you decide which flow to use, the next step is identifying a dashboard to connect it to. It’s likely that your users are already interacting with an existing dashboard that would work well. However, if necessary, you can [create a new dashboard](https://help.tableau.com/current/pro/desktop/en-us/dashboards_create.htm). With the right flow and the right dashboard in mind, it’s time to think about the compatibility of the data types in the dashboard with the flow’s required input fields (known as variables). For example, your unpaid orders dashboard must contain a viz with all of the relevant order details needed to send customer invoices. These details might include information such as order date, customer name and contact information, item descriptions and amounts, and payment amount due. When your dashboard contains all of the required components, add the Workflow object: 1. In a Tableau workbook, open an existing dashboard or [create a new one](https://help.tableau.com/current/pro/desktop/en-us/dashboards_create.htm). 2. From the Objects section of the Dashboard pane, drag Workflow to a viz in the dashboard. ![Objects section of Dashboard pane with a spotlight on the Workflow object and a right-facing arrow indicating dragging the object to the dashboard ](/tableau/next/en-us/online/en-us/Img/workflow_object_arrow_spotlight_sm.png) 3. When prompted, enter your log-in credentials for the Salesforce org associated with your flow. **Note:** When users access the dashboard where you set up your workflow, they must enter their Salesforce credentials. If their Salesforce credentials expire while viewing the dashboard, they're prompted to reauthenticate. 4. Click Configure Workflow. 5. In the Add Workflow dialog, search for a flow by flow name or flow author. 6. Select a flow to view its details, including the required inputs (Salesforce variables) it needs from the viz. Click Back to select a different flow, or click Next to continue. 7. From the Select Sheet drop-down, select a sheet (worksheet, dashboard, or story) that contains the marks your users will select and send to the flow. **Note:** Be sure to select a sheet that has marks with the encoded fields you want to map to the flow’s required inputs. For example, if you want to map the `forecast_revenue` variable in the flow to the `SUM(Sales)` field in Tableau, you must select a sheet with marks that are encoded with the `Sum(Sales)` field. 8. Click Next. 9. For each of the flow's required inputs (Salesforce variables), select an appropriate field from the Tableau sheet you chose in the Select Sheet step. **Note:** For each input, the data type of the Salesforce variable and Tableau field must match. 10. Click Next. 11. Configure the appearance of the button that users click to trigger the External Actions workflow. Specify a button title, background color, and border color. Check the preview to confirm the button's appearance. **Note:** Remember that users must select a mark from the viz that you chose in the Select Sheet step. Until a mark is selected, the button isn't available. Consider adding guiding text to the dashboard so users know exactly what viz to interact with and what will happen when they click the button. 13. Click Done to create the workflow and add the corresponding button to the viz in the dashboard. ## Use a workflow To get started as a workflow user, open the dashboard where your dashboard author has added a workflow. You can confirm that a workflow is available if a workflow button displays. The dashboard author customizes the name and format of the button, and it should clearly indicate the action triggered when you click it (such as "Send Data" or "Update Record"). Select a relevant mark from a viz in the dashboard, and then click the button to start the workflow. ![GIF showing selection of a mark in a Tableau dashboard, followed by clicking of workflow button, and concluding with Success message](/tableau/next/en-us/online/en-us/Img/workflow_dash_button_success.gif) Clicking the workflow button triggers the transmission of data, and the mark you select determines what data is sent. For that reason, the button is unavailable (grayed out) until you select a mark. If you’ve selected a mark but the button is still unavailable, verify that you’ve selected a mark on a valid viz for the workflow. If you aren’t sure which vizzes are valid, check with the dashboard author. Depending on their configuration, some workflows might be long-running operations that don't complete immediately. If you’re unable to determine whether the workflow you selected is working as expected, check with the dashboard author or your Salesforce admin. ## Troubleshoot a workflow For help resolving issues with an External Actions workflow, see the following troubleshooting guidance. ### Access issues - **For dashboard authors using Tableau Desktop:** If the Workflow object doesn’t appear in the Objects section of the Dashboard pane, confirm that you’re signed in to a Tableau Server or Tableau Cloud site. If you aren’t signed in, you won’t be able to access the Workflow extension. - **For dashboard authors:** If the Workflow object doesn’t appear in the Objects section of the Dashboard pane, check with your Tableau admin to ensure that the extension is turned on. - **For all users:** - If your Salesforce admin hasn’t created a connected app, the External Actions feature won’t work. Ask your Salesforce admin to [create a connected app](https://help.salesforce.com/s/articleView?id=sf.connected_app_create.htm&type=5) in Salesforce for Tableau Server. - If you’re unable to click a workflow button that displays on a dashboard, confirm that you’ve selected a mark on a valid viz for the workflow. If you aren’t sure which vizzes are valid, check with the dashboard author. ### Authentication issues - **For Tableau Cloud or Tableau Server users:** Refresh the dashboard in your browser. - **For all users:** Confirm that you’ve signed in to the Salesforce org where the External Actions workflow was added. If necessary, check with your dashboard author to confirm the correct Salesforce org. ### Error messages | Error Message | Explanation and Resolution | | --- | --- | | Workflow is turned off on this site. For more information, contact your Tableau administrator. | Your Tableau admin has turned off the Workflow dashboard extension for your site, so it isn't available for your use. Contact your Tableau admin to discuss turning on access to the extension. | | Workflow isn’t supported by Tableau Reader | The Workflow dashboard extension and External Actions feature can only be used to send data to a flow using [Tableau Cloud](https://www.tableau.com/products/cloud-bi), [Tableau Desktop](https://www.tableau.com/products/desktop), or [Tableau Server](https://www.tableau.com/products/server) versions 2022.3 and later. | | Flow contains one or more unsupported data types. Go back to select a different flow, or contact your Salesforce Flow administrator to remove unsupported data types from this flow. | The selected flow requires a data type input that isn't available in Tableau dashboards, or is otherwise incompatible with External Actions workflows. Select a different flow if a suitable alternative exists, or check with your Salesforce admin for next steps. | | One or more data type mismatches exist in the mapping of input fields. | The data type for one or more of the dashboard values mapped to the input variable fields aren’t identical. For example, the flow might require a numeric variable for Revenue, but the mapped value from the dashboard was a text string. Depending on your scenario, you have two options to fix this. You can [change the data type](https://help.tableau.com/current/pro/desktop/en-us/datafields_typesandroles_datatypes.htm) of the Revenue field in Tableau from a text string to a numerical value. Or, you edit the workflow configuration to map a different field from the dashboard that has a numerical data type. | | Unable to submit data to Salesforce Flow. | An unknown error occurred while the External Actions workflow attempted to send data from the dashboard to the flow. Contact your dashboard author to troubleshoot. | | Error occurred: . Contact your Salesforce Flow administrator. | The [flow interview](https://help.salesforce.com/s/articleView?id=sf.flow_interviews.htm&type=5) (running instance of the flow) failed. Share the exception code with your Salesforce admin so they can find the corresponding [error email](https://help.salesforce.com/s/articleView?id=sf.flow_troubleshoot_email.htm&type=5) and troubleshoot accordingly. | | Workflow failed. Contact your Salesforce Flow administrator. | The data from the selected mark in the dashboard was sent to the flow, but there was an issue in translating that data to the flow. Contact your Salesforce admin to troubleshoot. | | Unable to submit data to flow. Contact your workflow author. | The data from the selected mark in the dashboard wasn't sent to the flow. Contact your dashboard author to troubleshoot. | ### Flow issues - Some flows run asynchronously, so you may not immediately know whether a flow that’s part of an External Actions workflow ran successfully. At times, a flow might fail and rollback changes without immediately providing detailed feedback. However, when a flow fails, a detailed error email is sent to the workflow user, dashboard author, and Salesforce admin. Workflow users should contact their dashboard authors when they receive a flow [error email](https://help.salesforce.com/s/articleView?id=sf.flow_troubleshoot_email.htm&type=5). Dashboard authors and Salesforce admins can then work together to troubleshoot and resolve the error. For more information on troubleshooting flow issues, see [Troubleshoot Flows](https://help.salesforce.com/s/articleView?id=sf.flow_troubleshoot.htm&type=5). ### Licensing issues - **For dashboard authors:** On the Tableau side, no special permissions are required to add a workflow to a dashboard (as long as External Actions are enabled for the site). On the Salesforce side, you’ll need the [Manage Flows permission](https://help.salesforce.com/s/articleView?id=sf.retail_task_admin_permission_flow.htm&type=5) added to your Salesforce profile. - **For workflow users:** On the Tableau side, any user who can access a dashboard with a workflow can run it. From the Salesforce side, you’ll need the [Run Flows permission](https://help.salesforce.com/s/articleView?id=sf.retail_task_admin_permission_flow.htm&type=5) added to your Salesforce profile. ## Turn External Actions On or Off In Tableau 2022.3 and later, the External Actions feature is turned on by default. For more information on how Tableau admins can configure org-wide access to Tableau External Actions, see [Configure External Actions Workflow Integration](https://help.tableau.com/current/server/en-us/external_actions_admin.htm). [Skip to main content](#main-content) # Integrate Tableau with a Slack Workspace Beginning with version 2021.3, Tableau Server and Tableau Cloud support integration with the Tableau App for Slack, so your team can collaborate-share Tableau snapshots, search for Tableau content, and receive notifications about Tableau data–right where they’re working in a Slack workspace. The Tableau App for Slack lets you connect your Tableau site with a Slack workspace. After it’s enabled, Tableau users can: - See notifications in Slack when teammates share content with them, when they're mentioned in a comment, or when data meets a specified threshold in a data-driven alert. If a site administrator in Tableau Cloud or a server administrator in Tableau Server enables notifications on a site, users can control which notifications they receive in Slack by configuring their [Account Settings](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm). - See a preview of a viz when a Tableau URL is pasted into Slack, allowing users to share data-related content with context directly in Slack. - Search for Tableau views or workbooks in Slack DMs and channels. - Access Recents and Favorites from the Tableau App for Slack. For more information, see [Receive Notifications, Search, and Share Using the Tableau App for Slack](https://help.tableau.com/current/pro/desktop/en-us/slack_tableau.htm). **Note:** Some notifications preferences might not be available if the features are turned off for your site. For example, if the User Visibility setting is set to Limited, notifications are turned off. For more information, see [Site Settings Reference](https://help.tableau.com/v0.0/online/en-us/sites_add.htm) and [Manage Site User Visibility](https://help.tableau.com/v0.0/online/en-us/user_visibility.htm#user). To integrate Slack with your Tableau site, there are a few necessary configuration steps, including some in your Tableau site, and some in the Slack workspace you want to connect. This overview outlines these steps for both Tableau site administrators on Tableau Cloud or a Tableau Server Administrator on Tableau Server, and Slack workspace administrators. **Requirements** Enabling Tableau in Slack requires both a Slack workspace administrator and either a Tableau site administrator in Tableau Cloud, or a Tableau server administrator in Tableau Server. ## Connect a Tableau Cloud site to a Slack workspace Tableau Cloud site administrators can connect one or more Tableau Cloud sites to a single Slack workspace. However, you can’t connect a Tableau site to more than one Slack workspace. Connecting consists of these tasks: - **Tableau site administrator**: Request permission to the Slack workspace through Tableau's site settings. - **Slack workspace administrator**: Add the Tableau App for Slack to a Slack workspace by approving a request from the Tableau administrator for permission to access the Slack workspace. - **Tableau site administrator**: Connect your Tableau site to Slack. ### Step 1: Request permission to the Slack workspace **Tableau site administrator** 1. Sign in to the site you’d like to connect to Slack. On the **Settings** page of your site, select the **Integrations** tab. ![Integrations tab in Tableau site settings](/tableau/next/en-us/online/en-us/Img/slack_settings.png) 2. Under **Slack Connectivity**, select **Connect to Slack**. Follow the prompt to sign in to your Slack workspace. 3. Request to install the Tableau App for Slack. This request goes to the Slack workspace administrator. You can add a message to the workspace administrator, if needed. 4. Select **Submit**. The Slack administrator receives a notification for the request. For more information about this process, see [An Admin's Guide to Slack Management](https://slack.com/resources/slack-for-admins/app-management) in Slack's documentation. Slackbot (Slack’s notifications center) will notify you when your request is approved. ### Step 2: Add the Tableau App for Slack to the Slack workspace **Slack workspace administrator** Approve the request from the Tableau site administrator in Manage Apps to add the Tableau App for Slack to the Slack workspace. For more information, see [An Admin's Guide to Slack Management](https://slack.com/resources/slack-for-admins/app-management) in Slack's documentation. ### Step 3: Connect your Tableau site to Slack **Tableau site administrator** After the Slack workspace administrator approves the Tableau application, a Tableau administrator can finalize the app's connection to a Tableau site. 1. From the **Settings** page of your site, select the **Integrations** tab. ![Integrations tab in Tableau site settings](/tableau/next/en-us/online/en-us/Img/slack_settings.png) 2. Under **Slack Connectivity**, select **Connect to Slack**. 3. Follow the prompt to sign in to your Slack workspace. 4. Select **Allow** to give your Tableau site access to the Slack workspace. The Tableau site and Slack workspace are now connected. ## Disconnect a Tableau site from Slack As a site admin, you can disconnect a Tableau site from a Slack workspace by selecting **Disconnect from Slack** in the **Integrations** tab of site settings. Users continue to receive notifications for some time. The OAuth client information you added in Step 2 is retained and can be used to connect to a new workspace, if needed. As a Slack user, you can disconnect from Slack by selecting **Disconnect from Tableau** from the **Home** tab in the Tableau App for Slack. ## Update your Tableau App for Slack When a new version of the Tableau App for Slack is available, Tableau recommends updating the application to maintain app performance and use new features. To update the Tableau App for Slack: 1. From the **Settings** page of your site, select the **Integrations** tab. ![Integrations tab in Tableau site settings](/tableau/next/en-us/online/en-us/Img/slack_settings.png) 2. Under **Slack Connectivity**, select **Connect to Slack**. 3. Select **Update**. **Note:** App updates applied by any Tableau admin affect all Tableau sites connected to the same workspace. ## Troubleshoot the Tableau App for Slack It’s a best practice to [Manage app approvals for your Slack workspace](https://slack.com/help/articles/222386767-Manage-app-approval-for-your-workspace). However, if your Slack workspace allows users who aren’t admins to remove apps, it’s possible that a user can remove the Tableau App for Slack for the site. In this scenario, other users will see the Tableau App for Slack, but its features won’t work as expected. To resolve this issue, have your Slack admin uninstall and reinstall the Tableau App for Slack. Then, have your admin follow the steps to connect Slack with your Tableau site. If the preview of your Tableau link isn't unfurling in Slack, confirm that the **files:read** token allows **Bots** in the Tableau app for [Slack Permissions Scopes](https://api.slack.com/scopes). [Skip to main content](#main-content) # Interact with Data in Tableau This tutorial walks you through some of the basics of viewing and interacting with data visualizations, or views, in Tableau Server. Tableau is a tool that lets you interact with published visualizations to explore insights, ask questions, and stay on top of your data. Here’s how to get started. ## Go ahead. It’s safe to click around Tableau is built for interaction. What you do to a visualization changes how it looks for you, just for now. Others will still see the visualization as it originally appeared. And the data used to build it stays the same, too. ## 1: What is a Tableau Site? A Tableau Site is a place for your team to share data and data visualizations with each other. You can explore what they’ve published and made available to you. When you sign in to your Tableau site, you’ll land on the home page. ![Viewer log in page on Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/Viewer_sign_in.gif) ## 2: Search for a viz Tableau calls visualizations on a site Views. Use search to find views or workbooks (a package of views in a single file). Search results will show all the different content types relevant to your query. ![A viewer can search for views and workbooks on Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/Viewer_search.gif) You can select See All for all search results if the views in the quick search aren’t what you were looking for, or use the Explore page to browse. There you’ll see all the different types of content a Tableau site can host. ## 3: Interact with Content A published view is a canvas for you to interact and understand your data. Remember, you won’t hurt or change the underlying data, or change what others see. Here are some of the tools in your toolbox to find data insights. ### See Details and Sort Data Now that you know you can click on the data, let’s check it out. As you move the mouse across a view, you might see tooltips that reveal details about each data point, or mark. You can also select multiple marks. ![A viewer hovering over marks on a published viz.](/tableau/next/en-us/online/en-us/Img/Viewer_details.gif) Sort tables alphabetically or numerically by hovering over a column header and clicking the sort icon. ![A viewer can sort data on Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/viewer_sort.gif) ### Filter Data Trim or limit the visible data to a specific area, date, or category. ![A viewer can filter the data on Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/Viewer_filter.gif) ### Undo/Revert Maybe you didn’t mean to exclude everything but one area. Click Undo to remove the last change, or use Revert to undo all your selections. ![Undo button on Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/Viewer_undo.gif) ## 4: Keep up This view can automatically update with new data, so you don’t need to go searching for new charts to get the latest information. Keep it handy by clicking the star icon to add it to your favorites. ![Favorite a view on Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/Viewer_favorites.gif) All favorites are added to the Favorites page in the navigation panel. And any recent dashboard or view you explored also appears in the Home page, waiting for you next time. ![Access favorited workbooks on the Home tab in Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/Viewer_favoriteshome.gif) There’s a lot you can do in Tableau Server, and this just explored some of the basics. For more information, see What Can I Do with a Tableau Web View? Happy exploring! [Skip to main content](#main-content) # Job Performance Data Source Job Performance contains events and runtime information for background jobs on the site, such as extract refreshes and flow runs. Starting May 2023, Job Performance includes Tableau Bridge refresh data, including the Bridge client name, pooling data, and refresh started and completed times. ## Create custom views If you're a site admin or someone who has been granted access to the Admin Insights project, you can access the Admin Insights data sources directly from Tableau Cloud using Web Authoring or through Tableau Desktop to build custom views. For more information about connecting to Admin Insights data sources, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Example: How many extract refreshes and flow runs occur on the site? Use the following steps to create a view that displays the total number of extract refreshes and flow runs that occur on the site. 1. Connect to the Job Performance data source. 2. From the Data pane, drag Item Name, Item Type, Owner Email, and Job Type to the Rows shelf. 3. In the Rows shelf, right-click Item Name and select Sort. 4. In the Sort dialog, select Sort By > Field and Field Name > Job ID. Close the dialog. 5. From the Data pane, drag Started At (local) to the Columns shelf. 6. In the Columns shelf, right-click Started At (local) and select Exact Date. This converts the dimension to a measure. 7. From the Data pane, drag Job Result to Color and Job Execution Duration (Days) to Size on the Marks card. ### Example: What is the average job queued duration? Use the following steps to create a view that displays the average job queued duration. 1. Connect to the Job Performance data source. 2. From the Data pane, drag Started At to the Columns shelf and Started At (local) to the Rows shelf. 3. In the Columns shelf, right-click the Started At field and select Day from the second set of values (i.e., May 11, 2022). This converts the field to a measure. 4. In the Rows shelf, right-click Started At (local) and select More > Hour from the first set of values (i.e., 9). 5. On the Marks card, select Square from the Shape dropdown menu. 6. From the Data pane, drag Job Queued Duration to Color on the Marks card. Right-click the field and select Measure > Average. 7. From the Data pane, drag Job ID to Size on the Marks card. Right-click the field and select Measure > Count (Distinct). ## Do more with your data Using Tableau Prep, you can join Job Performance with other Admin Insights data sources on the following fields to get more visibility into your site. If you're analyzing data from multiple Tableau Cloud sites, you must also join on "Site LUID = Site LUID". - Join Job Performance to Site Content on "Item ID = Item ID" For more information, see [Aggregate, Join, or Union Data](https://help.tableau.com/current/prep/en-us/prep_combine.htm) in Tableau Prep Help. ## Data schema The following table lists the fields included in the Job Performance data source. Each row of data corresponds to a unique background job and the related content item, providing information about job status, duration, and error details. **Note:** The Job Performance data source does not include virtual connection information.

Folder	Field Name	Type	Description
Bridge	Agent is Pooled?	String	Indicates whether the Bridge client is part of a pool
	Agent Name	String	Name of the Bridge client that performed the refresh
	Agent Timezone	String	The timezone of the Bridge client
	Agent Version	String	The version of Bridge deployed on the machine
	Bridge Error Message	String	The error message associated with the failed request
	Bridge Error Type	String	The type of refresh error
	Bridge Initiator User Name	String	The user who initiated the refresh request, either from a scheduled task or manual run
	Bridge Job Result	String	The result of the Bridge refresh job. Either Succeeded or Failed.
	Pool Name	String	Name of the pool associated with the Bridge client
Dates	Bridge Completed At	Date-time	Date and time the Bridge refresh was completed in UTC
	Bridge Completed At (Local)	Date-time	Date and time the Bridge refresh was completed, adjusted by the Timezone parameter. Doesn't account for daylight savings.
	Bridge Started At	Date-time	Date and time the Bridge refresh was started in UTC
	Bridge Started At (Local)	Date-time	Date and time the Bridge refresh was started, adjusted by the Timezone parameter. Doesn't account for daylight savings.
	Completed At	Date-time	Date and time the job was completed in UTC
	Completed At (Local)	Date-time	Date and time the job was completed, adjusted by the Timezone parameter. Doesn't account for daylight savings.
	Created At	Date-time	Date and time the job was created in UTC
	Created At (Local)	Date-time	Date and time the job was created, adjusted by the Timezone parameter. Doesn't account for daylight savings.
	Overflow Queued At	Date-time	Date and time the job entered the overflow queue in UTC. This applies only to jobs that count toward concurrent jobs capacity. It's NULL for other jobs.
	Overflow Queued At (Local)	Date-time	Date and time the job entered the overflow queue, adjusted by the Timezone parameter. Doesn't account for daylight savings.
	Queued At	Date-time	Date and time the job entered the queue in UTC. This applies only to jobs that don't count toward concurrent jobs capacity. It's NULL for other jobs.
	Queued At (Local)	Date-time	Date and time the job entered the queue, adjusted by the Timezone parameter. Doesn't account for daylight savings.
	Started At	Date-time	Date and time the job was started in UTC
	Started At (Local)	Date-time	Date and time the job was started, adjusted by the Timezone parameter. Doesn't account for daylight savings.
Hyperlinks	Item Hyperlink	String	Full URL of the item on the site
Item	Item ID	String	The ID of the item related to the job. The ID is unique within each Item Type and Site.
	Item LUID	String	The LUID of the item. The LUID is unique within each item type and site. Primarily used to reference content via the REST API.
	Item Name	String	For data sources, flows, and workbooks, the display name of the item that the job is related to.
	Item Type	String	The type of item that the job is related to. Either a data source, flow, workbook, or view.
	Owner Email	String	Email address of the item owner
	Parent Project Name	String	The Item Name of this item's Parent Project.
	Parent Project Owner Email	String	The email address of the owner of the parent project (if any) that the item exists within.
Job	Error Message	String	Runtime details associated with the job, such as ID, status, and error messages
	Final Job Result	String	The final result of the background job, either Succeeded or Failed
	Job ID	String	The ID of the job generated. The ID is unique per Job Type and Site.
	Job LUID	String	The LUID of the job. The LUID is unique with each job type and site. Primarily used to reference content via the REST API.
	Job Result	String	The result of the background job, either Succeeded or Failed.
	Job Type	String	The type of job. Either an extract refresh, incremental refresh, flow run, subscription, data alert, or metric.
	Subscriber Email	String	Email address of the individual receiving the subscription
	Subscriber ID	String	User ID of the subscription creator
	Subscription Subject	String	The email Subject entered by the user when they subscribed to the workbook or view.
	Was Manual Run	Boolean	Whether the job was initiated manually by selecting the "Run Now" option on the site.
	Was Overflow Queued	Boolean	Whether the job counts toward concurrent jobs capacity. For more information, see Tableau Cloud Capacity.
Schedule	Schedule LUID	String	The LUID of the schedule that the background task is associated with
Schedule	Schedule Name	String	Name of the schedule that the background task is associated with
-	Admin Insights Published At	Date-time	Date and time the Admin Insights data source was last published in UTC
	Bridge Extract Upload Duration	Number	The amount of time it took for the extract to upload in seconds
	Bridge Refresh Duration	Number	The amount of time elapsed since the refresh was started in seconds
	Job Duration	Number	How long the job took to run, in seconds, including any time spent waiting in a queue.
	Job Execution Duration	Number	The amount of time running after the job was started, in seconds.
	Job Overflow Queued Duration	Number	The amount of time waiting in the overflow queue in seconds. This applies only to jobs that count toward concurrent jobs capacity. It's NULL for other jobs.
	Job Queued Duration	Number	The amount of time waiting in the queue in seconds. This applies only to jobs that don't count toward concurrent jobs capacity. It's NULL for other jobs.
	Timezone	Number	Specifies the timezone for displaying dates. This field represents an integer value used to determine the number of hours to offset from UTC. It doesn't account for Daylight Saving Time adjustments.

[Skip to main content](#main-content) # Labels with Custom Categories > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. Tableau offers several data labels – certification, quality warnings, and sensitivity labels – that cover a wide variety of ways to classify data. Still, there may be times that users need other labels and categories that match other use cases. Starting in Tableau Cloud October 2023 and Tableau Server 2023.3, users can classify assets using labels with custom categories that an administrator has defined. For example, an administrator could create a category called "Department" with labels for the sales, service, and operations departments ready to be applied to assets. Labels with custom categories require a Data Management license with Tableau Catalog enabled, and can be attached to the same kinds of assets that other data labels can. However, labels with custom categories don't show on downstream assets the way that data quality warnings and sensitivity labels do. Note: If you're an administrator who wants to create custom categories and labels, see [Manage Data Labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_manage.htm). ## Attach labels with custom categories to an asset Note: Starting in Tableau Cloud February 2024 and Tableau Server 2024.2, you add and remove labels with custom categories using the consolidated Data Labels dialog instead of separate dialogs for each type of label. For information on the Data Labels dialog, see [The Data Labels dialog](https://help.tableau.com/v0.0/online/en-us/dm_labels.htm#data-labels-dialog). To attach a label with a custom category to an asset: ### In Tableau Cloud and Tableau Server 2024.2 and later 1. Search for or navigate to the asset. The steps to navigate depend on the type of asset you want to add the label to: - Data source or virtual connection - on the Explore page, select All Data Sources or All Virtual Connections. - Virtual connection table - on the Explore page, select All Virtual Connections, and select the virtual connection that contains the virtual connection table you want to certify. Then select the virtual connection table. - Database or table - on the Explore page, navigate to the database or table. Or on the External Assets page, select Databases and Files or Tables and Objects. - Column - on the Explore page, navigate to the table. Or on the External Assets page, select Tables and Objects and navigate to the table. Then find the column in the list. 2. Select the actions menu (...) next to the asset, and then select Data Labels > All Data Labels. 3. Select the vertical tab on the left side of the dialog that corresponds to the custom label category. Optionally, if you know the name of a label, you can search for it at the top of the dialog. 4. Select the checkbox beside labels you want attached to the asset. 5. If desired, enter a message to display to users. You can format the text in a message with bold, underline, and italics, and include a link or an image. To see text formatting tips, hover over the information (i) icon above the Save button. 6. Repeat steps 3 through 5 for each label you want to add. 7. Select Save. ![Data Labels dialog on custom category tab](/tableau/next/en-us/online/en-us/Img/dm_label_data_labels_dialog_custom_category.png) ### In Tableau Server 2023.3 1. Select the actions menu (...) next to the asset, and then select Data Labels > More Data Labels. 2. Select the Labels dropdown. The label names are arranged by label category, and you can scroll through them. ![Selecting a label in the More Data Labels dialog](/tableau/next/en-us/online/en-us/Img/dm_label_custom_category_add_1_246.png) 3. Select the label to attach, then select Add next to the Labels dropdown. The label appears in the Applied Labels list on the right side of the dialog. 4. To add an optional label message on this specific asset, select the pencil in the Messages (Optional) column, then select Save. ![Adding a message in the More Data Labels dialog](/tableau/next/en-us/online/en-us/Img/dm_label_custom_category_add_2_246.png) 5. Repeat steps 2 through 5 for each label you want to add. 6. When you're finished adding labels, close the dialog. (Select the X in the dialog box's upper right corner or select something outside of the dialog box to close it.) ## Remove labels with custom categories from an asset Note: Starting in Tableau Cloud February 2024 and Tableau Server 2024.2, you add and remove labels with custom categories using the consolidated Data Labels dialog instead of separate dialogs for each type of label. For information on the Data Labels dialog, see [The Data Labels dialog](https://help.tableau.com/v0.0/online/en-us/dm_labels.htm#data-labels-dialog). To remove a label with a custom category from an asset: ### In Tableau Cloud and Tableau Server 2024.2 and later. 1. Search for or navigate to the asset. The steps to navigate depend on the type of asset you want to add the label to: - Data source or virtual connection - on the Explore page, select All Data Sources or All Virtual Connections. - Virtual connection table - on the Explore page, select All Virtual Connections, and select the virtual connection that contains the virtual connection table you want to certify. Then select the virtual connection table. - Database or table - on the Explore page, navigate to the database or table. Or on the External Assets page, select Databases and Files or Tables and Objects. - Column - on the Explore page, navigate to the table. Or on the External Assets page, select Tables and Objects and navigate to the table. Then find the column in the list. 2. Select the actions menu (...) next to the asset, and then select Data Labels > All Data Labels. 3. Select the vertical tab on the left side of the dialog that corresponds to the custom label category. Optionally, use the Selected Labels vertical tab to see all the labels attached to the asset. Or, if you know the name of a label, you can search for it at the top of the dialog. 4. Deselect the checkbox beside labels you want removed from the asset. 5. Repeat steps 3 and 4 for each label you want to remove. 6. Select Save. ### In Tableau Server 2023.3 1. Select the actions menu (...) next to the asset, and then select Data Labels > More Data Labels. 2. In the Applied Labels section of the dialog, select the trash icon in the row for the label to remove. ![Removing a label in the More Data Labels dialog](/tableau/next/en-us/online/en-us/Img/dm_label_custom_category_remove_246.png) 3. Repeat step 2 for each label you want to remove. 4. When you're finished removing labels, close the dialog. (Select the X in the dialog box's upper right corner or select something outside of the dialog box to close it.) ## Where labels with custom categories appear Custom labels appear on assets when navigating Tableau Cloud and Tableau Server. ![Label with custom category appearing on table page](/tableau/next/en-us/online/en-us/Img/dm_label_custom_category_masthead.png) In web authoring, you can select a data source or a column and then select Catalog Details to see all its labels. Unlike quality warnings and sensitivity labels, labels with custom categories don't appear downstream from assets they're attached to. For example, suppose your organization has a custom label category named "Department" to which a custom label named "Sales" belongs. If you attach the "Sales" label to a table called "Orders", the label only appears on the "Orders" table and not on workbooks downstream from it. ## Who can add custom category labels To add a label with a custom category to an asset (or to remove one from an asset), you must either - be a server or site administrator, or - have the Overwrite capability for the asset. ## Customize a label with a custom category For information on how administrators can create or edit custom categories and labels that appear in the More Data Labels dialog, see [Manage Data Labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_manage.htm). [Skip to main content](#main-content) # Let Site Users Request Access to Content Permissions determine if a user has viewing access to a workbook, data source, or other content inside a project. If a user clicks on content or a project they don’t have access to, they can send a request for access to the owner who controls permissions for that content. ![Request access dialog](/tableau/next/en-us/online/en-us/Img/request_access.png) When someone requests access, the owner who controls permissions for that content (either at the project or workbook level) receives an email with the name and email of the requester, the content or project requested, and a link to grant access to the content. In Tableau Server version 2022.3 and earlier, the owner receives a link to the content to manage permissions instead of a link to directly grant access. 1. On the email notification, select Grant Access. 2. On the dialog that appears, to grant the view permissions template, select Grant Access. To grant permissions other than the view template, select Manage Permissions. ![Grant access dialog](/tableau/next/en-us/online/en-us/Img/grant_access.png) If a user requests access to a workbook and content permissions are locked to the project, then the project owner receives the request. Likewise, if a user requests access to a workbook and project permissions are managed by the workbook owner, then the workbook owner receives the request. After permission is granted, the owner can email the requester to let them know they have view capability to the project or workbook. ## Default settings The Request Access setting is enabled by default on a new site. To enable the setting if it's been disabled: 1. Go to the General tab of the Settings page for your site. 2. On the General tab, scroll down to Request Access and select Let users request access to projects, workbooks, and views. 3. Click Save. ## Configure project permissions You can control who receives the access request by adjusting the project’s content permissions. If content permissions are: - Locked to the project: the project owner receives the request. - Customizable: The workbook owner receives the request. To manage content access using projects, see [Use Projects to Manage Content Access](https://help.tableau.com/v0.0/online/en-us/projects.htm) and [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#lock-project-permissions). For more information about how permission rules are evaluated, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#evaluate-permission-rules): Evaluate permission rules. ## Change project permissions _For administrators and project leaders_ Permissions can be set at the project level for both the project itself and for any content in the project. For example, if workbook permissions are configured at the project level, all workbooks published into that project inherit those default permissions. However, the Creator can choose to change the permissions during publishing, or certain users can change the permissions on published content. To enforce the permissions established at the project level, **Content Permissions** can be locked to the project. For more information, see [Lock asset permissions](https://help.tableau.com/v0.0/online/en-us/permissions_projects.htm#LockProject). To set permissions at the project level: 1. Navigate to the project 2. Open the Actions menu (...) and click **Permissions**. The permissions dialog box opens. This dialog box has two main areas: permission rules at the top and the effective permissions grid below. Use the tabs to navigate between types of content. ![Project permissions window with the Group row highlighted.](/tableau/next/en-us/online/en-us/Img/perms_projectwrkbkperms.png) With a row selected at the top, the effective permissions grid populates. Use this to verify permissions. Hovering over a capability indicator provides information about why the capability is allowed or denied for that specific user. 6. To modify an existing permission rule, select the rule and click the capability boxes to toggle through allowed/denied/unspecified. 7. To create a new rule, 1. Select \+ Add Group/User Rule. 2. Select a group or user from the drop-down box. This creates a row where you can configure the permission rule. 8. In the row for the permission rule 1. choose an existing permission role template from the drop-down box for each content type tab. ![Permission rules window with the Explore option selected from the Custom template menu.](/tableau/next/en-us/online/en-us/Img/perms_projwkbk_templates.png) 3. Or create a custom rule by navigating to a content type tab and clicking the capabilities. One click sets the capability to **Allowed**, two clicks sets it to **Denied**, and a third click clears the selection (**Unspecified**). 9. When finished, click **Save**. ## Change content permissions _For administrators, project leaders, and content owners_ If project permissions are customizable, permissions for individual pieces of content can be modified. > [!WARNING] > > Tableau recommends locking permissions to the project. These steps are relevant only for content in projects where permissions are customizable. ### Set permissions on content 1. Navigate to the content (workbook, data source, flow, data role) 2. Open the Actions menu (...) and click **Permissions**. The permissions dialog box opens. This dialog box has two main areas: permission rules at the top and the effective permissions grid below. ![Table of user permissions and site roles.](/tableau/next/en-us/online/en-us/Img/perms_workbook_siteroles.png) With a row selected at the top, the effective permissions grid populates. Use this to verify permissions. Hovering over a capability square provides information about why the capability is allowed or denied for that specific user. 6. To modify an existing permission rule, open the Actions menu (...) for that row and click **Edit**. 7. To create a new rule, 1. Select \+ Add a user or group rule. 2. If necessary, use the drop-down box on the right to change between groups and users. 3. Select a group or user from the drop-down box. This creates a row where you can configure the permission rule. 8. In the row for the permission rule, choose an existing permissions role template from the drop-down box or create a custom rule by clicking the capabilities. One click sets the capability to **Allowed**, two clicks sets it to **Denied**, and a third click clears the selection (**Unspecified**). 10. When finished, click **Save**. ### Set permissions on a view In some situations, it may be valuable to specify permissions on a view independently from the workbook that contains it. To set permissions on a published view, navigate to the view within a published workbook and follow steps above. > [!WARNING] > > While it is possible to set view-level permissions within a workbook, we strongly recommend managing permissions at the project (or workbook) level as much as possible. For views to inherit permissions, the project must be locked or the workbook must be published with **Show Sheets as Tabs**. See [Let Site Users Request Access to Content](#sheettabs) for more information. [Skip to main content](#main-content) # Leverage User Attribute Functions (UAF) with Tableau Lightning Web Components You can leverage User Attribute Functions (UAF) with your Tableau View and Pulse Lightning web components (LWC) to surface specific data based on the attributes of the user looking at a visualization. [User attribute functions](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_user.htm) provide row-level security so that people viewing your visualization only see data relevant to them. For more information about UAFs, see [Unlock the Power of Personalized Analytics with User Attribute Functions](https://www.tableau.com/blog/unlock-power-personalized-analytics-user-attribute-functions). Prerequisites - Single Sign-On (SSO) with Token Authentication is configured for Tableau Lightning Web Components. See [Configure Tableau Lightning Web Components and Single Sign-On (SSO) with Token Authentication](https://help.tableau.com/current/server/en-us/lwc_seamless_auth.htm). - Tableau is configured to capture user attributes in authentication workflows. See [Allow capture of user attributes](https://help.tableau.com/current/server/en-us/lwc_seamless_auth.htm#allow-capture-of-user-attributes). - Tableau content to be embedded includes [user attribute functions](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_user.htm). For an example of how to use user attribute functions in a Tableau workbook, see [Ensure the content author includes user attribute functions](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_user_attributes.html#4-ensure-the-content-author-includes-user-attribute-functions). ## Tableau UAF Claims Definitions in Salesforce Tableau UAF claim definitions allow you to include claims for user attributes in the JWT. The values for these attributes can be pulled from Account, User, Opportunity, or Case objects in Salesforce. When used in conjunction with user attribute functions in Tableau content, only data matching the specified attributes is displayed. For example, a Tableau dashboard may be configured to only show sales data where the value in its \[State/Province\] data column matches one of the values in the JWT claim for the attribute 'state'. **Syntax**: USERATTRIBUTEINCLUDES('attribute\_name', expected value) **Example**: USERATTRIBUTEINCLUDES('state', \[State/Province\]) Creating a claim definition in Salesforce can include the appropriate user-specific information in the JWT. In this example, the attribute 'state' may be populated with values from Accounts where the current user is the Account Owner by pulling values from the Billing State/Province field. **Example Claim Definition** - Definition Name: state\_Account\_BillingState - Attribute Name: state - Target Object: Account - Target Object Field: Billing State/Province - Viewer Target Object Relationship: Current Viewer is the Account Owner In the case of a sales representative who owns accounts in Washington, Oregon, and California, the JWT will include a claim for 'state' with the values \[WA, OR, CA\]. The Tableau dashboard would then only show data with \[State/Province\] values matching WA, OR, or CA. ## Support for External Users in Experience Cloud User Attribute Functions (UAF) and Host Mapping are supported for **external users** accessing Tableau through Experience Cloud sites. This allows Salesforce attributes associated with the logged-in external user to be included in the JWT, enabling personalized Tableau views based on that user’s data. External users include authenticated Experience Cloud users such as Partner and Customer Community users. **Guest users are not supported.** To ensure proper functionality: - External users must have access to the relevant records used by UAF and Host Mapping. - The following objects must be configured to allow external access (for example, Public Read Only): - Analytics User Attribute Function Token - Host Mapping - UAF claims must be created and configured by an internal Salesforce user with Setup access. With the appropriate sharing configuration in place, UAF and Host Mapping will function the same for external users as they do for internal users. ## Create a definition To create a user attribute definition, follow these steps: 1. From your Salesforce app, select the gear in the top-right corner, and then select Setup. 2. On the left navigation pane, enter “Tableau” in the Quick Find search bar. 3. Select the Tableau UAF Claims Definition settings page. 4. Select Create New. 5. Fill in the definition values: 1. Definition Name: Enter a unique name. (Example: state\_Account\_BillingState) 2. Attribute Name: Enter the attribute name specified by the user attribute function in Tableau. (Example: state) 3. Target Object: Select the target object from which you want to pull the values. Tableau LWCs currently support the User and Account objects. 4. Target Object Field: Select the field on the target object from which you want to pull the values. (Example: Billing State/Province) 5. Viewer Target Object Relationship: Select the relationship between the current viewer and the Target Object. (Example: Current Viewer is the Account Owner). 6. Select Save. Or, if you want to return to the Tableau UAF Claims Definition settings page without saving, select Cancel. ## Add a definition to a Tableau Lightning web component page ### Home, App, and Record Lightning pages To add a definition: 1. Select Select…. 2. Use the arrows to move available definitions to the Selected field. 3. Select OK. 4. Repeat for all Tableau Lightning web components on the same page. For more information, see [Considerations for multiple components on the same page](#Consider). ### Experience Cloud pages and the Utility Bar Enter a comma-separated list of UAF claim definition names. To copy definition names, from the Salesforce app, navigate to the Tableau UAF Claims Definition setup page, and select Copy. ### Considerations for multiple components on the same page If multiple Tableau View or Tableau Pulse Lightning web components are added to the same page, each component must have the same set of UAF Definition Names. Only one of the components authenticates to Tableau, and that session will be used to load both components. This means that the relevant user attribute information for both components must be present in that session, no matter which component does the authentication. For example: - If you have two Tableau View components and one needs user attribute information from Definition A and the other needs the user attribute information from Definition B, both components must include both Definitions A and B. - If a Tableau View component needs Definition A but the Tableau Pulse component on the same page doesn’t need any user attribute information, both components must include Definition A. ## Delete a definition To delete a user attribute definition, follow these steps: 1. From your Salesforce app, select the gear in the top-right corner, and then select Setup. 2. On the left navigation pane, enter “Tableau” in the Quick Find search bar. 3. Select the Tableau UAF Claims Definition settings page. 4. Select Delete for the definition that you want to delete. ### Home, App, and Record Lightning pages If you delete a definition that is already added to a Tableau LWC, refresh the page in Lightning App Builder to update the available definitions. Deleted definitions are automatically removed. ### Experience Cloud pages and the Utility Bar Deleted definitions are not automatically removed from the Tableau LWC component field. Deleted definitions in the UAF Definition Names component field won’t cause problems, but do create unnecessary and confusing clutter. To remove definitions from the Tableau LWC component field, select the UAF Definition Names field, and manually delete any names that are no longer in use. [Skip to main content](#main-content) # License Data Management **Important:** As of September 16, 2024, Data Management is no longer available as an independent add-on option. Data Management capabilities are only available if you previously purchased Data Management, or if you purchase certain license editions: Tableau Enterprise, Tableau Cloud+, or Tableau+ Bundle (available for Tableau Cloud), or Tableau Enterprise or Tableau Server+ (available for Tableau Server). Data Management includes Tableau Catalog, Tableau Prep Conductor, virtual connections, and data policies. It is included with the following editions. - **Tableau Server:** Enterprise, Server+ - **Tableau Cloud:** Enterprise, Cloud+, Tableau+ Bundle Contact your account manager (or go to the Tableau [pricing](https://www.tableau.com/pricing/teams-orgs) page) for more information. ## Tableau Prep Conductor When you purchase Enterprise, Cloud+, or Tableau+ Bundle licenses, Prep Conductor is automatically enabled on your Tableau Cloud site. For more information, see [Enable Tableau Prep Conductor on your Tableau Cloud Site](https://help.tableau.com/v0.0/online/en-us/prep_conductor_configure_online.htm). - At least one resource block is required to use Tableau Prep Conductor in Tableau Cloud. To learn more about resource blocks, see [Resource Blocks](https://help.tableau.com/v0.0/online/en-us/to_resource_blocks.htm). - When Data Management is active and enabled, you can schedule flows in Tableau Server or Tableau Cloud and monitor flows. - When Data Management is removed or deactivated, or if the Data Management license expires, then the ability to schedule flows is disabled. - If your Tableau Server or Tableau Cloud license is still active and valid, you can download the flows using the Tableau Server REST API. For more information, see [Flow Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_flow.htm). ## Tableau Catalog When you purchase Enterprise, Cloud+, or Tableau+ Bundle licenses, Catalog is automatically enabled. If your site was upgraded from Standard, a site admin must turn on Catalog once. For more information, see [Enable Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_enable.htm). When Data Management is active and enabled, you can use Tableau Catalog to discover data, curate data assets, perform impact analysis, and trace the lineage of data used in Tableau content. When Data Management is removed, deactivated, or the license expires, Catalog-specific information is deleted and access to the Metadata API is removed. ## Virtual connections and data policies When you purchase Enterprise, Cloud+, or Tableau+ Bundle licenses, virtual connections and data policies are automatically enabled on your Tableau Cloud site. - When Data Management is active and enabled, you can use virtual connections to create sharable resources that provide a central access point to data. You can also create data policies that enable you to filter data for users using centralized row-level security. - When Data Management is removed, deactivated, or the license expires, the information remains on the server but is not accessible. - When Data Management is reactivated, the information is restored on the server and becomes accessible. ## Other articles in this section [Skip to main content](#main-content) # List and Share Outbound Private Connections ## Cloud Administrator As a cloud administrator, see all private connections using the Private Connect tab in Tableau Cloud Manager (TCM) Settings: - Log in to Tableau Cloud Manager (TCM). - Go to Settings. - Select the Private Connect tab. ![A cloud administrator's table of private connections](/tableau/next/en-us/online/en-us/Img/private_connect_cloud_admin_private_connection_table.png) The list of private connections in TCM Settings includes all private connections, regardless of state or site assignment. If you can't see the Private Connect tab, talk to your Tableau account manager and confirm you are using Tableau Cloud with an Enterprise or Tableau+ license edition, and you have at least one Private Connect endpoint add-on license. ## Site Administrator As a site administrator, see useable private connections using the Private Connect tab in site Settings: 1. Log in to your Tableau Cloud site. 2. Go to Settings. 3. Select the Private Connect tab. ![A site administrator's table of private connections](/tableau/next/en-us/online/en-us/Img/private_connect_site_admin_private_connection_table.png) If you can't see the Private Connect tab, or the list of private connections looks inaccurate or incomplete, talk to your cloud administrator. ## Share a Private Connection with Creators Creators need the private connection's Connection Address for connecting to the AWS-hosted data. Cloud administrators and site administrators get the Connection Address from the private connections table and give it to creators or the group that supports them. The full address is often truncated due to length, and the easiest method to copy the Connection Address is to use the Actions menu (...): 1. Find the private connection in the list of private connections. 2. Select Copy Connection Address in the Actions menu (...) to copy the full Connection Address to your clipboard. 3. Share the connection address with Creators. **Note:** Share the connection address as-is. Do not add `https://` or any other elements to the address. In workbook and data source connection dialogs, creators enter the private connection's Connection Address like any other server name. Creators fill in the other connection dialog fields (for example, port, database name, or authentication) the same as the regular, non-private version of the connection. [Skip to main content](#main-content) # Maintain Content with Custom Views As a content creator, it's important to understand how updates you make to workbooks and data sources can impact the end user. Custom views are a popular way to personalize how vizzes are consumed, but custom views can break if their source content changes. Avoid making changes known to impact custom views, if possible. When changes need to be made, follow the steps outlined later in this topic. In general, there are some best practices when working with content known to use custom views. - Advise end users to only create custom views on stable content. - Use projects or naming systems to identify workbooks that are being modified and recommend users don't create custom views on them. - Test changes in a staging or development environment. Test custom views that are representative of the expected filters, user actions, parameter settings, and other customizations. - Proactively notify users before publishing changes that may break custom views. (Retrieve a list of all custom views applied to a workbook [using the custom views methods in Tableau's REST API](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_workbooks_and_views.htm#list_custom_views).) ## Changes known to impact custom views While it's best to test any changes to verify their impact on custom views, there are some updates that are known to impact custom views. This list isn't comprehensive and is intended for guidance only. ### Workbook changes - **Name changes**. Changing the name of the workbook (or the sheet the custom view is associated with) breaks the custom views. - **Parameters**. Adding or removing a parameter may cause a custom view to break or fail to update as expected. - If a parameter is added to the original content, the custom view may break. - If a parameter control is removed, calculated fields that used its input retain their last value and are no longer adjustable. - **Filters**. Removing a filter removes the filter control but leaves the data in a filtered state. - In general, if a filter is deleted in the original content, a custom view that used that filter continues to work. However, the data remains filtered with no filter control present. This means users can't change the filter selection from the custom view. - Changing the filter control from slider to relative date doesn't adjust the filter to accurately reflect the relative date as expected. - If custom views are used to control filter selections, consider using embedding filter parameters in a shared URL instead. - **Hiding sheets**. Setting a sheet to hidden, even if it's later unhidden, breaks custom views on that sheet. - **Republishing**. Deleting and republishing a workbook breaks its custom views. - **Default values**. If a custom view is defined by a default value (such as for a parameter, set, or filter) and the default value changes, the custom view updates to reflect the new value. If the custom view needs to be tied to a specific value, use it rather than relying on . ### Data source changes - **Data source changes**. Replacing a data source using the Replace data source functionality or replacing an embedded data source with a published copy of the same data source breaks the custom views. - **Data type**. Changing the data type of a field relevant to the custom view breaks the custom view. - **Removing fields**. Removing fields, calculations, groups, or sets that custom views are based on breaks the custom view. ## Update content safely The following is a set of best practices to minimize the risk of breaking existing custom views. - Edit the workbooks and changes to the data sources separately. - Don't republish a workbook that has a replaced data source. - Edit a local version of the workbook or data source and republish it with the same name. ### Modify a workbook These steps assume the workbook uses a live connection to a separately published data source and has existing custom views. #### Modify a workbook with web editing Web editing is the preferred method for modifying a workbook. Only use Tableau Desktop if necessary. 1. Edit a workbook in the browser, avoiding the items addressed earlier that are known to break custom views. - If changes need to be made to the data, don't make them now. See the section on modifying a data source. 2. Publish the workbook to the same location with the same name, saving over the existing version. #### Modify a workbook with Tableau Desktop When possible, modify workbooks in the browser. Only use Tableau Desktop if necessary. 1. Open a local version of the workbook (download the workbook first if necessary). 2. Edit the workbook, avoiding the items addressed earlier that are known to break custom views. - If changes need to be made to the data, don't make them now. See the section on modifying a data source. 3. Publish the workbook to the same location with the same name, replacing the existing version. - _Don't_ check the option to "Update the workbook to use the published data source". ### Modify a data source 1. Open a local version of the data source in Tableau Desktop by downloading the workbook and creating a local copy of the data source: 1. Download the workbook and open it in Tableau Desktop. 2. Right-click the data source and select "Create Local Copy". 3. Right-click the new data source and select "Replace Data Source…" 4. Swap the existing connection to the published data source with the newly created local copy. **Note**: Using a local version in a workbook is the preferred method because it allows you to verify data source changes directly in the workbook. Alternatively, you can download the data source or use a locally stored copy. 2. Edit to the data source, avoiding the items addressed earlier that are known to break custom views. 3. Publish the data source. 1. Use the same name and save over the existing data source. 2. Don't check the option to "Update the workbook to use the published data source". 3. Don't publish the workbook with the modified data source. If changes need to be made to the workbook contents, see the section on modifying workbooks. ## Investigate broken custom views **Note**: This section assumes familiarity with XML and basic command-line interactions. In a .twb workbook file, the XML of a workbook contains identifying tags for elements of the workbook. When a custom view is created, a snapshot is taken of the interactive elements (such as filter or set values, parameters, or selected marks) and their values. When a custom view is accessed, Tableau applies the attribute values stored with the custom view to the relevant element IDs. If the element IDs are changed or the attribute values can't be loaded, the custom view breaks. It may be possible to identify what changed to break a custom view by comparing a .twb from before and after the change. 1. You need a .twb of the workbook when the custom view is functioning (save a copy of content before making any changes). 2. In another copy of the workbook, make the change thought to cause the custom view to break and save it as a different .twb. 3. In the command line, run the following command (substituting the files from step one as file1.twb and from step two as file2.twb). vimdiff file1.twb file2.twb 4. The results highlight changes between the files. Some IDs or attribute values (in **\[brackets\]**) that are known to break custom views if changed: ```

``` [Skip to main content](#main-content) # Manage Tasks Administrators can manually refresh extracts or delete their schedules. For Tableau Prep flows, Administrators can manually run flows, edit and delete schedules. 1. Sign in to the site that has the schedules you want to manage, and then click Tasks. 2. Select one or more scheduled extract refreshes. 3. From the Actions menu, do any of the following: - Select Change Schedule, and choose a new schedule from the list. - Select Run Now to refresh manually. **Note:** If an extract does not have a scheduled refresh, you can refresh it on demand from the Data Connections page. - Select Delete to completely remove the schedule for the selected data sources. ## Manage flow tasks Administrators can change the frequency for a flow schedule, change the priority, as well as edit a schedule for a flow or manually run the flow, all from the Tasks page. 1. Sign in to the site that has the schedules you want to manage, and then click Tasks. 2. On the Flow tab, select one or more flows that you want to manage. 3. From the Actions menu, do any of the following: - Select Run Now to run the flows manually. - Select Edit Task to edit the flow task. - Select Change Schedule, choose a new schedule from the list, then select Change Frequency. - Select Delete to completely remove the schedule for the selected flows. ## See also [Notify Owners When Extract Refreshes Fail](https://help.tableau.com/v0.0/online/en-us/to_refresh_enable_emails.htm) [Skip to main content](#main-content) # Manage a Flow Once you publish a flow to Tableau Server or Tableau Cloud, you can manage your flows and make changes to them as necessary. This topic describes the various actions you can take to manage your flows. **Note**: The content in this topic applies to both Tableau Server and Tableau Cloud, exceptions are called out specifically. ## Managing your flows **Following is a list of actions you can take to manage your flows:** - **Create flows:** Starting in version 2020.4, as a Creator you can create flows directly on the web. From the Home page, click Create > Flow or from the Explore page, click New > Flow. For more information, see [Tableau Prep on the Web](https://help.tableau.com/v0.0/online/en-us/prep_web_auth.htm). - **Edit flows:** Starting in version 2020.4, as a Creator you can edit flows directly on the web. Navigate to the list of flows, select Actions and click Edit Flow, or open a flow and click the Edit button. When you edit a flow, your changes are moved to a draft state. When you're finished, publish your flow to commit your changes and create a new version of the flow. For more information, see [Autosave and working with drafts](https://help.tableau.com/v0.0/online/en-us/prep_web_auth.htm#autosave). You can edit the data connection using the Edit Connection menu option from the Connections view, Actions (…) menu for the data source. The new connection is saved and used the next time the flow runs in Tableau Prep Conductor. However, when you open the flow to view it, the original connection persists and won't be updated until you edit the flow, update the connector, and republish it. If you open, edit, and republish the flow without changing the original connection, any connection changes made using the Edit Connection menu will be overridden and replaced with the original connection. - **Upload flows** (version 2026.2.4 and later) As a Creator, you can upload a flow file into Tableau Cloud from the Home or Explore pages, just like Tableau workbooks. Embedding credentials is not currently supported. After the flow is uploaded, you can either edit the connection or edit the flow, and republish it with the embedded credentials. If you upload a flow that outputs to a different server, after you upload it, you'll need to edit the output to point to the correct project on the new server before running the flow. - **Run flows:** As a Creator, you can manually run a flow in addition to creating scheduled flows tasks that run at a specific time. Explorer (can publish) users can also run flows if the Server Administrator has granted this permission. - **Note**: The Data Management is not required to manually run flows, but is required to schedule flows to run. - Navigate to the list of flows, select one or more flows you want to run, select Actions and click Run Now. - **Tag:** Tags are keywords you can create for flows to help you find, filter, and categorize content. Authors can add tags to flows when they publish it. But you can also add tags to any workbook, view, or data source that you are allowed to access and you can delete any tags you have added. You can add a tag to a list of flows. Navigate to the list of flows, select one or more items you want to tag, select Actions and click Tag. To add a tag to a specific flow you can do it from the list of flows as described above. Open the Flow, from the Overview tab, select Actions, and click Tag. - **Change Owner:** Administrators and flow owners can change owners to any Creator on their site. In versions 2025.1 and earlier, they could only change the owner to themselves. For more information, see [Manage Content Ownership](https://help.tableau.com/current/online/en-us/owner.htm?). - **Permissions:** You can set permissions for users and specify if they can perform edit actions like save, download, move to a different project and delete. In addition, you can specify who can view and run the flow. - **Download:** You can download a flow to view or modify it using Tableau Prep Builder. To download a flow, you need download permissions. You’ll have that by default if you are the owner, but you might need to add it for other users. - **Revision History:** When you make a change to the flow, and republish it to the same project with the same name, a new version of the flow is created. You can view the revision history by selecting revision history from the actions menu. Flow owners have permissions to restore a previous version of a flow. - **Move:** You can move flows between projects. To move a flow, users need Move permission. You’ll have that by default for flows you own, but you might need to add it for other users. - **Rename:** You can rename a flow. To rename a flow, users need the Save permission. You'll have that by default for flows you own, but you might need to add it for other users. - **Delete:** You can delete a flow. To delete a flow, users need the Delete permission. You’ll have that by default for flows you own, but you might need to add it for other users. Starting in version 2025.3, you can now retrieve deleted flows from the Recycle Bin. For more information, see [Recover deleted flows](https://help.tableau.com/current/prep/en-us/prep_save_share.htm#recover-deleted-flows). ### Who can do this Tableau Server Administrator **Can do the following tasks across all the sites:** - Create flows - Edit published flows - Upload flows - View a list of all draft flows - Run flows - Delete flows - Turn on and configure Recycle Bin - Recover deleted flows - Download flows - Change Owner - Change Permissions - Change Project - Add/Remove Tags - Change Description - Change Name - Update Flow Task - Delete Flow Task - Create a Flow Task\* - Version Management\* \*Some additional conditions apply to these actions: - To create a flow task: - A flow schedule must be available. In Tableau Server, only Server Administrators can create a schedule. In Tableau Cloud, users with permissions to schedule flow tasks can create a custom schedule. For more information, see [Schedule Flow Tasks](https://help.tableau.com/current/online/en-us/prep_conductor_schedule_flow_task.htm). - The flow must have at least one output step. - The flow version must be compatible with the Tableau Server version. - Version management: - Revision history must be enabled on the site. - User role is allowed to publish to the project. Tableau Site Administrator **Can do the following tasks on flows published to the sites that they are site administrator for:** - Create flows - Edit published flows - Upload flows - View a list of all draft flows - Run flows - Delete flows - Turn on and configure Recycle Bin - Recover deleted flows - Download flows - Change Owner - Change Permissions - Change Project - Add/Remove Tags - Change Description - Change Name - Update Flow Task - Delete Flow Task - Create a Flow Task\* - Version Management\* Some additional conditions apply to these actions: - To create a flow task: - A flow schedule must be available. In Tableau Server, only Server Administrators can create a schedule. In Tableau Cloud, users with permissions to schedule flow tasks can create a custom schedule. For more information, see [Schedule Flow Tasks](https://help.tableau.com/current/online/en-us/prep_conductor_schedule_flow_task.htm). - The flow must have at least one output step. - The flow version must be compatible with the Tableau Server version. - Version management: - Revision history must be enabled on the site. - User role is allowed to publish to the project. Project Leader **Can do the following tasks on flows published to the projects where they have project leader permissions:** - Create flows - Edit published flows - Upload flows - Run Flows - Delete - Download - Change Permissions - Change Project - Add/Remove Tags - Change Description - Change Name - Update Flow Task - Delete Flow Task - Create a Flow Task\* - Version Management\* \*Some additional conditions apply to these actions: - To create a flow task: - A flow schedule must be available. In Tableau Server, only Server Administrators can create a schedule. In Tableau Cloud, users with permissions to schedule flow tasks can create a custom schedule. For more information, see [Schedule Flow Tasks](https://help.tableau.com/current/online/en-us/prep_conductor_schedule_flow_task.htm). - The flow must have at least one output step. - The flow version must be compatible with the Tableau Server version. - Version management: - Revision history must be enabled on the site. - User role is allowed to publish to the project. Project Owner **Can do the following tasks on flows published to the projects that they own:** - Create Flows - Edit published flows - Upload flows - Run Flows - Delete - Download - Change Permissions - Change Project - Add/Remove Tags - Change Description - Change Name - Update Flow Task - Delete Flow Task - Create a Flow Task\* - Version Management\* \* Some additional conditions apply to these actions: - To create a flow task: - A flow schedule must be available. In Tableau Server, only Server Administrators can create a schedule. In Tableau Cloud, users with permissions to schedule flow tasks can create a custom schedule. For more information, see [Schedule Flow Tasks](https://help.tableau.com/current/online/en-us/prep_conductor_schedule_flow_task.htm). - The flow must have at least one output step. - The flow version must be compatible with the Tableau Server version. - Version management: - Revision history must be enabled on the site. - User role is allowed to publish to the project. Flow Owner **Can do the following tasks on flows that they own:** - Create Flows - Edit Draft (flows they own) and Published Flows - Upload flows - Run flows - Delete flows - Recover deleted flows (with Recycle Bin turned on by administrator) - Download flows - Change Owner - Change Permissions - Change Project - Add/Remove Tags - Change Description - Change Name - Update Flow Task - Delete Flow Task - Create a Flow Task\* - Version Management\* \*Some additional conditions apply to these actions: - To create a flow task: - A flow schedule must be available. In Tableau Server, only Server Administrators can create a schedule. In Tableau Cloud, users with permissions to schedule flow tasks can create a custom schedule. For more information, see [Schedule Flow Tasks](https://help.tableau.com/current/online/en-us/prep_conductor_schedule_flow_task.htm). - The flow must have at least one output step. - The flow version must be compatible with the Tableau Server version. - Version management: - Revision history must be enabled on the site. - User role is allowed to publish to the project. User with Creator License **Can do the following tasks:** - Create Flows - Edit Draft (flows they own) and Published Flows - Upload flows - Run Flows (with Run flow permissions) - Delete (with delete permissions) - Recover deleted flows (with Recycle Bin turned on by administrator) - Download (with download or Save as, and read permissions) - Change Permissions (with Change Permissions) - Change Project (with move permissions, and write permissions on the destination project) - Add/Remove Tags (with read permissions) - Change Description (with Save permissions) - Change Name (with Save permissions) - Update Flow task (with Execute permissions) - Delete Flow Task (with Execute permissions) - Create a Flow Task\* (with Execute permissions) - Version Management\* (with view, read, save as, download permissions) \* Some additional conditions apply to these actions: - To create a flow task: - A flow schedule must be available. In Tableau Server, only Server Administrators can create a schedule. In Tableau Cloud, users with permissions to schedule flow tasks can create a custom schedule. For more information, see [Schedule Flow Tasks](https://help.tableau.com/current/online/en-us/prep_conductor_schedule_flow_task.htm). - The flow must have at least one output step. - The flow version must be compatible with the Tableau Server version. - Version management: - Revision history must be enabled on the site. - User role is allowed to publish to the project. User with Explorer License **Can do the following tasks:** **Note**: Starting in version 2020.4, Explorer license users can no longer run flows on Tableau Server, even if the Server Administrator assigns the Run Flow: Allowed permissions. - Explorer (can publish) license users with Run Flow: Allowed permissions can run flows on Tableau Server and Tableau Cloud. - Delete (with delete permissions) - Recover deleted flows (with Explorer (can publish) permissions and Recycle Bin turned on by administrator) - Download (with download or Save as, and read permissions) - Change Permissions (with Change Permissions) - Change Project (with move permissions and write permissions on the destination project) - Add/Remove Tags (with read permissions) - Change Description (with Save permissions) - Change Name (with Save permissions) - Update Flow task (with Execute permissions) - Delete Flow Task (with Execute permissions) - Create a Flow Task\* (with Execute permissions) - Version Management\* (with view, read, save as, download permissions) \*Some additional conditions apply to these actions: - To create a flow task: - A flow schedule must be available. In Tableau Server, only Server Administrators can create a schedule. In Tableau Cloud, users with permissions to schedule flow tasks can create a custom schedule. For more information, see [Schedule Flow Tasks](https://help.tableau.com/current/online/en-us/prep_conductor_schedule_flow_task.htm). - The flow must have at least one output step. - The flow version must be compatible with the Tableau Server version. - Version management: - Revision history must be enabled on the site. - User role is allowed to publish to the project. User with Viewer License Viewers cannot manage flows, they can however view the flow and the different versions of the flow. For more information about the full capabilities you can set on flows, see [Permission capabilities](https://help.tableau.com/current/server/en-us/permissions.htm). [Skip to main content](#main-content) # Manage Admin Insights Admin Insights is a Tableau Cloud-only project that is pre-populated with carefully curated data sources and a pre-built workbook of your site's data. Using the resources available to you through the Admin Insights project, you can create custom views to help answer a range of common questions you might have about your site. ## Admin Insights versus Admin views The Admin Insights project and the pre-built admin views (accessible from Tableau Cloud's Status page) are both valuable tools for monitoring the health and activity of your Tableau Cloud site. One tool does not replace the other. To determine which tool to use, consider the following:

Admin Insights	Admin Views
Site traffic, adoption, and reach User roles and sign-in activity Publishing-related activity	General site activity, site performance, and disk space usage Extract performance Tableau Bridge traffic and extract-related activity Troubleshooting

## What's included with the Admin Insights project The Admin Insights project is comprised of the following: - **Admin Insights data sources**—TS Events, TS Users, Groups, Site Content, Viz Load Times, Job Performance, Permissions, Subscriptions, and Tokens. You can use these data sources on which to create new data sources if you need to enrich the data with custom calculations or other data from your organization. For more information about the data sources, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm#datasources). - **Admin Insights Starter**—a pre-built workbook that contains dashboards based on the Admin Insights data sources. These dashboards are intended to serve as templates on which to build more dashboards and views that can go more in depth and answer questions that are unique to your site's deployment or organization. For more information about the dashboards, see [Explore the pre-built workbook](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm#dashboards). - **Tableau System Account**—data sources in the Admin Insights project are updated by the Tableau System Account. While events conducted by this account are not visible in the data sources, the Tableau System Account is listed as the owner of Admin Insights content by default. This account exists to provide Admin Insights data to your Admin Insights project. **Note:** The Admin Insights project shouldn't be moved from its default location on the Explore page. Moving the project will stop data source updates from Tableau. If you've moved the project, back up any changes or content you've published, and delete the Admin Insights project to restore functionality. A new Admin Insights project will be created the next day. ### About data freshness The Admin Insights data sources contain up to 90 days of data about your site by default or 365 days with Advanced Management. For more information, see [About Tableau Advanced Management on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/itm_intro.htm). The data sources can be updated daily or weekly. To specify the update frequency for Admin Insights data sources, go to Settings, and on the General tab, scroll to **Admin Insights Update Frequency**. Because the Admin Insights Starter is based on these data sources, dashboards in the workbook always show up-to-date information. Periodically, Tableau updates the workbook itself. For more information, see [Get updates to the Admin Insights Starter](#updates) later in this topic. ## Share access to Admin Insights The Admin Insights content is initially visible to site admins only. Consider extending access to other site users in your organization to enable them to build, curate, and gain insight unique to their needs and workflows and ultimately help them manage their content more effectively. For more information about extending project permissions to non-site admins, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#projectpermissions). ## Move or rename the Admin Insights Starter Tableau strongly recommends that you move the pre-built workbook, Admin Insights Starter, to a different project or simply rename it. Doing so helps ensure that your changes are preserved and do not get overwritten by periodic updates Tableau makes to the pre-built workbook. For more information, see the [Get updates to the Admin Insights Starter](#updates) below. ### Get updates to the Admin Insights Starter Periodically, Tableau makes updates to the Admin Insights Starter. The updates are automatically applied to the Admin Insights Starter workbook in the Admin Insights project. The updates are summarized in the Release Notes workbook that is also available in the Admin Insights project. Updates can include new fields or field descriptions, new views, updates to existing views, and more. To make sure you get the latest updates to the Admin Insights Starter, and none of the changes you make to the workbook are overwritten, follow the steps described below. **Step 1: Prepare for updates** In order to preserve the changes you make to your workbook and avoid these changes from being overwritten by Tableau, Tableau recommends that you do one of the following tasks: - Move the workbook to a different project - Rename the workbook To maintain both your changes and Tableau's latest workbook improvements, you'll need to repeat one of the above tasks after each update that Tableau makes. **Step 2: Check for updates** As part of its update process, Tableau recreates and then adds the Admin Insights Starter to your Admin Insights project. If you've moved or renamed the workbook, a _new_ "Admin Insights Starter" is added to your Admin Insights project. You can verify the new workbook by its modified date or by its publish date in revision history. **Step 3: Use Revision History to undo changes (optional)** If you were unable to move or rename the workbook before Tableau replaced the Admin Insights Starter, or you don't care for the update, you can use revision history to revert the changes. For more information about revision history, see [Work with Content Revisions](https://help.tableau.com/current/pro/desktop/en-us/qs_revision_history.htm) in the Tableau User Help. **Step 4: Manually make or move your changes to the latest Admin Insights Starter** To ensure that your changes are reflected in the same workbook as the changes made by Tableau, you'll need to follow the procedure below. 1. In the latest version of the Admin Insights Starter workbook, you do can do one or both of the following: - Manually make the changes that you made in your version of the workbook to the latest version of the workbook. - Export the sheet from your version of the workbook and save it to the latest version of workbook. For more information about exporting sheets, see [Export and import sheets between workbooks](https://help.tableau.com/current/pro/desktop/en-us/copy_b_wkbks.htm#export-and-import-sheets-between-workbooks) in the Tableau User Help. 2. Move or rename the latest workbook again, so that any new updates Tableau makes to the Admin Insights Starter does not overwrite your changes. ## Tips for managing Admin Insights Although the Admin Insights project functions just like any other project on your site, Tableau recommends you consider the following while managing the project: - **Move the Admin Insights Starter to a different location.** If you plan to make updates to Admin Insights Starter, Tableau recommends that you either 1) move the workbook to a different project or 2) rename the workbook. Doing one of these tasks ensures that your changes are preserved and do not get overwritten by periodic updates that Tableau automatically makes to the workbook. For more information, see [Get updates to the Admin Insights Starter](#updates). - **Use caution when moving data sources.** If you move any of the Admin Insights data sources outside of the Admin Insights project, Tableau will be unable to refresh them. The data sources are also periodically updated by Tableau. To ensure the data sources are refreshed and your changes are preserved, keep the TS Events, TS Users, Groups, Site Content, Viz Load Times, Job Performance, Permissions, Subscriptions, and Tokens data sources in the Admin Insights project. - **Designate other users, including users who are not site admins, to access and create content for the project.** For example, allow a user to create new views based on the TS Events, TS Users, Groups, Site Content, Viz Load Times, Job Performance, Permissions, Subscriptions, and Tokens data sources. For more information about changing project permissions, see [Set permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#setpermissions). [Skip to main content](#main-content) # Manage Alerts for Tableau Bridge A scheduled refresh can fail for a variety of reasons. As a data source owner, it's important to be aware of these refresh failures so that you can troubleshoot any issues and minimize gaps in data freshness. If enabled by your site admin, you receive alerts about refresh failures for all of the data sources that you own. When refreshes for your data sources are facilitated by Bridge refresh or Bridge legacy schedules, the type of alerts you receive, when you receive them, and the alerts that you can configure differ from other Tableau alerts. ## How you receive Bridge alerts Bridge job failure notifications are delivered through Tableau's Unified Notification Platform, the same platform that powers your other Tableau notifications. Previously, Bridge sent these notifications by email only. Now, alerts about Bridge job failures—such as client disconnection, extract refresh failures, prep flow failures, and virtual connection failures—appear alongside your other Tableau notifications, in addition to email. Bridge alerts are sent to the same audience as the email alerts: site admins and the data source owners. No additional setup is required to receive these notifications. Make sure the Tableau checkbox is selected in your general notification preferences. ## Differences with Bridge alerts - Timeout refresh failure emails are sent when the timeout limit is exceeded. Unlike refreshes that run directly on Tableau Cloud, Bridge refreshes timeout after 24 hours (default). However, a timeout limit for refreshes can be increased (or decreased) through each Bridge client by a site admin. For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#timeout). - Notifications for Bridge-related refresh issues are sent to specific recipients depending on the failure type: - **RAS failures**: These alerts relate to a Refresh after Schedule (RAS) failure, meaning the job was successfully sent to the Bridge client but failed during or after processing on the client machine. Notifications are sent only to the data source owner. Site admins do not receive these notifications. - **Refresh job failure**: When an extract refresh fails for reasons other than those listed below (this is the catch-all for failures that occur once the job is with the client). - **Bridge client is not running:** When the Bridge client linked to the data source is not running, but other clients in the pool are active. - **Incomplete refresh**: When a scheduled refresh hasn't completed after a specified amount of time. - **Edge pool failures**: These alerts relate to an edge pool failure, meaning the scheduled refresh job failed to run before it could be sent to the Bridge client due to issues with the pool capacity or client availability. These notifications are sent to the data source owner and the site admin. - **Bridge pool at capacity:** When extract refreshes can’t run because the pool is at capacity. - **No clients in Bridge pool:** No Bridge clients are assigned to the pool. - **No clients running in Bridge pool:** Bridge clients are assigned to the pool, but none of them are currently running. This includes cases where a single client in the pool is not running, or where multiple clients are assigned but all are inactive. - For a particular data source, Tableau Cloud sends email about the first five consecutive refresh-related failures (i.e., refresh failures, alerts because the client is not running, or alerts because the refresh hasn't completed yet) on the first day. If the data source continues to have refresh issues after the first day, Tableau Cloud sends one email per day. - A data source owner can receive up to 10 emails, one email per data source with active and consecutive refresh issues, in one day. The time period of _one day_ is 24 hours starting at the time of the first refresh issue. - Data refresh-initiated [Subscription](https://help.tableau.com/current/online/en-us/subscribe_user.htm) emails are not supported for views or workbooks that rely on Bridge extract data sources to keep data fresh. For more information, see [Missing subscription emails](https://help.tableau.com/v0.0/online/en-us/to_bridge_troubleshoot.htm#subscriptions). ## Configure pooling Extract refreshes can fail because of issues with the Bridge pool and load balancing. Site admins can configure and manage pooling for Bridge clients by adding a new pool or modifying the pooling capacity. For more information, see [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm) and [Manage the size of the Bridge pool](https://help.tableau.com/current/online/en-us/to_sync_change_computer_site.htm#configurable-options1). ## Stop receiving alerts when a client is not running By default, Tableau Cloud is configured to notify data source owners when scheduled refreshes can't start because the Bridge client linked to the data source is not running. There are two primary reasons why you might be receiving this email: - The computer where the client is running from is not on. - An extract data source continues to be associated with a client that is no longer in use. If any of these reasons apply to your situation: - Confirm whether the Bridge client is running, and - If you're a site admin, delete unused clients from the site. If you're not a site admin, you can delete the data source from the client. For more information, see [Scheduled refreshes appear to be running outside of schedule:](https://help.tableau.com/v0.0/online/en-us/to_bridge_troubleshoot.htm#notrunning). [Skip to main content](#main-content) # Manage Connection Information ## Other articles in this section [Skip to main content](#main-content) # Manage Content Access You can manage who can access content on your site and set the permissions that govern content ownership. ## Other articles in this section [Skip to main content](#main-content) # Manage Content Ownership When you publish a data source, workbook, or flow on Tableau Cloud or when you create a project, you become its _owner_. A content owner, a project leader with an appropriate site role, or an administrator can change ownership of a content asset. After ownership is reassigned, the original owner has no special connection to the content item, and their ability to access it is determined by their permissions on the project or that specific item. ## Who can change or be given ownership, by content type Whether you can change or be given ownership depends on your permissions and your relationship to the content asset, as described in the following table. **Note:** Full project leader access is available only with some site roles. For information, see [Project-level administration](https://help.tableau.com/v0.0/online/en-us/projects.htm#project-admin).

Content asset type	Who can change ownership	Who can be given ownership
Top-level projects	Server administrator¹ Site administrator	Server administrator Site administrator Creator Explorer (can publish)
Child (nested) projects	Server administrator Site administrator Project owner	Any administrator or owner, excluding Explorer and Viewer.
Workbooks and data sources	Server administrator Site administrator Workbook or data source owner Project leader or owner of the project that contains the item	Server administrator Site administrator Creator Explorer (can publish)
Metrics (The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see Create and Troubleshoot Metrics (Retired).)	Server administrator Site administrator Metric owner Project leader or owner of the project that contains the item	Any administrator or user of the site, excluding Explorer and Viewer.
Flows	Server administrator Site administrator Flow owner (2025.2 and later)	Server administrator Site administrator Creator Note: In versions 2025.1 and earlier, Server and site administrators can only change the owner to themselves.
Data Roles	Server administrator Site administrator Data role owner Project leader or owner of the project that contains the item	Any administrator or user of the site, excluding Explorer and Viewer.
Collections	Server administrator Site administrator Collection owner	Server administrator Site administrator Creator Explorer Viewer
Virtual Connections²	Server administrator Site administrator Virtual connection owner	Server administrator Site administrator Creator

1 The Server Administrator site role applies to Tableau Server only; not Tableau Cloud. 2 Virtual connections require Data Management. See [About Data Management](https://help.tableau.com/v0.0/online/en-us/dm_overview.htm) for details. Note that to edit a virtual connection, you must have the database credentials. ## Considerations for changing content ownership - Before you remove a user from Tableau Cloud, make sure they do not own any content assets. - If the user does own content, you must first reassign ownership of those assets before you can delete the user. Otherwise, their site role is set to Unlicensed, but they are not deleted, and only an administrator can take certain actions on that content. Reassign ownership of workbooks or data sources with embedded credentials before you set the user's site role to Unlicensed or delete the user. - If you change the ownership of a workbook, data source, or flow that includes embedded credentials to connect to underlying data, the embedded credentials will be deleted, and you’ll need to reauthenticate to connect. **Note:** This doesn't apply to embedded credentials that use a managed keychain. In those cases, the credentials are preserved even after the ownership change. Connections to published data sources are authenticated using the original flow owner and authorized based on their permissions. The new owner would need the necessary read/write permissions to that data source. Otherwise, the flow would fail when trying to connect to or write to the data source. - Ownership of input or output data sources to a flow may also need to be transferred to the new owner or their permissions to the data source may need to be updated. - You can update the embedded credentials by editing the connection information on Tableau Cloud. For more information, see [Edit Connections on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_connections_modify.htm). For flows, you can open and edit the flow in Tableau Prep web authoring and republish the flow with the new credentials. - You can only transfer ownership on published flows. You can’t change the ownership on flow drafts. - If you do not lock permissions to projects, make sure users you give content ownership to know your permissions guidelines, or you account for permissions as you change ownership. In unlocked projects, by default, content owners can set permissions on their content. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#LockProject). - While it is possible to change the owner of a metric to a user with a site role of Viewer or Explorer, it is not recommended, because doing so will cause the metric refresh to be suspended. A site role of Creator or Explorer (can publish) is required to refresh, overwrite, or delete a metric. ## Change the owner of a content resource 1. Sign in to the Tableau Cloud web environment, and from the navigation menu, select Explore. 2. Navigate to the content you want to assign to someone else. - If you want to reassign multiple of the same type of content, for example, multiple workbooks, select the content type from the drop-down menu. - If you want to reassign multiple items within the same project, navigate to the project. If you’re not sure where to find a child project, display filters, and select Show all projects. - If you want to reassign multiple content items with the same owner, find the user on the Users page. 3. Select the items you want to reassign, and then select Actions > **Change Owner**. The other menu commands you see will depend on the content type. ![](/tableau/next/en-us/online/en-us/Img/owner_wkbks_change.png) 4. Type the name of a user or select a user from the list. ![A form for changing the owner of selected workbooks and flows.](/tableau/next/en-us/online/en-us/Img/owner_change_256.png) 5. Select **Change Owner**. [Skip to main content](#main-content) # Manage Saved Credentials for Data Connections Saved credentials enable you to connect to a data source without being prompted for your credentials. The credentials saved for your connection can be OAuth access tokens, or other credentials, such as user name and password. You can manage saved credentials on your account settings page. On Tableau Cloud, you can manage saved credentials on your Account Settings page. **Note:** When editing Tableau Prep flows on the web, you may still be prompted to re-authenticate. ## Test connections using saved credentials If the connector supports test functionality, you can test the connection using saved credentials. 1. While you’re signed in to Tableau Server or Tableau Cloud, display your Account Settings page. 2. In the Saved Credentials section, select the Test link next to the stored connection that you want to test. This test confirms that Tableau Cloud or Tableau Server can access your account using this corresponding saved credential. If the test succeeds, but you can’t access your data through this managed connection, confirm that the credentials you provided for this connection can access your data. For example, if you accidentally created the connection using your personal Gmail account, but you use a different account to access a Google Analytics database, you’ll need to delete the saved credentials and sign in to the data using the appropriate Gmail account. ## Update saved credentials To help ensure uninterrupted data access from existing Tableau content after a custom OAuth client has been configured for your site, we encourage you to update your saved credentials. To update saved credentials, you can delete the previous saved credentials for a particular connector and then add it again. When you add saved credentials again, both new and existing Tableau content will access the data using the custom OAuth client configured by your site admin. For more information about custom OAuth clients, see [OAuth Connections](https://help.tableau.com/v0.0/online/en-us/protected_auth.htm#custom_oauth). 1. Sign in to Tableau Server and navigate to your My Account Settings page. 2. Under Saved Credentials for Data Sources, do the following: 1. Click Delete next to the saved credentials for a connector. 2. Next to the same connector, click Add and follow the prompts to 1) connect to the custom OAuth client that your site admin notified you about and 2) save the latest credentials. ## Clear all saved credentials When you select Clear All Saved Credentials, the following items are removed from your user account: - All saved credentials for connections that are stored in your account. **Caution:** If any of these saved credentials are stored with published workbooks or data sources, deleting them also removes access to the data source from those locations. Effectively, this is like "changing the locks" anywhere the affected saved credentials are used. - Passwords you’ve used to access published data extracts or workbooks that connect to them. ## Remove saved credentials To remove Tableau access to data, delete the associated saved credentials for that data from your account. After you delete the credentials, you’ll need to sign in to the data the next time you access it. This creates new saved credentials. Your administrator might choose for all users to use the same shared credentials for connecting to a data source. If this is the case, the saved credential is associated with the data connection for all users, and it doesn’t appear under Saved Credentials on your Account Settings page. **Note:** If you're a Tableau Server user and can't delete saved credentials, ask your administrator if they've cleared the Allow users to save data source access tokens option in the server settings. [Skip to main content](#main-content) # Manage Dashboard and Viz Extensions in Tableau Cloud Tableau Extensions are web applications that can help extend the analytics delivered in a Tableau workbook. Extensions integrate seamlessly to interact with the rest of the Tableau workbook, using the [Tableau Extensions API](https://tableau.github.io/extensions-api). Dashboard extensions run in custom dashboard zones and can interact with the rest of the dashboard. Dashboard extensions give users the ability to interact with other applications directly in Tableau. Viz extensions run in worksheets and give users the ability to use custom viz types. Tableau users access dashboard extensions as dashboard objects and access viz extensions through the worksheet Marks card. **Note:** Site administrator can add dashboard and viz extensions to the safe list and to control the type of data the extensions can access. The site administrator can also configure whether users on the site see prompts when they add or view extensions. For information about extension security and recommended deployment options, see [Extension Security - Best Practices for Deployment](https://help.tableau.com/current/server/en-us/security_extensions.htm). For information about using dashboard extensions in Tableau, see [Use Dashboard Extensions](https://help.tableau.com/current/pro/desktop/en-us/dashboard_extensions.htm). For information about using viz extensions, see [Add Viz Extensions to Your Worksheet](https://help.tableau.com/v0.0/pro/desktop/en-us/viz_extensions.htm). Looking for Tableau Server? See [Manage Dashboard Extensions in Tableau Server.](https://help.tableau.com/current/server/en-us/dashboard_extensions_server.htm "Opens topic in a new browser tab") ## Before you run extensions on Tableau Cloud Extensions are an open platform, but in general there are two standards to consider: - Tableau Trusted extensions, which are extensions that have been specifically reviewed and deployed on Tableau managed hosts. These extensions include solutions built and managed by Tableau; solutions built by Tableau Exchange Partners that deploy with Tableau review and host service, and solutions hosted in the protected environment of our legacy Sandboxed extensions. - Network-enabled extensions, which are extensions that are hosted on any third-party host. Network-enabled extensions can be useful when developers choose to manage the delivery of their extensions without the involvement of Tableau. This includes extensions that partners manage directly to provide better production support; extensions that are hosted and deployed within your own local network, or extensions that require communication with third-party services outside of Tableau. Network-enabled extensions have full access to the web. **Note:** Tableau supports integration with Salesforce Einstein Discovery through the Einstein Discovery Dashboard extension. This is a special extension that has access to data in Salesforce.com and is allowed by default. It is not considered a Network-enabled extension or a Sandboxed extension. For more information on Einstein Discovery integration, see [Configure Einstein Discovery Integration](https://help.tableau.com/v0.0/online/en-us/config_einstein_extensions.htm#2021-1-einstein-predictions). ### Tableau Trusted extensions Starting in 2025.3, Tableau Trusted extensions represent the subset of extensions from Tableau Exchange that have been elevated for use. Trusted extensions are hosted on Tableau hosts and are required to limit communication between user clients and Tableau. These extensions have been tested for network communications and scanned for vulnerabilities before deployment. This extension standard is used to deliver a more governed access to extensions. This standard includes: - Sandboxed extensions are hosted by Tableau and employ W3C standards, such as Content Security Policy (CSP), to ensure the extension can't make network calls outside of the Tableau Sandbox host. A Sandboxed extension can query data, but the sandbox environment explicitly blocks communicating that data elsewhere. Sandboxed Extensions are supported in Tableau 2019.4 and later. By default, Sandboxed extensions are allowed to run if extensions are enabled for the site. - Tableau-built extensions are solutions developed and actively maintained by the Tableau development team. Tableau-built extensions are explicitly designed to direct communications toward the user client, rather than to query user data out. By design, this limits the risk of data exfiltration and data retention. Tableau Built Extensions also undergo Salesforce Software Development Life Cycle (SDLC) standards. By default, Tableau-built extensions are allowed to run if extensions are enabled for the site. - Tableau Trusted partner-built extensions are solutions developed and actively maintained by accredited Tableau and Salesforce Partners that contribute to Tableau Exchange. Tableau developers validate these third-party solutions through manual testing before they are deployed as Tableau Trusted extensions. Tableau developers conduct functional and network communication testing, and automated code scans of the extensions before they are deployed to a dedicated Tableau host. Tableau Trusted partner-built extensions can be enabled for use by your Tableau administrator. ### Network-enabled extensions Network-enabled extensions are web applications and could be running on any computer set up as a web server. This includes local computers, computers in your domain, and third-party web services. Because Network-enabled extensions could be hosted on third-party servers and could have access to the data in the workbook, you want to only allow the extensions you trust. See [Test Network-enabled extensions for security](#Test). ### Default Extensions Settings Administrators can use the settings for extensions on Tableau Cloud to control and limit the extensions that are allowed to run. - By default, extensions are enabled to run unless explicitly disabled. This can be disabled for any given site by the Site Administrator. - We recommend allowing the use of Tableau Trusted extensions. By default, Sandboxed extension and Tableau-built extensions are enabled to run if extensions are enabled for the site; Tableau Trusted partner-built extensions can be enabled by Administrator. - By default, no Network-enabled extensions are allowed unless they've been explicitly added to the safe list. Only extensions that use the HTTPS protocol are allowed, which guarantees an encrypted channel for sending and receiving data (the only exception is for `http://localhost`). Some extensions require full data permissions (access to the underlying data). These extensions can't run on Tableau Cloud unless you explicitly add the extension to the safe list and grant the extension access to full data. ## Control extensions use Site administrators can control whether to enable extensions for the site and whether to allow Tableau-Trusted extensions on the site. The default site settings allow Sandboxed extensions and Tableau-trusted extensions to run on the site, provided the extension is not specifically blocked on the server. The default site settings allow Network-enabled extensions to run when registered on the safe list for the site. Any extensions can be explicitly added to the safe list, which then enables that extension for use on the site. 1. To change these settings for the site, go to Settings > Extensions. 2. Under Dashboard and Viz Extensions, configure these options: - Allow extensions to run on this site - Allow Trusted extensions to run on this site Site administrators can add or remove extensions from the safe list for a site. When you add an extension to the safe list, you can configure permissions that allow the extension to have access (if needed) to full data. See [Add extensions to the safe list and configure the extension](#Add). ## Using the safe list Use the safe list to allow specific extensions to run on a site. The safe list is used primarily for Network-enabled extensions. Unlike Tableau-Trusted extensions, which are served from known Tableau hosts and allowed to run by default, Network-enabled extensions are not allowed unless they have been explicitly added to the safe list. The safe list also lets you control whether users are asked to grant permission to allow the extension to run and whether the extension has access to full data (underlying data) in the workbook. By default, Tableau-Trusted extensions are allowed to run, which includes Sandboxed and Tableau-built extensions. You do not need to add them to the safe list unless the default settings have changed and they are no longer allowed. The same holds true for Tableau trusted partner-built extensions, if they are allowed you do not need to explicitly add them to the safe list. ### Identifying the URL of an extension As a web application, an extension is associated with a URL. You can use this URL to test and verify the extension. You also use the URL to add the extension to the safe list to allow full data access, or to the block list to prohibit any access. To allow Network-enabled extensions or other extensions, you need to find the URL of the extension and then add the URL to the safe list. By adding the URL to the safe list you are approving communication with the web application. There are several ways to determine the URL of the extension. #### From Tableau Exchange When you use an extension that you've downloaded from the Tableau Exchange, you can find the URL for the extension on the Exchange listing page. Open the tile for the extension, under Tech Specifications, look for the URL under the heading, Hosted at. ![A Tableau Exchange tile for an extension showing where to find the hosted at URL](/tableau/next/en-us/online/en-us/Img/gallery_ext_url_350x187.png) #### From the manifest file If you have the extension manifest file (`.trex`), an XML file that defines properties for the extension, you can find the URL from the `` element. You can retrieve the manifest file if you download the extension from Tableau Exchange using your web browser. Open the manifest file in a text editor. ``` https://www.example.com/myExtension.html ``` #### Identifying a dashboard extension using the About dialog box For dashboard extensions, you can find the URL from the extension properties found in the dashboard extension context menu. From the More Options menu, click About. ![A context menu with options including About, Reload, Debug Options, Floating, Fix Width, Edit Width, Select Layout Container, Deselect, and Remove from Dashboard.](/tableau/next/en-us/online/en-us/Img/about_extension_menu_224x217.png) The About dialog box lists the name of the extension, the author, the web site of the author, and the URL of the extension. ![A dialog box with details on the data source sample extension, such as its URL, version number, and instance ID.](/tableau/next/en-us/online/en-us/Img/about_extension_url_281x209.png) ### Add extensions to the safe list and configure the extension To allow users to access to Network-enabled extensions, add the extension to the safe list for the site. By default, when you add an extension to the safe list, the extension only has access to the summary (or aggregated) data. You can also control whether users see a prompt asking them to allow the extension access to data. You might want to add an extension to the safe list (for example, a Sandboxed extension) so that you can configure whether users see the prompts. When you hide the prompt from users, the extension can run immediately. 1. Go to Settings > Extensions. 2. Under Enable Specific Extensions, add the URL of the extension. See [Identifying the URL of an extension](#Identify). **Tip:** You can use a period and asterisk (`.*`) as a wildcard in the URL to allow all extensions in a certain domain or location. For example, to allow all extensions in the domain under example.com that use port 8080, you would add the URL: `https://example.com:8080/.*` . For more information, see [Using regular expressions in the safe list URL](#RegEx). 3. Choose to Allow or Deny the extension Full Data Access. Full data access is access to the underlying data in the view, not just the summary or aggregated data. Full data access also includes information about the data sources, such as the names of the connection, fields, and tables. Usually, if you are adding an extension you want to use to the safe list, you also want to allow the extension to have access to full data, if the extension requires it. Before adding extensions to the safe list, be sure to [Test Network-enabled extensions for security](#Test). 4. Choose to Show or Hide the User Prompts. Users see the prompts by default when they are adding a dashboard extension to a dashboard, or a viz extension to a worksheet, or when they are interacting with a view that has an extension. The prompt tells users details about the extension and whether the extension has access to full data. The prompt gives users the ability to allow or deny the extension from running. You can hide this prompt from users, allowing the extension to run immediately. ### Make sure that the extension has permissions to access the workbook or view A dashboard or viz extension requires access to the visible data in the view. The visible data is summary aggregated data presented in a worksheet or dashboard. Make sure the workbook or view allows permission to Download Summary Data. The extension doesn't download the data. The extension just requires permission so it can interact with the data in the view. ### Using regular expressions in the safe list URL In general, when you add an extension to the safe list, you should use the specific URL of the extension. However, there are times when you might want to allow multiple extensions that are hosted from the same domain and location. In this case, it's convenient to use a wildcard in the URL. The extension settings support the use of regular expressions.

Regular expression	Description
`.`	A period (.) is a wildcard you can use to match any character. If you need to specify a period (.) in the URL instead of a wildcard, you can escape the character with a backslash (`\.`).
`*`	An asterisk (*) is a quantifier that specifies one or more instances of the previous character.

Use care if you use wildcards so that you don't make the safe list too permissive, and inadvertently allow access to extensions that shouldn't have access. The following table shows some examples of using regular expressions in the URL. Note that these examples do not show the protocol and the full URL of the extension. Only extensions that use the HTTPS protocol are allowed (with the exception of http://localhost).

To specify...	Example	Specifies
Range of domains	.*\.example.com	All subdomains under example.com.
All ports	example.com:.*	Extensions are allowed access from all ports on example.com.
All extensions under domain, port, and path	example.com:8080/xyz/.*	All extensions under the domain example.com that use port 8080 and are located in zyz, are allowed access.
All ports for a range of domains	.\.example.com:.	Allows access to extensions on all ports on all subdomains under example.com.
All extensions under a domain and path that match the pattern	example.com/t.c/.*	Allows access to extensions running on example.com under folders that match the pattern t.c. For example, tic, tac, toc.

## Test Network-enabled extensions for security Extensions are web applications that interact with data in Tableau using the Extensions API. If you choose to allow Network-enabled extensions that are not directly reviewed and managed by Tableau, users should be aware that these extensions could make network calls and have access to resources on the Internet. Tableau recommends testing and understanding Network-enabled extensions before they are rolled out for broad adoption. ### Examine the source files Extensions include various HTML, CSS, and JavaScript files, and an XML manifest file (\*.trex) that defines the properties in the extension. When reviewing a network-enabled extension, we recommend contacting the extension developer directly for access and permission to review. Tableau does not distribute or provide access to other developer's source files. If the code for an extension is publicly available on GitHub, it can be examined there or downloaded. In the manifest file (`*.trex`), you can find the source location, or URL indicating where the extension is hosted, the name of the author, and the web site of the author or company to contact for support. The `` element specifies the URL, the `` element, specifies the name of the organization and the web site to contact for support (`website="SUPPORT_URL"`). The web site is the Get Support link user see in the About dialog box for the dashboard extension. Extensions reference external JavaScript libraries, such as the jQuery library or API libraries for third parties. Validate that the URL for external libraries points to a trusted location for the library. For example, if the extension references the jQuery library, make sure that the library is on a site that is considered standard and safe. All extensions are required to use the HTTPS protocol (`https://`) for hosting their extensions. You should examine the source files for the extension to ensure that any reference to external libraries is also using HTTPS or is hosted on the same web site as the extension. The one exception to the requirement of HTTPS is if the extension is hosted on the same computer as Tableau (`http://localhost`). To the extent possible, make sure you understand what the code is doing. In particular, try to understand how the code is constructing requests to external sites, and what information is being sent in the request. In particular, check if any user-supplied data is validated to prevent cross-site scripting. ### Understand data access Tableau extensions primarily work with the summary aggregated data presented in a worksheet or dashboard. However, the Tableau Extensions API provides methods that can access the underlying data when the extension declares it needs full data access. These methods can access the names of the active tables and fields in the data source, the summary descriptions of the data source connections, and the underlying data in a worksheet. If an extension uses any of these methods in a view, the extension developer must declare that the extension requires full data permission in the manifest file (`.trex`). The declaration looks like the following. ``` full data ``` Tableau uses this declaration to provide a prompt to users at run time that gives them the option of allowing this access. If the extension uses any one of these methods, without declaring full data permission in the manifest file, the extension loads but the method calls fail. For information about how an extension accesses data from the dashboard, and the JavaScript methods used, see [Accessing Underlying Data](https://tableau.github.io/extensions-api/docs/security/trex_data_access) in the Tableau Extensions API. To get a better understanding about what the extension can find out about the data, you can use the [DataSources](https://github.com/tableau/extensions-api/tree/master/Samples/Dashboard/DataSources) sample dashboard extension (available from the [Tableau Extensions API GitHub repository](https://github.com/tableau/extensions-api)) to see what data is exposed when the `getDataSourcesAsync()` method is called. ### Test the extension in an isolated environment If possible, Tableau recommends testing the extension in an environment that is isolated from your production environment and from user computers. For example, add a dashboard or viz extension to a safe list on a test computer or virtual machine that's running a version of Tableau Cloud that is not used for production. ### Monitor traffic created by the dashboard extension To assess potential network calls used by a Network-enabled extension, use web debugging tools like [Fiddler](http://www.telerik.com/fiddler), [Charles HTTP proxy](http://www.charlesproxy.com/), or [Wireshark](https://www.wireshark.org/) to examine the requests and responses that the extension makes. Make sure that you understand what content the extension is requesting. Examine the traffic to be sure that the extension is not reading data or code that is not directly related to the purpose of the extension. [Skip to main content](#main-content) # Manage Data After you configure your Tableau Cloud site with your logo and authentication options, you can start organizing the _content_ framework for the way you and your users want to share Tableau data. To populate your Tableau Cloud site with content (data, reports, and so on), you or the data professionals in your organization _publish_ that content. Depending on the type of license, users can connect to and publish content from Tableau Desktop, or from the Tableau Cloud web editing environment. Types of content you can publish include standalone data sources that users can share among multiple workbooks, and workbooks that contain _embedded_ data connections with visualizations based on that data. Each of these types has pros and cons, which are explained in the [Publishing resources](#publishing-resources-user-help-links) below. ## Determine your organization’s publishing needs As the site administrator, before you open the site for publishing, evaluate how much preparation you think is appropriate for your level of Tableau Cloud use: - If you don’t have strict requirements around data access—for example, you have just a few users who all share the same data—you might dive in to the [Publishing resources](#publishing-resources-user-help-links), starting with publishing steps, and adjust your publishing and content management practices as you go. - If people use Tableau across distinct areas of your organization, or if you have a large Tableau user population, we recommend using the [Publishing resources](#publishing-resources-user-help-links) to create a test environment, and working out access and discoverability wrinkles. You can still adjust practices as you go, but it’s not as easy to do this after you open up the site to a large group of active users. Examples of additional factors you might need to consider are authorization (permissions for who gets access to what), data security and compliance requirements, minimizing users’ need to contact you for help if they can’t figure out where to publish or find their data, and so on. For more information, see [Configure Projects, Groups, Group Sets, and Permissions for Managed Self-Service](https://help.tableau.com/v0.0/online/en-us/projects_data_gov.htm). ### Summary of the publishing process In Tableau Desktop, you open the workbook or data connection you want to upload to Tableau Cloud, and go to the Server menu to publish it. During the publishing steps, you sign in to Tableau Cloud, entering the Tableau Cloud address (https://online.tableau.com) and your credentials. The publishing steps require you to make decisions related to how you and others in your organization will access your data source or workbook. In some cases, this can involve a few layers of complexity, and it helps for you to understand how these layers fit together. Use the topics in the following lists to determine the level of complexity you need and to help establish appropriate publishing guidelines. ### Publishing resources These resources are part of the Tableau User Help and open in a new browser window. - **Publishing concepts** [Prepare for Publishing a Workbook](https://help.tableau.com/current/pro/desktop/en-us/publish_workbooks_prepare.htm) [Publish Data Sources and Workbooks](https://help.tableau.com/current/pro/desktop/en-us/publish_overview.htm) [Best Practices for Published Data Sources](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources_about.htm) - **Basic publishing steps for informal collaboration** [Simple Steps to Share a Workbook](https://help.tableau.com/current/pro/desktop/en-us/publish_workbooks_share.htm) - Comprehensive data source planning and publishing steps for meeting compliance and security standards, creating a data “source of truth,” and using best practices [Plan the Data Source](https://help.tableau.com/current/pro/desktop/en-us/datasource_plan.htm "Opens linked article in new browser tab") [Publish a Data Source](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources.htm) [Publish a Workbook](https://help.tableau.com/current/pro/desktop/en-us/publish_workbooks_howto.htm) ## Tableau Cloud storage limit A site has a 1 TB storage limit for workbooks and extracts. The storage limit is not configurable. For enterprises that require more storage, Tableau+ or Tableau Enterprise licensing may be a good option For more information, see [Understanding License Models](https://help.tableau.com/v0.0/online/en-us/license_product_keys.htm). For additional technical specifications for Tableau Cloud, see [Technical Specifications](https://www.tableau.com/products/techspecs#online) on the Tableau website. ## Tableau Cloud data connection support You can publish data sources and workbooks using direct (live) or extract connections to your underlying database. You can also publish multi-connection data sources that use either or both types of connection. The database connections defined in the workbook or data source determines how you can publish and keep the data fresh on Tableau Cloud. If you’re familiar with connection types and want a more specific list of data types and their supported connections, see [Keep Data Fresh](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm). Otherwise, read on. ### Connector types that support direct (live) connections to Tableau Cloud When you use live connections, published workbooks and data sources always reflect what is current in the underlying database. Tableau Cloud supports live connections to: - Google BigQuery, Amazon Redshift data, or SQL-based data hosted on a cloud platform; for example, Amazon RDS, Microsoft SQL Azure, or similar service. For direct connections to cloud data, you usually need to add Tableau Cloud to your data provider’s authorized list. - On-premises relational data, such as SQL Server or Oracle, when you use Tableau Bridge to maintain the connection. To learn more about Tableau Bridge, see [Use Tableau Bridge to Keep Data Fresh](https://help.tableau.com/current/online/en-us/qs_refresh_local_data.htm). You can embed database credentials in live connections so all users who have access to the published content can see the underlying data. Or you can require users to provide their own database credentials. In that case, even if they can open the published content on the server, they need to sign in to the underlying database to see it. ### Connector types that support extract connections For any type of data that Tableau can connect to, users can publish extracts with embedded database credentials, and set up recurring refresh schedules. You can create an extract in Tableau Desktop, before you initiate the publishing process, to have finer control over the connection definition. You might do this if you want to publish a sampling of the data, or to set up the ability to refresh incrementally. Otherwise, Tableau creates the extract during publishing, and you can do full refreshes only. After Tableau completes the publishing step, it guides you through the steps for setting up a schedule for refreshing your data. If your Tableau data source or workbook connects to underlying data in the cloud, refreshes are run from Tableau Cloud directly. If the underlying data is on your local network, you use Tableau Bridge. To learn more about Tableau Bridge, see [Use Tableau Bridge to Keep Data Fresh](https://help.tableau.com/current/online/en-us/qs_refresh_local_data.htm). ## Other articles in this section [Skip to main content](#main-content) # Manage Data Connect As of September 2025, Tableau Data Connect is no longer available for new deployments. We recommend that existing customers migrate their Data Connect deployment to [Private Connect](https://help.tableau.com/current/online/en-us/private_connect_migrate_from_bridge.htm) or [Tableau Bridge](https://help.tableau.com/current/online/en-us/data_fresh_sync_section.htm). Data Connect will be retired in the future. Data Connect operates as a shared responsibility model. With this model, customers supply the physical or virtual compute resources, and Tableau hosts and manages the Data Connect Kubernetes cluster on those resources. Tableau reduces the overhead of administration by remotely managing, monitoring, and maintaining the Kubernetes cluster. In this model, Tableau is responsible for operating the Data Connect service securely and customers are responsible for managing the infrastructure and networking layers. ![](/tableau/next/en-us/online/en-us/Img/data_connect-security_616x420.png) ## Managing Data Connect nodes As a part of the shared responsibility model, Tableau manages troubleshooting the health of Bridge clients that are deployed on Data Connect nodes. You are responsible for the health of the nodes themselves, keeping the computers up-to-date and healthy and managing network connectivity. To support managing Data Connect nodes, Tableau will provide alerts in Tableau Cloud when node action is required. ### Node licenses Data Connect is licensed by the node and is available for purchase by customers who are on the Tableau Cloud Enterprise or Tableau+ editions. Nodes can only be added to a single cluster at a time. Learn more at [About Data Connect](https://help.tableau.com/v0.0/online/en-us/data_connect_about_overview.htm). Node licenses are shared across all sites on a Tableau Cloud Manager tenant. This allows you to share clusters across different sites without having to pay for separate node licenses. If you see that Data Connect node licenses are consumed before you have set up a cluster, this means that another site on your tenant has already set up Data Connect nodes. Consider sharing Data Connect nodes with other sites on your tenant to reduce overall costs. ### Monitoring node health In the case where a node becomes unhealthy or loses connectivity with Tableau Cloud, details will be provided to Tableau Cloud site admins. Node utilization percentages are provided for near real-time monitoring of your deployment. Values provided are refreshed every 15 seconds and will display updated values when you refresh your browser. When node computers surpass 90% CPU utilization or 80% memory load, alerts will surface within the Tableau Cloud user experience. For more information on troubleshooting node issues, see [Troubleshooting service initialization and health](#Troubles). ### Adding and removing nodes from a cluster Nodes can be added and removed from clusters to accommodate different usage patterns. However they are intended to serve a single cluster at a time and are not intended for dynamically changing between Clusters. To add or remove a node, you must be a Site Admin on the cluster owner site. See [Add a node from an existing cluster](https://help.tableau.com/v0.0/online/en-us/data_connect_setup.htm#add-node) and [Remove a node from an existing cluster](https://help.tableau.com/v0.0/online/en-us/data_connect_setup.htm#remove-node). ### Managing node capacity As Data Connect workloads grow, you may begin to run into limitations of the existing infrastructure initially provided. There are two ways to expand Data Connect service capacity. The first is to increase the size of the computer you are using for your Data Connect node. The second is to increase the number of nodes you have within a cluster. Increasing CPU on a machine will particularly benefit the throughput of live queries and embedded data source extracts on a node. Increasing memory will particularly benefit the performance of published data source extracts on a node. Increasing the number of nodes within a cluster will increase the throughput of the system overall. For more information about capacity planning, download the whitepaper, [Accessing Your Private Network Data with Tableau Cloud](https://www.tableau.com/learn/whitepapers/tableau-bridge-data-connect-best-practices-guide). ### Making changes to existing nodes While Data Connect is actively deployed you may need to make operational changes to your node infrastructure. This can include adding memory or CPU to your infrastructure, rotating a node new machine or performing maintenance on a node. Changing the node identity (hostname or IP address) or otherwise impacting network availability will result in downtime of the Data Connect node. If you are changing the node identity (hostname or IP address), you will need to take additional steps to delete the node within Tableau Cloud prior to making your changes and then onboard that node as a new node after the changes are complete. **Example Scenario #1: Add resources to an existing computer without requiring restart** Some cloud providers allow you to add resources to an existing machine (CPU/memory) without restarting the computer. In this scenario, no Data Connect changes are required and the service will utilize the additional resources without requiring Data Connect action. **Example Scenario #2: Making changes that require computer restart but do not impact networking or machine identity** Oftentimes computer maintenance or adding resources to an existing computer (CPU/memory) will require a restart of the computer itself, but do not impact computer identity or networking. In these cases, the node requiring a restart will become disconnected from Tableau Cloud during its restart. After it restarts, it will also need to start the Data Connect service on the computer. After this process is complete (typically less than 1 hour), the node will show as "Available" within Tableau Cloud. There should be no other action required to enable Data Connect. If you unexpectedly change the computer identity, please see Example Scenario #3. If you unexpectedly impact networking of the computer during maintenance, see [Troubleshooting service initialization and health](#Troubles). **Example Scenario #3: Making changes that require a change to node identity (hostname or IP address)** In this scenario, you must first disconnect the node from Tableau Cloud by deleting the node before making any changes. After the node is disconnected, conduct the required maintenance, and add the node back to the cluster. **Example Scenario #4: Making changes that impact networking** This scenario is most common if another team at your organization or a third party hosts the computer for you. If they conduct maintenance on the computer and it impacts the computer's networking, then the node will become unavailable within Tableau Cloud. To resolve this issue you will need to resolve the networking issue, and in some cases, restart the computer. For more details on the appropriate networking configurations, see [Troubleshooting service initialization and health](#Troubles). ## Sharing Data Connect clusters Data Connect clusters and their corresponding nodes can be used by all sites on a Tableau Cloud tenant (Tableau Cloud Manager). Sharing infrastructure reduces the cost of running Data Connect across your Tableau Cloud deployment. Sharing clusters allows queries on different sites within the tenant to use the same node infrastructure. After a cluster has been shared, site admins on the shared sites will be responsible for setting up the pools in their site. After the pools have been established, queries on the site will begin to use Data Connect for queries sent to the domains specified in the pools. See [(Optional) Step 4: Share clusters across sites](https://help.tableau.com/v0.0/online/en-us/data_connect_setup.htm#\(Optiona). ### Roles and responsibilities for shared clusters Cluster owners and cluster recipients work together to manage shared clusters. #### Cluster owners The site admins of the site that originally configured the Data Connect cluster are referred to as the _cluster owners_. Cluster owners are responsible for ensuring the health of the Data Connect nodes on behalf of all sites that use the cluster. Cluster owners are also responsible for configuring the pools on the site that owns the cluster, as well as monitoring the health of individual queries of that site. However, configuring pools and monitoring the health of individual queries on all other sites will be the responsibility of the sites those pools are configured on. #### Cluster recipients The site admins of the sites who did not originally configure the Data Connect cluster are referred to as the _cluster recipients_. Cluster recipients do not have visibility into node health and are unable to take action on node health from their site. Cluster recipient site admins are only responsible for establishing pools and monitoring individual query health. Any communication about node health for cross-site purposes must take place outside of Tableau Cloud. #### Shared cluster responsibility summary

Responsibility	Cluster owner	Cluster recipient
Setup	Cluster setup Networking configuration Install drivers for all sites Add base images for all recipient sites	Provide pool ID and driver requirements to cluster owner
Enable	Share the cluster
Pool configuration	Managed by site admins on owning site	Managed by site admins on receiving site
Monitoring	Cluster owner monitors Data Connect health at cluster level
Refresh tokens (90 days)	Refresh on own site	Refresh on own site
Refresh base image Notes: Traffic will be suspended until the pods come back to running state. If you are running Data Connect with an older Bridge client version and if the base image version has been upgraded by our team in the Cloud, then next you refresh the base image, the upgraded Bridge client versions will be picked up.	Refresh on own site	Refresh on own site
Query health	Monitors on own site	Monitors on own site

## Troubleshooting service initialization and health Data Connect uses a shared responsibility model to deploy Tableau Bridge within your environment and keep private network data up-to-date. This troubleshooting section covers issues that may arise while setting up Data Connect and issues that cause existing clusters and nodes to become unavailable. ![](/tableau/next/en-us/online/en-us/Img/data_connect_setup_526x514.png) If you experience initiation issues, verify the following connectivity and access: - Data Connect infrastructure, cluster, and container require networking access to the orchestration provider services (#2 in the image above) and to Tableau Cloud (outbound only, #5). - Data Connect infrastructure, cluster, container, and Agent require networking access to your database (#6). See [Networking specifications](https://help.tableau.com/v0.0/online/en-us/data_connect_get_started.htm#Networki). ## Monitoring Data Connect query health Data Connect deploys and manages Bridge clients. Individual Bridge clients are responsible for the queries sent to your private network data. To learn more, see [Architecture](https://help.tableau.com/v0.0/online/en-us/data_connect_about_overview.htm#Architec). There are several monitoring solutions available in Tableau Cloud to help you manage different monitoring scenarios for individual queries handled by Data Connect. All of these solutions are available to all admins. Admins can make Admin Insights and Activity Log available to non-admin users. **Real-time monitoring** - Jobs page: Monitor real-time extract job status for jobs performed in the last 24 hours. See [Managing Background Jobs in Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/server_backgrounder_job_management.htm). - Admin views: Monitor real-time extract job status and performance. Includes recent job history for longer term analysis. See [Find Admin Views](https://help.tableau.com/v0.0/online/en-us/adminview.htm). **Historical analysis** - Admin Insights: Monitor job status and performance using Tableau Cloud data sources that are published in your environment. This data is updated daily and shows historical data for longer term analysis. It can be shared with non-admin users if desired. See [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). - Activity Log: Monitor job status and performance using log data that can be stored as long as necessary for your analysis. This data can be shared with non-admin users if desired. Available for Tableau Cloud Enterprise and Tableau+ customers only. See [Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_overview.htm). Please note that for shared Data Connect clusters, monitoring of Data Connect queries is managed at the site level. Site admins will only be able to monitor queries that use the pools in their site(s). For a full description of monitoring individual jobs through various user scenarios, download the whitepaper, [Accessing Your Private Network Data with Tableau Cloud](https://www.tableau.com/learn/whitepapers/tableau-bridge-data-connect-best-practices-guide). For information related to troubleshooting individual errors, see Troubleshooting Errors from Individual Queries. [Skip to main content](#main-content) # Manage Data Labels Starting in Tableau Cloud October 2023 and Tableau Server 2023.3, if you have a Data Management license and are an administrator, you can use the label manager to create or edit label names and label categories. These customizations affect the way that labels appear throughout Tableau when users interact with labels. Note: You can also use the REST API's labelValues methods and labelCategories methods to create and edit labels and label categories. (Tableau Cloud administrators have been able to create and modify label names and descriptions using the labelValues methods since Tableau Cloud June 2023.) For more information, see the Metadata Methods in the [REST API Reference](https://help.tableau.com/v0.0/api/rest_api/en-us/REST/rest_api_ref_metadata.htm). ## Label Manager To use the label manager, log in as an administrator and select Data Labels from the left navigation pane. ![Using the Data Labels menu item to reach the Data Labels page](/tableau/next/en-us/online/en-us/Img/dm_label_manager_data_labels_menu_item.png) Alternatively, if you're logged in as an administrator and you open the Data Labels dialog to label an asset, a Manage labels link shows in the lower-left corner. The Manage labels link leads to the Data Labels page. (In Tableau Server 2023.3 and earlier, the Manage labels link shows in the label selection dropdowns of the individual certification, data quality warning, sensitivity label, and custom label dialogs instead.) ![Using the Manage labels link to reach the Data Labels page](/tableau/next/en-us/online/en-us/Img/dm_label_manager_alt_entry_point_248.png) The label manager page shows a row for each label, sorted by label category. Each row includes the label category, name (here known as the value), an Actions menu (...) to perform actions on that label, visibility, and description. ![The Data Labels page and list of labels](/tableau/next/en-us/online/en-us/Img/dm_label_manager_label_list_246.png) Use the label manager to: - **Edit built-in labels** - Example: You change the name of the built-in "Under maintenance" quality warning to "Maintenance mode". - Example: You change the visibility of extract refresh monitoring labels from standard visibility to high visibility so that they show in views. - **Create new labels for the existing, built-in categories** - Example: You add a new sensitivity label called "Confidential". - **Revert a built-in label to its default name, description, and visibility** - Example: You previously changed the "Stale data" quality warning name to "Outdated", and you want to revert it to its default name. - **Create custom categories** - Example: You create a new label category called "Department" with the intention of adding labels for different business units. - **Create new labels in custom categories** - Example: You create new "Sales", "Service", and "Operations" labels for your newly created "Department" category. ## Properties of Data Labels A label has a name, a category, and a description. Labels with a Quality Warning or Sensitivity category also have a visibility level. ### Name The label name is the common name for the label as it appears in various places. For example, here the label name "Deprecated" is selected in the Quality Warning tab of the Data Labels dialog. ![Label name in Data Quality Warning dialog](/tableau/next/en-us/online/en-us/Img/dm_label_value_name.png) Here the label name "Warning" shows at the top of the "Batters" table page, and again in the label details. ![Label name at the top of table page](/tableau/next/en-us/online/en-us/Img/dm_label_value_name_on_sticker.png) ### Category The label category affects where and how the label appears, whether it appears on assets that are downstream from the one it's attached to, and which parts are customizable, among other things. For example, quality warnings and sensitivity labels appear on downstream assets, but other labels with other categories don't. Another example: You can change the description of a certification label, but not the name. The built-in categories are certification, quality warning, and sensitivity. For custom categories, users see the category name in the vertical category tabs of the Data Labels dialog, among other places. For example, here the category name "Department" appears in the vertical category tabs, the top of the label name list, and other places. ![Category selection in More Data Labels dialog](/tableau/next/en-us/online/en-us/Img/dm_label_category_in_data_labels_dialog_248.png) ### Description The label description appears in various places, including in the Data Labels dialog, and helps the user understand what the label is used for. For example, the label description for this quality warning says "This asset is no longer maintained and shouldn't be used." ![Label description in Data Quality Warning dialog](/tableau/next/en-us/online/en-us/Img/dm_label_value_description.png) ### Visibility The visibility of a label determines its appearance. High-visibility labels appear in more places and may appear more urgent to the user. You can only set the visibility level on Quality Warning or Sensitivity labels. Furthermore, if a label has a category of Quality Warning, users with permissions can override the default visibility on each asset that they attach a Quality Warning label to. For more information, see the [Set a Data Quality Warning](https://help.tableau.com/v0.0/online/en-us/dm_dqw.htm#high_visibility) and [Sensitivity Labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_sensitivity.htm#visibility) topics. ## Create a data label To create a label: 1. From the Data Labels page, select New Label. 2. Select a category from the Label category dropdown. 3. Enter the label name in the Label value field. 4. Enter the label description in the Label description field. You can format the text with bold, underline, and italics, and include a link or an image. To see text formatting tips, hover over the information (i) icon above the Save button. 5. If the label has a category of Quality Warning or Sensitivity, set the visibility level. For more information, see [Visibility](#Visibility). 6. Select Save. ![New Label dialog](/tableau/next/en-us/online/en-us/Img/dm_label_manager_new_label_248.png) ### Limitations for creating labels - You can't create a label in the certification category. The certification category allows only the single, built-in label. - You can't create new monitoring warnings. However, the extract refresh failure warning and flow run failure warning can be edited in limited ways, as described in the "Edit a label" section. - The maximum length for a label name is 128 characters in Tableau Cloud and Tableau Server 2024.2 and later. The maximum length for a label name is 24 characters in Tableau Server 2023.3 and earlier. - The maximum length for a label description is 500 characters. ## Edit a data label To edit an existing label: 1. From the Data Labels page, select the Actions (...) menu in the label's row. Or select the row using its checkbox on the left and click the Actions dropdown at the top of the label list. 2. Select Edit. 3. (Optional) Change the label name using the Label value field. 4. (Optional) Change the label description using the Label description field. 5. (Optional) If the label has a category of Quality Warning or Sensitivity, set the visibility level. For more information, see [Visibility](#Visibility). 6. Select Save. ### Limitations for editing labels - You can't change the category on an existing label. - The maximum length for a label name is 128 characters in Tableau Cloud and Tableau Server 2024.2 and later. The maximum length for a label name is 24 characters in Tableau Server 2023.3 and earlier. - The maximum length for a label description is 500 characters. The different label categories allow different degrees of label editing. The following table lists the editable properties of labels with the given categories:

Label category	Can edit label category	Can edit label names	Can edit label descriptions	Can edit label visibility
Certification	No	No	Yes	N/A
Quality Warning	No	Yes¹	Yes	Yes²
Sensitivity	No	Yes	Yes	Yes
Custom	No	Yes	Yes	N/A

1 _You can't edit the label name (label value) of the extract refresh or flow run monitoring warnings._ 2 _The visibility level you set for quality warnings is the default visibility. Users with permission can override the default visibility when they attach a quality warning to an asset. For more information, see_ [Visibility](#Visibility)_._ ## Delete a data label To delete an existing label: 1. From the Data Labels page, select the Actions (...) menu in the label's row. Or select the row using its checkbox on the left and click the Actions dropdown at the top of the label list. 2. Select Delete. ### Limitations for deleting labels - You can't delete a built-in label. Built-in labels are the default labels in Tableau Cloud. ## Revert a built-in data label to its defaults If an administrator previously edited a built-in label, the Actions menu for that label contains Revert to default label. Reverting a label to its defaults returns the label's name (value), description, and visibility to its built-in defaults. ![Reverting a built-in label to its defaults](/tableau/next/en-us/online/en-us/Img/dm_label_manager_revert_built-in_label_246.png) ## Create a data label category To create a label category: 1. From the Data Labels page, select New Label. 2. In the New Label dialog, select New Category. 3. Enter the category name in the Category name field. 4. Enter the category description in the Category description field. You can format the text with bold, underline, and italics, and include a link or an image. To see text formatting tips, hover over the information (i) icon above the Save button. 5. Select Save. ![Add New Category dialog](/tableau/next/en-us/online/en-us/Img/dm_label_manager_new_category_248.png) ### Limitations for creating label categories - The maximum length for a category name is 128 characters in Tableau Cloud and Tableau Server 2024.2 and later. The maximum length for a category name is 24 characters in Tableau Server 2023.3 and earlier. - The maximum length for a category description is 500 characters. ## Edit a data label category To edit a label category: 1. From the Data Labels page, select the label category, then select the pencil icon. Or from the New Label or Edit Label dialogs, select the category in the Label category dropdown and then select the pencil icon next to Category description. 2. (Optional) Change the category name using the Category name field. 3. (Optional) Change the category description using the Category description field. 4. Select Save. ### Limitations for editing label categories - You can't edit a built-in category. - The maximum length for a category name is 128 characters in Tableau Cloud and Tableau Server 2024.2 and later. The maximum length for a category name is 24 characters in Tableau Server 2023.3 and earlier. - The maximum length for a category description is 500 characters. ## Delete a data label category Currently, there isn't a method to delete a label category through the regular Tableau Cloud interface. To delete a category using the REST API, see the [Delete Label Category method](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_metadata.htm#delete_label_category) in the REST API Reference. ## Scenarios for customization ### Scenario: Customize a built-in data label Suppose you decide that the data quality warning called "Warning" could be more specific. As an administrator, you change the label name from the default ("Warning") to something you think is more useful to your organization: "Not approved". The label name "Not approved" now appears in label dialogs when users are selecting labels. Alternatively, you could change the label description so that the user learns more about the warning in the label dialog. For example: "This asset doesn't meet quality standards required by the marketing department." ### Scenario: Create a custom data label Suppose you want users to have more granular control over classifying the sensitivity of assets. You create two sensitivity labels with the names "Public" and "PII". The custom label names "Public" and "PII" now appear in the label dialog dropdowns and descriptions, alongside the built-in sensitivity label. ### Scenario: Create a new data label category and associated data labels Suppose you need a way to identify the business units that are responsible for assets. You create a label category called "Department". Then you create three labels – "Sales", "Service", and "Operations" – with "Department" as their category. The category "Department" and the three associated labels now appear in the More Data Labels dialog for users to attach to assets. [Skip to main content](#main-content) # Manage Permissions for External Assets Tableau Cloud and Tableau Server provide a space for accessing and managing published content. When Tableau Cloud or Tableau Server is licensed with Data Management, you have access to Tableau Catalog. Tableau Catalog adds a complementary space and a set of features across your site to track and manage metadata and lineage of external assets used by the content published to your site. ## Tableau Catalog indexes content and assets Catalog discovers, tracks, and stores metadata from the content that you publish to Tableau Cloud or Tableau Server. Catalog indexes metadata for the following: - **Tableau content:** Workbooks, data sources, flows, projects, metrics, virtual connections, virtual connection tables, users, and sites. (The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm).) - **External assets:** Databases (including data files) and tables (including table-like objects) that are associated with Tableau content. Catalog classifies the metadata of external assets that come from outside the Tableau environment. External assets can be stored in many different formats, such as a database server or a local .json file. Catalog tracks only the metadata of the external data and does not track the underlying data in any form (raw or aggregated). Catalog metadata includes the following: - **Lineage information** or the relationship between items. For example, the Sales table has a relationship with both the Superstore data source and the Superstore Sample workbook. - **Schema information**. Some examples include: - Table names, column names, and column types. For example, Table A contains Columns A, B, and C, which are types INT, VARCHAR, and VARCHAR. - Database name and server location. For example, Database\_1 is a SQL Server database at http://example.net. - Data source name, and the names and types of the fields the data source contains. For example, Superstore data source has fields AA, BB, and CC. Field CC is a calculated field that refers back to both field AA and field BB. - **User curated, added, or managed information**. For example, item descriptions, certifications, user contacts, data quality warnings, and more. ### How does Tableau Catalog work? Tableau Catalog indexes all content published to Tableau Cloud or Tableau Server to track lineage and schema metadata. For example, the metadata comes from workbooks, packaged workbooks, data sources, and the Tableau Server or Tableau Cloud repository. As part of the indexing process, lineage and schema metadata about external assets (databases, tables, and other objects) used by the published content are also indexed. After Catalog has indexed asset metadata, you can access that metadata using Tableau Cloud or Tableau Server. Indexed metadata can also be accessed from the Tableau Metadata API and the Tableau REST API. For more information on the Metadata API and REST API Metadata Methods, see [Tableau Metadata API](https://help.tableau.com/current/api/metadata_api/en-us/index.html) and [Tableau REST API Metadata Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_metadata.htm). **Note:** Tableau Cloud requires Data Management to access the Tableau Metadata API, but Tableau Server does not. This requirement started with Tableau Cloud October 2026. If you were using the Metadata API without Data Management at that time, you can continue doing so until June 2027. ## Permissions on metadata Permissions control who is allowed to see and manage external assets and what metadata is shown through lineage. ### Accessing metadata The permissions used to access metadata through Catalog (or the Metadata API) work similarly to permissions for accessing content through Tableau Cloud or Tableau Server, with some additional considerations for sensitive data that can be exposed through lineage and the capabilities granted on external assets. #### Permissions for Tableau content Catalog follows the view and manage capabilities that are already in place on existing Tableau content to control the metadata that you can see and manage on Tableau content. For more general information on these capabilities, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#permissioncapabilities). #### Permissions for external assets using _derived permissions_ When Tableau Cloud or Tableau Server is licensed with Data Management, by default Catalog uses _derived permissions_ to automatically grant you capabilities to external assets. Derived permissions are permissions for external assets that are derived from the Tableau Content they're associated with. The View capability: - If you are the owner of a workbook, data source, or flow, you can see the database and table metadata used _directly_ by that workbook, data source, or flow. See [Additional notes about lineage](#addnotes). - If you are a project owner or project leader, you can see all the database and table metadata used by the content published to your project. - Embedded files use the permissions of the source content (such as the workbook, data source, or flow), rather than the derived permissions of the external asset (the database or table). For example, if you can see a workbook with an embedded file, you can see the embedded file and its metadata used by that workbook. The Overwrite and Set Permissions capabilities: - If you are the owner of a flow, you can edit and manage permissions for the database and table metadata used by the flow output. **Note:** In the case of flows, the capabilities mentioned above apply only after the flow has been run successfully at least once under the current owner of the flow. **Check permissions** As an admin or someone who has been given the capability to set permissions for an asset, you can validate who has derived permissions by following the steps below. 1. Sign in to Tableau Cloud or Tableau Server. 2. From the left navigation pane, click External Assets. 3. From the drop-down menu, select Databases and Files or Tables and Objects. **Note:** Local files, like .json or .csv files are grouped as external assets under Databases. 4. Select the check box next to the database or table whose permissions you want to modify, and then select Actions > Permissions. 5. In the Permissions dialog box, click + Add Group/User Rule and start typing to search for a group or user. 6. Validate the permissions by clicking a group name or user name in the permission rules to see the effective permissions below. ![Permissions dialog box showing a user's effective permissions](/tableau/next/en-us/online/en-us/Img/dm_perms_derived.png) **Order of precedence for derived permissions on external assets** When derived permissions are configured for your Tableau Cloud site or Tableau Server, each user's level of access to external assets depends on the associated Tableau content and the order of precedence of rules Tableau uses for its content. Tableau follows the rules below, continuing on to the next rule, only if the current rule evaluates to "denied." If any rule evaluates to "allowed," the capability is allowed and Tableau stops evaluating. This rules list is based on the [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#EvaluatePermRules). For View capability: 1. Admin role 2. License 3. Project leader (Tableau content) 4. Project owner (Tableau content) 5. Content owner (Tableau content) 6. _Derived permissions_ (applies only to external assets and the View capability) 1. Admin role 2. License 3. Project leader (external assets) 4. Project owner (external assets) 5. Content owner (external assets) 7. Explicit permissions For Overwrite and Set Permissions capabilities: 1. Admin role 2. License 3. Project leader (Tableau content) 4. Project owner (Tableau content) 5. Content owner (Tableau content) 6. Explicit permissions (Tableau content) 7. _Derived permissions_ (applies only to external assets and the Overwrite and Set Permissions capabilities for flow outputs) 1. Admin role 2. License 3. Project leader (external assets) 4. Project owner (external assets) 5. Content owner (external assets) **Turn off derived permissions** As an admin, you can turn off the derived permissions default setting for a site in favor of manually granting explicit permissions to databases and tables. 1. Sign in to Tableau Cloud or Tableau Server as an admin. 2. From the left navigation pane, click Settings. 3. On the General tab, under Automatic Access to Metadata about Databases and Tables, clear the Automatically grant authorized users access to metadata about databases and tables check box. **Note:** Data quality warning messages on databases and tables that are visible to users though derived permissions remain visible to those users even when the check box is not selected. ### Set permissions on individual external assets In order to grant additional users permissions to view, edit (overwrite), and manage external assets, an admin can grant those capabilities explicitly on individual databases or tables for users or groups. Starting with Tableau Server 2022.3 and Tableau Cloud September 2022, you can organize external assets in projects. Permissions inheritance for external assets works the same way as it does for Tableau content, as described in the [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#permissionfundamentals) topic, and can simplify permissions management. **Summary of permissions capabilities** The following table shows the capabilities you can set for external assets:

Capability	Description	Template
View	See the database or table asset.	View
Overwrite	Add or edit data quality warnings and descriptions of the database or table asset. Prior to version 2020.1, the Overwrite capability was called Save.	Publish
Move	Move the database or table asset.	Administer
Set Permissions	Grant or deny permissions for the database or table asset.	Administer

**Set permissions on a database or table** To set permissions on databases or tables, use the following procedure. 1. Sign in to Tableau Cloud or Tableau Server as an admin or someone who has been granted the "Set Permissions" capability. 2. Find the database or table. You can do this through Explore (starting with Tableau Server 2022.3 and Tableau Cloud September 2022) if you know the current location of the database or table, or through External Assets to see a list of all databases, tables, and files. - Explore - From the left navigation pane, click Explore and locate the project the database or table is in. - External Assets - From the left navigation pane, click External Assets. From the drop-down menu, select Databases and Files or Tables and Objects (Note: Local files, like .json or .csv files are grouped as external assets under Databases.) 3. Select the check box next to the database or table whose permissions you want to modify, and then select Actions > Permissions. 4. In the Permissions dialog box, click + Add Group/User Rule and start typing to search for a group or user. 5. Select a permission role template to apply an initial set of capability for the group or user, and then click Save. Available templates are: View, Publish, Administer, None, and Denied. 6. To further customize the rule, click a capability in the rule to set it to Allowed or Denied, or leave it unspecified. Click save when you are done. 7. Configure any additional rules you want for other groups or users. 8. Validate the permissions clicking a group name or user name in the permission rules to see the effective permissions below. ![User permissions for adventureworks database](/tableau/next/en-us/online/en-us/Img/dm_perms_set.png) **External assets that are not in projects** There are some scenarios in which an external asset is not in a project: - External assets that Catalog discovered before the External Assets Default Project existed (Tableau Cloud December 2022 / Server 2023.1) will not be in a project unless they've been moved into one since then. - External assets that had their project deleted before the External Assets Default Project existed (Tableau Cloud December 2022 / Server 2023.1) will not be in a project unless they've been moved into one since then. - In Tableau Server 2022.1 and earlier, external assets cannot be moved to projects at all. If an external asset is not in a project, permissions for external assets work as they did in Tableau Server 2022.1 and Tableau Cloud June 2022 and earlier. That is, database and table permissions are controlled independently of content in projects, and table permissions can be managed through database permissions. When permissions are set at the database level in this way, those permissions can serve as a template for any newly discovered and indexed child tables of that database. Furthermore, database permissions can also be locked so that the child tables will always use the permissions set at the database level. Note: You cannot lock (or unlock) permissions to a database if the database is in a project. To lock (or unlock) permissions to the database, use the following procedure: 1. Sign in to Tableau Cloud or Tableau Server as an admin or someone who has been granted the "Set Permissions" capability. 2. From the left navigation pane, click External Assets. By default, the External Assets page shows a list of databases and files. 3. Select the check box next to the database whose permissions you want to lock, select Actions > Permissions, and then click the Table Permissions Edit link . 4. In the Table Permissions in Database dialog box, select Locked and click Save. 5. To unlock permissions, click Edit again, and select Customized. ### Access lineage information Catalog (and the Metadata API) can expose relationship and dependencies metadata, also referred to as _lineage_, among the Tableau content and external assets on Tableau Cloud or Tableau Server. Lineage shows three primary things: - How items relate to each other, either directly or indirectly - How many of those items relate to each other - With the appropriate permissions, shows sensitive data about items in the lineage **Sensitive lineage data** In some cases, lineage can contain sensitive data, such as data quality warning messages, content or asset names, or related items and metadata. By default, complete lineage information displays for all users while its sensitive data is blocked from specific users who don't have the appropriate View capabilities. The concept of blocking sensitive data is called obfuscation. Obfuscation allows all metadata in the lineage to be visible while keeping its sensitive data blocked from specific users who don't have the appropriate View capabilities. This default enables workflows that rely on a complete impact analysis. If obfuscating sensitive data in the lineage is not enough for your organization, certain parts of the lineage, including its sensitive data, can be filtered. Filtering omits certain parts of the lineage (and lineage-related areas like data details) for specific users who don't have the appropriate View capabilities for its sensitive data. Because filtering omits parts of lineage, it prevents workflows that rely on a complete impact analysis. To change how sensitive data is handled, do the following: 1. Sign in to Tableau Cloud or Tableau Server as an admin. 2. From the left navigation pane, click Settings. 3. On the General tab, under Sensitive Lineage Information, select the radio button that best handles lineage information for all users on your Tableau Cloud site or Tableau Server. **Additional notes about lineage** - **If you have the View capability on related assets**, you can see when and what assets and content are related to each other, and their sensitive metadata. For example, you can see 1) the names, data quality warnings, and total number of related upstream databases and tables and 2) the combined number of sheets (visible and hidden) in the lineage of the downstream workbook of the asset you are evaluating. - **If you _don't_ have the View capability on related assets**, you can always see when assets relate to each other. For example, you can see 1) whether related upstream databases and tables exist in the lineage and 2) the total number of databases or total number of tables that are related to the asset you are evaluating. However, you can't see the metadata associated with those assets when you don't have the view capability for them. When metadata is blocked because of limited permissions, or the asset is in a Personal Space, you see Permissions Required. ![Example of an asset where permission is required](/tableau/next/en-us/online/en-us/Img/dm_perms_required_related.png) - **If you _don't_ have the View capability on related assets**, you can always see whether the assets are certified. However, if you don't have View capability, you can't see sensitive information related to the certification, like the names of the related databases and tables. When metadata is blocked because of limited permissions, or the asset is in a Personal Space, you see **Permissions Required**. ![Example of an asset where permission is required](/tableau/next/en-us/online/en-us/Img/dm_perms_required_cert_message.png) For more information about lineage see [Use Lineage for Impact Analysis](https://help.tableau.com/v0.0/online/en-us/dm_lineage.htm). **Additional notes about tags discoverable through lineage data** In addition to Tableau content, external assets can also be tagged. Although tags are always visible, tagged items that you see through lineage data can either be obfuscated (default) or filtered as described earlier in this topic. When tagged items are obfuscated: - **If you have the View capability for tagged items**, you can see the tagged items and related tagged items, and all metadata. - **If you don't have the View capability for tagged items**: - You can see the type of tagged and related tagged items but you can't see sensitive metadata about the items. For example, suppose you use a tag filter to see items with the tag "Noteworthy." Although you can see that there are database items tagged with "Noteworthy," you can't see the names of the tagged databases. - You can see how many related tagged items there are. For example, suppose you do a tag query on "Noteworthy." Your query returns five tagged databases. When tagged items are filtered, the tagged and related tagged items you see are limited to only the items that you have the View capability for. For more information about tags, see [Tagged Items](https://help.tableau.com/current/pro/desktop/en-us/tags.htm) in the Tableau User Help. Potential mismatch between asset results and content results When Catalog shows lineage information, it provides information about Tableau content and external assets. Catalog lineage always shows the true count or result of associated items. However, in other areas of the site, you might see fewer items. This could be because of your View capabilities. Outside of Catalog, you see only the content that your permissions allow. For example, suppose you're looking at the Superstore data source. The lineage for the Superstore data source shows how many upstream underlying tables the data source connects to and how many downstream workbooks rely on the data source. However, because you might not have permissions to see all of those downstream workbooks, the number of related workbooks in the Catalog lineage (actual total) might be greater than the number of workbooks in the Connected Workbooks tab (what you have permission to see). There might be other reasons, unrelated to permissions, why you might see a mismatch between asset counts and content counts. For more information, see [Use Lineage for Impact Analysis](https://help.tableau.com/v0.0/online/en-us/dm_lineage.htm). ## Who can do this The following information summarizes the types of users who can do the tasks described in this topic. Tableau Cloud site or Tableau Server admin

Data Management	Capability	Requirements
Licensed	See assets and their metadata	None
	Edit assets and their metadata	None
	Change permission on assets and their metadata	None
	Grant users ability to see assets and their metadata	Default: When "derived permissions" is on, your users can see metadata on external assets for the content that they own, or for the content that is published to a project that they are a project leader or project owner of. Ad-hoc: You can configure explicit View permissions on a specified external asset.
	Grant users ability to edit assets and their metadata	You can configure explicit "write" or Overwrite permissions on a specified external asset (if not automatically granted because the user is a flow owner).
	Grant users ability to change permissions on assets and their metadata	You can configure explicit "edit" or Set Permissions on a specified external asset (if not automatically granted because the user is a flow owner).
Not licensed	See all assets and their metadata	Requires Data Management Tableau Cloud requires Data Management to access the Metadata API, but Tableau Server does not. This requirement started with Tableau Cloud October 2026. If you were using the Metadata API without Data Management at that time, you can continue doing so until June 2027.
	Edit assets and their metadata	Requires Data Management
	Change permission on assets and their metadata
	Grant users ability to see assets and their metadata
	Grant users ability to edit assets and their metadata
	Grant users ability to change permissions on assets and their metadata

User with Creator or Explorer license

Data Management	Capability	Requirements
Licensed	See assets and their metadata	Default: When "derived permissions" is enabled by your Tableau Cloud site admin or Tableau Server admin, you can see metadata on external assets for the content that you own, or for the content that is published to a project that you are a project leader or project owner of. Ad-hoc: You can see metadata on external assets that you have been granted explicit View permissions to.
	Edit assets and their metadata	You can edit metadata on an external asset that you have been granted explicit "write" or Overwrite permissions to (if not automatically granted because the user is a flow owner).
	Change permissions on assets and their metadata	You can change permissions on an external asset that you have been granted explicit "edit" or Set Permissions to (if not automatically granted because the user is a flow owner).
	Grant other users permissions to see assets and their metadata	You can change permissions on an external asset that you have been granted explicit "edit" or Set Permissions to (if not automatically granted because the user is a flow owner).
Not licensed	See assets and their metadata	Requires Data Management Tableau Cloud requires Data Management to access the Metadata API, but Tableau Server does not. This requirement started with Tableau Cloud October 2026. If you were using the Metadata API without Data Management at that time, you can continue doing so until June 2027.
	Edit assets and their metadata	Requires Data Management
	Change permissions on assets and their metadata
	Grant other users permissions to see assets and their metadata

[Skip to main content](#main-content) # Manage Permissions with Projects Projects can simplify permission management with features such as nested projects, project visibility, non-admin project leaders, and locking permissions. > [!TIP] > > How permissions are set at the project level is important, especially for the Default project. When a new top-level project is created, it inherits its default permission rules (for all content types) from the Default project. When a new project is created nested inside another project, the child project inherits its default permission rules from the parent project. ## Project administration Projects are containers used to organize and manage access to content. By giving non-administrators privileges to manage projects, certain content administration tasks can be handled at the project level. **Project Leaders**: Projects can have project leaders, users who have been set as a project leader. This setting automatically grants a user their maximum capabilities—depending on their site role—for that project and all content in that project. Project leaders with site role of Explorer (can publish) and above have all capabilities. Project leaders are essentially local admins for the project without access to site or server settings. **Hierarchy**: Only administrators can create top-level projects. Project owners and project leaders can create nested projects inside their projects. Project owners and leaders have full administrative access to the project and its content, as well as any nested projects it contains. In a hierarchy, project leaders are implicitly given project leader access to all child content. To remove project leader access, you must do so at the level in the hierarchy where the role was explicitly assigned. **Ownership**: A project can have multiple project leaders, but each project has exactly one owner. By default, a project is owned by the user who created it. A project’s owner can be changed by the existing owner or an administrator. (Project leaders can't change project ownership, only content ownership). Projects can be owned by users with a site role of Explorer (can publish), Creator, or administrator. Project ownership can be changed even if a project is locked. **Deleting**: Most content can only exist inside a project. Only administrators can create and delete top-level projects, but project leaders can create or delete nested projects. Deleting projects also deletes all the Tableau content and nested projects they contain. To delete a project without losing its content, move the content to another project first. Deleting projects can’t be undone. External assets are handled differently. They don’t have to be in a project. External assets aren’t deleted if their project is deleted and continue to appear in External Assets. See [External assets that aren’t in projects](https://help.tableau.com/v0.0/online/en-us/dm_perms_assets.htm#external_assets_not_in_projects) for more information. For a deeper dive into project administration, see [Use Projects to Manage Content Access](https://help.tableau.com/v0.0/online/en-us/projects.htm) and [Add Projects and Move Content Into Them](https://help.tableau.com/v0.0/online/en-us/projects_add.htm). ## Special projects Default: The project named "Default" is a special project. When other top-level projects are created, they use the Default project as a template, and copy all their permissions rules from it (but not the Asset permissions setting). The Default project can’t be deleted, moved, or renamed, but its description can be changed. It has no owner by default, but one can be assigned. External Assets Default Project: In Tableau Cloud and Tableau Server 2023.1 and later, if you have a Data Management license with Catalog enabled, the project named "External Assets Default Project" appears when Catalog needs to move new or existing external assets to it. Catalog puts new external assets and external assets from deleted projects in the External Assets Default Project. The project has no permissions rules by default, so server administrators and site administrators are the only users who can see it unless permissions are added. It can’t be deleted, moved, or renamed, but its description can be changed. It has no owner by default, but one can be assigned. ## Set a project leader Project leaders are users who have administrator-like access for a specific project or project hierarchy. To assign project leader status to a group or user 1. Open the permission dialog for the appropriate project. 2. Select an existing permission rule, or click + Add Group/User Rule and chose the desired group or user. 3. Open the action menu (...) for that permission rule and select Set Project Leader.... **Note**: If the action menu includes an option for Enable "Set Project Leader", this needs to be selected before the group or user can be set as a project leader. This option only appears when that group or user was denied the Project Leader capability (prior to 2020.1). That denied capability needs to be removed before they can be set as a project leader. After a permission rule establishes a project leader, the templates and capabilities can't be edited because all capabilities are allowed for project leaders. If a project leader is established on a project that contains nested projects, they have inherited project leader status on all nested projects and their content. Project leader status is always applied downward through the entire project hierarchy and can only be removed from the level where it was set. To remove project leader status, follow the same steps but select Remove as Project Leader from the action menu. After a group or user has been removed as project leader, that permission rule has all capabilities set to Unspecified. This may mean their access to and capabilities for that project is removed if there’s no other permission rule giving them permissions to the content. To keep their access to the project and its content, they need to have capabilities set like any other group or user. **Note**: Project leaders can refresh extracts in their projects in most circumstances. They can't refresh extracts if they're only the project leader of a nested project (instead of a top-level project) and the top-level project is _locked (including nested projects)_. ## Lock asset permissions Permission rules set at the project level act as a default for content saved in that project and any nested projects it contains. Whether those project-level default rules are enforced or only preliminary depends on the Asset permissions setting. This setting can be configured in two ways, either Locked (recommended) or Customizable. Locking a project removes the ability for content owners to modify the permission rules on their content. Locking permissions can be applied to nested projects or just to the parent project itself. - When Asset permissions is Locked (including nested projects), permission rules set at the project level are enforced for all assets in the project and all nested projects. - When Asset permissions is **Locked** (_not_ including nested projects), permission rules set at the project level are enforced for assets in the project. Nested projects can be configured independently with their own permission rules and set as locked or customizable. - When Asset permissions is Customizable, permission rules set at the project level are applied to all assets in the project by default. However, permission rules can be modified for individual assets during or after publishing. **Note**: Whether permission rules are locked or customizable, the permissions on content are always applied. _Locked_ and _customizable_ refer only to how project-level permissions are inherited by content in the project and who can change them. Even in a project with customizable permissions, only specific users can modify permissions (content or project owner, project leader, admins, or those with the Set Permission capability). In a locked project: - The project permission rules per content type are applied to all assets. - Only administrators, project owners, and project leaders can modify permissions. - Content owners lose the Set Permission capability but retain all other capabilities on their content. - Permissions are predictable for all content in the project. In a customizable project: - The project permission rules are applied by default when content is published into the project or nested projects are created, but permissions can be modified during publication or after the content is created. - Any user with the Set Permissions capability can modify permission rules for that content. - Content owners have all capabilities on their content. - Permissions can be different across content in the project. - Any changes to permissions on the customizable parent project aren't applied down to nested projects. ### Set asset permissions (lock a project) New top-level projects inherit all initial permission rules from the Default project but not the Asset permissions setting, which is set to Customizable. This can be changed to Locked if desired. To configure Asset permissions: 1. You must be logged into the site as an administrator, project owner, or project leader 2. Open the permissions dialog for a project 3. Next to Asset permissions in the upper left, click the Edit link and select the desired option in the Asset permissions dialog ![Asset Permissions dialog box with the Locked option selected.](/tableau/next/en-us/online/en-us/Img/perms_lockproject.png) **Note**: If the upper left corner doesn’t show an **Edit** link in step 3 above, you may be on the permissions dialog for a (a) nested project or a piece of content in a locked project, in which case the link should bring you to the managing project, (b) piece of content in a customizable project, which won’t show anything, or (c) view, which will indicate how the view permissions are tied to the workbook. For more information on the interplay of permissions for views and workbooks, see [Show or Hide Sheet Tabs](https://help.tableau.com/v0.0/online/en-us/permissions.htm#sheettabs). ### Change asset permissions When the Asset permissions setting for a project is changed, the outcome depends on the new setting. Changes to permission rules in a locked hierarchy must be done at the level of the managing project.

Changing from	Changing to	Outcome
Locked (including nested projects)	Locked	Doesn’t modify existing permission rules. Any nested projects become customizable.
Locked (including nested projects)	Customizable	Doesn’t modify existing permission rules, though they become customizable. Any nested projects become customizable.
Locked	Locked (including nested projects)	Overwrites existing custom permission rules for all nested projects and their content. This can’t be undone.
Locked	Customizable	Doesn’t modify existing permission rules, though they become customizable. Any nested projects retain their content permission settings and permission rules.
Customizable	Locked (including nested projects)	Overwrites existing custom permission rules for content in the project, and all nested projects and their content. This can’t be undone.
Customizable	Locked	Overwrites existing custom permission rules for content in the project. This can’t be undone. Any nested projects retain their permission rules and remain customizable.

### Move projects and content #### Move Tableau content and external assets When _Tableau content_ or _external assets_ are moved between projects with different permission settings, Asset permissions settings determine the logic of how permissions are applied. - Moving assets into a locked project overrides the existing permission rules and enforce the destination’s permissions. - Moving assets into a customizable project maintains the existing permission rules on the asset. **Note**: Prior to Tableau Server 2022.3 and Tableau Cloud June 2022, external assets couldn’t be in projects, and permissions on tables were managed through the Table permissions setting of the parent database. Beginning with Tableau Server 2022.3 and Tableau Cloud June 2022, external assets can be in projects. If a database or a table is moved into a project, older settings to control table permissions through the database are ignored, and the database or table permissions follow the logic of other assets. #### Move projects When a _project_ is moved into another project, the permissions settings on the item being moved are maintained unless the destination project is scoped to include nested projects. (Project permissions in this case mean the View and Publish capabilities for the project itself.) - If the destination project is set to **locked (including nested projects)**, the permissions for the project being moved _and its content_ are overwritten. - If the destination project is set to **locked** (not including nested projects), the permissions for the project being moved aren’t overwritten. Whether the moved project is locked or customizable is preserved from its original setting. - If the destination project is set to **customizable**, the permissions for the project being moved aren’t overwritten but they’re now editable. If the project being moved was previously nested under a parent that was _locked (including nested projects)_, when moved, the project takes on the setting of _locked (including nested projects)_ and becomes the managing project for any projects it contains. Note: This is the same outcome if a project is moved to become a top-level project. Use care moving locked nested projects Moving nested projects inside _locked (including nested projects)_ environments can be tricky. A project can be moved into situation that prevents the user from moving it out again. If a nested project is owned by a different user than the managing project, and the managing project is set to _locked (including nested projects)_, a nested project can wind up unable to be moved by anyone except an admin. For example, consider a locked (including nested projects) top-level project owned by userA, and two nested projects owned by userB. If userB moves one nested project inside the other, they aren't then able to move it back out—and neither is userA. - UserB can't move **Nested project2** because they don't have rights to move rights on **Top-level Project** as a destination. - UserA can't move **Nested project2** because they don't have move rights on it. - A project leader on **Top-level Project** can't move it even though project leader trickles down to nested projects. - Only an admin can move **Nested project2** in this setup. ![A top-level project with a lock icon and the name "userA" next to it, with "nested project1" inside and "nested project2" inside that. Both nested projects are owned by userB.](/tableau/next/en-us/online/en-us/Img/move_locked_nested_projects.png "Screenshot of move content window") ## Collections Unlike projects, which contain content, a collection can be thought of as a list of links to content. Project permissions can be inherited by the content in the project, but permissions for a collection have no effect on the content added to the collection. This means that different users might see different numbers of items in a collection, depending on which items they have permission to view. To make sure that users can see all items in a collection, adjust the permissions for those items individually. Permissions for a collection can be changed either by using the permissions dialog or by granting access upon sharing a collection, if you’re an administrator or the collection owner. For more information, see [Manage Collection Permissions](https://help.tableau.com/current/pro/desktop/en-us/collections.htm#permissions). #### Private collections When a collection is created, it’s private by default. A private collection appears on the owner’s My Collections page, but it doesn't appear in the list of all collections on a site. Private collections are simply collections with no permission rules added. Unlike other types of content, collections don't have the “All Users” group added by default. When you add permission rules to a collection, it’s no longer flagged as private. To return a collection to a private state, remove the permission rules. Private collections can be viewed by the collection owner as well as by administrators, whose site role gives them effective permissions to view all collections. [Skip to main content](#main-content) # Manage Pools There are a few ways you can manage your pooled Bridge clients. ## Monitor data freshness tasks You can monitor client activity using a combination of the Jobs page and built-in admin views. ### Live queries To monitor live query activity, you can use the [Traffic to Bridge Connected Data Sources](https://help.tableau.com/v0.0/online/en-us/adminview_bridge_datasources.htm) admin view. ### Refresh jobs To monitor refresh jobs, you can use the following resources: - **Jobs** page: The Jobs page can show you the completed, in progress, pending, canceled, and suspended Bridge refresh jobs that use Bridge refresh schedules. For more information, see [About Bridge Refresh jobs](https://help.tableau.com/v0.0/online/en-us/server_backgrounder_job_management.htm#bridge). - **Background Tasks for Non Extracts** admin view: After filtering on Refresh Extracts Via Bridge, this admin view shows Bridge refresh jobs that use refresh schedules. For more information, see [Background Tasks for Non Extracts](https://help.tableau.com/v0.0/online/en-us/adminview_backgrnd_nonextract.htm). - **Bridge Extracts** admin view: This admin view shows Bridge refresh jobs that use both Bridge refresh schedules and Bridge legacy schedules. For more information about this view, see [Bridge Extracts](https://help.tableau.com/v0.0/online/en-us/adminview_bridge_extract.htm). - **Create a data source or view using client logs:** Using JSON log files generated by a client, create your own data sources and views to monitor refresh jobs. For more information, see the [Refresh jobs by client](#json) section below. ### Multiple connection scenarios For Bridge extract refresh connections that contain embedded data sources, you can connect to more than one Bridge client, therefore allowing data from multiple sources to be combined and accessed as if it were a single source. This behavior differs from published data sources. Multiple published data source connections must be assigned to one Bridge client. Pool mappings that have conflicting connections are not supported. **Scenario 1** Data source 1: Embedded data source for Snowflake that has direct connection to a data source through Tableau Cloud. Data source 2: Published data source for Snowflake that has a connection to union on-premises databases. **Pool mapping** - For the embedded data sources, don’t add the Snowflake to the Private Network Allowlist. Edit connection type from the Connections tab and set the network type as Tableau Cloud. **Note**: You don’t need to use Bridge if the data source can access Tableau Cloud directly. - For the Snowflake published data sources that have union connections to on-premise databases, add the connection to the Private Network Allowlist, edit the connection type from the Connections tab, and set the network type as Private Network. **Scenario 2: _Not Supported_** - Published data source with two connections: Connection one is assigned to pool1 and connection two is assigned to pool2. ### Refresh jobs by client As an alternative to monitoring refresh jobs using the admin views listed above, consider creating your own data sources and views to monitor refreshes performed by a Bridge client. You can do this by using Tableau Desktop to connect to a client’s JSON log files on the machine where the client is running. **Note:** A client's JSON log files do not capture refreshes for virtual connections. The JSON log files are comprised of objects, “k” and “v”. The “k” objects capture refresh jobs and “v” objects capture refresh details. The refreshes and their details include: - Schedule type - Bridge refresh or Bridge legacy - Data source type and name - Refresh start and end time, duration, time to upload and publish - Errors #### Step 1: Before you begin If you want to build a view from the data of one log file, you can skip to **Step 2**. If the data for a client is in multiple log files, you’ll need to union the files. You can create a script to union the log files locally or use Tableau Desktop to perform the union as described in the procedure below. **Notes:** - The procedure described below assumes you are running Tableau Desktop on the same machine as the client. - If you are working with multiple log files from different clients in a pool, in addition to unioning multiple logs files for a client, you can join the log files from multiple clients to monitor refreshes in a pool. - Connecting to JSON files directly from Tableau Cloud web authoring is currently not supported. For more information, see [Creators: Connect to data on the web](https://help.tableau.com/current/pro/desktop/en-us/creator_connect.htm#open-the-connect-to-data-page). #### Step 2: Connect to JSON logs To build a data source and view, connect to a client’s log files using Tableau Desktop. 1. Start Tableau Desktop and under Connect, select JSON file. Do the following: 1. In the Select Schema Levels dialog box, select the top level schema to include “k” object details and optionally, select the "v"-level schema to include "v" object details, and then click OK. 2. Navigate to the log file you want to connect to (for example, C:\\Users\\jsmith\\Documents\\My Tableau Bridge Repository\\Logs), select it, and then click Open. 2. (Optional) On the data source page, right-click the log files and click Convert to Union to set up a union. Do the following: 1. Select Wildcard (automatic) tab. 2. Next to Search In, verify the path shows the client’s Log folder. 3. Under Matching pattern, enter ExtractRefreshMetrics\_\* and click OK. 3. Select the sheet tab to start your analysis and build your view. 4. When finished, publish the data source and view to Tableau Cloud separately. To ensure that your data source is kept up to date, you can set up a Bridge (legacy) schedule for the data source after publishing. Be aware that the data sources and views you create can change without warning because new log files can be generated and old log files can be deleted after certain log-specific limits are met. For more information about these limits and how to adjust them, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm). ## Manage pools and clients Under the Pooling section, you can see up to five tables of pooling and client related information in your Bridge deployment. **About pools** The first table consists of clients registered to the site organized by the pools they are assigned to. ![Pooling dialog with option to add new pool and table with Pool name, clients in pool, active clients, and pool status. ](/tableau/next/en-us/online/en-us/Img/bridge_pools_extended.png) The second table, Unassigned Clients, shows clients not assigned to a pool. In most cases, these clients need to be assigned to a pool before they can load balance live query and extract refresh jobs. In other cases, clients in this table might be dedicated to refreshing data sources using Bridge (legacy) schedules. ![A table displays unassigned clients, including computer name, owner, version, connection status, and last connected date.](/tableau/next/en-us/online/en-us/Img/bridge_pools_unassigned.png) The third table, Default Pool, shows clients in the default pool. Clients configured to use pooling prior to Bridge 2021.4 are included in this pool by default. Because the default pool's domain can't be configured to access a specific private network, we recommend you reduce its scope of access by creating new pools and mapping them to specific domains. ![A Default Pool table that displays computer names, owners, versions, connection status, and last connection time.](/tableau/next/en-us/online/en-us/Img/bridge_pools_default.png) The clients you see in the first three tables can tell you the following information: - Client name, also known as the computer name, is the name of the machine the client is installed on and running from. - Owner name, which in most cases is a site admin. This is the user who is authenticated (signed in) to Tableau Cloud from the client. - Pool status, applies to the first table only, can indicate 1) whether there are assigned clients in the pool, 2) clients are connected and available to handle data freshness tasks, or 3) pool is offline because all clients int he pool are disconnected. - Client version: - A warning icon (![A yellow square with an exclamation point.](/tableau/next/en-us/online/en-us/Img/bridge_settings_version_warning.png)) displays in this column when the client is not running the latest version of Bridge. Although not required, we strongly recommend upgrading to take advantage of the latest security and feature updates. To download the latest version of Bridge, go to the [Downloads](https://www.tableau.com/support/releases/bridge) page on the Tableau website. **Note:** The warning icon shows only when there is a newer client available for download. The warning icon is not an indication that there are issues with the client or related Bridge data sources or virtual connections. - Connection status—for more information see the [Client connection status](#status), below. - Last connected—shows the day and time Tableau Cloud was last able to reach the client. #### About Private Network Allowlist The fourth table, Allowlist Registry, contains a list of domains that pools are scoped to. ![Private Network allowlist with list of allowed domains.](/tableau/next/en-us/online/en-us/Img/bridge_pools_allowlist.png) The fifth table, Allowlist Requests, shows pending domains that users have requested to connect to when trying to create virtual connections. These domain requests should be addressed as soon as possible to unblock users from their virtual connection workflows. ## Client connection status Where clients are listed, the colored squares and status labels indicate the _availability_ of the client to support data freshness tasks. - Green or "Connected": A green or Connected state indicates that the client is connected and _available_ to support live queries and extract refreshes. - Red or "Disconnected": A red or Disconnected state can indicate one of a few conditions that have temporarily put the client in a disconnected state. The most common scenario is if the client is not running or was unable to establish communication with Tableau Cloud after being launched. You can hover over the status to see a tooltip that describes the condition. **Notes:** When the client is in a disconnected state, live queries might be disrupted. In cases like this, views that depend on data sources or virtual connections with live queries might not properly display until the issue is resolved. The states described above reflect and correspond to the status you see in the client. ![A Tableau Bridge window displays a connection status of "Connected," with options for "Batters (TestV1)" and "Mariners Only (Batters—TestV1)."](/tableau/next/en-us/online/en-us/Img/bridge_client_status.png) [Skip to main content](#main-content) # Manage Routing Rules Routing rules determine which Tableau Bridge pool handles traffic for specific domains and, optionally, the Tableau project it belongs to. **Note:** Routing rules replace the private network allowlist and provide domain- and project-based routing. Existing allowlist entries become **Allow** routing rules assigned to the same pools, so you don't have to create them again. ## Prerequisites - Create at least one non-default pool before creating an Allow rule. - Identify the target domains (for example, myco.com, \*.myco.com, 172.16.0.0). **Note:** Tableau-owned domains like \*.tableau.com are not supported. ## Rule Conditions Each routing rule consists of three configurable parameters:

Condition	Description	Required
Rule Type	Allow routes matching traffic to a specific pool. Block prevents Bridge from routing traffic that matches the rule. Block rules are not assigned a pool. Rules must be unique.	Yes
Domain	The domain name or IP address the rule applies to.	Yes
Project	One or more Tableau projects (including nested sub projects) to scope the rule to. If you leave it blank, the rule applies to the domain across all projects.	Optional

**Note**: Each rule combination must be unique. Project-level conditions only apply to resources published from Tableau Desktop or Tableau Prep. Web-authored content is evaluated by domain only. ## Pools and routing rules Bridge Pools distribute live queries and extract refreshes across the Bridge clients assigned to them. Routing rules decide which pool a given query goes to: when a query matches a rule's domain (and project, if specified), Bridge routes it to that rule's pool instead of falling back to the default pool. **Note**: Create your target pools before setting up routing rules. An **Allow** rule requires at least one non-default pool to receive traffic. ## Create a routing rule 1. From your site's **Settings** page, go to the **Routing Rules** section. 2. Click **\+ Add Routing Rule**. 3. For **Rule Type**, select **Allow** or **Block**. 4. In **Rule Details**, enter the domain that the rule matches in Domain. 5. (Optional) Under **Project**, select one or more projects to scope the rule to. Use the search box, or expand a project and select specific subprojects or folders. To apply the rule to the domain regardless of project, leave **Project** blank. 6. If you selected **Allow**, select the **Pool** that handles matching traffic. 7. Click **Save**. If a new rule duplicates an existing one, it won't be saved. A warning icon appears on the rule until it is made unique. ![](/tableau/next/en-us/online/en-us/Img/routing_rule_441x449.png) **Note:** Project-based conditions currently apply only to Bridge-connected resources published from Tableau Desktop or Prep. Content published through web authoring can only be filtered by domain, since project information is not available for web-authored resources at the time a rule is evaluated. ## Edit a routing rule 1\. In the **Routing Rules** table, find the rule you want to change. 2\. In the **Actions** column, click the edit icon.. 3\. Update the rule type, domain, project selection, or pool, then click **Save**. If the edited rule duplicates an existing one, you cannot save it. The warning icon remains until you make the rule unique.. ## Delete a routing rule In the **Actions** column, click the delete icon next to the rule. You cannot restore deleted rules. Traffic automatically follows the next matching rule or routes to the default pool. **Note:** Block rules apply site-wide. There is no way to block a domain for only a subset of projects. ## View and organize your routing rules Use the **View by** dropdown above the routing rules table to group rules differently. Group rules by: - **Routing Rules:** Shows one row per rule and is the default view. - **Domains:** Groups rules by domain and shows the number of rules for each domain and a shortcut for adding another rule to that domain. - **Pools:** Groups rules by the pool to which they route. - **Rule Type:** Groups rules by **Allow** or **Block**. If a rule includes more than one project, click the ⓘ icon next to the rule to see the full list of projects (and subprojects) it applies to. A warning icon in the **Status** column indicates that the rule needs attention. For example, a warning icon appears if a project referenced by the rule was deleted from your site. Edit the rule, and then update or remove the affected project. ## Migrating from the private network allowlist Routing rules replace the private network domain allowlist.If you used the allowlist to map domains to pools, your existing entries automatically become **Allow** routing rules that point to the same pools. You do not need to re-create the entries. The **Default Pool** remains available after migration for backward compatibility, but it's no longer the recommended way to manage routing. For more control, create dedicated pools and use routing rules to map them to domains and, optionally, projects. ## How project-based routing is determined When a routing rule includes a project condition, Bridge evaluates the project that contains the queried data source or virtual connection. Bridge doesn’t evaluate the project that contains the workbook or flow consuming the connection. In most cases, the projects are the same. They differ when, for example, a data source belongs to one project but workbooks in other projects use it.

Content Type	Project used for routing
Published Data Sources (PDS) or Virtual Connections (VConns) extract refresh	PDS or VConn project
Workbook with a Live Connection to a PDS	PDS project
Workbook on VConn (live)	VConn project
Workbook → direct DB / File (EDS)	Workbook project
Flow on PDS (live)	PDS project
Flow on VConn (live)	VConn project
Flow → direct DB / File	Flow project
PDS with a Live Connection to a VConn	VConn project
Composable data source (not in MVP) - PDS2 on PDS1(live)	PDS1 project
Workbook on Composable DS(PDS2 on PDS1 Live)	PDS1 project
Flow on Composable DS	Not supported

## Impact on shared data sources If a data source in a shared or central project (for example, "BITeam") is used by workbooks in a different department's project (for example, "Finance"), queries against that data source route based on the shared prbook's project. To route queries from different departments to different pools, publish a copy of the data source in each department’s project instead of sharing one data source across projects. ## Limitations - Routing rules don’t support composable data sources. The routing behavior of a workbook built on a composable data source is undefined. - For web-authored content, routing rules match only by domain. Project-based conditions are not available. (see [note](#Note:)). - Bulk editing of multiple routing rules at once is not currently supported. For example, changing the domain or pool on several rules simultaneously. [Skip to main content](#main-content) # Manage Site Role Limits In Tableau Cloud Manager (TCM), cloud administrators can set site role limits, which define the maximum number of each license type—Creator, Explorer, or Viewer—that can be consumed by a site. After role limits are created, users on the site automatically consume a license of their assigned role, following the limits set by the cloud administrator. **Note:** Cloud administrators only have access to TCM and don't consume a license. To gain site access, you can assign yourself a site role or be assigned one by another cloud admin. For more information, see [Manage users' site membership](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm#manage-site-membership). If a user is added to multiple Tableau Cloud sites, they count against the role limit for each individual site. However, for the overall license consumption within TCM, a user only consumes one license. This license corresponds to the max site role they've been assigned across all the sites they're a member of. Let's consider the following scenario where a cloud administrator sets site role limits on two sites: - **Site A:** 3 Creator, 5 Explorer, 10 Viewer licenses - **Site B:** 2 Creator, 4 Explorer, 6 Viewer licenses Jane, who works in both sites, is added as a Creator on Site A and an Explorer on Site B. On Site A, Jane is counted as one of the 3 Creators. On Site B, Jane is counted as one of the 4 Explorers Despite being a member of both sites, Jane only consumes one Creator license in TCM because that is the highest assigned role across sites. ## Create or modify role limits on a site By default, each site within Tableau Cloud Manager (TCM) uses the _cloud limit_, which is the total number of licenses purchased. When adding users to a site, TCM checks against the cloud limit to ensure that the number of users doesn't exceed the total licenses available. To manage your organization's Tableau Cloud licenses, cloud administrators can set site role limits. This feature enables control over license allocation across different sites within your tenant. To set site role limits, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Navigate to the Sites page, and select the site you want to modify. 3. Click the Actions menu or ellipsis icon (**...**) and select Site Role Limits. 4. In the dialog, select Site Role Limit for the site role you want to modify, and then enter the desired value. ![](/tableau/next/en-us/online/en-us/Img/tcm_set_site_role_limits.png) **Note:** The site role limit must be equal to or greater than the number of licenses used and can't exceed the cloud limit for that site role. 5. Click Save. After setting site role limits, the maximum license count is visible on the Sites page of TCM. ![](/tableau/next/en-us/online/en-us/Img/tcm_site_role_limits.png) At the site level, site administrators can see role limits for their site on the Users page. ![](/tableau/next/en-us/online/en-us/Img/tcm_site_role_limits_info.png) ## When site role limits are met When a user is added to a site, they automatically consume the license assigned to their site role. However, if the maximum number of licenses for that role (the site role limit) has already been reached, the following occurs: - If all licenses for a site role are in use, but there are available licenses at a higher role, the user is added to the site and consumes a license for the higher role. For example, if there are no available Explorer licenses, a user added as an Explorer consumes an available Creator license. - If no higher role licenses are available, the user is added to the site as an Unlicensed user. Users consuming licenses different from their assigned roles, such as Viewers using Explorer licenses, can affect site role limits. Cloud administrators can address this scenario in two ways: - Unlicensing these users and updating the site role limit as needed. For more information, see [Create or modify role limits on a site](#create-modify-role-limits). - Purchasing additional licenses through the Tableau Webstore. For more information, see [Buy More Licenses](https://help.tableau.com/v0.0/online/en-us/to_buy_more_licenses.htm). [Skip to main content](#main-content) # Manage Site User Visibility By default, all site users can see aliases, project ownership and comments by other users when permissions allow. The User Visibility setting lets administrators manage if users with Viewer and Explorer site roles see other users and groups on the site, which can be important for sites that are used by multiple clients. To learn more about site roles, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm). ## Limit user visibility Setting User Visibility to **Limited** impacts certain collaboration tools and hides user information in Tableau Cloud and Tableau Server. Limited User Visibility either disables the feature for Viewers and Explorers (excluding Site Administrator Explorers), or removes user information from other areas. Note that Creators and administrators will still see user information when User Visibility is set to Limited. To limit user visibility for Explorers and Viewers (excluding Site Administrator Explorers): - Navigate to the site's Settings page - Select Limited in the User Visibility setting The following is a list of site areas impacted when User Visibility is set to Limited. Unless noted that the feature is disabled for all users, only non-administrator Explorers or Viewers are impacted.

Area	Impact
Search	User information not displayed
Content owners	User information not displayed (Explorers and Viewers can't see themselves, but can see their content in My Content)
Profile pictures	User information not displayed
Subscriptions	User information not displayed
Recommendations	Similar users not displayed (all users)
Add/Edit Tags	Explorers and Viewers can see tags but cannot delete or modify them
"Who has seen this view?"	Disabled
Ask Data usage analytics	Disabled
Permissions dialogs	Disabled
Named sharing	Disabled (all users)
Alerts	Disabled (all users) Existing alerts paused
Comments	Disabled (all users)
Public Custom Views	Disabled (all users) Existing public custom views appear as private
Request Access	Disabled (all users)
Tableau Desktop	Publishing workbooks disabled from Desktop User information not displayed on user filters
Tableau Pulse	The button to see and manage followers doesn't appear on metrics
Tableau Catalog (with Data Management)	User information not displayed

When User Visibility is set to Limited, Tableau Server REST API and Metadata API calls behave as described in the table above. It remains possible to make API calls that reference a known user ID. Users on a site can interact with views and modify them, such as applying filters. If that user shares their modified view with others, or if the user creates something from that modified view (like a metric or a private custom view), then that user's name appears in the URL. Make sure that the URL for this modified view is only distributed to users who are permitted to see that person's name. **Note**: If a user is a member of multiple sites, entering an email on the sign in page for Tableau Cloud will return the names of all sites the user is a member of. ### Best practices for limiting user visibility Administrators can also check that user and group information is not visible in these ways: - Configure permissions to only provide content to appropriate parties. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). - Limited User Visibility hides user identification information from search, but might return content that the user published, including when searching by owner name, if the person searching has viewing permission to that content. - A user publishing a workbook with a duplicate title in the same project might see a warning that a workbook with that title already exists. - Apply row-level security when necessary. - Check that metadata within dashboards does not contain user information. - Check that calculations accessible to users don't contain user metadata (e.g., user filters). ## Restore Full User Visibility When administrators set User Visibility back to Full, features disabled for all users by Limited User Visibility (such as comments and alerts) remain off. Administrators can re-enable these features through the site's Settings page. Any previous feature settings are not retained when User Visibility is set to Full, and affected features are not automatically turned on. [Skip to main content](#main-content) # Manage Users and Groups You can add users to your Tableau Cloud site and set their site roles, which determines each user's level of access. To make it easier to manage multiple users, you can organize users into groups. ## Other articles in this section [Skip to main content](#main-content) # Manage Users With Tableau Cloud Manager Everyone who accesses Tableau Cloud—whether to browse, publish, edit content, or perform administrative tasks—must be added as a user. Cloud administrators have the following options for adding users: - Enter users' email addresses individually - Import users via a CSV file that you create using the [CSV Import File Guidelines](https://help.tableau.com/v0.0/online/en-us/csvguidelines.htm) ## How users are managed in Tableau Cloud Within Tableau Cloud, user management is handled through two distinct pages: the Cloud Users page and the Site Users page. The Cloud Users page, accessible only to cloud administrators in Tableau Cloud Manager (TCM), serves as the central place for assigning users to multiple sites and for removing users from Tableau Cloud. Meanwhile, the Site Users page is available to site administrators, allowing them to manage users within their specific sites. **Note:** You can only remove a user if the user doesn't own any content (projects, workbooks, views, or data sources). For more information, see [Remove users from Tableau Cloud](#remove-users). With TCM, users are added at the tenant level and then assigned to the appropriate sites as needed. Adding users through TCM can improve the onboarding process by reducing the administrative burden on site administrators, allowing them to focus more on site-specific management tasks. As a cloud administrator, you can also modify a user's site membership and role at any time. For more information, see [Manage users' site membership](#manage-site-membership). ## Add users to Tableau Cloud Manager You can add users to Tableau Cloud Manager (TCM) individually or in bulk by uploading a CSV file with user information. ### Add a user individually 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Navigate to the Users page, and select Add Users > Add User by Email. 3. Complete the fields in the Add User dialog: ![](/tableau/next/en-us/online/en-us/Img/tcm_users_add.png) 1. **Email address:** Email address of the user. 2. **(Optional) User is a Cloud Administrator:** Select whether to add the user as a cloud administrator. By default, cloud administrators authenticate using Tableau with MFA when they sign in to TCM. If an external authentication method is configured, select an alternative authentication type from the dropdown menu. 3. **Site:** Select one or more sites to add the user to. 4. **Site role:** Assign the user a site role on each selected site. For more information about site roles and capabilities, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm). 5. **Site authentication:** Select an authentication method for the user. The default authentication method is Tableau with MFA (multi-factor authentication). If site administrators have configured multiple authentication methods, select an alternative authentication type from the dropdown menu. 4. Click Add User. An email is sent to the user with the next steps to sign in to Tableau Cloud. If a new user's email address is already associated with an account on tableau.com, the user is prompted to sign in using the existing email address and password for that account. If a new user's email address isn't associated with an account on tableau.com, the user is prompted to provide a first and last name and password. ### Bulk import users To automate the process of adding users, you can create a CSV file containing user information, and then import the file to Tableau Cloud Manager (TCM). When importing the CSV file, you can specify the users' site membership, site role, and authentication type. The following columns and values are exclusive to TCM: - **Site URI:** The uniform resource identifier for the site. To import a user as a cloud administrator, include the Site URI column and leave it blank. - **Administrator level:** To add a user as cloud administrator, set the value to `Cloud`. - **Authentication type:** The user authentication type for accessing a site or TCM. **Note:** This section contains the steps for importing, assuming that you have already created the CSV file. If you haven't created the file yet, see [CSV Import File Guidelines](https://help.tableau.com/v0.0/online/en-us/csvguidelines.htm) for a list of file format requirements and import options. When importing to TCM, make sure your CSV file is in UTF-8 format without a byte order mark (BOM). To add or modify users from a CSV file, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Navigate to the Users page, and select Add Users > Import Users from File. 3. To upload a file, drag the CSV file into the dialog, or click Choose a file. ![](/tableau/next/en-us/online/en-us/Img/tcm_users_import.png) 4. Click Import Users. > [!IMPORTANT] > > Importing a CSV file with different site roles automatically updates existing users to the roles specified, even if they're more restrictive. This change affects all users, including cloud administrators. ## Manage users' site membership Site membership refers to the sites and roles assigned to each user in a tenant. Cloud administrators can modify a user's site membership at any time, such as granting access to additional sites or changing their designated site role and authentication. All changes to users are performed in the site membership dialog and then shared across sites. ![](/tableau/next/en-us/online/en-us/Img/tcm_users_site_membership.png) To modify site membership, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Navigate to the Users page and select the users to modify. **Note:** You can select up to 50 users at a time. To modify more than 50 users, import a CSV file containing the desired changes. For more information about modifying users in bulk, see [Bulk import users](#bulk-import-users). 3. Select Actions > Site Membership. 4. In the dialog, modify users' site membership, including their site role and authentication method. When modifying site membership for multiple users, the Site role and Site authentication dropdown menus display "Multiple Values" when users are assigned different values on the site. Selecting a new value from the list assigns the same value to the selected users. ![](/tableau/next/en-us/online/en-us/Img/tcm_users_site_membership_multiple_values.png) 5. Click Save. ### Assign or remove cloud administrator privileges You can have up to 100 cloud administrators in Tableau Cloud Manager (TCM). To assign or remove the cloud administrator role, select the User is a Cloud Administrator checkbox while modifying site membership. When a user is assigned cloud administrator privileges, they gain access to the TCM web interface and Tableau Cloud Manager REST API. **Note:** If an authentication type other than Tableau with MFA has been configured for TCM authentication, TCM will default to using the non-default authentication type when adding a new Tableau Cloud administrator. This can be changed at any time from the Authentication for Tableau Cloud Manager dropdown in the Site Membership dialog pictured above. ## Remove users from Tableau Cloud You can remove a user only if the user doesn't own any content (projects, workbooks, views, or data sources). If you attempt to remove a user who owns content, the user's site role is set to Unlicensed, but the user isn't removed from Tableau Cloud Manager. A user who belongs to multiple sites and owns content on any of them is removed from the sites where they don't own content. The user remains a member on sites where they own content, but is demoted to the Unlicensed site role. To remove a user from Tableau Cloud, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Navigate to the Users page, and select one or more users to remove. **Note:** You can select up to 50 users at a time. To modify more than 50 users, import a CSV file containing the desired changes. For more information about modifying users in bulk, see [Bulk import users](#bulk-import-users). 3. Select Actions > Remove. 4. In the confirmation dialog, select Remove User. ![](/tableau/next/en-us/online/en-us/Img/tcm_users_remove.png) [Skip to main content](#main-content) # Managing Background Jobs in Tableau Cloud In Tableau Cloud, users can schedule extract refreshes, subscriptions, or flows to run periodically. These scheduled items are referred to as **Tasks**. The Backgrounder process initiates unique instances of these tasks to run them at the scheduled time. The unique instances of the tasks that are initiated as a result are referred to as **Jobs**. Jobs are also created for runs that are initiated manually, by selecting **Run Now** in the web interface, programmatically through REST API, or tabcmd commands. For example, an extract refresh task is created to run daily at 9 AM. This is an extract refresh task, and every day at 9 AM, a job will be created for the Backgrounder to run. Running all these jobs can mean that Backgrounder uses a lot of resources at various times during the day. Using the Job Management feature, Site administrators can get more details on these jobs that happen in their Site, and take action on those jobs to better manage resource usage. The **Run Now** settings on the **General** settings page also allows you to manage your resources by either allowing or blocking users from running jobs manually. By default, this option is selected to allow users to run jobs manually. Clear the check box to prevent users from running jobs manually. The Jobs page which contains the information about jobs can be accessed by navigating to the **Existing Tasks** menu of the left navigation menu. **Note:** Information about jobs can only be viewed by site administrators. ## Overview This topic describes how to view and understand the information displayed in the Jobs page. Your Tableau Cloud site comes with capacity to support all your users’ analytic needs. A site’s capacity includes capacity for storage and tasks that need to be performed on the site for extracts, metrics, subscriptions, and flows. (The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm).) The jobs page allows you to monitor the tasks for your Tableau Cloud site. For more information on site capacity, see [Tableau Cloud Capacity](https://help.tableau.com/v0.0/online/en-us/to_site_capacity.htm). At the top of the page there are high level statistics for the number of **Failed**, **Completed**, and **Canceled** jobs within the past 24 hours. Applying filters does not change these values. ![Jobs page table displaying job IDs, statuses, task types, and run times.](/tableau/next/en-us/online/en-us/Img/jobs_page.png) For each job generated, there is a Job ID, the status of that job, the priority, the type of task that the job was generated from, the content associated with the job, the current run time - if the job is in-progress, current queue time - if queued, as well as the average run time, and average queue time. Select a name in the **Content** column to go to that content's page. If the content was deleted, the **Content** column doesn't show a name or link. **Note:** The priority for tasks and schedules can't be adjusted in Tableau Cloud. Tableau records historical run times and queue times to compute the average run times and average queue times. Both average run times and average queue times are calculated as weighted averages using the following formula: ((current run time or queue time average x 4) + most recent run time or queue time)/ 5. For more information about a job and its task, select the Job ID to open the Task Details page. You can also use the Job ID to find the job in admin views. ### Task Details Starting in October 2026, the **Task Details** page shows information about a job's task and run history from the past 30 days. Use it to confirm that a task is running as expected. If something goes wrong, you can find out why a job failed and who owns the content, or spot patterns like repeated failures or longer queue times. You can open the **Task Details** page from the Jobs page in two ways: - Select a Job ID. - Select the ellipses next to the Job ID, and then select **View Details**. **Note:** If the content associated with a job was deleted, selecting the Job ID opens a dialog instead of the Task Details page. ![A Task Details page displaying task settings and a job run history table.](/tableau/next/en-us/online/en-us/Img/task_details.png) At the top of the page, you can see information about the task: - **Content**: The content associated with the task. Select the name to go to the content's page. - **Content owner**: The user who owns the content. - **Project**: The project that contains the content. - **Site**: The site that contains the content. - **Last successful run**: The date and time the task last ran successfully. - **Next run date and time**: The date and time the task is next scheduled to run. - **Average run time**: The average time the task's jobs take to run, calculated as a weighted average of the task's recent jobs. - **Average queue time**: The average time the task's jobs wait in the queue before they start, calculated the same way as average run time. - **Task type**: The kind of task, such as an extract refresh, subscription, or flow. - **Schedule**: How often the task runs, including the time and time zone. - **Priority**: The task's priority. Lower numbers have higher priority. - **Task creator**: The user who created the task. The **Job Run History** section lists each job that the task generated in the past 30 days, with the most recent job first. Scroll down to load older jobs. For each job, you can see: - **Job ID**: The job's ID number. Use it to find the job in admin views. - **Job LUID**: The job's unique identifier. Use it to refer to the job in the REST API. - **Status**: The job's status, such as Completed, Failed, or Canceled. - **Details**: Messages about the job. For example, a subscription job shows how many views were sent successfully. Other messages include a failure reason, a delay message, or the reason the job was canceled. - **Bridge**: For Bridge refresh jobs, the Bridge pool and client that the job ran on. - **Scheduled At**: The date and time the job was scheduled to run. - **Started At**: The date and time the job started running. - **Completed At**: The date and time the job finished. - **Queue Time**: The time the job waited in the queue before it started. - **Run Time**: The time the job took to run. ### Task Types There are several types of tasks: - Extracts: Includes extract creation, incremental extract refreshes, and full extract refreshes. Extracts can run on a schedule or manually with **Run Now**. - Bridge Refresh: Includes full and incremental extract refreshes that use Cloud schedules. For more information, see [About Bridge Refresh jobs](#bridge). - Subscriptions: Includes subscriptions for workbooks and views. Subscriptions can run on a schedule or when data refreshes. For more information, see [Create a Subscription to a View or Workbook](https://help.tableau.com/v0.0/online/en-us/subscribe_user.htm). - Flow: Includes scheduled flows and manual flow runs. See [Job runtime capacity](https://help.tableau.com/current/online/en-us/to_site_capacity.htm) for information about the maximum runtime for flows and [Concurrent jobs capacity](https://help.tableau.com/current/online/en-us/to_site_capacity.htm) for capacity limits when running concurrent flow jobs. Scheduling more flows than the number of resource blocks you have can result in an error. See the Knowledge Base article [Flow Job Pending](https://kb.tableau.com/articles/Issue/flow-job-pending-with-cannot-run-because-your-site-has-reached-its-concurrency-limit-for-extract-refreshes) for more information. - Encryption: Includes the following: - Extract encryption and decryption - Flow encryption and decryption - Re-key extracts and flows ### Filters You can filter to see only certain jobs. The available filters are by Job Status type, Task Type, and Time Range. For the Time Range filter, you can choose from past one to 24 hours, in four hour increments. ## Canceling Jobs Extract refreshes, subscriptions and flow run jobs can be canceled. You can only cancel one job at a time, and selecting multiple jobs at one time for cancellation is not supported. When you cancel a job, an email with the time the job was canceled, the affected content, and the time the job ran before being canceled is sent to the recipients that you select in the **Cancel Job** dialog box . In addition you can add your customized notes to be included in the email. If you do not select any recipients, the job will be canceled, but no email will be sent. To cancel a job, select the ellipses next to the Job ID, and then use the dialog to cancel the job: ![Cancel button.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_cancel.png) ## Status There are seven types of status that jobs can be in, and hovering over each status will display more relevant information. - **Completed:** This job shows as **Completed successfully** and you can see the time when the job completed in the tooltip that is displayed when you hover over the status. ![A green checkmark appears next to the word "Completed."](/tableau/next/en-us/online/en-us/Img/backgrounder_job_completed.png) ![A message indicates that a job successfully completed on June 13, 2019, at 10:23 AM.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_completed_tootip.png) - **In Progress:** This job shows as **In Progress**. A time for how long the job has been running for is displayed in the tooltip when you hover over the status. ![In progress icon.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_inprogress.png) ![A tooltip showing the in progress job run time.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_inprogress_tooltip.png) - **In Progress:** This job is **In Progress**, but is **running late**. Tableau keeps track of the average run times for the same job, and if the current run time is longer than the average run time, then it is considered running late. Times for how much longer than average the job has been running and its average run time is provided in the tooltip that is displayed when you hover over the status. ![In progress icon indicating a longer job run time than previous runs.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_late.png) ![A tooltip showing the in progress job run time that exceeds previous run times.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_late_tooltip.png) - **Pending:** This job is currently **Pending**, waiting to be run when there is available Backgrounder capacity. A time for how long the job has been in the queue for is provided in the tooltip that is displayed when you hover over the status. ![Job Queued icon.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_queued.png) ![A tooltip showing the in progress queue time.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_queued_tooltip.png) - **Pending:** The flow cannot be run because the number of Resource Blocks is less than the number of flow you have scheduled and the site has reached its concurrency limit. ![Job Queued icon.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_queued.png) ![A notification stating that a queued job cannot run because the site reached its extract refresh concurrency limit.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_pending_flow.png) - **Pending:** This job is currently **Pending**, but is **running late**. Tableau keeps track of the average queue times for the same job, and if the current queue time is longer than the average queue time then it is considered running late. Times for how much longer than average the job has been queued is provided in the tooltip that is displayed when you hover over the status. ![Job Queued icon indicating a longer queue time than previous runs.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_queued_late.png) ![A tooltip showing the in progress queue time that exceeds previous queue times.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_queued_late_toolip.png) - **Canceled:** This job was **Canceled** by a Site administrator. The time the job was canceled and how long it ran for before cancellation is provided in the tooltip that is displayed when you hover over the status. ![A yellow exclamation point and the word "Cancelled."](/tableau/next/en-us/online/en-us/Img/backgrounder_job_canceled.png) ![A message indicates that a job was cancelled on June 11, 2019 at 9:55pm after running for 29.5 minutes.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_canceled_tooltip.png) - **Failed:** This job is showing as **Failed**. The time when the job failed, how long it ran for before it failed, and why the job has failed is provided in the tooltip that is displayed when you hover over the status. ![A red exclamation point next to the word "Failed."](/tableau/next/en-us/online/en-us/Img/backgrounder_job_failed.png) ![Message indicates that a job failed on June 11, 2019 at 4:23am after running for 51.6 minutes because of invalid credentials.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_failed_tooltip.png) - **Suspended:** This job is showing as **Failed** with a pause icon. If the job fails 5 times consecutively, then the job is suspended. Suspended tasks are still available but Backgrounder will not create jobs for these tasks until they are resumed by the user. ![Job Suspended icon.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_suspended.png) ![A tooltip explaining that jobs can't run for suspended tasks.](/tableau/next/en-us/online/en-us/Img/backgrounder_job_suspended_details.png) ### About Bridge Refresh jobs Although Bridge Refresh jobs can generate the same statuses as other job types, Bridge Refresh jobs differ in the following ways: - **Canceling jobs**: Bridge Refresh jobs can't be canceled from the Jobs page. Instead, ensure that Bridge clients are configured with the appropriate timeout limit to prevent any misuse of refreshes. For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#timeout) - **"Sent to Bridge" job status**: The refresh job was successfully sent to a Bridge client in the pool. - **"Completed" job status**: The refresh completed successfully. - **"Failed" job status**: If a refresh fails for whatever reason, the status changes to "Failed." The publisher (data source owner) is notified through an account alert and a failure email alert. These alerts provide the publisher troubleshooting steps to help resolve the issue. - **Subscription and Bridge Refresh jobs**: Subscription jobs can't be initiated by completed Bridge Refresh jobs. This is because a completed Bridge Refresh job only indicates whether the refresh job was successfully sent to a Bridge client in the pool and not whether the refresh job was completed successfully. **Notes:** - Refresh jobs that originate from Bridge (legacy) schedules are not captured on the Jobs page. To monitor refresh jobs for Bridge (legacy) schedules, you can refer to the Bridge Extracts admin view. For more information, see [Bridge Extracts](https://help.tableau.com/v0.0/online/en-us/adminview_bridge_extract.htm). - For troubleshooting Bridge errors you see on the Jobs page, see [Troubleshoot pooling](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#errors). ### Monitoring solutions for Data Connect and Tableau Bridge Several monitoring solutions are available in Tableau Cloud to help you manage different monitoring scenarios for Data Connect and Tableau Bridge. All of these solutions are available to administrators by default. Admin Insights can be made available for other individuals if desired. - Jobs page: Monitor real-time extract job status for jobs performed in the last 24 hours as described earlier in this topic. - Administrative Views: Monitor real-time extract job status and performance. Includes recent job history for longer term analysis. See [Find Admin Views](https://help.tableau.com/v0.0/online/en-us/adminview.htm). - Admin Insights: Monitor job status and performance using Tableau Cloud data sources that are published in your environment. This data is updated daily and shows historical data for longer term analysis. It can be shared with non-admin users if desired. See [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). For more information on how to use these tools and other best practices for deploying Data Connect and Bridge, download the whitepaper, [Accessing Your Private Network Data with Tableau Cloud - Best Practices for Data Connect and Tableau Bridge](https://www.tableau.com/learn/whitepapers/tableau-bridge-data-connect-best-practices-guide). [Skip to main content](#main-content) # Migrate from Customer-Managed Encryption Keys to External KMS > [!WARNING] > > **Note:** Switching from customer-managed encryption keys to an external key management service (KMS) is permanent and can't be undone. For more information on using an external KMS, see [Use an External KMS for Key Management](https://help.tableau.com/v0.0/online/en-us/to_external_kms.htm). Migrating from customer-managed encryption keys (which use Salesforce's KMS) to an external KMS is simple, but it's permanent and can't be undone. After the change, you’ll manage your keys in the external KMS instead of Salesforce's KMS. Be sure that you understand how to perform basic key functions in the external KMS before you migrate from customer-managed encryption keys to an external KMS. After the migration, the key derived from the external KMS will write new extracts. The Salesforce KMS key will continue to read extracts that it wrote, until the extracts are refreshed with the external KMS-based key. For more information on customer-managed encryption keys and the Salesforce KMS, see [Customer-Managed Encryption Keys](https://help.tableau.com/v0.0/online/en-us/to_customer_managed_encryption_keys.htm). To migrate from customer-managed encryption keys to an external KMS: 1. Log in to your Tableau Cloud site. 2. Select Settings in the left navigation pane. 3. Select the Security tab. 4. Under the Extract Encryption section, change the selection from Use the Salesforce KMS to Use an external KMS. 5. Read the warning, then select Switch to External KMS. [Skip to main content](#main-content) # Migrate from Tableau Bridge to Outbound Private Connect Tableau Bridge, Data Connect, and Private Connect all satisfy security and network requirements that are common when working with Tableau Cloud and private data. In some cases, Private Connect offers a simpler and lower maintenance solution than Tableau Bridge or Data Connect, and you may want to update a workbook or data source so that it uses Private Connect instead of Tableau Bridge or Data Connect. You can update a workbook or data source to use Private Connect by changing the connection server name (and port if required). ## Update a data source or workbook to use a private connection ### Prerequisites You need to know the following: - The Connection Address for the private connection. The site administrator and cloud administrator have access to the connection address. - The port number for the database, if different than the current one. The port number depends on the configuration of the endpoint service in AWS, and the person who configured it (or interacted with the party that did) should know if a different port number is required. The site administrator and cloud administrator should also know. ### Update the connection information 1. In the left navigation, select Explore. 2. Go to the published data source or workbook. 3. If it's a data source, go to the Connections tab. If it's a workbook, go to the Data Sources tab. 4. Select the Actions menu (...) for the connection or data source, then select Edit Connection. 5. Change Server name to the private connection Connection Address. 6. Change Server port to the new port (if a change is required). 7. Change Network type to Tableau Cloud. 8. Select Save. ### Considerations for assets with scheduled extract refreshes - Changing the Network Type from Private Network to Tableau Cloud does not change the network type used by existing extract refresh schedules. If you change the network type for an asset that has an existing extract refresh schedule associated with it, you must create a new extract refresh schedule. - Extract refreshes over private connections count towards [concurrent refreshes](https://help.tableau.com/v0.0/online/en-us/to_site_capacity.htm#site-extract-refresh-capacity), whereas some extract refreshes using Tableau Bridge don't. [Skip to main content](#main-content) # Migrate Rserve Connections from TCP to HTTP Beginning October 2026, you can connect to Rserve over HTTP. Before October 2026, Tableau communicated with Rserve only at the transport layer (TCP). An Rserve-by-HTTP connection uses the [Analytics Extensions API](https://tableau.github.io/analytics-extensions-api/), so it has the same advantages that TabPy and other analytics extensions have in Tableau: - Access to [model calculations](https://help.tableau.com/current/pro/desktop/en-us/r_connection_manage.htm#directly-query-external-analytics-models) and the [Function Explorer](https://help.tableau.com/current/pro/desktop/en-us/r_connection_manage.htm#custom-functions-explorer-for-deployed-models). - Simple requests to your extension are up to 10 times faster. - The payload limit increases from 6 MB to 100 MB. - The request timeout increases from 30 seconds to 60 minutes. **Note**: Rserve-by-TCP doesn't have a deprecation date, but eventually Rserve will be available only over HTTP. If you migrate now, you get the benefits of Rserve-by-HTTP right away and you won't need to take action later. The migration is a one-time process: 1. [Step 1: Set up an HTTP endpoint for Rserve](#step1RserveHTTP) 2. [Step 2: Replace or update the Rserve connection](#step2RserveHTTP) - Either: - **Create a new Rserve HTTP connection**. This approach allows you to leave the existing connection alone while you create and test a new Rserve connection. You will need to edit your workbooks one by one to complete the migration. - **Edit your existing Rserve connection so it uses HTTP**. This approach is faster, but automatically updates the connection for all workbooks using it. 3. (Optional) [Step 3: Update workbook connections](#step3RserveHTTP) - If you choose to create a new Rserve HTTP connection, you will need to update any workbooks using the old connection so they use the new connection. For general information about configuring analytics extensions, see . [Configure Connections with Analytics Extensions](https://help.tableau.com/v0.0/online/en-us/config_r_tabpy.htm). . For information about using analytics extensions in workbooks, see [Pass Expressions with Analytics Extensions](https://help.tableau.com/current/pro/desktop/en-us/r_connection_manage.htm) in the _Tableau Desktop and Web Authoring Help_. ## Impact on users Once Rserve connections are migrated to HTTP there should be little or no impact on authors and business users. The analytics experience doesn't change, other than potentially faster performance and access to the Function Explorer. Existing content will continue to work after its connection is updated. ## Step 1: Set up an HTTP endpoint for Rserve To migrate Rserve from TCP to HTTP, you replace your existing Rserve connection with one that works through the Analytics Extensions API. You can use any method, as long as it implements the Analytics Extensions API, specifically the `/info` and `/evaluate` endpoints. We recommend [RestRserve](https://restrserve.org/), which is the method described in this section. Alternatively, you can use [Posit Connect](https://docs.posit.co/connect/admin/integrations/tableau/) (previously RStudio Connect) as your R integration, but that method requires changes to existing workbooks. For an example using RestRserve, see the [Example - RestRserve](https://tableau.github.io/analytics-extensions-api/docs/ae_example_rserve.html "RestRserve example on GitHub") on the Tableau Analytics Extensions API GitHub site. ## Step 2: Replace or update the Rserve connection New Rserve connections use HTTP by default. To switch a connection between HTTP and TCP, click Use TCP or Use HTTP in the upper-right corner of the Rserve connection dialog. The option will change depending on what type of connection is configured. For default HTTP connections, the dialog looks like this: ![New Rserve HTTP Connection dialog with the Use TCP link in the upper-right corner, and fields for connection name, hostname, port, username, and password.](/tableau/next/en-us/online/en-us/Img/rserve-http-connection-dialog.png) Switch to an HTTP Rserve connection in one of two ways: - **Create a new connection**: Create a new connection with Rserve as the connection type (this will default to HTTP) while leaving your existing TCP connection in place. Using this approach you can create and test the new connection with one or more workbooks to make sure it works as expected. You then need to switch each workbook from the old connection to the new one. Once all workbooks are updated to use the new connection, you can delete the old connection. For details, see [Configure Connections with Analytics Extensions](https://help.tableau.com/v0.0/online/en-us/config_r_tabpy.htm#configure-analytics-extensions-settings). or - **Edit the connection in place**: Edit the existing Rserve connection and change it from TCP to HTTP by clicking Use HTTP. Using this approach you can quickly update all workbooks by editing the existing Rserve connection. Once edited, any workbook using the existing connection will automatically be using the updated connection with HTTP. **Important**: Editing the connection in place immediately switches every workbook using the connection to HTTP. Because of this you should test your new HTTP endpoint using a single workbook before you edit the existing connection. ## Step 3: Update workbook connections If you created a new connection instead of editing the existing connection, after testing to ensure the new HTTP connection works, update the connection in each workbook that uses the Rserve analytics extension. You can either do this manually following the steps in in the Desktop and Web Authoring Help, or automate the process using the [Update analytics extension for workbook](https://help.tableau.com/current/api/rest_api/en-us/REST/TAG/index.html#tag/Analytics-Extensions-Settings-Methods/operation/AnalyticsExtensionsService_updateWorkbookWithConnection) API method. [Skip to main content](#main-content) # Migrate Workbooks and Data Sources with Embedded Credentials Starting in version 2023.1, authorized users can migrate workbooks and published data sources with embedded credentials from Tableau Server to Tableau Cloud. Additional configuration is required before migrating with Content Migration Tool. **Note:** Content Migration Tool does not support embedded credential migration for OAuth connections. For more information, see [Migration Limitations](https://help.tableau.com/v0.0/online/en-us/cmt-migration_limitations.htm). ## Overview Migrating embedded credentials using Content Migration Tool (CMT) is available when connecting to Tableau Server as the source site and Tableau Cloud as the destination site. Both sites must have an [Advanced Management](https://help.tableau.com/v0.0/online/en-us/itm_intro.htm) license. Now that we've covered the requirements, let's discuss how migration works. You'll need to work closely with the Tableau Cloud site administrator and TSM administrator (sometimes the same person) to allow the feature and authorize a site user. After the feature is activated, the authorized site user builds a migration plan and selects the publish options _Migrate Embedded Credentials for Workbooks_ and _Migrate Embedded Credentials for Data Sources_. When running the migration plan, all required content credentials are transmitted in an encrypted content manifest from Tableau Server to Tableau Cloud. As CMT publishes content, the destination Tableau Cloud site embeds matched credentials securely from the manifest into the content (workbooks or published data sources). Any problems that occur during migration will appear in the Errors and Warnings tab in CMT. For more information, see [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm). ## Allow embedded credential migration Use the following steps to allow embedded credential migration from Tableau Server to Tableau Cloud. ### Tableau Cloud 1. Open a browser window and sign in to Tableau Cloud as a site administrator. 2. Select Settings > General, and scroll down to Manage Content Migration. ![Manage content migration encryption keys interface with options to create new keys.](/tableau/next/en-us/online/en-us/Img/cmt-plan-manage-content-migration.png) 3. Click Create new key to generate an encryption key pair. **Note:** The public key is only displayed once. If you lose the key before completing the configuration, you'll need to generate a new key. 4. In the resulting window, click Copy to clipboard and then close the window. 5. Paste the public key to a file and store it in a safe location. The TSM administrator will use the public key to allow migration. You can view the public key expiration date on the Settings page. ### TSM Command Line Interface 1. Depending on your operating system, do one of the following: - Tableau Server on Windows: Open Windows Command Prompt with an account that is a member of the Administrators group on a node in the cluster. - Tableau Server on Linux: Open a command prompt with an account that is a member of the `tsmadmin` group on a node in the cluster. 2. Use `tsm security authorize-credential-migration` to allow embedded credential migration to the Tableau Cloud site. For more information, see [tsm security](https://help.tableau.com/current/server-linux/en-us/cli_security_tsm.htm) in Tableau Server help. `tsm security authorize-credential-migration --source-site-url-namespace --destination-site-url-namespace --destination-server-url --authorized-migration-runner --destination-public-encryption-key ` **Note:** When running TSM commands from a remote node, use `tsm login` to authenticate a session with the Tableau Server Administration Controller service before running `tsm security authorize-credential-migration`. 3. (Optional) Use `tsm security cancel-credential-migrations` to cancel granted authorizations. By default, migration authorization will expire in 7 days or the number of days specified with the `--expiration-time-in-days` option. ### Content Migration Tool 1. Open Content Migration Tool and select Create New Plan or Browse for a Plan. 2. On the Sites page, click Sign in to Tableau, and connect to Tableau Server as the source and Tableau Cloud as the destination. Embedded credential migration is only available when migrating from Tableau Server to Tableau Cloud. 3. Build your migration plan and select the following Publish Options: - On the Workbook Publish Options page, select Migrate Embedded Credentials for Workbooks. For more information, see [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm). - On the Data Source Publish Options page, select Migrate Embedded Credentials for Data Sources. For more information, see [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm). 4. When you are ready, click Verify & Run to start the migration. The workbooks and published data sources you selected are migrated to your Tableau Cloud site and should not prompt for authentication. If you experience issues while migrating embedded credentials, see [Troubleshooting](#troubleshooting). ## Troubleshooting This section includes some common migration issues you might encounter and suggestions to resolve them. ### There is no option to migrate embedded credentials You can only migrate embedded credentials from a Tableau Server to a Tableau Cloud site. Tableau Server and Content Migration Tool must be running versions 2023.1 or later. For more information, see [Install Tableau Content Migration Tool](https://help.tableau.com/v0.0/online/en-us/cmt-install.htm). ### Migrating embedded credentials failed In the [Errors and Warnings](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm) tab of CMT, you may receive an error indicating that migrating the embedded credentials failed. This can occur when the public key used to authorize migration has expired. As a Tableau Cloud site administrator, go to the Settings page and verify that the public key is valid. You'll have to create a new encryption pair to authorize the migration if the public key expires. For more information, see [Allow embedded credential migration](#allow-migration). ## Who can do this? - Tableau Cloud site administrator and TSM administrator are required to allow embedded credential migration. - The authorized site user must have an Explorer role or higher. They must also have View and Download/Save a Copy capabilities for workbooks on the source site and View and Publish capabilities for target projects on the destination site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). [Skip to main content](#main-content) # Migrate Workbooks and Data Sources with Extracts Tableau Cloud users can publish extracts which are copies, or subsets of the original data. These extracts may be embedded in a workbook or a data source. By default, when you use the Tableau Content Migration Tool to migrate a workbook or data source that contains an extract, that extract is migrated along with the workbook or data source that contains it. The Content Migration Tool gives you a couple options for controlling this behavior: - **Switching to a Live Connection** You can add the Remove Extract transformation to your migration plan to remove the extract from your workbook or data source during migration. As always, the source workbook or data source will not be modified. The copy of the workbook or data source migrated to the destination project will have the extract removed from it. This effectively switches the data connection back to a live connection. - **Refreshing Extracts after Migration** You can enable the Refresh Extracts After Migration option in your migration plan to have an immediate extract refresh task scheduled after the workbook or data source is migrated. We don't recommend using the Refresh Extracts After Migration option if your migration plan also uses the Set Connection Info transformation to change the data connection to point to a different set of data (for example, a different database server or database). When you change the connection information to point to different data and use the Refresh Extracts After Migration option, this can unintentionally expose data in a way that is a potential security issue. For more information, see [Option 3: Refresh Extracts After Migration](#refresh-after-migration). #### Changing data connections that use extracts Tableau data connections are either live connections that directly query a data source, or they are extracts of a data source. Extracts are copies or subsets of the original data and can be embedded in a workbook or data source. When present, the views will query data from the extract instead of the underlying data source. Commonly, you'll want to modify the data source connection during the migration so that it points to a different database in the destination project than it did in the source project. For example, if you are migrating a workbook from your staging project to your production project, you will likely want to update the data connections inside the workbook to connect to your production database. You can implement this by using the Set Connection Info transformation in your migration plan. Now you have a migration plan which copies a workbook from staging to production and updates the data connections to point to the production database. If your workbook uses an extract, additional work is required. In this scenario, the workbook will be migrated and the live data connection updated. However, the views will still show data from the staging database since it still contains the staging database extract - copied from the source (staging) project. There are a few ways to address this. #### Option 1: Use Published Data Sources You can change your workbooks so that they use published data sources instead. This way, the extract will be managed as part of the published data source and migrating updates to the workbooks that use that data source can be simplified by not having to worry about the connection to the live database or the data extract. #### Option 2: Remove the Extract During Migration You can add a Remove Extract transformation to your migration plan. This will remove the extract from your workbook, effectively switching the data source to a live connection. #### Option 3: Refresh the Extract After Migration You can use the Refresh Extracts After Migration option in your migration plan. This will migrate the extract along with the workbook but will schedule an immediate extract refresh task for that workbook after the migration is complete. This option is usually not recommended when used in combination with a Set Connection Info transformation because of potential security issues that it can introduce. The issue is that the migrated workbook in your destination project will still show the old (source) extract data for the period between the completion of migration and the completion of the extract refresh task. If the extract refresh task fails, then the old/source extract data will remain until the extract is refreshed. In a scenario like we've outlined above, migrating from a staging to production environment, this may be acceptable but you should be aware that the users of your workbooks may not be aware that the workbook is showing old/staging data due it being recently migrated and the extract not being refreshed yet. In other scenarios where you may be using Set Connection Info to change data connections to point to a different set of customer or client data, this could introduce serious security issues where the workbook's extract contains data from a different client or customer until the extract has been refreshed post-migration. One way to mitigate this issue is to implement a 2-stage migration. This approach requires you to create two migration plans, one for each step described below and ensures the workbooks and data sources have an up-t-o-date extract before they are accessible. - **Stage 1:** Migrate your content to a project on your destination site that only administrators have access to. This migration allows you to use the Refresh the Extract After Migration option along with the Set Connection Info transformation to update the data connection, because no unauthorized users will have an opportunity to see the old data, even if the extract refresh fails. - **Stage 2:** After stage 1 is complete and you confirm there is a successful extract refresh, run a second migration plan to migrate the content from the stage 1 destination to the final destination where it is visible to end-users. ## Who can do this Tableau site user with an Explorer role or higher. To migrate content, you must have **View** and **Download/Save a Copy** capabilities for workbooks on the source site and **View** and **Publish** capabilities for target projects on the destination site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). [Skip to main content](#main-content) # Migration Limitations There are certain limitations to migrations when using the Tableau Content Migration Tool. Before creating your migration plan, review the sections below to learn about version compatibility and content that will not be migrated. ## Compatibility with Tableau content The Content Migration Tool supports migrating workbooks and published data sources saved in the eight most recent versions of Tableau. Workbooks and published data sources saved before version 2018.1.x are not supported by CMT. For more information, see [Getting Started with Tableau Content Migration Tool](https://help.tableau.com/v0.0/online/en-us/cmt-getting-started.htm). Migrating content to previous Tableau versions can fail if the content includes features or formats not recognized by the previous version. The Content Migration Tool will tell you if incompatibilities are found, and the migration will fail. ## Configurations The following configurations are not migrated to the destination site when using the Content Migration Tool. - [Users](https://help.tableau.com/current/server/en-us/users_add.htm) - [Groups](https://help.tableau.com/current/server/en-us/users_add_group.htm) - [Site settings (custom logos, view recommendations, etc.)](https://help.tableau.com/current/server/en-us/sites_add.htm) ## Data connections While you can migrate existing data sources, only data sources that use the connection types in the table below can be changed and modified during migration. For more information, see Data Source Transformations in [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm) and [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm).

Actian Matrix

Actian Vectorwise

Amazon Athena

Amazon Aurora

Amazon EMR

Amazon Redshift

Apache Drill

Aster Database

Box

Cloudera Hadoop

Delimited Text File

EXASOL

Firebird

Google Analytics

Google BigQuery

Google Cloud SQL

Google Drive

HortonWorks Hadoop Hive

HP Vertica

IBM DB2

IBM Netezza

Map R Hadoop Hive

Microsoft Access

Microsoft Analysis Services

Microsoft Excel

Microsoft Excel Direct

Microsoft OneDrive

Microsoft SQL Server

MySQL

OData

Oracle

Oracle Essbase

Pivotal Greenplum Database

PostgreSQL

Progress OpenEdge

Salesforce

SAP HANA

SAP Sybase ASE

SAP Sybase IQ

Snowflake

Spark SQL

Statistical File

Tableau Extracts

Tableau Server Data Sources

Teradata

Text File

Web Data Connector

Other Databases (ODBC)

## Unsupported content The following content is not migrated to the destination site when using the Content Migration Tool and will require additional configuration.

Content	Action required
Ask Data lenses	Users must recreate Ask Data lenses on the destination site. For more information, see Create Lenses that Focus Ask Data for Specific Audiences.
Collections	Users must recreate collections on the destination site. For more information, see Collections in Tableau Desktop help.
Comments	Users must re-add comments to views on the destination site. For more information, see Comment on Views in Tableau Desktop help.
Custom views	Users must recreate custom views on the destination site. For more information, see Use Custom Views in Tableau Desktop help.
Data freshness policy	Defaults to the site default upon publishing. Users must manually set it up if a specific freshness policy is needed. For more information, see Set a Data Freshness Policy in Tableau Cloud or Set a Data Freshness Policy in Tableau Server help.
Data roles	Users must recreate data roles on the destination site. For more information see Use Data Roles to Validate your Data in Tableau Prep Builder help.
Data source certifications	If you have the following site roles and capabilities, you can certify data sources on the destination site. Site Administrator Creator Creator or Explorer (can publish) with Project Leader capability on the project containing the data source For more information, see Use Certification to Help Users Find Trusted Data.
Data-driven alerts	Users must recreate data-driven alerts for dashboards and views on the destination site. After data-driven alerts are created, anyone with access to the view can add themselves to existing alerts. For more information, see Send Data-Driven Alerts from Tableau Cloud or Tableau Server in Tableau Desktop help.
Descriptions for workbooks and data sources	If you own the content item or have the appropriate permissions, you can edit the item's description on the destination site. For more information, see Add or edit descriptions in Tableau Desktop help.
Embedded credentials	For security purposes, Tableau Server removes embedded credentials from data sources during the download process. To include embedded credentials when migrating from Tableau Server to Tableau Cloud, use the Migrate Embedded Credentials for Workbooks and Migrate Embedded Credentials for Data Source publish options. For more information, see Migrate Workbooks and Data Sources with Embedded Credentials. To include embedded credentials when publishing to Tableau Server sites, use the Set Connection Info data source transformation. For more information, see Migration Plans: Published Data Sources. Note: CMT does not support embedded credential migration for OAuth connections. To migrate OAuth credentials, use the Set Connection Info data source transformation.
External assets	Customized attributes for external assets are not migrated to the destination site. For example, tags, certifications, data quality warnings, descriptions, permissions, user contacts, tables, and columns must be recreated. For more information, see Manage Permissions for External Assets.
Extract refresh schedules	Extract refresh schedules cannot be migrated to Tableau Cloud destination sites. To refresh data on Tableau Cloud, you can run extract refreshes manually or create new extract refresh schedules. For more information, see Schedule Refreshes on Tableau Cloud.
Favorites	Users must reselect their favorite content on the destination site. For more information, see Mark Favorites in Tableau Desktop help.
Flows	To run flows on a schedule, users must republish flows to the destination site with Tableau Prep. For more information, see Publish a Flow to Tableau Server or Tableau Cloud in Tableau Prep help.
Incremental extract refreshes	Incremental extract refreshes are changed to full extract refreshes on the destination site. Users must reconfigure incremental refreshes in Tableau Desktop and publish extracts to the destination site after migration. For more information, see Refresh Extracts in Tableau Desktop help.
Metrics	The historical values for metrics are removed from views, and users must recreate metrics on the destination site. For more information, see Create and Troubleshoot Metrics (Retired). The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see Create and Troubleshoot Metrics (Retired).
Revision history	To migrate previous versions of workbooks to the destination site, users must download the versions they wish to keep and republish the workbook to the destination site. For more information see Work with Content Revisions in Tableau Desktop help.
Subscriptions	Users must resubscribe to views and workbooks on the destination site. For more information, see Create a Subscription to a View or Workbook.
Thumbnails for workbooks and views	Workbooks and views that are migrated using the Content Migration Tool will retain their original thumbnails, even if the migration plan includes transformations that result in the views being rendered differently (for example, if data connections change). To update thumbnails, edit the workbook or view on the destination site and re-save it. For more information, see Edit Tableau Views on the Web in Tableau Desktop help.
Virtual connections	Users must recreate virtual connections on the destination site. For more information, see Create a Virtual Connection.

[Skip to main content](#main-content) # Migration Plan Overview Tableau Content Migration Tool creates a streamlined process for migrating Tableau content between projects. The easy-to-follow plan can be audited, is repeatable, and works via a batch process so any number of workbooks and data sources can be migrated in a simple and efficient process. The Content Migration Tool will display contextual tips to walk you through creating or editing a migration plan. Once you select the source and destination sites, a summary of your migration will be displayed at the top of the screen as follows: ![Migrating from one website to another.](/tableau/next/en-us/online/en-us/Img/ptd-plan-summary.png) ## Limitations when migrating content Before you start, make sure you understand the limitations when migrating content using the Content Migration Tool. For more information, see [Migration Limitations](https://help.tableau.com/v0.0/online/en-us/cmt-migration_limitations.htm). ## Encryption keys Each migration plan file is generated with an encryption key unique to the application that created the plan. Encryption keys can be shared if the migration plan needs to be run through an application that did not originally generate the file. When sharing encryption keys, you will need to overwrite the existing key in the application to run the migration plan. To view your encryption key, select Help > Settings. ![Settings menu with options for legacy license key, diagnostics, and security encryption key.](/tableau/next/en-us/online/en-us/Img/cmt-plan-encryption.png) If you will be using the Content Migration Tool Console Runner for migration plans, you must specify the encryption key using the `tabcmt-runner encryption` command before running the plan. For more information, see [Using the Tableau Content Migration Tool Console Runner](https://help.tableau.com/v0.0/online/en-us/cmt-deployment_console_runner.htm). ## Migration process ### Step 1: Start The core of the migration process is creating a plan, which you can save and re-use for future migrations or modify and update as needed. The first step is choosing whether to create a new plan, or select a previously saved plan. To create a new plan, click Create New Plan. If you already created a migration plan and want to use it, click Browse for a Plan. ![Buttons labeled "Create New Plan" and "Browse for a Plan."](/tableau/next/en-us/online/en-us/Img/ptd-plan-start.jpg) By default, all of your saved migration plans will be stored in the `Tableau Content Migration Tool Plans` folder in your My Documents folder. All migration plans are saved with a `.tcmx` extension, with recently accessed plans listed separately to make them easy to select: ![Path to Create New Plan, Browse for a Plan, and view Recent Plans.](/tableau/next/en-us/online/en-us/Img/ptd-plan-recent.png) You can select a recently accessed plan and duplicate it to modify the plan and save it as a new plan. Select the plan you want to copy and click Duplicate. ![A Duplicate icon.](/tableau/next/en-us/online/en-us/Img/cmt-icon-duplicate.png) ### Step 2: Planning The Content Migration Tool guides you through building or editing your migration plan in six steps. Click on each step for detailed instructions: - [Migration Plans: Sites](https://help.tableau.com/v0.0/online/en-us/cmt-plan_servers.htm) - [Migration Plans: Source Projects](https://help.tableau.com/v0.0/online/en-us/cmt-plan_source_projects.htm) - [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm) - [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm) - [Migration Plans: Permissions and Ownership](https://help.tableau.com/v0.0/online/en-us/cmt-plan_users.htm) - [Migration Plans: Migration Scripts](https://help.tableau.com/v0.0/online/en-us/cmt-plan_scripts.htm) - [Migration Plans: Plan Options](https://help.tableau.com/v0.0/online/en-us/cmt-plan_options.htm) ### Step 3: Migration Once you have completed your plan, you are now ready to run the batch process for migration. When you reach the final step of the migration, a plan summary displays for your verification: ![Review plan summary with a list of data sources detailing the review's source, destination, projects, workbooks, published data sources, and auto-archive.](/tableau/next/en-us/online/en-us/Img/ptd-plan-summary-verification.png) If you want to change any aspects of your plan, you can click on a section in the left sidebar to go directly to that phase. When you are ready, click Run to begin your migration. When you click Run, the migration tool will prompt you about any unsaved elements of your plan. By default, any unsaved elements will be saved when you click Yes. Remember you can always keep your previous plan without making any changes by duplicating it during the Start phase of the migration process. ![Option to confirm plan save.](/tableau/next/en-us/online/en-us/Img/ptd-plan-save-confirm.png) Your migration plan will run and a status bar displays for the overall plan progress and each workbook being sent to the destination server. ![A progress bar indicating the download of source workbooks and test data for 2019.](/tableau/next/en-us/online/en-us/Img/ptd-plan-status.png) When the plan finishes running, you can click the tabs at the bottom of the screen for more information about the migration. #### Published workbooks Published Workbooks details the newly published workbooks and the projects where they were migrated. ![A table displaying published workbooks, projects, and a link to view the data on Tableau Server.](/tableau/next/en-us/online/en-us/Img/ptd-plan-pub-workbooks.png) #### Published data sources Published Data Sources details the newly published data sources and the projects where they were migrated. #### Output The Output tab details the migration log of your plan. ![Information about a Tableau Content Migration Tool run.](/tableau/next/en-us/online/en-us/Img/ptd-plan-output.png) You can save this log by clicking Save Log. ![A Save Log icon.](/tableau/next/en-us/online/en-us/Img/cmt-icon-save-log.png) #### Errors and warnings The Errors and Warnings tab highlights any problems that occurred during the migration. ![A table of errors and warnings, complete with messages, workbooks or data sources, and projects.](/tableau/next/en-us/online/en-us/Img/ptd-plan-errors.png) You can correct these and rerun your plan. When you have completed your migration and saved your plan, click Done to finish. ![A Done icon.](/tableau/next/en-us/online/en-us/Img/cmt-icon-done.png) ## Who can do this Tableau site user with an Explorer role or higher. To migrate content, you must have **View** and **Download/Save a Copy** capabilities for workbooks on the source site and **View** and **Publish** capabilities for target projects on the destination site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). ## Other articles in this section [Skip to main content](#main-content) # Migration Plans: Migration Scripts The next step of creating a migration plan in the Tableau Content Migration Tool is to create any scripts you want to run with your plan before or after migration. ## Step 1: Pre-Migration The Run Pre Migration section of the screen is dedicated to scripts that will run before the migration. ![Settings to enable running pre-migration.](/tableau/next/en-us/online/en-us/Img/cmt-plan-script-pre.png) Each field has a help icon you can get information from by moving your cursor over it. To start with your pre-migration scripts, select Enable, which will then activate the fields below. #### Working Directory This is the working directory for the script. The default directory is the same folder as the migration plan. Click on the browse button to select a different folder. The Reset button will restore the current migration plan folder as the working directory. #### Run This drop down allows you to choose either to run a custom script or an executable with parameters. #### Command Executable If you selected Executable with Parameters from the Run menu, this field will appear. This is the file path to the command executable to run before migration. Type it in directly or use the browse button to find the executable. This is a required field. #### Command Parameters If you selected Executable with Parameters from the Run drop-down menu, this field will appear. Enter in command line parameters here to use with the command executable. #### Script If you selected Custom script from the Run menu, enter in your pre-migration script here. It will be executed as a \*.cmd file. This is a required field. ## Step 2: Post-Migration The Run Post Migration half of the screen is dedicated to scripts that will run after migration. ![Interface for configuring post-migration scripts with fields for executable and parameters.](/tableau/next/en-us/online/en-us/Img/cmt-plan-script-post.png) Each field has a help icon you can get information from by moving your cursor over it. To start with your post-migration scripts, select Enable, which will then activate the fields below. #### Working Directory This is the working directory for the script. The default directory is the same folder as the migration plan. Click on the browse button to select a different folder. The Reset button will restore the current migration plan folder as the working directory. #### Run This drop down allows you to choose either to run a custom script or an executable with parameters. #### Command Executable If you selected Executable with Parameters from the Run menu, this field will appear. This is the file path to the command executable to run before migration. Type it in directly or use the browse button to find the executable. This is a required field. #### Command Parameters If you selected Executable with Parameters from the Run menu, this field displays. Enter in command line parameters here to use with the command executable. #### Script If you selected Custom script from the Run menu, enter in your post-migration script here. It will be executed as a \*.cmd file. This is a required field. ## Step 3: Continue to Next Step When you are ready, click Next. ![A Next icon.](/tableau/next/en-us/online/en-us/Img/cmt-icon-next.png) ## Who can do this Tableau site user with an Explorer role or higher. To migrate content, you must have **View** and **Download/Save a Copy** capabilities for workbooks on the source site and **View** and **Publish** capabilities for target projects on the destination site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). [Skip to main content](#main-content) # Migration Plans: Permissions and Ownership The Content Migration Tool allows you to replicate workbook and data source permissions to different users. You can create user permissions mappings to customize and secure content after it has been published to the destination location. Mappings are applied if Copy Project Permissions, Copy Workbook Permissions, or Copy Data Source Permissions have been selected earlier in the planning phase, along with Apply User Mappings. For more information, see [Migration Plans: Source Projects](https://help.tableau.com/v0.0/online/en-us/cmt-plan_source_projects.htm), [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm), and [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm). ## Mapping limitations - Content Migration Tool will stop the migration process if it fails to find the mapped user or group in the destination location. Subsequent user or group permissions mappings are not checked after the first failure, and the plan must be run again. - Content Migration Tool cannot replicate permissions if the source content has permissions for multiple users and groups with identical names. This only occurs when there are duplicate user or group names sourced from separate domains. ## Step 1: Add mapping To add user permissions mapping, click Add Mapping and select whether to change the name of a domain, user, group or to import mappings from a comma-separated values (CSV) file. If Content Migration Tool is unable to match a permission in the destination location, the source content will not be migrated. ![User mapping addition interface with options for domain, user, and group mapping.](/tableau/next/en-us/online/en-us/Img/cmt-plan-user-add.png) ### Domain Mapping Domain permissions mapping applies to all users and groups in the destination location. If you are unsure about the source or destination domain, you can check the user and group pages on your Tableau site. If local user provisioning has been selected, the domain must be specified as `local`. ![Domain mapping interface showing source and destination domain fields.](/tableau/next/en-us/online/en-us/Img/cmt-plan-user-domain-mapping.png) ### User Mapping User permissions mapping automatically populates a list of users from the source and destination locations using the syntax `domain\user`. You cannot enter and save the names of users that don't exist. **Note:** When migrating between projects on the same site, the destination location and list of users will be the same. You can use mappings to update content ownership from `User_A` to `User_B` on the site. ![User mapping addition interface with options for domain, user, and group mapping.](/tableau/next/en-us/online/en-us/Img/cmt-plan-user-mapping.png) ### Group Mapping Group permissions mapping automatically populates a list of users from the source and destination locations using the syntax `domain\group`. You cannot enter and save the names of groups that don't exist. ![Edit mapping interface showing source and destination group mapping options.](/tableau/next/en-us/online/en-us/Img/cmt-plan-group-mapping.png) ## Import mappings from a CSV file Starting in version 2021.4, you can import a CSV file containing domain, user, and group mappings to quickly prepare your data for migration. Importing mappings can reduce the manual steps required to run a migration plan by allowing you to create and edit your mappings in bulk outside of Content Migration Tool. To import mappings, select Import from File from the Add Mapping menu. ### CSV file format requirements When you create a CSV file to import mappings, make sure that the file meets the following requirements: - The file does not include column headings. Tableau assumes that every line represents a mapping. - The file contains three comma-separated values per row: mapping type, source domain/user/group, and destination domain/user/group. - Include the domain for user names and groups if the server uses Active Directory authentication or "local" if a local identity store is used. You must specify "domain," "user," or "group" for mapping type, as shown in the following table. The source and destination columns provide example syntax for Active Directory and a local identity store. Actual values in the CSV file will vary depending on your organization.

Mapping Type	Source	Destination
domain	`<domain>`	`<domain>`
user	`<domain>`\`<user name>` local\`<user name>`	`<domain>`\`<user name>` local\`<user name`>
group	`<domain>`\`<group name>` local\`<group name>`	`<domain>`\`<group name>` local\`<group name>`

### Import user permissions mappings To import user permissions mappings in the Content Migration Tool: 1. Click Add Mapping and select Import from File. 2. In the dialogue window, click Export CSV to export a .csv file containing all users and groups from the source site. Edit the resulting file in a text editor to add mappings for the destination site. If you already have a mapping file, skip to step 3. **Note:** The exported CSV file doesn't include domains from the source site. Domains must be added manually to the CSV to create domain mappings. 3. Click Import Mappings and select the mapping file you want to import. Content Migration Tool will validate the mappings for errors when importing the file. If errors are detected, you must fix each error in the CSV file and then import it again. ### CSV import example The following example shows a CSV file that contains multiple mapping types. user,local\\hwilson,companyx.lan\\henry.wilson user,local\\jjohnson,companyx.lan\\janna.johnson user,local\\mkim,companyx.lan\\michele.kim user,local\\fsuzuki,companyx.lan\\fred.suzuki user,local\\awang,companyx.lan\\alan.wang user,local\\snguyen,companyx.lan\\susan.nguyen user,local\\lrodriguez,companyx.lan\\laura.rodriguez user,local\\agarcia,companyx.lan\\ashley.garcia group,local\\All Users,companyx.lan\\All Users group,local\\Finance Team,companyx.lan\\Finance Group domain,dev.mycompany,prod.mycompany A preview window is displayed while importing the CSV that shows mappings removed, added or updated, unchanged, and ignored. Review that the mapping changes are correct and click Accept. ![User mapping addition interface with options for domain, user, and group mapping.](/tableau/next/en-us/online/en-us/Img/cmt-plan-user-import-preview.png) Once the mappings are imported successfully, you can edit, delete, or change the mapping order as described in Step 2. ## Step 2: Change mapping order After a permissions mapping is created, you can change the order using the Up or Down options to determine when it will be handled during the migration. When a domain, user, or group is handled in a permissions mapping, any subsequent permissions mappings for the source domain, user, or group will be ignored. In the example below, permissions for `User_A` are mapped to `User_B`. Content Migration Tool will ignore the second permissions mapping because `User_A` has already been handled. ![User mapping interface with options to edit, delete, and reorder mappings.](/tableau/next/en-us/online/en-us/Img/cmt-plan-user-order_example.png) In the example below, the first permissions mapping associates the domain for all users to `prod`. Content Migration Tool will ignore the second permissions mapping because the domain for `User_A` has already been handled. ![User and domain mapping interface with options for editing and reordering.](/tableau/next/en-us/online/en-us/Img/cmt-plan-user-override_example.png) ## Step 3: Continue to next step When you are ready, click Next to continue to the [Migration Plans: Migration Scripts](https://help.tableau.com/v0.0/online/en-us/cmt-plan_scripts.htm) section of the planning phase. ## Who can do this Tableau site user with an Explorer role or higher. To migrate content, you must have **View** and **Download/Save a Copy** capabilities for workbooks on the source site and **View** and **Publish** capabilities for target projects on the destination site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). [Skip to main content](#main-content) # Migration Plans: Plan Options The last step of creating a migration plan in the Tableau Content Migration Tool is configuring the plan options. ## Step 1: Configure options ![Settings for planoptions including refresh extracts, error handling, and automatic creation of schedules](/tableau/next/en-us/online/en-us/Img/cmt-plan-options02.png) The Plan Name is the name of the plan as it will appear in Content Migration Tool. We recommend using a user-friendly name for your plan name. The following are available options: - Refresh Extracts After Migration: If selected, data extracts will be refreshed immediately after migration if Content Migration Tool detects they have been modified during migration. Click the Filter link to exclude specific extracts. For more information, see [Exclude extract refreshes](#exclude-extract-refreshes) below. - Automatically create Extract Refresh Schedules that do not Exist: Automatically creates destination extract schedules that do not exist. If not checked, source schedules that do not exist on the destination site will not be copied. - Continue Migration if Workbook or Data Source Fails: If checked, errors migrating a workbook or data source will not cause the migration to stop. The errors will be logged and the migration will continue. Errors during version control will always stop the migration. - Continue Migration if Permission or Ownership Mapping Fails: If checked, errors copying permissions or ownership will not cause the migration to stop. The errors will be logged and the migration will continue. ### Exclude extract refreshes By clicking Filter next to Refresh Extracts After Migration, you can choose the workbooks or published data sources that will not be refreshed automatically. Use the arrow buttons to select the items you want to exclude, and clickOK. ![Version control to archive workbooks and published data sources, along with where to archive them to.](/tableau/next/en-us/online/en-us/Img/cmt-plan-options-exclude-extract-refresh.png) ## Step 2: Version control These options allow you to avoid losing the existing workbooks in the destination site that might be replaced by the migrated workbooks. ![Version control to archive workbooks and published data sources, along with where to archive them to.](/tableau/next/en-us/online/en-us/Img/cmt-plan-options-version-control.png) Select Enable to save previous versions of your content. You can choose to archive workbooks and/or published data sources. Once version control is enabled, you must select a project from the Archive To menu, which lists all of the projects in your site. We recommend creating a separate archive project to store your versioned content. Click the refresh button to display any projects that have been added or modified on the site. ## Step 3: Save plan Once you have selected your plan options, click Save Plan to save your plan for future use. The plan will be saved to the `Documents\Tableau Content Migration Tool Plans` folder on your local machine. ## Step 4: Continue to next step When you are ready, click Verify & Run to end the Planning phase and prepare to run your plan. ## Who can do this Tableau site user with an Explorer role or higher. To migrate content, you must have **View** and **Download/Save a Copy** capabilities for workbooks on the source site and **View** and **Publish** capabilities for target projects on the destination site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). [Skip to main content](#main-content) # Migration Plans: Published Data Sources The next step of creating a migration plan in the Tableau Content Migration Tool is to select, map, and add any transformations to your published data sources. The process is very similar to the Workbooks step of the planning phase, particularly the data source mapping step. **Note:** If your workbooks or data sources include extracts, be sure you read and understand the information in [Migrate Workbooks and Data Sources with Extracts](https://help.tableau.com/v0.0/online/en-us/cmt-migration_extracts.htm). ## Step 1: Selection Starting the Published Data Sources phase of the migration plan, you'll select any data sources you want to include in the migration plan: ![Data Source Selection for data mapping.](/tableau/next/en-us/online/en-us/Img/cmt-plan-datasource-selection.png) The data sources will only be selected at the moment of migration. You have two methods of selection. Use Specific Data Sources to choose one or more published data sources. Click Refresh to reload the list of published data sources available. The second option is All Data Sources, which selects every data source in the source site. ## Step 2: Mapping The next step is to map your source data sources to the new destination. This is similar in functionality to mapping workbooks. ![Data Source Mapping page with dropdown to Add Mapping.](/tableau/next/en-us/online/en-us/Img/cmt-plan-datasource-mapping.png) If you make no changes here, then the selected data sources will simply be deployed with the same name and project as the source. To add data source mapping click Add Mapping. The following options will appear in the mapping area. ![A form with fields for name, project, destination name, and destination project.](/tableau/next/en-us/online/en-us/Img/cmt-plan-datasource-mapping-options.png) The entry has the following options: ### Delete Clicking the Delete link will delete this mapping entry. ### Name Use the Name menu to select the data source you wish to map. You can select (All Selected Data Sources) to choose all of the data sources. ### Project The Project is the project of the associated data source names. ### Destination Name By default, the Content Migration Tool will use the same Destination Name(Same As Source), keeping the original name in the Source file, but you can type in a new name here for the destination folder. ### Destination Project If your destination projects have already been created on your site, you can choose which project to place your migrated workbooks or click Add New to create a new project. You can create different project destinations for individual data sources. ![A form for the addition or modification of data sources, with fields for name, project, destination name, and destination process.](/tableau/next/en-us/online/en-us/Img/ptd-plan-datasource-mapping-dest-proj.png) In most situations if multiple mapping entries exist for a single data source, a validation error will be displayed and must be fixed to continue. There is one important exception to this – a data source may match both a specific selection and a project-wide mapping entry. In this instance, the more specific entry will be used. When you have completed all of the data source mapping necessary, click Next to continue. ![A Next icon.](/tableau/next/en-us/online/en-us/Img/cmt-icon-next.png) ## Step 3: Data source transformations You can modify your data sources by using the transformation option. Click Add Transformation to see the list of transformations available. ![A dropdown menu to add a transformation.](/tableau/next/en-us/online/en-us/Img/cmt-datasource-transform-add-list.png) Selecting any of the data source transformations opens the Edit Transformation window. Use this to customize your selected data sources. Transformations are executed in the order they are listed, from top to bottom. For most data source transformations, there are two basic steps. The first step is to enter in the Match Criteria for the desired data source. Depending on which connection type you select, more fields will appear on the Match Criteria tab. ![A dialog to edit a transformation.](/tableau/next/en-us/online/en-us/Img/cmt-datasource-transform-edit-match.png) The second step depends on which transformation type you are adding. Each of the data source transformations have different values to be entered on the second tab. You can add notes in the Comments section on the left side of the Edit Transformation window for each of the transformations you add. ### Replace Table/Schema Name On the Options tab, you can replace all or part of a table or schema name. ### Set Calculation Formula On the New Calculation Formula tab, you can replace the calculation for a column. ![Interface for defining a formula in a column transformation setting.](/tableau/next/en-us/online/en-us/Img/cmt-plan-datasource-transform-set-calc.png) ### Set Connection Info On the New Connection Values tab, enter the authentication method and connection details for the new data source. Depending on which connection type you select, more fields will appear. ![A text field labeled "File Path."](/tableau/next/en-us/online/en-us/Img/cmt-plan-datasource-transform-set-cx.png) ### Set Custom SQL On the New Custom SQL tab, enter the name of the custom SQL query you want to modify for Match Query Name. The query name must match the custom SQL query name from the physical layer of the data source. If these names don't match, the transformation will fail. For more information about data modeling and the physical layer, see [The Tableau Data Model](https://help.tableau.com/v0.0/online/en-us/datasource_datamodel.htm). After entering the query name, enter the desired Custom SQL in the text field. Be aware that custom SQL can negatively impact the performance of your workbooks if improperly used. ![A text box labeled "Match Query Name" and a larger text box labeled "Custom SQL".](/tableau/next/en-us/online/en-us/Img/ptd-plan-transform-set-custom-sql.png) ### Remove Extract There is no Options tab for this transformation. Type the Match Criteria information and the extract will be removed during migration. ### Use Tableau Bridge There is no Options tab for this transformation. Type the Match Criteria information and data sources that are within a private network (inaccessible to the public internet) will be allowed to refresh using Tableau Bridge. The destination Tableau Cloud site must have Tableau Bridge configured before migrating data sources. For information about Tableau Bridge, see [Use Tableau Bridge](https://help.tableau.com/current/online/en-us/data_fresh_sync_section.htm) in Tableau Cloud help. After the migration, data sources will need to be assigned a refresh schedule through Tableau Cloud. ### Apply Saved Credentials Deprecated in version 2022.3. Use the Set Connection Info data source transformation instead. On the options tab, enter the Tableau Username and corresponding Saved Credentials Username for the data connection. You can only apply saved credentials for existing data connections on the Account Settings page of your Tableau site. For more information, see [Manage Saved Credentials for Data Connections](https://help.tableau.com/v0.0/online/en-us/manage_stored_credentials.htm). ![Two text boxes request a Tableau username and a saved credentials username.](/tableau/next/en-us/online/en-us/Img/cmt-plan-datasource-transform-saved-credentials.png) ## Step 4: Publish options The final step in the Published Data Source phase is to create transformations for permissions and tags and finalize the publish options specific to the data sources. ![The Data Source Publish Options dialog.](/tableau/next/en-us/online/en-us/Img/cmt-datasource-pub-options.png) #### Overwrite Newer Data Sources If selected, a data source will be published even if it will overwrite a data source that has been updated more recently. #### Copy Data Source Permissions When selected, the migration tool will attempt to match source published data source permissions as closely as possible. #### Copy Extract Refresh Schedules When selected, the migration tool will attempt to set the destination data source extract refresh schedule to schedules matching the source's name. **Note:** Extract refresh schedules cannot be created in Tableau Cloud. This option is not available if the destination is a Tableau Cloud site. For more information, see [Migration Limitations](https://help.tableau.com/v0.0/online/en-us/cmt-migration_limitations.htm). #### Copy Embedded Credentials for Data Sources Copy the embedded credentials for published data sources. Only available when migrating from Tableau Server to Tableau Cloud sites. For more information, see [Migrate Workbooks and Data Sources with Embedded Credentials](https://help.tableau.com/v0.0/online/en-us/cmt-migration_embedded_credentials.htm). **Note:** CMT does not support embedded credential migration for OAuth connections. To migrate OAuth credentials to the destination site, use the [Set Connection Info](#plan_datasrc_trans) data source transformation. #### Copy Data Source Owner Copy data source owner settings from the source location to assign the data source owner. If unselected, the Content Migration Tool user is given ownership of the data source in the destination location. #### Apply User Mappings Apply user mappings to assign content ownership. Select this option if there are differences in username syntax in the destination location. For more information, see [Migration Plans: Permissions and Ownership](https://help.tableau.com/v0.0/online/en-us/cmt-plan_users.htm). ### Add Options Click on the Add Option drop-down menu for the different types of transformations you can add: ![A dropdown menu to add or remove tags, apply extract refresh schedules, or set permissions.](/tableau/next/en-us/online/en-us/Img/cmt-datasource-pub-options-add.png) For all of the different types of transformations, there are two basic steps. The first step is to make your selection for the transformation. In this case, select the data source(s) you want to transform. At the top of the list, you can select Apply to all published data sources, which is an option to automatically select all data sources for future transformations. You can also Refresh the data source display window to reflect any changes or updates to the source site. ![A dialog to set published data source-level permissions.](/tableau/next/en-us/online/en-us/Img/cmt-datasource-pub-perms.png) The second step is to enter the specific selections for the transformation you select. ### Remove Tags Once the data sources you would like to remove tags from are selected, enter any tags you want to remove by entering them into the field at the bottom and click Add. From this screen, you can also select to remove from the source or destination data sources. If you want to remove a previously entered tag, click on it and press the delete key. ![A dialog to remove tags from published data sources.](/tableau/next/en-us/online/en-us/Img/cmt-datasource-pub-tags-remove.png) ### Add Tags After selecting the data sources desired, enter any tags you want to assign by entering them into the field at the bottom and click Add. If you want to remove a tag, click on it and press the delete key. ![A dialog to add tags to published data sources.](/tableau/next/en-us/online/en-us/Img/cmt-datasource-pub-tags-add.png) In addition, on each of the transformations you can enter notes in the Comments section on the left-hand side of the Edit Transformation window. ### Apply Extract Refresh Schedules This transformation applies destination extract refresh schedules to migrated data sources. The list of schedules generated are from the destination. **Note:** Extract refresh schedules cannot be created in Tableau Cloud. This option is not available if the destination is a Tableau Cloud site. For more information, see [Migration Limitations](https://help.tableau.com/v0.0/online/en-us/cmt-migration_limitations.htm). ![A dialog to apply an extract refresh schedule.](/tableau/next/en-us/online/en-us/Img/cmt-datasource-pub-extract-sched.png) ### Set Permissions The last type of transformation is to edit the permissions for the selected data sources. Enter in a Group or User and click Add. Adjust the permissions as desired. The four different options are to Allow the permission, Deny the permission, Inherit, or to keep the Source Value. ![A dialog to set published data source-level permissions.](/tableau/next/en-us/online/en-us/Img/cmt-datasource-pub-perms-new.png) ## Step 5: Continue to the next step When you are ready, click Next to continue to the [Migration Plans: Permissions and Ownership](https://help.tableau.com/v0.0/online/en-us/cmt-plan_users.htm) section of the planning phase. ## Who can do this Tableau site user with an Explorer role or higher. To migrate content, you must have **View** and **Download/Save a Copy** capabilities for workbooks on the source site and **View** and **Publish** capabilities for target projects on the destination site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). [Skip to main content](#main-content) # Migration Plans: Sites The first step when creating a migration plan in the Tableau Content Migration Tool is to sign in to the source and destination sites. In the Sites section of the planning phase, you'll sign in to the source and destination sites. The permissions of the user credentials you use govern the sites and projects you see when creating a migration plan. You can only migrate content that the user has access to. ![Dual-panel interface for selecting source and destination connections in Tableau.](/tableau/next/en-us/online/en-us/Img/cmt-plan-servers.png) ## Required permissions and licenses The user account(s) used to sign in to the source and destination sites must have an Explorer role or higher, and the following permissions for the content you want to migrate: - View - Download Workbook/Save a Copy - Optional: Administrator (to select workbooks, to access a user list) Both the source and destination sites must have Advanced Management capacities. For more information, see [About Tableau Advanced Management on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/itm_intro.htm). ## Step 1: Source Here is the starting point of the migration. Sign in to Tableau Cloud, then select your _site_ to use as the source. Sites are independent silos of workbooks, data, and user lists created within Tableau to group related content for selected users. You can only migrate content from one site at a time. ### Sign in to the source site Use the steps below to sign in to Tableau Cloud or Tableau Server. For more information about signing in to Tableau Cloud with Single Sign-On and Tableau with MFA, see [Sign In to Tableau Cloud](https://help.tableau.com/current/online/en-us/to_signin.htm). 1. Click Sign in to Tableau. 2. In the Select a Connection dialog window, select a saved connection and click Continue. ![Connection selection interface for Tableau Cloud with options to edit connections.](/tableau/next/en-us/online/en-us/Img/cmt-plan-select-server.png) If no connections are available, click Add or edit saved connections to add a new connection. For more information, see [Saved connections](#saved-connections). 3. Enter your username and password, and click Sign In. If your server is configured for SAML or Single Sign-On, you are redirected to the Identity Provider sign-in page to complete the authentication process. 4. Select the site you want to use. ![Site selection interface with a search field and list of available sites.](/tableau/next/en-us/online/en-us/Img/cmt-plan-servers-source-sites.png) To change the source server or update your site selection, click Select a different source. ## Step 2: Destination Repeat the sign-in process for the destination site (the site you are migrating content to). If you are migrating your workbooks between two projects on the same Tableau site, your sign-in credentials for the source and destination site will be identical (including the server URL and site name). ## Saved connections Using saved connections allow you to quickly sign in to the source and destination sites by creating a reusable connection. When adding a saved connection, you must specify the preferred sign-in method for your site. The Content Migration Tool supports the following sign-in methods: - **Personal access tokens:** Allows users to create long-lived authentication tokens for improved security, auditing, and automation of migration plans. Personal access tokens let users sign in without requiring interactive login in the Content Migration Tool. For more information, see [Personal Access Tokens](https://help.tableau.com/v0.0/online/en-us/security_personal_access_tokens.htm). - **Browser-based sign-in:** Users enter their credentials and complete authentication through an embedded web browser. This option may be similar to how you usually authenticate to Tableau. - **Username and password sign-in:** Users authenticate through the Content Migration Tool instead of an embedded browser window. This option passes credentials to the server using Tableau REST APIs. You can use username and password sign-in to troubleshoot issues that prevent the use of browser-based sign-in. ### Add or edit saved connections A link to Add or edit saved connections is displayed at the bottom of the Content Migration Tool, and when signing in to the source and destination sites. Clicking this link will open the Manage Tableau Connections window. ![A Tableau connection management window with options for personal access tokens, browser-based sign-in, and username and password sign-in.](/tableau/next/en-us/online/en-us/Img/cmt-plan-connections.png) Use the steps below to add a saved connection: 1. On the Manage Tableau Connections window, click New Connection, or select an existing connection to make changes. 2. Enter a Connection Name (name to describe your server) and the Server URL. If you don't include a prefix for the Server URL, the Content Migration Tool will use `http://`. 3. Select the sign-in method for your connection. If you're using personal access tokens, see [Add saved connections with personal access tokens](#add-saved-connections-with-personal-access-tokens). 4. Click Save. After you create a saved connection, it's listed in the Select a Connection window next time you sign in to the source and destination sites. ### Add saved connections with personal access tokens Adding a saved connection with a personal access token requires more information than other sign-in methods. You will need to create a new personal access token on the source and destination sites to begin. Personal access tokens should not be shared between applications. For more information, see [Personal Access Tokens](https://help.tableau.com/v0.0/online/en-us/security_personal_access_tokens.htm). Creating personal access tokens 1. In a web browser, sign in to your Tableau site. 2. At the top of the page, click your profile image or initials, and then select My Account Settings. 3. Under Personal Access Tokens, enter a descriptive name for your token in the Token Name field, and then click Create new token. 4. In the resulting window, click Copy to clipboard and then close the window. 5. Paste the token secret to a file. Store the file in a safe location. Adding personal access tokens 1. In the Content Migration Tool, click Add or edit saved connections. 2. On the Manage Tableau Connections window, enter a Connection name and the Server URL. If you are connecting to Tableau Cloud, you must enter the full pod URL of your site. For example, `https://10ay.online.tableau.com`. Your pod is shown in the first portion of the site URL after signing in to Tableau Cloud. 3. Enter the Personal access token name and Personal access token secret, obtained when creating a personal access token in the previous section. 4. In the Site name field, enter the site name as it appears in the URL, without spaces. This is different than the friendly site name. For example, "Site A" would be "sitea" in a browser URL. 5. Click Save. ## Step 3: Continue to the next step After successfully signing in to both source and destination sites, click Next to continue to the [Migration Plans: Source Projects](https://help.tableau.com/v0.0/online/en-us/cmt-plan_source_projects.htm) section of the planning phase. ## Who can do this Tableau site user with an Explorer role or higher. To migrate content, you must have **View** and **Download/Save a Copy** capabilities for workbooks on the source site and **View** and **Publish** capabilities for target projects on the destination site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). [Skip to main content](#main-content) # Migration Plans: Source Projects The next step in creating a migration plan in the Tableau Content Migration Tool is to select the source projects. Source projects are the projects the workbooks and published data sources will be migrated from. The projects you choose determine which workbooks are available to migrate in the next step of the migration plan. ## Step 1: Select your source project There are two options when selecting source projects, All Projects, and Specific Projects: ![Interface for selecting all projects for migration with a refresh option.](/tableau/next/en-us/online/en-us/Img/cmt-plan-source-proj-select-all.png) The All Projects option selects all projects from the source site you specified in the Servers step. The Specific Projects option allows you to select specific projects from the source site. **Note:** Source projects must contain workbooks or data sources. Content Migration Tool will not migrate empty projects. ![Project selection interface with options to select specific projects for migration.](/tableau/next/en-us/online/en-us/Img/cmt-plan-source-proj-select-specific.png) You can select each project individually or use the Select All button and then clear selections for the projects you don't want to include. If you make any changes on the source site while on this step, you can use the Refresh button to update the projects list. ![A button labeled "Refresh."](/tableau/next/en-us/online/en-us/Img/cmt-plan-source-proj-refresh.png) ## Step 2: Select project options Once the source projects are selected, select which project options to apply for the destination location. There are options to create projects that don't exist, in addition to copying project permissions and ownership from the source location. To assign new content ownership based on user mappings, select Apply User Mappings. ![Options menu for project creation and user mapping application in a migration project.](/tableau/next/en-us/online/en-us/Img/cmt-plan-source-proj-options.png) - Create Destination Projects: Automatically create projects that don't exist in the destination location. Content Migration Tool will not create destination projects if the source project is empty or no workbooks or data sources are selected. By default, attempts to migrate to a non-existent project will result in a failed migration. - Copy Project Permissions: Copy source project permissions as closely as possible. - Copy Project Owner: Copy project ownership settings from the source location to assign the project owner. - Apply User Mappings: Apply user mappings to assign content ownership of projects in the destination location. Content ownership won't be applied if the destination project already exists. For more information, see [Migration Plans: Permissions and Ownership](https://help.tableau.com/v0.0/online/en-us/cmt-plan_users.htm). ## Step 3: Continue to the next step After selecting the source projects, click Next to continue to the [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm) section of the planning phase. If you are migrating workbooks between two projects on the same Tableau site, you'll choose your destination project in the next section. ## Who can do this Tableau site user with an Explorer role or higher. To migrate content, you must have **View** and **Download/Save a Copy** capabilities for workbooks on the source site and **View** and **Publish** capabilities for target projects on the destination site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). [Skip to main content](#main-content) # Migration Plans: Workbooks You have successfully signed in to your source and destination sites and selected projects. The next step is to prepare your workbooks for migration. **Note:** If your workbooks or data sources include extracts, be sure you read and understand the information in [Migrate Workbooks and Data Sources with Extracts](https://help.tableau.com/v0.0/online/en-us/cmt-migration_extracts.htm). ## Step 1: Workbook selection All of the workbooks in the source site and selected projects appear on the Workbook Selection screen. ![Workbook selection window with the specific workbooks option selected and six previews of the selected visualizations shown.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-select.png) If you make any changes to the workbooks in the source site while on this step, you can click Refresh to update the workbook listings. There are several different ways to select these workbooks. ### Specific workbooks selection There are three buttons in the Specific section. Any choices from the Basic section will immediately include the specifically selected workbook in the migration plan. Alternately, you can individually select specific workbooks by clicking on each one. #### Select all The Select All button will select or clear selection of all the workbooks in the site. If additional workbooks are added to the site after the plan is saved, they will not be automatically added the next time the plan is used. #### Display: ##### Thumbnails The default view shows your workbooks in thumbnail previews to help you differentiate each of them. In this view, mousing over the thumbnail will show previews of the other worksheets and dashboards within that workbook. ##### List The list view is a more succinct listing that also provides additional information, including Workbook Name, Project, Tableau Version, and Last Modified. Clicking on any of the column headers will sort the workbooks appropriately. Also, mousing over any of the workbooks will also provide a floating preview of the worksheets and dashboards within that workbook. List view is particularly useful if you have a large amount of workbooks in a site. ### Rule Based selection You can use Rule Based selection to choose workbooks based on specific criteria. Rule-based options will create workbook selection criteria to be used when the migration plan is run. Be aware that selecting "all" in any of the Rule Based options is different than the Specific Workbooks selection. A rule-based "all" selection will always include all workbooks, so any newly added workbooks are included in future migrations. ![Interface for setting rules based on project tags and publisher for workbook migration.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-rulebased.png) The Rule Based radio button allows you to select workbooks by using the following options: #### Workbooks in projects This menu allows you to select workbooks from specific projects. #### Workbooks tagged with This menu allows you to select workbooks by their tags. #### Workbooks published by This menu allows you to select workbooks by their author. With each option, you can select individually or multiple by clicking on the option next to each entry. All selected workbooks will appear in the Selection Description box. ### All Workbooks selection The last option is to select the All Workbooks radio button, which selects all workbooks in all projects in the site. Using the All Workbooks radio button is different than selecting all of the workbooks using the Specific Workbook method because it will use every workbook in the source site each time the migration plan is used in the future. ![Workbook selection options with all workbooks in all projects selected.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-select-all.png) When you're satisfied with your workbook selections, click Next. ## Step 2: Workbook mapping You can now map your selected workbooks from the source file to the destination file. Mapping allows you to rename source workbooks as they are migrated and choose different destinations. You can also add mapping to change the project, prefix, or suffix for the workbooks as well. Projects can be added to the Destination in this section as well. If you make no changes here, then the selected workbooks will simply be migrated with the same name and into the same project as the source. If you have not defined projects in your destination site, then they will be migrated into the Default project. To add workbook mapping click the Add Mapping button. The following options will appear in the mapping area. ![Interface for adding new workbook mappings with options for renaming and changing projects.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-mapping.png) ### Rename workbook ![Workbook mapping interface with fields for source and destination project and workbook names.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-mapping-rename.png) This transformation allows you to filter by the Source project and select the desired workbook(s) to rename. In the Destination field, select which project you would like the workbook to be directed to and enter the desired name. ### Change project ![Interface for changing workbook prefix with options to remove or replace.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-mapping-chgproj.png) By default, the workbooks are migrated to the same project in the destination. This mapping allows you to change the destination project for all workbooks from a source project. ### Add project When renaming the workbook or changing the project, the Add New option allows you to create a destination project without having to sign in to the destination site and create the project manually. You can create both projects and nested projects using the Add New dialog box. ![A form for creating a new project with fields for location, project name, parent project, and description.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-mapping-chgproj-new.png) ### Change prefix ![Interface for changing workbook prefix with options to remove or replace.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-mapping-chgprefix.png) This allows you to remove or replace the prefix for workbooks from one or all source projects. ### Change suffix Like the prefix mapping, you can remove or replace the suffix for workbooks from one or all source projects. ## Step 3: Workbook transformations You can change and modify your workbooks by using the Transformation step. ![A button labeled "Add Transformation" with a dropdown arrow.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-add-transform-button.png) Transformations modify your workbooks in a specified manner. Additional transformations can be included via plug-ins or will be added in future versions of the application. Click on the Add Transformation drop-down menu to see the selection of Transformations currently available. ![A drop-down menu of workbook transformation options.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-add-transform-list.png) Selecting any of the transformations will bring up the Edit Transformation window, which will allow you to customize it to your selected workbooks. All transformations will be completed in the order that they are listed from top to bottom. For all of the different types of transformations, there are two basic steps. The first step is to make your selection for the transformation. In this case, select the workbook(s) you want to transform. The selection area is similar to the Workbook Selection section of the Planning phase with all of the features of the Basic selection radio button: Select/Unselect All, Refresh, Thumbnail Display, and List Display. At the top of the list, you can select Select All workbooks, which is an option to automatically select all workbooks for future transformations. You can also Refresh the workbook display window to reflect any changes or updates to the source site. ![A window with choices to edit a transformation.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-edit-transform-workbook.png) The second step is to use the options tab to enter the specific selections for whichever transformation you select. ![A form to edit a parameter value, complete with fields for the parameter name, data type, and value.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-edit-transform-options.png) Each of the workbook transformations have different values to be entered on the options tab, and the tab will have different names, depending on the transformation you're editing: ### Replace URL action Replace part or all of a URL action inside the workbook using this transformation. On the options tab, enter the text to be matched and its replacement value. The replacement functionality is intended for URL actions and doesn't check the entire workbook XML. ![Two text boxes with labels, "Match" and "Replacement."](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-action-url.png) #### Example: URL: `www.exampledev.com` Match: `dev` Replacement: `Prod` Result: `www.exampleProd.com` ### Set parameter value Define a new parameter. On the options tab, enter the name of the Parameter, the data type from the drop-down menu, and the value. ![A form with fields for a parameter name, data type, and value.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-parameter.png) ### Remove images Remove any images (such as a watermark) in the selected workbooks by entering in the file name on the options tab. There is an additional check box to receive a warning during migration if no image is found. ![A text field labeled "File Name" and a warning message about no matching images found in the workbook.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-image-remove.png) ### Remove tooltip commands Remove all of the tooltip commands from the selected workbooks. There are no additional options to define for this transformation. ### Replace images Replace images embedded in the selected workbooks. On the options tab, enter the file name of the current image and the replacement image. You can replace images using a local file path or URL. ![A text field labeled "File Name" and a warning message about no matching images found in the workbook.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-image-replace.png) #### Example: File Name: `image.png` Replacement Image URL: `https://www.exampledev.com/replacementImage.png` ### Zoom control visibility Set the visibility mode from the drop-down menu: Automatic, Show on Hover, or Hide on the options tab. ![A visibility mode dropdown menu with "Automatic" chosen.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-zoom.png) ### Web page URL replacement Replace part or all of a web page URL used on dashboards using this transformation. On the options tab, enter the text that should be matched and its replacement value. ![Two empty text fields labeled "Match" and "Replacement"](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-web-url-replace.png) #### Example: URL: `www.exampledev.com` Match: `dev` Replacement: `Prod` Result: `www.exampleProd.com` ## Step 4: Data source transformations The next step in planning your workbooks for your enterprise migration are your data source transformations. It is similar in function to the Workbook Transformations step. These are for data sources that are packaged within the workbooks. Published data sources are handled in a different step in the process. ![A button labeled "Add Transformation" with a dropdown arrow.](/tableau/next/en-us/online/en-us/Img/ptd-plan-transform-add-button.png) Click on the Add Transformation drop-down menu and the following options will appear: ![List of data source transformations including table name replacement and SQL setting adjustments.](/tableau/next/en-us/online/en-us/Img/cmt-plan-transform-datasource-add-list.png) Selecting any of the data source transformations will bring up the Edit Transformation window, which will allow you to customize it to your selected data sources. All transformations will be completed in the order that they are listed from top to bottom. For all of the different types of data source transformations, there are two basic steps. The first step is to enter in the match criteria for the desired data source. Depending on which connection type you select, more fields will appear on the Match Criteria tab. ![Data source transformation interface with fields for setting new connection values and matching criteria.](/tableau/next/en-us/online/en-us/Img/cmt-plan-transform-datasource-edit-criteria.png) Click on the Preview Source Connections to find any connections that match the criteria entered. ![A table that previews a data source transformation.](/tableau/next/en-us/online/en-us/Img/ptd-plan-transform-preview.png) The second step is to use the options tab to enter the specific selections for whichever transformation you select. ![Custom SQL setting interface for data source transformations.](/tableau/next/en-us/online/en-us/Img/cmt-plan-transform-datasources-edit-options.png) Each of the data source transformations have different values to be entered on the options tab: #### Set calculation formula On the options tab, you can replace the calculation for a column. ![A form with fields for a column name and a formula.](/tableau/next/en-us/online/en-us/Img/ptd-plan-transform-calc-set.png) #### Set connection info On the New Connection Values tab, enter the authentication method and connection details for the new data source. Depending on which connection type you select, more fields will appear. **Change published data sources with CMT** Select the Tableau Server (Published Data Source) connection type to change the published data source for a workbook. This can reduce the manual steps required when migrating workbooks between projects, for example, promoting content from development to production. To change the published data source, select a data source from the drop-down menu and enter the Tableau Username for authentication. The user must exist on the destination site and have the Connect capability for the published data source. - For file-based data sources, users will access the workbook and see data based on permissions of the specified Tableau user. - For all other data sources, users are prompted for their own database credentials when the view or workbook loads. If Tableau Username isn't specified, only users with the Connect capability can see data in the workbook. ![A form with fields for the published data source and your Tableau username.](/tableau/next/en-us/online/en-us/Img/ptd-plan-transform-set-cx.png) #### Set custom SQL On the New Custom SQL tab, enter the name of the custom SQL query you want to modify for Match Query Name. The query name must match the custom SQL query name from the physical layer of the data source. If these names don't match, the transformation will fail. For more information about data modeling and the physical layer, see [The Tableau Data Model](https://help.tableau.com/v0.0/online/en-us/datasource_datamodel.htm). After entering the query name, enter the desired Custom SQL in the text field. Be aware that custom SQL can negatively impact the performance of your workbooks if improperly used. ![A text box labeled "Match Query Name" and a larger text box labeled "Custom SQL".](/tableau/next/en-us/online/en-us/Img/ptd-plan-transform-set-custom-sql.png) #### Remove extract There is no options tab for this transformation, simply enter in the Match Criteria information and the extract will be removed during migration. In addition, on each of the transformations you can enter notes in the Comments section on the left-hand side of the Edit Transformation window. #### Apply saved credentials Deprecated in version 2022.3. Use the Set Connection Info data source transformation instead. On the options tab, enter the Tableau Username and corresponding Saved Credentials Username for the data connection. You can only apply saved credentials for existing data connections on the Account Settings page of your Tableau site. For more information, see [Manage Saved Credentials for Data Connections](https://help.tableau.com/v0.0/online/en-us/manage_stored_credentials.htm). ![Two text boxes request a Tableau username and a saved credentials username.](/tableau/next/en-us/online/en-us/Img/cmt-plan-datasource-transform-saved-credentials.png) ## Step 5: Publish options The final step in the Workbooks phase is to select publish options and create transformations for tags, extract refresh schedules, and permissions. ![Publish options for workbooks including overwrite controls and permission settings.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-publish-options.png) #### Reset dashboard selections This option deselects all objects on dashboards. #### Overwrite newer workbooks If checked, a workbook will be migrated even if it will overwrite a workbook that has been created at the same time or more recently than the moved workbook #### Copy workbook permissions When selected, the migration tool will attempt to match source workbook permissions as closely as possible. #### Copy extract refresh schedules When selected, the migration tool will attempt to set the destination workbook extract refresh schedule(s) to schedules matching the source's name. **Note:** Extract refresh schedules cannot be created in Tableau Cloud. This option is not available if the destination is a Tableau Cloud site. For more information, see [Migration Limitations](https://help.tableau.com/v0.0/online/en-us/cmt-migration_limitations.htm). #### Copy embedded credentials for workbooks Copy the embedded credentials for data sources embedded in workbooks. Only available when migrating from Tableau Server to Tableau Cloud sites. For more information, see [Migrate Workbooks and Data Sources with Embedded Credentials](https://help.tableau.com/v0.0/online/en-us/cmt-migration_embedded_credentials.htm). **Note:** CMT does not support embedded credential migration for OAuth connections. To migrate OAuth credentials to the destination site, use the [Set Connection Info](#plan_wkbk_data_trans) data source transformation. #### Copy workbook owner Copy workbook owner settings from the source location to assign the workbook owner. If unselected, the Content Migration Tool user is given ownership of the workbook in the destination location. #### Apply user mappings Apply user mappings to assign content ownership. Select this option if there are differences in username syntax in the destination location. For more information, see [Migration Plans: Permissions and Ownership](https://help.tableau.com/v0.0/online/en-us/cmt-plan_users.htm). ### Add option Click on the Add Option drop-down menu for the different types of transformations you can add: ![Interface for adding workbook publish options including tag management and permission settings.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-pub-option-add.png) For all of the different types of transformations, there are two basic steps. The first step is to make your selection for the transformation. In this case, select the workbook(s) you want to transform. The selection area is similar to the Workbook Selection section of the Planning phase with all of the features of the Basic selection radio button: Select/Unselect All, Refresh, Thumbnail Display, and List Display. At the top of the list, you can select Select All workbooks, which is an option to automatically select all workbooks for future transformations. You can also Refresh the workbook display window to reflect any changes or updates to the source site. ![Tag addition interface for workbooks with fields for tag selection and application.](/tableau/next/en-us/online/en-us/Img/cmt-plan-workbook-pub-option-add-tags.png) The second step is to use the options tab to enter the specific selections for whichever transformation you select. **Note:** The options tab will have different names, depending on which transformation you are editing. #### Add tags This allows you to add one or more tags to the workbook. If you hover your mouse over a previously entered tag, a blue "X" will appear to allow deletion. ![An Edit Option dialog with options to select workbooks or add a tag.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-tags-add.png) #### Remove tags This allows you to add one or more tags to the workbook. If you hover your mouse over a previously entered tag, a blue "X" will appear to allow deletion. You can also choose to remove the tag from the source or destination workbooks. ![A window for removing tags from workbooks.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-tags-remove.png) #### Apply extract refresh schedules Here you can apply destination extract refresh schedules to migrated workbooks. The list of schedules generated are from the destination. **Note:** Extract refresh schedules cannot be created in Tableau Cloud. This option is not available if the destination is a Tableau Cloud site. For more information, see [Migration Limitations](https://help.tableau.com/v0.0/online/en-us/cmt-migration_limitations.htm). ![A dialog box with options for applying extract refresh schedules, including end of the month, Saturday night, and weekday early mornings.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-sched-refresh.png) #### Set permissions This transformation is to edit the permissions for the selected workbooks. Enter in a Group or User and then click Add. Adjust the permissions as desired. The four different options are to Allow the permission, Deny the permission, Inherit, or to keep the Source Value. ![A window that shows permissions for a workbook.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-permissions-set.png) #### Set Generate Thumbnail As This allows you to set the User or Group to be used for generating user-specific data in the workbook thumbnail after being migrated. Each option has a drop down to select the desired user or group. ![A dialog box to generate thumbnails as a user or a group.](/tableau/next/en-us/online/en-us/Img/ptd-plan-workbook-thumbnail-gen.png) ## Step 6: Continue to the next step After selecting your workbooks and preferences, click Next to continue to the [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm) section of the planning phase. ## Who can do this Tableau site user with an Explorer role or higher. To migrate content, you must have **View** and **Download/Save a Copy** capabilities for workbooks on the source site and **View** and **Publish** capabilities for target projects on the destination site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). [Skip to main content](#main-content) # Monitor Data Exports Using the Activity Log Monitoring how your company's data is being used is an important part of being an admin. Using the Activity Log, you can see data exports in real time to maintain data security and compliance. This topic describes how admins can use different event types to see which users have exported data, including: - **Downloading published content:** This refers to the download of workbooks, data sources, and flows published on your Tableau Cloud site. - **Accessing or exporting data from published content:** This refers to the export of data from published views or dashboards. For example, downloading an image of the view in .png format or exporting data as a comma-separated value (.csv) file. ## Prerequisites To monitor data exports, your Activity Log data must be in a structured and queryable format. Make sure that these prerequisites are met before you continue: - **Activity Log configuration:** Set up Activity Log to write log files to your AWS S3 bucket. - **Data import:** Import the log files generated by Activity Log into a monitoring tool, such as Splunk or Amazon EventBridge. Alternatively, you can import them into a cloud data warehouse like Snowflake or Google BigQuery. The goal is to get your data into a format that you can easily query and analyze. **Note:** The process of importing your Activity Log data into a data store isn't covered in this topic. For detailed instructions, refer to [Set Up Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_setup.htm) and the documentation for your chosen data platform. ## Reasons to monitor data exports You can use Activity Log to monitor data exports for these scenarios: - **Enhanced security and compliance:** Identify if sensitive information was exported without authorization. This helps make sure internal security policies and external regulatory compliance requirements are met, such ‌as GxP, GDPR, or HIPAA. - **Data governance:** Knowing who's exporting what data helps you control your data assets. With more visibility, you can find cases of data replication, misuse, or unintended data sprawl. This helps make sure your data governance policies are followed. - **Understanding user behavior:** Analyzing data export patterns can show how users interact with your data. This can help you decide on data access policies, identify areas for additional training, or ways to make data easier to find. ## Understanding export events in Activity Log We've covered why monitoring data exports is important, but let's discuss how user actions appear in Activity Log. This section helps you identify the specific actions users take on a site and their corresponding Activity Log events. Depending on how data was exported, you may need an endpoint filter for the event type. ### Download from action menus This table shows how download actions taken on Tableau Cloud content menus appear in Activity Log.

User Interaction	Activity Log Event Name	Endpoint Name (endpointName)
Download Workbook	hist_download_workbook	N/A
Download Data Source	hist_download_datasource	N/A
Download Flow	hist_download_flow	N/A

**Example** To see which users have exported a workbook: 1. Open the monitoring tool you've set up, such as Splunk or Amazon EventBridge. 2. Filter on `endpointName = hist_download_workbook`. ![A dropdown menu displays options to edit, share, download, and move a workbook.](/tableau/next/en-us/online/en-us/Img/export_from_action_menu.png) ### Export from views This table shows how export actions taken on views appear in the Activity Log. For more information about specific export formats, see [Download Views and Workbooks](https://help.tableau.com/current/pro/desktop/en-us/export.htm) in Tableau Desktop and Web Authoring Help. **Note:** The Activity Log doesn't record exports (such as PNG, CSV, or PDF) initiated using the Tableau REST API.

User Interaction	Activity Log Event Name	Endpoint Name (endpointName)
Export Summary Data	hist_export_summary_data	N/A
Export Underlying Data	hist_export_underlying_data	N/A
Export Workbook*	hist_download_workbook	N/A
Export to Image	vizql_http_request	executeCommand.tabsrv.export-image-server
Export to Crosstab*	vizql_http_request	executeCommand.tabsrv.export-crosstab-to-excel-server
Export to CSV*	vizql_http_request	executeCommand.tabsrv.export-crosstab-to-csvserver
Export to PDF*	vizql_http_request	executeCommand.tabsrv.export-pdf-server
Export to PowerPoint*	vizql_http_request	executeCommand.tabsrv.power-point-export-server

\*A confirmation dialog is displayed for this download format. If users proceed, a `getSessionTempFile` endpoint is recorded in the logs. No value is recorded if users close the dialog without confirming. **Example** To find users who have exported to CSV: 1. Open the monitoring tool you've set up, such as Splunk or Amazon EventBridge. 2. Filter on these values: 1. `eventType = vizql_http_request`. 2. `endpointName = executeCommand.tabsrv.export-crosstab-to-csvserver`. 3. `endpointName = getSessionTempFile`. ![A dropdown menu includes file format options, like image, data, or PDF.](/tableau/next/en-us/online/en-us/Img/export_from_view.png) [Skip to main content](#main-content) # Monitor Flow Health and Performance After you publish Tableau Prep flows and schedule them to run periodically, you want to know that they are running as expected and resolve any issues as they occur. You will also want to monitor, troubleshoot, and understand the performance of your flows. Need help troubleshooting your flow? See [Troubleshoot Tableau Prep Builder](https://help.tableau.com/current/prep/en-us/prep_troubleshoot.htm). This topic describes the various methods that Tableau Cloud provides to help you monitor and troubleshoot your Tableau Prep flows. ## Detect issues as they occur and resolve them In Tableau Cloud, email notifications are automatically sent when flows fail. You can also find and review errors on your server using the Alerts menu or by reviewing the flow pages for the flows that you are interested in. This type of monitoring allows you to detect problems as they occur. ### Get notifications when a flow fails: Email notifications is turned on by default for your site in Tableau Cloud. You can verify this by going to **Settings** > **General** page. ### View and resolve errors **Note**: Starting in version 2020.4.1, you can now create and edit flows directly in Tableau Server and Tableau Cloud. The content in this section applies to all platforms, unless specifically noted. For more information about authoring flows on the web, see [Tableau Prep on the Web](https://help.tableau.com/v0.0/online/en-us/prep_web_auth.htm). The following errors can happen when running a flow: - **Connection errors:** Connection errors generally happen when Tableau Cloud is unable to connect to one or more data inputs or is unable to make a connection in one or more output steps. - For Input connection errors, use the Edit connections option on the Connections tab to make changes to connection details, then run the flow again. - For output connection errors, check the output location for the flow output steps. If the flow output is going to a network share, make sure the output steps are pointing to a safe listed location. After you make any changes republish the flow and try running it again. **Note**: To fix output connection errors for flows that output to a file or network share, download the flow to Tableau Prep Builder, then republish the flow to your server. Flows that output to a published data source or database can be edited directly on the web. - **Errors in the flow:** If there are errors in one or more steps in the flow, you will see an error message. You can edit the flow directly on the web and republish it. You can also download the flow to Tableau Prep Builder, resolve the errors, republish the flow to the server and then run the flow again. - **Suspended flow tasks:** When a scheduled flow task fails to run after a configured number of attempts, the flow task is suspended. By default, a flow task is suspended after 5 consecutive flow tasks failures. A flow can have multiple scheduled tasks assigned to it, but only the failed tasks are suspended. All other flow tasks will continue to run unless they have errors. To resolve a suspended task, review and resolve the errors then run the flow on-demand or let the flow run automatically based on the assigned schedule. You can view errors on the following pages: #### Flow Overview page On this page you can see the status of the most recent flow run and any errors. Hover on the error text to review the error details. If a scheduled task is suspended, a warning icon shows next to the schedule. Hover on the icon to view the status. After you resolve the error that caused the flow to fail or the task to be suspended, you can run the flow manually or let the flow run based on the assigned schedule. For suspended flow tasks, click the Go to Scheduled Task link on the tooltip for the suspended task to navigate to the Scheduled Tasks page and click the Resume Scheduled Tasks button to resume the suspended tasks. ![A process flow for a data set titled "Tableau Prep Crane" displays an error message: "Incremental refresh on step 'Output' failed".](/tableau/next/en-us/online/en-us/Img/prep_server_overview_error.png) #### Connections page The **Connections** page shows the most recent status and any related connectivity errors. To correct input errors, click the More actions![The More Options menu option represented by 3 dots.](/tableau/next/en-us/online/en-us/Img/prep_server_rmoremenu.png) menu for an input connection to edit the connection and change the server name, port, user name and password. To fix output connection errors, edit the flow directly or download the flow in Tableau Prep Builder, correct the file path, then republish the flow to continue running it. ![Connection details with an error message stating "Incorrect username or password."](/tableau/next/en-us/online/en-us/Img/prep_server_connections_error.png) #### Scheduled Tasks page **Note**: The Data Management is required to see this tab. View the scheduled tasks assigned to a flow. If a scheduled task is suspended, you can see the status of that tasks here and you can manually resume the flow tasks from this page. Before resuming a suspended task, resolve any errors in the flow. Error details are not shown on this page, but you can review them on the Overview or Run History pages. You can also click the links in the Schedule type column to view the details of what was scheduled and to edit the tasks. A suspended scheduled task will automatically resume when the flow is republished, if you edit a connection for the flow or manually run the flow tasks. To manually resume a suspended tasks, on the Scheduled Tasks page, click Resume Scheduled Tasks. This resumes all suspended tasks for the flow. To resume individual tasks, click the More actions![The More Options menu option represented by 3 dots.](/tableau/next/en-us/online/en-us/Img/prep_server_rmoremenu.png) menu for a scheduled task and select Resume. You can also click Run Now to run all tasks for the flow immediately. ![A list of scheduled tasks for a data flow with their status.](/tableau/next/en-us/online/en-us/Img/prep_linked_tasks_schedule_error.png) #### Run History page **Note**: The Data Management is required to see this tab. The Run History page shows the details of all the flow runs that have either completed or are in progress for each output. View any error details by hovering over the errors in the **Errors** column. The duration column shows you the run time of the flow. **Note**: Starting in version 2020.2.1, the Run Type field shows the refresh type for the output. In prior releases this field showed whether the output was run on a schedule or on-demand. For more information about setting up output refresh types, see [Refresh Flow Data Using Incremental Refresh](https://help.tableau.com/current/prep/en-us/prep_incremental_refresh.htm). ![Tableau Prep Run History.](/tableau/next/en-us/online/en-us/Img/prep_server_runhistory.png) #### Alerts When a flow fails, the alerts menu is populated with the error details with the option to re-run the flow, or download the flow to troubleshoot. **Note**:Flow owners and Site Administrators can see this menu. ![The Alerts dialog showing error details and the alerts menu options to re-run the flow, or download the flow to troubleshoot.](/tableau/next/en-us/online/en-us/Img/prep_conductor_server_alerts.png) ### Who can do this - **Tableau Site Administrators**: - Set up email notifications at the site level - View errors - Resume suspended tasks - View alerts - **Flow owners, project leaders and any user who is granted permissions to view the flow**: - View errors - Resume suspended tasks - View alerts (Flow owners) ## Other articles in this section [Skip to main content](#main-content) # Monitor Site Activity Monitor site usage and activity with these prebuilt administrative views and data sources. - **Admin Views:** The set of embedded dashboards you can access from the Status page. They show near real-time information about what's happening on your site. You can use them to see site activity, but you can't change or subscribe to them. - **Admin Insights:** The data sources and starter workbook published in the Admin Insights project on your site. The data updates daily and can be used to build custom admin dashboards for your organization. To audit your data for security or custom analytics, get tenant and site event logs using these additional features. - **Tableau Cloud Manager (TCM) REST API:** The platform data methods get tenant and site event logs. Users with a Cloud Administrator role can access these events using any client capable of making API calls. For more information, see [Platform Data](https://help.tableau.com/current/api/cloud-manager/en-us/docs/platform_data.html) in TCM REST API Reference. - **Activity Log:** The Activity Log sends site event logs to an Amazon Simple Storage Service (S3) bucket for analysis. To use Activity Log, you must have an Amazon Web Services (AWS) account, an Amazon S3 bucket to receive data, and an AWS Key Management Service (KMS) key. For more information, see [Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_overview.htm). ## Other articles in this section [Skip to main content](#main-content) # Monitor View Load Times Using the Activity Log Making sure that views render optimally for users is an important part of being an admin. Using the Activity Log, you can identify performance concerns in real time and address issues that come up to keep the site operating smoothly. This topic describes how admins can use the `vizql_http_request` event type to understand view load times and troubleshoot performance bottlenecks. ## Prerequisites To monitor view load times, your Activity Log data must be in a structured and queryable format. Make sure that these prerequisites are met before you continue: - **Activity Log configuration:** Set up Activity Log to write log files to your AWS S3 bucket. - **Data import:** Import the log files generated by Activity Log into a monitoring tool, such as Splunk or Amazon EventBridge. Alternatively, you can import them into a cloud data warehouse like Snowflake or Google BigQuery. The goal is to get your data into a format that you can easily query and analyze. **Note:** The process of importing your Activity Log data into a data store isn't covered in this topic. For detailed instructions, refer to [Set Up Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_setup.htm) and the documentation for your chosen data platform. ## Getting started So where do we begin? You can monitor view performance by focusing on the initial load of a dashboard or view, known as the "bootstrap session" event. This event typically captures the bulk of the time required to render the view, giving you a clear indication of how long it took to load. To monitor bootstrap events: 1. Open the monitoring tool you've set up, such as Splunk or Amazon EventBridge. 2. Filter on the these values: 1. `eventType = vizql_http_request`. 2. `endpointName = bootstrapSession`. 3. `eventOutcome = success`. 3. In the results, find the `duration` field. The duration field for vizql\_http\_request events represents the amount of time the operation took to complete, in milliseconds. This helps you ‌track and analyze the initial load times of your Tableau views. > [!TIP] > > Not sure where to start? Use the "Dashboard Load Times" dashboard included in the Admin Insights Starter workbook. This dashboard displays load times and performance ratings for content, helping you identify problematic views. You can then use Activity Log to see which users are experiencing issues in real time and how workbook revisions might be impacting performance. For more information, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ## Monitor for errors In addition to performance, you can use bootstrap session data to see if users encounter errors while viewing content. To see these errors, search for the eventOutcome and eventOutcomeReason fields. These fields are useful for setting up monitoring alerts and providing a starting point for investigations. For example, if users report an error when viewing a dashboard, you can look at the bootstrap session to see historical user interactions. This helps you pinpoint what triggered the error and determine when the issue started. Knowing this information is important for troubleshooting the root cause of problems. - **eventOutcome:** This field records the high-level success or failure category of each operation (success, failure, client\_error, or internal\_error). - **eventOutcomeReason:** This field provides more detailed information about what went wrong, often recording the HTTP status code that describes the error. To monitor for errors: 1. Open the monitoring tool you've set up, such as Splunk or Amazon EventBridge. 2. Filter on these values: 1. `eventType = vizql_http_request`. 2. `endpointName = bootstrapSession`. 3. `eventOutcome != success`. 3. In the results, review the `eventOutcomeReason` for more details about the error. ## Troubleshoot performance issues There are many factors that can contribute to performance issues, making them difficult to investigate. However, you can take a few approaches to simplify the process. This section provides an overview of common ways to troubleshoot workbook performance using the bootstrap session. To get started, determine if the issue is isolated to one workbook or a few. Then, follow the instructions in the related section. ### Troubleshoot a single workbook Use these steps if the performance concern is with a single workbook. 1. **Identify the workbook revisions:** Check if the performance issue was introduced with a new workbook revision. You can do this by reviewing the `workbookRevision` attribute in the bootstrap session. This process may require comparing user visits to previous versions of the workbook. If a new revision is causing the performance issue, contact the workbook owner and work with them to improve the design. 2. **Check for user-specific issues:** If the performance issue isn't specific to a workbook revision, determine if it affects only certain users. You can do this by looking at the `requestUri` and `actorUserLuid` attributes in the bootstrap session. The `requestUri` attribute provides the URL of the workbook or view being accessed, and the `actorUserLuid` attribute provides the user accessing the view. Using both can help you distinguish individual user sessions. If the issue is user-specific, look for similarities across users. For example, it may be due to a customized view those users are accessing or certain ways they interact with the view. You will need to parse the `requestURI` attribute to identify the specific views. 3. **Review row-level security:** If some users have trouble with performance, and custom views aren't the cause, the problem might be related to row-level security (RLS) implemented in the workbook. RLS can significantly impact performance, especially if the security rules are complex or if the dataset is large. For more information, see [Overview of Row-Level Security Options in Tableau](https://help.tableau.com/v0.0/online/en-us/rls_options_overview.htm). ### Troubleshoot a subset of workbooks Use these steps if the performance concern is with a subset of workbooks. 1. **Identify common data sources:** Look for commonalities in the data sources used by the affected workbooks. If the affected workbooks are using live connections to a database server or cloud data warehouse, the performance issue might be with the live connection. If the affected workbooks are using data extracts, check if there were recent updates to them. You can use the `hist_publish_datasource` event type in Activity Log or the TS Events data source in Admin Insights to identify recent changes. 2. **Review data source performance:** For live connections, monitor the performance of the database server or cloud data warehouse. Check for any recent changes or issues on the server side. This step is performed outside of Tableau. For extracted data sources, review the extraction process and any recent updates. Make sure that the extraction is optimized and that the data is not excessively large or complex. For more information, see [Create Extracts on the Web](https://help.tableau.com/v0.0/online/en-us/datasource_extract.htm) . ## Important considerations Using Activity Log to monitor view load times is a great way to stay on top of dashboard performance and user engagement. However, not every dashboard or view rendering operation generates a bootstrap session event. Here are some scenarios where a bootstrap session event won't be required: - **Cached dashboards:** If the dashboard or view is retrieved from a previous cache. - **Tab switching:** If a user switches tabs within the same workbook, and the content for the new tab is loaded or cached. By using the `vizql_http_request` event type and focusing on `bootstrapSession` events, you can gain valuable insights into view performance and proactively address issues. [Skip to main content](#main-content) # Multi-Factor Authentication and Tableau Cloud [As part of the broader Salesforce ecosystem](https://help.salesforce.com/apex/HTViewSolution?urlname=Salesforce-Multi-Factor-Authentication-FAQ), we require you, the site owners, to configure account security mechanisms for you and your users. The way you can enable account security depends on which technologies are available to you in your organization. MFA authentication became a Tableau Cloud requirement beginning February 1, 2022. MFA is an effective tool for enhancing sign-in security and protecting your organization and its data against security threats. For more information, see the [Salesforce Multi-Factor Authentication FAQ](https://help.salesforce.com/apex/HTViewSolution?urlname=Salesforce-Multi-Factor-Authentication-FAQ) in Salesforce Help. To meet the MFA requirement, you can use your single sign-on (SSO) identity provider (IdP). If you don’t work directly with an IdP, you can enable MFA for Tableau authentication using the Tableau with MFA capability. **Important:** If you decide to use Tableau with MFA, review this topic in its entirety, especially [Regain site access after being locked out](#mfa_lockedout). ## User accounts and multi-factor authentication Multi-factor authentication (MFA) is a secure account authentication method that requires users to prove their identity by providing two or more pieces of information (factors) when they sign in to Tableau Cloud. The first factor is the unique information your users know—their usernames and passwords. Other factors are verification methods that users have in their possession, such as an authenticator app, security key, or built-in authenticator. By enforcing multiple factors when users sign in to Tableau Cloud, MFA makes it more difficult for common threats like phishing attacks and account takeovers to succeed. MFA is an effective tool for enhancing sign-in security and protecting your organization and its data against security threats. > **Recommended method - SSO with MFA:** If you’re currently using your organization’s SSO IdP with MFA to enhance your security, continue to do so. If not, to satisfy the MFA requirement, configure your site to use SSO and enable MFA with your SSO IdP. You can configure your site users to authenticate with Google, Salesforce, or SAML provider. > > **Alternative method - Tableau with MFA:** If you don’t work directly with an SSO IdP, or if you use TableauID, you can satisfy the MFA requirement by enabling MFA with Tableau authentication. This capability enables an additional step of using a verification method before being successfully authenticated to the site. > > Tableau with MFA supports the following verification methods: > > - Salesforce Authenticator app > - Third-party time-based one-time passcode (TOTP) authenticator apps, including Google Authenticator, Microsoft Authenticator, and Authy > - Security keys that support WebAuthn or U2F, such as Yubico YubiKey or Google Titan Security Key > - Built-in authenticators, including Touch ID, Face ID, and Windows Hello > - Recovery codes (as backup only) > > **Important:** Security keys that support WebAuthn or U2F and built-in authenticators can't be used when authenticating to Tableau Cloud from Tableau Desktop, Tableau Prep Builder, Tableau Bridge, and Tableau Content Migration Tool. If one of these verification methods have been registered, you (and your users) can register an additional verification method from your My Account Settings page in Tableau Cloud. > > To compare supported verification methods and review usage requirements, see [Verification Methods for Multi-Factor Authentication](https://help.salesforce.com/articleView?id=sf.mfa_supported_verification_methods.htm) topic in Salesforce Help. ## Enable MFA with Tableau authentication If your organization doesn’t work directly with an SSO IdP, you can satisfy the MFA requirement with the default Tableau with MFA authentication. For more information, see [About multi-factor authentication and Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/security_auth.htm#mfa_requirement). If Tableau hasn't updated your site to require Tableau with MFA yet, follow these steps to enable MFA. You can also see an overview of this process in the [Multi-Factor Authentication Enforcement | Tableau Cloud](https://www.youtube.com/watch?v=U8909ayNKjI) video on YouTube. 1. Sign in to Tableau Cloud using your site admin credentials and go to the Users page. 2. Next to the first user listed, do the following: 1. Click the Actions menu, select Authentication, and then select Tableau with MFA. ![A dialog box with options to authenticate users with or without multi-factor authentication.](/tableau/next/en-us/online/en-us/Img/mfa_option_new_sites.png) 2. Click Update to save changes. 3. Repeat step 2 for each user listed, including site admins. After users sign in to Tableau Cloud with their Tableau username and password, they’re prompted to choose a supported verification method. For more information about the user process for registering and managing a verification method, see [Register for multi-factor authentication](https://help.tableau.com/v0.0/online/en-us/to_signin.htm#mfa_register_user). For an overview of the MFA sign-in experience for Tableau Bridge, tabcmd 2.0, and Tableau REST API, see the [Multi-Factor Authentication: Post Enforcement | Tableau Cloud](https://www.youtube.com/watch?v=8qMMEQZgMLM) video on YouTube. ### MFA best practices for site admin accounts When enabling Tableau with MFA for your users, we recommend the following best practices for your site admin accounts: - **Register a minimum of two verification methods:** For each site admin account, register at least two verification methods to reduce the risk of being locked out of the site. For example, after you’ve registered a primary verification method, we recommend you add the Recovery Codes option to generate a set of recovery codes as backup. - **Designate at least one site admin account to manage users and MFA:** Designate at least one site admin-level account (Site Administrator Creator or Site Administrator Explorer) that has permissions to manage users and MFA settings. This redundancy can help prevent admin access delays if another admin is locked out of the site. ### Manage verification methods You (and your users) can manage verification methods from your My Account Settings page. After clicking the Manage MFA Verification Methods link, you can add or remove additional verification methods, including adding recovery codes. ![A curved arrow points to a list of verification methods.](/tableau/next/en-us/online/en-us/Img/mfa_manage_methods.png) ### About recovery codes - emergency cases only To help reduce the risk of a locked-out scenario, we recommend you (and your users) add the Recovery Codes option as backup after registering for MFA. Recovery codes, to be used in emergency cases only, allow you to sign in to Tableau Cloud if you don't have access to your usual MFA verification methods. If you add the Recovery Codes option, a list of ten one-time use codes are generated that you can use to sign in to Tableau Cloud. **Important:** - Because the list of codes isn't accessible after you've added the Recovery Codes option, immediately copy and store these codes in a safe and secure location for use in emergency situations. - Recovery codes aren't intended to be a primary verification method and should be used as **backup** only. Instead, recovery codes are intended for emergency situations only when you don’t have access to your usual MFA verification methods. ### Regain site access after being locked out **Important:** We strongly recommend that you (and your users) register the Recovery Codes option to help avoid being locked out of your site. Recovery codes should be used in emergency cases only. If you lose all your usual verification methods, you must have your MFA verification methods reset to regain access to the site. The process for resetting MFA verification methods depends on your role and whether you belong to one or more sites. Review the table below to determine next steps.

Your role	Target user	Target site membership	Can reset MFA?	Reason or next steps
Site admin	Site admin or site user	Single site	Yes	Reset verification methods from the Users page. For more information, see Reset verification methods below.
		Multiple sites, same tenant	No	Site admins can't reset MFA verification methods for multi-site users. Only TCM cloud administrators can reset the verification methods for multi-site users. For more information, see Reset verification methods.
		Multiple sites, different tenants	No	For security purposes, site admins or TCM cloud administrators can't reset the verification methods for users on multiple tenants. For more information, see About resetting verification methods for users on multiple tenants below.
Only site admin on site	Yourself	Single site	No	Contact your Tableau account manager. For more information see Regain site access as the only site admin below.

#### Reset verification methods To enable site access, reset the MFA with Tableau verification methods from the Users page in Tableau Cloud. **Important:** For security purposes, a site admin can only reset the verification methods of a user that belongs to a single site. However, if you're also a cloud administrator, you can use Tableau Cloud Manager (TCM) [to reset verification methods](https://help.tableau.com/v0.0/online/en-us/cloud_manager_auth.htm#reset_mfa) of users on multiple sites. If you don't meet one of these requirements, you can contact Tableau Support to file a support case to reset a user's verification methods. For more information, see the[How To Create a Case on Salesforce Help](https://help.salesforce.com/s/articleView?id=000393090&type=1) knowledge article. 1. Sign in to Tableau Cloud as a site admin. 2. Navigate to the Users page and select the user who needs to regain access to the site. 3. Click the Actions menu, and select Reset MFA Verifiers. 4. On the user's profile page, click the Settings tab, and then click the Reset MFA Verifiers button. **Note:** To see the Reset MFA Verifiers button, the user's authentication method must be set to Tableau with MFA. 5. After the MFA verification methods have been reset, contact the user and request that they follow the procedure described in [Register for multi-factor authentication](https://help.tableau.com/v0.0/online/en-us/to_signin.htm#mfa_register_user) to register for MFA again. **Note:** To reset verification methods for users on multiple sites or for Tableau Cloud Manager (TCM) users, see [Reset verification methods](https://help.tableau.com/v0.0/online/en-us/cloud_manager_auth.htm#reset_mfa) for cloud administrators. #### Regain site access as the only site admin If you're the only site admin and you lose all your usual MFA with Tableau verification methods, you must contact your Tableau account manager. To regain access to Tableau Cloud, Tableau must manually confirm your identity and then reset the verification methods. To help ensure a smooth account recovery process, keep the following in mind: - Tableau might use information from your TableauID profile (on [Tableau.com](http://tableau.com/)) to validate who you are. Therefore, it’s important to keep your profile information, such as phone number, up to date. For more information about editing your TableauID profile, see [Changing your Name, Title or Email Address in the Tableau Community](https://community.tableau.com/s/changing-contact-information) on the Tableau Community site. - If you have Premium Support and require assistance on a weekend, you can file a Tableau Support case. For more information, see the [Submitting a Case from the Webform](https://kb.tableau.com/articles/HowTo/submitting-a-case-from-the-webform) knowledge article. For more information, see the [Tableau Cloud Reset Authenticator for Tableau ID with Multi-Factor Authentication](https://kb.tableau.com/articles/issue/reset-authenticator-for-tableau-id-with-multifactor-authentication) knowledge article. #### About resetting verification methods for users on multiple tenants As a security best practice, you must contact Tableau Support to reset the MFA with Tableau verification methods for users who belong to sites across multiple tenants. To contact Tableau Support, follow the steps described in the [How to Create a Case on Salesforce Help](https://help.salesforce.com/s/articleView?id=000393090&type=1) knowledge article. [Skip to main content](#main-content) # Navigate the Admin Areas of the Tableau Web Environment As an administrator on Tableau Server or Tableau Cloud, you can access admin settings that aren’t available to other users to configure sites, users, projects, and to do other content-related tasks. If you’re looking for settings for managing published content, see [Navigate Tableau on the Web](https://help.tableau.com/current/pro/desktop/en-us/navigating.htm) and [Manage Web Content](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm) in Tableau User Help. ## Access based on site role and number of sites The menus you get when you sign in to Tableau Server or Tableau Cloud depend on the following conditions: - Whether you’re a site or server administrator. Site administrator access is available on Tableau Cloud and Tableau Server. Server administrator access is only on Tableau Server. - Whether you have access to only one site or to multiple sites. ### Server administrator

On a single-site server, the site selector does not appear, and all other menus are the same.

In a multi-site environment, menus along the left enable you to modify a specific site or all sites, and to configure users, groups, schedules, tasks, and server settings.

To access server administrator settings that affect all sites, open the site menu by clicking the arrow next to the current site name, and then select Manage all sites.

The Content and Group tabs go away, and the site menu text changes to All Sites to let you know you are managing server-wide settings, and options like Server Status reflect the server-wide view.

To return to the site administration menus, select All Sites, and the select the site you want to manage.

Single-site server menu with no site selector. Site menu showing the selected option for Manage all sites.

### Site administrator

If you are a site administrator for Tableau Cloud or Tableau Server, and you have access to multiple sites, you’ll get menus for selecting which site to manage, and for managing that site’s content, users, groups, schedules, and tasks, and for monitoring its status.

The site selector displays the name of the current site. To go to another site, select the site menu, and then select the site name.

If you have access to only one site, the site selector does not appear, but all other menus are the same.

Multiple-site menu with site selector for accessible sites.

## Server administrator tasks Server administrators (available with Tableau Server Enterprise only) can do the following: - Monitor server status and activity. - Generate log files. - Add sites and edit site settings. Only server administrators can add sites to the server. - Add users to the server, and assign users to sites. - Add and manage site groups. To manage settings only for a specific site, you must first navigate to the site. Within each site, you can do the following: - Administer content: Create projects, move content from one project to another, assign permissions, change ownership of a content resource, and so on. - Manage schedules for extract refreshes and subscriptions. - Monitor site activity and record workbook performance metrics. - Manage storage space limits for content published by users. - Allow web authoring. - Enable revision history. - Allow site administrators to add and remove users. - Set the maximum number of licenses that site can consume for each license type (Creator, Explorer, Viewer). - Allow users to subscribe to workbooks and views, and allow content owners to subscribe others to workbooks and views. - Enable offline snapshots for favorites (iOS only). ## Site administrator tasks A site administrator on Tableau Cloud or Tableau Server can do the following tasks: - Administer content: Create projects, move content from one project to another, assign permissions, change ownership of a content resource, and so on. - View, manage, and manually run schedules for extract refreshes and subscriptions. - Add and manage site users. - Add and manage site groups. - Monitor site activity. [Skip to main content](#main-content) # Navigate Visualizations with Assistive Technology Starting in Tableau version 24.3, you can navigate Marks on all online visualization types on Tableau Cloud using a keyboard and other assistive technologies. Note: Viz navigation isn't currently supported for server-rendered visualizations. To learn more about server and client-side rendering, see [Configure Client-Side Rendering.](https://help.tableau.com/current/server/en-us/browser_rendering.htm) ## Navigate marks in a visualization 1. To activate the experience, navigate to a visualization and press Enter. 2. Select Enter again to navigate the Marks. 3. Use the Arrow keys to navigate between headers, columns, and rows. If your visualization has a dual axis, or if it's a scatter plot or map, an additional navigation affordance appears. Use the Arrow keys to move the focus to a group of marks and select Enter to navigate the marks in the group. 4. To navigate out of the text table, press Esc. Note: Prior to entering mark-level navigation, you can use the Arrow keys to navigate different areas of the view, such as the header and axis. ## Navigate marks in the View Data pane 1. To open the View Data pane, move your focus to the viz and press Shift + Enter. 2. Use the Arrow keys to navigate between headers, columns, and rows. 3. To close the View Data pane, press ALT + F4 (Windows) or Cmd + W (Mac OS). To learn more about keyboard navigation on Tableau, see [Keyboard Accessibility for Tableau Views.](https://help.tableau.com/current/pro/desktop/en-us/access_keyboard_navigation.htm) [Skip to main content](#main-content) # Notify Users of Successful Flow Runs _Supported in Tableau Prep Builder version 2021.4.1 and later and in Tableau Server and Tableau Cloud version 2021.4 and later. Data Management is required to use this feature._ Flow owners can subscribe themselves, individual users, and groups to email notifications for information about scheduled tasks for successful flow runs. The email includes links to data within the Tableau environment, and in Tableau Server, you can optionally include the details of the flow run in attached Excel and CSV files. Flow subscriptions are added to scheduled tasks for flows. You can add flow subscriptions when you create a new flow task or to an existing flow task. Email notifications are sent when the scheduled task is completed successfully. ## Configure the site settings for flow subscriptions By default, the Flow Subscriptions site setting for sending and receiving email notifications is enabled. ![The Flow Subscriptions site setting showing the check box for sending and receiving email notifications selected.](/tableau/next/en-us/online/en-us/Img/prep_conductor_subscribe_site.png) - The Let users send or receive emails that include flow output data option allows the flow owner to receive, and subscribe users and groups to successful flow run notifications. From the notification email, users can access the full data source or view the flow details from within Tableau. - Tableau Server only (not recommended): The Attach .csv and .xlsx flow output files option lets the flow owner attach files to notification emails. The email recipients must be added to Tableau server, however, the files contain the data source and can be exposed outside of the Tableau system. This option is available only for on-premise environments. ## Publish the Flow Publish the flow output as either a file, database table, or data source. Consider the following when saving the flow: - (On-premise only) When publishing you can save the output as a file or as a database table and choose to attach either a .csv or .xlsx file type to the email. - When publishing and saving the output as a published data source, the email notification provides a link to the flow in Tableau. Files cannot be attached to the email. - When choosing to save as a file output, you must use a network share and the output and input location must be included in a safe list. For more information, see [Step 4: Safe list Input and Output locations](https://help.tableau.com/current/server/en-us/prep_conductor_configure_network_shares.htm). - Flow subscriptions are supported on Windows and Linux. The following restrictions apply to flow subscriptions on Linux: - File outputs must be output to a Windows server. - For flows that output to a file, use the UNC format for the path: \\\\server\\path\\filename. Do not use a local drive letter. - The mounted path must be safe listed. - When attaching files to an email, the file limit is approximately 25 MB for Tableau Cloud. When using an on-premise Tableau Server, you configure the size of attachment files. ## Add a flow subscription 1. As the owner of the flow, select a published flow in Tableau Server or Tableau Cloud that you want to add subscriptions to for email notifications. 2. You can add subscriptions to a new or existing task: - If you are adding a subscription to a new task: 1. Click Scheduled Tasks > New Task. 2. In the New Task dialog select a schedule to run the flow from the Select a schedule drop-down list. 3. Enable Send email when done - If you are adding a subscription to an existing task: 1. Click Subscriptions > Subscribe. 2. In the Add Flow Subscriptions dialog, select a schedule from the Frequency drop-down list. 4. In the Send to field, start typing the name of the user or group to populate the field. Select the users and groups that you want to send a notification to. Users and groups must be added to the Tableau environment by the administrator. 5. (Optional) To be included in the notification, check the Send to me box. 6. (Optional) In the Subject field, customize the default email subject line for the flow run notification. 7. (Optional) Add information about the flow run in the Email message text box. 8. Click Include output data and select the type of output that you want to include in the email. - In Tableau Server, if you published your flow as a file or database table output you can choose to attach .csv or .xlsx files containing the data source to the email. This is not recommended because data can be exposed outside of the Tableau system. ![The check box to include the data source as an attachement when publishing flow output as a file or to a database table.](/tableau/next/en-us/online/en-us/Img/prep_conductor_subscribe_text_out.png)- If you published your flow as a data source, you can choose to include the link to the data source. Attaching files to the email is not supported. ![The check box to include the link to the data source when publishing flow output as a data source.](/tableau/next/en-us/online/en-us/Img/prep_conductor_subscribe_pub_data.png) 10. If you are adding a subscription to an existing task, click Subscribe. ## Unsubscribe from a flow subscription To unsubscribe from notifications from the email, follow these steps. 1. Click Unsubscribe from the bottom of a subscription email. 2. As the flow owner, Sign in to Tableau Server or Tableau Cloud. At the top of the page, click the Notifications icon. 3. Expand the … menu, then select Remove notification. To unsubscribe and remove the subscription as the flow owner, follow these steps. 1. Click Subscriptions. 2. Open the published flow in Tableau Server or Tableau Cloud. 3. From the list of flow subscriptions, click the selection box for the flow you want to unsubscribe from. 4. Select Actions \> Unsubscribe. ![The Subscriptions tab Action menu showing the Unsubscribe option.](/tableau/next/en-us/online/en-us/Img/prep_conductor_subscribe_unsbscribe.png) ## View Subscriptions You can view your current flow subscriptions in Tableau Server or Tableau Cloud. - From the Subscriptions tab on the Overview page of the flow, you can see the list of current subscriptions. - From the Subscriptions tab on the Tasks page, you can see the list of subscriptions along with subscriptions to workbooks. ## Resume suspended flow subscriptions Sometimes, subscriptions fail because of an issue with the flow. If a subscription fails more than five times, you'll receive a notification email thatyour scheduled flow task has been suspended. From the flow Overview page, you can see when a scheduled flow task fails. ![The flow Overview page that shows the details for a flow run, including the output step, output name, status, schedule, and errors.](/tableau/next/en-us/online/en-us/Img/prep_conductor_subscribe_overview.png) There are a few ways to resume a suspended flow task. If you're flow owner: - From the My Content area of Tableau web pages, an icon appears in the Last update column to indicate that the subscription is suspended. Select ... > Resume Scheduled Tasks to resume. ![The menu options to resume a suspended flow task with the option Resume Scheduled Tasks highlighted.](/tableau/next/en-us/online/en-us/Img/prep_conductor_subscription_resume.png) - From the Scheduled Tasks page, an icon appears in the last update column to indicate that the subscription is suspended. Select the flow, then click Actions \> Resume.![The Scheduled Tasks tab Action menu showing the Resume option.](/tableau/next/en-us/online/en-us/Img/prep_conductor_subscribe_resume_task.png) ## Access the flow data from a notification email Depending on how the flow notification was configured, you can access the data source and file attachments from the notification email. - Click View Flow to open the flow in Tableau Server or Tableau Cloud. - Click the attachment file to view the flow data. ![An email notification that confirms the successful execution of a flow. The email provides details about the flow, its data source, and the sender.](/tableau/next/en-us/online/en-us/Img/prep_conductor_subscribe_email.png) ### Who can do this - Flow owners can create flow notification subscriptions for flows that they own. - To receive notifications, users and groups must be added to the Tableau environment by the administrator. For more information, review the following articles: - Windows: [Set Users' Site Roles](https://help.tableau.com/current/server/en-us/users_site_roles.htm) and [Content Permissions and Ownership](https://help.tableau.com/current/server/en-us/permissions.htm) - Linux: [Set Users’ Site Roles](https://help.tableau.com/current/server-linux/en-us/users_site_roles.htm) and [Content Permissions and Ownership](https://help.tableau.com/current/server-linux/en-us/permissions.htm) [Skip to main content](#main-content) # OAuth Connections An alternative to storing your sensitive database credentials with Tableau Cloud or Tableau Server is to create connections using the **OAuth 2.0** standard. The following connectors support OAuth authentication: - Amazon Athena - Anaplan - Azure Data Lake Storage Gen2, Azure SQL, Azure Synapse - Box - Esri ArcGIS Server - Databricks - Denodo - Dremio - Dropbox - Google Ads, Google Analytics, Google BigQuery, Google Drive - Impala - LinkedIn Sales Navigator - Marketo - OneDrive and SharePoint Online - Oracle Eloqua - QuickBooks Online - Salesforce, Salesforce CDP - SAP HANA - ServiceNow ITSM - Snowflake From Tableau, when users sign in to data with a connector that uses OAuth, users are redirected to the authentication provider’s sign in page. After users provide their credentials and authorize Tableau to access their data, the authentication provider sends Tableau an **access token** that uniquely identifies Tableau and the users. This access token is used to access data on users' behalf. For more information, see [Overview of the OAuth process](#Overview) below. Using OAuth-based connections provides the following benefits: - **Security:** Your database credentials are never known to or stored in Tableau Cloud, and the access token can be used only by Tableau on behalf of users. - **Convenience:** Instead of having to embed your data source ID and password in multiple places, you can use the token provided for a particular data provider for all published workbooks and data sources that access that data provider. **Note:** For live connections to Google BigQuery data, each workbook viewer can have a unique access token that identifies the user, rather than sharing a single username and password credential. ## Overview of the OAuth process The following steps describe a workflow in the Tableau environment that calls the OAuth process. 1. A user takes an action that requires access to a cloud-based data source. For example, you open a workbook that’s published to Tableau Cloud. 2. Tableau directs the user to the cloud data provider’s sign in page. The information that is sent to the data provider identifies Tableau as the requesting site. 3. When the user signs in to the data, the provider prompts the user to confirm their authorization for Tableau Cloud to access the data. 4. Upon the user's confirmation, the data provider sends an access token back to Tableau Cloud. 5. Tableau Cloud presents the workbook and data to the user. ![A diagram of the data flow between your laptop, Tableau Cloud, and your database.](/tableau/next/en-us/online/en-us/Img/protected_auth_online.png) **Note**: Support for single use refresh tokens (sometimes called one-time use refresh tokens, rolling refresh tokens, or refresh token rotation) for OAuth connections was added in Tableau Cloud with the 2025.2 (Summer 2025) release and added in Tableau Server with the 2025.3 release if the IDP of the data source provider supports it. These are not yet supported on Tableau Bridge connections to Tableau Cloud. If you use the external OAuth configuration for the connection, please see the [OAuth Configuration and Usage documentation](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth Config docs") in GitHub for more information. The following user workflows can use the OAuth process: - Creating a workbook and connecting to the data source from Tableau Desktop or from Tableau Cloud. - Publishing a data source from Tableau Desktop. - Signing in to a Tableau Cloud site from an approved _client_, such as Tableau Mobile or Tableau Desktop. - Using Tableau Bridge to access on-premises data. See [Connectivity with Bridge](https://help.tableau.com/current/online/en-us/to_sync_local_data.htm#authentication). ## Default saved credential connectors _Saved credentials_ refers to the functionality where Tableau Cloud stores user tokens for OAuth connections. This allows users to save their OAuth credentials to their user profile on Tableau Cloud. After they’ve saved the credentials, they won’t be prompted when they subsequently publish, edit, or refresh when accessing the connector. **Note**: When editing Tableau Prep flows on the web, you may still be prompted to reauthenticate. All supported connectors are listed under Saved Credentials for Data Sources on users’ My Account Settings page on Tableau Cloud. Users manage their saved credentials for each connector. ### Access tokens for data connections You can embed credentials based on access tokens with data connections, to enable direct access after the initial authentication process. An access token is valid until a Tableau Cloud user deletes it, or the data provider revokes it. It’s possible to exceed the number of access tokens your data source provider allows. If that's the case, when a user creates a token, the data provider uses the length of time since last access to decide which token to invalidate to make room for the new one. ### Access tokens for authentication from approved clients By default, Tableau Cloud sites allow users to access their sites directly from approved Tableau clients, after users provide their credentials the first time they sign in. This type of authentication also uses OAuth access tokens to store the users' credentials securely. For more information, see [Access Sites from Connected Clients](https://help.tableau.com/v0.0/online/en-us/to_connected_clients.htm). ## Default-managed keychain connectors _Managed keychain_ refers to the functionality where OAuth tokens are generated for Tableau Cloud by the provider and shared by all users in the same site. When a user first publishes a data source, Tableau Server prompts the user for the data source credentials. Tableau Cloud submits the credentials to the data source provider, which returns OAuth tokens for Tableau Cloud to use on behalf of the user. On subsequent publishing operations, the OAuth token stored by Tableau Cloud for the same class and username is used so that the user isn’t prompted for the OAuth credentials. Should the data source password change, then the preceding process is repeated and the old token is replaced by a new token on Tableau Cloud. Additional OAuth configuration on Tableau Cloud isn't required for the default-managed keychain connectors: - Google Analytics, Google BigQuery, and Google Sheets (deprecated in March 2022) - Salesforce ## Configure custom OAuth Beginning with 2021.2, as a site admin, you can configure a custom OAuth client, for each OAuth supported data provider (connector), to override the pre-configured OAuth client settings for your site. You might consider configuring a custom OAuth client to support securely connecting to data that requires unique OAuth clients. When a custom OAuth client is configured, default configurations are ignored and all new OAuth credentials created on the site use the custom OAuth client by default. **Important:** Existing OAuth credentials established before the custom OAuth client is configured are temporarily usable but both site admins and users must update saved credentials to help ensure uninterrupted data access. ### Step 1: Prepare the OAuth client ID, client secret, and redirect URL Before you can configure the custom OAuth client, you must collect the information listed after this. After you have this information, you can configure the custom OAuth client for each of the OAuth supported connector. - **OAuth client ID and client secret:** First register the OAuth client with the data provider (connector) to retrieve the client ID and client secret. Supported connectors include: - Azure Data Lake Storage Gen2, Azure SQL Database, Azure Synapse - Databricks - Dremio - Dropbox - Google Analytics, Google BigQuery, Google Sheets (deprecated in March 2022) - Impala - Intuit Quick books Online - Salesforce, Salesforce CDP - Snowflake (For more information, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) in the Tableau Connector SDK documentation.) - **Redirect URL:** Note the pod your Tableau Cloud site is located to ensure you enter the correct redirect URL during the registration process in **Step 2** below. The redirect URL uses the following format: https://.online.tableau.com/auth/add\_oauth\_token For example, https://us-west-2b.online.tableau.com/auth/add\_oauth\_token **Note:** For more information about pods, see the [Salesforce Trust](https://status.salesforce.com/products/tableau) page. If you have set up a custom domain for your site, the OAuth client must use the custom domain as the redirect URL. For example, if your custom domain is "analytics.example.com", the redirect URL will be "https://analytics.example.com/auth/add\_oauth\_token". For more information, see [Use a Custom Domain with Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/custom_domain.htm). ### Step 2: Register OAuth client ID and client secret Follow the procedure described below to register the custom OAuth client to your site. 1. Sign in to Tableau Cloud using your site admin credentials and navigate to the Settings page. 2. Under OAuth Clients Registry, click the Add OAuth Client button. 3. Enter the required information, including the information from **Step 1** above: **Note:** Leave the OAuth Instance URL field blank unless using multiple OAuth clients. 1. For Connection Type, select a database class value that corresponds to the connector whose custom OAuth client you want to configure. 2. For Client ID, Client Secret, and Redirect URL, enter the information you prepared in **Step 1** above. 3. Click the Add OAuth Client button to complete the registration process. ![A form for the creation of an OAuth client, including fields for connection type, OAuth instance URL, client ID, client secret, and redirect URL.](/tableau/next/en-us/online/en-us/Img/oauth_custom.png) 4. (Optional) Repeat step 3 for additional connectors. 5. Click the Save button at the bottom or top of the Settings page to save changes. ### Step 3: Validate and update saved credentials To help ensure uninterrupted data access, you (and your site users) must delete the previous saved credentials and add it again to use the custom OAuth client instead of the default OAuth client. 1. Navigate to your My Account Settings page. 2. Under Saved Credentials for Data Sources, do the following: 1. Click Delete next to the existing saved credentials for the connector whose custom OAuth client you configured in **Step 2** above. 2. Next to the same connector, click Add, and follow the prompts to 1) connect to the custom OAuth client configured in **Step 2** above and 2) save the latest credentials. ### Step 4: Notify users to update their saved credentials Make sure you notify your site users to update their saved credentials for the data provider whose custom OAuth client you configured in **Step 2** above. Site users can use the procedure described in [Update saved credentials](https://help.tableau.com/v0.0/online/en-us/manage_stored_credentials.htm#oauth_update_credentials) to update their saved credentials. ## Other articles in this section [Skip to main content](#main-content) # OpenID Connect You can configure Tableau Cloud or Tableau Cloud Manager (TCM) to support OpenID Connect (OIDC) for single sign-in (SSO). OIDC is a standard authentication protocol that lets users sign in to an identity provider (IdP) such as Google or Salesforce. After they've successfully signed in to their IdP, they are automatically signed in to Tableau Cloud or TCM. Configuring OIDC involves several steps. The topics in this section provide general information about using Tableau Cloud or TCM with OIDC, and provide a sequence for configuring the IdP and Tableau Cloud or TCM. **Note:** Separate setup and app integration is required to enable OIDC authentication for Tableau Cloud and TCM. To configure OIDC using the Tableau REST API, see [OpenID Connect Authentication Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_openid_connect.htm) in the Tableau REST API Help. **Note:** Applies to Tableau Cloud only. ## Authentication overview This section describes the OpenID Connect (OIDC) authentication process with Tableau Cloud or TCM. ![](/tableau/next/en-us/online/en-us/Img/openid_auth_overview_cloud.png) 1\. A user attempts to log in to Tableau Cloud or TCM from a client computer. 2\. Tableau Cloud redirects the request for authentication to the IdP gateway. 3\. The user is prompted for credentials and successfully authenticates to the IdP. The IdP responds with a redirect URL back to Tableau Cloud or TCM. The redirect URL includes an authorization code for the user. 4\. The client is redirected to Tableau Cloud or TCM and presents the authorization code. 5\. Tableau Cloud or TCM presents the client's authorization code to the IdP along with its own client credentials. Tableau Cloud or TCM is also a client of the IdP. This step is intended to prevent spoofing or man-in-the-middle attacks. 6\. The IdP returns an access token and an ID token to Tableau Cloud or TCM. - JSON Web Token (JWT) validation: By default Tableau performs a validation of the IdP JWT. During discovery, Tableau retrieves the public keys specified by the `jwks_uri` in the IdP configuration discovery document. Tableau validates the ID token for expiry and then verifies the JSON web signature (JWS), the issuer (IdP), and the client ID. You can learn more about the JWT process in the OIDC documentation, [10\. Signatures and Encryption](http://openid.net/specs/openid-connect-core-1_0.html#SigEnc), and the IETF proposed standard, [JSON Web Token](https://tools.ietf.org/html/rfc7519). We recommend leaving JWT validation enabled, unless your Idp does not support it. - The ID token is a set of attribute key-pairs for the user. The key-pairs are called _claims_. Here is an example IdP claim for a user: "sub" : "7gYhRR3HiRRCaRcgvY50ubrtjGQBMJW4rXbpPFpg2cptHP62m2sqowM7G1LwjN5" "email" : "alice@example.com", "email\_verified" : true, "name" : "Alice Adams", "given\_name" : "Alice", "family\_name" : "Adams" 7\. Tableau Cloud or TCM identifies the user from the IdP claims and completes the authentication request from step 1. Tableau Cloud can be configured to use different claims for this process. See [Requirements](https://help.tableau.com/v0.0/online/en-us/openid_auth_server_config.htm#requirements). 8\. Tableau Cloud or TCM authorizes the user. ## How Tableau works with OpenID Connect OpenID Connect (OIDC) is a flexible protocol that supports many options for the information that's exchanged between a service provider (here, Tableau Cloud or TCM) and an IdP. The following list provides details about the Tableau Cloud and TCM implementation of OIDC. These details can help you understand what types of information Tableau Cloud or TCM sends and expects, and how to configure an IdP. - Tableau Cloud and TCM supports only the OpenID Authorization Code Flow as described in the [OpenID Connect final specification](http://openid.net/specs/openid-connect-core-1_0.html) in the OpenID Connect documentation. - Tableau Cloud and TCM relies on using discovery or a provider URL to retrieve the IdP metadata. - Tableau Cloud and TCM supports the `client_secret_basic` (default) and `client_secret_post` client authentication, and other parameters specified in the OpenID Connect specification. These can only be configured using the Tableau REST API. ## Dynamic group membership in OIDC claims **Note:** Applies to Tableau Cloud only. Beginning in June 2024, if OIDC authentication is configured and the capability’s setting enabled, you can dynamically control group membership through custom claims included in the JSON Web Token (JWT) sent by the identity provider (IdP). When configured, during user authentication, the IdP sends the OIDC assertion that contains two custom group membership claims: group (`https://tableau.com/groups`) and group names (for example, "Group1" and "Group2") to assert the user into. Tableau validates the assertion and then enables access to the groups and the content whose permissions are dependent on those groups. For more information, see [Dynamic group membership using assertions](https://help.tableau.com/v0.0/online/en-us/to_add_users_groups.htm#assertions). **Example JWT** "sub" : "7gYhRR3HiRRCaRcgvY50ubrtjGQBMJW4rXbpPFpg2cptHP62m2sqowM7G1LwjN5", "email" : "alice@example.com", "email\_verified" : true, "name" : "Alice Adams", "given\_name" : "Alice", "family\_name" : "Adams", "https://tableau.com/groups": \["Group1", "Group2"\] ## User attributes in OIDC claims **Note:** Applies to Tableau Cloud only. Beginning in October 2025 (Tableau 2025.3), when configured and the capability's setting is enabled, you can pass users attribute claims in the JSON Web Token (JWT) sent by the identity provider (IdP) to Tableau Cloud during sign-in. These user attributes can be used with Tableau's user attribute functions `(USERATTRIBUTE()`, `USERATTRIBUTEINCLUDES()`) to dynamically control and customize content. Tableau validates the claims and then enables access to the content. For more information, see [Customize and control data access using user attributes](https://help.tableau.com/v0.0/online/en-us/openid_auth_server_config.htm#user_attributes). **Example JWT** "sub" : "7gYhRR3HiRRCaRcgvY50ubrtjGQBMJW4rXbpPFpg2cptHP62m2sqowM7G1LwjN5", "email" : "alice@example.com", "email\_verified" : true, "name" : "Alice Adams", "given\_name" : "Alice", "family\_name" : "Adams", "region" : \["South", "South West"\] ## Other articles in this section [Skip to main content](#main-content) # Optimize Bridge Refresh Performance Tableau Bridge supports extract refreshes of published data sources and embedded data sources. Publish data sources allow you to widen the audience for your data analysis within your organization. Embedded data sources are saved to a workbook and can be shared easily without having to separately share the data source. Both published data sources and embedded data sources have advantages. In general, a published data source refresh through bridge is best for long-running refresh tasks. An embedded data source refresh through bridge is best for short running refresh tasks and for integrated data sources. The table below shows a few recommendations for choosing between published data sources and embedded data sources based on performance when using Bridge. **Note**: Performance can vary depending on the hardware and infrastructure you’re running on.

Use a published data source	Use an embedded data source
Publishing data sources is a step toward centralizing data management. You can share the data source with multiple workbooks and create policies geared toward minimizing data source proliferation and helping people find the right data for the work they do. For more information about published data sources, see Best Practices for Published Data Sources.	You don’t want to share the data sources. Data is available only inside the workbook; it isn’t available for other users to connect to.
When connecting to an integrated data source that includes only private network connections or where there are only lightweight public connections along with private network connections.	The embedded data source includes large data sets from a public network data source and short-running tasks from private network connections.
For long-running refresh tasks, and depending on your Bridge deployment, a published data source can deliver better performance.	For short running refresh tasks. Using embedded data sources may not provide optimal performance if the refresh time for your data source is expected to be more than 10 minutes on an existing published data source or workbook with direct connections to data. To ensure that long-running refresh tasks don't take up all system resources and don't prevent refreshes of other extracts on your site, Tableau Cloud enforces a timeout limit of 120 minutes for refresh tasks. See Time limit for extract refreshes.

## Troubleshooting an embedded data source extract refresh If a refresh task reaches the timeout limit, you can try to resolve the issue using the following options. - Reduce the size of extracts. For more information, see [Optimize for Extracts.](https://help.tableau.com/current/server/en-us/perf_optimize_extracts.htm) - If you’re using a full refresh, using an incremental refresh may help in some instances. For more information, see [Staying within the timeout limit](https://help.tableau.com/current/online/en-us/schedule_add.htm). - Convert the embedded data source to a published data source. [Skip to main content](#main-content) # Optimize Data for Ask Data **Important changes for Ask Data and Metrics** Tableau's Ask Data and Metrics features were retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau AI and Tableau Pulse are reimagining the data experience.](https://www.tableau.com/blog/tableau-pulse-and-tableau-gpt) If you manage and publish data sources, here are some tips to help make users of Ask Data more successful. By spending a little extra time on this process, you'll open up data analysis to a wider range of people at your organization, helping them independently answer questions and gain deeper insights. ## Optimize data in Ask Data In the Data pane on the left of the Ask Data interface, data source owners can add synonyms for fields and exclude irrelevant values. ### Changing settings at the data source or lens level When changing settings in the Data pane for Ask Data, pay close attention to whether you're at the data source or lens level. (For more information, see [Create Lenses that Focus Ask Data for Specific Audiences](https://help.tableau.com/current/pro/desktop/en-us/ask_data_lenses.htm).) - At the data source level, you'll see the cylindrical data source icon in the upper left corner. Here, changes you make in the Data pane will apply by default to all subsequently created lenses. **Note:** For extracts, two cylinders will appear. ![Super Store dashboard with the data source icon highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_edit_data_source.png) - For an individual lens, you'll see the quotation icon in the upper left corner. Here, changes you make in the Data pane will apply to this lens alone. ![Super Store dashboard with the data lens icon highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_edit_data_lens.png) ### Add synonyms for field names and values People may not use the same terminology found in your data source, so data source owners and Tableau administrators can [add synonyms for specific data field names and values](https://help.tableau.com/current/pro/desktop/en-us/ask_data_synonyms.htm). Synonyms you enter are available throughout your organization, making data analysis quicker and easier for everyone. ### Exclude values of specific fields from search results To improve the usability of search results in Ask Data, you can exclude the values of specific fields from indexing. Though Ask Data doesn't add non-indexed values to search results, the values still appear in visualization results when relevant. For example, if you don't index values from a "Product" field because they add unnecessary detail to search results, Ask Data can still display values such as "iPhone 12" in resulting data visualizations. And users can manually add non-indexed values to queries by surrounding them with quotation marks (for example, "Sales for Product containing "iPhone 12" ). **Note:** This field-level setting is ignored if [the value indexing setting for the data source](https://help.tableau.com/current/pro/desktop/en-us/ask_data_enable.htm#Indexing) is set to Disabled. Field names and related synonyms are always indexed. 1. Go to the Ask Data tab for a data source or individual lens. 2. Hover over a data source field at left, and click the Edit Field Details icon (the pencil). ![A list of fields with the edit icon next to one value.](/tableau/next/en-us/online/en-us/Img/ask_data_synonyms.png) 3. Deselect Index field values. Either click the text box that appears to reindex the data source now, or let it reindex based on its regular indexing schedule. ## Optimize data sources To create the best experience for Ask Data users, optimize the original data source. **Note:** Ask Data doesn't support multidimensional cube data sources, or non-relational data sources like Google Analytics, or data sources with a virtual connection. ### Optimize indexing for Ask Data Data source owners can change how often field values are indexed for Ask Data, optimizing system performance. 1. At the top of a data source page, click the Details icon: ![World Indicators data source name displays with the information icon highlighted.](/tableau/next/en-us/online/en-us/Img/ask_data_datasource_details.png) 2. In the Ask Data section, click Edit. 3. Choose an indexing option for field values: - Automatic checks for changes every 24 hours and analyzes the data source if it is live, has had an extract refreshed, or has been republished. Choose this option for a data source frequently used with Ask Data, so it will be ready before users query it. - Manual analyzes the data source only when Tableau creators manually trigger indexing on the data source page. Choose this option if the data source changes frequently but users query it with Ask Data only occasionally. To trigger manual indexing, go to the data source page, click the circled "i" in the Data pane at left, and then click Reindex Data Source. ![The Data Indexed section shows the date and time the data was last indexed and provides a button to reindex the data source.](/tableau/next/en-us/online/en-us/Img/ask_data_reindex.png) - Disabled analyzes only field names, not values. 4. Click Save ### Use data extracts for faster performance For improved performance and support for large data sets, use Ask Data with published extracts rather than live data sources. For more information, see [Create an extract](https://help.tableau.com/current/pro/desktop/en-us/extracting_data.htm). ### Ensure that users can access the data source To use Ask Data, users must have permission to connect to the individual data source. If a data source has row-level permissions, those permissions also apply to Ask Data, which won't recognize secure values or make related statistical recommendations. ### Be aware of unsupported data source features Ask Data supports all Tableau data source features except the following. If your data source contains these, Ask Data users won't be able to query related fields. - Sets - Combined fields - Parameters ### Anticipate user questions Anticipate the kinds of questions your users will ask, and then optimize your data source for those questions using these techniques: - Clean and shape data [in Tableau Prep](https://help.tableau.com/current/prep/en-us/prep_clean.htm) or a similar tool. - [Join data](https://help.tableau.com/current/pro/desktop/en-us/joining_tables.htm) to include all fields users may have questions about in one table, improving performance. - Add [calculated fields](https://help.tableau.com/current/pro/desktop/en-us/calculations_calculatedfields.htm) that answer common user questions. - Create [bins with appropriate sizes](https://help.tableau.com/current/pro/desktop/en-us/calculations_bins.htm) for quantitative variables that users are likely to want to see as a histogram or another binned form. ### Simplify the data To make data easier to understand by both users and Ask Data, simplify the data source as much as possible during the data prep process. 1. Remove any unnecessary fields to improve performance. 2. Give each field a unique and meaningful name. - For example, if there are five field names that start with "Sales …", better distinguish them so Ask Data can properly interpret the term "sales". - Rename "Number of records" to something more meaningful. For example, use "Number of earthquakes" in a data source where each record is an earthquake. - Avoid field names that are numbers, dates, or boolean ("true" or "false") values. - Avoid names which resemble analytical expressions such as "Sales in 2015" or "Average Products Sold". 3. Create meaningful [aliases for field values](https://help.tableau.com/current/pro/desktop/en-us/datafields_fieldproperties_aliases_ex1editing.htm), reflecting terms people would use in conversation. ### Set appropriate field defaults To help Ask Data analyze data correctly, ensure that default field settings reflect the content of each field. - [Set data types](https://help.tableau.com/current/pro/desktop/en-us/datafields_typesandroles_datatypes.htm) for text, time, date, geographic, and other values. - [Assign the proper data role](https://help.tableau.com/current/pro/desktop/en-us/datafields_typesandroles.htm): dimension or measure, continuous or discrete. - For each measure, [assign appropriate default settings](https://help.tableau.com/current/pro/desktop/en-us/datafields_fieldproperties.htm) in Tableau Desktop, such as color, sort order, number format (percentage, currency, etc.), and aggregation function. For example, SUM may be appropriate for "Sales", but AVERAGE might be a better default for "Test Score". **Tip:** It's particularly helpful to set a default comment for each field, because these comments appear as informative descriptions when users hover over fields in Ask Data. ### Create hierarchies for geographic and categorical fields For time data, Tableau automatically creates hierarchies, which let users quickly drill up and down in vizzes (for example, from day to week to month). For geographic and categorical data, however, we recommend that you [create custom hierarchies](https://help.tableau.com/current/pro/desktop/en-us/qs_hierarchies.htm) to help Ask Data produce visualizations that reflect the relationships between fields. Be aware that Ask Data won't show the hierarchies in the data pane. Ask Data doesn't index hierarchy names, only names of fields within hierarchies. For example, if a geographic hierarchy named "Location" contains "Country" and "City" fields, users should enter "Country" and "City" in their questions for Ask Data. [Skip to main content](#main-content) # Optimize Relationship Queries Using Performance Options Performance Options are optional settings that define the cardinality (uniqueness) and referential integrity (matching records) between the two tables in a relationship. These settings help Tableau optimize queries during analysis. - **If you aren't sure what to choose**, use the recommended default settings indicated by Tableau. Using the defaults is safe and will automatically generate correct aggregations and joins during analysis. If you don't know the cardinality or referential integrity, you don't need to change these settings. - **If you know the shape of your data**, you can optionally change these settings to represent uniqueness and matching between the records in the two tables. In many analytical scenarios, using the default settings for a relationship will give you all of the data you need for analysis. In some scenarios, you might want to adjust the Performance Options settings to describe your data more accurately. For more details about using relationships to combine and analyze data, see [Relate Your Data](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm) and this Tableau blog post: [Relationships, part 1: Introducing new data modeling in Tableau](https://www.tableau.com/about/blog/2020/5/relationships-part-1-meet-new-tableau-data-model). ## What the Cardinality and Referential Integrity settings mean ![Performance option settings for editing a relationship, including cardinality and referential integrity.](/tableau/next/en-us/online/en-us/Img/data_model_perfoptions.png) ### Cardinality options Cardinality settings determine if Tableau aggregates table data before or after automatically joining the data during analysis. - Select **Many** if the field values aren't unique, or you don't know. Tableau will aggregate the relevant data before forming joins during analysis. - Select **One** if field values are unique. During analysis, the relevant data will be joined before aggregation. Setting this option correctly optimizes queries in the workbook when the field values in the relationship are unique. However, selecting **One** when field values aren't unique can result in duplicate aggregate values being shown in the view. > [!TIP] > > **Note**: Selecting **One** treats records as if each key value is unique and there is at most only one row with a null value. ### Referential Integrity options Referential Integrity settings determine the type of join used to get the dimension values for a measure during analysis. - Select **Some Records Match** if some values in the field don't have a match in the other table, or you don't know. During analysis, Tableau uses outer joins to get dimensions values for a measure. All measure values will be shown in the view, even unmatched measures. - Select **All Records Match** if values in the field are guaranteed to have a match in the other table. This setting generates fewer and simpler joins during analysis, and optimizes queries. You might see inconsistent results during analysis (unmatched values removed or missing in view) if there are unmatched values in this table. **Notes**: Selecting **All Records Match** treats records as if no null values exist in the fields used for the relationship. During analysis, Tableau will use inner joins to get dimension values for a measure. By default, Tableau will never join null keys. For more information about Cardinality and Referential integrity as concepts, see [Cardinality and Referential Integrity](https://help.tableau.com/current/pro/desktop/en-us/cardinality_and_ri.htm). ## Where did joins go? You can still specify joins between tables in the physical layer of a data source. Double-click a logical table to go to the join canvas. Every top-level, logical table contains at least one physical table. Open a logical table to view, edit, or create joins between its physical tables. Right-click a logical table, and then click Open. Or, just double-click the table to open it. ![Data model with two joins.](/tableau/next/en-us/online/en-us/Img/data_model_singletable_joins.gif) When you create a data source, it has two layers. The top-level layer is the logical layer of the data source. You combine data between tables in the logical layer using relationships. The next layer is the physical layer of the data source. You combine data between tables at the physical layer using joins. For more information, see [Logical and physical tables in the data model](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel.htm#dm_log_phys). ![A data model diagram displays a logical layer with two tables linked by a relationship, and a physical layer that illustrates how the logical tables are constructed from physical tables.](/tableau/next/en-us/online/en-us/Img/data_model_layers_sm.png) ## Tips on using Performance Options If you know the shape of your data, you can use the optional settings in Performance Options to establish the cardinality of the tables to each other (one-to-one, one-to-many, many-to-many) and indicate referential integrity (values from one table will always have match in the other table). Instead of thinking of the settings in Performance Options as "yes" and "no", think of them as "yes" and "I don't know". If you are sure that a table's values are unique, select **One**. If you are sure that each record in one table matches one or more records in the other table, select **All Records Match**. Otherwise, leave the default settings as they are. If you aren't sure about the shape of your data, use the default settings. When Tableau can't detect these settings in your data, the default settings are: - Cardinality: Many-to-Many - Referential integrity: Some Records Match If Tableau detects key relationships or referential integrity in your data, those settings will be used and indicated as "detected". To reapply the default settings, click Revert to Default. ### Terms defined _Cardinality_ refers to the uniqueness of data contained in a field (column) or combination of fields. When the tables you want to analyze contain many rows of data, queries can be slow (and performance of the overall data source is affected) so we recommend choosing a method for combining data based on the cardinality of the related columns between tables. - Low cardinality: When related columns have a lot of repeated data. For example, a table called Products might contain a Category column that contains three values: Furniture, Office Supplies, and Technology. - High cardinality: When related columns have highly unique data. For example, a table called Orders might contain an Order ID column that contains a unique value for every order of product. _Referential integrity_ means that one table will always have a matching row in the other table. For example, a Sales table will always have a matching row in the Product Catalog table. [Skip to main content](#main-content) # Outbound Private Connect Outbound Private Connect for AWS (Amazon Web Services) allows cloud administrators to create secure, private, and dedicated connections between Tableau Cloud and AWS-hosted data providers. These private connections are provisioned on top of AWS PrivateLink, using private IP address space, meaning that data traffic doesn't traverse the public internet. The private and secure nature of private connections addresses a key requirement of restricting data traffic to private networks. ![Private Connection Diagram, including AWS and Tableau clouds, endpoint, endpoint service, and data provider](/tableau/next/en-us/online/en-us/Img/private_connect_diagram.png) After the private connection is created and ready, creators use the connection address like any other database address in workbook and data source connection dialogs. Likewise, administrators and creators use the connection address when creating virtual connections. Supported AWS data providers are: - Athena - Aurora MySQL - Databricks - Dremio - Heroku Postgres - MariaDB - Microsoft SQL - MySQL - Oracle - Palantir - PostgreSQL - Redshift - Snowflake - Teradata Vantage Cloud - Teradata Vantage On-Premise Your ability to work with outbound private connections depends on your role: - **Cloud administrators** create outbound private connections in Tableau Cloud Manager (TCM), and assign them to sites. They can also provide connection information to creators and the groups that support them. - Site administrators have read-only access to information about the outbound private connections that are assigned to their site. They can also provide connection information to creators and the groups that support them. - Creators use outbound private connections to securely connect to data stored in AWS. Using an outbound private connection in a workbook, data source, or virtual connection is as simple as using a regular, non-private connection, except the creator uses a special connection address provided by the site administrator or cloud administrator. The data traffic doesn't traverse the public internet, but is instead restricted to private connections between AWS Virtual Private Clouds (VPCs). ## Example use cases ### Scenario 1: Avoid public internet Your organization's data is in Snowflake. Network security policy prevents Tableau Cloud from reaching the Snowflake data over the public internet. **With Outbound Private Connect** You create an outbound private connection between your Tableau Cloud site and your Snowflake data. Data travels securely and privately between Tableau Cloud and Snowflake, without traversing the public internet. ### Scenario 2: Migrate from bridge, use private address space Your organization's data is in Redshift. Network security policy requires Tableau Cloud to reach the Redshift data using private IP addresses, so you use Tableau Bridge to connect to it. Tableau Bridge is free, but has management overhead. **With Outbound Private Connect** You create an outbound private connection between your Tableau Cloud site and your Redshift data. Data now travels securely and privately between Tableau Cloud and Redshift, using private IP addresses, without traversing the public internet, and without the need for Tableau Bridge. Management is simpler using Outbound Private Connect, though there is a cost for data transferred. For information on migrating to Outbound Private Connect from Bridge or Data Connect, see [Migrate from Tableau Bridge to Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_migrate_from_bridge.htm). ## Licensing requirements Outbound Private Connect works on Tableau Cloud with an Enterprise or Tableau+ license edition, and requires an add-on license for each private connection. For information on licensing and pricing, contact your account manager. Outbound Private connection data usage is billed per terabyte. For information on Outbound Private Connect usage, see [Private Connect licensing](https://help.tableau.com/v0.0/online/en-us/license_product_keys.htm#private-connect-licensing). ## High-level setup overview An outbound private connection consists of: - the data provider (hosted at AWS) - the endpoint service (AWS) - the endpoint (Tableau Cloud) For outbound private connections to Athena, Heroku Postgres, and Teradata Vantage Cloud, your Tableau Cloud site and AWS-hosted data provider must be in the same AWS region. For a table that includes Tableau Cloud pods and associated regions, see [IP Addresses for Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#ip-addresses-for-tableau-cloud). ## Data provider and AWS components The AWS-hosted data provider and AWS endpoint service are configured in AWS. In the case of most AWS-hosted data providers, the AWS endpoint service needs to explicitly allow the connection from your Tableau Cloud site. The AWS endpoint service identifies your Tableau Cloud site using an Identity and Access Management (IAM) Amazon Resource Name (ARN) for its region. To allow access, the AWS endpoint service needs Tableau Cloud's IAM ARN added to the list of allowed principals. ## Tableau Cloud component The Tableau Cloud end of the outbound private connection is configured in Tableau Cloud Manager (TCM). Tableau Cloud needs the AWS endpoint service name. Tableau Cloud may also need custom address information about the endpoint service if the data provider requires it. ## Typical set up steps The _typical_ process to set up an outboud private connection is: 1. **AWS**: Set up the data provider and create the endpoint service. (You may need to rely on a third party. More details are in the specific topics for individual data providers under [Outbound Private Connection Set Up: AWS](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_aws.htm).) 2. **TCM**: Get the Tableau Cloud IAM ARN for the region. 3. **AWS**: Add the Tableau Cloud IAM ARN as an allowed principal on the endpoint service. (You may need to rely on a third party. More details are in the specific topics for individual data providers under [Outbound Private Connection Set Up: AWS](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_aws.htm).) 4. **AWS**: Get the endpoint service name. 5. **TCM**: Create the outbound private connection using the AWS endpoint service name. (A custom connection address may also be required or allowed. More details are in the specific topics for individual data providers under [Outbound Private Connection Set Up: AWS](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_aws.htm).) Exceptions to the typical set up process depend on the data provider, and are in the specific topics for individual data providers under [Outbound Private Connection Set Up: AWS](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_aws.htm). After both ends are configured correctly and the private connection is ready, creators can use the private connection to connect securely and privately to the AWS-hosted data provider. ## Create your outbound private connection To create and configure an outbound private connection for your sites: 1. See the subtopic for your AWS-hosted data provider under [Outbound Private Connection Set Up: AWS](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_aws.htm) 2. See the topic [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Other articles in this section [Skip to main content](#main-content) # Outbound Private Connect for Athena This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites - Your Tableau Cloud site and AWS-hosted data provider must be in the same AWS region. For a table that includes Tableau Cloud pods and associated regions, see [IP Addresses for Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#ip-addresses-for-tableau-cloud). ## Tableau Cloud Information for the Data Provider Not applicable. Amazon Athena doesn't require endpoint service configuration. This means you don't have to get the Identity and Access Management (IAM) Amazon Resource Name (ARN) from Tableau Cloud and add it to the endpoint service. ## Data Provider Information for Tableau Cloud Tableau Cloud requires an endpoint service name from Amazon Athena. Choose an endpoint service name for your site's region from the list at [Amazon Athena endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/athena.html). (Use the "endpoint" column.) Note: Reverse the domain name elements in order to make it fit the expected Endpoint Service Name format in Tableau Cloud's Create Private Connection dialog. **Example** - **From the [Amazon Athena endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/athena.html) page:** Endpoint: athena.us-east-2.amazonaws.com - **In the Create Private Connection dialog:** Endpoint Service Name: com.amazonaws.us-east-2.athena [Skip to main content](#main-content) # Outbound Private Connect for Aurora MySQL > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites 1. [Create and connect to an Aurora MySQL DB cluster](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAP_GettingStartedAurora.CreatingConnecting.Aurora.html) 2. [Create network load balancer to front the instance](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html). If your Tableau Cloud site and your Aurora MySQL instance are in different regions, make sure the load balancer is deployed in multiple AWS Availability Zones. If your load balancer is deployed in multiple AWS Availability Zones, enable cross-zone load balancing. 3. [Create VPC endpoint service for the network load balancer](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html). If your Tableau Cloud site and your Aurora MySQL instance are in different regions, make sure your Tableau Cloud site's region is in the endpoint service's Supported Regions tab. ## Tableau Cloud Information for the Data Provider The IAM ARN needs to be added as an allowed principal on the endpoint service in AWS. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have copied Tableau Cloud's IAM ARN, allow it as an allowed principal on the endpoint service per the instructions in [Configure an endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions). ## Data Provider Information for Tableau Cloud Use the AWS Management Console or AWS CLI to get the endpoint service name needed for the Tableau Cloud Create Private Connection dialog. ## Alternative Approach As an alternative to the high level steps in the Prerequisites and subsequent sections, you can use the blog post [Enhance Agentforce data security with Private Connect for Salesforce Data Cloud and Amazon Redshift – Part 3](https://aws.amazon.com/blogs/big-data/enhance-agentforce-data-security-with-private-connect-for-salesforce-data-cloud-and-amazon-redshift-part-3/) for information on configuring a private connection between Redshift and Salesforce Data Cloud. Adjust the instructions as described below to work with Aurora MySQL and Tableau Cloud instead. From the blog post, follow the instructions in these sections completely: - Create a security group for the Network Load Balancer - Create a target group - Create a load balancer Then, from the "Create an endpoint service" section of the blog post: - Instead of steps 9-12, use the [Tableau Cloud Information for the Data Provider](#private-connect-info-for-data-provider) section above to get the IAM ARN. - In step 14, use the IAM ARN in place of the Principal ID when adding allowed principals to the endpoint service. - In step 15, note the endpoint service name. - For step 17 and later, set up the private connection in Tableau Cloud per [Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). [Skip to main content](#main-content) # Outbound Private Connect for Databricks This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites - Your Databricks workspace is on a plan that supports front-end PrivateLink (for example, the Enterprise tier on AWS). Confirm that your workspace meets the Databricks prerequisites described in Databricks topic [Configure Inbound PrivateLink](https://docs.databricks.com/aws/en/security/network/front-end/front-end-private-connect). - Your Databricks workspace is configured for front-end PrivateLink, with a Private Access Settings object attached to the workspace. For more information, see [Configure Inbound PrivateLink](https://docs.databricks.com/aws/en/security/network/front-end/front-end-private-connect) in the Databricks documentation. Note: Tableau Cloud connections to Databricks over Private Connect support the following authentication methods: Service Principal (OAuth M2M) and Personal Access Token (PAT). Other authentication methods (for example, OAuth through an external identity provider) aren't supported ## Tableau Cloud Information for the Data Provider Databricks front-end PrivateLink doesn't require endpoint service configuration on the Databricks side to allow a connection from Tableau Cloud. This means that you don't need to get the Identity and Access Management (IAM) Amazon Resource Name (ARN) from Tableau Cloud and add it to the endpoint service. ## Data Provider Information for Tableau Cloud From the Databricks Account Console, get: - Endpoint service name: The regional front-end VPC Endpoint Service Name for your Tableau Cloud site's AWS region (for example, `com.amazonaws.vpce.us-east-1.vpce-svc-1234567890abcdef1`). This is published by Databricks per region. See the Databricks topic [Configure Inbound PrivateLink](https://docs.databricks.com/aws/en/security/network/front-end/front-end-private-connect) for the service name for your region. Note: If your Databricks workspace and your Tableau Cloud site are in different AWS regions, use the endpoint service name for your Tableau Cloud site's region, not your workspace's region. - Workspace URL: The default workspace URL for the workspace you want Tableau Cloud to connect to (for example, `dbc-12345678-abcd.cloud.databricks.com`). After you have the values, enter them in the Tableau Cloud Create Private Connection dialog: - Enter the endpoint service name in the Endpoint Service Name field. - Enter the workspace URL in the Custom Address field. For instructions on the Create Private Connection dialog, see the Databricks topic [Configure Inbound PrivateLink](https://docs.databricks.com/aws/en/security/network/front-end/front-end-private-connect). ## Register the VPC Endpoint in Databricks After you create the private connection in TCM, Tableau provisions a VPC Endpoint and assigns it a VPC Endpoint ID. Register this VPC Endpoint ID with your Databricks account to complete the private connection setup. 1. In TCM, find the private connection and record the VPC Endpoint ID (for example, `vpce-1234567890abcdef1`). 2. In the Databricks Account Console, go to Cloud resources > VPC endpoints, and select Add VPC endpoint. 3. Name the endpoint, then enter the VPC Endpoint ID from TCM that you recorded in step 1. Select the AWS region that matches your Tableau Cloud site's region. 4. Attach the registered VPC endpoint to your workspace's Private Access Settings (front-end VPC endpoints list). For full instructions, see Configure AWS PrivateLink for front-end connections. After Databricks accepts the connection, return to Tableau Cloud Manager. In the private connection's Actions menu (...), select Sync and watch for the status to become Ready. Note: If you need both public and private access to the same Databricks workspace (for example, private access from Tableau Cloud and public access from user browsers), you must configure a [custom workspace URL](https://www.databricks.com/blog/announcing-public-preview-custom-urls) in Databricks before setting up Private Connect. After the custom URL is configured, use the default workspace URL in the Custom Address field in Tableau Cloud Manager, and make sure that public access is enabled on the workspace's Private Access Settings in the Databricks Account Console. [Skip to main content](#main-content) # Outbound Private Connect for Dremio Server > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites Note: Dremio Cloud isn't supported. 1. You have an AWS-hosted Dremio server in a private subnet. 2. [Create a network load balancer to front the instance](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html). If your Tableau Cloud site and your Dremio server instance are in different regions, make sure the load balancer is deployed in multiple AWS Availability Zones. 3. [Create a VPC endpoint service for the network load balancer](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html). If your Tableau Cloud site and your Dremio server instance are in different regions, make sure your Tableau Cloud site's region is in the endpoint service's Supported Regions tab. ## Tableau Cloud Information for the Data Provider The IAM ARN needs to be added as an allowed principal on the endpoint service in AWS. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have copied Tableau Cloud's IAM ARN, allow it as an allowed principal on the endpoint service per the instructions in [Configure an endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions). ## Data Provider Information for Tableau Cloud Use the AWS Management Console or AWS CLI to get the endpoint service name needed for the Tableau Cloud Create Private Connection dialog. ## Alternative Approach As an alternative to the high level steps in the Prerequisites and subsequent sections, you can use the blog post [Enhance Agentforce data security with Private Connect for Salesforce Data Cloud and Amazon Redshift – Part 3](https://aws.amazon.com/blogs/big-data/enhance-agentforce-data-security-with-private-connect-for-salesforce-data-cloud-and-amazon-redshift-part-3/) for information on configuring a private connection between Redshift and Salesforce Data Cloud. Adjust the instructions as described below to work with Dremio server and Tableau Cloud instead. From the blog post, follow the instructions in these sections completely: - Create a security group for the Network Load Balancer - Create a target group - Create a load balancer Then, from the "Create an endpoint service" section of the blog post: - Instead of steps 9-12, use the [Tableau Cloud Information for the Data Provider](#private-connect-info-for-data-provider) section above to get the IAM ARN. - In step 14, use the IAM ARN in place of the Principal ID when adding allowed principals to the endpoint service. - In step 15, note the endpoint service name. - For step 17 and later, set up the private connection in Tableau Cloud per [Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). [Skip to main content](#main-content) # Outbound Private Connect for Heroku Postgres This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). Note: There isn't a dedicated web authoring connector for Heroku Postgres. To connect to Heroku Postgres, end users use the connection address from the private connection with the standard Postgres connector. ## Prerequisites 1. A Heroku app running in a Private Space or Shield Private Space with an attached Heroku Postgres database. 2. Your Tableau Cloud site and Heroku Postgres database must be in the same AWS region. For a table that includes Tableau Cloud pods and associated regions, see [IP Addresses for Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#ip-addresses-for-tableau-cloud). 3. The Heroku Postgres endpoint has been provisioned. See steps 1-3 of [Provision the Heroku Postgres endpoint](https://devcenter.heroku.com/articles/heroku-postgres-via-privatelink#provisioning-the-heroku-endpoint). ## Tableau Cloud Information for the Data Provider To get the account number that's required to provision the Heroku Postgres endpoint: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. From the IAM ARN column, copy _only_ the account number and resource information in the ARN. For example, if the complete ARN is `arn:aws:iam::012345678910:role/tab-private-connect`, copy `012345678910:role/tab-private-connect`. ## Data Provider Information for Tableau Cloud See [Step 4: Obtain Your Endpoint’s Service Name](https://devcenter.heroku.com/articles/heroku-postgres-via-privatelink#step-4-obtain-your-endpoint-s-service-name) (in Heroku's "Connecting to Heroku Postgres in a Private or Shield Space via PrivateLink" help topic) to get the endpoint service name needed for the Tableau Cloud Create Private Connection dialog. [Skip to main content](#main-content) # Outbound Private Connect for MariaDB > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites 1. If your database is hosted in RDS: [Set up your Amazon RDS Environment](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SettingUp.html) 2. [Create and connect to an MariaDB DB instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_GettingStarted.CreatingConnecting.MariaDB.html) 3. [Create a network load balancer to front the instance](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html). If your Tableau Cloud site and your MariaDB instance are in different regions, make sure the load balancer is deployed in multiple AWS Availability Zones. 4. [Create a VPC endpoint service for the network load balancer](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html). If your Tableau Cloud site and your MariaDB instance are in different regions, make sure your Tableau Cloud site's region is in the endpoint service's Supported Regions tab. ## Tableau Cloud Information for the Data Provider The IAM ARN needs to be added as an allowed principal on the endpoint service in AWS. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have copied Tableau Cloud's IAM ARN, allow it as an allowed principal on the endpoint service per the instructions in [Configure an endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions). ## Data Provider Information for Tableau Cloud Use the AWS Management Console or AWS CLI to get the endpoint service name needed for the Tableau Cloud Create Private Connection dialog. ## Alternative Approach As an alternative to the high level steps in the Prerequisites and subsequent sections, you can use the blog post [Enhance Agentforce data security with Private Connect for Salesforce Data Cloud and Amazon Redshift – Part 3](https://aws.amazon.com/blogs/big-data/enhance-agentforce-data-security-with-private-connect-for-salesforce-data-cloud-and-amazon-redshift-part-3/) for information on configuring a private connection between Redshift and Salesforce Data Cloud. Adjust the instructions as described below to work with MariaDB and Tableau Cloud instead. From the blog post, follow the instructions in these sections completely: - Create a security group for the Network Load Balancer - Create a target group - Create a load balancer Then, from the "Create an endpoint service" section of the blog post: - Instead of steps 9-12, use the [Tableau Cloud Information for the Data Provider](#private-connect-info-for-data-provider) section above to get the IAM ARN. - In step 14, use the IAM ARN in place of the Principal ID when adding allowed principals to the endpoint service. - In step 15, note the endpoint service name. - For step 17 and later, set up the private connection in Tableau Cloud per [Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). [Skip to main content](#main-content) # Outbound Private Connect for Microsoft SQL > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites 1. If your database is hosted in RDS: [Set up your Amazon RDS Environment](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SettingUp.html) 2. [Create and connect to a Microsoft SQL DB instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_GettingStarted.CreatingConnecting.SQLServer.html) 3. [Create network load balancer to front the instance](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html). If your Tableau Cloud site and your Microsoft SQL instance are in different regions, make sure the load balancer is deployed in multiple AWS Availability Zones. If your load balancer is deployed in multiple AWS Availability Zones, enable cross-zone load balancing. 4. [Create VPC endpoint service for the network load balancer](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html). If your Tableau Cloud site and your Microsoft SQL instance are in different regions, make sure your Tableau Cloud site's region is in the endpoint service's Supported Regions tab. ## Tableau Cloud Information for the Data Provider The IAM ARN needs to be added as an allowed principal on the endpoint service in AWS. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have copied Tableau Cloud's IAM ARN, allow it as an allowed principal on the endpoint service per the instructions in [Configure an endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions). ## Data Provider Information for Tableau Cloud Use the AWS Management Console or AWS CLI to get the endpoint service name needed for the Tableau Cloud Create Private Connection dialog. ## Alternative Approach As an alternative to the high level steps in the Prerequisites and subsequent sections, you can use the blog post [Enhance Agentforce data security with Private Connect for Salesforce Data Cloud and Amazon Redshift – Part 3](https://aws.amazon.com/blogs/big-data/enhance-agentforce-data-security-with-private-connect-for-salesforce-data-cloud-and-amazon-redshift-part-3/) for information on configuring a private connection between Redshift and Salesforce Data Cloud. Adjust the instructions as described below to work with Microsoft SQL and Tableau Cloud instead. From the blog post, follow the instructions in these sections completely: - Create a security group for the Network Load Balancer - Create a target group - Create a load balancer Then, from the "Create an endpoint service" section of the blog post: - Instead of steps 9-12, use the [Tableau Cloud Information for the Data Provider](#private-connect-info-for-data-provider) section above to get the IAM ARN. - In step 14, use the IAM ARN in place of the Principal ID when adding allowed principals to the endpoint service. - In step 15, note the endpoint service name. - For step 17 and later, set up the private connection in Tableau Cloud per [Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). [Skip to main content](#main-content) # Outbound Private Connect for MySQL > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites 1. If your database is hosted in RDS: [Set up your Amazon RDS Environment](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SettingUp.html) 2. [Create and connect to a MySQL DB instance](http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_GettingStarted.CreatingConnecting.MySQL.html) 3. [Create network load balancer to front the instance](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html). If your Tableau Cloud site and your MySQL instance are in different regions, make sure the load balancer is deployed in multiple AWS Availability Zones. If your load balancer is deployed in multiple AWS Availability Zones, enable cross-zone load balancing. 4. [Create VPC endpoint service for the network load balancer](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html). If your Tableau Cloud site and your MySQL instance are in different regions, make sure your Tableau Cloud site's region is in the endpoint service's Supported Regions tab. ## Tableau Cloud Information for the Data Provider The IAM ARN needs to be added as an allowed principal on the endpoint service in AWS. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have copied Tableau Cloud's IAM ARN, allow it as an allowed principal on the endpoint service per the instructions in [Configure an endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions). ## Data Provider Information for Tableau Cloud Use the AWS Management Console or AWS CLI to get the endpoint service name needed for the Tableau Cloud Create Private Connection dialog. ## Alternative Approach As an alternative to the high level steps in the Prerequisites and subsequent sections, you can use the blog post [Enhance Agentforce data security with Private Connect for Salesforce Data Cloud and Amazon Redshift – Part 3](https://aws.amazon.com/blogs/big-data/enhance-agentforce-data-security-with-private-connect-for-salesforce-data-cloud-and-amazon-redshift-part-3/) for information on configuring a private connection between Redshift and Salesforce Data Cloud. Adjust the instructions as described below to work with MySQL and Tableau Cloud instead. From the blog post, follow the instructions in these sections completely: - Create a security group for the Network Load Balancer - Create a target group - Create a load balancer Then, from the "Create an endpoint service" section of the blog post: - Instead of steps 9-12, use the [Tableau Cloud Information for the Data Provider](#private-connect-info-for-data-provider) section above to get the IAM ARN. - In step 14, use the IAM ARN in place of the Principal ID when adding allowed principals to the endpoint service. - In step 15, note the endpoint service name. - For step 17 and later, set up the private connection in Tableau Cloud per [Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). [Skip to main content](#main-content) # Outbound Private Connect for Oracle > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites 1. If your database is hosted in RDS: [Set up your Amazon RDS Environment](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SettingUp.html) 2. [Create and connect to an Oracle DB instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_GettingStarted.CreatingConnecting.Oracle.html) 3. [Create network load balancer to front the instance](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html). If your Tableau Cloud site and your Oracle instance are in different regions, make sure the load balancer is deployed in multiple AWS Availability Zones. If your load balancer is deployed in multiple AWS Availability Zones, enable cross-zone load balancing. 4. [Create VPC endpoint service for the network load balancer](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html). If your Tableau Cloud site and your Oracle instance are in different regions, make sure your Tableau Cloud site's region is in the endpoint service's Supported Regions tab. ## Tableau Cloud Information for the Data Provider The IAM ARN needs to be added as an allowed principal on the endpoint service in AWS. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have copied Tableau Cloud's IAM ARN, allow it as an allowed principal on the endpoint service per the instructions in [Configure an endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions). ## Data Provider Information for Tableau Cloud Use the AWS Management Console or AWS CLI to get the endpoint service name needed for the Tableau Cloud Create Private Connection dialog. ## Alternative Approach As an alternative to the high level steps in the Prerequisites and subsequent sections, you can use the blog post [Enhance Agentforce data security with Private Connect for Salesforce Data Cloud and Amazon Redshift – Part 3](https://aws.amazon.com/blogs/big-data/enhance-agentforce-data-security-with-private-connect-for-salesforce-data-cloud-and-amazon-redshift-part-3/) for information on configuring a private connection between Redshift and Salesforce Data Cloud. Adjust the instructions as described below to work with Oracle and Tableau Cloud instead. From the blog post, follow the instructions in these sections completely: - Create a security group for the Network Load Balancer - Create a target group - Create a load balancer Then, from the "Create an endpoint service" section of the blog post: - Instead of steps 9-12, use the [Tableau Cloud Information for the Data Provider](#private-connect-info-for-data-provider) section above to get the IAM ARN. - In step 14, use the IAM ARN in place of the Principal ID when adding allowed principals to the endpoint service. - In step 15, note the endpoint service name. - For step 17 and later, set up the private connection in Tableau Cloud per [Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). [Skip to main content](#main-content) # Outbound Private Connect for Palantir This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites - **You have access to a Palantir representative** for Palantir configuration tasks. - **You have a custom domain with Palantir.** For more information, contact your Palantir representative about getting a custom domain, and see Palantir's documentation: [Configure domains and certificates](https://www.palantir.com/docs/foundry/administration/configure-domains-and-certificates). - **Custom domain routing is configured in Tableau Cloud.** To initiate custom domain routing, provide the custom domain from the previous prerequisite to your Tableau Customer Success Manager. Tableau-side setup depends on the product release schedule, and takes from 2 to 8 weeks, depending on the amount of time to the next release. ## Tableau Cloud Information for the Data Provider Your Palantir representative handles private connection setup on Palantir's side. You need to know the IAM ARN and the Tableau AWS account number that Palantir should add to the allow list. You also need the custom domain that you established in the prerequisites. ### IAM ARN To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. ### Account number Palantir needs to allow a specific AWS account number to connect. (It's not the account number in the IAM ARN.) Contact your Tableau Customer Success Manager to get this account number. ## Data Provider Information for Tableau Cloud After setup is complete on Palantir's side, your Palantir representative will provide you with the endpoint address. Use the endpoint address as the Endpoint Service Name in the Tableau Cloud Create Private Connection dialog. For more information, see [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). [Skip to main content](#main-content) # Outbound Private Connect for PostgreSQL This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites 1. If your database is hosted in RDS: [Set up your Amazon RDS Environment](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SettingUp.html) 2. [Create and connect to a PostgreSQL DB instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_GettingStarted.CreatingConnecting.PostgreSQL.html) 3. [Create network load balancer to front the instance](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html). If your Tableau Cloud site and your PostgreSQL instance are in different regions, make sure the load balancer is deployed in multiple AWS Availability Zones. If your load balancer is deployed in multiple AWS Availability Zones, enable cross-zone load balancing. 4. [Create VPC endpoint service for the network load balancer](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html). If your Tableau Cloud site and your PostgreSQL instance are in different regions, make sure your Tableau Cloud site's region is in the endpoint service's Supported Regions tab. ## Tableau Cloud Information for the Data Provider The IAM ARN needs to be added as an allowed principal on the endpoint service in AWS. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have copied Tableau Cloud's IAM ARN, allow it as an allowed principal on the endpoint service per the instructions in [Configure an endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions). ## Data Provider Information for Tableau Cloud Use the AWS Management Console or AWS CLI to get the endpoint service name needed for the Tableau Cloud Create Private Connection dialog. ## Alternative Approach As an alternative to the high level steps in the Prerequisites and subsequent sections, you can use the blog post [Enhance Agentforce data security with Private Connect for Salesforce Data Cloud and Amazon Redshift – Part 3](https://aws.amazon.com/blogs/big-data/enhance-agentforce-data-security-with-private-connect-for-salesforce-data-cloud-and-amazon-redshift-part-3/) for information on configuring a private connection between Redshift and Salesforce Data Cloud. Adjust the instructions as described below to work with PostgreSQL and Tableau Cloud instead. From the blog post, follow the instructions in these sections completely: - Create a security group for the Network Load Balancer - Create a target group - Create a load balancer Then, from the "Create an endpoint service" section of the blog post: - Instead of steps 9-12, use the [Tableau Cloud Information for the Data Provider](#private-connect-info-for-data-provider) section above to get the IAM ARN. - In step 14, use the IAM ARN in place of the Principal ID when adding allowed principals to the endpoint service. - In step 15, note the endpoint service name. - For step 17 and later, set up the private connection in Tableau Cloud per [Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). [Skip to main content](#main-content) # Outbound Private Connect for Redshift > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites Note: Private Connect doesn't support Redshift-managed PrivateLink. 1. [Create Redshift in private subnet in a VPC](https://docs.aws.amazon.com/redshift/latest/mgmt/getting-started-cluster-in-vpc.html) 2. [Create network load balancer to front the instance](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html). If your Tableau Cloud site and your Redshift instance are in different regions, make sure the load balancer is deployed in multiple AWS Availability Zones. If your load balancer is deployed in multiple AWS Availability Zones, enable cross-zone load balancing. 3. [Create VPC endpoint service for the network load balancer](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html). If your Tableau Cloud site and your Redshift instance are in different regions, make sure your Tableau Cloud site's region is in the endpoint service's Supported Regions tab. ## Tableau Cloud Information for the Data Provider The IAM ARN needs to be added as an allowed principal on the endpoint service in AWS. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have copied Tableau Cloud's IAM ARN, allow it as an allowed principal on the endpoint service per the instructions in [Configure an endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions). ## Data Provider Information for Tableau Cloud Use the AWS Management Console or AWS CLI to get the endpoint service name needed for the Tableau Cloud Create Private Connection dialog. ## Alternative Approach As an alternative to the high level steps in the Prerequisites and subsequent sections, you can use the blog post [Enhance Agentforce data security with Private Connect for Salesforce Data Cloud and Amazon Redshift – Part 3](https://aws.amazon.com/blogs/big-data/enhance-agentforce-data-security-with-private-connect-for-salesforce-data-cloud-and-amazon-redshift-part-3/) for information on configuring a private connection between Redshift and Salesforce Data Cloud. Adjust the instructions as described below to work with Redshift and Tableau Cloud instead. From the blog post, follow the instructions in these sections completely: - Create a security group for the Network Load Balancer - Create a target group - Create a load balancer Then, from the "Create an endpoint service" section of the blog post: - Instead of steps 9-12, use the [Tableau Cloud Information for the Data Provider](#private-connect-info-for-data-provider) section above to get the IAM ARN. - In step 14, use the IAM ARN in place of the Principal ID when adding allowed principals to the endpoint service. - In step 15, note the endpoint service name. - For step 17 and later, set up the private connection in Tableau Cloud per [Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). [Skip to main content](#main-content) # Outbound Private Connect for Snowflake This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites - Your Snowflake edition is Business Critical Edition. - Your Snowflake account has at least one warehouse. - If you use OAuth, use an external Oauth provider instead of Snowflake Oauth. For more information on using an external OAuth provider with Snowflake, see [External OAuth for Snowflake.](https://help.tableau.com/current/pro/desktop/en-us/snowflake_oauth_idp.htm) - Optional, but convenient: You have access to a Snowflake account administrator user to execute the Snowflake [SYSTEM$GET\_PRIVATELINK\_CONFIG function](https://docs.snowflake.com/en/sql-reference/functions/system_get_privatelink_config). If you don't, you can get the information from Snowflake support when needed. ## Tableau Cloud Information for the Data Provider Snowflake support needs the IAM ARN to enable PrivateLink. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have the IAM ARN, open a Snowflake support case. Ask for PrivateLink to be enabled, and provide them with the IAM ARN to allow connections from. ## Data Provider Information for Tableau Cloud As a Snowflake account administrator, invoke the [SYSTEM$GET\_PRIVATELINK\_CONFIG function](https://docs.snowflake.com/en/sql-reference/functions/system_get_privatelink_config) and get these values from the output: - privatelink-vpce-id - privatelink-account-url If you don't have access to a Snowflake account administrator account, use your Snowflake support case and ask for the values of **privatelink-vpce-id** and **privatelink-account-url**. After you have the values, enter them in the Tableau Cloud Create Private Connection dialog: - Enter the value of **privatelink-vpce-id** in the Endpoint Service Name field. - Enter the value of **privatelink-account-url** in the Custom Address field. [Skip to main content](#main-content) # Outbound Private Connect for Teradata Vantage Cloud > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites 1. You have access to a Teradata Vantage Cloud database. 2. You can contact a Teradata admin. 3. Your Tableau Cloud site and Teradata Vantage Cloud database are in the same AWS region. For a table that includes Tableau Cloud pods and associated regions, see [IP Addresses for Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#ip-addresses-for-tableau-cloud). 4. Your Teradata Cloud admin has performed the steps from the following sections of the Teradata documentation: - [Set Up PrivateLink for AWS](https://docs.teradata.com/r/Lake-Getting-Started-with-VantageCloud-Lake/First-Sign-On-by-Organization-Admin-Create-an-Environment/Step-2-Set-the-Environment-Connection-Type/Set-Up-PrivateLink-for-AWS) (To get the account number to add to allowlisted accounts, see [Tableau Cloud Information for the Data Provider](#Tableau).) - [Create Endpoints for AWS](https://docs.teradata.com/r/Lake-Getting-Started-with-VantageCloud-Lake/First-Sign-On-by-Organization-Admin-Create-an-Environment/Step-2-Set-the-Environment-Connection-Type/Set-Up-PrivateLink-for-AWS/Create-Endpoints-for-AWS) ## Tableau Cloud Information for the Data Provider The IAM ARN needs to be added as an allowed principal on the endpoint service in AWS. Your Teradata admin will also need Tableau's Account number for the AWS Region. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have copied Tableau Cloud's IAM ARN, allow it as an allowed principal on the endpoint service per the instructions in [Configure an endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions). To get the account number: 1. Paste the IAM ARN somewhere where you can see all of it (like a text editor). 2. Find the account number in the IAM ARN. It's the string of numbers in the middle. For example: - ARN: `arn:aws:iam::012345678910:role/tab-private-connect` - Account number: `012345678910` Provide the account number to your Teradata admin. ## Data Provider Information for Tableau Cloud After your Teradata Cloud admin has followed the steps in the Prerequisites section, they can provide you with the endpoint address. Use the endpoint address as the Endpoint Service Name in the Tableau Cloud Create Private Connection dialog. [Skip to main content](#main-content) # Outbound Private Connect for Teradata Vantage On-Premise > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. This topic covers setup information specific to the data provider. General information on setting up a private connection is in [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm), and information on setting up the Tableau Cloud endpoint is in [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). ## Prerequisites 1. You have an AWS-hosted Teradata Vantage On-Premise server in a private subnet. 2. [Create a network load balancer to front the instance](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html). If your Tableau Cloud site and your Teradata server instance are in different regions, make sure the load balancer is deployed in multiple AWS Availability Zones. 3. [Create a VPC endpoint service for the network load balancer](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html). If your Tableau Cloud site and your Teradata server instance are in different regions, make sure your Tableau Cloud site's region is in the endpoint service's Supported Regions tab. ## Tableau Cloud Information for the Data Provider The IAM ARN needs to be added as an allowed principal on the endpoint service in AWS. To get the IAM ARN: 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Expand IAM Regions and ARNs. 5. Find the region for your Tableau Cloud site. 6. In the Actions menu (...), select Copy IAM ARN. After you have copied Tableau Cloud's IAM ARN, allow it as an allowed principal on the endpoint service per the instructions in [Configure an endpoint service](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#add-remove-permissions). ## Data Provider Information for Tableau Cloud Use the AWS Management Console or AWS CLI to get the endpoint service name needed for the Tableau Cloud Create Private Connection dialog. ## Alternative Approach As an alternative to the high level steps in the Prerequisites and subsequent sections, you can use the blog post [Enhance Agentforce data security with Private Connect for Salesforce Data Cloud and Amazon Redshift – Part 3](https://aws.amazon.com/blogs/big-data/enhance-agentforce-data-security-with-private-connect-for-salesforce-data-cloud-and-amazon-redshift-part-3/) for information on configuring a private connection between Redshift and Salesforce Data Cloud. Adjust the instructions as described below to work with Teradata Vantage On-Premise server and Tableau Cloud instead. From the blog post, follow the instructions in these sections completely: - Create a security group for the Network Load Balancer - Create a target group - Create a load balancer Then, from the "Create an endpoint service" section of the blog post: - Instead of steps 9-12, use the [Tableau Cloud Information for the Data Provider](#private-connect-info-for-data-provider) section above to get the IAM ARN. - In step 14, use the IAM ARN in place of the Principal ID when adding allowed principals to the endpoint service. - In step 15, note the endpoint service name. - For step 17 and later, set up the private connection in Tableau Cloud per [Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm). [Skip to main content](#main-content) # Outbound Private Connection Set Up: AWS As stated in the [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm) topic, the setup for AWS-hosted data providers and the AWS endpoint service varies. For setup information on your data provider, see the appropriate subtopic below for specific instructions. Then see the topic [Outbound Private Connection Set Up: Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_tableau_cloud.htm) topic. ## Other articles in this section [Skip to main content](#main-content) # Outbound Private Connection Set Up: Tableau Cloud Cloud administrators create, edit, and delete private connections in Tableau Cloud Manager (TCM). They also assign private connections to sites, and can provide connection information to creators and the groups that support them. ## Prerequisites - **The AWS endpoint service and AWS-hosted data provider is set up.** For information on setting up AWS and the AWS-hosted data provider, see the topics for [Outbound Private Connection Set Up: AWS](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_aws.htm). - **You're a cloud administrator**, able to use Tableau Cloud Manager (TCM). - **You see the Private Connect tab in TCM Settings.** The Private Connect tab shows when you have Tableau Cloud with an Enterprise or Tableau+ license edition, and you have at least one Private Connect endpoint add-on license. - **TCM shows available private connection capacity.** Above the table of private connections, the capacity is represented as X/Y, where X is current number of private connections, and Y is the maximum number. If there's no available capacity, delete a private connection or talk to your Tableau account manager about more capacity. - **You know the AWS endpoint service name.** The endpoint service name begins with "com.amazonaws.vpce", and looks something like this: `com.amazonaws.vpce.us-west-1.vpce-svc-0123456789abcdef0`. You may be able to get the endpoint service name, or you may need to rely on a third party to get it for you. It depends on the data provider. For more information, see the topics under [Outbound Private Connection Set Up: AWS](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_aws.htm). - **You are aware of allowances or requirements around connecting with a custom address.** For more information, see the topics under [Outbound Private Connection Set Up: AWS](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_aws.htm). ### Create a Private Connection 1. Log in to Tableau Cloud Manager (TCM). 2. Go to Settings. 3. Select the Private Connect tab. 4. Select Create. In the Creation Private Connection dialog: 1. Enter a Name. Cloud administrators and site administrators can see the private connection name. It has no functional effect on the private connection, but can help administrators distinguish this private connection from others. 2. Optionally, enter a Description. Cloud administrators and site administrators can see the private connection description. It has no functional effect on the private connection, but can help administrators distinguish one private connection from another. 3. Select a Region. Select the region for your Tableau Cloud site. The region also matches the IAM ARN that's allowed as a principal on the AWS endpoint service. For private connections to Athena, Heroku Postgres, or Teradata Vantage Cloud, your Tableau Cloud site and AWS-hosted data provider must be in the same AWS region. For a table that includes Tableau Cloud pods and associated regions, see [IP Addresses for Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#ip-addresses-for-tableau-cloud). 4. Enter the Endpoint Service Name from AWS. The endpoint service name begins with "com.amazonaws.vpce". 5. If required or allowed by the endpoint service, enter the endpoint service's Custom Address. The group that administers the AWS endpoint service can help determine if you need or have the option for custom address in this field. 6. Select Create to create the private connection. ![The Create Private Connection dialog](/tableau/next/en-us/online/en-us/Img/private_connect_create_private_connection.png) The new private connection is added to the table of private connections, and begins in the Allocating state. ## Private Connection Status Select Sync in the private connection's Actions menu (...) to check for updates in the private connection's status.

Status	Description	Next Steps
Allocating	The private connection is being provisioned. This is a pending state that concludes with either success or failure.	Select Sync in the Actions menu (...) to check for updated status every few minutes until the status changes. If the status never changes from Allocating, check to make sure your Tableau Cloud site and the endpoint service are in the same AWS area.
PendingAcceptance	Provisioning is waiting because the private connection needs to be accepted by the endpoint service in AWS.	Accept the connection in AWS. Optionally configure the endpoint service in AWS so that it doesn't require acceptance.
RejectedRemotely	The private connection was rejected by the endpoint service in AWS. This is an error state.	Make sure that the endpoint service is configured to allow connections from Tableau Cloud. Verify the IAM ARN is an allowed principal on the AWS endpoint service.
Ready	Provisioning is complete and the private connection can be assigned to sites.	Select Assign to Sites in the Actions menu (...) to assign the private connection to sites. After a private connection is assigned to a site, site administrators can see it in the site settings Private Connect tab, and creators can use it to create content.
Inactive	The private connection is configured but inactive. After 30 days of being Inactive, the private connection is deleted.	Delete the private connection if it's not being used, or resolve the reason it's Inactive.

![A cloud administrator's table of private connections](/tableau/next/en-us/online/en-us/Img/private_connect_cloud_admin_private_connection_table.png) ## Assign a Private Connection to Sites After a private connection's status is Ready, it can be assigned to sites. After a private connection is assigned to a site, site administrators can see it in the site settings Private Connect tab, and creators can use it to create workbooks and data sources. Data traffic that uses a private connection never traverses the public internet. To assign a private connection to sites: 1. Find the private connection in the list of private connections. 2. Select Assign to Sites in the Actions menu (...). 3. Select or deselect sites to change the private connection assignment. You can search for sites using the search bar, or select the check box in the table heading to select or deselect all sites. The number in the Save Assignment button indicates the total number of sites that the private connection will be assigned to. 4. Select Save Assignment. ## Edit the Private Connection Description To edit the description of a private connection: 1. Find the private connection in the list of private connections. 2. Select Edit Description in the Actions menu (...). 3. Edit the description. 4. Select Save. The description has no functional effect on the private connection, but can help administrators distinguish one private connection from another. ## Delete a Private Connection To delete a private connection: 1. Find the private connection in the list of private connections. 2. Select Delete in the Actions menu (...). 3. Select Delete in the **Delete Private Connection** dialog. You can't undo a deletion. After the private connection is deleted, workbooks and data sources that use the private connection won't work. Furthermore, because every private connection is assigned a unique connection address at creation time, recreating the private connection won't resolve broken workbooks and data sources. If, however, both the deleted private connection and the recreated private connection use a custom address, and those addresses are the same, the workbooks and data sources will continue to work after private connection delete and recreation. [Skip to main content](#main-content) # Overview of Row-Level Security Options in Tableau Sometimes you want to filter data based on the user that is requesting it. For example: - You want regional salespeople to see sales figures only for their region. - You want sales managers to see statistics only for salespeople that report to them. - You want students to see visualizations based only on their own test scores. An approach to filtering data this way is called row-level security (RLS). There are multiple methods to accomplish row-level security both inside and outside of Tableau, each with its own pros and cons. ## Create a user filter and map users to values manually The simplest way to achieve row-level security in Tableau is through a user filter where you manually map users to values. For example, you could manually map a user named “Alice” to the value “East” so that she only sees rows in the data source where the “Region” column is “East”. This method is convenient but high maintenance, and attention must be paid to security. It must be done per-workbook, and you must update the filter and republish the data source as your user base changes. When you publish an asset with this type of user filter, you need to set permissions so that users cannot save or download it and remove the filter, thereby gaining access to all of the data. For more information, see [Create a user filter and map users to values manually](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters_create.htm#create-user-filter) in the Tableau Desktop and Web Authoring help. ## Create a dynamic user filter using a security field in the data Using this method, you create a calculated field that automates the process of mapping users to data values. This method requires that the underlying data include the security information you want to use for filtering. For example, using a calculated field, the USERNAME() function, and a “Manager” column in the data source, you could determine if the user requesting the view is a manager and adjust the data in the view accordingly. Because filtering is defined at the data level and automated by the calculated field, this method is less error prone than mapping users to data values manually. When you publish an asset with this type of user filter, you need to set permissions so that users cannot save or download it and remove the filter, thereby gaining access to all of the data. For more information, see [Create a dynamic filter using a security field in the data](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters_create.htm#dynamic) in the Tableau Desktop and Web Authoring help. ## Use a data policy Starting in Tableau 2021.4, when Data Management is enabled in Tableau Server or Tableau Cloud, users with a Creator license can implement row-level security through data policies on virtual connections. Because virtual connections are centralized and reusable, you can manage row-level security for each connection in one place, safely and securely, across all content that uses that connection. Unlike the above solutions for row-level security in Tableau, this method doesn't carry the same risk of exposing information if an author neglects to properly secure permissions on the workbook or data source, because the policy is enforced on the server for every query. Row-level security through virtual connection data policies was developed to address shortcomings of other row-level security solutions. We recommend this solution in most situations where it's an option. For more information on row-level security using data policies on virtual connections, see [About Virtual Connections and Data Policies](https://help.tableau.com/v0.0/online/en-us/dm_vconn_overview.htm). ## Use existing RLS in the database Many data sources have mechanisms for RLS built in. If your organization has already put effort into building row-level security in a data source, you may be able to take advantage of your existing RLS. It is not necessarily easier or better to implement a built-in RLS model vs. building it with Tableau in mind; these techniques are generally leveraged when an organization has already invested in these technologies and they want to take advantage of that investment, or when they need to apply the same security policies to other database clients in addition to Tableau. The main benefit of using built-in RLS is that administrators can implement and control their data security policy in one place: their databases. ## Pass user attributes You can pass user attributes included in a JSON Web Token (JWT) to customize and control access to data in Tableau Cloud embedding workflows. For more information, see [Embedding v3 API](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_user_attributes.html) Help. ## Row-level security option comparison

RLS option	Useful when	Pros	Cons
Manual user filter	You are doing a proof of concept or testing user filtering functionality You are creating a static workbook to use with an unchanging group of users You understand the data security risk of having the permissions set incorrectly	Simple at small scales Easy to understand mapping Good for testing	High-maintenance Need to update filter and republish as user base changes Permissions must be secured to prevent users from seeing unfiltered data Must be replicated in every workbook
Dynamic user filter	You don't have a Data Management license The data contains information you can use to filter it You understand the data security risk of having the permissions set incorrectly	Relatively easy to set up	Permissions must be secured to prevent users from seeing unfiltered data Must be replicated in every workbook or data source
Data policy	You have a Data Management license The data contains information you can use to filter it Ease of data security is a significant concern	Centralized Secure Low-maintenance Responsibilities for security and analytics can be separated	Data Management license required
RLS in the database	Your database has an existing RLS security built into the database You aren’t using extracts	Might already be built into your organization’s database Policies can be applied to database clients other than Tableau	Must use live queries Might have limitations or requirements. Your IT team can identify them
User attributes	You are authenticating and authorizing access to embedded content using Tableau connected apps	Manage data access policies in the same place you manage other policies and personalization for your users	Requires user attributes defined in the JWT, site setting enabled, and content authored with user attribute functions

[Skip to main content](#main-content) # Permission Capabilities and Templates Permissions are made up of capabilities, or the ability to perform a given action on a piece of content, such as view, filter, download, or delete. Each row in the Permission Rules area of the dialog is a _permission rule_. Permission rules are the setting for each capability (allowed, denied, or unspecified) for the group or user in that row. Permission rules have _templates_ available that make it easier to assign capabilities quickly. Permission rules can also be copied and pasted. **Note**: In the permission dialog for projects, there are tabs for each content type: Projects, Workbooks, Data Sources, etc. When a permission rule is added, the default for all capabilities across all content types is Unspecified. To allow or deny capabilities for each content type, you must go to each tab of the permission dialog in turn. This sets the pattern for all content of that type in the project (such as all workbooks). In the permission dialog for a specific piece of content, there are no tabs and the permission rules only apply to that piece of content. ## Templates Templates group sets of capabilities that are often assigned together based on common user scenarios, View, Explore, Publish, and Administer. When you assign a template, its included capabilities are set to Allowed, with the rest left as Unspecified. The templates are cumulative, so the Explore template includes everything from the View template plus additional capabilities. All content also has a template for **None** (which sets all capabilities to unspecified) and **Denied** (which sets all capabilities to denied). Templates are meant to be a starting point and can be adjusted after they are applied. Capabilities can also be granted or denied without using a template at all. In both cases, the template column then shows Custom. ## Copy and paste permissions If there is a permission rule that needs to be assigned to multiple groups or users, you can copy and paste from one rule to another. You can’t copy from or paste onto a rule that involves Project Leader status. 1. Open the action menu (...) for the existing rule you want to copy from and select Copy Permissions. This is available only when the rule is not in edit mode. 2. Select an existing rule you want to paste over. You can also create a new rule by clicking + Add Group/User Rule and selecting a group or user. 3. Open the action menu (...) and select Paste Permissions. ## Effective permissions Remember, just because a user has been granted a capability in a given rule doesn't mean they'll have the ability to perform that action. There are site role caps on what a user can do (see [Permissions, Site Roles, and Licenses](https://help.tableau.com/v0.0/online/en-us/permission_license_siterole.htm)) and multiple permissions rules may need to be compared to evaluate the final capabilities for a given user (see [Effective permissions](https://help.tableau.com/v0.0/online/en-us/permission_effective.htm)). ## Capabilities Each content type has specific capabilities: ### Projects Projects have only two capabilities and two templates. For more information about project leaders and how to assign them, see [Project administration](https://help.tableau.com/v0.0/online/en-us/permissions_projects.htm#projectpermissions). #### View template ![View icon.](/tableau/next/en-us/online/en-us/Img/perms_view_icon.png)**View** lets a user see the project. If a user hasn’t been granted the view capability, the project won’t be visible to them. Granting the view capability for a project does not mean a user can see any content in the project, just the existence of the project itself. #### Publish template ![Save icon.](/tableau/next/en-us/online/en-us/Img/perms_save_icon.png)**Publish** lets a user publish content to the project from Tableau Desktop or Tableau Prep Builder. The publish capability is also required to move content into the project or save content to the project from web authoring. ### Workbooks #### View template ![View icon.](/tableau/next/en-us/online/en-us/Img/perms_view_icon.png)**View** lets a user see the workbook or view. If a user hasn’t been granted the view capability, the workbook won’t be visible to them. ![Filter icon.](/tableau/next/en-us/online/en-us/Img/perms_filter_icon.png)**Filter** lets a user interact with filters in the view, including keep only and exclude filters. Users lacking this capability won’t see filter controls in the view. ![View comments icon.](/tableau/next/en-us/online/en-us/Img/perms_viewcomments_icon.png)**View Comments** lets a user view the comments associated with the views in a workbook. ![Add comments icon.](/tableau/next/en-us/online/en-us/Img/perms_addcomments_icon.png)**Add Comments** lets a user add comments to views in a workbook. ![Download full data icon.](/tableau/next/en-us/online/en-us/Img/perms_downloadimage_icon.png)**Download Image/PDF** lets a user download each view as a PNG, PDF, or PowerPoint. ![Download sum data icon.](/tableau/next/en-us/online/en-us/Img/perms_downloadsumdata_icon.png)**Download Summary Data** lets a user view the aggregated data in a view, or in the marks they’ve selected, and download that data (as a CSV). #### Explore template ![Share Customized icon.](/tableau/next/en-us/online/en-us/Img/perms_sharecustomized_icon.png)**Share Customized** lets users add their custom views to the list of “Other Views” visible on a workbook. - When this capability is denied, users won’t see the “Make visible to others” option when they create a custom view. For more information, see [Use Custom Views](https://help.tableau.com/current/pro/desktop/en-us/customview.htm). This capability doesn’t impact the ability to share a custom view with the share dialog or by copying the link. ![Download full data icon.](/tableau/next/en-us/online/en-us/Img/perms_downloadfulldata_icon.png)**Download Full Data** lets a user view the underlying data in a view, or in the marks they’ve selected, and download that data (as a CSV). - Download Full Data is not the same thing as Full Data Query, which is used by APIs on behalf of the user. ![Web edit icon.](/tableau/next/en-us/online/en-us/Img/perms_webedit_icon.png)**Web Edit** lets a user edit the view in a browser-based authoring environment. - Creating new content in the browser or saving views from the web edit interface requires a specific combination of capabilities. For more information, see [Web Editing and Web Authoring](https://help.tableau.com/v0.0/online/en-us/permissions.htm#webauthor). - The Web Editing feature must also be enabled for the entire site or even users with this capability allowed won’t be able to web edit. For more information, see [Set a Site's Web Authoring Access](https://help.tableau.com/current/server/en-us/web_author_enable.htm). ![](/tableau/next/en-us/online/en-us/Img/perms_explain_data_icon.png)**Run Explain Data** lets a user run Explain Data on marks in editing and viewing mode. - For Explain Data to be displayed as an option when a user selects a mark in a workbook, the feature must also be enabled as a site setting. To make Explain Data available in viewing mode, the feature must also be allowed by the author from within a workbook in Explain Data settings. For more information, see [Control Access to Explain Data](https://help.tableau.com/current/pro/desktop/en-us/explain_data_control_access.htm). ![Full Data Query](/tableau/next/en-us/online/en-us/Img/perms_full_data_query.png) **Full Data Query** lets an API or agent access the underlying data in a workbook data source. - Full Data Query (FDQ) is not the same as Download Full Data. FDQ is a pass-through permission capability that works in conjunction with API Access or AI Access to allow an API or an agent to query the workbook's data on behalf of the user. - FDQ guarantees user filters are enforced only when they are data source filters, not filters at the workbook or sheet level. Row level security with user filters must be set as data source filters. - VizQL Data Service interaction with the workbook's data requires both FDQ and API Access permission capabilities. - If FDQ isn't allowed, Tableau Agent in Dashboards has access to summary data only and therefore limited ability to discover deeper insights and analysis. FDQ is necessary for full functionality of Tableau Agent. #### Publish template ![Download workbook and save as icon.](/tableau/next/en-us/online/en-us/Img/perms_downloadwkbksaveas_icon.png)**Download Workbook/Save a Copy** lets a user download a packaged workbook (as a TWBX). Lets a user save (publish) a copy from the web edit interface as a new workbook. ![Save icon.](/tableau/next/en-us/online/en-us/Img/perms_save_icon.png)**Overwrite** lets a user overwrite (save) the content or asset on the server. - When allowed, the user can re-publish a workbook, data source, or flow, or save a workbook or flow in web authoring, thereby becoming the owner and gaining access to all permissions. After this change in ownership, the original owner’s access to the workbook is determined by their permissions just like any other user. ![API access icon.](/tableau/next/en-us/online/en-us/Img/perms_api_access_icon.png)**API Access** lets a user query the workbook's data source with the VizQL Data Service. For more information, see [VizQL Data Service](https://help.tableau.com/current/api/vizql-data-service/en-us/index.html). ![](/tableau/next/en-us/online/en-us/Img/perms_ai_access.png)**AI Access** lets a user use Tableau Agent in Dashboards, including Dashboard Overview, Dashboard Insights, and Dashboard Q&A. - Also grant Full Data Query so the AI tool can access more than the summary data in the vizzes. ![](/tableau/next/en-us/online/en-us/Img/perms_metrics_icon.png)**Create/Refresh Metrics** lets a user create metrics on the views in a workbook and lets any metrics that a user creates from those views refresh. The legacy Metrics feature was retired in February 2024 for Tableau Cloud and in Tableau Server version 2024.2. For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm). #### Administer template ![Move icon.](/tableau/next/en-us/online/en-us/Img/perms_move_icon.png)**Move** lets a user move workbooks between projects. For more information, see [Move content](https://help.tableau.com/v0.0/online/en-us/permissions.htm#MoveContent). ![Delete icon.](/tableau/next/en-us/online/en-us/Img/perms_delete_icon.png)**Delete** lets a user delete the workbook. ![Set Permissions icon.](/tableau/next/en-us/online/en-us/Img/perms_setperms_icon.png)**Set Permissions** lets a user create permission rules for the workbook. ![icon for extract refresh permission capability](/tableau/next/en-us/online/en-us/Img/perms_extract_refresh.jpg)**Refresh Extracts** lets a user trigger an extract refresh for that workbook. ### Views In a workbook that is not in a locked project and does not show sheets as tabs for navigation, views (sheets, dashboards, stories) inherit the workbook permissions at publication, but any changes to permission rules must be made on individual views. View capabilities are the same as those for workbooks, except for **Overwrite**, **Download Workbook/Save a Copy**, and **Move** which are only available at the workbook level. We recommend showing navigational sheet tabs whenever possible so views continue to inherit their permissions from the workbook. ### Data Sources #### View template ![View icon.](/tableau/next/en-us/online/en-us/Img/perms_view_icon.png)**View** lets a user see the data source on the server. ![Connect icon.](/tableau/next/en-us/online/en-us/Img/perms_connect_icon.png)**Connect** lets a user connect to a data source in Tableau Desktop, Tableau Prep Builder, Ask Data, or web editing. - If a workbook author embeds their credentials to a published data source in a published workbook, they are essentially embedding their **Connect** capability. Therefore, users can see the data in the workbook regardless of their own **Connect** capability for that data source. If the workbook author doesn’t embed their credentials to the published data source, the user needs their own **Connect** capability to the data source to consume the workbook. For more information, see [Data access for published Tableau data sources](https://help.tableau.com/v0.0/online/en-us/permissions.htm#PublishedData). - A user must have the **Connect** capability for a data source to use Ask Data and to create Ask Data lenses. For more information, see [Enable Ask Data for Sites and Data Sources](https://help.tableau.com/current/pro/desktop/en-us/ask_data_enable.htm#ensure-that-users-can-access-a-data-source). #### Explore template ![Download data source icon.](/tableau/next/en-us/online/en-us/Img/perms_downloaddatasource_icon.png)**Download Data Source** lets a user download the data source from the server (as a TDSX). #### Publish template ![Save icon.](/tableau/next/en-us/online/en-us/Img/perms_save_icon.png)**Overwrite** lets a user publish a data source to the server and overwrite the data source on the server. ![](/tableau/next/en-us/online/en-us/Img/perms_api_access_icon.png)**API Access** lets a user query the data source with the VizQL Data Service. For more information, see [VizQL Data Service](https://help.tableau.com/current/api/vizql-data-service/en-us/index.html). ![Create metric defintions icon](/tableau/next/en-us/online/en-us/Img/perms_pulse_metric_icon.png) **Create Metric Definitions** lets a user connect to a data source to create Tableau Pulse metric definitions. For more information, see [Create Metrics with Tableau Pulse](https://help.tableau.com/current/online/en-us/pulse_create_metrics.htm). #### Administer template ![Delete icon.](/tableau/next/en-us/online/en-us/Img/perms_delete_icon.png)**Delete** lets a user delete the data source. ![Set Permissions icon.](/tableau/next/en-us/online/en-us/Img/perms_setperms_icon.png)**Set Permissions** lets a user create and edit permission rules for the data source. ![icon for extract refresh permission capability](/tableau/next/en-us/online/en-us/Img/perms_extract_refresh.jpg)**Refresh Extracts** lets a user trigger an extract refresh for the data source. ### Other types of assets

	View template	Explore template	Publish template	Administer template
Flows	View lets a user view the flow.	Download flow lets a user download the flow (as a TFLX).	Run lets a user run the flow. Overwrite lets a user publish a flow and overwrite the published flow.	Move lets a user move assets between projects. For more information, see Move content. Delete lets a user delete the asset. Set Permissions lets a user create permission rules for the asset.
Data Roles	View lets a user view data roles.	n/a	Overwrite lets a user publish data roles, overwrite published data roles, and edit published data roles' synonyms.
Metrics (retired)	View lets a user view metrics.	n/a	Overwrite lets a user overwrite a metric and edit a metric's details.
Ask Data Lenses	View lets a user see the lens.	n/a	Overwrite lets a user edit the lens.
Virtual Connections	View lets a user see the virtual connection. Connect* lets a user connect to data using a virtual connection.	n/a	Overwrite lets a user edit the virtual connection.
Databases	View lets a user see the database.	n/a	Overwrite lets a user edit the metadata for the database.
Tables	View lets a user see the table.	n/a	Overwrite lets a user edit the metadata for the table.
Collections	View lets a user view collections.	n/a	n/a	n/a

\*By default, virtual connections have a Custom template that sets the View capability to Allowed but not the Connect capability. Be sure to set the Connect capability to Allowed so users can connect using the virtual connection. [Skip to main content](#main-content) # Permissions Permissions determine how users can interact with content such as workbooks and data sources. Permissions are set in the permission dialog or via the [REST API](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_permissions.htm). At the top of the dialog, permission rules configure capabilities for groups or users. Below, the permissions grid displays the effective permissions for users. ![Project permissions dialog showing the workbook tab](/tableau/next/en-us/online/en-us/Img/perms_projectwrkbkperms.png "Project permissions dialog showing the workbook tab") There are several interrelated topics that discuss how to think about, set, and manage permissions. The main topics are: - This topic, which covers the fundamentals, how to set permission rules for projects and other content, and permission considerations for specific scenarios. - [Permission Capabilities and Templates](https://help.tableau.com/v0.0/online/en-us/permissions_capabilities.htm), which covers in detail the various capabilities that are used to build permission rules. - [Manage Permissions with Projects](https://help.tableau.com/v0.0/online/en-us/permissions_projects.htm), which covers using projects to manage permissions and how nested and locked projects impact permissions. - [Effective permissions](https://help.tableau.com/v0.0/online/en-us/permission_effective.htm), which covers how permission rules are evaluated and how final permissions are determined. - [Permissions, Site Roles, and Licenses](https://help.tableau.com/v0.0/online/en-us/permission_license_siterole.htm), which covers how permissions interact with site roles and licenses to determine what a user can do on a site. Additionally, if Data Management is licensed, permissions for external assets have additional considerations. For more information, see [Manage Permissions for External Assets](https://help.tableau.com/v0.0/online/en-us/dm_perms_assets.htm). ## Permissions fundamentals **Projects and groups** Tableau sites use _projects_ to organize content and _groups_ to organize users. Managing permissions is easier when permission rules are: - Set at the project level instead of on individual pieces of content. - Established for groups instead of individuals. Permissions can only be established for users, groups, projects, or assets that already exist. For more information about creating users and groups, creating projects, and publishing content, see [Manage Users and Groups](https://help.tableau.com/v0.0/online/en-us/users.htm), [Use Projects to Manage Content Access](https://help.tableau.com/v0.0/online/en-us/projects.htm) , and [Publish Data Sources and Workbooks](https://help.tableau.com/current/pro/desktop/en-us/publish_overview.htm). **Capabilities and permission rules** Permissions are made up of _capabilities_—the ability to perform actions like view content, web edit, download data sources, or delete content. _Permission rules_ establish what capabilities are allowed or denied for a user or group on an asset. For more information about capabilities and permission rule templates, see [Permission Capabilities and Templates](https://help.tableau.com/v0.0/online/en-us/permissions_capabilities.htm). **Note:** When talking about permissions in general, it’s common to see a phrase like "a user must have the delete _permission_." This is easy to understand in a broad context. However, when working with permissions at a technical level like in this article, it’s more accurate to say "the delete _capability._" In this topic we’ll use the more precise term _capability_, but you should be aware that you might see _permission_ in other places. ![The permission dialog showing several permission rules with some capabilities allowed, denied, or left unspecified](/tableau/next/en-us/online/en-us/Img/perms_permissionrules.png) For a breakdown of the capability icons and their meanings, see [Permission Capabilities and Templates](https://help.tableau.com/v0.0/online/en-us/permissions_capabilities.htm). The interplay between license level, site role, and potentially multiple permission rules factor into the final determination of what a user can or can’t do. For each user this becomes their _effective permissions_. For more information, see [Effective permissions](https://help.tableau.com/v0.0/online/en-us/permission_effective.htm).Some tasks such as creating new workbooks from a browser (web authoring) or moving content might require specific configurations of several capabilities rather than being captured in a single capability. For more information, see [Permission settings for specific scenarios](#Permissi). ## Set permissions Permission rules are set differently at the project level, at the content level, or when publishing content from Tableau Desktop. **Note**: The phrase "project permissions" can have two meanings. There are the permission capabilities for a project itself—View and Publish—that control how a user can interact with a project. There is also the concept of project-level permission rules for other content types. In this article “project-level permissions” means permission rules for workbooks, data sources, and the other assets that are configured in the permission dialog for a project. This is in contrast to “content-level” permission rules that can be set on a specific workbook, data source, etc. _For administrators, project owners, and project leaders_ To set permissions at the project level: 1. Navigate to the project 2. Open the Actions menu (...) and click **Permissions**. ![Actions menu](/tableau/next/en-us/online/en-us/Img/perms_actions_menu.png) The permissions dialog opens. This dialog has two main areas: permission rules at the top and the effective permissions grid below. Each content type has a tab. The image below shows the Data Sources tab. ![Project permissions dialog showing the data sources tab](/tableau/next/en-us/online/en-us/Img/perms_project_ds_perms.png "Project permissions dialog showing the data sources tab") With a row selected at the top, the effective permissions grid populates. Use this to verify permissions. Hovering provides information about why the capability is allowed or denied for that specific user. 3. To modify an existing permission rule, select the appropriate tab for that content type and click a capability. 4. To create a rule, click + Add Group/User Rule and start typing to search for a group or user. For each tab, choose an existing template from the dropdown box or create a custom rule by clicking the capabilities. One click sets the capability to **Allowed**, two clicks sets it to **Denied**, and a third click clears the selection (**Unspecified**). 6. When finished, click **Save**. - If the "None" template is selected, the button will say "Delete Rule". ### Set project permissions for all content types Remember that the permissions dialog for a project contains tabs for each type of content. **You must set permissions for each type of content at the project level or users will be denied access to that content type**. A capability is only granted to a user if they’re expressly allowed it. Leaving a capability as Unspecified will result in it being denied. > [!TIP] > > Every time you create a permission rule at the project level, make sure you look through all the content type tabs. ### Configure the asset permissions setting Permission rules set at the project level act as a default for content saved in that project and any nested projects it contains. Whether those project-level default rules are kept uniform or are able to be edited depends on the Asset permissions setting. This setting can be configured in two ways, either Locked or Customizable. For more information, see [Lock asset permissions](https://help.tableau.com/v0.0/online/en-us/permissions_projects.htm#LockProject). _For administrators, project leaders, and content owners_ If project Asset permissions are Customizable, permissions for individual assets can be modified. The information below isn’t relevant to assets in locked projects. For more information, see [Lock asset permissions](https://help.tableau.com/v0.0/online/en-us/permissions_projects.htm#LockProject). > [!TIP] > > While it is possible to set permissions on individual assets in Customizable projects, we recommend managing permissions at the project level. ### Set permissions on assets 1. Navigate to the asset (such as a workbook, data source, or flow) 2. Open the Actions menu (...) and click **Permissions**. ![Actions menu](/tableau/next/en-us/online/en-us/Img/project_permissions_actionmenu.png) The permissions dialog opens. This dialog has two main areas: permission rules at the top and the effective permissions grid below. (Note the lack of tabs across the top—an asset-level permissions dialog has no tabs.) ![Workbook-level permissions dialog showing permission rules and effective permissions](/tableau/next/en-us/online/en-us/Img/perms_workbookperms.png) With a row selected at the top, the effective permissions grid populates. Use this to verify permissions. Hovering over a capability square provides information about why the capability is allowed or denied for that specific user. 3. To modify an existing permission rule, click a capability. 4. To create a rule, click + Add Group/User Rule and start typing to search for a group or user. Choose an existing template from the dropdown or create a custom rule by clicking the capabilities. One click sets the capability to **Allowed**, two clicks sets it to **Denied**, and a third click clears the selection (**Unspecified**). 6. When finished, click **Save**. - If the "None" template is selected, the button will say "Delete Rule". ### Set permissions on a view > [!TIP] > > While it’s possible to set view-level permissions within a workbook, we strongly recommend managing permissions at the project (or, if necessary, workbook) level. If a workbook is published with **Show Sheets as Tabs** checked, the views in that workbook will inherit all permissions set for the workbook. The permission dialog for a view will be read-only. In some situations, it may be valuable to specify permissions on a view independently from the workbook that contains it. If the workbook is published with **Show Sheets as Tabs** unchecked (sheet tabs hidden), the views will start with the workbook permissions but will be independent thereafter and can be set independently. Note that this means if the permission rules are modified for the workbook, those changes won’t be applied to the views—each view’s permissions will need to be managed individually. See [Show or Hide Sheet Tabs](#sheettabs) for more information. _For content publishers_ If project Asset permissions are Customizable, permissions for individual assets can be set when publishing from Tableau Desktop. The information below isn’t relevant for content in locked projects. For more information, see [Lock asset permissions](https://help.tableau.com/v0.0/online/en-us/permissions_projects.htm#LockProject). > [!TIP] > > While it’s possible to set permissions on individual assets in Customizable projects, we recommend managing permissions at the project level. 1. From the publishing dialog , click the Edit link for **Permissions**. If the Edit link is unavailable, permissions are locked to the project and can’t be modified except by the project owner, project leader, or an administrator. 2. The Add/Edit Permissions dialog shows any existing permission rules. Click Add to add a permission rule or Edit to modify an existing permission rule 1. Select the group or user from the left pane. You can expand a group to see which users it contains. 2. Use the selector at the top of the right pane to choose an existing template, or use the radio buttons to create a custom rule. Note that effective permissions can’t be inspected from the publishing dialog. 3. When finished, click **OK** and resume publishing. **Note**: Permissions can’t be set while publishing flows from Tableau Prep Builder. To set permissions on a flow, refer to the steps for Project-level permissions or Content-level permissions. ### Clean up the All Users group By default, all users are added to an "All Users" group that has basic permissions for content. To start with a clean slate when building your own permission rules, we recommend that you delete the rule entirely or edit the rule for All Users to remove any permissions (set the permission role template to None). This helps prevent any ambiguity down the road by reducing the number of rules that applies to any given user and therefore making effective permissions easier to understand. ## Permission settings for specific scenarios Certain actions require combinations of permission capabilities and possibly site roles. The following are some common scenarios and their necessary permission configurations ### Saving, publishing, and overwriting In the context of permissions, saving is essentially publishing. As such, the Overwrite and Save a Copy capabilities can only be given to users with a site role that allows publishing: Administrator, Creator, or Explorer (can publish). Explorer or Viewer site roles can’t publish, overwrite, or save a copy. - The Publish capability for a project allows a user to publish content into that project. - The Overwrite capability for content allows a user to save over an existing piece of content. By saving over the content, the user becomes the owner of that content. The Overwrite capability also allows users to edit minor aspects of existing pieces of content, such as the description for a metric or the synonyms for a data role. Editing the existing content in this way doesn't change the owner of the content. - The Download / Save a Copy or Save a Copy capability for content allows a user to use the Publish As... menu option to save a new copy of the content. This is usually done in conjunction with web authoring and means the user can save their modifications. - Saving a copy of a workbook is distinct from [autosave](https://help.tableau.com/current/online/en-us/autosave.htm), which maintains any changes as a draft. #### A place to publish It’s important to note that users aren’t able to Publish or Publish As a piece of content unless they have the Publish capability for at least one project, because all content must be published into a project. Without the Publish capability at the project level, the content can’t be published. #### Overwrite and claim ownership In web editing, the **Publish** option in the File menu only appears to the content owner. If a user who isn’t the owner has the Overwrite capability (allowing them to save the content), they must use **File > Publish As...** and name the workbook the exact same name. This prompts a warning that they’re about to overwrite the existing content, which they can do. Conversely, a user with only the Save a Copy capability trying to use the same name gets an error stating they don’t have permission to overwrite the existing content. If a user who isn’t the content owner overwrites content, they become the owner, with all the permissions that entails. The original owner’s access to the content is then determined by their permissions as a user rather than the owner. **Note**: Download/Save a Copy is a joint capability for workbooks. Explorers can be given this capability but they’re only able to download the workbook, not save a copy using Publish As. Giving the capability to Explorer (can publish), Creator, or Administrator site roles gives them both the ability to download workbooks _and_ save a copy using the publishing options in the File menu. ### Web Editing and Web Authoring Web editing and web authoring allows users to edit or create workbooks directly in the browser. The permission capability is called _Web Edit_ and the site setting is called _Web Authoring_. This section refers to any web-based editing or publishing action as _web authoring_. To enable this functionality, there are several requirements. - **User site role**: The user must have the appropriate site role. - Viewers can never web edit. - Explorers can be given the web edit capability but can’t publish. Essentially, they can use web editing to answer deeper questions based on existing content on the fly, but can’t save their edits. - Explorers (can publish) or Site Administrator Explorers can publish, but they can only use data that is already published to the site. - Creators, Site Administrator Creators, and Server Administrators can publish and create data sources. - **Permission capabilities**: The user must have the necessary permission capabilities based on the desired functionality. #### Required Permission Capability Settings

Desired functionality	Minimum Site Role	Web Edit	Download/ Save a Copy	Overwrite (workbook)	Publish (project)	Connect (data source)
Web author without being able to save	Explorer	Allow	Deny	Deny	Optional	Allow
Web author and save as new content	Explorer (can publish)	Allow	Allow	Deny	Allow	Allow
Web author and save (overwrite) content	Explorer (can publish)	Allow	Allow	Allow	Allow	Allow
Web author with new data and save new content	Creator	Allow	Optional	Optional	Allow	Optional

Optional indicates this capability isn’t involved in the desired functionality ### Tableau Agent in Dashboards Tableau Agent in Dashboards allows users to leverage AI to understand a published dashboard and ask deeper questions using natural language. To enable this functionality, there are several requirements. **Note**: Tableau Agent in Dashboards is currently in beta. A site administrator must opt into the Beta before proceeding with setup. - **Edition requirements**: To use Tableau Agent in Dashboards, you must be signed into a Tableau Cloud+ site. - **Site setting**: AI in Tableau must be turned on for the entire Tableau site. See [Turn On AI in Your Tableau Cloud Site](https://help.tableau.com/current/online/en-us/setup_tabAI_site_setting.htm). Without this setting enabled, no users can use Tableau Agent, _even if they have the AI Access capability_. - **User site role**: Any licensed site role can be granted the necessary permissions to use Tableau Agent in Dashboards. - **Permission capabilities**: Each user must have **AI Access** and **Full Data Query** allowed on every workbook they want to use with Tableau Agent. - Note: Full Data Query does not grant the same access as Download Full Data and is only for the context of an agent or API. ### Data access for published Tableau data sources Data sources published to a Tableau site can have native authentication as well as permissions within the Tableau environment. When the data source is published to the Tableau site, the publisher can choose how to [Set Credentials for Accessing Your Published Data](https://help.tableau.com/current/pro/desktop/en-gb/publishing_sharing_authentication.htm#workbook-connections-to-tableau-data-sources), which addresses how data source credentials are handled (such as requiring users to log into a database or enter their credentials for Google Sheets). This authentication is controlled by whatever technology holds the data. This can be embedded when the data source is published, or the data source publisher can choose to prompt the user for their credentials to the data source. For more information, see [Publish a Data Source](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources.htm#publishing-steps). There are also data source capabilities that allow or deny users the ability to see (View) and connect to the published data source (Connect) in the context of Tableau. These capabilities are set like any other permissions in Tableau. When a workbook is published that uses a published data source, the author can control how the Tableau authentication behaves for someone consuming the workbook. The author sets the workbook’s access to the published data source, either as Embed password (using the author’s Connect access to the data source) or Prompt users (using the Connect access of the person viewing the workbook), which may require data source authentication as well. - When the workbook is set to **Embed password**, anyone who looks at the workbook sees the data based on the author’s access to the data source. - If the workbook is set to **Prompt users**, the Tableau-controlled access is checked for the data source. The person consuming the workbook must have the Connect capability for the published data source to see the data. If the published data source is also set to Prompt user, the viewer must also enter their credentials for the data source itself.

Workbook authentication to the data source	Data source authentication to the data	How data access is evaluated for someone consuming the workbook
Embed password	Embed password	User sees the data as if they were the workbook author
Embed password	Prompt user	User sees the data as if they were the workbook author. (The author is prompted for data source authentication, not the user.)
Prompt user	Embed password	User must have their own Connect capability to the published data source
Prompt user	Prompt user	User must have their own Connect capability to the published data source and are prompted for their credentials to the underlying data

Note that this applies to consuming a workbook, not web editing. To web edit, the user must have their own Connect capability. For information on embedding passwords when you publish Tableau content such as a data source or workbook that uses a virtual connection, see [Virtual connections](https://help.tableau.com/current/server/en-us/publishing_sharing_authentication.htm#virtual-connection-embedded-password) in the Tableau Server help. ### Allow other users to refresh extracts Users with the Explorer (can publish) site role or higher can be granted the Extract Refresh capability on workbooks or data sources. This capability provides users with the same interface as the asset owner for triggering an extract refresh. The extract must either be a published data source or, if it's local to a workbook, have embedded credentials. Because extract refreshes can be resource intensive and may already be scheduled, consider the following best practices when assigning the Extract Refresh capability: - **Infrequently used extracts**: Grant users the ability to refresh extracts on demand and consider turning off redundant or unneeded scheduled refreshes. - **Regularly used extracts**: Consider scheduling extract refreshes and limiting the Extract Refresh capability for on-demand refreshes. - Assign the extract refresh capability as a backup to prevent bottlenecks dependent on the asset owner or administrators, rather than granting these permissions broadly. ### Move content To move an item, open its Action menu (...) and click Move. Select the new project for the item, then click Move Assets. If Move is unavailable or there are no available destination projects, verify the appropriate conditions are met: - Administrators can always move assets and projects to any location. - Project leaders and project owners can move assets and nested projects among their projects. - Note that non-administrators can’t move projects to become top-level projects - Other users can move assets only if all three of the following requirements are met: - Creator or Explorer (Can Publish) site role. - Publishing rights (View and Publish capabilities) for the destination project - Owner of the content, or—for workbooks and flows—having the Move capability. When moving a database with its tables, the user must have the Move capability for both the database _and_ its tables. For information about how permissions are handled when moving content and projects, see [Move projects and content](https://help.tableau.com/v0.0/online/en-us/permissions_projects.htm#moveproject). ### Metrics (retired 2024.2) > [!TIP] > > The information in this section is for the legacy metrics feature, which was retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. For information about permissions for Tableau Pulse metrics, see [Set Up Your Site for Tableau Pulse](https://help.tableau.com/current/online/en-us/pulse_set_up.htm#permissions). **Retirement of the legacy metrics feature** Tableau's legacy metrics feature was retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. In October 2023, Tableau retired the ability to embed legacy metrics in Tableau Cloud and in Tableau Server version 2023.3. With Tableau Pulse, we've developed an improved experience to track metrics and ask questions of your data. For more information, see [Create Metrics with Tableau Pulse](https://help.tableau.com/current/online/en-us/pulse_create_metrics.htm) to learn about the new experience and [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm) for the retired feature. Metrics are created from views in published workbooks. Users can create metrics if they: - Are a Creator or Explorer (can publish) site role - Have the **Publish** capability on a project - Have the **Create/Refresh Metric** capability for the relevant workbook For more information, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/v0.0/online/en-us/metrics_create.htm) and [Set Up for Metrics](https://help.tableau.com/v0.0/online/en-us/metrics_admin.htm). Because metrics are independent assets, it’s important to note that the permissions for metrics are managed independently from the view they were created from. (This is unlike data-driven alerts and subscriptions, where the content of the alert or subscription can only be seen if the user has the correct permissions for the view itself.) Although the capabilities for metrics are straightforward, the **View** capability should be considered carefully. It may be possible for a workbook with restricted permissions to be the basis for a metric with more open permissions. To protect sensitive data, you might want to deny metric creation for specific workbooks. #### Metrics display data from their owner’s perspective When you create a metric, you capture your perspective of the data from that view. This means that any users who can access your metric will see the data as it appears to you. If the data in the view is filtered based on your credentials, the data you see might be different from what other users see when they access the same view. Limit the View capability for your metric if you're concerned about exposing your perspective of the data. ### Explain Data When Explain Data is available, a user can select a mark in a view and click Run Explain Data in the mark’s Tooltip menu. A combination of settings must be enabled to make Explain Data available in editing mode and viewing mode. Requirements for authors to run Explain Data or edit Explain Data settings in editing mode: - Site setting: Availability of Explain Data set to Enable. Enabled by default. - Site role: Creator, Explorer (can publish) - Permissions: Run Explain Data capability set to Allowed. Unspecified by default. If you open a workbook (Tableau version 2022.1 or earlier) that used this permission in Tableau version 2022.2 or later, you must reset the Run Explain Data capability to Allowed. **Note:** The Download Full Data capability for a Creator or Explorer (can publish) controls whether they see the View Full Data option in Extreme Values explanations. Viewers are always denied the Download Full Data capability. However, all users can see record-level details when the Extreme Values explanation type is enabled in Explain Data settings. Requirements for all users to run Explain Data in viewing mode: - Site setting: Availability of Explain Data set to Enable. Enabled by default. - Site role: Creator, Explorer, or Viewer - Permissions: Run Explain Data capability set to Allowed. Unspecified by default. If you open a workbook (Tableau version 2022.1 or earlier) that used this permission in Tableau version 2022.2 or later, you’ll need to reset the Run Explain Data capability to Allowed. ### Show or Hide Sheet Tabs In the context of published content, sheet tabs (also referred to as tabbed views) is a distinct concept from sheet tabs in Tableau Desktop. Showing and hiding sheet tabs in Tableau Desktop refers to hiding sheets in the authoring environment. For more information, see [Manage Sheets in Dashboards and Stories](https://help.tableau.com/current/pro/desktop/en-us/environ_workbooksandsheets_sheets_hideshow.htm). Showing and hiding sheet tabs (turning tabbed views on or off) for published content refers to navigation in a published workbook. When sheet tabs are shown, published content has navigational sheet tabs along the top of each view. ![comparison of view navigation with tabbed views on and off](/tableau/next/en-us/online/en-us/Img/tabbedviews.png) This setting also impacts how permissions function and may have security implications (see note). **Note:** It’s possible to have the View capability for a view without the View capability for the workbook or project that contain it. Normally if a user lacks the View capability for a project and workbook, they wouldn’t know those assets exist. If they have the View capability for a view, however, a user may be able to see the project and workbook name when looking at the view, such as in the navigational breadcrumb. This is expected and accepted behavior. #### Turn off tabbed views to allow independent view permissions Although it isn’t recommended as a general practice, there are times when it can be useful to set permissions on views independently of the workbook that contains them. To do so, three conditions must be met: 1. The workbook must be published—there’s no way to set view permissions during publishing. 2. The workbook must be in a customizable project. 3. The workbook can’t show sheets as tabs (tabbed views must be hidden). When a workbook shows sheets as tabs, all views inherit the workbook permissions and any changes to the workbook permissions affect all of its views. **When a workbook in a customizable project doesn’t show tabbed views, all views assume the workbook permissions upon publication, but any subsequent changes to the workbook’s permission rules** _won’t be inherited by the views_**.** Changing the configuration of sheets as tabs on a published workbook will also impact the permission model. Show Tabs overrides any existing view-level permissions and reinstate the workbook-level permissions for all views. Hide Tabs breaks the relationship between the workbook and its views. - To configure sheets as tabs on a published workbook, open the Actions menu (...) for the workbook and select **Tabbed Views**. Choose **Show Tabs** or **Hide Tabs** as desired. - To configure sheets as tabs during publishing, refer to [Show sheets as tabs](https://help.tableau.com/current/pro/desktop/en-us/publish_workbooks_howto.htm#show-sheets-as-tabs). - To set view-level permissions, see [Set permissions on assets](#contentpermissions). > [!IMPORTANT] > > In a customizable project, any modifications to the workbook-level permissions won’t be applied if navigational sheet tabs are hidden (aka tabbed views are off). Changes to permissions must be made on individual views. ### Collections For information on managing permissions in Collections, refer to [Collections](https://help.tableau.com/v0.0/online/en-us/permissions_projects.htm#collections). ## Other articles in this section [Skip to main content](#main-content) # Permissions Data Source Permissions contains the explicit permissions for all users and content on the site. Administrators can use the data source to identify gaps in permissions security and ensure that only the appropriate users can access content items. **Note:** Site roles determine the maximum capabilities a user can have. For example, a Viewer can't web edit, even if they're allowed in a user or group rule. Based on the order that permissions are evaluated, users may have different capabilities than listed in the data source. For more information, see [Effective permissions](https://help.tableau.com/v0.0/online/en-us/permission_effective.htm). ## Create custom views If you're a site admin or someone who has been granted access to the Admin Insights project, you can access the Admin Insights data sources directly from Tableau Cloud using Web Authoring or through Tableau Desktop to build custom views. For more information about connecting to Admin Insights data sources, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Example: Which users and groups have access to content? Use these steps to create a view that displays which users and groups have access to content. 1. Connect to the Permissions data source. 2. From the Data pane, drag Item Type, Item Name, Item Parent Project Name, and Controlling Permissions Project Name to the Rows shelf. This creates a hierarchical view of your site content and shows how permissions are determined, for example, if permissions are set at the project level or on individual content items. 3. From the Data pane, drag Grantee Name and Grantee Type to the Rows shelf. Adding these dimensions shows the users and groups with access to the content. 4. From the Data pane, drag Capability Type to the Rows shelf. The capabilities for users and groups are displayed. ## Locked projects and inherited permissions When a project is locked, the content items it contains inherit their permissions from that project. These items include workbooks, data sources, and prep flows. They don't have their own explicit permission rules. In the Permissions data source, content items in a locked project appear as a single row where Grantee Name and Capability Type are null. The null values mean the item inherits its permissions from the controlling project, which the Controlling Permissions Project Name field identifies. They don't indicate a gap in the data or that access is missing. To find the permissions that apply to a content item, use these steps: 1. Connect to the Permissions data source. 2. From the Data pane, drag Item Name, Item Type, Controlling Permissions Project Name, Grantee Name, and Capability Type to the Rows shelf. 3. From the Data pane, drag Item Name to the Filters shelf and select a content item from a locked project. The item appears with null Grantee Name and Capability Type values. 4. Edit the Item Name filter, and then filter by the project name from the Controlling Permissions Project Name field. The view shows the grantees and capabilities that apply to the content item. ## Do more with your data Using Tableau Prep, you can join Permissions with other Admin Insights data sources on the following fields to get more visibility into your site. If you're analyzing data from multiple Tableau Cloud sites, you must also join on "Site LUID = Site LUID". - Join Site Content to Permissions on "Item LUID = Item LUID" (left join) - Join Permissions to TS Users on "User LUID = User LUID" - Join Permissions to Groups on "Grantee LUID = Group LUID" (right join) > [!TIP] > > To streamline analysis, delete the All Users group rule or edit the rule to remove permissions. For more information, see [Aggregate, Join, or Union Data](https://help.tableau.com/current/prep/en-us/prep_combine.htm) in Tableau Prep Help. ## Data schema The following table lists the fields included in the Permissions data source. Each row of data corresponds to a combination of user, content item, and permission capability.

Folder	Field Name	Type	Description
Capabilities	Capability Type	String	The ability to perform a given action on the item. Options include view, filter, download, or delete and are unique to the item type. This value is null for content items in a locked project.
	Permissions Description	String	A description of the permission value.
	Permission Value	Number	A numerical representation of the explicit permissions for a content item. Lower values indicate precedence. For example, denying a capability to a group (8) is overridden by allowing that capability to a user in the group (7).
Grantees	Grantee LUID	String	The LUID of the grantee. Either the user LUID or Group LUID. Primarily used to reference content via the REST API.
	Grantee Name	String	The name of the grantee. Either the user email or group name. This value is null for content items in a locked project.
	Grantee Type	String	The type of the grantee. Either user or group.
Items	Controlling Permissions Project Name	String	The name of the project that controls permissions for the nested project. For content items in a locked project, this field identifies the project the item inherits its permissions from. For more information, see Locked projects and inherited permissions.
	Item Hyperlink	String	Full URL to the item on the site. Useful for creating hyperlinks on a dashboard.
	Item LUID	String	The LUID of the item. The LUID is unique within each item type and site. Primarily used to reference content via the REST API.
	Item Name	String	Display name of the item.
	Item Parent Project Name	String	The name of the item's parent project.
	Item Type	String	The type of content item. Such as a data source, prep flow, project, or workbook.
	Top Parent Project Name	String	The name of the item's top-level project.
Site	Site LUID	String	The LUID of the Tableau Cloud site. Primarily used to reference content via the REST API.
Site	Site Name	String	The name of the Tableau Cloud site.
-	Admin Insights Published At	Date-time	Date and time the Admin Insights data source was last published in UTC.
	User Email	String	The email address of the user with explicit permission.
	User LUID	String	The LUID of the user with explicit permission.
	User Site Role	String	The site role of the user.
	Has Permission?	Calculated field	Indicates whether the grantee is allowed access to an item. Doesn't take into account the Site Administrator capability. Site Administrators have more permissions than the calculation captures.

[Skip to main content](#main-content) # Permissions, Site Roles, and Licenses Adding a user to Tableau Cloud requires an available license. (Users can also be added as unlicensed and configured so they will consume a license only when they first sign in. For more information, see [Grant License on Sign In](https://help.tableau.com/v0.0/online/en-us/grant_role.htm).) For each site the user belongs to they have exactly one site role, restricted by their license. A user has permissions for content on the site, restricted by what their site role allows. Licenses and site roles apply to users. Permission capabilities apply to content. **Licenses** are assigned to a user when they are created (or sign in for the first time) on the Tableau Server or Tableau Cloud site. Users are licensed as a **Creator**, **Explorer**, or **Viewer**. - License levels are consumed based on the maximum _site role_ a user can have on that server. - Site Administrator Creator and Creator site roles use a Creator license. - Site Administrator Explorer, Explorer (can publish), and Explorer site roles use at least an Explorer license. - Viewer site role uses at least a Viewer license. - An unlicensed user can exist on the site, but they cannot sign in unless they were added with grant site role on sign in. - In Tableau Cloud, a user consumes only one license per tenant, even if they're a member of multiple sites. If a user is a member of multiple sites, their license level is determined by their highest site role. For example, if a user has a Creator site role on one site and a Viewer site role on two others, they consume a Creator license. For more information about how site role limits and licenses are handled in Tableau Cloud Manager, see [Manage Site Role Limits](https://help.tableau.com/v0.0/online/en-us/cloud_manager_site_role_limit.htm). **Site roles** are assigned to a user for each site they are a member of. - Site roles determine the maximum capabilities a user can have in that site. (For example, a user with a site role of Viewer will never be able to download a data source even if that capability is explicitly granted to them on a specific data source.) - Site roles do not inherently grant any capabilities in and of themselves—with the exception of the administrator site roles. Administrators always have all capabilities applicable to their license level. **Permissions** consist of _capabilities_, like the ability to save to a project, web edit a workbook, connect to a data source, etc. They apply to group or user on a specific piece of content (project, data source, workbook, view, or flow). For more information, see [Permission Capabilities and Templates](https://help.tableau.com/v0.0/online/en-us/permissions_capabilities.htm). - Permission capabilities are not given to a group or user in a vacuum but rather in the context of content. A user can have different capabilities for different content assets. - Permissions are evaluated based on the interplay of a user’s site role and the permission rules for that user or any groups they are members of. - Some actions such as web authoring might require combinations of capabilities. For more information, see [Permission settings for specific scenarios](https://help.tableau.com/v0.0/online/en-us/permissions.htm#Permissi). ## Site roles and their maximum capabilities These tables indicate what capabilities are available for a site role. There may be other ways for a user with a site role to perform a similar action. For example, although Viewers can't be given the Share Customized capability to make their custom views visible to others on the workbook, they can share custom views by copying the view URL. See [General capabilities allowed with each site role](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm#site-role-capabilities-summary) for more information on what each site role can do. For more information about each capability, see [Permission Capabilities and Templates](https://help.tableau.com/v0.0/online/en-us/permissions_capabilities.htm). ### Projects

Capability	Creator	Explorer (can publish)	Explorer	Viewer
View
Publish

### Workbooks

Capability	Creator	Explorer (can publish)	Explorer	Viewer
View
Filter
View Comments
Add Comments
Download Image/PDF
Download Summary Data
Run Explain Data †
Share Customized
Download Full Data
Web Edit
Full Data Query ‡
Download Workbook/Save a Copy
Overwrite
AI Access
API Access
Create/Refresh Metrics §
Move			*
Delete
Set Permissions
Refresh Extracts

† Explain Data can be controlled in site settings and in a workbook using the Run Explain Data capability. The availability of Explain Data in viewing mode is controlled in a workbook in the Explain Data Settings dialog box. ‡ Full Data Query (FDQ) can be granted to all site roles. It works together with API or AI Access to grant those tools the ability to query the full data. FDQ is not the same as Download Full Data. § Prior to Tableau 2021.3, the Create/Refresh Metrics capability was controlled by the Download Full Data capability. ### Data Sources

Capability	Creator	Explorer (can publish)	Explorer	Viewer
View
Connect
Download Data Source
Overwrite
Create Metric Definitions
Delete
Set Permissions
Refresh Extracts

### Data Roles

Capability	Creator	Explorer (can publish)	Explorer	Viewer
View
Overwrite
Move			*
Delete
Set Permissions

### Flows To run flows on a schedule, you must have a Data Management license. For information about configuring flow settings, see [Create and Interact with Flows on the Web](https://help.tableau.com/current/server/en-us/web_author_flows.htm). Explorer (can publish) license users can run flows on Tableau Server and Tableau Cloud. Starting in version 2020.4 Explorer license users cannot run flows, even if the administrator grants them the Run Flow permissions.

Capability	Creator	Explorer (can publish)	Explorer	Viewer
View
Download Flow
Web Edit
Run Flow
Overwrite
Move			*
Delete
Set Permissions

### Ask Data Lenses

Capability	Creator	Explorer (can publish)	Explorer	Viewer
View
Overwrite
Move			*
Delete
Set Permissions

### Metrics (retired 2024.2) > [!TIP] > > The information in this section is for the legacy metrics feature, which was retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. For information about permissions for Tableau Pulse metrics, see [Set Up Your Site for Tableau Pulse](https://help.tableau.com/current/online/en-us/pulse_set_up.htm#permissions). **Retirement of the legacy metrics feature** Tableau's legacy metrics feature was retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. In October 2023, Tableau retired the ability to embed legacy metrics in Tableau Cloud and in Tableau Server version 2023.3. With Tableau Pulse, we've developed an improved experience to track metrics and ask questions of your data. For more information, see [Create Metrics with Tableau Pulse](https://help.tableau.com/current/online/en-us/pulse_create_metrics.htm) to learn about the new experience and [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm) for the retired feature.

Capability	Creator	Explorer (can publish)	Explorer	Viewer
View
Overwrite
Move			*
Delete
Set Permissions

### Collections

Capability	Creator	Explorer (can publish)	Explorer	Viewer
View

### Virtual Connections Virtual connections require a Data Management license. See [About Data Management](https://help.tableau.com/v0.0/online/en-us/dm_overview.htm) for details.

Capability	Creator	Explorer (can publish)	Explorer	Viewer
View
Connect		**	**	**
Overwrite
Move			*
Delete
Set Permissions

\* Although the Explorer role can be given the Move capability, they can’t have the Publish capability on a project and therefore there is no place for them to move content to. The Move capability should therefore be considered not possible for Explorer site roles. \*\* Although the Explorer (can publish) role can be given the **Connect** capability for Virtual Connections, the ability to create a new data source of any kind, including Virtual Connections, is only available for users with a Creator site role. Similarly, Explorer and Viewer role users can't access the UI to connect to new or existing data sources. The **Connect** capability should be considered not possible for any role but Creator. [Skip to main content](#main-content) # Personal Access Tokens Personal access tokens (PATs) provide you and your Tableau Cloud users the ability to create long-lived authentication tokens. PATs enable you and your users to sign in to Tableau REST API without requiring hard-coded credentials (username and password) or interactive sign-in. For more information about using PATs with Tableau REST API, see [Signing In and Out (Authentication)](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_concepts_auth.htm) in the Tableau REST API Help. > [!WARNING] > > **Important:** Tableau Cloud PATs can’t be used to sign in to the Tableau Cloud Manager (TCM) REST API. To authenticate to the TCM REST API, you must use PATs generated in TCM. For more information about how to use PATs with TCM, see [Personal Access Tokens for Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_personal_access_tokens.htm). We recommend creating PATs for automated scripts and tasks that are created with the Tableau REST API: - **Improve security:** PATs reduce risk in the event credentials are compromised. Instead of using a user name and password, users can reduce the impact of credential compromise by using a personal access token for automated tasks. If a PAT gets compromised or is used in automation that is failing or posing a risk, you or your users can just revoke the PAT instead of rotating or revoking the user's credentials. - **Manage automation:** A PAT can be created for each script or task that is run. This allows you and your users to silo and review automation tasks across your organization. Additionally, by using PATs, password resets or metadata changes (username, email, etc.) on user accounts do not disrupt automation as it would when credentials are hard-coded into the scripts. - **Monitor usage:** If you have Tableau Cloud with Advanced Management, as a site admin, you can review Activity Log to track which users are creating and revoking PATs, which PATs are being used, which PATs are being revoked and the sessions attached to them. **Notes:** - You must use a PAT, instead of user name and password, to make a REST API sign in request to Tableau Cloud with multi-factor authentication (MFA) enabled with Tableau authentication. - PATs are not used for generic client access to Tableau Cloud. - To use PATs with tabcmd, install the compatible version of tabcmd from [https://tableau.github.io/tabcmd/](https://tableau.github.io/tabcmd/). - PATs are automatically revoked when a [user's authentication method](https://help.tableau.com/v0.0/online/en-us/users_set_auth_type.htm) is changed. ## Understand personal access tokens When a personal access token (PAT) is created, it is hashed then stored in the repository. After the PAT is hashed and stored, the PAT secret is shown once to the user and then no longer accessible after the users dismisses the dialog. Therefore, users are instructed to copy the PAT to a safe place and to handle it as they would a password. When the PAT is used at run-time, Tableau Cloud compares the PAT presented by the user to the hashed value stored in the repository. If a match is made, then an authenticated session is started. In the context of authorization, the Tableau Cloud session that is authenticated with a PAT has the same access and privileges as the PAT owner. **Note:** Users can't request concurrent Tableau Cloud sessions with a PAT. Signing in again with the same PAT, whether at the same site or a different site, will terminate the previous session and result in an authentication error. ### About PAT expiration Personal access tokens (PATs) expire if not used after 15 consecutive days. If PATs are used more frequently than every 15 days, their expiration depends on the PAT's site setting, which is configurable by a site admin. After PATs expire, they're unable to be used for authentication and removed from the user's My Account Settings page. ## Site settings for personal access tokens ### Configure PAT creation and expiration As a site admin, you can configure who can create and use PATs, and when PATs expire. The changes that you make to PATs settings apply only to new PATs. PATs created before setting changes retain the configurations present when they were created and remain valid until they expire. On sites activated in June 2023 (Tableau 2023.2) and later, creating PATs is disabled by default. On sites activated before June 2023 (Tableau 2023.2), creating personal access tokens (PATs) is enabled for all users by default and have a default expiration of one year. 1. Sign in to Tableau Cloud as a site admin and navigate to the Settings page. 2. Under the Personal Access Tokens section, select the Enable personal access tokens check box if not already selected, and do _one_ of the following tasks: - Keep the Enable personal access tokens check box selection to enable all users to create PATs. - Alternatively, select the Only users in the specified group radio button and select a group from the list to limit the access of creating new PATs only to the users that are members of that group. **Note:** If you select this option, a group must be selected in order for you to save the setting. 1. Under Set expiration period, do _one_ of the following: - If not selected already, select the 180 days radio button. - Alternatively, in the Custom days text box, enter a valid value, 1 through 365. ![A form for creating personal access tokens and setting an expiration period.](/tableau/next/en-us/online/en-us/Img/pats_configure.png) 2. When finished, click the Save button on the top or bottom of the page. ## Tasks for managing users' personal access tokens ### Create a PAT Site admins can't create PATs for users. Your users must create their own PATs. Users with accounts on Tableau Cloud can create, manage, and revoke personal access tokens on the My Account Settings page. For more information, see [Manage Your Account Settings](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm) in the Tableau Help. Note: A user can have up to 104 PATs. ### Monitor PATs usage If you have Tableau Cloud with Advanced Management, you can use Activity Log to monitor PATs usage. Events in the Activity Log that capture PATs usage include, but not limited to: issue token (issue refresh token), log in with token (login with pat), redeem token (redeem refresh token), and revoke token (revoke refresh token). For more information about these events, see [Activity Log Site Event Type Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_schema.htm). ### Revoke a PAT As a site admin, you can revoke a user's PAT. A user is also able to revoke their own PAT on their My Account Settings page using the procedure described in the [Manage Your Account](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm#pat) topic in the Tableau User Help. 1. Sign in to Tableau Cloud as a site admin and navigate to the Users page. 2. Locate the user whose PAT you want to revoke. For more information about navigating Server Admin pages and locating users, see [View, Manage, or Remove Users](https://help.tableau.com/v0.0/online/en-us/users_view.htm). 3. Click the user's name to open their profile page. 4. On the user's profile page, click the Settings tab. Note: A site admin can only access the Settings tab and see a user’s PAT if they are a site admin on all the sites that the user belongs to. 5. Under the Personal Access Tokens section, identify the PAT that you want to revoke and then click the Revoke Token button. 6. In the Delete dialog, click the Delete button. [Skip to main content](#main-content) # Personal Access Tokens for Tableau Cloud Manager Personal access tokens (PATs) provide you with the ability to create long-lived authentication tokens. PATs enable you to sign in to the Tableau Cloud Manager (TCM) REST API without requiring hard-coded credentials (username and password) or interactive sign-in. For more information, see [Tableau Cloud Manager REST API](https://help.tableau.com/current/api/cloud-manager/en-us/index.html). > [!WARNING] > > **Important:** TCM PATs can't be used to sign in to the Tableau REST API. To authenticate to the Tableau REST API, you must use PATs generated in Tableau Cloud. For more information about how to use PATs with Tableau Cloud, see [Personal Access Tokens](https://help.tableau.com/v0.0/online/en-us/security_personal_access_tokens.htm). We recommend creating PATs for automated scripts and tasks that are created with the Tableau Cloud Manager REST API: - **Improve security:** PATs reduce risk in the event credentials are compromised. Instead of using a username and password, users can reduce the impact of credential compromise by using a personal access token for automated tasks. If a PAT gets compromised or is used in automation that's failing or posing a risk, you can revoke the PAT instead of rotating or revoking the user's credentials. - **Manage automation:** A PAT can be created for each script or task that is run. This allows you to silo and review automation tasks across your organization. Additionally, by using PATs, password resets, or metadata changes (username, email, etc.) on user accounts don't disrupt automation as it does when credentials are hard-coded into the scripts. Notes: - PATs are required to make a Tableau Cloud Manager REST API sign-in request to Tableau Cloud Manager (TCM) with multi-factor authentication (MFA) enabled with Tableau authentication. - PATs aren't used for generic client access to TCM. - PATs are automatically revoked when the TCM authentication method changes. - The first time you sign in to the Tableau Cloud Manager REST API, a PAT must be created using the TCM UI using the procedure described below or in [Authentication](https://help.tableau.com/current/api/cloud-manager/en-us/docs/authentication.html) in the TCM REST API Help. ## Understand personal access tokens When a personal access token (PAT) is created, it's hashed then stored in the repository. After the PAT is hashed and stored, the PAT secret is shown one time to the user and then no longer accessible after they dismiss the dialog. Therefore, users are instructed to copy the PAT to a safe place and handle it like a password. When the PAT is used at run-time, Tableau Cloud Manager (TCM) compares the PAT presented by the user to the hashed value stored in the repository. If a match is made, then an authenticated session is started. In the context of authorization, the TCM session that is authenticated with a PAT has the same access and privileges as the PAT owner. ### About PAT expiration Personal access tokens (PATs) expire if not used after 15 consecutive days or based on the token expiration value selected when creating the PAT, whichever comes first. After PATs expire, they're unable to be used for authentication and removed from the cloud administrator's My Account Settings page. ## Tasks for managing cloud administrator's personal access tokens ### Create a PAT This procedure requires you to copy a secret to a file. The secret is the string that you include in your automation scripts and will be used to authenticate to Tableau Cloud Manager (TCM). Handle the secret as you would a password: protect the secret and don't share it with others. To create a PAT, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. At the top of a page, click your profile image or initials, and then select My Account Settings. 3. Under Personal Access Tokens, click Create Token. 4. Enter a descriptive name for your token in the Token Name field. 5. Select the token expiration date and click Create Token. 6. In the Personal Access Token dialog box, click Copy Secret. ![](/tableau/next/en-us/online/en-us/Img/pats_secret.png) 7. Paste the secret to a file and store the file in a safe location. 8. When finished, click Done. **Note:** A user can have up to 104 PATs. ### Revoke a PAT Cloud administrators can revoke their PAT on their My Account Settings page using the following steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. At the top of a page, click your profile image or initials, and then select My Account Settings. 3. Under the Personal Access Tokens section, identify the PAT that you want to revoke and then click Revoke Token. 4. In the Delete dialog box, click Delete. [Skip to main content](#main-content) # Plan Your Bridge Deployment As a site admin, if you're setting up Tableau Bridge for the first time or upgrading, there are a set of recommendations, best practices, and planning tasks to follow to optimize Bridge for your organization. For a general overview of Bridge, see [Use Bridge to Keep Data Fresh](https://help.tableau.com/v0.0/online/en-us/qs_refresh_local_data.htm). Before you deploy Bridge, review the following information to help you, as the site admin, understand the different components of Bridge, how these components work together, and how they impact your Bridge deployment. ### Bridge software Bridge is stand-alone software, provided at no additional cost, to use in conjunction with Tableau Cloud. Bridge is a thin client that you install behind a firewall to enable connectivity between private network data and Tableau Cloud. To take advantage of the latest security and feature updates, always install the latest version of the Bridge client from the [Downloads](https://www.tableau.com/support/releases/bridge) page. For more information, see the [Install Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm) topic. In most cases, you will own the set up and management of several clients, or pools of clients, in your organization. - Clients can only be registered to one site at a time. - There is no limit on how many clients that can be registered to a site. ### Database drivers To facilitate connectivity between private network data and Tableau Cloud, Bridge requires drivers to communicate with some databases. Some driver software is installed with the client. Other driver software must be downloaded and installed separately. For more information, see the [Install Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm#database-drivers) section in the Install Bridge topic. ### Pooling capacity By default, data freshness tasks, live queries, and data sources or virtual connections that use extract connections refreshed with Bridge refresh schedules, are distributed and load balanced across available clients in a pool. | Data Freshness Task | Pooling Support | Concurrency Capacity | | --- | --- | --- | | Live query | Yes | 16 live queries per client | | Extract connection - Bridge refresh schedule (Published data sources) | Yes | 10 refreshes per client ([can be configured](https://help.tableau.com/current/online/en-us/to_sync_change_computer_site.htm#poolcapacity)) | | Extract connection - Bridge legacy schedule | No | 1 refresh per client | Bridge is designed to scale up and scale out. When configuring your Bridge deployment, consider the following: - For a smaller pool of clients running on higher specification machines, each client can be scaled up to run more scheduled refresh jobs in parallel. - For a larger pool of clients running on lower specification machines, though each client can run fewer refresh jobs in parallel, each client still provides high throughput and capacity for the pool as a whole. For information about Tableau site capacity, see [Concurrent jobs capacity](https://help.tableau.com/current/online/en-us/to_site_capacity.htm#concurrent-jobs-capacity). ### Data access and authentication The underlying data that a data source or virtual connection connects to often requires authentication. If authentication is required, the publisher or owner can configure how the database credentials are obtained. For data sources The authentication configuration options for data sources are: Prompt user or Embedded password. If the data source is set to prompt users, database credentials are not stored with the connection. This means, a user who opens the data source (or workbook that uses the data source) must enter his or her own database credentials to access the data. If a data source is set up with the password embedded, database credentials are saved with the connection and used by anyone who accesses the data source (or workbook that uses the data source). For more information, see [Set Credentials for Accessing Your Published Data](https://help.tableau.com/current/pro/desktop/en-us/publishing_sharing_authentication.htm). **For virtual connections** Database credentials are stored with a virtual connection's connection and used by anyone who accesses the virtual connection. ### Content management In most cases, the site admin owns and manages the Bridge clients. Content owners manage the data sources or virtual connections themselves for tasks that range from publishing to updating database credentials and refresh schedules. ### Timeout limits Live queries have a timeout limit of 15 minutes. This limit is not configurable. Refreshes have a default timeout limit of 24 hours and is configurable by the client. For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#timeout). ### Hardware recommendations The following table shows hardware guidelines for virtual environments running Bridge. These guidelines are based on the number of concurrent refreshes you need each client to be able to run in parallel.

	Refreshes running in parallel per client
	<=5	<=10
vCPU	4	8
RAM	16 GB	32 GB
NVMe SSD	150 GB	300 GB

**Disk space considerations** The required free space is determined by the combined size of the data extracts (the .hyper files) that are created in parallel on the Bridge Client. This process is similar to creating an extract in Tableau Desktop, where the extract file needs to be saved to disk temporarily. To plan for disk space, calculate the maximum size of the data sources you expect to refresh concurrently. Ensure that the system drive has at least that amount of free space, plus a buffer, to accommodate the temporary files. For Tableau Bridge on Windows, temporary disk usage is important to consider in your planning. See the section below, [Disk space planning for Windows](#disk-windows). **Virtual environments** All of Tableau’s products operate in virtualized environments when they are configured with the proper underlying Windows operating system and minimum hardware requirements. - Amazon EC2 - Citrix environments (non-streaming) - Google Cloud Platform - Microsoft Azure - Microsoft Hyper-V - Parallels - VMware ## Linux deployment To use Bridge on Linux you must create a customized Docker image, install the RPM package, and then run Bridge from inside the container image. The Bridge on Linux project is supported on Red Hat and Amazon Linux. For more information, see [Install Bridge for Linux for Containers](https://help.tableau.com/v0.0/online/en-us/to_bridge_linux_install.htm). ## **Windows deployment** Tableau recommends installing the Bridge client on a computer behind your firewall. Only one client can be installed on a computer. - Microsoft Windows 10 or later, 64-bit - Windows Server 2016, Windows Server 2019, Windows Server 2022 **Note**: Windows Server 2025 is not yet supported. For more information, see the Product Knowledge Article, [Tableau Server Is Not Compatible With Windows Server 2025](https://help.salesforce.com/s/articleView?id=004811287&type=1). - CPUs must support SSE4.2 and POPCNT instruction sets For more information, see [Windows Client requirements](https://help.tableau.com/v0.0/online/en-us/to_bridge_client.htm#reqs) ### Disk space planning for Windows The primary concern for disk space planning when deploying Tableau Bridge on Windows is to ensure adequate free space is available on the system drive (typically C:), regardless of where the Tableau Bridge application is installed: - Default behavior: Unlike Tableau Server, which moves all its files to the chosen installation drive, the Tableau Bridge Client uses the default Windows profile settings of the user running it. - Location of utilization: The significant disk space required for extract refreshes is consumed by the temporary (TEMP/TMP) files and the My Tableau Bridge Repository folder. - System drive dependency: Unless the Windows administrator has explicitly changed the user's default profile settings, the TEMP directories and user profiles will reside on the system drive (e.g., C:), even if the Bridge Client is installed on a separate drive (e.g., D:). Always confirm that the system drive (C:) has sufficient free disk space to handle the temporary files generated during extract creation, as this is the default location for the TEMP/TMP folders. ### Required accounts for Windows There are two types of accounts that your Bridge deployment requires: a Windows service account and a Tableau Cloud account. **Windows services account** Bridge clients can run in one of two modes: Application or Service. To run the client in Service mode, a Windows services account, with "log on as user" privilege is required. Service mode allows the client to run continuously without a dedicated logged-on user. Service mode is recommended to support 1) data sources or virtual connections with live connections to private network data, and 2) load balancing (pooling) of clients. For more information about each mode, see [About the Bridge Client](https://help.tableau.com/v0.0/online/en-us/to_bridge_client.htm). **Note:** We recommend that no more than 10 clients run under a single Windows services account. **Tableau Cloud account** Tableau Cloud authenticates the client by the user that is signed in to and managing the client. Therefore, a Tableau Cloud site admin account is necessary to perform certain management tasks, like adding or removing a client from a pool, both on the client and Tableau Cloud site. One of the following site roles is required to manage Bridge: - Site Administrator Creator - Site Administrator Explorer The non-administrator site roles, Creator and Explorer can publish data sources, refresh data, and use Bridge to facilitate the live and extract connections between Tableau Cloud and private network data. The Creator or Explorer role and Data Management is required to publish virtual connections and refresh data with Bridge. #### Scheduling capacity Because Bridge clients can easily be connected and disconnected, you can leverage scripts to schedule Bridge capacity (that is, the number of running client machines) in advance of anticipated data freshness workloads. For example, if your Bridge clients run on virtual machines on AWS, the following AWS resources can help you get started with scheduling: - [AWS Instance Scheduler](https://docs.aws.amazon.com/solutions/latest/instance-scheduler/welcome.html) - [How do I stop and start my instances using the AWS Instance Scheduler?](https://aws.amazon.com/premiumsupport/knowledge-center/stop-start-instance-scheduler/) - [How do I stop and start Amazon EC2 instances at regular intervals using Lambda?](https://aws.amazon.com/premiumsupport/knowledge-center/start-stop-lambda-cloudwatch/) ### New Bridge deployment on Windows To deploy Bridge, do the following: 1. For each machine, log on using your Windows services account, and install the latest client. 2. After installation, sign in to the client using your Tableau Cloud site admin credentials to ensure that the client is [running under Service mode](https://help.tableau.com/current/online/en-us/to_bridge_client.htm) (on by default). 3. Open a browser, sign in to Tableau Cloud using your site admin credentials and go to the Bridge settings page to ensure: 1. [Installed clients are properly linked to the site.](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm#step-1-ensure-clients-can-connect-to-the-site) 2. [Clients are part of the client pool.](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm#step-2-enable-pooling) 4. [Monitor](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm#monitor-data-freshness-tasks) the Bridge live queries using the Bridge Connected Data Sources admin view, and refresh jobs from the Jobs page on Tableau Cloud. ## Upgrade an existing Bridge deployment As with previous releases, the enterprise improvements in this release are designed to complement your existing Bridge deployment. As with other deployments, we recommend the following steps below. **Notes:** - Sites with default pools can’t be configured to access a specific private network. To reduce the scope of access of this pool and to enable more advanced scheduling capabilities, we recommend you create new pools and map them to specific domains. For more information, see [Step 2: Configure a pool](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#step2). - Because Bridge pools are mapped to and refresh data from specific domains, we strongly recommend that extract data sources that contain connections to multiple domains be updated in one of the following ways: - Consolidate underlying data locations so that the connections are in the same domain - Change the connection type of each connection to use live query - Convert each connection to a data source - When using 1) Tableau Desktop on a Mac, 2) publishing a file-based data source from a Windows network file share, and then 3) configuring a Bridge refresh schedule, the refreshes will fail. If this file-based data source is business critical resource for your organization, consider configuring a Bridge legacy schedule instead. For more information, see [Set up a Bridge legacy schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm#Set). - Existing data sources, including all file-based data sources that are already configured with Bridge legacy schedules and associated with specific clients will continue to run as expected. **Important:** Support for Bridge legacy schedules will be removed in version 2025.2. To ensure a smooth transition, we recommend you use Bridge refresh schedules. For more information, see [Migrate from Bridge legacy to Bridge refresh schedules](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm#migrate). ### Upgrade steps 1. Add new clients. 2. Create new pools, map domains to a pool, and assign version clients to pools. Follow the procedures described in [Step 2: Configure a pool](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#step2), [Step 3: Specify a domain for a pool](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#step3), and [Step 4: Add clients to a pool](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#step4). 3. If you have Bridge legacy schedules, request data source owners to convert the (legacy) schedules. See [Migrate from Bridge legacy to Bridge refresh schedules](https://help.tableau.com/current/online/en-us/to_sync_schedule.htm#migrate-from-bridge-legacy-to-online-schedules). > [!IMPORTANT] > > We recommend that data source owners begin the process by converting refresh schedules for extract data sources that are least critical to daily business. This is because converting Bridge legacy to Bridge refresh schedules will immediately delete the existing refresh schedules. 4. Upgrade existing clients. For more information, see [Install Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm#upgrade). 5. Add existing clients to a pool. After upgrade, ensure the upgraded clients are running as a Window service and then add those clients to the pool. For more information, see [Step 4: Add clients to a pool](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#step4). ## Other articles in this section [Skip to main content](#main-content) # Plan Your Data Connect Deployment As of September 2025, Tableau Data Connect is no longer available for new deployments. We recommend that existing customers migrate their Data Connect deployment to [Private Connect](https://help.tableau.com/current/online/en-us/private_connect_migrate_from_bridge.htm) or [Tableau Bridge](https://help.tableau.com/current/online/en-us/data_fresh_sync_section.htm). Data Connect will be retired in the future. Data Connect is a paid subscription service available to Tableau Cloud Enterprise and Tableau+ customers. After you have purchased Data Connect, the site admin will be able to configure the service in the settings page of Tableau Cloud. ### Infrastructure specifications - **Compute**: A location for hosting Data Connect. This can be a bare-metal or VM, and can be located in a private network or in the cloud. - **Operating System (OS)**: An up-to-date and patched installation of a supported Linux distribution. - **Storage**: Allocated storage space to host the OS, Data Connect, and the extracts it creates when performing refreshes. - **Network**: The compute must be able to connect to your data source and two locations on the public internet. ### Node specifications

Number of nodes	Production workload minimum: three nodes per network Development/test workload minimum: one node per network
vCPU	Minimum: 8 vCPU Recommended: 16 vCPU or more
Memory	Minimum: 16 GB Recommended: 64 GB or more
Root volume	Minimum: 100 GB Recommended: 200 GB
Variable volume	Minimum: 100 GB Recommended: 200 GB
Storage (two disk) Important: The secondary disk must be raw and unformatted.	Root disk Minimum: 200 GB disk space Recommended: Greater than 300 GB Secondary disk Minimum: 200 GB Recommended: Greater than 500 GB
Permission	Root access to host

### Linux Operating System

Supported distributions

RHEL-8
RHEL-9
Ubuntu-20.04
Ubuntu-22.04

### Networking specifications For more information about Data Connect component relationships, see [Architecture](https://help.tableau.com/v0.0/online/en-us/data_connect_about_overview.htm#Architec).

Proxy filtering	See Optional forward proxy filtering.
Bi-directional communication with Tableau Cloud on port 443 (Application layer)	IP address range is unique for each Tableau Cloud pod. To determine your IP address range, see Authorize Access to Cloud Data Published to Tableau Cloud.
Outbound requests for certification validation on port 80 (Application layer)
Outbound TLS client authentication on port 443 with mutual TLS authentication (Orchestration layer)	52.42.211.235 52.10.6.79 35.167.70.143
Outbound listing of Fully Qualified Domain Names (FQDN) (Orchestration layer)	tunnel.rafay-edge.net api.rafay.dev control.rafay.dev fluentd-aggr.rafay-edge.net influxdb01.core.rafay-edge.net debug.core.rafay-edge.net edge.core.rafay-edge.net registry.rafay-edge.net app.rafay.dev console.rafay.dev .connector.kubeapi-proxy.rafay.dev .user.kubeapi-proxy.rafay.dev event.core.rafay-edge.net repo.rafay-edge.net .connector.cdrelay.rafay.dev .user.cdrelay.rafay.dev .connector.infrarelay.rafay.dev .user.infrarelay.rafay.dev
Internal network	The cluster nodes will need the same network access to the data source as is required by Tableau Desktop.
Inbound network rules To enable communication between the nodes within your environment, configure network rules on the nodes for these ports.	Port ranges: 53, TCP 6443, TCP 2379-2380, TCP 10250, 10255, TCP 10259, 10251, TCP 10257, 10252, TCP 30000-32767, TCP 8285, 8472, UDP 8500, TCP 8600, UDP 8301, TCP/UDP 9099, TCP 5656, TCP 4789, UDP
Tableau Cloud permissions	Site Admin role and the credentials to access the data source.
Data source	An authentication method for the data source that is currently supported by Data Connect and that is network accessible from the cluster.

### Database access Data Connect uses Tableau connectors to connect to different databases to maintain data freshness. Some of those connectors require drivers to communicate with the databases. To get drivers for connectors that the Data Connect supports, go to Tableau [Driver Download](http://www.tableau.com/support/drivers) and filter to Linux. Data Connect only supports Linux drivers. Make sure to use the instructions listed for each database. ### Database authentication The underlying data that a data source, Prep Conductor flow, or virtual connection connects to often requires authentication. If authentication is required, the publisher or owner can configure how the database credentials are obtained. #### Data sources The authentication configuration options for data sources are _Prompt user_ or _Embedded password._ - If the data source is set to prompt users, database credentials are not stored with the connection. This means, a user who opens the data source (or workbook that uses the data source) must enter their own database credentials to access the data. - If a data source is set up with the password embedded, database credentials are saved with the connection and used by anyone who accesses the data source (or refreshes the data source). For more information, see [Set Credentials for Accessing Your Published Data](https://help.tableau.com/current/pro/desktop/en-us/publishing_sharing_authentication.htm). #### Tableau Prep Conductor and virtual connections Database credentials are stored in a Prep flow or a virtual connection. For Prep flows, the credentials are used when a Prep Conductor flow runs. For virtual connections, these credentials are used by anyone who accesses the virtual connection. For more information on data source credential management, please refer to [Data Connect Security](https://help.tableau.com/v0.0/online/en-us/data_connect_security.htm). ## Capacity planning There are several tools available to administrators to manage capacity of their workloads on Data Connect. ![Compontents of Data Connect service include Private network, pools, clusters, and nodes.](/tableau/next/en-us/online/en-us/Img/data_connect_object_relationship.png) ### Cluster management Data Connect clusters are a cluster of nodes that access data within a specified private network. Those nodes can access any databases within their network that they have been configured to access. All Bridge clients on all nodes of that cluster can handle workloads for any sites that have access to the cluster. To increase capacity of a cluster you can add nodes to the cluster to increase throughput or increase the size of the computer (CPU, memory, etc). ### Load balancing with pools Each cluster uses a pool to load balance traffic across all Bridge clients in the cluster. Having multiple nodes within each cluster ensures that you have multiple Bridge clients available to handle traffic associated with the pool. For every domain added to a pool, all traffic to that domain is load balanced across the cluster. Domains cannot be added to more than one pool on a site. This design ensures traffic is routed appropriately. ### Site limits There are site limits enforced on jobs delivered by Data Connect to ensure a good experience for all customers on Tableau Cloud. The limits that are enforced are the same as those enforced for Tableau Bridge because Data Connect is deploying Tableau Bridge on your behalf to service database queries. For more information on those limits, see[Bridge Site Capacity](https://help.tableau.com/v0.0/online/en-us/to_bridge_site_capacity.htm). For more information about capacity planning, download the whitepaper, [Accessing Your Private Network Data with Tableau Cloud](https://www.tableau.com/learn/whitepapers/tableau-bridge-data-connect-best-practices-guide). [Skip to main content](#main-content) # Premium Tableau Pulse Capabilities A limited number of Tableau Pulse capabilities are available only as part of Tableau+. Tableau+ is a license edition of Tableau Cloud that supports larger or more complex deployments. To learn more, see [About Tableau+ Bundle](https://help.tableau.com/v0.0/online/en-us/to_tab_plus_features.htm) .

Capability

Description

Tableau Agent in Pulse (formerly known as Enhanced Q&A)

Use Tableau Agent in Pulse on the Tableau Pulse home page to explore insights about groups of metrics that share the same data source, definition, or time range. On an individual metric, select the Ask button then select a Tableau Agent in Pulse question to get answers powered by AI in Tableau. For more information, see Ask Questions and Discover Insights in Tableau Pulse.

You can try Tableau Agent in Pulse for free on an existing Tableau Cloud site with the Try AI site setting. For more information, see Try Tableau Agent in Pulse.

Correlated metrics

Get insights about how a metric is similar to other metrics that have been set as correlation candidates. For more information, see Configure insights.

Forecast

See a forecast of how a metric is expected to perform for the remainder of a time period. The forecast appears on the overview chart on a metric’s insights exploration page. For more information, see Insight types in Tableau Pulse.

[Skip to main content](#main-content) # Private Connect Private Connect uses AWS PrivateLink to provide secure, private, and dedicated connections between your network environments and Tableau Cloud. By routing traffic entirely over private address space, your data never traverses the public internet. This network isolation helps meet strict security policies and compliance regulations such as GDPR, HIPAA, and CCPA. ## Outbound Private Connect Outbound Private Connect allows users to securely connect from Tableau Cloud to cloud-hosted data providers. It restricts data traffic to private networks and can simplify architecture by removing the need for other tools like Tableau Bridge. Once established, creators simply use a special connection address exactly as they would a standard database connection. For more information, see [Outbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_setup_overview.htm). ## Inbound Private Connect Inbound Private Connect secures traffic flowing from your organization's network to Tableau Cloud. It supports standard interactions over a private connection, including web browser access, Tableau Desktop publishing, Tableau Bridge connections, and API calls. This completely isolates your analytical data, user sessions, and login pages from the public web. For more information, see [Inbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_inbound.htm). ## Other articles in this section [Skip to main content](#main-content) # Publish a Private Network Data Source with a Live Connection This topic describes how a data source owner can publish a data source that uses a live connection to private network data. Data sources that connect to private network (including private cloud) data rely on Tableau Bridge. The tasks described in this topic assume Bridge has already been set up and is being maintained by your site admin. - Bridge supports keeping data fresh for data sources embedded in workbooks. To publish a workbook with embedded data sources, see [Use Embedded Data Sources](https://help.tableau.com/v0.0/online/en-us/to_bridge_eds.htm). - To publish a private cloud-based data source that uses a live connection, see [Connect to Private Cloud Data](https://help.tableau.com/v0.0/online/en-us/to_bridge_vpc.htm). - To publish a virtual connection with a live connection, see [Create a Virtual Connection](https://help.tableau.com/v0.0/online/en-us/dm_vconn_create_conn.htm##select-table-mode-live-or-extract) ## Publish a data source The procedure below describes how you can publish a data source that uses a live connection. To support live connections to data sources that connect to private network data, Bridge uses functionality called live queries. To keep the data source up to date, Bridge queries the database directly and returns the results of the query for use in the data source. 1. In Tableau Desktop, create your data source. 2. Select Server > Publish Data Source to begin the publishing process. If you haven't already signed in to Tableau Cloud, you will be prompted to. 3. In the Publish Data Source to Tableau Cloud dialog box, configure the various options for your data source and ensure you do the following: - Under Authentication, click Edit and select Embedded password or Server Run As account depending on the option you see. - Depending on the data that the data source is connected to or how you've configured the data source, the dialog can default to publishing a live connection or give you the option to publish a live connection or extract. If you are provided with options, select Maintain a live connection. 4. Click the Publish button. This opens a browser window to Tableau Cloud. 5. In the Publishing Complete dialog box, click the Done button. [Skip to main content](#main-content) # Publish a Virtual Connection and Set Permissions When you work in the virtual connection editor, your changes are automatically saved as a draft while you work. To share a new virtual connection with other users, you need to publish it. ## Save a draft You can manually save a draft of the connection by clicking the save icon ![Save icon](/tableau/next/en-us/online/en-us/Img/ipa_Save_16px_medium.png) in the toolbar or by selecting File \> Save Draft from the menu. When editing a published virtual connection, the connection stays available to users in its current published state. You can save your updates as a draft while you work on the connection in the editor. To share the updates to the virtual connection with other users, you need to publish it. ### Draft in progress If you close the editor while updating a published virtual connection, the next time you open the connection in the editor within seven days, you have the option of continuing to make edits to the existing draft, starting a new draft, or opening the connection in its current published state by clicking Cancel. ![Draft Already Exists message](/tableau/next/en-us/online/en-us/Img/dm_vconn_draft_exists.png) To return to a draft version of an unpublished virtual connection, you need to manually save the URL of the draft **before** you close the editor. You can use the URL to open the draft in the editor the next time you want to work on the connection within seven days. For example: `https://yourserver.test.com/published-connection-editor/?draft=d1789edc-5d9f-40ae-988d-9fc879f37a98` ## Publish the connection To publish a new connection: 1. Click the Publish button in the upper right corner of the editor or select File \> Publish from the menu. 2. In the Publish dialog box: 1. Type a name in the Name field. 2. Select a project to save the connection to. 3. Click Publish. To publish an updated connection, click the Publish button in the upper right corner of the editor or select File \> Publish from the menu. ## Set permissions on a virtual connection After you publish a virtual connection, you need to set the permissions so that others can use it. By default, all users can View the connection, in other words, see it listed under Virtual Connections in Tableau, but unless you set the Connect capability to Allowed, only you and administrators can use the virtual connection. For more information on the Connect capability, see [Permissions](https://help.tableau.com/v0.0/online/en-us/dm_vconn_overview.htm#VConnOverviewPermissions). To set permissions: 1. Navigate to the virtual connection. 2. Open the Actions menu (...) and click Permissions. 3. Check the box under the Connect icon so that connect is allowed for all users. ![Connect Allowed permission check box](/tableau/next/en-us/online/en-us/Img/dm_vconn_connect_allowed.png) > [!TIP] > > You can add additional rules if you want to grant the permission only to certain users or groups. 4. Click Save. For more information about permissions on Tableau content, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#contentlevel-permissions). For information on embedding passwords when you publish Tableau content such as a data source or workbook that uses a virtual connection, see [Virtual connections](https://help.tableau.com/current/server/en-us/publishing_sharing_authentication.htm#virtual-connection-embedded-password) in the Tableau Server help. ## Who can do this To publish a virtual connection or set permissions, you must - have credentials to the database that the virtual connection connects to, and - be a server or site administrator, or a Creator. ## Next step After you publish a virtual connection and set its permissions, you can [Use a Virtual Connection](https://help.tableau.com/v0.0/online/en-us/dm_vconn_use.htm) . [Skip to main content](#main-content) # Publish Views to Salesforce Bring your views from Tableau Cloud or Tableau Server right to your Salesforce ecosystem by publishing views to a CRM Analytics app or Salesforce Lightning page. For more information, see [Publish Tableau Content to CRM Analytics](https://help.salesforce.com/s/articleView?id=sf.bi_publish_tableau_online.htm&language=en_US&type=5) in Salesforce Help. ## Prerequisites See a complete list of [prerequisites](https://help.salesforce.com/s/articleView?id=sf.bi_tableauviews_setup_prereq.htm&type=5) in Salesforce Help, including required licenses, account setup, and permissions. ## Publish a view to Salesforce Select one or more views, including dashboards, sheets, and stories. Then, choose a destination from a list of CRM Analytics apps that you have access to edit or manage. 1. Select the view that you want to publish to Salesforce. **Note**: You can select a maximum of 25 views at a time to publish to Salesforce. 3. For Actions, select Publish to Salesforce. 4. Select the Salesforce credentials that you want to use for publishing. 5. Select the destination app that you want to publish to. You can only see apps that you can edit or manage with the signed-in Salesforce user. ![Publish to Salesforce dialog showing the list of apps that you can choose from.](/tableau/next/en-us/online/en-us/Img/publish-to-salesforce-dialog.png) 9. Click Publish. ## Who can see the published view in Salesforce? When you publish a view to Salesforce, anyone with access to the selected CRM Analytics app or Lightning page can see that the content exists. However, only those signed in with existing Tableau permissions can see the view. [Skip to main content](#main-content) # Publish with Data Connect As of September 2025, Tableau Data Connect is no longer available for new deployments. We recommend that existing customers migrate their Data Connect deployment to [Private Connect](https://help.tableau.com/current/online/en-us/private_connect_migrate_from_bridge.htm) or [Tableau Bridge](https://help.tableau.com/current/online/en-us/data_fresh_sync_section.htm). Data Connect will be retired in the future. Data Connect is a product that is managed by site admins. But it can service queries for all users on a Tableau Cloud Site. Creators who publish content will need to keep a few things in mind when connecting to private network data using Data Connect. Those items are outlined below. Explorers and Viewers will utilize Data Connect, but will largely be unaware of whether or not it is in use. ## Database connectivity Data Connect deploys the Bridge client which services database queries. The Bridge clients used in Data Connect are individual deployments of Tableau Bridge on Linux for Containers. Therefore, Data Connect supports all database connectors and database authentication patterns that Tableau Bridge on Linux for Containers supports. For more information, see [Connectivity with Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm). Data Connect supports both live and extract data sources. Data Connect only supports database drivers built for Linux. The drivers must be included in the base image that site admins configure during Data Connect setup. ## Using Data Connect to query private data Creators who need to connect to private network data with Data Connect [follow the same process of connecting to data](https://help.tableau.com/current/pro/desktop/en-us/basicconnectoverview.htm) with Tableau Desktop and publishing it to Tableau Cloud. There are two additional steps required for keeping that data fresh with Data Connect: - When setting up Data Connect, site admins create pools. Pools define the database domains that will use Data Connect. Queries to that database domain are sent to the Data Connect Bridge client. - (Published Data Sources only) Data Source owners must take one additional action for each data source after publishing it to Tableau Cloud to use Data Connect. After a data source is published you can rotate the credentials of that data source and update other aspects of the connection information. See [Update Bridge Connection Information](https://help.tableau.com/v0.0/online/en-us/to_sync_client_settings.htm). - **Using embedded data sources**: Data Connect supports querying embedded data sources. There are many advantages to using published data sources to scale centralized data sources. For more information, see [Using Embedded Data Sources](https://help.tableau.com/current/online/en-us/to_bridge_eds.htm). - **Setting up refresh schedules**: Data Connect allows you to schedule refreshes of extract data on a regular basis. See S[Set Up a Private Network Refresh Schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm). - **Managing email alerts**: If enabled by your site admin, you will receive email alerts about refresh failures for all of the data sources that you own. When refreshes for your data sources are managed by Data Connect, the type of alerts you receive, when you receive the alerts, and the alerts that you can configure will differ from Tableau Cloud alerts. See [Manage Email Alerts for Bridge](https://help.tableau.com/current/online/en-us/to_bridge_eds.htm). ## Troubleshooting errors from individual queries Individual jobs are handled by the Data Connect Bridge client. To determine the underlying cause, the troubleshooting steps required will depend on the user scenario. Site admins have access to data about all refresh jobs serviced by Data Connect. For more information on accessing this data, see [Monitoring Data Connect query health](https://help.tableau.com/v0.0/online/en-us/data_connect_admin.htm#Monitori). The Admin Insights Job Performance data source is especially useful in identifying if issues are occurring commonly on the same database or on the same Data Connect Agent. In the event that a node becomes unhealthy, the Bridge clients and the queries they execute can fail. To troubleshoot node health, see [Troubleshooting service initialization and health](https://help.tableau.com/v0.0/online/en-us/data_connect_admin.htm#Troubles). ### Live query errors Live query errors arise when a user opens a dashboard with a live data source configured to use Data Connect. These errors indicate that there is an issue with the connection to the database. For common troubleshooting steps, see [Identifying causes for live query issues](https://help.tableau.com/v0.0/online/en-us/to_bridge_troubleshoot.htm#livequery) . ### Extract refresh failures Data source owners receive email notifications if an extract refresh is unsuccessful. These email notifications will contain error messages that can support troubleshooting the issue. For more information about how Data Source owners can troubleshoot their jobs, see [Identifying causes for scheduled refresh issues](https://help.tableau.com/v0.0/online/en-us/to_bridge_troubleshoot.htm#refresh). [Skip to main content](#main-content) # Quick Help [Connect to Data](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_connect.htm) [About the Virtual Connection Editor](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_about_editor.htm) [Add Tables to the Connection](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_add_tables.htm) [About Data Policies](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_about_data_policy.htm) [Create and Test Data Policies](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_create_data_policy.htm) Not finding what you need? Go online to see [all Tableau help](https://www.tableau.com/support/help) [Skip to main content](#main-content) - [Get Started](https://help.tableau.com/current/pro/desktop/en-us/navigating.htm) ![Add description of the image](/tableau/next/en-us/online/en-us/Img/getstarted_36px_43x43.png) Learn what Tableau Cloud can do - [Quick Help](https://help.tableau.com/v0.0/online/en-us/ipa_vconn_start.htm) ![Add description of the image](/tableau/next/en-us/online/en-us/Img/producthelp_36px.png) Get help with what you're doing now - [Release Highlights](https://help.tableau.com/v0.0/online/en-us/ipa_online_whats_new.htm) ![Add description of the image](/tableau/next/en-us/online/en-us/Img/whatsnew_36px.png) Learn what's new in Tableau Cloud - [Training](https://trailhead.salesforce.com/en/search?keywords=tableau+online) ![Add description of the image](/tableau/next/en-us/online/en-us/Img/training_36px.png) Video training and tutorials - [Troubleshoot](https://help.tableau.com/current/online/en-us/to_refresh_troubleshoot.htm) ![Add description of the image](/tableau/next/en-us/online/en-us/Img/troubleshoot_36px.png) Troubleshooting and Support articles ## Other articles in this section [Skip to main content](#main-content) # Quick Start: Permissions A permission rule is a set of capabilities that defines what access a group or user has to a piece of content, such as a workbook, project, or data source. To efficiently manage permissions: - Remove permissions from the All Users group before creating more groups - Configure template permissions on the **Default** project before creating more projects - Manage permissions for groups, not users - Manage permissions for projects, not content ## Create group permission rules for projects For details on the following steps, see the [main article on permissions](https://help.tableau.com/current/server/en-us/permissions.htm). This Quick Start guide is an overview and doesn't capture many important details about permissions and permission management. ### 1\. Add users to groups A common way to manage permissions is to use groups for users who should have the same permissions. 1. If necessary, add users to the site. 2. Within a site, select **Groups**. 3. If necessary, create a group using the **Add Group** option. 4. Click a group name to open it, then use the **Add Users** button to add existing users to the group. ### 2\. Access project-level permissions settings The Explore page displays the content on the site. Use the dropdown to display Top-Level Projects or All Projects (to see nested projects as well). Navigate to the project you want to update, open the Actions (…) menu, then select Permissions. ![A dropdown menu with options to share, add to collections, rename, move, change permissions, change owner, and delete the project.](/tableau/next/en-us/online/en-us/Img/project_permissions_actionmenu.png) ### 3\. Create a permissions rule Select **\+ Add Group/User Rule** to create a new permission rule. The template drop-down offers a shortcut to apply an initial set of capabilities for the group. If desired, customize the permission rule by clicking a capability to set it to **Allowed** or **Denied**, or leave it **Unspecified**. ![Permission levels for project.](/tableau/next/en-us/online/en-us/Img/permissionrule.jpg) Whether a user can set permissions is based on their site role, content ownership, and how their Set Permissions capability is set. ### 4\. View a user’s effective permissions After you save the permissions rule for the group, you can view the effective permissions for each user. Click a group name to see the group's users and their permissions. Hover over a capability box to see a tooltip with details on whether a capability is allowed or denied. #### Site roles A user’s site role determines the maximum permissions allowed for that user. - Server and site administrators can access all site content and take actions on it. - Owners always get full access to the content they’ve published. When the parent project permissions aren’t locked, owners can change permissions for their published content. For more information, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm) and [Use Projects to Manage Content Access](https://help.tableau.com/v0.0/online/en-us/projects.htm). #### Permission logic - **Denied** takes precedence over **Allowed**. - **Unspecified** results in **Denied** if no other permissions are specified. - Specific user permissions on content take precedence over group permissions on content. In other words, user permissions trump group permissions. For more information, see [Effective permissions](https://help.tableau.com/v0.0/online/en-us/permission_effective.htm). [Skip to main content](#main-content) # Recycle Bin The Recycle Bin allows Site Administrators, Server Administrators, and authors with Explorer (can publish) or Creator site roles to restore previously deleted projects, workbooks, data sources, and flows. You can access the Recycle Bin from the Home page of your Tableau site. Expand the side pane, and then select Recycle Bin. If you don’t see Recycle Bin, the feature must be turned on by your administrator. > [!IMPORTANT] > > With the release of Recycle Bin in Tableau Cloud version 2025.1, the Technical Support team no longer accepts requests for help recovering accidentally deleted content. This includes content deleted from the Recycle Bin. ## What content is stored in the Recycle Bin? When the Recycle Bin is turned on, the following content types will temporarily move to the Recycle Bin after deletion: - Workbooks (including revision history, views, embedded credentials, embedded data sources, and extracts) - Data sources (including extracts and embedded credentials) - Projects (including contained workbooks and data sources) - Tableau Prep flows (Note: Tableau Prep flow drafts are still deleted permanently and will not go to the Recycle Bin) However, when you delete and restore workbooks, data sources, and projects, some elements of the original content will be lost, including: - Custom views - Subscriptions - Data-driven alerts - Permissions - Aggregated statistics about the deleted item (view and usage counters) - Tags - Favorite information (if the item was favorited) - Comments - Flow schedules - Extract refresh schedules > [!TIP] > > If you don’t see something that you expect to be in the Recycle Bin, verify that the correct Content Type is selected. ### Content: Notes and best practices - When deleted, supported content types keep their original names. The Restore action will fail if the project you restore to already has an item with the same name. To resolve this issue, restore into a different project, rename the just-restored content, and then move the content into the desired location. - Workbooks and data sources stored in the Recycle Bin still take up space on a site. If a workbook or data source uses an extract, that extract size is still counted against the site quota. - When deleted, supported content types do not change their owner. Users who originally owned content are still considered to be an owner. - On restore, restored Items will take on the default permissions set for the container that you restore to. When restoring critical content, the operating user should verify that permissions are set as necessary. The Restore operation will not restore original content permissions. - Users can see content they deleted in the Recycle Bin even if they aren't an admin or don't own the content. ### Projects: Notes and best practices Projects can contain a variety of content or nested projects. Note the following about projects when the Recycle Bin is turned on. **Note**: Recycle Bin respects hierarchy for nested projects on the original delete action and when restoring content. For example, you can delete an entire project branch from the root project to send the root and all nested projects to the Recycle Bin, and you can restore an entire project branch from the Recycle Bin if you restore the root project (and all of the nested projects are still in the Recycle Bin). However, hierarchy is not respected when you delete content from the Recycle Bin. To delete all of the projects from an original project branch from the Recycle Bin, you’ll need to delete each project individually. **Example project**: Project A includes 2 workbooks (A and B), a data source, and a flow. - When a project is initially deleted and sent to the Recycle Bin, all content from that project that is compatible with the Recycle Bin is stored individually. For Project A, you’ll see a project, Workbook A, Workbook B, and a data source in the Recycle Bin. Other types of content, like flows, are deleted immediately and can’t be recovered. - All compatible content from a project can be restored or deleted individually. For example, you can permanently delete Workbook A from Project A, leaving only a project, Workbook B, and the data source in the Recycle Bin. - If you restore a project, all compatible content that is still stored in the Recycle Bin at the time will also be restored. For Project A, if you’ve already deleted Workbook A and then restore Project A, the project will restore with only Workbook B and a data source. - If you delete a project from the Recycle Bin, only the project is deleted. For example, if you delete Project A from the Recycle Bin, Workbook B and the data source remain in the Recycle Bin until they are individually deleted, restored, or until the storage time expires. **Example project**: Project A includes Workbooks A, Workbook B, a data source, and a nested Project B that includes Workbook C. - If a deleted project contains nested projects, any nested projects that are still stored in the Recycle Bin at the time will be restored if the top-level project is restored. For example, restoring the root Project A restores the top-level Project A, Workbook B, a data source, Project B, and Workbook C to the selected restore location. - Nested projects in the Recycle Bin can be restored independently from their top-level project. If a nested project is restored independently, and then the top-level project is later restored, the top-level project restores without any content from the nested project. For example, if you restore Project B independently and then later restore Project A, Project A will restore with the top-level project, Workbook B, and the data source. The restored Project B will no longer be nested within Project A. **Example project**: Project 1 (P1) is a project branch that includes 4 nested projects (P2-P3-P4-P5). **Scenario**: You initially delete P1 and send the whole branch (the root P1 and the nested P2-P3-P4-P5 to the Recycle Bin. - From the Recycle Bin, you can delete any individual project from the original hierarchy (P1-P2-P3-P4-P5). - Deleting nested projects from the Recycle Bin will disrupt the original project hierarchy. - If you delete P3, P1, P2, P4, and P5 remain in the Recycle Bin, however P4 is no longer connected to P2. The original single project branch is now divided into two branches: P1-P2 and P4-P5. - With P3 deleted, if you then restore P1, the Restore action will also restore P2, but will leave P4 and P5 in the Recycle Bin. - With P3 deleted, if you restore P4, the Restore action will also restore P5, as P4 is now considered the root for P5. - You can restore any of the originally-nested projects individually. - You can’t remove a whole project hierarchy from the Recycle Bin. You must delete each project individually. ## Restore content from the Recycle Bin You can restore content from the Recycle Bin to a project within the storage time frame configured by the administrator. 1. From the Home page, expand the side pane, and then select Recycle Bin. 2. For Content Type, select Workbooks, Projects, Data Sources, or Flows. 3. Select the More actions menu for the content that you want to restore, and then select Restore. 4. Select a project as the restore location. 5. Select Restore. ## Delete content from the Recycle Bin You can permanently delete content from the Recycle Bin before the end of the storage time frame configured by the administrator. _This action can’t be undone._ 1. From the Home page, expand the side pane, and then select Recycle Bin. 2. For Content Type, select Workbooks, Projects, Data Sources, or Flows. 3. Select the More actions menu for the content that you want to permanently delete, and then select Delete. 4. Select Delete. ## Turn on the Recycle Bin Administrators can turn on the Recycle Bin for a Tableau site in the Tableau [site settings](https://help.tableau.com/current/online/en-us/sites_add.htm). 1. From the General tab, scroll to the Recycle Bin section. 2. Select the checkbox for Allow Recycle Bin for this site. 3. Select the number of days that the content is stored in the Recycle Bin. You can choose 1, 7, or 30 days. > [!IMPORTANT] > > Content is permanently deleted after the selected number of days. 4. Select Save. ## Turn off the Recycle Bin > [!WARNING] > > If an administrator turns off the Recycle Bin, any content stored in the Recycle Bin will be permanently deleted. Administrators can turn off the Recycle Bin for a Tableau site in the Tableau [site settings](https://help.tableau.com/current/online/en-us/sites_add.htm). 1. From the General tab, scroll to the Recycle Bin section. 2. Clear the checkbox for Allow Recycle Bin for this site. 3. Select Save. ## Contact your administrator The Recycle Bin can only be turned on and configured by a Tableau Site Administrator or Server Administrator. To see contact information for your administrator, from the Home page, select the Show help menu icon, and then select Contact Tableau Administrator. [Skip to main content](#main-content) # Refresh Data on Tableau Cloud The topics in this section describe how to manually refresh data, as well as schedule data refreshes. ## Other articles in this section [Skip to main content](#main-content) # Refresh Data Using Saved Credentials To keep data fresh for Salesforce, Google Analytics, Google BigQuery, OneDrive, Dropbox, Quickbooks Online, Anaplan, Oracle Eloqua, and ServiceNow ITSM, you must do the following: 1. Embed credentials into the data connection. The steps are described in this topic 2. If your data source or workbook contains an extract, you can add the extract to a refresh schedule. For the steps to schedule a refresh, see [Schedule Refreshes on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/schedule_add.htm). If your data source or workbook contains a direct (live) connection to the data, then the data is always fresh, and you don't need to create a scheduled task to refresh it. ## Embed credentials into the data connection You can embed credentials for your connection by following these steps. 1. Sign in to Tableau Cloud and navigate to Data Sources page. 2. Select the data source with the connection you want to refresh, and on the Actions menu, select Edit Connection. 3. The options in the Edit Connection dialog box will vary depending on the data source you selected. Review the options available to you and select the one that meets your needs. If you select Prompt user for credentials, you will need to refresh data manually. You can do this by asking users to republish the data source from Tableau Desktop or by initiating a refresh task on Tableau Cloud. ## Connector-specific credential information ### Use OAuth credentials Secure data connections are made using OAuth access tokens for data connections to Google Analytics, Google BigQuery, Google Sheets, OneDrive, Dropbox, Salesforce, and QuickBooks Online. You create access tokens by signing in to the data from Tableau Cloud and approving Tableau Cloud access to the data as long as the credentials exist (or you manually revoke access). When you add a new account, the sign-in page appears. When you sign in, you create a new access token for the credentials you submit. Note: Dropbox uses OAuth credentials, however Tableau doesn't currently support authenticating to Dropbox using a Google account. You can embed shared credentials, as you might do if you use a dedicated database account for a group of users. Or you can embed an individual user’s credentials. The account you use to create the access token must allow a level of access for running the refresh task. ### Use other credentials Anaplan, Oracle Eloqua, and ServiceNow ITSM each support using saved credentials (for example, user name and password) to connect to the data. ### Use Salesforce security tokens If you embed standard Salesforce credentials, Salesforce might require a security token for you to access a data. For example, if you want to access the Salesforce connection from an IP address that is not included in your organization's trusted IP list. This security token must be appended to the password used in the data connection. The security token can expire. When Tableau is unable to refresh a Salesforce connection because the security token has expired, Tableau displays an alert to the following users: - Authors of the relevant workbooks and data sources. - Authors of workbooks that connect to the relevant data sources. - Site administrators. You can renew an expired security token by editing the data connection on the server. For more information about Salesforce authentication and security tokens see [Security and the API](https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_concepts_security.htm) in the Salesforce.com _SOAP API Developer's Guide_. [Skip to main content](#main-content) # Refresh Parameters in a Tableau Data Story **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). If you’ve added a parameter to your dashboard and are using Data Stories, you’ll notice that clicking the parameter refreshes your visualization, but not the story. This happens because the parameter doesn’t refresh the underlying data like a filter does. To refresh your Tableau Data Story with the parameter data, add a "refresh" button to your dashboard that updates your story to align with your parameter. 1. Create a new sheet in your workbook. 2. Create a Calculated Field in the new sheet with the following info: > > Name: Refresh > > > > Contents: "refresh" ![A calculated field that is named "Refresh" and contains the word “refresh”](/tableau/next/en-us/online/en-us/Img/data_stories_parameter_calcfield.png) 1. Click OK, and then drag the new calculated field (Refresh) onto your new sheet. 2. Right-click the field and click Show Header to hide the header. ![The open menu for Refresh with “Show Header” selected.](/tableau/next/en-us/online/en-us/Img/data_stories_parameter_showheader.png) 1. Choose a shape for your button. ![The open menu for the Mark with Square selected.](/tableau/next/en-us/online/en-us/Img/data_stories_parameter_shape.png) 1. Return to your dashboard and drag the sheet containing the refresh button onto your dashboard next to the parameter. 2. Hover over the button, select More Options, and click Title to hide the title. 3. Hover over the button and click Use as Filter. ![The object is selected, the filter icon is clicked, and “Use as Filter” is selected.](/tableau/next/en-us/online/en-us/Img/data_stories_parameter_refreshfilter.png) 1. Adjust your parameter and then click on the new refresh button. The button updates your story to align with the parameter. [Skip to main content](#main-content) # Refresh Published Extracts from Tableau Desktop You can send updates to published extracts from Tableau Desktop. This option is best for refreshing extracts of data you maintain on your local network. 1. In Tableau Desktop, connect to the data source that is published to Tableau Cloud or open a workbook that connects to it. To connect to the server, use the address **https://online.tableau.com**. In the Data pane, a data source published to a Tableau server shows a Tableau icon next to its name. ![Sample Superstore data source on server.](/tableau/next/en-us/online/en-us/Img/DataSourceOnServer.png) 2. Select Data > Tableau Data Server, and then choose one of the following options: - Refresh from Source Refreshes the extract (full or incremental) using the data in the original data source. This command is available only for extracts that include a connection to the original data source. If you connected directly to a extract file and then published it, the connection to the original data source is not included. - Append Data from Data Source Updates the extract from another data source in the workbook. - Append Data from File Updates the extract from the contents of a file if the original data source type of the extract is the same file-based data source or extract file. **Note:** If you do not see the Tableau Data Server option, your data source may not be published to Tableau Cloud (in which case it will not show the icon above). If you see the Tableau Data Server option, but refresh commands are unavailable, the data source exists on the server, but it is not an extract. For example, it is a live connection to data hosted on the internet. ## See also Topics in the [Extracting Data](https://help.tableau.com/current/pro/desktop/en-us/help.htm#extracting_data.htm) section in the Tableau Help. [Skip to main content](#main-content) # Release Highlights **Note:** Innovations are delivered to Tableau Cloud across a worldwide infrastructure. Access to them might occur earlier or later than announced. In Tableau Cloud for November 2025: - **Comments on data model tables:** You can add rich text comments on tables in your data model. - **Tableau Agent permissions:** Customers can turn on AI in Tableau feature access for all users on your site, or only users that are members of a selected security group. - **User attributes in OIDC and SAML workflows:** You can now include user attributes passed through OIDC claims or SAML assertions during sign-in to customize and control what users can see. - **External key management for extract encryption keys**: Allows customers direct control over their AWS Key Management Service (KMS) encryption keys use to encrypt their extracts. - **Tableau trusted extensions:** A new subset of securely vetted extensions from Tableau Exchange that are Tableau-hosted, providing governed and seamless functionality are now available. - **Tableau Mobile changes:** The Tableau Mobile app security setting for malware detection was retired. [See full list](https://help.tableau.com/current/online/en-us/whatsnew_online.htm) ## Other articles in this section [Skip to main content](#main-content) # Requirements and Considerations for Using Explain Data Explain Data is always available to authors in Tableau Desktop. For Tableau Cloud and Tableau Server: When Explain Data is enabled for a site, Creators and Explorers with the appropriate permissions can run Explain Data when editing a workbook. All users with the appropriate permissions can run Explain Data in viewing mode in published workbooks. For more information, see [Control Access to Explain Data](https://help.tableau.com/v0.0/online/en-us/explain_data_control_access.htm). ## What makes a viz a good candidate for Explain Data Explain Data works best on visualizations that require deeper exploration and analysis, rather than infographic-style, descriptive vizzes that communicate summarized data. - Row-level data is necessary for Explain Data to create models of your data and generate explanations. Vizzes with underlying, row-level data, where relationships might exist in unvisualized fields are good candidates for running Explain Data. - Vizzes based on pre-aggregated data without access to row-level data are not ideal for the statistical analysis performed by Explain Data. ## What data works best for Explain Data When you are using Explain Data in a worksheet, remember that Explain Data works with: - **Single marks only**—Explain Data analyzes single marks. Multiple mark analysis is not supported. - **Aggregated data**—The view must contain one or more measures that are aggregated using SUM, AVG, COUNT, or COUNTD. At least one dimension must also be present in the view. - **Single data sources only**—The data must be drawn from a single, primary data source. Explain Data does not work with blended or cube data sources. When preparing a data source for a workbook, keep the following considerations in mind if you plan to use Explain Data during analysis. - Use a data source with underlying data that is sufficiently wide. An ideal data set has at least 10-20 columns in addition to one (or more) aggregated measures to be explained. - Give columns (fields) names that are easy to understand. - Eliminate redundant columns and data prep artifacts. For more information, see [Change fields used for statistical analysis](https://help.tableau.com/v0.0/online/en-us/explain_data_lm_status.htm#IncludeExcludeFields). - Don't discard unvisualized columns in the data source. Explain Data considers fields in the underlying data when is analyzes a mark. - Low cardinality dimensions work better. The explanation of a categorical dimension is easier to interpret if its cardinality is not too high (< 20 categories). Dimensions with more than 500 unique values will not be considered for analysis. - Don't pre-aggregate data as a general rule. But if the data source is massive, consider pre-aggregating the data to an appropriate level of detail. - Use extracts over live data sources. Extracts run faster than live data sources. With live data sources, the process of creating explanations can create many queries (roughly one query per each candidate explanation), which can result in explanations taking longer to be generated. ## Situations where Explain Data is not available Sometimes Explain Data will not be available for a selected mark, depending on the characteristics of the data source or the view. If Explain Data cannot analyze the selected mark, the Explain Data icon and context menu command will not be available.

Explain Data can't be run in views that use:	Map coordinate filters Blended data sources Data sources with parameters Data sources that don't support COUNTD or COUNT(DISTINCT ...) syntax, such as Access. Filters on aggregate measures Disaggregated measures
Explain Data can't be run if you select:	Multiple marks Axis Legend Grand total Trend line or reference line A mark in a view that contains a very low number of marks
Explain Data can't be run when the measure to be used for an explanation:	Isn't aggregated using SUM, AVG, COUNT, COUNTD Is a table calculation Is used in measure values
Explain Data can't offer explanations for a dimension when it is:	A calculated field A parameter Used in Measure Names and Measure Values A field with more than 500 unique values. Dimensions with more than 500 unique values will not be considered for analysis.

[Skip to main content](#main-content) # Resource Blocks Resource blocks are units of compute capacity in Tableau Cloud. Resource Blocks run Tableau Prep Conductor flows. Each Resource Block can run one flow at a time so the number of flows you can run concurrently is equal to the number of Resource Blocks that you have. By default, you get one Resource Block per site. One Resource Block is equivalent to one [concurrent flow job](https://help.tableau.com/v0.0/online/en-us/cloud_manager_capacity.htm#flows). You can purchase additional resource blocks for additional concurrent flow jobs capacity by contacting your Tableau account manager or learn more by visiting the Tableau [pricing](https://www.tableau.com/pricing/teams-orgs). [Skip to main content](#main-content) # Run Initial SQL **Note**: Tableau Prep Builder version 2019.2.2 and later supports using Initial SQL, but doesn't yet support all of the same options supported by Tableau Desktop For information about using Initial SQL with Tableau Prep Builder, see [Use Initial SQL to query your connections](https://help.tableau.com/current/prep/en-us/prep_connect.htm#initial_SQL) in the Tableau Prep Builder Salesforce Help. When connecting to some databases, you can specify an initial SQL command that will run or use a cached value when a connection is made to the database, for example, when you open the workbook, refresh an extract, sign in to Tableau Server, or publish to Tableau Server. **Note:** Initial SQL is different than a custom SQL connection. A custom SQL connection defines a relation (or table) to issue queries against. For more information, see [Connect to a Custom SQL Query](https://help.tableau.com/current/pro/desktop/en-us/customsql.htm). You can use this command to: - Set up temporary tables to use during the session. - Set up a custom data environment. You have the option to add an initial SQL command in the Server Connection dialog box or on the Data Source page. Note: If your data source supports running an initial SQL statement, an Initial SQL link appears in the lower-left corner of the Server Connection dialog box. For information about your data source, see [Supported Connectors](https://help.tableau.com/current/pro/desktop/en-us/exampleconnections_overview.htm). ## To use initial SQL 1. In the Server Connection dialog box, click Initial SQL. Or, on the Data Source page, select Data > Initial SQL or Data > Query Banding and Initial SQL depending on the database you connect to. 2. Enter the SQL command into the Initial SQL dialog box. You can use the Insert dropdown menu to pass parameters to your data source. ![Initial SQL setup with a text field for entering SQL statements.](/tableau/next/en-us/online/en-us/Img/connect_basic_initialsql.png) **Note:** Tableau doesn't examine the statement for errors. This SQL statement is sent to the database when you connect. Your software license may restrict you from using initial SQL with your connection. If you publish to Tableau Server, the server must be configured to allow Initial SQL statements. By default, the server software is configured to allow these statements to run when the workbook is loaded in a web browser. Administrators can configure the server to ignore initial SQL statements by using the `tsm configuration set` command: `tsm configuration set -k vizqlserver.initialsql.disabled -v true` If the server doesn't allow initial SQL statements, the workbook opens, but the initial SQL commands aren't sent. For more information about the `tsm configuration set` command, see the [Tableau Server Help](https://help.tableau.com/current/server/en-us/cli_configuration_tsm.htm#TSMSet). ## Parameters in an initial SQL statement You can pass parameters to your data source in an initial SQL statement. The following list has several benefits of using parameters in a initial SQL statement. - You can configure impersonation using the TableauServerUser or TableauServerUserFull parameters. - If your data source supports it, you can set up row-level security (for example, for Oracle VPD or SAP Sybase ASE) to make sure that users see only the data that they're authorized to see. - You can provide more details in logging, for example, the Tableau version or the workbook name. The following parameters are supported in an initial SQL statement:

Parameter	Description	Example of returned value
TableauServerUser	The username of the current server user. Use when setting up impersonation on the server. Returns an empty string if the user isn't signed in to Tableau Server.	jsmith
TableauServerUserFull	The username and domain of the current server user. Use when setting up impersonation on the server. Returns an empty string if the user isn't signed in to Tableau Server.	domain.lan\jsmith
TableauApp	The name of the Tableau application.	Tableau Desktop Professional Tableau Server
TableauVersion	The version of the Tableau application.	9.3
WorkbookName	The name of the Tableau workbook. Use only in workbooks with an embedded data source.	Financial-Analysis

> [!WARNING] > > **Warning:** Tableau Desktop doesn't include domain. You can include it if you aren't using delegation and you set tsm configuration set -k DelegationUseFullDomainName=-v true--force-keys The following examples show different ways you can use parameters in an initial SQL statement. - This example sets the security context on Microsoft SQL Server: `EXECUTE AS USER = [TableauServerUser] WITH NO REVERT;` - This example shows how, on a DataStax data source, you can use parameters to add detail to logging or to set up a session variable to track the data: `SET TABLEAUVERSION [TableauVersion];` - This example can be used to help set up row-level security for Oracle VPD: `begin` `DBMS_SESSION.SET_IDENTIFIER([TableauServerUser]);` `end;` Note:Oracle PL/SQL blocks require a trailing semicolon to terminate the block. Consult Oracle documentation for the proper syntax. ### Defer execution to the server You can defer an initial SQL statement so that it's executed only on the server. One reason to defer execution to the server is if you don't have permission to execute the commands that set up impersonation. Use tags to enclose the commands to be executed only on the server. Example: CREATE TEMP TABLE TempTable(x varchar(25)); INSERT INTO TempTable VALUES (1); INSERT INTO TempTable Values(2); ### Security and impersonation When you use the TableauServerUser or TableauServerUserFull parameter in an initial SQL statement, you'll create a dedicated connection that can't be shared with other users. This can also restrict cache sharing, which can enhance security, but may also slow performance. **Note:**Tableau Bridge does not support SQL impersonation using Initial SQL. ## Troubleshoot 'create table' for MySQL and Oracle connections #### For MySQL connections, tables aren't listed after using initial SQL to create a table After you connect to MySQL and run an initial SQL statement, the tables might not show because of the way Tableau constructs the query. CREATE TABLE TestV1.testtable77(testID int); To resolve this issue, add `IF NOT EXISTS` to the SQL statement: CREATE TABLE IF NOT EXISTS TestV1.TestTable(testID int); #### For Oracle connections, using initial SQL to create a table causes Tableau to stall After you connect to Oracle and run an initial SQL statement, Tableau is stalled with a spinning wheel because of the way Tableau constructs the query. CREATE TABLE TEST\_TABLE (TESTid int) To resolve this issue, use the following SQL statement: BEGIN EXECUTE IMMEDIATE 'create table test\_table(testID int)'; EXCEPTION WHEN OTHERS THEN NULL; END; [Skip to main content](#main-content) # Salesforce Authentication If your organization uses Salesforce, you can enable Tableau Cloud or Tableau Cloud Manager (TCM) to use Salesforce accounts for single sign-on (SSO) with multi-factor authentication (MFA) using OpenID Connect. As of spring 2021, Tableau supports Salesforce authentication as an authentication type. As of October 2024, TCM supports Salesforce authentication. When you enable Salesforce authentication, users are directed to the Salesforce sign-in page to enter their credentials, which are stored and managed by Salesforce. This scenario also supports scenarios where Salesforce federates authentication with another IdP. ## Username requirement The username that is used within your Salesforce Org must match the username field in Tableau Cloud or TCM. Both of these usernames are in email format, though they may not be used as email addresses. Verify that that these attributes match. If the do not, configure the Salesforce authentication type, and then see the section below, [Mismatched usernames](#mismatch). ## Change and configure authentication type If your organization already uses Salesforce, then setting the authentication type to Salesforce in Tableau Cloud or TCM is a three-step process. **For Tableau Cloud** 1. In Salesforce, install the [Tableau Cloud connected app package](https://appexchange.salesforce.com/appxListingDetail?listingId=a0N4V00000GlvlrUAB). To allow users to sign in to Tableau Cloud from your organization, manage access to your connected app by assigning the appropriate profiles or permission sets. Additionally, set the connected app to Admin pre-approved. For more information, see [Manage Other Access Settings for a Connected App](https://help.salesforce.com/articleView?id=connected_app_manage_additional_settings.htm&type=5&language=en_US). 2. In Tableau Cloud, change to Salesforce authentication by doing the following: 1. In Tableau Cloud, sign in as a site admin. 2. Select Settings > Authentication, click the New Configuration button, and select Salesforce from the Authentication drop-down menu. 3. Enter a name for the configuration. **Note:** Configurations created before January 2025 (Tableau 2024.3) can't be renamed. 4. (Optional) If you have configured your Salesforce organization to use a custom domain for user sign-in, then you will need to configure Tableau Cloud to redirect users to the sign-in page. Click Edit My Domain to enter your Salesforce My Domain. Tableau Cloud will verify the domain and then add it as a sign-in URL. ![](/tableau/next/en-us/online/en-us/Img/to_site_auth_salesforce.png) 3. Add new users (or update any previous users) to use Salesforce as their configured authentication type. - To add users, see [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm). - To update a user's authentication method, see [Set the User Authentication Type](https://help.tableau.com/v0.0/online/en-us/users_set_auth_type.htm). **For TCM** 1. In Salesforce, install the [Tableau Cloud connected app package](https://appexchange.salesforce.com/appxListingDetail?listingId=a0N4V00000GlvlrUAB) in Salesforce. To allow users to sign in to TCM from your organization, manage access to your connected app by assigning the appropriate profiles or permission sets. Additionally, set the connected app to Admin pre-approved. For more information, see [Manage Other Access Settings for a Connected App](https://help.salesforce.com/articleView?id=connected_app_manage_additional_settings.htm&type=5&language=en_US). 2. In TCM, change to Salesforce authentication by doing the following: 1. In TCM, sign in as a cloud admin. 2. Select Settings > Authentication and select the Enable an additional authentication method check box. 3. From the Authentication drop-down menu, select Salesforce. 4. (Optional) If you have configured your Salesforce organization to use a custom domain for user sign-in, then you will need to configure TCM to redirect users to the sign-in page. Click Edit My Domain to enter your Salesforce My Domain. TCM will verify the domain and then add it as a sign-in URL. 3. Add new users (or update any previous users) to use Salesforce as their configured authentication type. - To add users, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm). - To update a user's authentication method, see [Set the User Authentication Type](https://help.tableau.com/v0.0/online/en-us/users_set_auth_type.htm). ## Troubleshooting ### Mismatched usernames If existing users in Tableau Cloud are using usernames that do not match their corresponding usernames in Salesforce, follow this procedure: 1. Change the existing Tableau Cloud user to an Unlicensed site role to prevent license consumption. 2. Add the new Tableau Cloud user for Salesforce authentication, ensuring the username matches the username in your Salesforce organization. 3. If necessary, migrate previous content owned by the old username in Tableau Cloud to the new user. ### Unsuccessful login with OAUTH\_APP\_BLOCKED in return URL This issue is surfaced when a user who is configured with Salesforce authentication attempts to sign in and is not redirected. Tableau Cloud will display a message: The sign-in was unsuccessful. Try again. If you continue to get this message, capture the status information below, and send it to Customer Support. Additionally, return URL in the user's browser includes the following string: /public/oidc/login?error=OAUTH\_APP\_BLOCKED&error\_description=this+app+is+blocked+by+admin&state=... This indicates that the connected application within Salesforce is being blocked by your organization. Some security conscious Salesforce customers block all connected applications and implement API allowlist functionality that will prevent the connected application from working. To fix this, ensure that the [Tableau Cloud - Salesforce User Login via OIDC](https://appexchange.salesforce.com/appxListingDetail?listingId=a0N4V00000GlvlrUAB) connected application is installed and has the appropriate user profiles and permission sets applied. For more information, see: - [Manage Access to a Connected App](https://help.salesforce.com/articleView?id=sf.connected_app_manage.htm&type=5) - [Manage Other Access Settings for a Connected App](https://help.salesforce.com/articleView?id=sf.connected_app_manage_additional_settings.htm&type=5) ### Can't edit configuration name Configurations created before January 2025 (Tableau 2024.3) can't be renamed.. [Skip to main content](#main-content) # SAML SAML (Security Assertion Markup Language) is an XML standard that allows secure web domains to exchange user authentication and authorization data. You can configure Tableau Cloud or Tableau Cloud Manager (TCM) to use an external identity provider (IdP) to authenticate users over SAML 2.0. No user credentials are stored with Tableau, and using SAML enables you to add Tableau to your organization’s single sign-on environment. User authentication through SAML does not apply to permissions and authorization for Tableau Cloud content, such as data sources and workbooks. It also does not control access to underlying data that workbooks and data sources connect to. **Note:** Tableau Cloud supports both service provider initiated and IdP initiated SAML in browsers and in the Tableau Mobile app. SAML connections from Tableau Desktop must be service provider initiated. ## Authentication overview The following image shows the steps to authenticate a user with single sign-on in a typical service provider initiated flow: ![](/tableau/next/en-us/online/en-us/Img/saml_about_cloud.png) 1. User navigates to the Tableau Cloud or TCM sign-in page, or clicks a published workbook URL. 2. Tableau starts the authentication process by redirecting the client to the configured IdP. 3. The IdP requests the user’s username and password from the user. After the user submits valid credentials, the IdP authenticates the user. 4. The IdP returns the successful authentication in the form of a SAML Response to the client. The client passes the SAML Response to Tableau Cloud or TCM. 5. Tableau Cloud or TCM verifies that the username in the SAML Response matches a licensed user stored in the Tableau Cloud repository. If a match is verified, then Tableau Cloud or TCM responds to the client with the requested content or information. ## Other articles in this section [Skip to main content](#main-content) # SAML Requirements for Tableau Cloud Before you configure SAML for Tableau Cloud or Tableau Cloud Manager (TCM), obtain what you need to meet the requirements. - [Identity provider (IdP) requirements for Tableau configuration](#idp-reqs) - [SAML compatibility notes and requirements](#compatibility-notes) - [Using SAML SSO in Tableau client applications](#saml-sso-tableau-client) - [Effects of changing authentication type on Tableau Bridge](#bridge-consequences) - [XML data requirements](#xml-data-reqs) **Note:** Separate setup and app integration is required to enable SAML authentication for Tableau Cloud and TCM. ## Identity provider (IdP) requirements for Tableau configuration To configure Tableau Cloud or TCM for SAML, you need the following: - **SSO with MFA is enabled.** As of February 2022, multi-factor authentication (MFA) through your SAML SSO identity provider (IdP) is a Tableau requirement. > [!WARNING] > > **Important:** In addition to these requirements, we recommend that you dedicate a site administrator account that is always configured for [TableauID with MFA](https://help.tableau.com/current/online/en-us/to_security_mfa.htm). In the event of an issue with SAML or the IdP, a dedicated Tableau with MFA account ensures that you always have access to your site. - Administrator access to your Tableau Cloud site or tenant. You must have administrator access to the Tableau Cloud site or tenant on which you want to enable SAML. - List of users who will use SSO to access Tableau Cloud or TCM. You should gather the usernames (in email address format) for the users you want to allow single sign-on (SSO) access to Tableau. - IdP account that supports SAML 2.0. You need an account with an external identity provider. Some examples include PingFederate, SiteMinder, and Open AM. The IdP must support SAML 2.0. You must have administrator access to that account. - SHA256 is used as signing algorithm. As of May 2020, Tableau blocks IdP assertions and certificates that are signed with the SHA-1 algorithm. - IdP provider that supports import and export of XML metadata. Although a manually created metadata file might work, Tableau Technical Support cannot assist with generating the file or troubleshooting it. - IdP provider that enforces a maximum token age of 24 days or less (2073600 seconds). If the IdP allows a maximum age of tokens that is a greater length of time than the maximum age setting on Tableau (2073600 seconds), then Tableau will not recognize the token as valid. In this scenario, users will receive error messages (_The sign-in was unsuccessful. Try again._) when attempting to sign in to Tableau Cloud or TCM. ## SAML compatibility notes and requirements - SP or IdP initiated: Tableau supports SAML authentication that begins at the identity provider (IdP) or service provider (SP). - **Single Log Out (SLO):** Tableau supports both service provider (SP)-initiated SLO and identity provider (IdP)-initiated SLO. **Note:** To obtain the SLO URL for your site or tenant, download and refer to the metadata XML file your Tableau Cloud site or tenant generates. You can find this file by going to _one_ of the following places: - In Tableau Cloud, Settings > Authentication > New Configuration or Edit Configuration. - In TCM, Settings > Authentication. - tabcmd and REST API: To use [tabcmd](https://help.tableau.com/v0.0/online/en-us/tabcmd.htm) or the [Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/help.htm "Opens REST API help in a new tab"), users must sign in to Tableau Cloud using a personal access token (PAT). To use the [Tableau Cloud Manager REST API](https://help.tableau.com/current/api/cloud-manager/en-us/reference/index.html "Opens TCM REST API help in a new tab"), users must sign in to TCM using a personal access token (PAT). - Encrypted assertions: Tableau supports either cleartext or encrypted assertions. - **Tableau Bridge reconfiguration required:** Tableau Bridge supports SAML authentication, but an authentication change requires reconfiguring the Bridge client. For information, see [Effects of changing authentication type on Tableau Bridge](#bridge-consequences). - **Required signature algorithm:** For all new SAML certificates, Tableau Cloud or TCM requires the SHA256 (or greater) signature algorithm. - **RSA key and ECDSA curve sizes:** The IdP certificate must have either an RSA key strength of 2048 or ECDSA curve size of 256. - **NameID attribute:** Tableau requires the NameID attribute in the SAML response. - **Custom domains:** If you configure a [Use a Custom Domain with Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/custom_domain.htm) for your Tableau Cloud site, you must update both the Tableau Cloud Entity ID and ACS URL in your IDP's application settings to reflect the custom domain. For example, if your custom domain is `analytics.example.com`, update these URLs to use that domain instead of the default Tableau Cloud URLs. ## Using SAML SSO in Tableau client applications **Note:** Applies to Tableau Cloud only. Tableau Cloud users with SAML credentials can also sign in to their site from Tableau Desktop or the Tableau Mobile app. For best compatibility, we recommend that the Tableau client application version matches that of Tableau Cloud. Connecting to Tableau Cloud from Tableau Desktop or Tableau Mobile uses a service provider initiated connection. ### Redirecting authenticated users back to Tableau clients When a user signs in to Tableau Cloud (using a SP-initiated workflow), Tableau Cloud sends a SAML request (`AuthnRequest`) to the IdP, which includes the Tableau application’s **RelayState** value. If the user has signed in to Tableau Cloud from a Tableau client such as Tableau Desktop or Tableau Mobile, it’s important that the RelayState value is returned within the IdP’s SAML response back to Tableau to direct users to a specific Tableau resource. When the user initiates the sign in process to Tableau Cloud directly from the IdP (using an IdP-initiated workflow), the IdP can include a **RelayState** value in the SAML response to direct users to a specific Tableau resource. For example, the RelayState value could be set to `/#/site/[site-url]/views/[view-name]/[workbook-tab-name]`. When the RelayState value is not returned properly in these scenarios, the user is taken to their Tableau Cloud home page in the web browser, rather than being redirected back to the application they signed in from. Work with your identity provider and internal IT team to confirm that this value will be included as part of the IdP’s SAML response. ### Effects of changing authentication type on Tableau Bridge When you change the site’s authentication type or modify the IdP, publishers who use Tableau Bridge for scheduled extract refreshes will need to unlink and relink the client, and re-authenticate using the new method or IdP configuration. For legacy schedules, unlinking the Bridge client removes all data sources, therefore you must set up the refresh schedules again. For online schedules, after relinking the client you must reconfigure the Bridge client pool. The change in authentication type does not affect Bridge live queries or refreshes that run directly from the Tableau Cloud site (such as for underlying data in the cloud). We recommend that you alert Bridge users to changes in their site authentication before you make it. Otherwise, they will become aware through authentication errors they get from the Bridge client, or when the client opens with a blank data source area. ## XML data requirements You configure SAML using XML metadata documents that are generated by Tableau Cloud or TCM and by the IdP. During the authentication process, the IdP and Tableau exchange authentication information using these XML documents. If the XML does not meet the requirements, errors can occur when you configure SAML or when users try to sign in. ### HTTP POST and HTTP REDIRECT Tableau Cloud or TCM supports HTTP POST and REDIRECT requests for SAML communications. In the SAML metadata XML document that is exported by the IdP, the `Binding` attribute can be set to: - HTTP-POST - HTTP-REDIRECT - HTTP-POST-SimpleSign ### Dynamic group membership using SAML assertions **Note:** Applies to Tableau Cloud only. Beginning in June 2024 (Tableau 2024.2), if SAML is configured and the capability’s setting enabled, you can dynamically control group membership through custom claims included in the SAML XML response sent by the identity provider (IdP). When configured, during user authentication, the IdP sends the SAML assertion that contains two custom group membership claims: group (`https://tableau.com/groups`) and group names (for example, "Group1" and "Group2") to assert the user into. Tableau validates the assertion and then enables access to the groups and the content whose permissions are dependent on those groups. For more information, see [Dynamic group membership using assertions](https://help.tableau.com/v0.0/online/en-us/to_add_users_groups.htm#assertions). **Example SAML XML response** Group1 Group2 ### User attributes in SAML assertions **Note:** Applies to Tableau Cloud only. Beginning in October 2025 (Tableau 2025.3), when configured and the capability's setting is enabled, you can pass users attribute assertions from the SAML XML response sent by the identity provider (IdP) to Tableau Cloud during sign-in. These user attributes can be used with Tableau's user attribute functions (`USERATTRIBUTE()`, `USERATTRIBUTEINCLUDES()`) to dynamically control and customize content. Tableau validates the assertion and then enables access to the content. For more information, see [Customize and control data access using user attributes](https://help.tableau.com/v0.0/online/en-us/saml_config_site.htm#user_attributes). **Example SAML XML response** South South West [Skip to main content](#main-content) # Schedule Extract Refreshes for a Virtual Connection One of the benefits of virtual connections is that you can reuse the same extract multiple times, reducing data proliferation and removing redundant extract refresh jobs. To ensure that extract data is fresh for any content that uses a virtual connection, you can create an extract refresh schedule for the tables in your connection after you publish the connection. You can also schedule extract refreshes of data sources and workbooks that use virtual connections. See [Schedule Refreshes on Tableau Cloud](https://help.tableau.com/current/online/en-us/schedule_add.htm) and [Refresh Data on a Schedule](https://help.tableau.com/current/server/en-us/schedule_add.htm) (Tableau Server). ## Extract tables See [Extract table data](https://help.tableau.com/current/online/en-us/dm_vconn_create_conn.htm#vconn_extract_table_data). ## Schedule extract refreshes on Tableau Cloud 1. Navigate to the virtual connection page. (From the Home or Explore page, click Virtual Connections from the dropdown menu, then select your virtual connection.) 2. At the top of the page, a heading should say Data is Extract. If it says Data is Live, refresh your browser. 3. Select the Scheduled Tasks tab and click +New Task. 4. The Create Scheduled Task dialog box opens. The Create Scheduled Task dialog box looks different in Tableau Server and Tableau Cloud. If you are using Tableau Server, see [Schedule Extract Refreshes for a Virtual Connection](https://help.tableau.com/current/server/en-us/dm_vconn_extract.htm#schedule-extract-refreshes-on-tableau-server) in the Tableau Server Product Help. 5. Select the Refresh Frequency using the dropdowns for Repeats, Every, and At. Use the buttons under On to select the days of the week. 6. For cases when multiple tables use extracts, select Dependent or Independent. - Dependent means that none of the extracts will be updated if one or more tables' extract refresh jobs fails. - Independent means that the success or failure of a table's extract job doesn't affect whether or not other tables' extracts are updated. 7. Select Refresh Type. You can configure the type of extract in the virtual connection editor. For more information, see the Incremental Extracts section of the [Create a Virtual Connection page](https://help.tableau.com/v0.0/online/en-us/dm_vconn_create_conn.htm#incremental-extract). - Full means that full extract refresh jobs will be run on all extracts in the virtual connection, regardless of whether they are configured for full extract refresh or incremental extract refresh. - Incremental means that incremental extract refresh jobs will be run on all incremental extracts in the virtual connection. For all other extracts in the virtual connection, full extract refresh jobs will be run. 8. Select Add or Edit Tables and select the tables you want to refresh. 9. Select OK. 10. Select Apply. ![](/tableau/next/en-us/online/en-us/Img/dm_vconn_online_extract_sched.png) Virtual connections that connect to private network data use Tableau Bridge to keep data fresh. For more information, see [Configure and Manage the Bridge Client Pool](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm). ## Time limit for extract refreshes To ensure that long running refresh tasks don't take up all system resources and don't prevent refreshes of other extracts on your site, extract refreshes for a virtual connection are subject to a two-hour time limit. For more information about the timeout limit for refresh tasks and suggestions for resolving these errors, see [Time limit for extract refreshes](https://help.tableau.com/current/online/en-us/schedule_add.htm#timeout). Note: Starting with Tableau Cloud June 2024 and Tableau Server 2024.2, virtual connections support incremental refresh for table extracts. Prior to that release, virtual connections only supported full refreshes. ## Who can do this To publish a virtual connection or set permissions, you must - have credentials to the database that the virtual connection connects to, and - be a server or site administrator, or a Creator. ## Next step After you schedule extract refreshes for a virtual connection, you can [Use a Virtual Connection](https://help.tableau.com/v0.0/online/en-us/dm_vconn_use.htm) [Skip to main content](#main-content) # Schedule Flow Tasks **Note**:Flows can be scheduled to run on Tableau Cloud or Tableau Server using Tableau Prep Conductor. Prep Conductor is licensed through Data Management on a per deployment basis. After you purchase and license Data Management, you must enable Prep Conductor. Starting in version 2020.4.1, you no longer need the Data Management license to publish flows to the web. As a Creator, you can also create and edit flows directly on your server. For more information authoring flows on the web, see [Tableau Prep on the Web](https://help.tableau.com/v0.0/online/en-us/prep_web_auth.htm). > [!IMPORTANT] > > **Note**: With the 2024.1 release, changes were introduced for flow schedules on Tableau Cloud. The Schedules tab on the left navigation pane has been removed and users with permissions to schedule flow tasks can now create custom schedules directly from the flows Scheduled Tasks tab. Starting in version 2021.3, you can link flow runs together when scheduling tasks to run flows one after the other. For more information, see [Schedule linked tasks](#linked_tasks) in this topic. Starting in version 2022.1, you can also run linked tasks via the REST API using the new flow methods Query Linked Tasks, Query Single Linked Tasks, and Run Linked Task Now. For more information, see [Flow Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_flow.htm) in the Tableau REST API help. **Running flows that include parameters** Starting in version 2021.4, you can include user parameters in your flows to make flows more dynamic. When the flow runs, you are prompted to enter your parameter values. When setting up flows on a schedule, you specify parameter values at that time. You must specify the parameter values for any required parameters. For optional parameters, you can enter those values as well, or accept the current (default) value for the parameter. For more information about running flows with parameters, see [Run flows on a schedule](https://help.tableau.com/current/prep/en-us/prep_parameters.htm#run-flow-schedule) in the Tableau Prep help. Starting in Tableau Prep Builder and Tableau Cloud version 2023.2, you can apply date or time system parameters to flow output names for file and published data source output types. The start time is automatically added to the flow output name. **Note**: Your administrator must enable the Flow Parameter server and site settings on your server before you can run flows that include parameters in Tableau Server or Tableau Cloud. For more information, see **Create and Interact with Flows on the Web** in the [Tableau Server](https://help.tableau.com/current/server/en-us/web_author_flows.htm#flow-parameters) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/web_author_flows.htm#flow-parameters) help. ## Schedule a flow task 1. To create a schedule for a single task, do one of the following: - From the Overview page for the flow, click the Scheduled Tasks tab, click New Task or click the drop-down and select Single Task. ![](/tableau/next/en-us/online/en-us/Img/prep_conductor_schedule_single.png) - From the Explore page, in List view, in the Actions menu, select Schedule Flow > Single Task. If you select a flow in the list, you can also use the top Actions menu. ![](/tableau/next/en-us/online/en-us/Img/prep_schedule_tasks_explore.jpg) 2. On the Single Task tab of the New Task dialog, click Define a schedule. 3. Click Time zone. You are directed to the settings page. Scroll to Time Zone for Scheduled Tasks, select a time zone, then click Save Changes. 4. Enter the frequency of the task, then click Save. ![](/tableau/next/en-us/online/en-us/Img/prep_conductor_schedule_frequency.png) You can set the frequency to run hourly, daily, weekly or monthly. The time and day intervals depend on the repeat frequency that you select as described below: - **Hourly**: The available frequency is every hour from a specific time to a specific time. This means that the task will run every hour during the specified time. - **Daily**: The available frequencies are every two, four, six, eight, or twelve hours, or just once a day. You can also choose one or more days of the week, in addition to start and end times. This means you can run a task on all or certain days of the week at specific hourly intervals or once a day. - **Weekly**: The available frequency is one or more days of the week at a specific time. This means you can run the task on certain days of the week, once a week at a certain time. - **Monthly**: You can set this up in two different ways: - You can select Day as the frequency interval which then allows you to select specific dates of the month. For example you can select the task to run on the 2nd, 15th and 28th of every month at 2:45 pm. - You can also choose the first, second, third, fourth, fifth, and the last day of the week at a specific time. For example you can choose to run the task every second Wednesday of the month at 2:45 pm. 7. Select one of the following options: - Automatically include all output steps for this flow:(default) Select this option to include all current and future output steps for this flow in the scheduled task. As new output steps are added to the flow over time, they’re automatically included in the schedule when it runs. - Select the output steps to include in this task: Select this option and manually select the output steps to include in this scheduled task. To include all output steps in the flow task, select the check box next to Output Steps. This area can't be edited if the Automatically include all output steps for this flow radio button is selected. Select the other radio button to enable this section. 8. Select a Refresh Type. For more information about these settings, see [Refresh Flow Data Using Incremental Refresh](https://help.tableau.com/current/prep/en-us/prep_incremental_refresh.htm). **Note**: If one input is configured to use incremental refresh and it’s associated with multiple outputs, those outputs must be run together and must use the same refresh type. Otherwise the flow fails. - Full refresh (default): Refresh all data and create or append data to your table based on the flow output setting. - Incremental refresh: Refresh only the new rows and create or append data to your table based on the flow output setting. The incremental refresh option is only available when the flow is configured to use this refresh type. **Note**: Tableau Prep Conductor runs a full refresh for all outputs regardless of the run option you select if no existing output is found. Subsequent flow runs will use the incremental refresh process and retrieve and process only your new rows unless incremental refresh configuration data is missing or the existing output is removed. ![](/tableau/next/en-us/online/en-us/Img/prep_conductor_schedule_refresh.png) 9. (optional) If you’re the flow owner, select Send email when done to notify users when the flow is successful. For more information about how to send email notifications on flow runs, see [Notify Users of Successful Flow Runs](https://help.tableau.com/v0.0/online/en-us/prep_conductor_subscribe_to_flow.htm). 10. If your flows include parameters, enter any required or optional parameter values. You must enter required values for the flow to run. ![](/tableau/next/en-us/online/en-us/Img/prep_conductor_schedule_param_single.png) 11. Click **Create Task** to create the scheduled task. ## Schedule linked tasks _Supported in Tableau Server and Tableau Cloud version 2021.3.0 and later._ **Note**: Starting in version 2022.1, Linked tasks functionality is enabled by default. Server and Site Administrators can turn off this functionality on the Settings page and on flow schedules in the Schedules dialog. In previous versions, Server Administrators must first enable this functionality to use and manage it. Use the Linked Tasks option to schedule up to 20 flows to run sequentially, one after the other. Easily set up your flow list by selecting your schedule, then select downstream flows to run in the order you choose. Flows run in the order specified in the list. Use the menu to move flows around in your list or add new upstream or downstream flows to the list at any time. The duration of each individual linked task is counted towards the total flow runtime limit. If the runtime limit is reached when a flow task is run, the flow task will timeout, the linked task fails, and any downstream flows won't run. For more information, see [Job Runtime capacity](https://help.tableau.com/current/online/en-us/to_site_capacity.htm#jobruntimecapacity). Select the outputs that you want to include in the flow run and configure the settings to tell Tableau what to do with remaining flows in the schedule when the previous flow run fails. 1. To create a schedule for a linked task, do one of the following: - From the Overview page for the flow, **Scheduled Tasks** tab, click **New Task** and select the Linked Task tab, or click the drop-down and select Linked Task. ![](/tableau/next/en-us/online/en-us/Img/prep_conductor_schedule_linked.png) - From the Explore page, in List view, in the Actions menu, select Schedule Flow > Linked Task. If you select multiple flows in the list, you can also use the top Actions menu. ![](/tableau/next/en-us/online/en-us/Img/prep_schedule_tasks_explore.jpg) If the output step isn't assigned to a task, you can also create a new task from the Overview page. On that page, in the Schedules field, click Create new task. 2. On the Linked Task tab of the New Task dialog, click Define a schedule. 3. Enter the frequency of the task, then click Save. 4. Click the Select output steps drop-down to select the flow outputs to run. By default, all flow outputs are included. To select specific outputs, clear the Include all current and future output steps for this flow check box. The flow where the task is initiated is automatically set as the first flow to run, but you can use the menu to change the run order after you add other flows to your list. ![](/tableau/next/en-us/online/en-us/Img/prep_conductor_schedule_linked_refresh.png) 5. Select your refresh type from the following options: **Note**: If one input is configured to use incremental refresh and it’s associated with multiple outputs, those outputs must be run together and must use the same refresh type. Otherwise the flow fails. - Full refresh (default): Refresh all data and create or append data to your table based on the flow output setting. - Incremental refresh: Refresh only the new rows and create or append data to your table based on the flow output setting. The incremental refresh option is only available when the flow is configured to use this refresh type. For more information, see [Refresh Flow Data Using Incremental Refresh](https://help.tableau.com/current/prep/en-us/prep_incremental_refresh.htm). **Note**: If no existing output is found, Tableau Prep Conductor runs a full refresh for all outputs regardless of the run option you select. Subsequent flow runs use the incremental refresh process and retrieve and process only your new rows unless incremental refresh configuration data is missing or the existing output is removed. 6. (optional) If you’re the flow owner, select Send email when done to notify users when the flow is successful. For more information about how to send email notifications on flow runs, see [Notify Users of Successful Flow Runs](https://help.tableau.com/v0.0/online/en-us/prep_conductor_subscribe_to_flow.htm). 7. Set your flow failure options: - Add data quality warning: Select the check box to set a warning message on the flow so that users of the data are aware of issues. The message remains until the flow runs successfully. If the flow already has a data quality warning, this option shows selected and can't be turned off. ![](/tableau/next/en-us/online/en-us/Img/prep_conductor_schedule_error.png) - Stop remaining tasks: Select this option to prevent the downstream tasks in the list from being queued to run. - Email me: Email notifications are automatically sent to the flow owner and the linked task creator when the flow fails, is suspended, or is canceled. 8. If your flows include parameters, enter any required or optional parameter values. You must enter required values for the flow to run. ![](/tableau/next/en-us/online/en-us/Img/prep_conductor_schedule_link_param.png) 9. Click the drop-down for the second task to add your next flow. Flows that use the previous flow's outputs are shown automatically or click View all flows to see all available flows 10. Select one or more flows and click Add or click Add Next Task to add more flow run tasks to your list. If you don't have permission to run the flow, you must contact the flow owner to grant permissions before adding the flow to your list. 11. Repeat steps 4–6 to configure your flow run options. 12. (Optional) Click the drop-down next to any numbered task to open the menu to change the order of your flow tasks or insert new tasks between existing tasks. ![](/tableau/next/en-us/online/en-us/Img/prep_conductor_schedule_move.png) 13. Click **Create Tasks** to create the scheduled linked tasks. ### Who can do this - The Server administrator can do this on all sites on the server. The Site administrator can do this on sites they have access to if the site settings to allow users to publish and schedule tasks is enabled. - For linked tasks, the Server administrator can do this on all sites where the server settings to allow users to schedule linked tasks is enabled. The Site administrator can do this on sites they have access to if the site settings to allow users to schedule linked tasks is enabled. - Flow owners and project leaders with the Creator site role can create flow tasks for flows or projects that they own respectively. Site administrators, flow owners, and project leaders can create flow tasks for the flows and projects that they own respectively. Only the Creator site role and above can create or edit a flow task. For more information, see [Set Users' Site Roles](https://help.tableau.com/current/online/en-us/users_site_roles.htm) and [Content Ownership and Permissions](https://help.tableau.com/current/online/en-us/permissions.htm) [Skip to main content](#main-content) # Schedule Refreshes on Tableau Cloud You can schedule refresh tasks directly on Tableau Cloud for extracts of cloud-hosted data. This can include extracts of the following types of data: - Salesforce.com or Google Analytics. - Google BigQuery or Amazon Redshift, if you do not want to use a live connection. For on-premises Redshift, you must use Tableau Bridge. - SQL-based or other data hosted on cloud platforms, such as Amazon RDS, Microsoft Azure, or Google Cloud Platform, if you do not want to use a live connection, or if live connection isn’t supported for that data source. For a list of supported data sources, see [Allow Live Connections to Data Hosted on a Cloud Platform](https://help.tableau.com/v0.0/online/en-us/to_connect_live_sql.htm). Schedules are also available when creating extract refresh with Tableau Bridge. For more information see, [Set Up a Private Network Refresh Schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm). **Notes:** - For information about refreshing extracts of Microsoft Excel, SQL Server or other data Tableau Cloud cannot reach directly, see [Connectivity with Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm). - Your Tableau Cloud site comes with capacity to support all your users’ analytic needs. A site’s capacity includes capacity for storage and tasks that need to be performed on the site includes extracts. For more information, see [Tableau Cloud Capacity](https://help.tableau.com/v0.0/online/en-us/to_site_capacity.htm). ## Create a refresh schedule Important! - The **Run Now** option is no longer available in **Create an Extract Refresh** dialog box. **Run Now** option is now listed in the **Actions** drop down menu. - You cannot configure tasks to run sequentially (serially). Instead, you might want to stagger your start time for the extract refreshes, so the tasks run one after the other. - If you migrate your existing tasks to custom schedules, please note that unless you change your start times for these tasks, they will run in parallel, which may not be desired. - If you schedule more than one extract refresh for the same workbook or published data source, the jobs are run serially, with one waiting for the previous one to finish. 1. When you’re signed in to Tableau Cloud, select Explore from the left navigation pane, and then, depending on the type of content you want to refresh, select All Workbooks or All Data Sources from the drop-down menu. 2. Select the check box for the workbook or data source you want to refresh, and then select **Actions > Refresh Extracts**. 3. In the Refresh Extracts dialog, select Schedule a Refresh, and complete the following steps: ![A form to set up a data refresh, with options to configure frequency, time, and day.](/tableau/next/en-us/online/en-us/Img/online-custom-extract-refresh-dialog.png) - **Refresh Type:** Select the type of refresh you want. A full refresh is performed by default. Incremental refresh is available only if you configured for it in Tableau Desktop or web authoring in Tableau Cloud before publishing the extract. If you select one of more workbook or data source that has been set to do full refreshes, then the option to select incremental refresh is disabled. For more information, see [Refreshing Extracts in the Tableau Help](https://help.tableau.com/current/pro/desktop/en-us/extracting_refresh.htm). - **Refresh Frequency:** Setup the frequency for the extract refreshes to run. You can set the frequency to run hourly, daily, weekly or monthly. The time and day intervals depend on the repeat frequency that you select as described below: - **Hourly:** The available frequency is every hour from a specific time to a specific time. This means that the task will run every hour during the specified time. - **Daily:** The available frequencies are every two, four, six, eight, or twelve hours, or just once a day. You can also choose one or more days of the week, in addition to start and end times. This means you can run a task on all or certain days of the week at specific hourly intervals or once a day. - **Weekly:** The available frequency is one day of the week at a specific time. This means you can run the task on a certain day of the week, once a week at a certain time. - **Monthly:** You can set this up in two different ways: 1. You can select **Day** as the frequency interval which then allows you to select specific dates of the month. For example you can select the task to run on the 2nd, 15th and 28th of every month at 2:45 pm. 2. You can also choose the first, second, third, fourth, fifth, and the last day of the week at a specific time. For example you can choose to run the task every second Wednesday of the month at 2:45 pm. ## Update an Existing Schedule When making changes to an existing schedule, you will no longer choose from a list of existing schedules, but directly change the recurrence in the schedule. ## Time limit for extract refreshes To ensure that long running refresh tasks don't take up all system resources and don't prevent refreshes of other extracts on your site, Tableau Cloud enforces a time limit, also known as a timeout limit, of 7200 seconds (120 minutes or two hours) for refresh tasks. The timeout limit is the longest allowable time for a single extract to complete a refresh before it's canceled. The timeout limit is not configurable. ### Staying within the timeout limit Although reaching the timeout limit is not common, if you're working in an extract-heavy environment, there are few modifications you can make to your extracts to help avoid reaching the timeout limit. - [Schedule Refreshes on Tableau Cloud](#hyper) - [Set up incremental refreshes](#incremental) - [Decrease the size of extracts](#size) - [Use an alternative method for refreshing extracts](#altmethod) - [Schedule refreshes at a different time](#difftime) #### Set up incremental refreshes Consider configuring your extracts to be incrementally refreshed instead of fully refreshed each time a refresh task is performed. By default, extracts are set up to fully refresh. Although a full refresh gives you an exact copy of the data, a full refresh can take a long time to complete. To reduce the time it takes to refresh an extract, consider setting up incremental refreshes of your extracts instead. For more information, see [Configure an incremental extract refresh](https://help.tableau.com/current/pro/desktop/en-us/extracting_refresh.htm#incremental) in the Tableau Help. **Note:** You must set up the incremental refresh before publishing the extract to Tableau Cloud. After publishing, you will then be able to select Incremental Refresh option in the Create Extract Refresh dialog. #### Decrease the size of extracts You can help refresh tasks complete faster by decreasing the size of your extracts. There are two common methods for decreasing the size of extracts: hide all unused fields and use data source filters. - **Hide all unused fields:** Fields that you hide in your data source are excluded when the extract is created. To hide fields while creating the extract, see [Create an extract](https://help.tableau.com/current/pro/desktop/en-us/extracting_data.htm#extract) in the Tableau Help. - **Add data source filters:** You can reduce the number of rows in your extract by adding a data source filter. For more information, see [Filter Data from Data Sources](https://help.tableau.com/current/pro/desktop/en-us/filtering_datasource.htm) in the Tableau Help. **Note:** You must hide all unused fields or add data source filters before publishing the extract to Tableau Cloud. #### Use an alternative method for refreshing extracts If possible, consider refreshing your extracts outside of Tableau Cloud. - **Tableau Desktop:** You can manually refresh published extracts from Tableau Desktop. For more information, see [Refresh Published Extracts from Tableau Desktop](https://help.tableau.com/v0.0/online/en-us/to_refresh_desktop.htm). - **Tableau Bridge:** Depending on the data source, you can use Tableau Bridge to set up and refresh published extracts on a schedule. For more information, see [Use Bridge to Keep Data Fresh](https://help.tableau.com/v0.0/online/en-us/qs_refresh_local_data.htm). - **Tableau Data Extract Command-Line utility (Deprecated):** Depending on the data source, you can use the command-line utility that comes with Tableau Desktop to programmatically refresh published extracts. For more information, see [Automate Extract Refresh Tasks from the Command Line](https://help.tableau.com/v0.0/online/en-us/to_refresh_extract_commandline.htm). **Deprecated October 2022:** This utility is not available in later releases. To refresh data sources or virtual connections data that Tableau Cloud can't reach directly, use [Tableau Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm) instead. To initiate refresh jobs using a script, use tabcmd [refreshextracts](https://help.tableau.com/current/server/en-us/tabcmd_cmd.htm#refreshextracts-workbookname-or-datasourcename) or REST API [Run Extract Refresh Task](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref.htm#run_extract_refresh_task). #### Schedule refreshes at a different time Consider changing when the refresh tasks occur. For more information, see [Manage Tasks](https://help.tableau.com/v0.0/online/en-us/task.htm). ### Errors when refresh tasks reach timeout limit If a refresh task reaches the timeout limit, you or others might see one of the errors listed below. If you published the extract or are the extract owner, you might see one of these errors in an email notification. If you're a site administrator, you might see one of these errors in the administrative view about [Background Tasks for Extracts](https://help.tableau.com/v0.0/online/en-us/adminview_backgrnd.htm). - _The query time resource limit (7200 seconds) was exceeded._ - _com.tableau.nativeapi.dll.TableauCancelException: Operation cancelled._ - _The query time resource limit (8100 seconds) was exceeded._ To help resolve and avoid these errors in the future, see the section above, [Staying within the timeout limit](#timeout_avoid). [Skip to main content](#main-content) # SCIM System for Cross-domain Identity Management (SCIM) is a protocol that standardizes the automation of users and groups provisioning for cloud-based applications like Tableau Cloud. Tableau Cloud supports SCIM, enabling identity providers (IdPs) to centrally manage user identities while streamlining the process of managing users and group membership in Tableau Cloud. The IdP uses SCIM to ensure that access is granted and revoked in a timely way and Tableau Cloud is kept in sync with the provisioning assignments in the IdP. This type of integration improves security and reduces the manual work for site administrators in Tableau Cloud. ![A straightforward illustration of the identity provider linking to SCIM and Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/scim_provisioning.jpg) In the diagram above, the IdP _pushes_ updates to Tableau Cloud and controls how often Tableau Cloud’s SCIM endpoints are called to ensure users and groups are appropriately mirrored. ## IdP-specific configuration The steps later in this topic provide general information that you can use with your IdP’s documentation to configure SCIM for your Tableau Cloud site. You can get IdP-specific configuration steps for the following IdPs we support: - [Configure SCIM with Microsoft Entra ID](https://help.tableau.com/v0.0/online/en-us/scim_config_azure_ad.htm) - [Configure SCIM with Okta](https://help.tableau.com/v0.0/online/en-us/scim_config_okta.htm) - [Configure SCIM with OneLogin](https://help.tableau.com/v0.0/online/en-us/scim_config_onelogin.htm) - [Configure SCIM with PingFederate](https://help.tableau.com/v0.0/online/en-us/scim_config_pingfederate.htm) ## Overview of enabling SCIM support Review the following steps to enable SCIM integration in Tableau Cloud and your IdP. To complete this process, you’ll also need the documentation your IdP provides. Look for topics that refer to configuring or enabling a service provider for SCIM provisioning. **Notes:** - After enabling SCIM, users and their attributes should be managed through the IdP. Changes made within Tableau Cloud directly may result in unexpected behavior and overwritten values. - Beginning in January 2025 (Tableau 2024.3): - You can choose the SAML authentication configuration to associate with SCIM. However, only one SAML authentication configuration can support SCIM on a site. - The SCIM capability is no longer site admin-scoped. In other words, all site administrators have the ability to configure and edit SCIM. - Beginning in June 2025 (Tableau 2025.2): - You can configure one or more SCIM configurations on a site. - You can bypass the SCIM token that Tableau generates and instead use an externally generated JWT (using a Tableau connected app) to support SCIM requests in Tableau Cloud. - Beginning in December 2025, you can automate users and groups provisioning by using the [Tableau SCIM API](https://help.tableau.com/current/api/scim-api/en-us/index.html). - Beginning in February 2026 (Tableau 2026.1), you can choose OIDC and Google authentication to associate with SCIM. - Beginning in June 2026 (Tableau 2026.2), [custom domains](https://help.tableau.com/current/online/en-us/custom_domain.htm) are supported with SCIM integration. ### Step 1: Perform prerequisites Before enabling SCIM integration with your Tableau Cloud site, you’ll need to meet the following requirements: - Have site administrator access to the Tableau Cloud site. - Able to modify your IdP's settings for Tableau Cloud. - Your site is already configured to support SAML or OIDC (or Google) single sign-on (SSO). If you haven’t done this, see [Enable SAML Authentication on a Site or TCM](https://help.tableau.com/v0.0/online/en-us/saml_config_site.htm) or [Configure Tableau Cloud or TCM for OpenID Connect](https://help.tableau.com/v0.0/online/en-us/openid_auth_server_config.htm), and then follow your IdP’s documentation to add Tableau Cloud as an application. - Optionally, if using external token generation and management, you have the following: 1. Created and enabled a Tableau connected app. If you haven't done this, see [Use Tableau Connected Apps for Application Integration](https://help.tableau.com/v0.0/online/en-us/connected_apps.htm). 2. A valid JWT that contains the following scopes: `tableau:users:*` and `tableau:groups:*` ### Step 2: Enable SCIM support #### In Tableau Cloud - using a Tableau-generated token 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. Do the following: 1. On the Authentication page, under System for Cross-domain Identity Management (SCIM), click the **New Configuration** button. 2. In the New SCIM Configuration dialog box, do the following: 1. Enter a name for the SCIM configuration. 2. Copy the Base URL to use in your IdP's SCIM settings. 3. From the Authentication drop-down, select the authentication configuration to associate with SCIM. 4. Click **Save**. **Note:** This populates the SCIM token section. ![A new SCIM configuration](/tableau/next/en-us/online/en-us/Img/scim_config_new.png) 3. Under SCIM token, do the following: 1. Click the New Secret button. 2. In the New Secret dialog box, click the New Secret button again. A newly generated secret will display. ![](/tableau/next/en-us/online/en-us/Img/scim_config_newsecret_newsecret.png) 3. Copy the secret and store it in a safe location. **Important:** - If you close the SCIM configuration before you can add the secret to your IdP's SCIM settings, you can edit SCIM configuration but will be required to click New Secret again to generate a new secret. - The secret is tied to the Tableau site administrator user who created the SCIM configuration. If that user’s site role changes or the user is no longer a member of the site, the secret becomes invalid. In this case, another site administrator can generate a new secret for the existing SCIM configuration and add it to the IdP's SCIM settings or create a new SCIM configuration ensuring the base URL and secret is added to the IdP's SCIM settings. ![](/tableau/next/en-us/online/en-us/Img/scim_config_secret.png) 4. Click **Close**. 3. Navigate to your IdP's SCIM settings and paste the Tableau Cloud base URL and SCIM token in the appropriate fields. #### In Tableau Cloud, using an external token 1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication. 2. Do the following: 1. Under System for Cross-domain Identity Management (SCIM), click the New Configuration button. 2. In the New SCIM Configuration dialog box, do the following: 1. Enter a name for the SCIM configuration. 2. Copy the Base URL to use in your IdP's SCIM settings. 3. From the Authentication drop-down, select the authentication configuration to associate with SCIM. 4. Click Save. **Note:** This populates the SCIM token section, which you can safely ignore. 5. When finished, click Close. 3. Navigate to your IdP's SCIM settings and paste the Tableau Cloud base URL in the appropriate field. #### In the IdP After meeting the prerequisites and enabling SCIM in Tableau Cloud, use the steps in your IdP's documentation to enable SCIM support with your identity provider (IdP). For some general guidance for specific IdPs, see [IdP-specific configuration](#idp_specific). ### Step 3: Provision users and groups Follow your IdP’s documentation to provision users and groups after enabling SCIM support. For some general guidance for specific IdPs, see [IdP-specific configuration](#idp_specific). You can also automate users and groups provisioning by using the [Tableau SCIM API](https://help.tableau.com/current/api/scim-api/en-us/index.html). #### Supported user attributes When you provision users and groups through SCIM, Tableau Cloud honors a set of attributes sent by the IdP. Other attributes sent by the IdP are ignored and not stored or updated in Tableau. | SCIM action | Attributes honored by Tableau | | --- | --- | | Create user | `userName`, `siteRoles` | | Update user | `siteRoles`, `active` (true or false) | | Create group | `displayName` | | Update Group | `displayName`, `members`, `minimumSiteRole` | **Notes:** - On Tableau Cloud, `userName` attribute is the email address. However, the `emails` attribute is not supported and therefore ignored. - If `siteRoles` is not included, the user will be created with the _Viewer_ site role in Tableau. ## Replace a Tableau-generated SCIM token When you need to replace your Tableau-generated SCIM token, follow the steps below to generate a new secret for the existing SCIM configuration. **Note:** To generate a new token for an existing SCIM configuration, you must be the site administrator who created the SCIM configuration. 1. In Tableau Cloud, navigate to Settings > Authentication. 2. Under System for Cross-domain Identity Management (SCIM), next to the SCIM configuration, select **Actions** > **Edit Configuration**. 3. Under SCIM token, do the following: 1. Click the New Secret button. 2. In the New Secret dialog box, click the New Secret button again. A newly generated secret will display. 3. Copy the secret and store it in a safe location. **Important:** - If you close the SCIM configuration before you can add the secret to your IdP's SCIM settings, you can edit SCIM configuration but will be required to click New Secret again to generate a new secret. - The secret is tied to the Tableau site administrator user who created the SCIM configuration. If that user’s site role changes or the user is no longer a member of the site, the secret becomes invalid. In this case, another site administrator can generate a new secret for the existing SCIM configuration and add it to the IdP's SCIM settings or create a new SCIM configuration ensuring the base URL and secret is added to the IdP's SCIM settings. ## Other articles in this section [Skip to main content](#main-content) # Security in the Cloud Tableau understands that data is among the most strategic and important assets an organization has. We put the highest priority on maintaining the security and privacy of our customers’ data. Tableau enterprise-level security features manage operational security, user security, application security, network security, and data security. To learn more, see the following resources on Tableau's website ([https://www.tableau.com](https://www.tableau.com)): - [Tableau Cloud Security in the Cloud](http://www.tableau.com/learn/whitepapers/tableau-online-security-cloud) white paper. - [Tableau Cloud tips: A security checklist for publishing data to the cloud](https://www.tableau.com/about/blog/2016/3/tableau-online-tips-4-things-consider-when-publishing-data-cloud-51950) If you sign in to Tableau Cloud using TableauID credentials, you can use them also to sign in to the Tableau website. ## Operational Security The Tableau Cloud infrastructure is hosted in a SAS-70 compliant data center that provides numerous controls and safeguards over customer data. Your data is your own, even when stored in Tableau Cloud. Only your authorized users have access to data or workbooks stored in Tableau Cloud—Tableau employees and other Tableau customers do not. Tableau does have access to and may monitor metrics that have to do with system utilization, account status, and performance. ## User Security The only people who have access to your site and content are the users that site administrators or cloud administrators explicitly add. If a user is no longer authorized in your system, simply remove that person’s user account to revoke access to Tableau Cloud and your content stored there. Tableau Cloud enforces an idle user session timeout of 2 hours. This means that users must re-authenticate after not using Tableau Cloud for a period of 2 hours. The idle session timeout value is a system setting that can't be modified. ### Tableau Account Your Tableau Account provides secure, unified authentication to Tableau’s website and services. Some of the security features of Tableau Accounts are: - User sign-in is secured by HTTPS. - Accounts are locked for a period of time after repeated unsuccessful sign-in attempts. - Accounts are validated by user email to prove identity. - Passwords are stored using cryptographic protection. Tableau employees and contractor do not have access to plain-text passwords. - Multi-factor authentication (MFA) can be enabled for accounts that use Tableau authentication. Tableau Cloud site administrators and cloud administrators have the option of using your organization’s identity provider for added control and convenience of users. For more information, see [Authentication](https://help.tableau.com/v0.0/online/en-us/security_auth.htm) and [Tableau Cloud Manager Authentication](https://help.tableau.com/v0.0/online/en-us/cloud_manager_auth.htm). ### Roles and Permissions A role is a set of permissions that is applied to a project, workbook, view, or data source to manage user interaction. A wide range of specific permissions is available for each asset: view, create, edit, modify, delete, and more. ## Network Security **Important:** Beginning with version 2025.2 (Tableau Desktop), 2025.3 (Tableau Server), and June 2025 (Tableau Cloud), Tableau uses OpenSSL 3.4.x and Level-2 security. Level-2 security requires keys of 2048 bits or longer. Any existing Level-1 security keys will no longer work and you will need to generate and deploy a new key pair. If you have been generating at least 2048-bit length keys as recommended, no action is necessary. For more information on generating keys, see [Generate an SSL Key](https://help.tableau.com/current/server/en-us/ssl_cert_create.htm#generate-a-key) in the Server Help. All communication between users and Tableau Cloud is encrypted using SSL for secure transmission of data. Tableau Cloud supports TLS 1.2 and higher. For more information about TLS support, see the [Tableau Community](https://community.tableau.com/s/question/0D54T00000C5Q4mSAF/important-as-of-january-18th-2019-tableau-online-will-only-support-encrypted-connections-over-tls-12). A variety of encryption techniques ensure security from browser to server tier to repository and back. In addition, Tableau Cloud does not support HTTP/1.0 after the migration to Salesforce's [Hyperforce](https://help.salesforce.com/s/articleView?id=000388902&type=1); customers must use HTTP/1.1 or higher for enhanced performance and security. Finally, Tableau has many built-in security mechanisms to help prevent spoofing, hijacking, and SQL injection attacks, and it actively tests and responds to new threats with monthly updates. ## Application Security The Tableau Cloud environment is hosted in a multi-tenant configuration providing separation of users, data, and metadata across customers. ### Email notifications Tableau employs Domain-based Message Authentication, Reporting, and Conformance (DMARC) to enhance email security. DMARC, an email validation system that protects both email senders and recipients against spam, phishing, and spoofing, works with SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) protocols to instruct email servers on how to handle unauthenticated emails. For example, DMARC helps prevent unauthorized senders from sending emails that falsely claim to be from Tableau, thus protecting users while Tableau's email notifications are trusted and delivered reliably. DMARC is enabled by default for all Tableau email notifications, including Tableau Cloud Manager and site invitations, metrics, data-driven alerts, refresh failures, and so on. ## Data Security Tableau Cloud eliminates the need to implement VPNs or tunnels into your corporate environment. Many data sources can be captured as extracts and then refreshed on a regular basis. To use automatic refreshes, you need to embed credentials in the connection information for the data source. For Google and Salesforce.com data sources, you can embed credentials in the form of OAuth 2.0 access tokens. You can define additional security in your workbooks and data sources by adding user and data source filters. Tableau also provides a User Filter capability that can enable row-level data security using the user name, group, or full name of the current user. User filters allow you to set a filter on your data based on the identity of the person viewing the data. For example, the Western Sales Director could see results for sales in the West but not for other regions. You set user filters when you publish workbooks and data sources from Tableau Desktop. For information on the alternatives you can use to implement row-level security in Tableau, see an [Overview of Row-Level Security Options in Tableau](https://help.tableau.com/v0.0/online/en-us/rls_options_overview.htm). ### HIPAA Compliance Tableau Cloud is compliant with the Health Information and Portability Accountability Act (HIPAA) and can be provided in a HIPAA-compliant manner to meet the needs of health care and life sciences users. For more information, review the “Tableau Cloud and the HIPAA Security Rule” white paper on the [Salesforce Trust | Compliance](https://compliance.salesforce.com/en/services/tableau) site. ### PCI-DSS Compliance Tableau Cloud meets Payment Card Industry Data Security Standard (PCI-DSS) 4.0 compliance. Tableau’s PCI-DSS compliance is based on the Shared Responsibility Model. This model requires both Tableau Cloud, the service provider, and customers to follow their own responsibilities under this model for the environment to be fully PCI-DSS compliant. For more information about Tableau Cloud's commitment and responsibilities, and key considerations that you must make within the Shared Responsibility model to be fully compliant, see the [Keep Payment and Cardholder Data Secure with PCI-DSS Compliance for Tableau Cloud](https://www.tableau.com/blog/tableau-cloud-pci-dss-compliant) blog post and the “Tableau Cloud PCI DSS White Paper (EN)” on the [Salesforce Trust | Compliance](https://compliance.salesforce.com/en/services/tableau) site. ## Data Location Tableau Cloud is hosted on Salesforce's [Hyperforce](https://help.salesforce.com/s/articleView?id=000388902&type=1). Tableau Cloud is structured so that you can choose the region where your site, and its data, is stored. As a new customer, you can select one of the following regions during the site setup process:

Territory		Region
Asia	Asia Pacific	Australia
		India
		Indonesia
		Japan
		Singapore
		South Korea
Europe	Europe	Germany
		Switzerland
		UK
North America	Canada	Quebec
	US-East	Virginia
	US-West	Oregon

If needed, you can migrate your existing site to a different region through the site migration process. Contact your Tableau Sales Account Manager to request this change. Your site is backed up in the selected region on a regular basis. You can verify your site location by signing in to Tableau Cloud, noting the host name at the beginning of the URL, and then comparing it to the **Site Location** column in [IP addresses for data provider authorization](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#safelist). For example, URLs that begin with **10ax**, **10ay**, **10az**, **us-west-2b**, **prod-uswest-c** correspond to the US West - Oregon region. Data corresponding to a site in the US-West Oregon region is stored and backed up in Oregon. - To request a new site, see the [Tableau Cloud](https://www.tableau.com/products/cloud-bi) product page. - For more information about the Tableau Cloud maintenance schedule, see [Tableau Cloud System Maintenance](https://help.tableau.com/v0.0/online/en-us/to_maintenance_schedule.htm). ## See also [Keep Data Fresh](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#tableau-online-ip-addresses-for-data-provider-authorization) [OAuth Connections](https://help.tableau.com/v0.0/online/en-us/protected_auth.htm) [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm) [How SAML Authentication Works](https://help.tableau.com/v0.0/online/en-us/saml.htm) [User Filtering](https://help.tableau.com/current/pro/desktop/en-us/help.htm#publish_userfilters.htm) (Tableau Help) [Skip to main content](#main-content) # Sensitivity Labels Some data needs to be handled more carefully. To ensure trust and security, it's important that users know which data that is. Starting in Tableau Cloud June 2023 and Tableau Server 2023.3, if you have a Data Management license, Tableau offers a new category of data label: _Sensitivity labels_. Users can use sensitivity labels to indicate the level of care that should be taken when creating views or sharing information. Furthermore, sensitivity labels can co-exist on the same asset as other labels, such as certification and data quality warnings. And, using the label manager on the Data Labels page or the REST API, an administrator can create sensitivity labels to suit the needs of their organization. Note: In Tableau Cloud March 2023 and Tableau Server 2023.1 and earlier, data sensitivity was expressed using the "sensitive data" data quality warning. With the upgrade to Tableau Cloud June 2023 and Tableau Server 2023.3, "sensitive data" data quality warnings were migrated to sensitivity labels. Sensitivity labels can be attached to the same types of assets that other [data labels](https://help.tableau.com/v0.0/online/en-us/dm_labels.htm#assets) can. ## Attach a sensitivity label to an asset To attach a sensitivity label to an asset: Note: Starting with Tableau Cloud February 2024 and Tableau Server 2024.2, you add and remove sensitivity labels using the consolidated Data Labels dialog instead of separate dialogs for each type of label. For information on the Data Labels dialog, see [The Data Labels dialog](https://help.tableau.com/v0.0/online/en-us/dm_labels.htm#data-labels-dialog). 1. Search for or navigate to the asset. The steps to navigate depend on the type of asset you want to add the sensitivity label to: - Data source or virtual connection - on the Explore page, select All Data Sources or All Virtual Connections. - Virtual connection table - on the Explore page, select All Virtual Connections, and select the virtual connection that contains the virtual connection table you want to certify. Then select the virtual connection table. - Database or table - on the Explore page, navigate to the database or table. Or on the External Assets page, select Databases and Files or Tables and Objects. - Column - on the Explore page, navigate to the table. Or on the External Assets page, select Tables and Objects and navigate to the table. Then find the column in the list. 2. Select the actions menu (. . .) next to the asset, and then select Data Labels > Sensitivity Label. 3. Select the checkbox beside sensitivity labels you want attached to the asset. Optionally, if you know the name of a sensitivity label, you can search for it at the top of the dialog, and then select the checkbox beside it. (In Tableau Server 2023.3 and earlier, you can only attach one sensitivity label to each asset. Use the Show label switch to turn on a sensitivity label for that asset, then select the desired sensitivity label from the dropdown list.) 4. If desired, enter a message to display to users. You can format the text in a message with bold, underline, and italics, and include a link or an image. To see text formatting tips, hover over the information (i) icon above the Save button. 5. Select Save. ![The Sensitivity Label dialog](/tableau/next/en-us/online/en-us/Img/dm_label_sensitivity_dialog.png) ## Remove a sensitivity label from an asset To remove a sensitivity label from an asset: Note: Starting with Tableau Cloud February 2024 and Tableau Server 2024.2, you add and remove sensitivity labels using the consolidated Data Labels dialog instead of separate dialogs for each type of label. For information on the Data Labels dialog, see [The Data Labels dialog](https://help.tableau.com/v0.0/online/en-us/dm_labels.htm#data-labels-dialog) 1. Select the actions menu (. . .) next to the asset, and then select Data Labels > Sensitivity Label. 2. Uncheck the boxes beside sensitivity labels you want to remove from the asset. (In Tableau Server 2023.3 and earlier, turn off the label with the Show label switch.) 3. Select Save. ## Where sensitivity labels appear Sensitivity labels appear on assets when navigating Tableau Cloud. Like data quality warnings, sensitivity labels appear downstream from the assets on which they're attached. For example, a sensitivity label on a column appears in the columns row of the table page, again at the top of the table page, and on the database page. ![A sensitivity label on a table page](/tableau/next/en-us/online/en-us/Img/dm_label_sensitivity_table_page.png) ![A sensitivity label on a field of the workbook page](/tableau/next/en-us/online/en-us/Img/dm_label_sensitivity_workbook_lineage_page.png) In web authoring, users see an icon next to the data source in the Data pane when - there's a sensitivity label on a data source used in the workbook, or - there's a warning upstream from the data source used in the workbook To see the details, hover over the icon with the cursor. Or, in Tableau Cloud web authoring, you can select a data source or a column and then select Catalog Details to see all its labels. ### Visibility High visibility sensitivity labels appear more urgent and appear in more places. For example, a high visibility sensitivity label on a table generates a notification when anyone authors a view or opens a published view that depends on it. ![High visibility sensitivity label alert in web authoring](/tableau/next/en-us/online/en-us/Img/dm_label_sensitivity_hv_alert.png) The icon and badge for high visibility sensitivity labels is purple, while standard visibility ones are gray. By default, the built-in sensitivity label called "Sensitive data" is high visibility. If more than one sensitivity label applies to an asset (because the asset has more than one sensitivity label or is inheriting upstream ones), the badge includes a number, and the color is determined by the highest visibility label. For example, if two sensitivity labels apply to an asset, one of which is standard visibility and one of which is high visibility, the badge is purple. ![Sensitivity badge on masthead with two labels ](/tableau/next/en-us/online/en-us/Img/dm_label_sensitivity_badge_2_labels.png) ### Sensitivity labels in email subscriptions Administrators can turn on sensitivity labels in email subscriptions so that when users subscribe to a view, the email they get includes high visibility sensitivity labels associated with that view. Emails with high visibility sensitivity labels contain: - Links to relevant views or workbooks with their Data Details pane open. - Links to relevant upstream assets, such as data sources, tables, or databases. Administrators can turn on sensitivity labels in email subscriptions by selecting the High-Visibility Data Labels in View and Workbook Subscriptions option (previously the Data Quality Warnings in Subscriptions option) on the Tableau Server or Tableau Cloud site settings page. For more information, see [High-Visibility Data Labels in View and Workbook Subscriptions](https://help.tableau.com/v0.0/online/en-us/sites_add.htm#data-quality-warnings-in-subscriptions) in the Site Settings Reference. ## Who can set sensitivity labels To set a sensitivity label, you must either - be a server or site administrator, or - have the Overwrite capability for the asset. ## Customize sensitivity labels There's only one built-in sensitivity label: _Sensitive data_. Starting with Tableau Cloud June 2023 and Tableau Server 2023, using the labels manager on the Data Labels page or the REST API, an administrator can create sensitivity labels or change the name and description of an existing ones. Typical additions (name and description) might be: - **Public**: Available to the public to view. - **Internal**: Restricted to company employees and contractors. This data must not be shared publicly, but it can be shared with customers, partners, and others under a non-disclosure agreement (NDA). - **Confidential**: Available to an approved group of employees and contractors. This data isn't restricted by law, regulation, or a company master service agreement (MSA). It can be shared with customers, partners, and others under an NDA. - **Restricted**: Available only to an approved group of employees and contractors. This data is likely restricted by law, regulation, an NDA, or a company MSA. - **MissionCritical**: Available only to a small group of approved employees and contractors. Third parties who are given access could be subject to heightened contractual requirements. This data is almost always restricted by law, regulation, an NDA, or a company MSA. For more information, see [Manage Data Labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_manage.htm). [Skip to main content](#main-content) # Set a Data Freshness Policy for Query Caches ## Understand data freshness for Query Caches You've built your workbook, and your team loves it. But sometimes people need to click the Refresh button for the most up-to-date data to appear in the viz. You built the workbook using a live connection, so why does the data need to be refreshed? The answer is performance. To improve performance, Tableau caches the results of queries used to fetch data, so subsequent visits can reuse and return that cached data faster. You can click the Refresh button to retrieve updated data, but this can add to potential performance costs. To balance data performance and freshness, set a data freshness policy for your workbook. When you set a data freshness policy, your data is refreshed at the time you specify. Tableau won't visualize cached data that doesn't meet the freshness policy you've set. ## Choose what's best for your workbook Some people might not want caching so that they always have the freshest data, while other people might want large caches to reduce overhead and improve workbook performance. The first step in setting a data freshness policy is to decide what's right for your business. Tableau Cloud refreshes cached data every 12 hours by default, and workbook owners can set data freshness policies at the workbook level. In Tableau Server, server administrators can [set a default caching policy for all sites on the server](https://help.tableau.com/current/server/en-us/config_cache.htm), and workbook owners can set data freshness policies at the workbook level. **Note:** Data freshness policies aren't available in Tableau Desktop or for workbooks that use extract and file-based data sources. ## Edit a workbook data freshness policy To edit a workbook data freshness policy, you must be the workbook owner, and the workbook must have a live connection to the data source. 1. Sign in to a site on Tableau Cloud or Tableau Server. 2. From the Home or Explore page, navigate to the workbook you want to set a policy for. 3. Use the three dot (more options) icon to open the menu. 4. Select Edit Data Freshness Policy.... 5. Choose one of the following options: Site default (12 hours) Always live (Tableau will always get the latest data) Ensure data is fresh every Ensure data is fresh at 6. Select OK. Site default refreshes your data every 12 hours, which is a great option if your audience regularly uses your dashboard, but doesn't need up-to-the-minute data freshness. Always live provides the freshest data at all times, which can increase loading time. Ensure data is fresh every... allows you to specify how often data is refreshed with the granularity of minutes, hours, days, or weeks. Ensure data is fresh at... allows you to schedule the time and day for data refreshes. If you have an important meeting every Monday, Wednesday, and Friday at 09:00 AM Pacific time, then you can set your data refresh to occur at 08:45 AM every Monday, Wednesday, and Friday, so you have the freshest data when your meeting starts. [Skip to main content](#main-content) # Set a Data Quality Warning Data quality warnings are a feature of Tableau Catalog, part of the Data Management offering for Tableau Server and Tableau Cloud. For more information about Tableau Catalog, see "About Tableau Catalog" in the [Tableau Server](https://help.tableau.com/current/server/en-us/dm_catalog_overview.htm) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/dm_catalog_overview.htm) Help. When Tableau Catalog is enabled in your environment, you can set data quality warnings on data assets so that users of that data are aware of issues. For example, you might want to let users know that a data source has been deprecated, or that a refresh has failed for an extract data source. You can set data quality warnings on data sources, databases, tables, flows, virtual connections, virtual connection tables, and columns. Data quality warnings for data sources, databases, tables, and flows were introduced in version 2019.3 for Tableau Cloud and Tableau Server. Data quality warnings for virtual connections and virtual connection tables were added in Tableau Cloud March 2022 and Tableau Server 2022.1, and for columns in Tableau Cloud October 2022 and Tableau Server 2022.3. ## About data quality warnings There are two kinds of data quality warnings: Quality warnings that you set, and quality warnings that Tableau sets when an extract refresh or flow run fails, also known as monitoring quality warnings. - **Quality warnings that you set**: A quality warning that you set is visible to users until you or another user removes it. - **Monitoring quality warning**: If you enable a monitoring quality warning for an extract or flow asset, Tableau automatically adds a quality warning to the asset when an extract refresh or flow run fails. Later, if the extract refresh or flow run succeeds, Tableau automatically removes the quality warning. Starting with Tableau Cloud October 2023 and Tableau Server 2023.3, in addition to setting monitoring warnings at the asset level, you can also turn extract refresh and flow run monitoring on or off for the entire site at once. For information about site-wide monitoring, see [Site-wide monitoring for extract refresh and flow run failures](#sitewide_monitoring_dqw). **Note:** You can enable and modify both kinds of data quality warnings using the REST API. For more information, see the Label and Data Quality Warning [Metadata Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_metadata.htm) in the Tableau REST API Help. ## Where data quality warnings appear In Tableau Cloud and Tableau Server, when you set a warning on a data source, flow, database, table, column, virtual connection, or virtual connection table, the warning is visible to users of the asset and any assets downstream from it. For example, a warning set on a table is visible to users looking at a dashboard that depends on that table. The users see a warning icon on the dashboard's Data Details tab and can open the pane to see more information. ![Data quality warning on Data Details pane](/tableau/next/en-us/online/en-us/Img/dm_dqw_server_wkbk.png) Data quality warnings appear when exploring some types of content in a list view: ![Data quality warning column in list view](/tableau/next/en-us/online/en-us/Img/dm_dqw_list_view.png) Note: If you see a data quality warning column, but don't have a license that includes Data Management, selecting the column header displays a promotion for Data Management. The promotion can be turned off in your Account Settings. Data quality warnings also appear at the top of asset pages: ![Data quality warning on asset page](/tableau/next/en-us/online/en-us/Img/dm_label_dqw_masthead.png) In Tableau Desktop, users see an icon next to the data source in the Data pane when - there's a warning on a data source used in the workbook, or - there's a warning upstream from the data source used in the workbook Note: Data quality warnings for columns and virtual connections don't appear in Tableau Desktop. To see the details of the warning, select the warning icon. ![Data quality warning in the Data Pane](/tableau/next/en-us/online/en-us/Img/dm_dqw_label_in_data_pane.png) In Tableau Cloud web authoring, you can look at all label properties for an object in the data pane (data connection or field) by selecting Catalog Details on the data connection or field. ### Visibility Data quality warnings can be classified as high visibility. High visibility quality warnings appear more urgent and appear in more places. For example, a high visibility warning on a data source generates a notification when anyone opens a view that depends on it. ![Published view with data quality warning info toast](/tableau/next/en-us/online/en-us/Img/dm_dqw_hv_alert.png) The icon and badge for high visibility quality warnings is yellow or orange, while standard visibility quality warnings are blue. If more than one quality warning applies to an asset (because the asset has more than one quality warning or is inheriting upstream ones), the badge includes a number, and the color is determined by the highest visibility label. For example, if two quality warnings apply to an asset, one of which is standard visibility and one of which is high visibility, the badge is yellow or orange. ![](/tableau/next/en-us/online/en-us/Img/dm_label_dqw_badge_2_labels.png) ## Data quality warnings in subscriptions Administrators can turn on data quality warnings in email subscriptions. If this feature is turned on, emails the users receive include high visibility data quality warnings for that view, with links to: - Relevant views or workbooks with their Data Details pane open. - Relevant upstream assets, such as data sources, tables, or databases. Administrators can turn on data quality warnings in email subscriptions by selecting the High-Visibility Data Labels in View and Workbook Subscriptions option (previously the Data Quality Warnings in Subscriptions option) on the Tableau Server or Tableau Cloud site settings page. For more information, see [High-Visibility Data Labels in View and Workbook Subscriptions](https://help.tableau.com/v0.0/online/en-us/sites_add.htm#data-quality-warnings-in-subscriptions) in the Site Settings Reference. ## How to set a quality warning You can set several different data quality warnings on an asset. Starting with Tableau Cloud June 2023 and Tableau Server 2023.3, an administrator can add to the list of available data quality warnings by [customizing data labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_manage.htm). Starting with Tableau Cloud June 2023 and Tableau Server 2023.3, "Sensitive data" is no longer a data quality warning, but is a sensitivity label instead. For more information, see [Sensitivity Labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_sensitivity.htm). In Tableau Server 2023.1 and earlier, "Sensitive data" remains a data quality warning. The following data quality warnings are built in: - Warning - Deprecated - Stale data - Under maintenance To attach a data quality warning to an asset: Note: Starting with Tableau Cloud February 2024 and Tableau Server 2024.2, you add and remove quality warnings using the consolidated Data Labels dialog instead of separate dialogs for each type of label. For information on the Data Labels dialog, see [The Data Labels dialog](https://help.tableau.com/v0.0/online/en-us/dm_labels.htm#data-labels-dialog). 1. Search for or navigate to the asset. The steps to navigate depend on the type of asset you want to add the quality warning to: - Data source or virtual connection - on the Explore page, select All Data Sources or All Virtual Connections. - Virtual connection table - on the Explore page, select All Virtual Connections, and select the virtual connection that contains the virtual connection table you want to certify. Then select the virtual connection table. - Database or table - on the Explore page, navigate to the database or table. Or on the External Assets page, select Databases and Files or Tables and Objects. - Column - on the Explore page, navigate to the table. Or on the External Assets page, select Tables and Objects and navigate to the table. Then find the column in the list. 3. Select the actions menu (. . .) next to the asset, and then select Data Labels > Data Quality Warning. (For columns in Tableau Server 2022.3 and earlier, instead select the column, and then click the actions dropdown and select Quality Warning.) ![Data Labels dropdown menu with the cursor selecting "Data Quality Warning..."](/tableau/next/en-us/online/en-us/Img/dm_dqw_quality_warning_menu.png) 4. Select the checkbox beside quality warnings you want attached to the asset. Optionally, if you know the name of a quality warning, you can search for it at the top of the dialog, and then select the checkbox beside it. (In Tableau Server 2023.3 and earlier, you can only attach one quality warning to each asset. Use the Show warning switch or Enable warning checkbox to turn on a quality warning for that asset, then select the desired warning from the dropdown list.) 5. Set the visibility level. 6. If desired, enter a message to display to users. (In Tableau Server 2023.3 and earlier, a message is required.)You can format the text in a message with bold, underline, and italics, and include a link or an image. To see text formatting tips, click the information (i) icon above the Save button. ![Data Labels dialog with Quality Warning tab selected](/tableau/next/en-us/online/en-us/Img/dm_label_data_labels_dialog_dqw.png) 7. Select Save. ## Remove a data quality warning When a warning no longer applies, you can remove it by navigating to the data asset with the warning. Note: Starting with Tableau Cloud February 2024 and Tableau Server 2024.2, you add and remove quality warnings using the consolidated Data Labels dialog instead of separate dialogs for each type of label. For information on the Data Labels dialog, see [The Data Labels dialog](https://help.tableau.com/v0.0/online/en-us/dm_labels.htm#data-labels-dialog). 1. Select the actions menu (. . .) next to the asset, and then select Quality Warning. (For columns in Tableau Server 2022.3 and earlier, instead select the column, and then click the actions dropdown and select Quality Warning.) 2. Uncheck the boxes beside quality warnings you want to remove from the asset. (In Tableau Server 2023.3 and earlier, use the Show warning switch or Enable warning checkbox to turn off a quality warning for that asset.) 3. Turn off the warning. 4. Select Save. ## How to turn on a monitoring quality warning You can set Tableau to monitor for two events: extract data source refresh failure and flow run failure. When the event occurs, Tableau generates a quality warning that appears in the same places that a manual quality warning appears. You can turn on monitoring explicitly on the extract or flow, or, starting with Tableau Cloud October 2023 and Tableau Server 2023.3, you can enable site-wide monitoring for all extract refresh and flow run failures. For information on site-wide monitoring, see [Site-wide monitoring for extract refresh and flow run failures](#sitewide_monitoring_dqw). To explicitly monitor for either an extract refresh or flow run failure: 1. Select the actions menu (. . .) next to the extract data source or flow you want to create a warning for, and then select the appropriate option: - In Tableau Cloud and Tableau Server 2023.3 and later: - Data Labels > Extract Refresh Monitoring - Data labels > Flow Run Monitoring - In Tableau Server 2023.1 and earlier: - Quality Warning > Extract Refresh Monitoring - Quality Warning > Flow Run Monitoring 3. Enable the warning. 4. Set the visibility level. (Older versions of the dialogs have a checkbox for high visibility.) 5. If desired, enter a message for users to see in the warning details if the extract refresh or flow run fails. You can format the text in a message with bold, underline, and italics, and include a link or an image. To see text formatting tips, click the information (i) icon above the Save button. 6. Click Save. ![Flow Run Monitoring window with sample message that reads, "This flow run failed. Please contact Ashley Garcia."](/tableau/next/en-us/online/en-us/Img/dm_dqw_flow_run_dialog.png) ## How to turn off a monitoring quality warning To turn off monitoring for either an extract refresh or flow run failure: 1. Select the actions menu (. . .) next to the extract data source or flow you want to create a warning for, and then select the appropriate option: - In Tableau Cloud and Tableau Server 2023.3 and later: - Data Labels > Extract Refresh Monitoring - Data labels > Flow Run Monitoring - In Tableau Server 2023.1 and earlier: - Quality Warning > Extract Refresh Monitoring - Quality Warning > Flow Run Monitoring 2. Turn off the warning. 3. Click Save. ## Site-wide monitoring for extract refresh and flow run failures Starting with Tableau Cloud October 2023 and Tableau Server 2023.3, an administrator can turn on site-wide monitoring to add or remove data quality warnings for extract refresh failures and flow run failures. You can control this feature through the Settings page, under the Extract Refresh and Flow Run Monitoring section: ![Extract Refresh and Flow Run Monitoring Setting](/tableau/next/en-us/online/en-us/Img/monitoring_dqw_setting.png) These settings are turned on by default for all new sites. Sites that existed before the change will have the settings turned off, but an administrator can turn them on. **Note**: Starting with the October 2026 release of Tableau Cloud, Data Quality Warning notifications also apply to extract refreshes that use Tableau Bridge. ### Interaction of site-wide monitoring and explicit monitoring The interaction of explicit monitoring on assets and site-wide monitoring of all assets is as follows: - If monitoring is explicitly turned on for an asset _and_ site-wide monitoring is turned on, explicit settings on the asset take precedence over the site-wide settings. Settings include properties like visibility level and message. - When you turn off site-wide monitoring: - Assets _with_ monitoring explicitly turned on aren't changed. - Assets _without_ monitoring explicitly turned on stop monitoring for extract refresh or flow run failures, and warnings that previously arose from extract refresh or flow run failures on those assets are removed. - Catalog ingestion performance might be temporarily reduced as Catalog re-ingests assets that may no longer have warning labels. Site-wide monitoring was released in Tableau Cloud October 2023 and Tableau Server 2023.3. There's no interaction of explicit monitoring and site-wide monitoring in earlier versions. ## Who can set quality warnings To set a data quality warning, you must either - be a server or site administrator, or - have the Overwrite capability for the asset. ## Customize data quality warnings Starting with Tableau Cloud June 2023 and Tableau Server 2023.3, using the label manager on the Data Labels page or the REST API, an administrator can change the data quality warnings that users see in the data quality warning dialog, or create new ones. For more information, see [Manage Data Labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_manage.htm). [Skip to main content](#main-content) # Set a Site’s Web Authoring Access and Functions Tableau Server administrators can specify at the site level whether to allow users to edit published views in the web environment and configure other web authoring functionality. By default web authoring functionality is enabled for all sites. Users with the Web Edit capability can create and edit workbooks directly on the server. Turn off web authoring if you want users to be able to view and interact with published workbooks but not make any changes to the core information. The steps below describe how to set web authoring and other associated functionality for an entire site. For more granular control over which users can use web editing, you can use projects, groups, and permissions. See [Set Web Edit, Save, and Download Access on Content](https://help.tableau.com/current/server/en-us/web_author_who.htm). For information about how to enable authoring for flows on the web, see [Create and Interact with Flows on the Web](https://help.tableau.com/current/server/en-us/web_author_flows.htm). ## Turn web authoring on or off for a site **Note:** This setting is only available for Tableau Server. Web authoring is enabled for Tableau Cloud and cannot be turned off. 1. In a web browser, sign in to the server as an administrator and go to the site in which you want web authoring to be enabled. In that site, click Settings. 2. In the **Web Authoring** section, select Workbooks. Let users edit workbooks in their browser. to enable the functionality. Clear the check box to turn off web authoring for that site. ![Make views on your site uneditable](/tableau/next/en-us/online/en-us/Img/web_author_disable4.png) 3. If your site is already in production, and you want the change to take effect immediately, restart the server. Otherwise, the change takes effect after server session caching expires or the next time users sign in after signing out. ### Notes - When you enable web authoring, make sure that, on the appropriate workbooks or views, the permission rule for a user or group allows the **Web Edit** capability. - If you turn off web authoring on a production site and do not complete the last step to restart the server, users might continue to have authoring access until their session caches expire or they sign out. ## See which sites allow web authoring To confirm which sites allow web authoring, on the site-selection menu at the top, select Manage All Sites, and then go to the Sites page. ![The Sites page showing which sites allow web authoring.](/tableau/next/en-us/online/en-us/Img/web_author_disable3.png) ## About cross-database joins To improve performance for cross-database joins, Tableau will now default to deciding whether it should perform joins within Tableau using Hyper, or move data into the connected live database as a temporary table and perform joins there. The option in Settings for each site to configure cross-database joins is still visible, but it can no longer be changed from the default. ![Cross-Database Joins setting with options to always perform joins in the database or let Tableau decide where to join.](/tableau/next/en-us/online/en-us/Img/cross_database_join_web_setting.png) For more information, see [Improve performance for cross-database joins](https://help.tableau.com/current/pro/desktop/en-us/joining_tables.htm#cross_dbase_joins_perf). [Skip to main content](#main-content) # Set Manual Goals and Thresholds with Tableau Pulse Tableau Pulse lets you track important metrics and receive updates right where you’re working–in email or Slack. If you set a goal or threshold in Tableau Pulse, you can track a metric’s performance relative to that value. For goals, Tableau Pulse shows a metric’s progress toward the goal value. If the pace to goal insight is turned on, you also see whether the metric is expected to meet the goal by the end of the period. For thresholds, Tableau Pulse shows how far the metric is from the threshold value. There are two ways to define goals and thresholds in Tableau Pulse: as part of the data source or manually. Data source goals and thresholds are set on a metric definition. These goals and thresholds rely on a field from your data source to show a dynamic value that can be filtered. To learn about data source goals and thresholds, see [Configure data source goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#ds-goal). A manual goal or threshold is set on an individual metric and is a single static number. If you set a manual goal or threshold on a metric that has a data source goal or threshold, the manual value overrides the data source value. The manual goal or threshold you create is visible to anyone who views the metric. ## Create a manual goal or threshold When you create a manual goal or threshold, it’s based on the filters that are applied to the current metric. For example, a month-to-date metric has a monthly goal value. 1. Open a metric from your email or Slack digest or from the Tableau Pulse home page. 2. From the upper-right corner, select the Actions menu (...). 3. Select Set Goal or Threshold. If a data source goal or threshold exists, the option is Override Goal or Threshold. 4. For Type, choose whether to set a goal or threshold. 5. Enter the value. You can enter positive numbers, negative numbers, or 0. 6. If you’re setting a threshold, for the Unfavorable Range, select whether above or below the threshold is unfavorable. The unfavorable range is shaded red on the metric chart. When the aggregate metric value crosses into this range, followers receive an alert. For more information, see [Get Tableau Pulse Alerts](https://help.tableau.com/v0.0/online/en-us/pulse_alerts.htm). 7. To change the label for the goal or threshold, under **Custom goal label**, enter a name. This custom label appears on the goal progress indicator, chart, and in insights. 8. Select Save. After a manual goal or threshold is created, you see it in your Tableau Pulse digests and on your Tableau Pulse home page. ![A Tableau Pulse metric that has met 53.6% of the 30.0k goal. There are 9 days left to meet this goal.](/tableau/next/en-us/online/en-us/Img/Pulse_goals.png) To change the value, return to the Insights Exploration page, select the Actions menu (...), then select Edit Goal or Threshold. You can also select Delete from the Set Manual Goal or Threshold dialog. Editing or deleting changes the goal or threshold for all users who follow that metric. ## Manage who can create, edit, or delete a manual goal or threshold By default, all users can create, edit, and delete manual goals and thresholds. If you have access to edit the metric definition, you can restrict who can modify manual goals and thresholds. For information about the permission settings for metric definitions, see [Restrict editing for definitions and manual goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#edit-permissions). ## Understand limitations You can’t set manual goals or thresholds for metrics filtered to the last complete period. This includes metrics with a date range of yesterday, last week, last month, last quarter, and last year. If a metric definition is edited, all the metrics based on that definition are also updated. For example, if a definition is edited to use a different measure or time dimension, the existing manual goals and thresholds remain, even though the metric data might have changed. Review any pre-existing manual goals or thresholds to confirm that they still make sense with the updated metric data. [Skip to main content](#main-content) # Set the Default Start Page for All Users In a new site, when users sign in to the Tableau Cloud web authoring environment, they are taken to the Home screen, which displays a role-based welcome banner. Home also displays recent views, favorites, and the site's most-viewed content. As the administrator, you can change users’ default landing page at the site level. For example, you can show all workbooks, and when the user signs in, they see the workbooks they have access to. ### To set the default start page for all users 1. Display the page or filtered view you want to be the default page users see when they sign in to the site. 2. Select your profile icon in the upper right area of the page. 3. To set the start page for all users on a site, click Set as Start Page and For Users on this Site. ## User-set start pages and hierarchy Users can set their own start pages from their profile icon, and can reset their start pages in their account settings (see [Access Your Profile and Account Settings](https://help.tableau.com/current/pro/desktop/en-us/help.htm#useracct.htm)). If a user sets their own start page, it will override any start page set for the site. The next time that user signs into Tableau Cloud, they will land on the start page that they've set. If neither a user or an administrator has set a start page, users will default to Home. [Skip to main content](#main-content) # Set the Language for Invitation Emails You can set the default language for site invitation emails, also referred to as welcome notifications, sent to new users when you add them to your Tableau Cloud site or Tableau Cloud Manager (TCM) tenant. Set a single language for invitation email notifications or set a language per user through the Tableau REST API or TCM REST API. ## Method 1: Configure site-level default language (Tableau Cloud only) The site-level Email Language setting gives every site invitation email notifications a predictable language. New invitation email notifications use the default language for any user who doesn't have an individual language configured (all new users). If no default language is set, the user's invitation email notification is sent in English (US). 1. Sign in to [Tableau Cloud](https://online.tableau.com/) as a site admin. 2. From the left navigation pane, go to Settings and scroll to Email Language. 3. From the Language drop-down menu, select the language you want to use for site invitation email notifications. 4. Click Save. ## Method 2: Configure language for user This per-user method lets you configure the language for individual users, such as members of a regional team. If no language is set for the user, the user's invitation email notification is sent in English (US). ### Tableau Cloud As site admin, you can use the Tableau REST API to set the language for a specific user. A language configured this way overrides the site-level Email Language setting for that user's invitation email notification. For more information, see [Add User to Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#add_user_to_site) and [Update User](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#update_user) methods. ### Tableau Cloud Manager (TCM) As a cloud administrator, you can use the TCM REST API to set the language for a specific user on the tenant and site. Setting the language for the TCM user (cloud administrator) sets the language for the tenant-level invitation email notification. Setting the language for a site user also sets the language for the site-level invitation email notification and overrides the default site-level Email language setting that might be set. For more information, see [Add Tenant User](https://help.tableau.com/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/createUserWithMultiRole) and [Update Tenant User](https://help.tableau.com/current/api/cloud-manager/en-us/reference/index.html#tag/User-Methods/operation/modifyUserWithMultiRole) methods. [Skip to main content](#main-content) # Change Time Settings There are a two time-related configurations you might make when working with Tableau Cloud. ## Set the site time zone for extracts The default time zone for extract-based data sources in a site is Coordinated Universal Time (UTC). Site administrators can set a different time zone. To set the site time zone for extracts: 1. Sign in to Tableau as an administrator. 2. On the site you want to configure, click `Settings`. 3. In the `Site Time Zone for Extracts` section, select a time zone and then click `Save`. In calculated fields, functions such as NOW() or TODAY() look at the time zone. For more information about Extracts, see [Extract Your Data](https://help.tableau.com/current/pro/desktop/en-us/extracting_data.htm) in the Tableau Desktop help. The timezone setting, in addition to being used for extract-based data sources, also affects internal extracts. For example, when Tableau connects to file-based data sources like text files, an extract is automatically created internally. Similarly, this happens where Tableau uses an internal extract to integrate data from different sources. The timezone setting also affects how relative-date filter captions are rendered. **Note:** When viewing a workbook in a browser, relative-date filter captions (e.g., "Last 7 Days") display using your local time zone. However, exported files (Download > Image or Download > PDF) are rendered on the Tableau Cloud pod, which uses the pod's time zone. This can cause the exported filter caption to differ from your browser view by up to one day. This only affects the caption text and your underlying data remains accurate. To maintain consistent captions across browser and exported views, use a **Range of Dates** filter with fixed start and end dates instead. ## Synchronize your computer clock with UTC Timestamps displayed across your Tableau Cloud site are in Coordinated Universal Time (UTC) of the pod that your site is deployed to. To ensure the time on your computer matches the time used by your site, you can synchronize your computer's system clock with UTC using one of the following suggestions: - If your computer is deployed on Amazon Web Services (AWS), you can synchronize your computer's system clock using Network Time Protocol (NTP) sources as described in the [Keeping Time With Amazon Time Sync Service](https://aws.amazon.com/blogs/aws/keeping-time-with-amazon-time-sync-service/) blog post on the AWS website. - If your computer is deployed outside of AWS, you can synchronize your computer's system clock using one of the National Institute of Standards and Technology (NIST) time servers as described in [Set your computer clock via the Internet using tools built into the operating system](https://www.nist.gov/pml/time-and-frequency-division/time-distribution/internet-time-service-its) page on the NIST website. [Skip to main content](#main-content) # Set the User Authentication Type On a Google, OIDC, Salesforce, or SAML-enabled siteor Tableau Cloud Manager (TCM) tenant, site or cloud administrators can specify users’ authentication method. For example, which users can access Tableau Cloud or TCM using their single sign-on (SSO) credentials. You can assign authentication method at the time you add users to Tableau Cloud, as well as any time afterward. **For Tableau Cloud** 1. When you’re signed in to the Tableau Cloud site, select **Users**. 2. On the Users page, select the check boxes next to the users whose authentication type you want to assign or change. 3. On the Actions menu, select Authentication. ![An actions menu with the option for authentication.](/tableau/next/en-us/online/en-us/Img/users_set_authentication.png) 4. In the Authentication dialog box, select the authentication method or Tableau with MFA. **For TCM** 1. When you’re signed in to the TCM, select **Users**. 2. On the Users page, select the filter icon on the left-side of the page and select the Show only Cloud Administrators check box. 3. Select check boxes next to the users whose authentication type you want to assign or change. 4. On the Actions menu, select Site Membership. 5. In the Site Membership dialog box, under Authentication for Tableau Cloud Manager drop-down menu, select the authentication method or Tableau with MFA. ## Notes - In Tableau Cloud, if the authentication for the site changes, you'll see a warning symbol in the Authentication column on the Users page when a user is assigned that authentication method. Starting in January 2025 (Tableau 2024.3), if a user is assigned to an authentication method whose configuration is deleted, you'll see "Undefined" in the Authentication column for that user. **Note:** You might also see "Undefined" if the `authSetting` attribute was used instead of the `idpConfigurationId` attribute when assigning an authentication method to a user using the Tableau REST API. For more information, see [Add User to Site](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#add_user_to_site) and [Update User](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_users_and_groups.htm#update_user) methods in the Tableau REST API Help. - If you change users’ authentication from Tableau with MFA to Google, the next time they sign in, they will be directed to your identity provider’s site to provide their credentials. - If users were signing in using their external IdP credentials, and you change their authentication type to Tableau with MFA, if they do not have existing Tableau credentials, they will receive email from Tableau with instructions for creating new Tableau credentials. - Tableau recommends that you dedicate a site admin or cloud admin account that is always configured for Tableau with MFA authentication. In the event of an issue with your IdP, a dedicated Tableau account ensures that you always have access to your site or tenant. - See [Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_security_mfa.htm) or for more information about the Tableau with MFA authentication option. [Skip to main content](#main-content) # Set Up a Private Network Refresh Schedule This topic describes how a Tableau data source owner can set up and update refresh schedules for data sources that connects to private network data. Refresh schedules for data sources that connect to private network data rely on Tableau Bridge. The tasks described in this topic assume Bridge has been set up and is being maintained by your site admin. Exceptions are noted. This topic does not cover setting up refresh schedules for virtual connections. For more information about virtual connections, see [Schedule Extract Refreshes for a Virtual Connection](https://help.tableau.com/v0.0/online/en-us/dm_vconn_extract.htm). **Notes:** - Bridge supports keeping data fresh for data sources embedded in workbooks. See [Using Embedded Data Sources](https://help.tableau.com/current/online/en-us/to_bridge_eds.htm). - To set up and configure refresh schedules for a private cloud-based data sources, see [Connect to Private Cloud Data](https://help.tableau.com/v0.0/online/en-us/to_bridge_vpc.htm). ## Bridge refresh schedules versus Bridge legacy schedules For data sources that are set up to use extract connections, Bridge uses refresh schedules to keep data fresh. There are two types of refresh schedules that you can configure for Bridge to use: - Bridge refresh schedules - Bridge legacy schedules: To allow customers additional time to migrate off of legacy schedules, deprecation of Bridge legacy schedules has been postponed to the 2025.2 release. Until that time legacy schedules will continue to be supported by Tableau. For more information about how to migrate to Bridge refresh schedules see the section below, [Migrate from Bridge legacy to Bridge refresh schedules](#migrate). **Note:** Bridge legacy schedules do not support refreshes for virtual connections. The schedule you use can depend on a couple of factors, including the version the original schedule was created and the type of underlying data that the data source connects to. In summary, Bridge refresh schedules are designed to leave client management tasks to the site admin and enable you to perform all your data source management tasks directly on Tableau Cloud. #### Version Beginning with Bridge 2021.4.3, extract refreshes for file-based published data sources can use Bridge refresh schedules. Bridge refresh schedules for file-based data sources require at least one Bridge 2021.4.3 (or later) client be set up and added to the client pool by your site admin. Beginning with Bridge 2024.2.1, extract refreshes for file-based embedded data sources can use Bridge refresh schedules. Bridge refresh schedules for file-based embedded data sources require at least one Bridge 2024.2.1 (or later) client to be set up and add to a Named Pool by your site admin. By default, schedules created for file-based data sources that were created prior to Bridge 2021.4.3 use Bridge legacy schedules. Bridge legacy schedules can be converted to Bridge refresh schedules. ### Compare schedules The following table describes the differences between Bridge refresh and Bridge legacy schedules.

	Bridge refresh schedule	Bridge legacy schedule
Supported data types	Relational data File data On premises data Private cloud data	Relational data File data On premises data
Supported query types	Published Data Sources Live and Extract Embedded Data Sources Virtual Connections Incremental refresh	Published Data Sources Live and Extract
Schedule management	Data source page Workbook (live connections only) Distributed schedule management Integrated with Tableau Cloud schedules allowing for more control and shared visibility	Data source page Only accessible by user that is signed into Bridge client
Additional feature support	Supports pooling to load balance work loads Monitoring available: Jobs, Admin Insights, and Admin Views. REST API: Run Extract Refresh Now REST API:Update Data Source Now	Not supported

## Manage schedules Though the scheduling tasks are exactly the same, there are two primary entry points for setting up a Bridge refresh schedule for a data source that connects to private network data. The first entry point is during the data source publishing process, from Tableau Desktop. The second entry point is at any time after the data source publishing process. ### Set up a schedule In most cases, you will set up a schedule as you publish your data source from Tableau Desktop. **Note**: Scheduled extracts of published data sources do not support multiple pools. Multiple pools may be necessary when you have a connection in a single data source to data sources that are located in two or more network locations. 1. In Tableau Desktop, create your data source. 2. Select Server > Publish Data Source to begin the publishing process. If you haven't already signed in to Tableau Cloud, you will be prompted to. 3. In the Publish Data Source to Tableau Cloud dialog box, configure the various options for your data source, and then click the Publish button. This opens a browser window to Tableau Cloud. **Note:** Depending on the data that the data source is connected to or how you've configured the data source, the dialog will default to publishing an extract or will give you the option to publish an extract. If you are provided options, select the option to publish an extract. 4. In the Publishing Complete dialog box, click the Schedule Extract Refresh button. ![A dialog box confirms successful data publishing and prompts you to schedule an extract refresh.](/tableau/next/en-us/online/en-us/Img/bridge_online_publish_done_schedule.png) 5. In the Create Extract Refresh dialog box, configure a schedule for the refresh. For more information about how to configure the schedule, see [Schedule Refreshes on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/schedule_add.htm). ![A create extract dialog box with option to select the refresh type, frequency, and time zone.](/tableau/next/en-us/online/en-us/Img/bridge_schedule_integ.png) 6. Click the Create button. ### Add or update an existing schedule For whatever reason you are unable to schedule a refresh during the data source publishing process, you can add a new or update a schedule anytime after. 1. Sign in to Tableau Cloud and navigate to your data source. 2. From the data source page, click the Extract Refreshes tab. 3. Do one of the following: 1. To set up a new schedule, click the New Extract Refresh button and configure a schedule for your refresh. 2. To update an existing schedule, select the check box next to the schedule, click the Actions menu, and then select Change Frequency to reconfigure the schedule for the refresh. 4. Click the Create button. ### Change refresh connection type By default, Tableau Cloud uses Bridge when a published data source has at least one public cloud and one on-premise connection. For more information about how to edit the connection type, see [Change the connection type of a refresh to use Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_sync_signout_unlink.htm#use_cloud). ## Alternative: Manage Bridge legacy schedules Optionally, you can use the Bridge legacy schedule to keep your data fresh. **Notes:** - **Important:** Support for Bridge legacy schedules will be removed in version 2025.2. To ensure a smooth transition, we recommend you use Bridge refresh schedules. For more information, see [Migrate from Bridge legacy to Bridge refresh schedules](#migrate). - Bridge refresh schedules have greater flexibility, support more data source types and offer much simpler administration of Tableau Bridge. - Bridge legacy schedules can only complete successfully if you embed your database credentials in the connection through the Bridge client. For more information, see [Embed or update database credentials](https://help.tableau.com/v0.0/online/en-us/to_sync_client_settings.htm#embed-credentials). - When you use a Bridge legacy schedule, the time that shows on the client and the time that shows on Tableau Cloud correspond to the time zone of the machine from which the client is running. ### Migrate from Bridge legacy to Bridge refresh schedules Refresh schedules for file-based data sources that were created before Bridge 2021.4.3 use Bridge legacy schedules by default. You can migrate Bridge legacy schedules to use Bridge refresh schedules to keep your data fresh. Bridge refresh schedules run on Bridge clients managed by your site admin and take advantage of pools of available clients to perform the refreshes. 1. Ensure that you have a named pool with at least one client assigned to it. Pools are used to distribute (or load balance) data freshness tasks among the available clients. Pools also give you the ability to dedicate clients to keeping specific data fresh and centrally maintaining security. 2. In that pool, provide the domains of the private network locations that you want to make accessible to Bridge on behalf of Tableau Cloud. For more information, see [Configure Pooling](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm#configure-pooling). 3. Validate that the client is configured to run in Service mode and not Application mode. (More information: [Linux](https://help.tableau.com/current/online/en-us/to_bridge_linux_install.htm#troubleshooting) | [Windows](https://help.tableau.com/current/online/en-us/to_bridge_client.htm#application--versus-service-mode)). 4. In the legacy schedule, go to the published data source and click the Extract Refreshes tab to display the Bridge (legacy) schedule. ![](/tableau/next/en-us/online/en-us/Img/bridge_legacy_convert.png) 5. Use the action menu to delete all legacy schedules. ![](/tableau/next/en-us/online/en-us/Img/bridge_extract_legacy.png) 6. On the Connections tab, click Edit Connection, and then enter the user name and password for the connection. ![](/tableau/next/en-us/online/en-us/Img/bridge_edit_conn_legacy.png) 7. For all Published Data Sources, Embedded password in connection and Private network must be selected. ![](/tableau/next/en-us/online/en-us/Img/bridge_embed_legacy.png) 8. On the Extract Refreshes tab, click New Extract Refresh to schedule a refresh for the named pool. ![](/tableau/next/en-us/online/en-us/Img/bridge_new_legacy.png) 9. Click Create to add the replacement scheduled refresh. The new schedule is listed as Schedule rather than Bridge legacy schedule. 10. Continue this process for any Bridge legacy schedules that you have running on your site. You can find a list of all current Bridge legacy schedules by signing into the Bridge Client on the client’s machine. All active Bridge legacy schedules will be displayed on the client. ### Set up a Bridge legacy schedule **Important:** Support for Bridge legacy schedules will be removed in version 2025.2. To ensure a smooth transition, we recommend you use Bridge refresh schedules. For more information, see [Migrate from Bridge legacy to Bridge refresh schedules](#migrate). Just like with Bridge refresh schedules workflow, in most cases, you will set up a Bridge legacy schedule as you publish your data source from Tableau Desktop. 1. In Tableau Desktop, create your data source. 2. Select Server > Publish Data Source to begin the publishing process. If you haven't already signed in to Tableau Cloud, you will be prompted. 3. In the Publish Data Source to Tableau Cloud dialog box, configure the various options for your data source, and then click the Publish button. This opens a browser window to Tableau Cloud. 4. In the Publishing Complete dialog box, click the Schedule Extract Refresh button. The Create Extract Refresh dialog box, where you configure the Bridge legacy schedule, displays. 5. In the Create Extract Refresh dialog box, follow each step to configure the schedule. ![Tableau Bridge dropdown menu with option to schedule with Bridge.](/tableau/next/en-us/online/en-us/Img/bridge_schedule_leg_moved.png) **Notes:** - **To refresh during a specific time period on selected days:** Select Hourly, specify the time range during the day using the From and To drop-down lists, and then select the days of the week. To optimize performance on the server, refresh tasks are distributed within a range of up to five minutes of the time of day you specify. For example, if you set an hourly schedule, the occurrence set to run at 1:00 AM could run any time between 1:00 and 1:05 AM. - **Full or incremental refresh:** If available, you specify whether you want a full or incremental refresh. By default, Tableau Cloud runs a full refresh. Incremental refresh is available only if you configured the data source for an incremental refresh in Tableau Desktop before publishing. For information, see [Refreshing Extracts](https://help.tableau.com/current/pro/desktop/en-us/extracting_refresh.htm) in the Tableau Help. 6. Click the Create button. ### Add a new or update an existing Bridge legacy schedule **Important:** Support for Bridge legacy schedules will be removed in version 2025.2. To ensure a smooth transition, we recommend you use Bridge refresh schedules. For more information, see [Migrate from Bridge legacy to Bridge refresh schedules](#migrate). If you're unable to schedule a refresh during the data source publishing process, you can add a new or update a Bridge legacy schedule anytime after. New (for sites that have been migrated) 1. Sign in to Tableau Cloud and navigate to your data source. 2. From the data source page, click the Extract Refreshes tab. 3. Do one of the following: 1. To set up a new Bridge legacy schedule, in the data source's actions menu, select Schedule with Bridge legacy, configure the schedule, and then click the Schedule Refresh button. ![A dropdown menu lists options for a product owned by Neil.](/tableau/next/en-us/online/en-us/Img/bridge_schedule_leg_menu.png) 2. To update an existing Bridge legacy schedule, select the check box next to the existing schedule, click the data source's actions menu, and then select Change Schedule. In this workflow, you can't change the client that performs the refresh. If you need to change the client that performs the refresh, see [Change the client that performs the Bridge legacy schedule](#change-computer). When finished, click the Change Schedule button. ### Other Bridge legacy schedule management tasks #### Add a new or update an existing schedule from the client If you, not your site admin, are managing the "named" clients, you can add a new or update an existing Bridge legacy schedule directly from the Bridge client. 1. Open the Windows system tray and click the Bridge icon to open the client. 2. Hover over the data source and click the Schedule icon. This opens a browser window to the data source page in Tableau Cloud. 3. Repeat steps 2-3 from the above [Add a new or update an existing Bridge legacy schedule](#Add) section to set up the schedule. #### Add a new computer (client) to perform a scheduled refresh As part of the scheduling process, in the scheduling dialog, you must specify a machine. The machine you specify is the Bridge client that performs the refresh. The Bridge legacy schedule displays the clients that you signed into. ![Tableau Bridge refresh data source with dropdown to select a computer on your network where a Bridge client is installed.](/tableau/next/en-us/online/en-us/Img/bridge_schedule_leg_client.png) If the client you want to select is not available from the drop-down list, it can be one of a few reasons: - You're not signed in to the client. - The client is not properly registered or connected to the site. Go to and open the client and make sure that it has a green or "Connected" status. - Your site admin manages all clients in your organization. When using Bridge legacy schedules, the data source owner and the user signed into the client must be the same. If your site admin is signed into the client, he or she must reassign ownership of the data source to him or herself in order to schedule a refresh. #### Cancel an in-progress refresh In some cases, you might need to cancel an in-progress refresh. You can cancel a refresh for a data source that uses the Bridge legacy schedule only. 1. Open the Windows system tray and click the Bridge icon to open the client. 2. Click the Cancel Refresh button. This action will cancel the in-progress refresh. ![A Tableau Bridge window with options for site, orders, and mode.](/tableau/next/en-us/online/en-us/Img/bridge_cancelrefresh.png) **Note:** A client can perform one Bridge legacy refresh at a time. If you need to run more than one Bridge legacy refresh at the same time, discuss with your site admin about setting up additional clients on different machines to perform the extract refreshes. #### Change the client that performs the Bridge legacy schedule If you're working with a Bridge legacy schedule and want to change the location or machine that performs the refresh, you must set up a new refresh schedule. You can only schedule a refresh using a client that you are signed in to. To set up a new Bridge legacy schedule, see [Set up a Bridge legacy schedule](#Set). When you're done setting up a new refresh schedule, make sure that you delete the previous schedule identical to the new schedule. **Important:** If the data source requires database credentials to access the underlying data, you must go back to the client and edit the connection information to re-embed the database credentials. You can use the Test Connection option in the client to check whether the data source can access the underlying data. #### Remove a client from a site After you change the client that performs the Bridge legacy schedule, consider permanently removing the client from the site if it's no longer being used for any other data freshness tasks. 1. Sign in to Tableau Cloud. 2. In the upper-right corner of the browser, click your profile image or initials, and select My Account Settings. 3. Under Connected clients, click Delete next to the client you want to remove from the site. ## Verify a previous or upcoming refresh You can check when a previous refresh took place or find out when the next refresh will occur. 1. Sign in to Tableau Cloud and navigate to your data source. 2. From the data source page, click the Extract Refreshes tab. 3. Next to the schedule, review Last update and Next update columns. ## Delete a refresh schedule 1. Sign in to Tableau Cloud and navigate to the data source whose refresh schedule you want to delete. 2. On the data source page, click the Extract Refreshes tab. 3. Select the check box next to the schedule you want to delete and select Actions > Delete. [Skip to main content](#main-content) # Set Up Activity Log > [!TIP] > > **Important:** Between March 16 and March 31, 2026, the Activity Log feature in Tableau Cloud migrated to Hyperforce. For details on required policy updates and new folder structures, see [About the Hyperforce migration](#hyperforce-migration). The Activity Log contains detailed events for your Tableau deployment that you can use for compliance, monitoring, and auditing. You must complete the following steps in order to use Activity Log. ## Prerequisites To use the Activity Log, you must have the following: - Tableau Cloud with Advanced Management - Amazon Web Services (AWS) account - Amazon Simple Storage Service (S3) bucket to receive data - You'll create an Amazon S3 bucket as part of the setup process. Amazon S3 is currently the only supported option for a direct cloud storage sync integration. - You must create the Amazon S3 bucket in the same AWS region where your Tableau Cloud site is hosted. For more information about data locations, see [Security in the Cloud](https://help.tableau.com/v0.0/online/en-us/to_security.htm#data-location) and [IP addresses for data provider authorization](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#safelist). **Important:** Pods in the Europe - Ireland region have moved to the Europe - Germany region as part of Tableau Cloud's migration to Hyperforce. If your site resided on a Europe - Ireland pod, you'll need to reconfigure Activity Log to use an AWS S3 bucket in the new region, Europe - Germany. For more information, see [AWS region change for sites on Europe - Ireland pods](#hyperforce) below. - AWS Key Management Service (KMS) single-region key for the Amazon S3 bucket that you create during setup. ## About the Hyperforce migration In March 2026, the Activity Log feature migrated to Hyperforce to enhance compliance and improve security, privacy, and regional availability. This infrastructure change moved Activity Log to a regional architecture, which requires the use of region-specific IAM roles for log delivery. ### Policy requirements S3, KMS, and VPC policies require the IAM role and ID specific to the region where your site is hosted. These region-specific Hyperforce values replace the previous Tableau IAM role (`arn:aws:iam::061095916136:role/prod-replication-rule-role`) and ID (`AROAQ4OMZWJUBZG3DRFW5`). Use the [Role mapping by region](#role-mapping-by-region) table to find the correct values for your site. For more information about the migration, see [Changes to Tableau Cloud Activity Log Due to Hyperforce Migration](https://help.salesforce.com/s/articleView?id=005232922&type=1) in Salesforce Help. ### Folder structure The migration to Hyperforce updated the organization of event files in S3 buckets to a hierarchy based on the date and hour the events were processed.

	Before migration	After migration
Storage pattern	`eventCategory={}/ts={}/FILE`	`y={}/m={}/d={}/h={}/eventType={}/FILE`
Example S3 path	`eventCategory=security/ts=20250802T064500Z/part-0-32708-online`	`y=2025/m=08/d=02/h=06/eventType=activity_log_settings_change/ActivityLog-88974c0f-d35a-4743-bd55-7fccce1d54a7-0-346425.txt`

### Event attributes Activity Log events recorded on Hyperforce include the `eventProcessedTime` attribute. This attribute represents the approximate timestamp of when the event became available in the Activity Log. For more information, see [Activity Log Site Event Type Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_schema.htm). ## Step 1. Create an AWS account If you don't already have an Amazon Web Services (AWS) account, you can [sign up for an AWS account](https://portal.aws.amazon.com/billing/signup?nc2=h_ct&src=header_signup&redirect_url=https%3A%2F%2Faws.amazon.com%2Fregistration-confirmation#/start/email) at the AWS website. ## Step 2. Create an Amazon S3 bucket and set up permissions 1. Create an Amazon S3 bucket to receive your log data. For more information, see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html) at the AWS website. 2. Configure the Amazon S3 bucket with the following settings: 1. Under Object Ownership, select ACLs disabled (recommended). This ensures that the bucket owner is the owner of all objects written to it. 2. Under Bucket Versioning, select Enable. Bucket versioning must be enabled in order to replicate objects. 3. Under Default encryption, select Enable. 4. Choose AWS Key Management Service (SSE-KMS). 5. Choose Enter AWS KMS key ARN. 6. Click the Create key button that appears to create a new AWS Key Management Service (KMS) key. **Note:** KMS multi-region keys aren't supported. 7. Select Symmetric Key type and Encrypt and decrypt Key usage. 8. Name the key with an alias, and then click through until the Review page. 9. Add this statement to the key policy Statement list. Use the [Role mapping by region](#role-mapping-by-region) table to find your region-specific role, and then replace `HYPERFORCE-IAM-ROLE`. { "Sid": "AllowTableauS3ReplicationSourceRoleToUseTheKey", "Effect": "Allow", "Principal": { "AWS": \[ "HYPERFORCE-IAM-ROLE" \] }, "Action": \[ "kms:GenerateDataKey", "kms:Encrypt" \], "Resource": "\*" } **Note:** This statement allows the Hyperforce IAM role to encrypt the objects placed in the Amazon S3 bucket. For more information, see [Using server-side encryption with AWS KMS keys (SSE-KMS)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html) at the AWS website. - "kms:GenerateDataKey" is used to generate a data key to encrypt object replicas. - "kms:Encrypt" is used to encrypt object replicas created in the target S3 bucket. - "Resource": "\*" grants permission for the KMS key only to the replication role and doesn't allow the role to elevate its permissions. 10. Click Finish to create the KMS key. 11. Click Create bucket to create the Amazon S3 bucket. 3. Update permissions on the Amazon S3 bucket policy. 1. Open the Amazon S3 bucket and click the Permissions tab. 2. Locate the Bucket policy section and click Edit. 3. Add this statement to the bucket policy Statement list. - Replace `S3-BUCKET-NAME` with the name of the bucket. - Use the [Role mapping by region](#role-mapping-by-region) table to find your region-specific role, and then replace `HYPERFORCE-IAM-ROLE`. { "Sid": "TableauS3ReplicationRoleAccess", "Effect": "Allow", "Principal": { "AWS": \[ "HYPERFORCE-IAM-ROLE" \] }, "Action": \[ "s3:ReplicateObject", "s3:ReplicateDelete" \], "Resource": \[ "arn:aws:s3:::S3-BUCKET-NAME", "arn:aws:s3:::S3-BUCKET-NAME/\*" \] } **Note:** This statement allows the Hyperforce IAM role to replicate objects into the bucket. For more information, see [Granting permissions when the source and destination buckets are owned by different AWS accounts](https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html#setting-repl-config-crossacct) at the AWS website. - Using "\*" and "/\*" grants access to all prefixes in the specified bucket and path in the bucket. - The "s3:ReplicateObject" and "s3:ReplicateDelete" permissions are the minimum permissions required to successfully replicate objects and delete markers. 4. Optional. If your destination bucket has a policy that restricts access through an Amazon Virtual Private Cloud (VPC) endpoint, you must change the bucket policy in addition to the TableauS3ReplicationRoleAccess that you just added. For more information, see [How do I allow only specific VPC endpoints or IP addresses to access my Amazon S3 bucket?](https://aws.amazon.com/premiumsupport/knowledge-center/block-s3-traffic-vpc-ip/) at the AWS website. If the current bucket policy contains a VPC restriction like this: { "Sid": "Restricted VPC Access", "Effect": "Deny", "Principal": "\*", "Action": "s3:\*", "Resource": \[ "arn:aws:s3:::S3-BUCKET-NAME", "arn:aws:s3:::S3-BUCKET-NAME/\*" \], "Condition": { "StringNotEquals": { "aws:SourceVpc": "vpc-" } } } Then edit the "Condition" list. Use the [Role mapping by region](#role-mapping-by-region) table to find your region-specific role and role ID, and then replace `HYPERFORCE-IAM-ROLE` and `HYPERFORCE-IAM-ROLE-ID`. "StringNotLike": { "aws:userId": \["HYPERFORCE-IAM-ROLE-ID:\*"\] }, "ArnNotLike": { "aws:PrincipalArn": "HYPERFORCE-IAM-ROLE" } The edited policy should look like this: { "Sid": "Restricted VPC Access", "Effect": "Deny", "Principal": "\*", "Action": "s3:\*", "Resource": \[ "arn:aws:s3:::S3-BUCKET-NAME", "arn:aws:s3:::S3-BUCKET-NAME/\*" \], "Condition": { "StringNotLike": { "aws:userId": \["HYPERFORCE-IAM-ROLE-ID:\*"\] }, "ArnNotLike": { "aws:PrincipalArn": "HYPERFORCE-IAM-ROLE" }, "StringNotEquals": { "aws:SourceVpc": "vpc-" } } } This policy explicitly allows the Hyperforce IAM role to ReplicateObject and ReplicateDelete. It also excludes the role from the existing explicit VPC deny statement. 5. Click Save changes. ## Role mapping by region Use this table to find your region-specific role and ID when configuring S3, KMS, and VPC policies.

Location		Hyperforce region	Pod (Pod name)	Hyperforce IAM role	Hyperforce IAM role ID
Asia Pacific	Australia	ap-southeast-2	prod-apsoutheast-a	arn:aws:iam::667498515984:role/prod-replication-rule-role	AROAZW2QDBYIELBSU3VDC
	India	ap-south-2	prod-in-a	arn:aws:iam::119877853097:role/prod-replication-rule-role	AROARX2KG36USNTHK2AAX
	Indonesia	ap-southeast-3	prod-apsoutheast-c	arn:aws:iam::892386869973:role/prod-replication-rule-role	AROA47RTHALKXJHOEM32G
	Japan	ap-northeast-1	prod-apnortheast-a	arn:aws:iam::349070092441:role/prod-replication-rule-role	AROAVCRRS5CM6KOVJGVDJ
	Singapore	ap-southeast-1	prod-apsoutheast-b	arn:aws:iam::005102551263:role/prod-replication-rule-role	AROAQCMBCYDP4EQ7BSYPQ
	South Korea	ap-northeast-2	prod-kr-a	arn:aws:iam::943538517075:role/prod-replication-rule-role	AROA5XL2HGRJVG2MZNCKD
Canada	Quebec	ca-central-1	prod-ca-a	arn:aws:iam::075540750887:role/prod-replication-rule-role	AROARDFUUMITZCISXK6GD
Europe	Germany	eu-central-1	dub01 (DUB01)	arn:aws:iam::337853574888:role/prod-replication-rule-role	AROAU5KNEN3UM57STAJFK
	Germany	eu-central-1	eu-west-1a (EW1A)	arn:aws:iam::337853574888:role/prod-replication-rule-role	AROAU5KNEN3UM57STAJFK
	Switzerland	eu-central-2	prod-ch-a	arn:aws:iam::623102672691:role/prod-replication-rule-role	AROAZCE6QH4Z33FOSZXGJ
	UK	eu-west-2	prod-uk-a	arn:aws:iam::112108976196:role/prod-replication-rule-role	AROARUGRXHBCNE3KR64LZ
United States - West	Oregon	us-west-2	10ax (10AX)	arn:aws:iam::675003682462:role/prod-replication-rule-role	AROAZ2KK2Z2PMO2HWNLWH
			10ay (10AY)
			10az (10AZ)
			uw2b (UW2B)
			prod-uswest-c
United States - East	Virginia	us-east-1	prod-useast-a	arn:aws:iam::792479604904:role/prod-replication-rule-role	AROA3RA3XECUCMUTXI34R
			prod-useast-b
			us-east-1 (useast-1)
			prod-useast-c

## Step 3. Configure Tableau Cloud 1. Navigate to your Tableau site. 2. On the Settings page, select the Integrations tab. 3. In the Activity Log section, select the Enable button. 4. In the Set Up Connection dialog box, enter the following information: 1. In the AWS account number box, enter your 12-digit AWS account number. This is the AWS account number associated with your Amazon S3 bucket location. 2. In the S3 bucket name box, enter the name of the Amazon S3 bucket where Activity Log files will be delivered. This is the Amazon S3 bucket you created in [Step 2. Create an Amazon S3 bucket and set up permissions](#Step2CreateS3Bucket). This must be a valid name according to AWS bucket name requirements. 3. In the KMS key ARN box, enter the KMS key Amazon Resource Name (ARN) that you created in [Step 2. Create an Amazon S3 bucket and set up permissions](#Step2CreateS3Bucket). The account number in the ARN must match the provided AWS account number, and be of valid format (i.e. arn:aws:kms:__:__:key/__). 5. Click Submit. The connection status column will show In progress as the system attempts to replicate a text file to the target Amazon S3 bucket to test the connection. After the file has been successfully replicated to the target Amazon S3 bucket, the connection status column will state Pending verification and display a widget to input 'Test file contents'. You might need to refresh the page to see updates. ## Verify security file replication 1. Go to the target Amazon S3 bucket and find the folder beginning with siteLuid (the remainder of the name is the site's unique identifier). 2. Find the text file named `SECURITY_VERIFICATION_FILE.txt`. 3. Download and open the text file. 4. Copy the text content inside the file. 5. Return to the Settings page and paste the text contents into the Text file contents input field, and then click Submit. 6. If the submitted content is correct, the connection status changes to Active. Activity Log is now enabled, and data will begin to replicate to the target Amazon S3 bucket. 7. If the submitted content is incorrect, an error message will be displayed. Check that the content was copied correctly without extra characters or spaces. ## Troubleshooting ### Security verification file not appearing? - The file could take up to 15 minutes to appear in the target Amazon S3 bucket due to Amazon S3 limitations. If the connection status says "In progress", the file is still attempting to replicate. For more information, see [Troubleshooting replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-troubleshoot.html) at the AWS website. - A connection status of Failed means that the file was unable to replicate successfully. Confirm that the permissions on the Amazon S3 bucket policy and the AWS Key Management Service (KMS) key policy contain the appropriate statements. For more information, see the following topics at the AWS website: - [Troubleshooting replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-troubleshoot.html) - [Configuring replication when source and destination buckets are owned by different accounts](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-2.html) - [I set up replication between my buckets, but new objects aren't replicating. How can I troubleshoot this?](https://help.tableau.com/v0.0/online/en-us/%3Chttps://aws.amazon.com/premiumsupport/knowledge-center/s3-troubleshoot-replication/#:~:text=To troubleshoot objects that aren,object to the source bucket.>) ### Other settings that are required for log files to reach the Amazon S3 bucket - The Amazon S3 bucket has Bucket Versioning enabled (under Properties > Bucket Versioning). - The Amazon S3 bucket has Block all public access enabled (under Permissions > Block public access (bucket settings)). - The Amazon S3 bucket has the following ACL permissions for only "Bucket owner" (under Permissions > Access Control List (ACL)): - Objects: List, Write - Bucket ACL: Read, Write - The KMS key permissions policy contains the statement in [Step 2. Create an Amazon S3 bucket and set up permissions](#Step2CreateS3Bucket), step 2. i. (under Properties > Default encryption click on the ARN under AWS KMS Key ARN to go to the KMS key policy). - The Amazon S3 bucket has default encryption enabled and bucket key enabled (under Properties > Default encryption). - The Amazon S3 bucket permissions policy (under Permissions > Bucket Policy) exactly matches the one in the instructions. Ensure that you have replaced the example value "S3-BUCKET-NAME" with the Amazon S3 bucket you just created. ### AWS region change for sites on Europe - Ireland pods Between August 2024 to March 2025, Tableau Cloud sites were migrated to Salesforce's [Hyperforce](https://help.salesforce.com/s/articleView?id=000388902&type=1). As part of the migration, pods in the Ireland region moved to the Germany region. If your site resided on a pod in the Ireland region, you'll need to reconfigure Activity Log to use an AWS S3 bucket in the new region, Germany. [Skip to main content](#main-content) # Set Up Amazon Redshift IAM Identity Center OAuth These instructions are for the newer AWS IAM IDC service. For original IAM integration see [Set Up Amazon Redshift IAM OAuth](https://help.tableau.com/v0.0/online/en-us/config_oauth_redshift_iam.htm). Depending on the identity provider, there are different steps needed to configure the integration. This is a high-level overview. Tableau cannot provide detailed instructions for how to configure AWS or the IDP, but this is the general approach. For some detailed examples of implementing authentication with Redshift, see "[Integrate Tableau and Okta with Amazon Redshift using AWS IAM Identity Center](https://aws.amazon.com/blogs/big-data/integrate-tableau-and-okta-with-amazon-redshift-using-aws-iam-identity-center/)" and "[Integrate Tableau and Microsoft Entra ID with Amazon Redshift using AWS IAM Identity Center](https://aws.amazon.com/blogs/big-data/integrate-tableau-and-microsoft-entra-id-with-amazon-redshift-using-aws-iam-identity-center/)". **Note**: Single use refresh tokens (sometimes called rolling refresh tokens or refresh token rotation) are not supported for OAuth connections using Tableau Bridge to Tableau Cloud. Support for these tokens are planned for a future release. ## Step 1: Configure the IDP 1. Create OAuth clients on the IDP for Tableau Desktop and Tableau Server or Tableau Cloud. The Desktop client should enable `PKCE` and use `http://localhost` redirects. 2. Add any required custom claims to use for authorization to roles. 3. Create the Tableau OAuth config files. See documentation on [GitHub](https://tableau.github.io/connector-plugin-sdk/docs/oauth "Documentation on GitHub for creating Tableau OAuth config files."), and [examples](https://github.com/tableau/connector-plugin-sdk/tree/master/samples/components/oauth "Examples on GitHub for creating Tableau OAuth config files."). We welcome examples for other IDPs. 1. Be sure to prefix the Tableau OAuth config IDs with "`custom_`". **Note:** Oauth config IDs have a maximum limit of 36 characters. IDs longer than this may not generate an error, but will not work. 2. If your IDP supports dynamic localhost port then disable `OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL`. If it does not, make sure to add several localhost callback URLs to the allowlist in the config file and on the IDP. 4. Install the new Tableau OAuth configuration files in the `OAuthConfigs` folder associated with each application on desktop hosts (Tableau Desktop, Tableau Prep Builder, Tableau Bridge), and on each Tableau Server and Tableau Cloud site that will be using OAuth. ## Step 2: Configure IDP and Roles on AWS See your AWS documentation for information on doing this. ## Step 3: Connect to Redshift 1. Connect to Redshift. 2. Select OAuth for Authentication. 3. Select Identity Center for Federation Type. 4. (Optional) Specify the Identity Center Namespace if necessary. ![](/tableau/next/en-us/online/en-us/Img/redshift_oauth_idc_connect.png "Redshift Connection Dialog") When correctly configured, you will be redirected to the IDP to authenticate and authorize tokens for Tableau. Tableau will receive an access token and refresh tokens. It will send the access token to the driver for authentication. ## Tokens By default Redshift OAuth to IAM IDC passes the access token to the driver. For on-premise customers, including those using Tableau Bridge, you may use a TDC file to pass the ID token instead. For more information about configuring and installing .tdc files, see [Customize and Tune a Connection](https://help.tableau.com/current/pro/desktop/en-us/connect_customize.htm) and [Using a .tdc File with Tableau Server](https://help.salesforce.com/s/articleView?id=001458291&type=1). ## Okta If you are using Okta, it's better to use a "custom authorization server" instead of the "org authorization server." The custom authorization servers are more flexible. A custom authorization server is created by default and called "default". The authorization URL should look like this: https://${yourOktaDomain}/oauth2/{authServerName}/v1/authorize ![](/tableau/next/en-us/online/en-us/Img/redshift_oauth_idc_okta_800x332.png) ## Update the driver For Redshift OAuth using the IAM IDC service, you need to use at least version 2.x of the ODBC driver. Download the latest version of the Redshift ODBC driver found on [https://github.com/aws/amazon-redshift-odbc-driver/tags](https://github.com/aws/amazon-redshift-odbc-driver/tags "Driver download for Redshift ODBC version 2"). Note that there is no v2 driver yet for OSX. ## Troubleshooting Redshift IAM IDC OAuth The best way to diagnose errors is to remove Tableau from the picture. You can instead test using the driver manager or a similar tool. This is just for troubleshooting - you shouldn't use a DSN or the "Other ODBC" connector for regular usage of this feature. To help ensure a valid test, the parameters should be the same as shown below, except for the cluster information, database, token, and namespace. If you see an error message about invalid/expired token coming from the driver on the first connection (it will have a SQLState error code like \[28000\] or \[08001\] in the error message), then Tableau successfully completed the OAuth flow, and failed in the driver. This means there is a misconfiguration on either the AWS side or the IDP side. There may also be permissions or authorization errors returned from the driver, which is also out of Tableau's control. Before you begin testing, you first need to get an access token (the default for IAM IDC) or refresh token (if customized) to send to the driver. Here is an example with Okta. Almost all IDPs have a way to do this which is quite similar. Note that to use this flow you need to have enabled resource owner password grant type. Substitute the IDP URL, client secret, client ID, username, and password. curl -X POST "https://OKTA\_URL/v1/token" \\ \-H 'accept: application/json' \\ \-H "Authorization: Basic $(echo -n 'CLIENTID:CLIENTSECRET' | base64)" \\ \-H "Content-Type: application/x-www-form-urlencoded" \\ \-d "grant\_type=password&username=USER&password=PASSWORD&scope=openid" Once you have the token, you can use a DSN to test. For Windows, you can use the ODBC driver manager. On Linux you can use the isql command line tool that is included with Tableau Server in the customer-bin folder. Tableau recommends you do not use other plugins to test, because they may not work in a server environment. They either use a fixed AWS profile, or require direct access to a browser. Below is an example of using the ODBC driver manager on Windows. ![](/tableau/next/en-us/online/en-us/Img/redshift_oauth_idc_troubleshoot.png) [Skip to main content](#main-content) # Set Up Amazon Redshift IAM OAuth These instructions are for the older AWS IAM service. For IAM IDC integration see [Set Up Amazon Redshift IAM Identity Center OAuth](https://help.tableau.com/v0.0/online/en-us/config_oauth_redshift_iam_idc.htm). Depending on the identity provider, there are different steps needed to configure the integration. This is a high-level overview. Tableau cannot provide detailed instructions for how to configure AWS or the IDP, but the general approach is described below. **Note**: Single use refresh tokens (sometimes called rolling refresh tokens or refresh token rotation) are not supported for OAuth connections using Tableau Bridge to Tableau Cloud. Support for these tokens are planned for a future release. ## Step 1: Configure the IDP 1. Create OAuth clients on the IDP for Tableau Desktop, and Tableau Server or Tableau Cloud. The Desktop client should enable `PKCE` and use `http://localhost` redirects. 2. Add custom claims to use for authorization to roles. In particular, if you are using original IAM, you may want to add claims for `DbUser` and `DbGroups`. These can be used in your IAM policies later. 3. Create the Tableau OAuth config files. See documentation on [GitHub](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth documentation on GitHub"), and examples [here](https://github.com/tableau/connector-plugin-sdk/tree/master/samples/components/oauth "OAuth examples on GitHub."). We welcome examples for other IDPs. 1. Be sure to prefix the Tableau OAuth config IDs with "`custom_`". **Note:** Oauth config IDs have a maximum limit of 36 characters. IDs longer than this may not generate an error, but will not work. 2. If your IDP supports dynamic localhost port then disable `OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL`. If your IDP does not support this, make sure to add several localhost callback URLs to the allowlist in the config file and on the IDP. 4. Install the new Tableau OAuth configuration files in the `OAuthConfigs` folder associated with each application on desktop hosts (Tableau Desktop, Tableau Prep Builder, Tableau Bridge), and on each Tableau Server and Tableau Cloud site that will be using OAuth. ## Configure IDP on AWS 1\. Create the IDP model on the AWS. See Amazon docs [Web Identity Federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html "AWS documentation on Web Identity Federation") and [Create OIDC Identity Provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html "AWS documentation on creating OIDC Identity Provider"). 2\. Create roles and policies specifically for the IDP. See [Create Role for OIDC](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html "AWS documentation for creating roles for OIDC") in the AWS docs. ## Configure Roles for Redshift Users Attach the policies needed for Redshift. You may use custom claims from the token to authorize to roles. There are several examples with SAML in [the AWS documentation](https://docs.aws.amazon.com/redshift/latest/mgmt/options-for-providing-iam-credentials.html "AWS documentation for providing IAM credentials"). These can be easily adapted to OAuth. In the case of OAuth, the claims are just "`DbUser`", "`DbGroups`", etc. Here is an example of the policy from the AWS documentation: { "Version": "2012-10-17", "Statement": \[ { "Effect": "Allow", "Action": "redshift:GetClusterCredentials", "Resource": \[ "arn:aws:redshift:us-west-1:123456789012:dbname:cluster-identifier/dev", "arn:aws:redshift:us-west-1:123456789012:dbuser:cluster-identifier/${redshift:DbUser}", "arn:aws:redshift:us-west-1:123456789012:cluster:cluster-identifier" \], "Condition": { "StringEquals": { "aws:userid": "AROAJ2UCCR6DPCEXAMPLE:${redshift:DbUser}@example.com" } } }, { "Effect": "Allow" "Action": "redshift:CreateClusterUser", "Resource": "arn:aws:redshift:us-west-1:12345:dbuser:cluster-identifier/${redshift:DbUser}" }, { "Effect": "Allow", "Action": "redshift:JoinGroup", "Resource": "arn:aws:redshift:us-west-1:12345:dbgroup:cluster-identifier/my\_dbgroup" }, { "Effect": "Allow", "Action": \[ "redshift:DescribeClusters", "iam:ListRoles" \], "Resource": "\*" } \] } ## Connect to Redshift The user must specify the role ARN to assume, and select the OAuth config installed earlier. ![](/tableau/next/en-us/online/en-us/Img/redshift_oauth__iam_connect.png) When properly configured, the user will be redirected to the IDP to authenticate and authorize tokens for Tableau. Tableau will receive openid and refresh tokens. AWS is able to validate the token and signature from the IDP, extract the claims from the token, look up the mapping of claims to IAM role, and either permit or block Tableau from assuming the role on the user's behalf. (in other words, [AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html "AWS documentation for AssumeRoleWithWebIdentity")). ## Tokens By default Redshift OAuth IAM passes the ID token to the driver. For on-premise customers, including those using Tableau Bridge, you may use a TDC file to pass the access token instead. For more information about configuring and installing .tdc files, see [Customize and Tune a Connection](https://help.tableau.com/current/pro/desktop/en-us/connect_customize.htm) and [Using a .tdc File with Tableau Server](https://help.salesforce.com/s/articleView?id=001458291&type=1). ## About Group Federation When using OAuth authentication with an IAM Role, you can select whether or not you are using Group Federation. This will change how the connector interacts with the authentication API to interface with Redshift. - When the Group Federation box (available in versions 2025.1 and beyond) is checked while connecting, the Redshift driver will use the `[getClusterCredentialsWithIAM](https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetClusterCredentialsWithIAM.html)` API for obtaining the credentials in provisioned clusters. - When the Group Federation box is not checked, the `[getClusterCredentials](https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetClusterCredentials.html)` API will be used instead. These two APIs will return IAM tokens with slightly different properties. For more information, consult the AWS API documentation linked above, and [ODBC driver options](https://docs.aws.amazon.com/redshift/latest/mgmt/odbc20-configuration-options.html "Information on configuring ODBC 2.0 with AWS"). #### Usage Notes - For Tableau Desktop and Tableau Prep Builder before version 2024.3, this can be set in the advanced driver configuration field using 'group\_federation=1'. It can also be configured by using a TDC file to define custom connection properties. For more information on using a TDC, see [Customize and Tune a Connection](https://help.tableau.com/current/pro/desktop/en-us/connect_customize.htm). - Starting in version 2024.3, there is a group\_federation field in the connection dialog for on-premise (Tableau Desktop, Tableau Prep Builder, and Tableau Server). This will be available in Tableau Cloud starting in 2025.1 (Available in February 2025). - To use Group Federation with Tableau Server, group\_federation must be added to the ODBC extras allowlist. For more information, see [Customize Connection String for Native Connectors](https://help.tableau.com/current/pro/desktop/en-us/connect_string_custom.htm). ## Okta If using Okta it's better to use a "custom authorization server" rather than the "org authorization server." The custom authorization servers are more flexible. There is a custom authorization server created by default, which is called "default". The authorization URL should look like this: https://${yourOktaDomain}/oauth2/{authServerName}/v1/authorize ![](/tableau/next/en-us/online/en-us/Img/redshift_oauth_iam_okta_800x332.png) ## Update Driver For Redshift OAuth using the original IAM service, you may use either: - Redshift ODBC v1 driver starting with version 1.59, which can be downloaded from [https://docs.aws.amazon.com/redshift/latest/mgmt/configure-odbc-connection.html](https://docs.aws.amazon.com/redshift/latest/mgmt/configure-odbc-connection.html "Download Redshift ODBC V1 driver from Amazon"). - Redshift ODBC v2 driver starting with version 2.0.1.0, which can be downloaded from [https://github.com/aws/amazon-redshift-odbc-driver/tags](https://github.com/aws/amazon-redshift-odbc-driver/tags "Download the Redshift ODBC V2 driver from Amazon"). Note there is no v2 driver for OSX. ## Troubleshooting The best way to diagnose errors is to remove Tableau from the picture. You can instead test using the driver manager or a similar tool. This is just for troubleshooting - you shouldn't use a DSN or the "Other ODBC" connector for regular usage of this feature. To help ensure a valid test, the parameters should be the same as shown below, except for the cluster information, database, token, and namespace. **Note:** Don't specify DbUser or DbGroups in the connection string of the DSN when testing because Tableau does not have access to these and cannot include them in the connection string. You may include it in the token claims. If you see an error message about invalid/expired token coming from the driver on the first connection (it will have a SQLState error code like \[28000\] or \[08001\] in the error message), then Tableau successfully completed the OAuth flow, and failed in the driver. This means there is a misconfiguration on either the AWS side or the IDP side. There may also be permissions or authorization errors returned from the driver, which is also out of Tableau's control. Before you begin testing, you first need to get an access token (the default for IAM IDC) or refresh token (if customized) to send to the driver. Here is an example with Okta. Almost all IDPs have a way to do this which is quite similar. Note that to use this flow you need to have enabled resource owner password grant type. Substitute the IDP URL, client secret, client ID, username, and password. curl -X POST "https://OKTA\_URL/v1/token" \\ \-H 'accept: application/json' \\ \-H "Authorization: Basic $(echo -n 'CLIENTID:CLIENTSECRET' | base64)" \\ \-H "Content-Type: application/x-www-form-urlencoded" \\ \-d "grant\_type=password&username=USER&password=PASSWORD&scope=openid" Once you have the token, you can use a DSN to test. For Windows, you can use the ODBC driver manager. On Mac you can use the iODBC driver manager UI. On Linux you can use the isql command line tool that is included with Tableau Server in the customer-bin folder. The plugins that use a fixed AWS profile won't work unless you want to use the same profile for all users for that connection. The other OAuth plugins require direct access to the system browser, which doesn't work on the server side. Below is an example of using the ODBC driver manager on Windows. ![](/tableau/next/en-us/online/en-us/Img/redshift_oauth_iam_troubleshoot.jpg) [Skip to main content](#main-content) # Set Up for Data-Driven Alerts When data reaches important thresholds for your business, data-driven alerts automatically send email notifications to key people users specify. As a Tableau Cloud administrator, you set up data-driven alerts much like you do subscriptions. For information about how users create and manage these alerts, see [Send Data-Driven Alerts](https://help.tableau.com/current/pro/desktop/en-us/help.htm#data_alerts.htm) in Tableau User Help. ## Manage all data-driven alerts in a site 1. At the top of the browser window, click Tasks, and then click Alerts. 2. Select any alerts you want to update. 3. From the Actions menu, do any of the following: - Add or remove yourself as a recipient. - Edit alerts to change data thresholds, delivery schedules, and the full list of recipients. - Change alert ownership to different users, or delete alerts. ## Disable data-driven alerts for a site Data-driven alerts are supported for all sites by default, but administrators can disable them for specific ones. 1. While viewing a site, click Settings on the left-side navigation pane. 2. Under Data-Driven Alerts, uncheck Let users create alerts and receive alert emails. 3. Click Save. ## Suspend data-driven alerts ### Resume suspended alerts If an alert fails enough times, you'll receive a notification email that your alert has been suspended. There are a few ways that administrators or alert owners can resume a suspended alert: - From the Tasks > Alerts area of Tableau web pages, an ![Suspend data alerts icon.](/tableau/next/en-us/online/en-us/Img/suspend.jpg) icon appears in the Last checked column to indicate that the alert is suspended. Select ... > Resume Alert to resume the alert. - Click **Resume Alert** in the notification email to resume the alert. A notification will either allow you to resume the alert, or indicate that the view has changed and the alert should be deleted. - From the Alerts panel of the affected view or workbook. To resume the alert from a view or workbook, select **Alert** to open the Alerts panel. An icon appears next to the suspended alert. Select Actions > Resume Alert on the affected alert to resume. Alert owners will receive an email notification when the alert is working again. ## Identify and fix failing alerts As an administrator, you can proactively identify failing alerts that users may be unaware of. To check: 1. Select Status in your site menu. 2. Select Background tasks for non-extracts. 3. From the Task dropdown menu, select Check if Data Alert is True. 4. In the far right, click Error to see a list of failing alerts. 5. Hover over the red failure icon to display a tooltip with alert details. To determine the alert owner, look for the alert ID number in the [data\_alerts table](https://help.tableau.com/current/server/en-us/data_dictionary.htm#data_alerts_anchor) of the Tableau Cloud Repository. (In the [alert management](#Manage) area of a site, you can also look for the alert name following the number, but be aware that multiple different alerts may use the same name.) **Note:** Alert owners are automatically notified when an alert fails ten times. Administrators can customize when alert owners receive notifications. ![A check data alert with information about the alert and the data alert ID highlighted.](/tableau/next/en-us/online/en-us/Img/alert_failure.png) Failing alerts are often caused by content changes on Tableau Cloud. Encourage users to recreate alerts if changes like the following occur: - A workbook, view, or data field is removed or renamed. - Database credentials embedded in workbooks expire. - Data Driven Alerts require embedded credentials for Live Connections, the use of OAuth isn't currently supported with Alerts. - A data source becomes inaccessible. [Skip to main content](#main-content) # Set Up for Metrics **Retirement of the legacy metrics feature** Tableau's legacy metrics feature was retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. In October 2023, Tableau retired the ability to embed legacy metrics in Tableau Cloud and in Tableau Server version 2023.3. With Tableau Pulse, we've developed an improved experience to track metrics and ask questions of your data. For more information, see [Create Metrics with Tableau Pulse](https://help.tableau.com/current/online/en-us/pulse_create_metrics.htm) to learn about the new experience and [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/current/online/en-us/metrics_create.htm) for the retired feature. Metrics are a type of Tableau content that tracks the value of an aggregate measure, such as sum of sales. Because metrics refresh frequently and display their current value in an easy-to-glance format, they are useful for monitoring data. To learn more about how users work with metrics, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/v0.0/online/en-us/metrics_create.htm). ## Ensure that users can create metrics When metrics are enabled for a site, all users with a Creator or Explorer (can publish) site role can create metrics, if they have the correct permissions. Metrics are created from existing views on a Tableau site. To ensure that users can create metrics on a view, verify that: - Users have the Create/Refresh Metrics permission capability for the workbook that the view belongs to. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). - The password for the data source is embedded, if it is required. For more information, see [Edit Connections on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_connections_modify.htm). ## Disable metrics for a site Metrics are enabled on all sites by default. You can disable metrics on a per-site basis. 1. On the site where you want to disable metrics, from the navigation panel, click Settings. 2. Under Metrics Content Type, uncheck Enable metrics. 3. Click Save. When you disable the metrics content type, metrics no longer appear on the site. The data for any existing metrics is retained, but these metrics will no longer refresh. If you re-enable metrics, these metrics will reappear and resume refreshing. You can also disable metrics on a specific workbook by denying the Create/Refresh Metrics permission capability. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). ## Manage metrics Though metrics are created from a view, they are not tied to the view like alerts or subscriptions. This means you can manage metrics similar to how you manage workbooks, by renaming, moving, tagging, deleting, or setting permissions on a metric. Find metrics to manage either by navigating the project hierarchy or via the following paths. - To see all metrics on a site: Navigate to the Explore section, then select All Metrics. - To see metrics created from all the views in a workbook: Navigate to the workbook, then select the Connected Metrics tab. - To see metrics created from a single view: Open the view, then select Watch > Metrics from the toolbar. ## Address failing and suspended metric refreshes Metric refreshes may fail for one of the following reasons. - The connected view was deleted or modified. - Permissions changed for the connected view. - The password for the data source is no longer embedded or is no longer valid. - The metric owner doesn’t have the required site role to refresh the metric. A site role of Creator or Explorer (can publish) is required. - There was a temporary connectivity issue, which will resolve itself. **Note:** If the metric refresh is suspended because the owner doesn’t have the required site role for it to refresh, you won’t be able to resume the refresh unless you change the owner. For more information on why metric refreshes fail and what users can do to fix them, see [Fix failing refreshes](https://help.tableau.com/v0.0/online/en-us/metrics_create.htm#fix-failing-refreshes). Encourage users to overwrite a metric if the connected view was modified in a way that caused the refresh to fail, but the view is still available. Users can overwrite a metric by creating a metric with the same name in the same project as the existing metric. ### Resume suspended refreshes If the cause of the failure is fixed, for example by embedding the correct password for the data source, you can resume the metric refresh. 1. Locate the affected metric. Metrics with suspended refreshes display the text Refresh Suspended, instead of the time of last refresh, in grid and list view. 2. On the warning message, click Resume refresh. Tableau attempts to perform the refresh. If this attempt succeeds, you’ll receive a confirmation, and the refresh will resume on schedule. If the attempt doesn’t succeed, the refresh remains suspended. You or the metric owner can delete or overwrite the metric, or keep it to reference historical data. ## Monitor metric activity with administrative views Use the administrative views for Tableau Cloud to monitor metric activity. To monitor metric refresh activity: 1. From the navigation panel, click Site Status. 2. Select the Background Tasks for Non Extracts dashboard. 3. Filter for the tasks Find Metrics to Update or Update All Metrics on a View. For more information, see [Background Tasks for Non Extracts](https://help.tableau.com/v0.0/online/en-us/adminview_backgrnd_nonextract.htm). To monitor more metric events, create a custom view using Admin Insights. Connect to the Admin Insights **TS Events** data source and use the **Event Name** dimension to see the following events: Create Metric, Delete Metric, Move Metric From, Move Metric To, and Update Metric. For more information, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). [Skip to main content](#main-content) # Set up Private Connect for AWS Private Connect for AWS (Amazon Web Services) allows cloud administrators to create secure, private, and dedicated connections between Tableau Cloud and AWS-hosted data providers. These private connections are provisioned on top of AWS PrivateLink, using private IP address space, meaning that data traffic doesn't traverse the public internet. The private and secure nature of private connections addresses a key requirement of restricting data traffic to private networks. As a cloud administrator, you can create private connections and assign them to sites. They can also provide connection information to creators and the groups that support them. To learn more about setting up Private Connect, see [Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect.htm). [Skip to main content](#main-content) # Set Up the Pulse for Salesforce App > [!IMPORTANT] > > As of August 1, 2025, Pulse for Salesforce is no longer available for net-new sales. Pulse for Salesforce capabilities are available only if you previously purchased the app. [Tableau Next](https://www.tableau.com/products/tableau-next) gives your organization access to agentic analytics fully integrated with the Salesforce Platform, including many of the core capabilities of Pulse for Salesforce, like metric summaries. The Pulse for Salesforce app integrates Tableau Pulse with your Salesforce data. With the app, your users can explore metrics about their data and get insights directly in Salesforce. For more information about Tableau Pulse, see [About Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_about.htm). The app automates the process of connecting Tableau with Salesforce. To set up the app, you must complete steps in both your Salesforce org and on your Tableau site. After a connection is established between Salesforce and Tableau, the app prepares your data then creates metrics for sales, opportunities, and more. Users assigned to the correct permission set can access these metrics embedded in Salesforce. ## Complete Tableau Cloud prerequisites ### Set up your Tableau Cloud site 1. Follow the instructions in the Tableau Cloud activation email to create a site. 2. Copy your Site Name and URL, and paste them in a safe location. You’ll need these to set up the Pulse for Salesforce app. ### Set the authentication type to Salesforce 1. From the navigation panel on your Tableau site, select Settings. 2. Select the Authentication tab. 3. Under Authentication types, select Enable an additional authentication method. 4. For Authentication, select Salesforce. 5. Under Default authentication type for embedded views, select Salesforce. You can use the Salesforce Authenticator app for multi-factor authentication. For more information, see [Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_security_mfa.htm). ### Turn on Tableau Pulse and AI in Tableau Make sure that the site settings for Tableau Pulse and AI in Tableau are turned on for your Tableau site. 1. Turn on Tableau Pulse. See [Deploy Tableau Pulse for your site](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#site-setting). 2. Turn on AI in Tableau. See [AI in Tableau for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-ai). ### Create a personal access token 1. To turn on the personal access token setting for your Tableau site, go to site settings and follow the instructions on [Site settings for personal access tokens](https://help.tableau.com/v0.0/online/en-us/security_personal_access_tokens.htm#Site). 2. To create a token, go to your account settings and follow the instructions on [Create a personal access token](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm#Create). 3. Copy the Token Name and Secret, and paste them in a safe location. You’ll need these to set up the Pulse for Salesforce app. ### Create a connected app A connected app allows for seamless embedding of Tableau Pulse metrics in Salesforce. For more information about connected apps, see [Configure Connected Apps with Direct Trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_direct.htm). 1. From the navigation panel, select Settings. 2. Select the Connected Apps tab. 3. Select New Connected App > Direct Trust. 4. For Connected app name, enter a descriptive name. 5. For Access level, select All projects. 6. For Domain allowlist, select All domains. 7. Select Create. 8. Select Generate New Secret. 9. Copy the Secret ID, Secret Value (select the eye icon to reveal the value), and Client ID, and paste them in a safe location. You’ll need these to set up the Pulse for Salesforce app. ## Install the app package in Salesforce The Pulse for Salesforce app is a managed package that you install in your Salesforce org. 1. While signed in to your Salesforce org as a Salesforce admin, open the Pulse for Salesforce package. The link to this package was sent to you when you purchased the Pulse for Salesforce app. 2. Select Install for Admins Only. 3. Select Install. 4. On the Approve Third-Party Access dialog, select Yes, grant access to these third party web sites. 5. Select Continue. The Pulse Installation Wizard is installed in your org. > [!IMPORTANT] > > If the language setting for your Salesforce admin account is set to a language other than English, you must temporarily change your personal language setting to English to install the app. To learn how, see [Change Language in Salesforce](https://help.salesforce.com/s/articleView?id=000385317&type=1). After you set up the app, change the language setting back to your preferred language. ## Complete Salesforce prerequisites ### Assign users to the permission set **Tip:** While you set up the app, consider limiting the permission set to a small number of users. After you’ve finished customizing the app, give access to the rest of your users, then re-sync the app. For more information, see [Sync access to the Tableau Pulse app](#sync-access). If you need to implement row-level security to protect your data, add only admins to the permission set during setup. Salesforce access control doesn't carry over to Tableau Cloud, so the users you add have access to all the data in the metrics until you implement additional security measures. The Pulse app creates a permission set called “Pulse for Sales Cloud” in Salesforce. Assign the permission set to the users who should have access to the app. To learn how, see [Manage Permission Set Assignments](https://help.salesforce.com/s/articleView?id=sf.perm_sets_manage_assignments.htm&type=5). The users you add to this permission set have access to the Tableau Pulse app when you sync the app. At a minimum, add yourself to the permission set. ### Add Tableau as a remote site URL 1. Visit your Tableau site to identify the correct URL. Your URL should look like `https://us-west-2a.online.tableau.com/#/site/my-site/home`. You’ll add the part of the URL that begins with https, and ends with .com, for example: `https://us-west-2a.online.tableau.com` 2. Navigate to your Salesforce Setup page. 3. In the Quick Find box, enter `Remote Site Settings`, and then select Remote Site Settings. For more information, see [Configure Remote Site Settings](https://help.salesforce.com/s/articleView?id=sf.configuring_remoteproxy.htm&type=5). 4. For Remote Site Name, enter a descriptive name. 5. For Remote Site URL, enter the URL that you identified in step 1. 6. For Disable Protocol Security, don’t select the checkbox. 7. For Active, leave the checkbox selected. 8. Select Save. ### Add Tableau as a trusted URL for redirects 1. Navigate to your Salesforce Setup page. 2. In the Quick Find box, enter `Trusted URLs for Redirects`, and then select Trusted URLs for Redirects. For more information, see [Manage Redirections to External URLs](https://help.salesforce.com/s/articleView?id=sf.security_external_redirects.htm&type=5). 3. Select New. 4. Enter the same URL that you added as a remote site. 5. Select Save. ## Set up the Pulse for Salesforce app Before you set up the app, you must install the managed package for the app in your Salesforce org. If you haven't yet installed the package, see [Install the app package in Salesforce](#install). **Note:** The Pulse installation wizard is available in the languages that Tableau supports. For the current list of languages, see [Tech Specs for Tableau Cloud](https://www.tableau.com/products/techspecs). For languages that are supported by Salesforce but aren't supported by Tableau, the wizard falls back to English. 1. In the Salesforce App Launcher, search for the Pulse Installation Wizard and open it. 2. Select Get Started. 3. Enter your Tableau site information. If you don’t have this information, see [Complete Tableau Cloud prerequisites](#tableau-prereq). 1. For Tableau Site Name, enter the name displayed after /site/ in your Tableau Cloud URL. For the example URL `https://us-west-2a.online.tableau.com/#/site/my-site/home`, you would enter `my-site`. 2. For Tableau Site URL, enter the part of the URL that begins with https and ends with .com, for example: `https://us-west-2a.online.tableau.com` 3. For Personal Access Token (PAT) Name, enter the name of the token that you saved when you created the PAT. See [Create a personal access token](#PAT). 4. For Personal Access Token (PAT) Secret, enter the secret that you saved when you created the PAT. 5. For Data Source Refresh Time, select the time each day when your data should refresh on Tableau Cloud. This time setting uses the time zone set on your Tableau site. 6. For Select Cloud, choose the cloud that the Pulse app connects to for the metric data. 4. Select Test Connection. The Pulse app validates the site information you added. 5. For Sync Users, acknowledge the message about syncing users, then select Sync Users. The users in the “Pulse for Sales Cloud” permission set are added to your Tableau site. 6. For Create Pulse Metrics, select Publish. The Pulse for Salesforce app creates the data sources, flow, and metrics based on your data. 7. For Embed Your Pulse Metrics, enter the Client ID, Secret ID, and Secret Value that you noted when you created the connected app in Tableau. See [Create a connected app](#connected-app). 8. For Update Tableau Cloud Credentials, follow the instructions under [Embed credentials for your data in Tableau](#embed-credentials). Then select Next. 9. Select Finish. ## Enable connected apps in Tableau The Pulse for Salesforce app creates a connected app, in addition to the connected app that you created under the step [Create a connected app](#connected-app). Enable these apps so that Tableau Pulse can be embedded in Salesforce. 1. From the Tableau Cloud navigation panel, select Settings. 2. Select the Connected Apps tab. 3. For the app that you created, from the Actions (...) menu, select Enable. ![Enable action for connected apps](/tableau/next/en-us/online/en-us/Img/pulse_connected_app.png) 4. Also enable the connected app called “TableauPulseForSalesCloud.” This is the app that the Pulse for Salesforce app created. ## Embed credentials for your data in Tableau The app automatically creates Tableau data sources and a flow to get your data ready for Tableau Pulse. Embed your credentials so that Tableau can connect to your data. ### Embed credentials for the flow 1. From the Tableau Cloud navigation panel, select Explore. 2. In the content type menu, select All Flows. ![Content type menu](/tableau/next/en-us/online/en-us/Img/pulse_explore_flows.png) 3. From the Actions (...) menu for the flow called “Open Pipe,” select Edit Flow. ![Edit flow action](/tableau/next/en-us/online/en-us/Img/pulse_edit_flow.png) 4. Under Connections, select the Salesforce connection. 5. Enter the credentials for the connection, then accept the prompt to allow access. 6. Wait as Tableau connects to your org and resolves any errors in your flow. This should take less than a minute. ### Edit and run the flow Edit the final step of the flow so that the output goes to the correct location for the Pulse for Salesforce app. For more information about working with flows, see [Build and Organize your Flow](https://help.tableau.com/current/prep/en-us/prep_build_flow.htm). 1. Right click on the Output step for the flow, then select Remove. ![Remove flow step](/tableau/next/en-us/online/en-us/Img/pulse_remove_flow_step.png) 2. Select the + after the final step, then select Output. ![Add flow step](/tableau/next/en-us/online/en-us/Img/pluse_add_flow_step.png) 3. For the Output step: 1. For the Project, select Pulse for SalesCloud. 2. For the Name, enter Open Pipe Datasource. The name of the output must be exactly that, or the metrics won’t get the data they need. 3. Under Full Refresh, select Append to table. 4. In the upper-right corner of the screen, select Publish. 5. When asked to embed credentials for every connection, check the Embed credentials box. 6. On the notification message, select View Flow. 7. On the flow page, select Run All. ![Run flow button](/tableau/next/en-us/online/en-us/Img/pulse_run_flow.png) ### Embed credentials for the data source 1. From the Tableau Cloud navigation panel, select Explore. 2. In the content type menu, select All Data Sources. 3. From the Actions (...) menu for the data source called “Sales Cloud Metrics Datasource,” select Edit Connection. 4. Select Embed Salesforce credentials in the connection, then select your Salesforce account. 5. Select Save. ### Refresh the data source extract 1. From the Actions (...) menu for the data source called “Sales Cloud Metrics Datasource,” select Refresh Extracts Now. 2. Select Full Refresh. ## Check the app in Salesforce The Pulse for Salesforce app automatically creates a set of metrics based on your Salesforce data. | Metric | Description | | --- | --- | | Average Days to Close - Won | Average time it takes to win an opportunity | | Closed Opportunities (Running Total) | Number of opportunities that are closed | | Conversion Rate | Share of the amount of opportunities won in relation to the amount of all closed opportunities (expressed as a percentage) | | Created Opportunities (Running Total) | Total number of opportunities | | Open Pipe (Daily) | Sum of opportunity amount for open opportunities for today | | Open Pipe (Weekly) | Sum of opportunity amount for open opportunities for this week | | Pipe Gen (Running Total) | Sum of opportunity amount for open opportunities (IsClosed = false) by time dimension of Created Date | | Total Sales | Sum of opportunity amount for won opportunities by time dimension of Close Date | | Win Rate | Share of the number of won opportunities in relation to the number of all closed opportunities (expressed as a percentage) | 1. To make sure that the app is working as expected, in the Salesforce App Launcher, search for Pulse. Users who are assigned to the Pulse for Salesforce permission set can view this app in Salesforce. 2. Open the Pulse app. 3. Select a metric to open its insights exploration page. 4. Make sure that your data appears as expected. The chart might be empty if it’s the first day of the time period displayed. 5. If you initially limited the users who can access the Pulse app, after you’ve checked the metrics, add additional users to the permission set, then re-sync the app. For more information, see [Control access](#control-access). ## Customize the metrics You can customize the metrics that the Pulse for Salesforce app creates by editing the metric definitions that they’re based on, and you can create additional metrics by adjusting the filters. Edits must be made on your Tableau Cloud site. You can’t edit the metric definitions through the Pulse for Salesforce app. **Tip:** If you want to create metrics from scratch using different data, see [Create Metrics with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm). ### Access metrics in Tableau Pulse 1. From the Tableau Cloud navigation panel, select Tableau Pulse. 2. Select Browse Metrics to see all metric definitions. 3. Select a definition to see the metrics based on that definition. Metric definitions contain the core metadata for metrics. Edits made to a metric definition affect all metrics that are based on that definition. For more information about the relationship between metric definitions and metrics, see [Metric definitions and metrics](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#Metric). ### Change the measure, time dimension, or definition filters The measure and time dimension are the key components of a metric definition’s value, and definition filters are optional limits to that value. Edit the metric definition to change these fields. For more information about the key components of a metric definition, see [Define the metric value](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#Define). Note that if you want to adjust the time range for a metric without changing the field used as the time dimension, you can simply filter an existing metric. For more information, see [Create additional metrics](#additional-metrics). 1. In Tableau Pulse, open the metric that you want to change. 2. Select the actions (...) menu, then select Edit Definition. ![Edit definition button](/tableau/next/en-us/online/en-us/Img/pulse_edit_definition.png) 3. For Measure, Time dimension, or Definition filters, select a different field from the data source. If you don’t see the field you want to add, see [Include more fields from your Salesforce data](#more-fields). ![Time dimension selector](/tableau/next/en-us/online/en-us/Img/pulse_time_dimension.png) 4. Select Save Definition. **Tip:** If you need to combine data from multiple fields, see [Create an advanced definition](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#advanced). The advanced editor lets you create calculated fields. For more information about calculated fields, see [Get Started with Calculations in Tableau](https://help.tableau.com/current/pro/desktop/en-us/calculations_calculatedfields_create.htm). ### Change metric names The name shown on a metric is the name of its definition. You can change this name by editing the definition. 1. In Tableau Pulse, open the metric that you want to rename. 2. Select the actions (...) menu, then select Edit Definition. ![Edit definition button](/tableau/next/en-us/online/en-us/Img/pulse_edit_definition.png) 3. For Name, enter a new name. 4. Select Save Definition. ### Change insight dimensions Insight dimensions are the fields that Tableau Pulse uses to generate insights about your data. The Pulse for Salesforce app automatically adds a set of insight dimensions to your metrics, and you can add more to look at other dimensions in your data. In addition to being used in insights, these dimensions are available as filters and in the question-and-answer experience on a metric’s insights exploration page. 1. In Tableau Pulse, open the metric that you want to change. 2. Select the actions (...) menu, then select Edit Definition. ![Edit definition button](/tableau/next/en-us/online/en-us/Img/pulse_edit_definition.png) 3. Under Adjustable metric filters, select Add Filter Option. The adjustable metric filters are used as insight dimensions. 4. Select the fields that you want to add. 5. Select Save Definition. ### Change currency format By default, metrics show currency in the format of US Dollars. Adjust the currency setting to change the number format and currency symbol. 1. In Tableau Pulse, open the metric that you want to change. 2. Select the actions (...) menu, then select Edit Definition. ![Edit definition button](/tableau/next/en-us/online/en-us/Img/pulse_edit_definition.png) 3. Under Number format, make sure that Currency is selected. 4. Under Currency, select a currency code. ### Include more fields from your Salesforce data Each metric definition is connected to a data source, which is the link between your data and Tableau. The Pulse for Salesforce app automatically creates data sources based on your Salesforce data and uses these when creating metric definitions. If the field that you want to add as a measure or dimension isn’t available when you go to edit a metric definition, edit the data source or flow to add it. After you edit the data source or flow, edit the relevant metric definitions and replace the pre-existing fields with the newly added fields. The data source called “Sales Cloud Metrics Datasource” supplies the data for the following metrics: - Average Days to Close - Won - Closed Opportunities (Running Total) - Conversion Rate - Created Opportunities (Running Total) - Pipe Gen (Running Total) - Total Sales - Win Rate The flow called “Open Pipe” and the data source called “Open Pipe Data source” provide the data for the following metrics: - Open Pipe (Daily) - Open Pipe (Weekly) The Pulse for Salesforce app brings in data from the User, Account, and Opportunity Salesforce objects. If you need data from different objects, make sure that they include equivalents for the fields in the following table. | Salesforce object | Fields | | --- | --- | | User | Id, Name | | Account | Id, Name, BillingState, BillingCountry, Industry | | Opportunity | Id, AccountId, Amount, OwnerId, CreatedById | **Tip:** If you need entirely different data from what is included in the prebuilt data source, use the Salesforce connector to create a new published data source. For more information about connecting to Salesforce data, see [Salesforce CRM](https://help.tableau.com/current/pro/desktop/en-us/examples_salesforce.htm). If your organization uses a platform like Snowflake to store your data, connect directly to that data platform. For more information, see [Use Supported Connectors](https://help.tableau.com/current/pro/desktop/en-us/exampleconnections_overview.htm). Then create new metric definitions and metrics using that data instead. #### Edit the Tableau data source to add a new Salesforce data object If the data that you want to add is in an object that hasn’t yet been added to the data source, add it to the data canvas. 1. From the Tableau Cloud navigation panel, select Explore. 2. In the content type menu, select All Data Sources. 3. Open the data source called “Sales Cloud Metrics Datasource.” 4. Select Edit Data Source. For more information about editing a data source, see [Edit a Published Data Source](https://help.tableau.com/v0.0/online/en-us/edit_datasources.htm). 5. Drag the data that you want to add onto the canvas. 6. Relate or join the new object to the existing data. See [Relate Your Data](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm#create-and-define-relationships) and [Join Your Data](https://help.tableau.com/current/pro/desktop/en-us/joining_tables.htm). 7. Select Publish. Now, if you edit the metric definition, the added data appears when you go to select a field. #### Edit the flow to change the filtered data Metrics require a time dimension. For point in time data, it’s necessary to use a flow to snapshot the data and create the time series. If you edit the flow to use different fields, the snapshot of that data starts when you first run the updated flow. For more information about flows, see [Build and Organize your Flow](https://help.tableau.com/current/prep/en-us/prep_build_flow.htm). 1. From the navigation panel, select Explore. 2. In the content type menu, select All Flows. 3. Open the flow called “Open Pipe.” 4. Adjust the fields filtered by the flow. For more information, see [Filter Your Data](https://help.tableau.com/current/prep/en-us/prep_filter.htm). 5. Select Publish. 6. On the notification message, select View Flow. 7. On the flow page, select Run All. ## Create additional metrics From a single metric definition, you can create as many metrics as there are combinations of filter options for that definition. Consider creating metrics that are specific to a particular role and adding only the relevant users or groups as followers. To learn how, see [Create metrics](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#create-metrics). You can create metrics only from fields that are included in the metric definition. To use different fields, either edit the metric definition or create a new definition. ## Add followers You can add individual users or user groups as followers to metrics. To learn how to add followers on Tableau Cloud, see [Manage followers](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#Manage). You can also add followers using the REST API with the [Batch create subscriptions method](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_pulse.htm#PulseSubscriptionService_BatchCreateSubscriptions). Followers receive an email digest that shows how their metrics are doing. If they follow two or more metrics, they also see an insights summary highlighting notable changes to the data. Users who are following metrics as part of a group can’t individually unfollow those metrics. These users can, however, choose not to receive a digest of the metrics they follow. For more information, see [Help users manage digests](#digests). ## Manage user groups The Pulse for Salesforce app creates a Tableau user group called “Pulse for Sales Cloud.” This group contains all the users that were part of the Salesforce permission set that you synced while setting up the app. You can create a new group and add specific users to it. To learn how, see [Create a Group and Add Users to It](https://help.tableau.com/v0.0/online/en-us/to_add_users_groups.htm). You can also change the users in an existing group. To learn how, see [Add users to a group (Groups page)](https://help.tableau.com/v0.0/online/en-us/to_add_users_groups.htm#Add). Groups are useful for adding users with the same job role as followers to metrics. Groups can also be used to limit access to the data in metrics. For more information, see [Control access](#control-access). ## Help users manage digests As a Tableau administrator, you can’t change the digest settings for users. Users can individually opt out of receiving digests for the metrics they follow. 1. Open the Pulse app in Salesforce. 2. On a metric page, select the avatar icon at the upper-right corner, then select Preferences. ![Pulse preferences option](/tableau/next/en-us/online/en-us/Img/pulse_preferences.png) 3. Choose whether to receive digests. 4. Choose how frequently to receive digests. 5. Select Save. ## Control access Access controls to the data that have been configured in Salesforce don’t carry over into Tableau Cloud. Unless you limit access to the data in Tableau Cloud, you should consider the data in the Pulse for Salesforce app accessible by all users. ### Sync access to the Tableau Pulse app The users who you add to the Pulse for Salesforce permission set can access the app in Salesforce. Add or remove users from this permission set to limit access to the app. To learn how, see [Manage Permission Set Assignments](https://help.salesforce.com/s/articleView?language=en_US&id=sf.perm_sets_manage_assignments.htm&type=5). After you update the permissions set, open the wizard to re-sync the users with Tableau. 1. In the Salesforce App Launcher, search for the Pulse Installation Wizard and open it. 2. Select the Sync New Users tab. 3. Enter the same site information that you entered when setting up the app. See [Set up the Pulse for Salesforce app](#set-up-app). 4. Select Test Connection. 5. Acknowledge the message about syncing users, then select Sync Users. The users in the “Pulse for Sales Cloud” permission set are synced with the “Pulse for Sales Cloud” user group in Tableau. ### Limit access to individual metrics You can edit a metric definition to limit access to the data to a specific Tableau group. Before you edit the definition, create the user group that you plan to use to limit access. To learn how, see [Create a Group and Add Users to It](https://help.tableau.com/v0.0/online/en-us/to_add_users_groups.htm#Create). 1. In Tableau Pulse, select the metric you want to limit access to. 2. Select the actions (...) menu, then select Edit Definition. Note the measure, aggregation, time dimension, and any definition filters. 3. Select Create Advanced Definition. 4. Drag the fields that you noted in step 2 to the Measure, Time Dimension, and Filters shelves. 5. On the measure name, select the arrow, then select the aggregation type. ![Aggregation option](/tableau/next/en-us/online/en-us/Img/pulse_advance_aggregation.png) 6. Next to the field search box, select the arrow, then select Create Calculated Field. ![Calculated field option](/tableau/next/en-us/online/en-us/Img/pulse_calculated_field.png) 7. In the calculation editor, enter the calculation that includes the group that you want to limit access to, replacing `GroupName` with your group’s name. `ISMEMBEROF('GroupName')` 8. Drag the calculated field to the Filters shelf. 9. For the filter, under List, select Custom value list. 10. Enter True, then select Add. 11. Uncheck Include all values when empty. 12. Select OK to apply the filter. 13. On the Advanced Analytics Editor, select Apply. 14. Select Save Definition. ### Implement row-level security If you want your users to see data that's specific to them, for example, based on the organization they belong to or the region they sell in, you must implement row-level security for the data. There are a number of ways to implement row-level security for Tableau Cloud, depending on your goals and your data. For more information, see [Overview of Row-Level Security Options in Tableau](https://help.tableau.com/v0.0/online/en-us/rls_options_overview.htm) and [Best Practices for Row Level Security with Entitlements Tables](https://www.tableau.com/learn/whitepapers/row-level-security-entitlements-tables). [Skip to main content](#main-content) # Set up the Tableau Add-On for Google Workspace The Tableau add-on for Google Workspace allows you to securely view and interact with Tableau content directly within your workflow. You can embed image snapshots of Tableau visualizations and Pulse metrics into Google Docs and Slides. You can also connect your Tableau Cloud data sources directly to Google Sheets and export data from your Google Sheets to Tableau Cloud. The add-on is available for Tableau Cloud and Tableau Server and is available through the Google Workspace Marketplace. Tableau administrators are responsible for installing and setting up the app to connect a Tableau site with a Google Workspace environment. For information about using the Tableau add-on for Google Workspace, see [Access Tableau Content in Google Workspace](https://help.tableau.com/current/online/en-us/gworkspace_explore.htm). ## Prerequisites To set up the Tableau add-on for Google Workspace, you need these apps and accounts: - Tableau Cloud or Tableau Server - A site admin account for Tableau Cloud or a server admin account for Tableau Server - A Google Workspace subscription - A Google Workspace admin account - User licenses for both Tableau and Google Workspace, where each user's Google Workspace email address matches their Tableau username ## Install the Tableau add-on Open the Google Workspace Marketplace and search for the [Tableau Add-on listing](https://workspace.google.com/marketplace/app/tableau_cloud/1044537977580?flow_type=2). ![](/tableau/next/en-us/online/en-us/Img/gworkspace_install.png) If the install button is unavailable, your Google Workspace admin may have a defined allow-list of available add-ons. Make sure that your Google Workspace admin has added the Tableau Add-on to the allow list. It’s also possible for the Google Workspace admin to [auto-install the add-on](https://support.google.com/a/answer/172482?hl=en\&ref_topic=27380\&sjid=17199801914992583928-NA) for users based on Google user groups. If the install button is active, select it and then open up Google Docs or Slides in a new browser tab. After the add-on has been installed, you'll see a Tableau icon in the right side-panel. ## Configure the Tableau add-on The first time you open the Tableau add-on, you'll be prompted to authorize access. The Tableau add-on needs access to your Google Drive files (For example, Google Docs and Google Slides) to import and export content from Tableau. Clicking the Authorize Access button will trigger an OAuth notification, which will outline the specific permissions required. After granting access to the Tableau add-on, you may get one more prompt asking if the add-on can access this specific document of slide. Instead of asking for access to all the user’s Drive files, we only ask for permissions on files you want to use the add-on with. Select Allow. ![](/tableau/next/en-us/online/en-us/Img/gworkspace_access.png) ## Configure your Tableau site The first time you open the Tableau add-on, you're prompted to add a site configuration. Use this setting to specify the Tableau Cloud site that you want to integrate with Google Workspace. Only users with admin permissions on the Tableau Cloud site can manage site configurations. ### Step 1: Get your Tableau site details 1. To communicate with your Tableau site, make sure you have a direct trust connected app. 2. If you don't, your Tableau administrator should follow the guidelines for [Configuring Connected Apps with Direct Trust](https://help.tableau.com/current/online/en-us/connected_apps_direct.htm#create-a-connected-app). 3. Set the status to Enabled. You can bypass access level and domain allowlist settings because the add-on uses the Tableau REST API. 4. Gather your Tableau connected app’s Client ID, Secret ID, and Secret Value. You'll enter this information when configuring the Tableau add-on. ### Step 2: Configure the Tableau add-on 1. Open the Tableau add-on in Google Docs or Google Slides. 2. Select Add new site configuration and enter your Tableau site information and connected app details. 3. Complete the configuration fields as described in the following table.

Property	Description
Label	(Optional): Use this field to create a user-friendly label for the site. If you leave this property blank, the add-on defaults to using the site's name.
Tableau Base URL	This is the hostname for your Tableau site. For example, if your Tableau site is accessible at https://us-east-1.online.tableau.com/#/site/devplatembed/home, then the Base Url would be https://us-east-1.online.tableau.com.
Tableau Site	Your Tableau site name exactly as it appears in the URL, keeping in mind that this field is case-sensitive. For instance, in the URL example provided earlier, the site name is devplatembed. Note that characters restricted in URLs might cause the site name to differ slightly from its display label in Tableau Cloud. If you're configuring the default site for a Tableau Server instance, this field should remain empty.
User Mapping	This setting determines the method the add-on uses to authenticate Google Workspace users within Tableau. Email: When this option is selected, the add-on uses the user's Google Workspace email address as their Tableau Cloud username. Other attributes: Any custom attributes you’ve established for your users will be listed here. The custom attributes must be set up for each Google user who wants to authenticate to Tableau. See User mapping for more details.
Domains checkbox	Each domain that is registered within Google Workspace will have a corresponding checkbox. For additional information, please refer to the section on Domains
Connected App Credentials	The Tableau Site details you gathered in step 1. Enter your Tableau connected app’s Client ID Secret ID, and Secret Value.

1. Select Save and refresh the web page. The next time you open the Tableau add-on, a dropdown menu shows the list of configured sites. To start using the Tableau add-on, select the Home button in the top right. To manage your site configurations, select Settings from the home screen. #### User mapping To authenticate the Tableau add-on with Tableau Cloud or Server, the Google user must be mapped to their corresponding Tableau username. For Tableau Cloud, usernames often correspond to email addresses. By selecting Email from the dropdown, the add-on uses the user's primary Google Workspace email for sign-in. However, if your Tableau usernames don't align with Google Workspace primary emails, you can use Custom Attributes or External IDs. The add-on supports these alternative authentication methods by automatically including detected custom attributes or external IDs as options in the selection dropdown alongside the standard email choice. #### Custom Attributes You can establish custom attributes via the Google Admin Console. Go to the Directory > Users section, then from the More options menu, select Manage custom attributes. ![Google Workspace admin console with More Options then Manage Custom Attributes selected.](/tableau/next/en-us/online/en-us/Img/gworkspace1.png) Define the category (schema) and attribute name by selecting the Add Custom Attribute button. Ensure the following settings are selected from the dropdown menus: Type: Text Value: Single Value Admins have the option to limit the visibility of this custom attribute so that it’s only accessible to themselves and the individual user. ![Google Workspace Admin console with dialog to add custom fields.](/tableau/next/en-us/online/en-us/Img/gworkspacecustomfield.png) After creating a custom attribute, you must define its value for every user of the Tableau add-on for Google Workspace. For individual updates, go to the Google Admin Console's Users page, select a user, and enter the value in the User Information section where the new field appears. To manage these values at scale or sync them with Active Directory, we recommend using the [Directory Sync](https://knowledge.workspace.google.com/admin/users/get-started-with-directory-sync) tool. Alternatively, you can automate these updates through the [Google Directory API](https://developers.google.com/workspace/admin/directory/v1/guides/manage-users#update_user). #### External IDs If you've set up directory syncs that populate [External IDs](https://help.tableau.com/v0.0/online/en-us/%3Chttps://developers.google.com/workspace/admin/directory/reference/rest/v1/users#:~:text=%2C work.-,externalIds,-value \(Value>), you can use them in the add-on. However, because Google defines built-in external ID types as arrays, they aren't visible within the add-on. As these arrays can contain multiple values in varying orders for different users, the add-on can't determine which value to select. As a result, the add-on is restricted to supporting external IDs only when they're categorized as a custom type. #### Domains The add-on authenticates to Tableau via the [/auth/signin](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_authentication.htm#sign_in) endpoint by passing a JWT. This token includes connected app details and the Google user's Tableau username. To identify the correct site configuration for a specific user, the add-on uses the hostedDomain attribute provided by Google's API. When site configurations are saved, they’re associated with specific domains. For example, if a user signs in as someuser@salesforce.com, the Google APIs tell the add-on the user’s domain is salesforce.com. The add-on then searches for site configurations associated with that domain to populate the site picker dropdown, a process that is effective for approximately 95% of customers. In certain scenarios, end users within a single organization may be distributed across various domains, such as user1@salesforce.com and user2@tableau.com. Standard Google APIs don’t provide a mechanism to identify these users as part of the same company unless they’re granted administrative permissions. To streamline this process, the add-on retrieves all domains linked to a customer during the site configuration setup or update. This allows you to provide Tableau site details one time and apply them across multiple domains simultaneously. The domains checklist will only display extra domains if the user has the necessary permissions to execute that specific API call and those domains are defined within Google Workspace. **Note:** Only Super Admins or users that have Domain Management, Users Read permissions can set up the add-on within Google Docs, Slides, or Sheets for multiple domains, as the tool requires administrative directory scopes. ## See also [Tableau Add-On FAQ on Github](https://tableau.github.io/tableau-google-workspace-integration/#faq) [Tableau Add-On on Google Marketplace](https://workspace.google.com/marketplace/app/tableau/1044537977580) [Add an App to the Allowlist or Excludelist](https://knowledge.workspace.google.com/admin/apps/manage-the-marketplace-app-allowlist-for-your-organization?hl=en&visit_id=639099932994860105-1044754439&rd=1#add) [Skip to main content](#main-content) # Set Up the Tableau App for Microsoft 365 The Tableau app for Microsoft 365 lets your users see and understand their data without leaving their flow of work. With the Teams app, your users can interact with Tableau views (visualizations) and metrics and receive Tableau Pulse digests and alerts for the metrics that they follow. With the Word and PowerPoint add-ins, your users can add image snapshots of views and metrics to their documents and slides and refresh those snapshots to keep them up to date. With the Excel add-in, you can export data from Tableau views and published data sources into a worksheet, refresh it on demand, and publish Excel data back to Tableau Cloud. As a Tableau admin, you install and configure the app to connect your existing Tableau site with your Microsoft 365 deployment. You can install the app for Tableau Cloud directly from the Microsoft apps Marketplace. To install the app for Tableau Server, you download and side load the app. For information about using the Tableau app for Microsoft 365, see [Access Tableau Content in Microsoft 365](https://help.tableau.com/v0.0/online/en-us/teams_explore.htm). This article is about setting up the app. Note: If you've set the language in Tableau or Microsoft 365 to a Tableau-supported language other than English (US), you might see text in English that isn't localized. ## See also - [Tableau app FAQ on GitHub](https://github.com/tableau/tableau-app-msft-teams) - [Release notes on GitHub](https://github.com/tableau/tableau-app-msft-teams/blob/main/ReleaseNotes.md) - [Getting started tutorial on YouTube](https://www.youtube.com/watch?v=nsa123RgCO0) ## Prerequisites To set up the Tableau app for Microsoft 365, you need these apps, accounts, and configurations. - Tableau Cloud or Tableau Server version 2023.1 or later - A site admin account for Tableau Cloud or a server admin account for Tableau Server - A Microsoft 365 for Enterprise subscription - Microsoft Teams, Word, and PowerPoint - A Microsoft 365 admin account - User licenses for both Tableau and Microsoft 365 that are mapped to each other based on one of the user mapping attributes - IP address ranges `4.152.0.0/15` and `20.2.0.0/16` added to your allow list (only if IP filtering is enabled on your Tableau Cloud site) ### User mapping attributes To allow for single sign-on with Tableau, you map the user accounts in Microsoft 365 to the user accounts in Tableau. You can set up this mapping using attributes from either the Microsoft Teams SDK or from a user's Microsoft Entra profile. #### Microsoft Teams SDK attributes | Attribute | Description | | --- | --- | | [Preferred\_Username](https://learn.microsoft.com/en-us/microsoftteams/platform/tabs/how-to/authentication/tab-sso-code#:~:text=user%27s%20display%20name.-,preferred_username,-%3A%20The%20app%20user%27s) | The Microsoft Teams user's email address. In some cases, this value differs from the email defined in Microsoft Entra. | | [User Principal Name](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/plan-connect-userprincipalname#what-is-userprincipalname) | The primary way users log in to Microsoft Entra. | #### Microsoft Entra profile attributes | Attribute | Description | | --- | --- | | [Primary Email](https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties:~:text=%24select.-,mail,-String) | Corresponds to the `user.mail` attribute and represents the user's email address. | | [Mail Nickname](https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties:~:text=%24select.-,mailNickname,-String) | Corresponds to the `user.mailNickname` attribute and represents an alias for the user. | | [Employee ID](https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties:~:text=a%20user.-,employeeId,-String) | Corresponds to the `user.employeeId` attribute and represents an employee identifier assigned by the organization. | | [On-Premise Distinguished Name](https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties:~:text=on%20null%20values\).-,onPremisesDistinguishedName,-String) | Corresponds to the `user.onPremiseDistinguishedName` attribute and represents the distinguished name (DN) synced from an on-premise Active Directory. | | [On-Premise User Principal Name](https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties:~:text=on%20null%20values\).-,onPremisesUserPrincipalName,-String) | Corresponds to the `user.onPremiseUserPrincipalName` attribute and represents the userPrincipalName synced from an on-premise Active Directory. | | [On-premise SAM Account Name](https://learn.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0#properties:~:text=%2C%20le\).-,onPremisesSamAccountName,-String) | Corresponds to the `user.onPremiseSamAccountName` attribute and represents the samAccountName synced from an on-premise Active Directory. | | [Extension Attribute X](https://learn.microsoft.com/en-us/graph/extensibility-overview?tabs=http) | Microsoft Entra lets you add up to 15 extra attributes to a user's Entra profile. If the Tableau user name doesn’t exist in Microsoft Entra, use an extension attribute to store the Tableau user name for each Entra user. | ## Deploy the app for Tableau Cloud You install the Tableau Cloud app directly from the Microsoft apps Marketplace. To install the Tableau app for Tableau Server, see the [Tableau Server set up guide](https://help.tableau.com/current/server/en-us/teams_set_up.htm). ### Install the Teams app Your organization’s policies determine whether users can install the app on their own or if an admin must install it for them. 1. Open the [Microsoft Teams admin center](https://admin.teams.microsoft.com). 2. From the navigation panel, select Teams apps > Manage apps. 3. Search for the Tableau app, then select the app. 4. Choose whether to make the app available to all users or specific users. 5. To pre-install the app for your users, add a setup policy for the app. ### Install the Word, Excel, and PowerPoint add-ins When you install the Tableau app for Microsoft 365 in the Teams admin center, it’s also installed for Word, Excel, and PowerPoint. However, to make these add-ins available to your users, you must accept additional permissions. 1. Open the [Microsoft 365 admin center](https://admin.cloud.microsoft.com). 2. From the navigation panel, select Settings > Integrated apps. 3. Search for the Tableau app, then select the app. 4. Select Deploy app. 5. Make the app available to all users or specific users. 6. Accept the permissions. 7. Review and finish the deployment. ## Configure the Tableau app After you install the Tableau app, Microsoft Teams prompts you to set up the app. You configure your site information to connect the app to your Tableau site. ### 1\. Create a connected app The Tableau app for Microsoft 365 uses a connected app to authenticate users with single sign-on. You create this connected app in Tableau Cloud or Tableau Server. 1. In Tableau Cloud or Tableau Server, create a direct trust connected app. For more information, see [Configure Connected Apps with Direct Trust for Tableau Cloud](https://help.tableau.com/current/online/en-us/connected_apps_direct.htm) or [Configure Connected Apps with Direct Trust for Tableau Server](https://help.tableau.com/current/server/en-us/connected_apps_direct.htm#create-a-connected-app). - If you limit the domain allowlist for the connected app to only specified domains, add the following domains to the allowlist. - `tableau-ms-teams-prod-gycea7csh5hsbfh5.a02.azurefd.net` - `teams.microsoft.com` - `*.teams.microsoft.com` - If your users will access the app from other Microsoft platforms, add additional domains from the list of [Microsoft 365 URLs](https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide). 2. Enable the connected app. 3. Generate a connected app secret. 4. Copy the connected app client ID, secret ID, and secret value. Save these values. You need them to configure your Tableau site in Microsoft 365. ### 2\. Add your site configuration to the Tableau app When you open the Tableau app in Microsoft Teams, if you haven’t yet configured the app, you see a set up screen. To access site configuration options in Word and PowerPoint, select the Settings button at the bottom of the add-in panel. 1. For the Label, give the site a name. This name appears to users of the Microsoft 365 app. If you don’t enter a label, the app displays the site name. This field is optional. 2. For the Tableau Site Name, enter the name as it appears in the URL for your site. For example, for the URL `https://us-west-2b.online.tableau.com/#/site/mysitename/home`, you would enter `mysitename`. If you’re connecting the app to Tableau Server and want to use the default site, leave this field blank. 3. For the Base URL, enter the portion of the site URL that ends with `tableau.com`, for example, `https://us-west-2b.online.tableau.com`. 4. For the User Mapping Attribute, select the Microsoft Entra attribute that is used to authenticate the user with single sign-on. 5. For the Connected App ID, Connected App Secret ID, and Connected App Secret Value, paste in the values that you copied when you created the connected app. 6. Select Add Site Config. The Tableau app tests the connection before saving the configuration details. The site configuration won’t be added if the app can’t connect to Tableau. This failure could be because the connected app isn’t able to authenticate, the connected app isn’t enabled, the site information is wrong, or because the account that you're using isn’t a Tableau admin account. It could also mean the app can't reach Tableau Server because it’s behind a firewall. ## Add or delete site configurations After you've added a site configuration, you can add additional sites or delete an existing site configuration. 1. In the Tableau app for Microsoft Teams, select the Configuration tab. Or, on the Word or PowerPoint add-in panel, select the **Settings** button. 2. Under Configuration, select the Tableau Site Config tab. 3. To add a site, select Add Site Details. Or, to remove a site, select the delete icon for that site. For these options to appear, you must be a site administrator on the Tableau site that you are currently connected to. ## Turn on Tableau Pulse digests in Tableau Cloud Your users can receive digests and alert messages in Microsoft Teams about the Tableau Pulse metrics that they follow. Tableau Cloud site settings control the channels where digests and alerts are turned on. If you install the Microsoft 365 app but don’t turn on the digest setting for Teams, your users won’t be able to receive digests in Teams. For more information about the Tableau site settings for digests, see [Configure digests](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#digest-time). [Skip to main content](#main-content) # Set Up Your Data for Tableau Pulse You create a metric definition in Tableau Pulse by connecting to a published data source on Tableau Cloud. This data source should have time series data that is complete, well-structured, and clearly labeled. Follow the guidelines in this article to structure your data source. For information about creating metric definitions based on a data source, see [Create Metrics with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm). ## General data source requirements Make sure that the data source you're working with meets the following criteria. - It’s a single published data source. You can't connect to a data source that is embedded in a workbook, and you can't connect to multiple data sources or use data blending, unless you combine the data before publishing the data source. The data source can be an extract or a live connection, and it can use a virtual connection or connect directly to the data. - You have the Connect, View, and Create Metric Definitions permission capabilities for the data source. - The data source contains: - A measure to be aggregated as a sum, average, median, maximum, or minimum or a dimension to be aggregated as a count or count (distinct). - A time dimension for the metric's time series. Tableau Pulse monitors data over time, so single point-in-time values won’t produce a valid metric. The granularities supported for the time series are day, week, month, quarter, and year. Data that requires a lower level of granularity (hour or minute) isn’t a good fit for Tableau Pulse. - At least one dimension that can be used to filter the data and insights. Tableau Pulse displays the dimension names and values that you add as filters on metrics and in insights text. These names and values in your data source should be easy for others to understand. To create the best experience for viewers, follow these recommendations so that the names and values fit with the conversational language of Tableau Pulse. - Use title-style capitalization rather than all caps. - Use spaces rather than hyphens or underscores to separate words. - Don’t use special characters. - Don’t use Boolean fields that appear as `true` or `false`. - Don’t use fields that consist of IDs or other indecipherable strings. Custom calendars, goals, and thresholds require additional data to be added to your data source. For information about setting up your data source for those features, see [Requirements for custom calendars](#ds-requirement-calendar) and [Requirements for data source goals and thresholds](#ds-requirement-goals). ## Requirements for custom calendars Set a custom calendar in Tableau Pulse if your organization doesn’t use a standard Gregorian calendar. For example, you can define a calendar that aligns with the [National Retail Federation 4-5-4 calendar](https://nrf.com/resources/4-5-4-calendar). A custom calendar must be defined in your data source, and all of the calendar fields must belong to the same table. The custom calendar doesn’t need to belong to the same table as your metric data. If the custom calendar is in a separate table, create a relationship between that table and the metric data table. Don't add row-level security or data source filters that remove dates from the calendar table. If you add a filter to the transactions table in your data source, make sure that the filter scope is set to only that table and not that table and related tables. For information about setting the scope for data source filters, see [Create a data source filter](https://help.tableau.com/current/pro/desktop/en-us/filtering_datasource.htm#create-filter). Each row of the custom calendar represents a date and contains these fields. - Reference date - The standard Gregorian date that you're mapping to the custom calendar - Data type: date - Example: 01/01/2025 - Day of year - Data type: number (continuous dimension) - Example: 333 - Week of year - Data type: number (continuous dimension) - Example: 48 - Month of year - Data type: number (continuous dimension) - Example: 11 - Month name - Data type: string - Example: December - Quarter - Data type: number (continuous dimension) - Example: 4 - Year - Data type: number (continuous dimension) - Example: 2024 The format for dates in Tableau varies based on the locale that a user has set, and some fields aren't used in all locales. For example, locales set to Japanese or Chinese show the "month of year" instead of the "month name." After you add the custom calendar to your data source, you configure the calendar as part of the metric definition. For more information, see [Set a custom calendar](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#custom-calendar). ### Custom calendar validation Make sure that the custom calendar is complete, consistent, and doesn’t skip any dates or numbers. Follow these guidelines to ensure that your custom calendar is valid. - All of the fields are present for each reference date. - The fields are of the correct data type. - The first entry in the table is the first reference date. - The reference dates are in chronological order. - The reference date includes every day of the year, even if there's no business data for that day. - The day of year, week of year, month of year, and quarter of year begin with 1 and increase by 1 with no skipped numbers. - There are 7 days in a week. If a year ends with a partial week, the next year must begin with a partial week such that the 2 weeks add up to 7 days. For example, if week 53 of a year has only 2 days, then week 1 of the next year must contain 5 days to form a 7 day week, and week 2 would contain days 6-12. - The month name is the same for each month number across all years in the calendar. - There are 4 quarters in a year. - Each quarter starts and ends with a complete month. Months can’t be split across quarters. - The data contains the 2 previous calendar years. Metrics with a comparison to the prior year use those dates to determine the correct comparison. - The data is complete through the end of a custom year. If future data goes into a new custom year, include the complete set of dates for that year, but don't include more than 4 years beyond the end of the current custom year. Tableau Pulse validates the fields in the custom calendar. If there's a problem with your custom calendar, you’ll see an error that helps you troubleshoot the calendar. | Problem | Error message example | | --- | --- | | Skipped reference date | There is a skipped reference date for the date before Feb 1, 2026. The custom calendar must include every date in a year. | | Duplicate reference date | There is a duplicate entry for Feb 1, 2026. Each reference date must appear only once. | | Skipped day of year | There is a skipped day of year on Feb 1, 2026. The day of year must increase by 1 with no skipped numbers. | | Skipped week of year | There is a skipped week of year on Feb 1, 2026. The week of year must increase by 1 with no skipped numbers. | | Incomplete week of year | There is an incomplete week of year for the week before Feb 1, 2026. A week must have 7 days. | | Not enough days in the year for the week of year to be possible | The week of year on Feb 1, 2026 isn’t valid. A week must have 7 days. | | Skipped month of year | There is a skipped month of year on Feb 1, 2026. The month of year must increase by 1 with no skipped numbers. | | Inconsistent month name | There is an inconsistent month name on Feb 1, 2026. The month name must be the same for each corresponding month of year. | | Missing month name | There is no month name on Feb 1, 2026. All fields are required for every reference date. | | Duplicate month name | The month name on Feb 1, 2026 is already in use for another month number. The month name must correspond to a single month number. | | Skipped quarter | There is a skipped quarter on Feb 1, 2026. The quarter must increase by 1 with no skipped numbers. | | Not enough quarters | There are fewer than 4 quarters for the year that ends on Jan 31, 2026. A year must have 4 quarters. | | Extra quarter | There are more than 4 quarters in a year starting on Jan 31, 2026. A year must have 4 quarters. | | Not enough months in the year for the quarter to be possible | The quarter starting on Feb 1, 2026 isn’t valid. The quarter can’t be greater than the month of year. | | Skipped year | There is a skipped year on Feb 1, 2026. The year must increase by 1 with no skipped numbers. | | Field doesn’t start at 1 | The first day of year, week of year, month of year, or quarter has a value other than 1 for the year starting on Feb 1, 2026. These fields must begin with 1 at the start of a year. | | Value is less than 1 | The day of year, week of year, month of year, or quarter is 0 or a negative value on Feb 1, 2026. This field must begin with 1. | | Calendar ends before the current date | The custom calendar ends on Nov 30, 2025 and doesn't cover the current period. Include reference dates through the end of the current custom calendar year. | ### Example custom calendar To understand how to structure your custom calendar, [download an example custom calendar](http://help.tableau.com/samples/en-us/pulse/pulse_custom_calendar.csv). The table below shows ten rows from the example custom calendar. | Reference date | Day of year | Week of year | Month of year | Month name | Quarter | Year | | --- | --- | --- | --- | --- | --- | --- | | 01/01/2025 | 333 | 48 | 11 | December | 4 | 2024 | | 01/02/2025 | 334 | 48 | 11 | December | 4 | 2024 | | 01/03/2025 | 335 | 48 | 11 | December | 4 | 2024 | | 01/04/2025 | 336 | 48 | 11 | December | 4 | 2024 | | 01/05/2025 | 337 | 49 | 12 | January | 4 | 2024 | | 01/06/2025 | 338 | 49 | 12 | January | 4 | 2024 | | 01/07/2025 | 339 | 49 | 12 | January | 4 | 2024 | | 01/08/2025 | 340 | 49 | 12 | January | 4 | 2024 | | 01/09/2025 | 341 | 49 | 12 | January | 4 | 2024 | | 01/10/2025 | 342 | 49 | 12 | January | 4 | 2024 | ## Requirements for data source goals and thresholds There are two ways to set goals and thresholds: manually or as part of the data source. A manual goal or threshold is simply a static number entered for an individual metric, so there are no data source requirements. A data source goal or threshold is set at the definition level. These goals or thresholds use a field from your data source to show a dynamic value on the metrics based on that definition. For more information, see [Configure data source goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#ds-goal) and [Set Manual Goals and Thresholds with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_goals.htm). If you want to include a data source goal or threshold as part of a metric definition, there are additional data source considerations. - Include the field that specifies the goal or threshold values as part of the data source that the definition connects to. Metric definitions connect to only a single data source, so you can’t connect to a separate data source for this data. - If the goal or threshold data is in a separate table from the core definition data, create a relationship between the two tables. If you join the tables instead of relating them, the data source might end up with duplicate goal or threshold values. For information about relating data, see [Use Relationships for Multi-table Data Analysis](https://help.tableau.com/v0.0/online/en-us/datasource_multitable_normalized.htm). - If you want a finer-grained goal or threshold to be shown when users apply dimensional filters on metrics, include that level of granularity in your data. Otherwise, Tableau Pulse displays the total goal or threshold value for a dimension, even if the data is filtered to a subset of values. These two tables show example data sources with goals of different granularity. If there isn’t goal or threshold data for each row, for example in the case where there is only a monthly goal, include that value only once. Don’t duplicate the value in each row. Daily goals for each value in a dimension | Date | Account Executive | Sales | Sales Target (Daily) | | --- | --- | --- | --- | | 06/01/2025 | Fred Suzuki | 658 | 600 | | 06/01/2025 | Jane Johnson | 505 | 700 | | 06/01/2025 | Laura Rodriguez | 623 | 650 | | 06/02/2025 | Fred Suzuki | 678 | 600 | | 06/02/2025 | Jane Johnson | 527 | 700 | | 06/02/2025 | Laura Rodriguez | 656 | 650 | | 06/03/2025 | Fred Suzuki | 607 | 600 | | 06/03/2025 | Jane Johnson | 753 | 700 | | 06/03/2025 | Laura Rodriguez | 558 | 650 | Monthly goals for each value in a dimension | Date | Account Executive | Sales | Sales Target (Monthly) | | --- | --- | --- | --- | | 06/01/2025 | Fred Suzuki | 658 | 15000 | | 06/01/2025 | Jane Johnson | 505 | 17000 | | 06/01/2025 | Laura Rodriguez | 623 | 16000 | | 06/02/2025 | Fred Suzuki | 678 | | | 06/02/2025 | Jane Johnson | 527 | | | 06/02/2025 | Laura Rodriguez | 656 | | | 06/03/2025 | Fred Suzuki | 607 | | | 06/03/2025 | Jane Johnson | 753 | | | 06/03/2025 | Laura Rodriguez | 558 | | [Skip to main content](#main-content) # Set Up Your Site for Tableau Pulse Tableau Pulse provides users with personalized insights about the metrics that matter to them, directly in their flow of work. Users with a Creator, Site Administrator Explorer, or Explorer (can publish) site role can add metric definitions, and all users can follow metrics to discover insights and learn about changes to the data. For information about definitions, metrics, and how to create them, see [Create Metrics with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm). For information about how viewers interact with metrics, see [Explore Metrics with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm). ![Pulse home page](/tableau/next/en-us/online/en-us/Img/pulse_home.png) Users who follow metrics receive regular digests with insights about their data by email or in Slack. Tableau Pulse allows users who don't regularly access Tableau to understand their data without leaving the places they normally work. If these users want to learn more, they can visit a metric on Tableau Cloud to engage in guided, self-service data analysis and see how different factors impact their data. ## Deploy Tableau Pulse for your site The site setting to deploy Tableau Pulse is off by default. When you deploy Tableau Pulse, you can choose to turn it on for a single group of users or for all users on your site. You might want to have a controlled roll out for Tableau Pulse and turn it on for a single group so that a subset of users can explore and evaluate it before you make it available to your entire organization. To learn how to create a user group for Tableau Pulse, see [Create a Group and Add Users to It](https://help.tableau.com/v0.0/online/en-us/to_add_users_groups.htm). To deploy Tableau Pulse, visit the settings page for your site. 1. From the main Tableau Cloud navigation menu, select Settings. 2. Under Tableau Pulse > Deployment, select Turn on Tableau Pulse. 3. Choose whether to turn on Tableau Pulse for all users or for a specified group. 4. If you choose to limit Tableau Pulse to a group, select the group. 5. Select Save. Users without access will get a message informing them if they visit a Tableau Pulse URL. Also, if you limit Tableau Pulse to a group, that group is the only one available when you search to add followers, even if those same users are part of a different group. ### API availability of Tableau Pulse Limiting Tableau Pulse to a specified group isn't supported at the external API level. If the site setting is turned off entirely, the API won’t allow users to access Tableau Pulse. If the site setting for Tableau Pulse is on, all users will be able to access it in situations where it's being called through the API, such as in embedded scenarios, regardless of whether the setting limits it to a specified group. For more information about using the API for Tableau Pulse, see [Embed Tableau Pulse](https://help.tableau.com/current/api/embedding_api/en-us/docs/embedding_api_pulse.html) and [Tableau Pulse REST API Methods](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_pulse.htm). ### Stop digests that persist for users without access After you initially deploy Tableau Pulse, the services that query data sources and send metric digests continue to run whether the site setting is on or off. The site setting controls whether Tableau Pulse appears in the navigation menu and whether users are able to access the Tableau Pulse home page and individual metric pages. Because the services for Tableau Pulse continue to run, any users who previously had access and followed metrics will receive digests for those metrics, even if you restrict access to a group that they aren’t in or remove those users from the group with access to Tableau Pulse. If these users attempt to open the links to metrics that are sent in digests, they'll get a notice that they don’t have access to Tableau Pulse, and they'll be unable to unfollow these metrics. To prevent users who can’t access Tableau Pulse from receiving digests, remove those users from the metrics that they follow. Do this before you turn off Tableau Pulse or limit it to a smaller set of users, so these users don’t receive digests with links to metrics they can’t access. ## Set up your site As a Tableau administrator, you can help your users get the most from Tableau Pulse. Before your users get started, check that the data required for metrics is available and turn on optional features. - Verify that there are published data sources on your site for users to create metrics from. For information about the specific data requirements for metrics, see [Set Up Your Data for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_data_source_requirements.htm). To make sure that users can access the data, see [Understand governance for Tableau Pulse](#permissons). - Connect your Tableau site with Slack, if you want your users to receive Tableau Pulse digests in Slack. For more information, see [Integrate Tableau with a Slack Workspace](https://help.tableau.com/v0.0/online/en-us/slack_admin.htm). - Turn on AI in Tableau, if you want your users to see personalized insights summaries. For more information, see [AI in Tableau for Tableau Pulse](#tableau-ai). The legacy Metrics feature was retired on Tableau Cloud in February 2024. Any legacy metrics on your site won’t carry over to Tableau Pulse. If you had legacy metrics, note the data source, measure, and time dimension, then recreate them in Tableau Pulse. For more information about legacy metrics, see [Create and Troubleshoot Metrics (Retired)](https://help.tableau.com/v0.0/online/en-us/metrics_create.htm). ## Understand governance for Tableau Pulse A combination of settings and permissions control access to Tableau Pulse and its features. - Site settings control the ability to access Tableau Pulse and to see features that use generative AI. See [Deploy Tableau Pulse for your site](#site-setting) and [AI in Tableau for Tableau Pulse](#tableau-ai). - Permissions for data sources and authentication to the data itself control the ability to view metrics and create metric definitions. See [Permissions for viewing metrics](#permissions-viewing). - Settings on metric definitions control who can edit or delete metric definitions and goals. See [Permissions for editing metrics and goals](#permissions-editing). ### How site roles impact Tableau Pulse access Users must have a site role of Creator, Site Administrator Explorer, or Explorer (can publish) to create, edit, or delete metric definitions in Tableau Pulse. There are no site role limitations for creating and viewing metrics, following and adding followers to metrics, or setting and editing goals for metrics. Users who have site roles that don’t allow an action won’t be able to take that action, regardless of the permissions they're granted. ### Permissions for viewing metrics Metrics in Tableau Pulse aren’t part of the project content hierarchy in Tableau Cloud or governed by content-based permissions, meaning you can’t deny a user the ability to see an individual metric. However, by adjusting permissions on a published data source, you can control whether users can view metrics based on that data source. Also, the data that users see when viewing a metric respects row-level security applied to the data source. To view a metric, users must have: - The Connect and View permission capabilities for the published data source that the metric is connected to. For more information about permissions, see [Permission Capabilities and Templates](https://help.tableau.com/v0.0/online/en-us/permissions_capabilities.htm). - Access to the data in the data source that the metric is connected to. Tableau Pulse doesn’t prompt users to sign in to the database or data connection for the data source. Instead, one of the following must be true for users to access the metric data: - The credentials for the data source are embedded. For information about embedded credentials, see [Set Credentials for Accessing Your Published Data](https://help.tableau.com/v0.0/online/en-us/publishing_sharing_authentication.htm). - The user's credentials are passed to the data source with single sign-on. - The user’s credentials are saved for the data source. For more information, see [Manage Saved Credentials for Data Connections](https://help.tableau.com/v0.0/online/en-us/manage_stored_credentials.htm). - The data source doesn't require the user to authenticate to access the data. If users try to view a metric that they don’t have the correct permissions for, they see a message that the metric doesn’t exist or that they don’t have permission to access it. ### Permissions for creating metric definitions Any user with a site role of Creator, Site Administrator Explorer, or Explorer (can publish) can create metric definitions. You can’t deny users the ability to create definitions; however, you can limit the data sources that users can connect to when creating metric definitions. To create a metric definition from a data source, users must have the Create Metric Definitions permission capability for the data source. They must also have the same access that is required to view a metric that is connected to that data source. For more information, see [Permissions for viewing metrics](#permissions-viewing). If you want users to be able to view metrics based on a data source but don’t want users to be able to create metrics based on that data source, allow the View and Connect capabilities but deny the Create Metric Definitions capability. ### Permissions for creating metrics There’s no setting to limit who can create metrics in Tableau Pulse, and there are no site role limitations for creating metrics. A new metric is created any time a user filters an existing metric if one doesn’t already exist with that combination of filters. As long as users can view an existing metric, they can create new metrics by adjusting the filters. ### Permissions for editing metrics and goals You can adjust settings on a metric definition to control who can edit or delete the metric definition and who can set, edit, or delete goals for the metrics based on that definition. Note that these settings won’t grant users the ability to edit a definition if their site role doesn’t allow it. Tableau administrators don’t need to be added as editors, because their site role gives them the ability to edit all metric definitions and goals. For more information, see [Restrict editing for definitions and manual goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#edit-permissions). ## Configure digests You can control when and where users receive Tableau Pulse digests and off-cycle alerts. ### Limit the channels where users can receive digests Choose whether to allow users to receive email, Slack, or Microsoft Teams digests and alerts. These settings affect all users on a site. Users can also turn off channels in their individual Tableau Pulse preferences. 1. From the main Tableau Cloud navigation menu, select Settings. 2. Under Tableau Pulse > Digest, select the channels where users can receive digests. 3. Select Save. For users to receive digests in Slack or Microsoft Teams, you must connect Tableau to these applications. For more information, see [Integrate Tableau with a Slack Workspace](https://help.tableau.com/v0.0/online/en-us/slack_admin.htm) and [Set Up the Tableau App for Microsoft 365](https://help.tableau.com/v0.0/online/en-us/teams_set_up.htm). ### Set the digest start time and schedule You can change the time at which Tableau Pulse starts generating digests. You can also set the day of week and day of month when weekly and monthly digests are generated. These settings are useful if your data refreshes at a specific time or date so that Tableau Pulse digests include the latest data. 1. From the main Tableau Cloud navigation menu, select Settings. 2. Under Tableau Pulse > Digest Schedule, for the Digest start time, select a time. The start time is when Tableau Pulse begins generating digests, not the time at which the digests are sent. It can take more than an hour to generate and send digests. 3. For the Weekly and Monthly frequency, select the day of the week and day of the month when Tableau Pulse generates these digests. 4. Select Save. ## AI in Tableau for Tableau Pulse AI in Tableau is Tableau's generative artificial intelligence technology. Tableau Pulse uses AI in Tableau to provide these capabilities: - Personalized summaries of insights for the metrics that you follow - Better semantic matches in any language for Ask Q&A - Tableau Agent in Pulse for in-depth, conversational exploration of groups of metrics and insights Settings for these features are off by default, so you will need to turn on each setting individually in Tableau Cloud to use them. **Note**: AI in Tableau settings for Tableau Pulse are independent of the setting to deploy Tableau Pulse, meaning that turning on Tableau Pulse doesn't turn on settings for AI in Tableau. Tableau Pulse doesn't use your site’s data to train its generative AI. When AI in Tableau processes a prompt to generate an insight summary or insights brief, the prompt and the response are forgotten. Your data isn’t stored outside of Tableau, and the only data that AI in Tableau collects is the voluntary feedback users can submit about their insights summaries. For more information, see [Einstein Generative AI for Tableau](https://help.tableau.com/current/tableau/en-us/about_tableau_gai.htm). ### Turn on metric insight summaries When you follow two or more metrics, Tableau Pulse provides an overview to help you quickly see the latest insights across your metrics of interest. When available, this insight summary appears in digests and in the Tableau Pulse home page. For more information, see [Insight summaries highlight metrics of interest](https://help.tableau.com/current/online/en-us/pulse_insights_platform_insight_types.htm#insight-summaries-highlight-metrics-of-interest). AI in Tableau settings are turned off for your site by default. Turn on this setting so your users can see their personalized insights summaries and get a quick overview of important changes to their metrics. **Note**: This feature doesn't require you to log in to your Salesforce org. 1. From the main Tableau Cloud navigation menu, select Settings, and then select the General tab. 2. Under AI in Tableau, select Tableau Pulse: Summarizes key metric insights. 3. Select Save. **Note**: AI in Tableau settings for Tableau Pulse are independent of the setting to deploy Tableau Pulse, meaning that turning on Tableau Pulse doesn't turn on settings for AI in Tableau. When you turn on an AI in Tableau setting for Tableau Pulse, users will see a notice informing them that generative AI can produce inaccurate or harmful responses. Users have the option to leave feedback about the quality of the insight summaries that they see by selecting a thumbs-up or thumbs-down rating. AI in Tableau for Tableau Pulse is used to generate the language for insight summaries, but AI in Tableau isn't involved in the identification of data insights, and there are checks to ensure that no numbers change in the insight summaries. The insights that Tableau Pulse finds are grounded in the same types of statistical modeling used to analyze data in the traditional Tableau viz authoring experience. ### Turn on better semantic matches for Ask Q&A in Tableau Ask Q&A detects insights based on a single metric and suggests further questions. You can enter your own questions that adjust the time granularity and apply dimensional filters for the current metric view. For example, "Sales in California last week," "Zoom into technology," or "What about yesterday?" For more information, see [Ask Questions and Discover Insights in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm) and [How Tableau Approaches NLP with Q&A to Empower Everyone](https://www.tableau.com/blog/how-tableau-pulse-approaches-nlp-with-qa). Better semantic matches for Ask Q&A is turned off for your site by default. Turn on this setting to get the best semantic results when you use Ask Q&A to explore a single metric, in any language. Turning on this setting enhances semantic matching for any language when you use Ask Q&A. When this setting is on, questions and insights text are sent to OpenAI as part of the calculation process for semantic matching. All calls to OpenAI go through the [Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=sf.generative_ai_trust_layer.htm&type=5). **Note**: This feature doesn't require you to log in to your Salesforce org. 1. From the main Tableau Cloud navigation menu, select Settings, and then select the General tab. 2. Under AI in Tableau, select Tableau Pulse: Gets better semantic matches on insights in any language when asking questions. 3. Select Save. **Note**: AI in Tableau settings for Tableau Pulse are independent of the setting to deploy Tableau Pulse, meaning that turning on Tableau Pulse doesn't turn on settings for AI in Tableau. When you turn on an AI in Tableau setting for Tableau Pulse, users will see a notice informing them that generative AI can produce inaccurate or harmful responses. Users have the option to leave feedback about the quality of the insights surfaced as answers by selecting a thumbs-up or thumbs-down rating. ### Turn on Tableau Agent in Pulse Tableau Agent in Pulse uses AI in Tableau to take your analysis beyond individual metrics and reveal connections between groups of metrics. For more information, see [Ask Questions and Discover Insights in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm). Tableau Agent in Pulse is a Tableau+ feature; however, you can try Tableau Agent in Pulse for free for a limited time. For more information, see [Try Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/tableau_gai_trial.htm). **Note:** Enhanced Q&A (Discover) has been renamed to Tableau Agent in Pulse. The functionality remains the same. Only the name has changed. Tableau Agent in Pulse is turned off for your site by default. Turn on this setting to enable a conversational question and answer experience based on groups of metrics in Tableau Pulse. **Important:** Tableau Agent in Pulse requires a Salesforce org to be connected to Tableau Cloud. The connection settings are listed at the beginning of the AI in Tableau section of General settings in Tableau Cloud. Also, Einstein generative AI in Salesforce must be set up for the Salesforce org that you select. To make Tableau Agent in Pulse available in Tableau Cloud, you must configure changes in both Salesforce and your Tableau Cloud site. Follow the instructions for the multi-step procedure in [Configure Tableau Cloud sites for AI](https://help.tableau.com/current/online/en-us/setup_tabAI_site_setting.htm#configure-tableau-cloud-sites-for-ai). The trial of Tableau Agent in Pulse doesn't require a dedicated connection to a Salesforce org. To learn how to start the trial, see [Start your trial of Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/tableau_gai_trial.htm#start-trial). 1. Follow the instructions in the help topic [Configure Tableau Cloud sites for AI](https://help.tableau.com/current/online/en-us/setup_tabAI_site_setting.htm#configure-tableau-cloud-sites-for-ai). 2. From the main Tableau Cloud navigation menu, select Settings, and then select the General tab. 3. Under AI Settings by Feature, find the row for Tableau Pulse: Uses Pulse Discover for an in-depth, integrated exploration of groups of metrics and insights. 4. From the Actions (...) menu, select Turn On. To turn on the feature for only certain groups of users, select User Access, then select the groups to allow access. 5. Select Save. **Note**: AI in Tableau settings for Tableau Pulse are independent of the setting to deploy Tableau Pulse, meaning that turning on Tableau Pulse doesn't turn on settings for AI in Tableau. When you turn on an AI in Tableau setting for Tableau Pulse, users will see a notice informing them that generative AI can produce inaccurate or harmful responses. ## Turn off Personalized Insight Ranking The Personalized Insight Ranking setting is turned on for your Tableau site by default. When this setting is turned on, users can provide thumbs-up or thumbs-down feedback on insights. That feedback is then used by the Tableau Pulse insights platform to further personalize and rank the types of insights it shows to a user. This setting is independent of the setting to deploy Tableau Pulse. 1. From the main Tableau Cloud navigation menu, select Settings, and then select General. 2. Under Personalized Insight Ranking, select Turn on (Users can submit feedback to improve the insights they receive). 3. Select Save. When Personalized Insight Ranking is turned off, users won't be able to submit thumbs-up or thumbs-down feedback on individual insights. ## Troubleshoot metrics If users on your site don't see data when they create a metric definition or when they view a metric, there might be an issue with your data source. Be aware that if today’s date is the beginning of the current period for the time series, such as the first day of the month, the chart will display only that point. This isn’t an issue with your data source. New points in the time series will be added as the period progresses. **If a user is creating a metric definition and there's no data in the preview:** Tableau Pulse presents preview data for the current period to date. If the measure selected has no recent data, the user won't see a preview on the chart. Check the data source to verify that the data is updating. **If a user is viewing a metric that previously had data, but now there's no data:** Check to see if a field used by the metric was removed or changed in the data source. Edit the metric definition to account for this change, and the change will be reflected on all metrics based on that definition. For more information, see [Edit a metric definition](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#edit). [Skip to main content](#main-content) # Set Users’ Site Roles When you add users to a site on Tableau Cloud, independent of their license type, you must apply a _site role_ to them. The site role signifies the maximum level of access a user can have on the site. Along with content permissions, the site role determines who can publish, interact with or only view published content, or who can manage the site’s users and administer the site itself. ## How user licenses, site roles, and content permissions work together The intersection of a user’s license type, site role, and content permissions determines the level of access a user has on the Tableau site. 1. The license type is associated with the user. The site role you want to assign to the user determines the license type they require. If a user is a member of multiple Tableau Cloud sites, they must have a license for every site they belong to. 2. The site role is also set at the user level. If a user is a member of multiple Tableau Cloud sites, they will have independent site roles. For example, the same user can have the Site Administrator Creator site role on one site and the Viewer site role on another site. The site role defines the maximum capabilities the user can have. 3. Whether the site role’s maximum capabilities are available to the user depends on the permissions set on the content resources (projects, data sources, workbooks). For example, let's say that a user has the following access on a site: - Creator license - Explorer site role - Save permission capability on a project In this scenario, the license allows connecting to and creating new data sources in the web editing environment or Tableau Desktop, and a permission rule allows them to save in a project. However, their site role prevents them from being able to save, so their effective permissions don’t include the save capability. Therefore, the user can’t publish content to the site. Even if a user has a creator license and a creator site role, if they don’t have the save capability on at least one project, they can’t publish anything to the site. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm). ## Change a user’s site role 1. Sign in to the site as a site administrator, and go to the Users area. 2. Select the users, and then select Actions > Site Role. ![A table of site users with a dropdown menu open showing the option to remove users.](/tableau/next/en-us/online/en-us/Img/users_siterole_change.png) 3. Select the new site role, and then click Change Site Role. ![Select the new site role.](/tableau/next/en-us/online/en-us/Img/users_siterole_change_select_new.png) You can hover the pointer over the information icon to display a matrix that shows the maximum level of general capabilities each site role allows. For more information, continue to [General capabilities allowed with each site role](#site-role-capabilities-summary). ## General capabilities allowed with each site role **Note:** This information focuses on _site_ roles and is more generalized. For a list of common specific tasks available per _license_ role, see the matrix on the [For Teams & Organizations](https://www.tableau.com/pricing/teams-orgs "Open the Tableau pricing page for subscription-based licensing in a new browser window") tab on the Tableau pricing page. ### Tableau site roles

Site role name	Maximum capabilities this site role allows
Tenant roles that don't use a license
—Users with this role have access to Tableau Cloud Manager.
Cloud Administrator	Available on Tableau Cloud Manager only; not assignable on Tableau Cloud sites. This role is the highest level of administration within Tableau Cloud, enabling the creation of sites, management of users, and allocation of licenses across your organization at the tenant level. Cloud administrators don’t consume licenses and only have access to Tableau Cloud Manager. To gain site access, cloud administrators can assign themselves a site role through Tableau Cloud Manager, thereby gaining access to any site within the tenant. For more information, see Use Tableau Cloud Manager.
Site roles that use a Creator license
—Users with these site roles have access to Tableau clients such as Tableau Prep, Tableau Desktop, Tableau Bridge, and Tableau Mobile.
Site Administrator Creator	This is the highest level of access for a Tableau Cloud site. Unrestricted access to content as described above, but at the site level. Connect to Tableau or external data in the browser, Tableau Desktop, or Tableau Prep; create new data sources; build and publish content. On Tableau Server, server administrators can determine whether or not to allow site administrators to manage users and assign site roles and site membership. By default, on Tableau Server, and always on Tableau Cloud, site administrators are allowed these capabilities.
Creator	This is similar to the former Publisher site role, but allows new features. This site role offers non-administrators the maximum level of content access. Connect to Tableau or external data in the browser, build and publish flows, data sources and workbooks, have access to Dashboard Starters, and use interaction features on published views. Can also connect to data from Tableau Prep or Tableau Desktop, publish (upload/save) and download flows, workbooks and data sources.
Site roles that use an Explorer license
—Users with these site roles can access the server from the browser or Tableau Mobile.
Site Administrator Explorer	Same access to site and user configuration as Site Administrator Creator, but can’t connect to external data or virtual connections from the web editing environment. Can connect to Tableau published data sources to create new workbooks, and edit and save existing workbooks. Can't edit and save existing flows. Can't publish Tableau Prep flows.
Explorer (can publish)	Can publish workbooks from the web using existing data sources, browse and interact with published views, and use all interaction features. In the web editing environment, can edit and save existing workbooks. Can run Tableau Prep flows if granted the Run Flows permissions. Can't save new standalone data sources from data connections embedded in workbooks, and can’t connect to external data or virtual connections, or create new data sources. Can't edit and save existing flows. Can't publish Tableau Prep flows.
Explorer	Can browse and interact with published views. Can subscribe to content, create data driven alerts, connect to Tableau published data sources and open workbooks in the web authoring environment for ad-hoc queries, but they can’t save their work. Can’t connect to a virtual connection. Can't edit and save existing flows. Can't publish or run Tableau Prep flows.
Site roles that use a Viewer license
Viewer	Can see published views others have created and use most interaction features. Can subscribe to views and download as images or summary data. Can’t connect to data, create, edit, or publish content, or set data alerts. For a list of specific capabilities, see the Viewer column in the matrix on the Tableau pricing page. Note: Although the Viewer site role existed in previous versions, the new Viewer site role has additional capabilities.
Other site roles
Unlicensed	Unlicensed users can’t sign in to Tableau Server or Tableau Cloud. Users are assigned the Unlicensed role in the following circumstances: You import users from a CSV file and their license level is set to unlicensed. The number of available licenses is reached at the time you add or import users. You remove a user who owns content on the site. The user will still own the content but not be able to do anything with it.

## Who can publish content The following site roles allow the specified level of publishing access. - Site Administrator Creator; and Creator allow full connecting and publishing access. This includes connecting to data and publishing new flows, new workbooks and new data sources from Tableau Desktop and the web editing environment. The site roles also allow editing and saving existing published workbooks, or publishing updates to existing data sources. - Explorer (Can Publish) and Site Administrator Explorer have limited publishing capabilities, as described in [General capabilities allowed with each site role](#site-role-capabilities-summary). - Explorer, Viewer, Read Only, and Unlicensed don’t allow publishing. [Skip to main content](#main-content) # Set Web Edit, Save, and Download Access on Content If you’re enabling web authoring functionality on your site, you can configure more precisely which users on the site have access to this functionality. Using site roles and permissions rules at the content level, you can grant or deny Web edit, Save, or Download capabilities on projects, workbooks, and data sources. **Note:** This document strives to use the phrase _Web edit_ to specify the name of the capability in permissions rules, and _web authoring_ to refer to the general functionality of creating and modifying workbooks on the server. However, you might otherwise see these two phrases used interchangably. ## Why allow users to work on the site directly As an administrator, your initial thought about allowing people to populate a site with content, seemingly indiscriminately, might be one of skepticism. However, with a few controls, you can limit where this is done, while providing important benefits that centralized content management offers both you and your users. ### Web authoring pros and cons For publishers and business users, some benefits of web authoring include the following: - It provides analyst teams who work collaboratively with a central location in which to provide input. - It enables people who do not have Tableau Desktop to connect to data sources and create workbooks. - It enables people to access content when they are away from their Tableau Desktop computer or VPN, whether on a computer or a hand-held device. - It can provide a framework for enabling consistency across Tableau reports.(By making template workbooks available on the site, analysts can download or create new workbooks with data connections, branding, and formatting already in place. For administrators, benefits can include the following: - Fewer Tableau Desktop deployments to manage and support. - Fewer computers that need to have database drivers installed. - Capacity to govern content. - More accurate monitoring of what people are doing with Tableau. Some disadvantages to web editing include the following: - For analysts, web editing functionality is not as extensive as in Tableau Desktop (although it continues to evolve toward that parity). - For administrators, more people working on the server might mean upgrading systems. - Without publishing guidelines, content proliferation on the site is expected. This can confuse the people who rely on published Tableau dashboards and data sources, degrade server performance and data quality, and potentially affect data security. ## Managing permissions to help users avoid content proliferation To help users to avoid content proliferation on the site, many Tableau administrators use projects to allow varying levels of access to content. For example, one project can be configured to allow all users to edit and save workbooks; another can allow only approved publishers to save new content. To get a better idea how this works, see the following resources: - [Configure Projects, Groups, Group Sets, and Permissions for Managed Self-Service](https://help.tableau.com/v0.0/online/en-us/projects_data_gov.htm) - [Governed Self-Service at Scale](https://www.tableau.com/learn/whitepapers/governed-self-service-analytics-scale "View a whitepaper that describes a controlled self-service server environment"), a Tableau whitepaper by Rupali Jain. To view the PDF, you might need to provide your Tableau website credentials. These are the same ones you use for the community forums or to submit support cases. ## Coordinate edit and save capabilities with site roles for the appropriate level of access To edit, save, and download workbooks, users must have a site role that allows those actions, along with the capabilities—defined in permissions rules—that grant or deny editing-related access. ### Site role access - When the appropriate permissions are set at the content level, the Creator or Explorer (can publish) site role allows both Save (overwrite) and Save As/Download. Note that **File > Save** is only available to the workbook owner. When the **Save** permission capability has been granted at the project and workbook level, a non-owner user can overwrite the existing workbook in web authoring by selecting **File > Save As** and using the same workbook name. This overwrites the existing content and they become the owner and gain full access to the content. - The Explorer site role can be granted the **Web Edit** and **Save As/Download** capabilities, but they will not be able to save (neither overwriting existing nor saving changes to a new workbook). For more information, see [Web Editing and Web Authoring](https://help.tableau.com/v0.0/online/en-us/permissions.htm#webauthor). [Skip to main content](#main-content) # Setup Inbound Private Connect This topic explains how to set up Inbound Private Connect for a Tableau Cloud site. ## Prerequisites - Verify that your organization has enabled Inbound Private Connect. To check, log in to Tableau Cloud Manager, and select Settings. If you don't have the Private Connect tab, contact your account executive to enable Inbound Private Connect. - Record the Tableau Cloud pod name. For example, if your site hostname is `10ay.online.tableau.com`, the pod name is "10ay". - Record the Tableau Cloud Manager (TCM) tenant name. For example, if your TCM URL is `mytenant.cloudmanager.tableau.com`, your tenant name is "mytenant". - Record the Region common to both the Virtual Private Cloud (VPC) and Tableau Cloud pod. (Your AWS account must have a VPC in the same region as your Tableau Cloud pod.) See [IP addresses for data provider authorization](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#safelist) for a table with a list of pods and regions. - Record the Endpoint Service Name for your pod's region. The Endpoint Service Name is in the AWS Regions, IAM ARNs, and Endpoint Service Names table on the Tableau Cloud Manager Private Connect page. - The VPC must have Domain Name System (DNS) hostnames and DNS resolution enabled. For more information, see [DNS attributes for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/AmazonDNS-concepts.html#vpc-dns-support) in the AWS documentation. ## Step 1: Create a VPC endpoint Create an interface VPC endpoint in your AWS account that connects to the Tableau Cloud endpoint service. For more information, see [Create a VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint-aws) in the AWS documentation. 1. Name tag (optional): Name the endpoint if desired. 2. Type: Select the Endpoint services that use NLBs and GWLBs category. 3. Service name: Use the Endpoint Service Name that you recorded in the prerequisites. 4. Select Verify service to proceed with setup. 5. Make sure that Enable Cross Region endpoint isn't checked. 6. VPC: Select your AWS VPC. 7. Subnets: Select subnets in at least two Availability Zones for high availability. 8. Make sure that Enable DNS Name isn't checked. (Configure private DNS manually in Step 5.) 9. Security group: Select an existing security group or create one. (Configure security groups in step 3.) 10. Select Create endpoint. The new endpoint status should be Pending acceptance. 11. Select the new endpoint to see Details. 12. Record the Endpoint ID. (Example: `vpce-0123456789abcdef0`) 13. Record the first entry in the list of DNS names. (Example: `vpce-0123456789abcdef0-12345678.vpce-svc-0123456789abcdef0.us-west-2.vpce.amazonaws.com`) ## Step 2: Configure the endpoint in Tableau Cloud Manager Configure the Tableau Cloud side of Private Connect. 1. Log in to TCM. 2. Select Settings > Private Connect. 3. Under Inbound Connections, select Create. 4. Provide a Name and Description for the inbound private connection. 5. Select the Region. The region matches the VPC region and Tableau pod region. 6. VPC Endpoint ID: Use the Endpoint ID that you recorded in step 1. 7. Select Create. The new endpoint status should be Allocating. 8. Provisioning can take a few minutes. In the actions menu (...) of the new private connection, click Sync to refresh the status. 9. The private connection is ready when the status is Ready in TCM and Available on the AWS Endpoints page. (Refresh the endpoint list with the refresh icon.) ## Step 3: Configure security groups Configure a rule on a AWS security group to allow traffic. For more information, see [Control traffic to your AWS resources using security groups](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html) in the AWS documentation. - **Endpoint Security Group**: Allow HTTPS to the VPC Endpoint. Keep in mind that your particular network architecture may require other security group configurations. After you successfully establish the connection and configure the security group, proceed to Steps 4 & 5 in [DNS for Inbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_inbound_dns.htm). [Skip to main content](#main-content) # Sign In to Tableau Cloud You can sign in to Tableau Cloud from a Tableau _client_. Examples of clients include a web browser, Tableau Desktop, Tableau Bridge, and Tableau Mobile. You can sign in to your site directly, or from a Tableau view embedded in a web page. This topic discusses how to sign in to a Tableau Cloud site. For information on how to sign in to Tableau Cloud Manager as a cloud administrator, see [Sign In to Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_signin.htm). > [!WARNING] > > **Sign-in changes for Tableau with MFA users** > Starting April 2024, after entering your username from the Tableau Cloud sign-in page, the sign-in process redirects you to the Tableau provider sign-in page where you can enter your password. This change will give you a more seamless sign-in experience to other products and services across the Tableau platform. For more information, see [For sites with Tableau with MFA](#signin_mfa). ## Sign-in options and steps Depending on how your site admin set up your Tableau Cloud site, you will use one of the following ways to sign in (these are also referred to as _authentication_ types): - **Single sign-on** Single sign-on (SSO) means that your admin has set up the Tableau Cloud site so that you can use the same username and password (_credentials_) you use for other applications in your company. When you use SSO, your credentials are managed outside of Tableau Cloud by a third-party _identity provider_ (IdP). When you enter your credentials to sign in to Tableau Cloud, it's the IdP that lets Tableau Cloud know you are an approved user. - **Tableau with MFA** When multi-factor authentication (MFA) is enabled with Tableau authentication (also known as TableauID), you use a combination of your TableauID credentials and a verification method to access Tableau Cloud. TableauID credentials are made up of an email address and password that you use for accessing your Tableau Cloud site. These credentials also give you access to other content on the Tableau website such as white papers. You can choose a verification method after you register for MFA. For more information, see [Register for multi-factor authentication](#mfa_register_user). - **Tableau** If Tableau hasn't updated your site to require Tableau with MFA yet, you can continue to use Tableau authentication type on a temporary basis. ### How to know which type of credentials your site uses If your site is set up for single sign-on (SSO) credentials, generally your site admin will notify you, and you use the same user name and password you do for signing in to other applications in your organization. If your site is not setup for SSO, you sign in to your site using Tableau with MFA. In this case, you receive an email invitation to the site. When you click the link in the email, you can create your password. That email address and password become your TableauID. Then, you are prompted to register at least one verification method to use to confirm your identity each time your sign in. If you are not sure how the site is set up or which credentials to use, check with your Tableau Cloud site admin. ### To sign in (includes Tableau Cloud URL) Do one of the following, depending on where you're signing in:

When signing in from:	Do this:
A web browser	Enter the Tableau Cloud URL into the address bar: https://online.tableau.com
Tableau Desktop, to publish or access content	Select Server > Sign In, and enter the Tableau Cloud URL: http://online.tableau.com
Tableau Desktop, to sign in to Tableau Bridge	Select Server > Start Tableau Bridge Client.
Tableau Mobile app	Tap Sign In, and then tap Connect to Tableau Cloud.

**Note:** If using TableauID, the network must be configured to allow access to the required Tableau Cloud domains when signing in from client applications. For more information, see [Server's certificate is not trusted error](https://help.tableau.com/current/pro/desktop/en-us/sign_in_server.htm#certificate_error) in the Tableau Help. #### For sites with SSO 1. On the Tableau Cloud sign-in page, enter your email address and click Sign In. You are directed to the sign-in form for the identity provider if you've been added to only one site. Enter your user name again and your password. The third-party will authenticate you and direct you back to Tableau Cloud. 2. If you’ve been added to multiple sites with SSO, enter the site _Uniform Resource Identifier (URI)_ for the site you want to access, and then click Continue. As of January 2022, the site URI is required to maintain site privacy. The site URI is the unique identifier for your Tableau Cloud site and appears in the site URL after authenticating. For example, a site name "Company X" may appear in the URL as `https://us-east-1.online.tableau.com/#/site/companyx`. For the site URI, you would enter "companyx". To avoid remembering your site URI, you can bookmark site URLs in your browser to quickly redirect and authenticate to that Tableau Cloud site. ![Tableau Site URI login window.](/tableau/next/en-us/online/en-us/Img/to_signin_multisite.png) **Note:** If you don’t remember the site URI, click Forgot URI and follow instructions to verify your email address. Only one verification code is sent within five minutes, so be sure to check your spam folder if you don't see an email from Tableau. Be careful to enter the code correctly because multiple incorrect attempts can cause the code to expire. After verification, you're redirected to a list of sites associated with your username. You won't need to verify your email address again for 30 days on this client. #### For sites with Tableau with MFA Starting April 2024, after entering your username from the Tableau Cloud sign-in page, the sign-in process redirects you to the Tableau provider sign-in page where you can enter your password. This change will give you a more seamless sign-in experience to other products and services across the Tableau platform. **Note:** If accessing Tableau Cloud behind a firewall or proxy and sign-in problems occur, refer to the [Multiple Errors Accessing Tableau Cloud from Behind a Firewall or Proxy](https://help.salesforce.com/s/articleView?id=001473224&type=1) knowledge article for more information. 1. On the [Tableau Cloud sign-in](https://online.tableau.com/) page, enter your username (email address) and click Sign In. You'll be redirected to https://identity.idp.tableau.com/login. ![](/tableau/next/en-us/online/en-us/Img/to_sigin_siteSAML_page.png) 2. On the https://identity.idp.tableau.com/login page, enter your password and click Sign In again. You'll be redirected to https://verify.salesforce.com/v1/verify. **Note:** You can’t change your username on the https://identity.idp.tableau.com/login page. If you entered the incorrect username or are unable to sign in, go back to the initial [Tableau Cloud sign-in](https://online.tableau.com/) page, and try again. ![](/tableau/next/en-us/online/en-us/Img/to_signin_tabid_page.png) 3. Follow the Tableau Cloud prompt to verify your identity using the verification method you chose during the MFA registration process. For example, if you registered the Salesforce Authenticator app as your verification method, you see the following prompt. ![A mobile phone displays a Salesforce login that uses an authenticator app.](/tableau/next/en-us/online/en-us/Img/sf_auth_prompt.png) 1. Respond to the prompt by going to your mobile device and tapping the push notification. ![Salesforce authenticator for Tableau.](/tableau/next/en-us/online/en-us/Img/sf_auth_notification.png) 2. Verify the request details are correct and tap Approve. After your identity has been verified you are redirected to your Tableau Cloud site. ![Salesforce authenticator for Tableau.](/tableau/next/en-us/online/en-us/Img/sf_auth_approve.png) **Notes:** - If you are signing in to Tableau Cloud or registering for MFA for the first time, see [Register for multi-factor authentication](#mfa_register_user) section. - If you are signing in to Tableau Cloud when you have registered only one verification method that is either the built-in authenticator, security key, or recovery codes, you are redirected to register an additional backup verification method. 4. If your site admin has added you to multiple Tableau Cloud sites, select a site from the list of available sites that are associated with the credentials you provided. ![](/tableau/next/en-us/online/en-us/Img/to_signin_sitepicker.png) ### To sign out To sign out, select your display name in the upper-right corner of any page, and then select Sign Out. ![A dropdown menu with the Sign Out option selected.](/tableau/next/en-us/online/en-us/Img/to_signout.png) If your site uses single sign-on, and you do not see a Sign Out link, close the browser tab or window. The Sign Out link does not appear if your site and the identity provider that manages your company's user information are not configured to support single log-out. ## Remember your sign-in credentials If you want Tableau Cloud to remember your user name, select Remember me on the sign-in page. The next time you sign in, Tableau enters your user name. You still need to type your password. For sites with SSO authentication, Tableau remembers your user name and sets a default site as well. The next time you sign in, Tableau enters your user name and redirects you to the IdP for authentication without prompting for the site's URI. In both scenarios, the default site will be replaced if: - You sign in to a different Tableau Cloud site and select Remember me again. - You use deep links, URLs that point to specific sites, to access Tableau Cloud and select Remember me when signing in to that site. To make Tableau forget your user information, remove cookies using your web browser. ### Connected clients Your site admin has the option to allow direct sign-in from approved Tableau clients. For examples of clients, see this topic's introduction. After you sign in successfully from a recognized client, Tableau stores your credentials in a secure token that remembers your connection with Tableau Cloud. When this token is in place, you can access your Tableau Cloud site directly, without having to sign in. ### Clearing saved sign-ins - If you want to disconnect from your site, you can explicitly sign out from the connected client. For example, in Tableau Desktop, select Server > Sign Out. - To remove all existing server connections from Tableau Desktop, select Help > Settings and performance > Clear saved server sign-ins. **Note:** Site admins can disallow secure tokens that store users' connections to the site. ## Sign in to an embedded view in Internet Explorer When you browse to a web page that has an embedded view, you see a sign-in button in the frame where the view will appear. If you use Internet Explorer (IE), and after entering your credentials, the sign-in button is not replaced with the view, the browser security settings might be blocking access to the view. IE uses security zones to determine access levels to websites. To display Tableau embedded views in IE, you can add the website you visit and Tableau Cloud addresses to the correct security zone. ### Add web addresses to IE security zones 1. In Internet Explorer, browse to the website that contains the Tableau view. 2. Click the Tools button, and then select Internet Options. 3. On the Security tab, add the website to the appropriate security zone as follows: - If the site that contains the Tableau view is internal to your organization, select Local intranet, click Sites, and click Advanced. If the site is not already there, add it to the Websites list. - If the site is external to your organization, select Trusted sites, click Sites, and add it to the Websites list. 4. Add Tableau Cloud: Select Trusted sites, and in the Add this website to the zone box, enter \*.online.tableau.com. 5. Click Add, and then click Close. These steps were taken from the Microsoft Windows page [Security zones: adding or removing websites](http://windows.microsoft.com/en-us/windows/security-zones-adding-removing-websites). **Note:** The link provided will take you away from the Tableau website. Although we make every effort to ensure these links to external websites are accurate, up-to-date, and relevant, Tableau cannot take responsibility for the accuracy or freshness of pages maintained by external providers. Contact the external site for answers to questions regarding its content. ## Register for multi-factor authentication To help ensure account security, multi-factor authentication (MFA) became a Tableau Cloud requirement beginning February 1, 2022. To meet the requirement MFA with Tableau authentication might have been enabled. If MFA is enabled, you must register at least one verification method to confirm your identity each time you sign in to Tableau Cloud. **Note:** If you're using Tableau Desktop or Tableau Bridge in conjunction with Tableau Cloud, you must be running version 2021.1 and later. MFA is a secure account authentication method that requires you to prove your identity by providing two or more pieces of verification information, also known as “factors”, when you sign in to Tableau Cloud. The first factor is the username and password you use to sign in to Tableau Cloud (i.e., your TableauID credentials). The additional factor is a code generated by an authenticator app, such as Salesforce Authenticator or a third-party time-based one-time passcode (TOTP) app. To compare supported verification methods and review usage requirements, see [Verification Methods for Multi-Factor Authentication](https://help.salesforce.com/articleView?id=sf.mfa_supported_verification_methods.htm) topic in Salesforce Help. **Important:** - In most cases, verification methods for Tableau Cloud are mobile authenticator apps that you need to install on a mobile phone. - Security keys that support WebAuthn or U2F and built-in authenticators **can't** be used when authenticating to Tableau Cloud from **Tableau Desktop**, **Tableau Prep Builder**, **Tableau Bridge**, and **Tableau Content Migration Tool**. - Recovery Codes option is only available to you after registering your initial set of verification methods. To register for MFA 1. Sign in to Tableau Cloud with your username and password. You are prompted to register for MFA. 2. Select a verification method. For example, click Salesforce Authenticator. ![A Tableau page with four verification methods to choose from.](/tableau/next/en-us/online/en-us/Img/mfa_methods_prompt.png) 3. Follow the steps in the Tableau Cloud dialog to associate the selected verification method with your Tableau Cloud account. For example, if you selected the Salesforce Authenticator app in step 2, you are prompted to do the following: 1. On an iOS or Android mobile device, download and install the free Salesforce Authenticator app from the App Store or Google Play. 2. On the mobile device, after the app installation completes, open the app and tap Add an Account. 3. In Tableau Cloud, enter the two-word phase from the app in the dialog and click Connect. ![A Tableau form with instructions on connecting to the Salesforce Authenticator.](/tableau/next/en-us/online/en-us/Img/mfa_methods_sfauth_prompt.png) 4. To complete the sign-in process, Tableau Cloud prompts you to approve the request through the authenticator app on the mobile device. By accepting the request, you are verifying your identity. You are then redirected to your site. For example, if using the Salesforce Authenticator verification method, do the following: 1. When Tableau Cloud shows you the following prompt, respond to the push notification on your mobile device. ![A phone screen displaying a Salesforce Authenticator login interface.](/tableau/next/en-us/online/en-us/Img/mfa_desktop_prompt.png) 2. In the Salesforce Authenticator app, verify the request details are correct. 3. Tap Approve. You are redirected to your site. ### Manage verification methods After you start using MFA, you can manage verification methods by clicking the Manage MFA Verification Methods link in your My Account Settings page in Tableau Cloud. On this page, you can add or remove additional verification methods, including Recovery Codes. For example, if you get a new mobile phone, delete any verification methods on the old mobile phone. If you're unable to copy your authenticator app configuration by restoring it from a backup to your new mobile phone, you must install and register an authenticator app again. For more information, see [Manage Your Account Settings](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm). ![](/tableau/next/en-us/online/en-us/Img/mfa_methods_manage.png) ### About recovery codes - emergency cases only To help reduce the risk of a locked-out scenario, we recommend you add Recovery Codes as backup after registering for MFA. Recovery codes, to be used in emergency scenarios only, allow you to sign in to Tableau Cloud if you don't have access to your usual MFA verification methods. If you add Recovery Codes option, a list of ten one-time use codes are generated for you that you can use to sign in to Tableau Cloud. **Important:** - Because the list of recovery codes are not accessible after you've added the Recover Codes option, immediately copy and store these codes in a safe and secure location so that you can use them in emergency situations. - Recovery codes should not be used as your primary verification method. Instead, recovery codes should be used in emergency scenarios only when you don’t have access to your usual MFA verification methods. ### Regain site access after being locked out **Important:** We strongly recommend that you add Recovery Codes option to help avoid being locked out of your site. Recovery codes should be used in emergency scenarios only. If you lose all your usual MFA verification methods, you must contact your Tableau Cloud site admin and request your MFA verification methods be reset. After your MFA verification methods have been reset, follow the procedure in [Register for multi-factor authentication](#mfa_register_user) to register for MFA again. [Skip to main content](#main-content) # Sign In to Tableau Cloud Manager Cloud administrators can sign in to Tableau Cloud Manager (TCM) from the Tableau Cloud sign-in page. If you have access to more than one resource, such as sites or tenants, you can navigate between them from the site picker menu after authenticating. When you're added as a cloud administrator, you receive an email with a link to access TCM. For more information about adding users, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm). ## Sign-in options and steps Depending on how Tableau Cloud Manager (TCM) is set up, you'll use one of the following ways to sign in as a cloud administrator (also referred to as _authentication_ types): - **Single sign-on** Single sign-on (SSO) means that TCM is set up to use the same username and password (credentials) you use for other applications in your company. With SSO, your credentials are managed outside of Tableau by a third-party identity provider (IdP). When you sign in to TCM, it's the IdP that lets Tableau know you're an approved user. TCM supports authentication through Google, OIDC, Salesforce, and SAML. - **Tableau with MFA** When multi-factor authentication (MFA) is enabled with Tableau authentication (also known as TableauID), you use a combination of your Tableau with MFA credentials and a verification method to access TCM. TableauID credentials are made up of an email address and password that you use for accessing TCM. These credentials also give you access to other content on the Tableau website such as white papers. You can choose a verification method after you register for MFA. For more information, see [Register for multi-factor authentication](#mfa-register-user). ### How to know which type of credentials TCM uses If Tableau Cloud Manager (TCM) is set up for single sign-on (SSO) credentials, a cloud administrator notifies you, and you use the same username and password you do for signing in to other applications in your organization. If TCM isn't set up for SSO, you can sign in using Tableau with MFA. In this case, you receive an email invitation to TCM. When you click the link in the email, you can create your password. That email address and password become your TableauID. Then, you're prompted to register at least one verification method to confirm your identity each time you sign in. ### Sign in to Tableau Cloud Manager Do one of the following depending on the authentication type: #### For SSO 1. On the [Tableau Cloud Manager sign-in](https://cloudmanager.tableau.com/) page, enter your email address and click Sign In. 2. Enter the Uniform Resource Identifier (URI) for the Tableau Cloud Manager (TCM) you want to access, and then click Continue. You're directed to the sign-in form for the identity provider to complete authentication. The URI is a unique identifier for TCM and appears in the URL after authenticating. For example, https://**cloudmanageruri**.cloudmanager.tableau.com. To quickly redirect and authenticate to TCM, bookmark the URL. **Note:** If you don't remember the Cloud Manager URI, click Forgot URI and follow the instructions to verify your email address. Only one verification code can be issued within a five-minute period. If you don't see the email, check your spam folder for a message from Tableau. It's important to enter the code correctly, as multiple incorrect attempts cause the code to expire. After verification, you're redirected to a list that displays the TCM and sites associated with your username. You don't need to verify your email address again for 30 days on this client. #### For Tableau with MFA 1. On the [Tableau Cloud Manager sign-in](https://cloudmanager.tableau.com/) page, enter your email address and password, and then click Sign In. 2. Enter the Uniform Resource Identifier (URI) for the Tableau Cloud Manager (TCM) you want to access, and then click Continue. 3. Enter your password and click Sign In again. 4. To complete the sign-in process, follow the Tableau Cloud prompt to verify your identity using the method you chose during MFA registration. - If you're signing in to TCM or registering for MFA for the first time, see [Register for multi-factor authentication](#mfa-register-user). - If you've only registered one verification method (built-in authenticator, security key, or recovery codes) when signing in to TCM, you're prompted to register an additional backup verification method. ### Sign out To sign out, select your display name in the upper-right corner of any page, and then select Sign Out. ![](/tableau/next/en-us/online/en-us/Img/to_signout.png) If Tableau Cloud Manager (TCM) uses single sign-on and you don't see an option to sign out, close the browser tab or window. The sign-out link doesn't appear if TCM and the identity provider managing your company's user information aren't configured to support single log-out. ## Remember your sign-in credentials If you want Tableau Cloud to remember your username, select Remember me on the sign-in page. This will populate your username the next time you sign in, but you'll still need to enter your password. For SSO authentication, Tableau remembers your username and sets a default Tableau Cloud Manager (TCM). When you sign in again, your username is populated, and you're redirected to the IdP for authentication without being prompted for the Cloud Manager URI. In both scenarios, the default TCM is replaced if: - You sign in to a different TCM and select Remember me again. - You use deep links, URLs that point to specific pages, to access Tableau Cloud and select Remember me when signing in to that TCM. To have Tableau Cloud forget your user information, clear your web browser's cookies. ## Register for multi-factor authentication To help ensure account security, multi-factor authentication (MFA) is a required security measure for all Tableau Cloud accounts. With MFA enabled, you must register at least one verification method for identity confirmation each time you sign in to Tableau Cloud Manager. MFA is a secure account authentication method that requires you to prove your identity by providing two or more pieces of verification information, also known as "factors", when you sign in to Tableau Cloud. The first factor is the username and password you use to sign in to Tableau Cloud (that is, your TableauID credentials). The additional factor is a code generated by an authenticator app, such as Salesforce Authenticator or a third-party time-based one-time passcode (TOTP) app. To compare supported verification methods and review usage requirements, see [Verification Methods for Multi-Factor Authentication](https://help.salesforce.com/articleView?id=sf.mfa_supported_verification_methods.htm) in Salesforce Help. Important: - In most cases, verification methods for Tableau Cloud are mobile authenticator apps that you must install on a mobile phone. - Recovery Codes option is only available to you after registering your initial set of verification methods. To register for MFA: 1. Sign in to Tableau Cloud Manager with your username and password. You're prompted to register for MFA. 2. Select a verification method. For example, click Salesforce Authenticator. ![](/tableau/next/en-us/online/en-us/Img/mfa_methods_prompt.png) 3. Follow the steps in the dialog to associate the selected verification method with your Tableau Cloud account. For example, if you selected the Salesforce Authenticator app in step 2, you're prompted to do the following: 1. On an iOS or Android mobile device, download and install the free Salesforce Authenticator app from the App Store or Google Play. 2. On the mobile device, after the app installation completes, open the app and tap Add an Account. 3. In Tableau Cloud, enter the two-word phrase from the app in the dialog and click Connect. ![](/tableau/next/en-us/online/en-us/Img/mfa_methods_sfauth_prompt.png) 4. To complete the sign-in process, Tableau Cloud prompts you to approve the request through the authenticator app on the mobile device. By accepting the request, you're verifying your identity. You're then redirected to Tableau Cloud Manager. For example, if using the Salesforce Authenticator verification method, do the following: 1. When Tableau Cloud shows you the following prompt, respond to the push notification on your mobile device. ![](/tableau/next/en-us/online/en-us/Img/mfa_desktop_prompt.png) 2. In the Salesforce Authenticator app, verify the request details are correct. 3. Tap Approve. You're redirected to Tableau Cloud Manager. [Skip to main content](#main-content) # Site Administrator Role and Tasks This topic describes the typical role of the Tableau Cloud site administrator, and how it differs from the related data manager role. It then lists the core tasks that the site administrator completes to set up your Tableau Cloud site. Additional topics in this section provide more information about each of the steps. ## How we define the site administrator role We define the site administrator as the person who is in charge of creating and maintaining the framework that enables Tableau Desktop users in your organization to publish, share, manage, and connect to data sources and workbooks. For example, a site manager works with site users and their permissions, in contrast to working directly with content that is published to the site. The Tableau Cloud site administrator is typically part of the IT team at your organization. If your organization doesn’t have a formal IT team, the site administrator might be a savvy Tableau Desktop user who takes on this role (the _accidental admin_, so to speak). ### Tasks that are typically outside the site administrator’s realm In this documentation, we make a distinction between the roles of site administrator and data manager, which is the role for the person who creates and publishes data sources to Tableau Cloud. Even so, in your organization, the same person might cover both roles. In practice, you’ll divide these responsibilities in the way that works best in your environment. To learn more about the data manager’s realm, see [Publish Data Sources and Workbooks](https://help.tableau.com/current/pro/desktop/en-us/help.htm#publish_overview.htm). ## Steps for setting up your site The table below shows a loose sequence of steps for setting up a site. You can complete the steps in any order that makes sense for you. At the bottom of this topic you’ll find a list of links to more resources for each of the steps. Before you configure the site, we recommend getting acquainted with the site authentication options, users’ site roles, projects, and permissions. Create and document a plan for your projects, groups, and overall permissions strategy. Setting up a test project to experiment with different settings is a good way to iron out these issues. You can change many site settings after your users are working with the site, but try to go in with the intention of minimizing post-production changes.

Upload your logo	This simple first step helps you get familiar with the environment while you incorporate your organization's branding into your site. Sign in, go to the Settings page, and upload your logo where indicated.
Configure site access	If your organization uses single sign-on, you can configure your site to use Google or SAML authentication. Otherwise, you can use the default Tableau ID authentication, where each user signs in using an email address and password that is unique to Tableau Cloud. In addition to the authentication type, you can determine whether to allow users to sign in directly from Tableau clients after signing in the first time. This is enabled by default.
Create projects	Projects help you manage users’ access (permissions) to data sources and workbooks that are published to your site. You can set default groups and permissions for all content on the Default project, lock the project, and then use it as a template for additional projects you create. Projects can also serve as staging environments.
Set up the permissions structure	In Tableau, permissions work with site roles to make up a user’s access to the site and its content.
Add users	Each user who accesses Tableau Cloud must sign in. Determine the users you want to be able to sign in to the site. If you enabled Google or SAML authentication, determine which of those users will sign in with their single sign-on credentials, and which will use TableauID credentials. Add or import multiple users at a time based on their authentication type.
Get your data to Tableau Cloud	We recommend that you designate a Tableau Desktop user who will publish vetted data sources to the site (that is, who will serve in the data manager role mentioned earlier). These will be the shared data sources that other Tableau users can connect to. As the site administrator, you can centrally manage data source permissions. Other attributes that either you or the data manager can maintain centrally are connection information (credentials, access tokens) and refresh schedules for cloud data sources. For more information, see Keep Data Fresh.
Analyze site usage and performance	You can monitor usage of published data sources and workbooks, the success of extract refresh tasks, user activity, and so on.

## Other articles in this section [Skip to main content](#main-content) # Site Content Data Source The Site Content data source provides essential governance information about the projects, data sources, flows, workbooks, and views on a site. The data provided about a content item may be unique to its item type. Item types with unique fields are in folders with titles that correspond to their Item Type. Starting in December 2023, the Site Content data source includes Tableau Pulse information for your site. You can find the fields dedicated to Tableau Pulse within the "Metric" folder while creating views. **Note:** Users that connect to the Site Content data source see data about all content items on the site, regardless of the permissions set for each item. Keep this in mind if you plan to distribute to non-administrative users. ## Create custom views If you're a site admin or someone who has been granted access to the Admin Insights project, you can access the Admin Insights data sources directly from Tableau Cloud using Web Authoring or through Tableau Desktop to build custom views. For more information about connecting to Admin Insights data sources, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Example: What percent of site published data sources are certified? Use the following steps to create a view that displays the percentage of certified published data sources on the site. 1. Connect to the Site Content data source. 2. From the Data pane, drag Migrated Data (Count) to the Columns shelf. 3. From the Data pane, drag Data Source Content Type to the Filters shelf, clear the All checkbox, and select the Published checkbox. 4. From the Data pane, drag Data Source Certified to Color on the Marks card. 5. Right-click the CNT (Migrated Data) field in the Columns shelf and select Quick Table Calculation > Percent of Total. ### Example: How can I review content by tag? Use the following steps to create a view that displays tagged content on the site. 1. Connect to the Site Content data source. 2. Create a parameter that contains the tag values you're searching for. The parameter will be used in the calculated field. For more information on how to create a parameter, see [Create Parameters](https://help.tableau.com/current/pro/desktop/en-us/parameters_create.htm) in Tableau Desktop and Web Authoring Help. 3. From the toolbar, click Analysis > Create Calculated Field. 1. Use this calculation to return only the content where the parameter value matches an entire tag. 1. Name: Tag Filter (Exact) 2. Calculation: CONTAINS(\[Tags\], "||" + + "||") **Note:** All tags are combined into a single string and delimited by the double-pipe (||) character. 2. Use this calculation to return content where the parameter value appears anywhere within the \[Tags\] string. 1. Name: Tag Filter (Wildcard) 2. Calculation: CONTAINS(\[Tags\], ) 4. From the Data pane, drag your calculation to the Filters shelf. ## Do more with your data Using Tableau Prep, you can join Site Content with other Admin Insights data sources on the following fields to get more visibility into your site. If you're analyzing data from multiple Tableau Cloud sites, you must also join on "Site LUID = Site LUID". - Join Site Content to TS Events on "Item ID = Item ID" and "Item Type = Item Type" - Join Site Content to TS Users on "Owner Email = User Email" or "Owner Email = Item Parent Project Owner Email" For more information, see [Aggregate, Join, or Union Data](https://help.tableau.com/current/prep/en-us/prep_combine.htm) in Tableau Prep Help. ## Data schema The following table lists the fields included in the Site Content data source. Each row of data corresponds to a unique content item, with Item LUID as the unique identifier for content in a Tableau Cloud site. **Note:** The Site Content data source doesn't include virtual connection information.

Folder	Field Name	Type	Description
Data Source	Data Source Content Type	String	Indicates if the Data Source is Published or Embedded. Will be NULL for any Items that are not Data Sources.
	Data Source Database Type	String	Type of database connection (i.e. mysql, postgres, sqlproxy, etc.). Will be NULL for any Items that are not Data Sources.
	Data Source Is Certified	Boolean	Whether or not the Data Source is a Certified Data Source. Will be NULL for any Items that are not Data Sources.
Dates	Created At	Date-time	Date and time the item was created, in UTC.
	Created At (Local)	Date-time	Date and time the item was created, adjusted by the Timezone parameter.
	Extracts Incremented At	Date-time	Date and time the data source was incrementally refreshed, in UTC. For incremental refreshes only.
	Extracts Incremented At (Local)	Date-time	Date and time the data source was incrementally refreshed, adjusted by the Timezone parameter.
	Extracts Refreshed At	Date-time	Date and time the data source was last refreshed, in UTC. For full extract refreshes only.
	Extracts Refreshed At (Local)	Date-time	Date and time the data source was last refreshed, adjusted by the Timezone parameter.
	First Published At	Date-time	Date and time the item was first published, in UTC.
	First Published At (Local)	Date-time	Date and time the item was first published, adjusted by the Timezone parameter you've set.
	Last Accessed At	Date-time	Date and time the item was last accessed, either by accessing a View or connecting to a Data Source, in UTC.
	Last Accessed At (Local)	Date-time	Date and time the item was last accessed, either by accessing a View or connecting to a Data Source, adjusted by the Timezone parameter you've set.
	Last Published At	Date-time	Date and time the item was last published, in UTC.
	Last Published At (Local)	Date-time	Date and time the item was last published, adjusted by the Timezone parameter you've set.
	Updated At	Date-time	Date and time the item was last updated, in UTC.
	Updated At (Local)	Date-time	Date and time the item was last updated, adjusted by the Timezone parameter you've set.
Hyperlinks	Item Hyperlink	String	Full URL of the item on the site. (Useful for creating hyperlinks to the item).
Hyperlinks	Site Hyperlink	String	The root URL of the Tableau Cloud site
Item	Description	String	The text description of the item. Will be NULL for View items.
	Has Incremental Extract	Boolean	Whether or not it is possible to perform an incremental extract for this Workbook or Data Source.
	Has Refresh Scheduled	Boolean	Whether or not the Workbook or Data Source has extracts being refreshed on a schedule.
	Has Refreshable Extract	Boolean	Whether or not refreshable extracts are available for the Workbook or Data Source. (For example: .hyper files published via REST API are not refreshable from Tableau Cloud, so those extracts would be labeled False)
	Is Data Extract	Boolean	Whether or not the Workbook or Data Source contains an Extract.
	Item ID	Number	The ID of the item. The ID is unique within each Item Type and Site.
	Item LUID	String	The LUID of the item. The LUID is unique within each item type and site. Primarily used to reference content via the REST API.
	Item Name	String	Display name of the item
	Item Parent Project ID	Number	Item ID of the parent project that contains the item, such as a workbook or data source. The Item ID of this item's Parent Project. (Ex: The Item ID of the Project a Workbook resides in.)
	Item Parent Project Level	String	The Project Level of this item's Parent Project. (Ex: The Project Level of the Project a Workbook resides in.)
	Item Parent Project Name	String	The name of the item's parent project. For example, the item name of the project a workbook resides in.
	Item Parent Project Owner Email	String	The email address of the parent project owner
	Item Revision	Number	The revision number of the item
	Item Type	String	The type of item that this content is. Either a Data Source, Flow, Project, View or Workbook.
	Owner Email	String	Email address of the item owner
	Tags	String	List of tags applied to the item. All tags are combined into a single string and delimited by the double-pipe (\|\|) character.
	Top Parent Project Name	String	The name of the item's top parent project. For example, the item name of the project at project Level 0 of this item's project hierarchy. Will be NULL for top-level projects.
-	Size (bytes)	Number	The size of the item in bytes (÷1,000,000,000 for GB)
	Size (MB)	Number	The size of the item in MB (÷1,000 for GB)
	Total Size (bytes)	Number	The total size of the item in bytes (÷1,000,000,000 for GB)
	Total Size (MB)	Number	The total size of the item in MB (÷1,000 for GB)
Metric	Adjustable Filter Options	String	The fields added as adjustable filter options to a metric definition, or the filter options selected on a metric.
	Has Definition Filters	String	Whether or not there are definition filters applied.
	Metric Definition Aggregation	String	The aggregation for the measure being tracked.
	Metric Definition Data Source ID	String	The data source that the metric definition is connected to
	Metric Definition ID for Related Metric	String	The definition that the metric is related to
	Metric Definition Number Format	String	The format for the metric value
	Metric Time Granularity	String	The level of detail that the data is aggregated at
Project	Controlled Permissions Enabled	Boolean	The asset permissions setting for projects. When true, project permissions are locked, and assets inherit project permission rules.
	Controlling Permissions Project LUID	String	The LUID of the project that controls permissions for the nested project
	Controlling Permissions Project Name	String	The name of the project that controls permissions for the nested project
	Nested Projects Permissions Enabled	Boolean	The asset permissions setting for nested projects. When true, nested project permissions are locked, and assets inherit permission rules from the parent project.
	Project Level	Number	The level of the project within its hierarchy. The value increments by 1 for each level: 0 = Top-level project, 1 = A project whose parent is a top-level project, 2 = A project whose parent's parent is a top-level project, and so on. The value is NULL for any items that are not projects.
Site	Site LUID	String	LUID of the site associated with the user. Primarily used for referencing a site in the REST API.
Site	Site Name	String	The name of the Tableau Cloud site
-	Storage Quota (bytes)	Number	The storage capacity of the Tableau Cloud site in bytes.
View	View Title	String	The title of the view. The value is NULL for items that are not views.
	View Type	String	The type of view. Either a story, dashboard, or sheet. The value is NULL for items that are not views.
	View Workbook ID	Number	ID of the parent workbook of the view. Primarily used for hyperlinks and the REST API. The value is NULL for items that are not views.
	View Workbook Name	String	Display name of the parent workbook of the view. The value is NULL for items that are not views.
Workbook	Workbook Shows Sheets As Tabs	Boolean	Whether or not the sheets of the workbook are displayed as tabs. The value is NULL for items that are not workbooks.
-	Admin Insights Published At	Date-time	Date and time the Admin Insights data source was last published in UTC
-	Timezone	String	Specifies the timezone for displaying dates. This field represents an integer value used to determine the number of hours to offset from UTC. It doesn't account for Daylight Saving Time adjustments.

[Skip to main content](#main-content) # Site Settings Reference Customize a site for your organization using the settings below. To view and edit site settings, you must be a Site Administrator on Tableau Cloud or Server Administrator on Tableau Server. Site settings are displayed differently in Tableau Cloud and Tableau Server. The settings available to you depend on your site configuration and whether you use Tableau Cloud or Tableau Server. To easily find a specific setting below, press Ctrl+F (Windows) or Command+F (macOS) and search for the setting. ## Accessing site settings - (Tableau Cloud) From the Home page, expand the side pane, and click Settings at bottom. ![Tableau Cloud navigation menu with settings option.](/tableau/next/en-us/online/en-us/Img/site_settings_sidebar.png) - (Tableau Server) If you're editing an existing site, select it on the Sites page, and then select **Edit Settings**. Or, in a single-site deployment, click Settings at the bottom of the side pane. ![Edit Settings on a Tableau Site.](/tableau/next/en-us/online/en-us/Img/sites_ms_edit.png) ## General tab

Setting	Description
Site Name and ID (Tableau Server Administrators only)	Specifies the site name seen in the user interface and the ID seen in the site URL. (If you’re editing the Default site, you can’t change the ID.) You can't change the “#/site” portion of the URL (for example, http://localhost/#/site/sales). In multi-site server environments, these segments appear in the URL for sites other than the Default site.
Storage (Tableau Server Administrators only)	Select either Server Limit or GB, and for the latter enter the number of gigabytes you want as a limit for storage space for published workbooks, extracts, and other data sources. If you set a server limit and the site exceeds it, publishers will be prevented from uploading new content until the site is under the limit again. Server administrators can track where the site is relative to its limit using the Max Storage and Storage Used columns on the Sites page.
Revision History (Tableau Server Administrators only)	Specifies the number of previous versions of workbooks, flows, and data sources that are stored on the server.
Tableau Prep Conductor	Controls whether users with appropriate permissions can schedule and monitor flows. Tableau Prep Conductor is part of Data Management. For more information, see Tableau Prep Conductor.
Web Authoring	Controls whether browser-based authoring is enabled for the site. When web authoring for workbooks is disabled, users can't create or edit published workbooks from the server web environment but instead must use Tableau Desktop to republish the workbook. When web authoring for flows is disabled, users can't create or edit published flows from the server web environment but instead must use Tableau Prep Builder to re-publish the flow. For more information, see Set a Site’s Web Authoring Access and Functions in Tableau Cloud Help.
Managing Users (Tableau Server Administrators only)	Determines whether only server administrators can add and remove users and change their site roles, or whether site administrators can too. If you allow site administrators to manage users, specify how many users they can add to the site by selecting one of the following: Server Limit adds the number of available server seat licenses. For a server with core-based licensing, there’s no limit. Site Limit lets site administrators add users up to a limit you specify. Site Role Limit lets site administrators add users of each site role up to the license limit you specify for the site. For more information, see View Server Licenses.
Guest Access (Tableau Server Administrators only)	Lets people who lack a Tableau Server account see views that have guest access permissions. Note: If you use Tableau Server, your administrator can disable Guest Access.
Tableau Catalog	Turns off Catalog capabilities when Tableau Server or a Tableau Cloud site is licensed with Data Management. For more information, see Disable Catalog.
Workbook Performance after a Scheduled Refresh (Tableau Server Administrators only)	Pre-computes recently viewed workbooks with scheduled refreshes to open them faster. For more information, see Configure Workbook Performance after a Scheduled Refresh.
Workbook Performance Metrics (Tableau Server Administrators only)	Lets site users collect metrics on how workbooks perform, such as how quickly they load To initiate recording, users must add a parameter to the workbook's URL. For more information, see Create a Performance Recording.
Managed Keychain Clean Up (Tableau Server Administrators only)	Lets site administrators manage saved credential keychains for OAuth connections on the site. For more information, see OAuth Connections.
Automatically Suspend Extract Refresh Tasks	To save resources, Tableau can automatically suspend extract refresh tasks for inactive workbooks. This feature applies only to refresh schedules that run weekly or more often. For more information, see Automatically Suspend Extract Refreshes for Inactive Workbooks in Tableau Cloud Help.
Linked Tasks (Tableau Server and Site Administrators only)	Lets Server administrators enable users to schedule flow tasks to run one after the other. They can also enable users to trigger the scheduled flow tasks to run using Run Now. This setting can be applied at the server level to include all sites on Tableau Server. The setting can be disabled at the site level to include only specific sites. If the setting is turned off after linked tasks are scheduled, any tasks that are running will complete and the scheduled linked tasks are hidden and no longer show on the Scheduled Tasks tab. For more information, see Schedule Linked Tasks.
Email Language (Tableau Cloud only)	Sets the default language for site invitation emails sent to new users. For more information, see Set the Language for Invitation Emails.
Email Settings (Tableau Server Administrators only)	Specifies the From address and message footer seen in automatic emails for alerts and subscriptions.
Site Invite Notification (Tableau Cloud only)	For sites with single-sign-on authentication, sends an invite email when new users are added to the site.
Site Logo (Tableau Cloud only)	Specifies the image that appears with the site name.
Start Page	Controls which site page appears when users sign in. By default, the Home page appears, but you can instead open All Projects, All Workbooks, or other pages. For more information, see Set the Default Start Page in Tableau Cloud Help. Note: If you use Tableau Server, your administrator can override this site setting.
Tableau Pulse - Deployment (Tableau Cloud only)	Controls whether Tableau Pulse is available for all users, a group of users, or no users. For more information, see Set Up Your Site for Tableau Pulse.
Tableau Pulse - Digest - Let users receive email and Slack digests and alerts (Tableau Cloud only)	Controls whether users can receive Tableau Pulse digests and alerts via different channels. For more information, see Set Up Your Site for Tableau Pulse.
Tableau Pulse - Digest - Digest start time (Tableau Cloud only)	Determines the time at which Tableau Pulse starts generating digests. For more information, see Set Up Your Site for Tableau Pulse.
Tableau Pulse - Digest - Weekly and monthly schedule (Tableau Cloud only)	Determines the day of week and day of month when weekly and monthly digests are generated. For more information, see Set Up Your Site for Tableau Pulse.
AI in Tableau (Tableau Cloud)	This section includes multiple settings that control whether generative AI is enabled for Tableau features. Some generative AI features require Tableau+ and a connection to a Salesforce org with Einstein generative AI set up. For more information about how to turn on AI in Tableau features, see Turn On AI in Tableau for Your Site. To learn more about AI in Tableau, see AI in Tableau.
AI in Tableau (Tableau Server)	This section includes multiple settings that control whether generative AI is enabled for Tableau features. This feature, available starting in version 2025.3, enables you to connect to your own Large Language Model (LLM ) provider to turn on Tableau Agent in Tableau Server for Tableau Web Authoring and Tableau Prep. For more information see, Turn on AI in Your Tableau Server Site.
Personalized Insight Ranking (Tableau Cloud only)	Controls whether users can provide thumbs-up or thumbs-down feedback on individual insights. When this setting is turned on and users provide feedback, that feedback is used by the Tableau Pulse insights platform to further personalize and rank the types of insights it shows to a user. This setting is independent of the setting to deploy Tableau Pulse. When Personalized Insight Ranking is turned off, users won't be able to submit thumbs-up or thumbs-down feedback on individual insights. For more information, see "Turn off Personalized Insight Ranking" in Set Up Your Site for Tableau Pulse.
User Visibility	Controls what user and group names are visible to other users. For more information, see Manage User Visibility in Tableau Cloud Help.
Availability of Ask Data	Controls whether Ask Data lenses are enabled or disabled for data sources. Ask Data lets users query data using conversational language and automatically see visualizations. For more information, see Automatically Build Views with Ask Data in Tableau user Help.
Availability of Explain Data	Controls whether site users with the appropriate permissions can run Explain Data and authors can access Explain Data Settings. For more information, see Control Access to Explain Data. To learn more about Explain Data, see Discover Insights Faster with Explain Data.
Automatic Access to Metadata about Databases and Tables	Automatically grants users certain capabilities to external assets using derived permissions. For more information, see Turn off derived permissions in Tableau Cloud Help.
Sensitive Lineage Data	Specifies whether sensitive lineage data should be obfuscated or filtered when users don’t have the appropriate permissions to related metadata. For more information, see Sensitive lineage data.
Cross-Database Joins	Determines where the join process happens when joining data from multiple sources. For more information, see Combine Tables from Different Databases in Tableau user Help.
Extract Encryption at Rest (Tableau Server Administrators only)	Lets you encrypt .hyper extracts while they are stored on Tableau Server. Server administrators can enforce encryption of all extracts on their site or allow users to encrypt all extracts associated with particular published workbooks or data sources. For more information, see Extract Encryption at Rest.
Tableau Support Access (Tableau Cloud only)	Allows Tableau Support technicians access to the site to help troubleshoot support cases. By default, this feature is disabled. For more information, see Enable Support Access.
Sharing	Allows users to share items directly with other users. When an item is shared, the recipients get a notification and the item is added to their Shared with Me page. If this is not enabled, users can only copy a link to share. For more information, see Share Web Content in Tableau user Help.
Comments	Controls whether users can add remarks in a Comments side pane for each view and @mention other Tableau users to notify them via email. For more information, see Comment on Views in Tableau user Help.
Data-Driven Alerts	Lets users automatically receive emails when data reaches key thresholds. For more information, see Send Data-Driven Alerts in Tableau user Help.
Subscriptions	Lets site users subscribe to views and receive regular emails of them. On Tableau Server, these options are available only if you first configure subscription settings.
High-Visibility Data Labels in View and Workbook Subscriptions	Controls whether subscriptions include relevant upstream high visibility data quality warnings and sensitivity labels in the email. On Tableau Server, these options are available only if you first turn on and configure subscriptions. For more information on data quality warnings, see Set a Data Quality Warning. For more information on sensitivity labels, see Sensitivity Labels. Previously titled Data Quality Warnings in Subscriptions. Note: Data quality warnings and sensitivity labels are a feature of Tableau Catalog, which is part of Data Management.
Tagging	Specifies the number of tags that users can add to items. The default limit is 50 tags, and the maximum is 200. For more information, see Use Tags.
Recommendations for Views	Controls whether recommendations show on the site and whether the names of users who have looked at recommended items show on recommendation tooltips. Note: If you use Tableau Server, your administrator can disable Recommendations.
Request Access	Lets users send access requests to content or project owners. For more information, see Let Site Users Request Access to Content in Tableau Cloud Help.
Metrics Content Type	Controls whether metrics are available on the site. When you turn metrics on, users can create metrics from views and metrics appear as a content type. When turned off, metrics won't appear on the site or continue to sync. If you turn on metrics again, pre-existing metrics will reappear and resume refreshing. For more information, see "Set Up for Metrics" in Tableau Cloud Help or Tableau Server Help. Retirement of the legacy metrics feature Tableau's legacy metrics feature was retired in Tableau Cloud in February 2024 and in Tableau Server version 2024.2. In October 2023, Tableau retired the ability to embed legacy metrics in Tableau Cloud and in Tableau Server version 2023.3. With Tableau Pulse, we've developed an improved experience to track metrics and ask questions of your data. For more information, see Create Metrics with Tableau Pulse to learn about the new experience and Create and Troubleshoot Metrics (Retired) for the retired feature.
Web Page Objects and Web Images	Controls whether these Web Page and Image objects can display target URLs. For more information, see Security for Web Page objects in Tableau user Help.
Personal Space	Allows Creator and Explorer site users to create and save content to a private Personal Space. When Personal Space is turned on, you can set user storage limits. For more information, see Create and Edit Private Content in Personal Space.
Custom Domain	Allows you to use a custom domain to redirect traffic to your site. You can configure a subdomain, like `analytics.example.com`, for easier embedding and access to content. For more information, see Use a Custom Domain with Tableau Cloud
Collections	Controls whether collections are available on the site. When you turn on collections, users can create collections to organize content and browse collections made available by other users. For more information, see Organize Items in a Collection.
Site Time Zone for Extracts	The default time zone for extract-based data sources in a site is Coordinated Universal Time (UTC). Site administrators can set a different time zone. For more information, see Set the Site Time Zone for Extracts in Tableau Server Help or Set the Site Time Zone for Extracts in Tableau Cloud Help.
Extract Quota Limit Notifications	Sends email alerts to all site administrators when extract refresh jobs are canceled because of extract job capacity issues.
Flow Parameters (Tableau Server and Site Administrators only)	Enables users to schedule and run flows that include parameters. Administrators can also enable flow parameters to accept any value. If this option is enabled, any flow user can enter any value in a parameter, potentially exposing data that the user should not have access to. Starting in version 2023.2, administrators can enable system parameters that allow users to apply date or time parameters to flow output names for file and published data source output types. When the flow is run, the start time is automatically added to the flow output name. Parameters can be entered in an input step for file name and path, table name, or when using custom SQL queries, in an output step for file name and path and table name, and in any step type for filters or calculated values. Flow parameter settings can be applied at the server level to include all sites on Tableau Server. The settings can be disabled at the site level to include only specific sites. For more information about using parameters, see Create and Use Parameters in Flows in the Tableau Prep help.
Run Now	Controls who can run jobs manually using the Run Now option from the web, Rest API, and Tabcmd. By default, this option is selected to allow users to run jobs manually. Clear the check box if only administrators should be allowed to run jobs manually. Note: If you use Tableau Server, your administrator can disable this site setting.
Manage Notifications	Controls how site users can receive notifications for events such as extract jobs, flow runs, when another user shares content with them or mentions them in a comment. Notifications can be seen in their Tableau site via the notification center, sent by email, or sent to a Slack workspace. When a notification is enabled, users can configure their notification preferences on their Account Settings page. Note: If you use Tableau Server, your server administrator can disable this site setting.
Customize Email Notifications (Tableau Cloud only)	Controls whether email notifications for data-driven alerts and subscriptions to workbooks and views are sent using the Tableau email server or your own SMTP server. You can connect your custom mail server using standard basic authentication or modern OAuth 2.0 for Microsoft 365. When you use your own SMTP server, you can customize the email sender's name, email address, and domain for links in the notification emails. Added for Tableau Cloud in February 2024. For more information, see Use a Custom SMTP Server for Email Notifications in Tableau Cloud Help. Separately from the SMTP settings, you can control whether the email notifications sent to users for data-driven alerts and subscriptions include links. These links direct users to your Tableau site to see the content and manage the alert or subscription. A link to unsubscribe is always included in notification emails, regardless of whether this setting is on. Added for Tableau Cloud in June 2023.
Flow Subscriptions	Controls whether flow owners can schedule and send emails with flow output data to themselves and others. When you allow flow subscriptions, you can control whether flow output data is included in the subscription email and whether flow output files are attached to the email. For more information, see Notify Users of Successful Flow Runs
OAuth Clients Registry	For a subset of connectors, you can register a custom OAuth client to override pre-configured OAuth client settings. By registering a custom OAuth client, you enable new and existing connections to use the custom OAuth client instead of the default OAuth client. For more information, see Configure Custom OAuth.
Personal Access Tokens (Tableau Cloud only)	Controls whether personal access tokens (PATs) creation is enabled for all users, a group of users, or no users. Also allows PATs expiration period to be customized. Changes to these settings apply only to new PATs. Existing PATs remain valid and unchanged. For more information about PATs, see Personal Access Tokens.
View Acceleration	Controls whether Creator and Explorer site users can accelerate the views in their Tableau Server workbooks for faster loading times. When you allow view acceleration, you can set a maximum number of views to be accelerated, and you can choose to automatically suspend acceleration for views that repeatedly fail the acceleration task. For more information, see View Acceleration.
Assertions for Group Membership	Enables local group membership to be controlled and managed by your SSO IdP or through a Tableau connected app by dynamically asserting group membership when a user authenticates to Tableau Cloud. Requires additional configuration in the SAML assertion, OIDC assertion, or JSON web token (JWT). For more information, see Dynamic group membership using assertions.
Group Sets	Enables the Group Sets page and the ability to create group sets. Group sets can be used by certain users (site admins, project owners, and content owners) to apply permission rules that require users to be members of all groups in the group set to access content whose permissions are dependent on the group set. For more information, see Work with Group Sets.
Block Non Extract	When enabled, embedded data source files that are not extracts or live query data sources cannot be uploaded. These include but are not limited to files such as `.csv`, `.xls`, and `.txt` that are not covered by extract encryption.
Recycle Bin	Controls whether Recycle Bin is turned on for a site, allowing admins and authors with Explorer (can publish) or Creator licenses to restore previously deleted projects, workbooks, and data sources for a selected period of time. For more information, see Recycle Bin.
Explore in Tableau (Tableau Cloud only)	Allows external Tableau partners to forward their users directly into a Tableau Cloud web authoring experience. When this capability is enabled, a new workbook connects to a data source from the user's data platform, letting them start their data analysis more quickly. For more information, see the Explore in Tableau API Help.

## Authentication tab (Tableau Cloud)

Setting	Description
Authentication Types	Specifies how users can sign in to the site, and how they access it after signing in the first time. Authentication verifies a user’s identity. For more information, see Authentication.
Default Authentication Type for Embedded Views	Specifies how users can sign in to embedded views. By default, Tableau authentication is selected.
Control User Access in Authentication Workflows	Enables user attribute functions used in content to accept the passing of user attributes from a JSON Web Token (JWT) through connected apps, OIDC claims, or SAML XML response. The user attributes are passed to Tableau to customize and control the data that can be shown to a user at runtime. For more information, see Embedding API v3 Help, OIDC or SAML topics.
System for Cross-domain Identity Management (SCIM)	Allows you to manage users on the site through a third-party identity provider (IdP). When enabled, the Base URL and Secret boxes are populated with values to use in the IdP SCIM configuration. For more information, see Automate User Provisioning and Group Synchronization through an External Identity Provider.
Connected Clients	Allows Tableau clients such as Tableau Mobile, Tableau Bridge, and others to stay authenticated to the server after a user provides sign-in credentials the first time. When turned off, users are required to sign in explicitly each time they visit Tableau Cloud. For more information, see Access Sites from Connected Clients.

## Bridge tab (Tableau Cloud)

Setting	Description
Client Not Running Notifications	Sends email alerts to data source owners when a client appears to be disconnected from the site.
Pooling	Distributes live queries and refresh jobs across all clients in Bridge pools. For more information, see Configure and Manage the Bridge Client Pool.
Private Network Allowlist	Add and manage domains that enable dedicated Bridge pool access to private network data on behalf of Tableau Cloud.

## Extensions tab

Setting	Description
Dashboard and Viz Extensions	Manage and control dashboard and viz extensions. Dashboard extensions are web applications that run in custom dashboard zones and can interact with the rest of the dashboard. Viz extensions are web applications that support new viz types. For more information, see "Manage Dashboard and Viz Extensions" in Tableau Cloud Help or Tableau Server Help.
Analytics Extensions	Enables a set of functions that your users can use to pass expressions to analytics extensions for integration with R and Python. For more information, see "Configure Connection with Analytics Extensions" in Tableau Cloud Help or Tableau Server Help.
Tableau Prep Extension	When authoring flows on the web, enables users to apply Einstein Discovery-powered models to their flows to bulk score predictions for their data. For more information, see Configure Einstein Discovery Integration in the Tableau Server help.

## Integrations tab

Setting	Description
Slack Connectivity	Displays connections between a Slack workspace and the Tableau site. When connected, Tableau site users can see their Tableau notifications in the connected Slack workspace. In Tableau Cloud, you can request that the Slack workspace administrator install the Tableau for Slack app, then finalize the connection once installed. For more information, see Integrate Tableau with a Slack Workspace.
Analytics Extensions	Enables a set of functions that your users can use to pass expressions to analytics extensions for integration with R and Python. For more information, see "Configure Connection with Analytics Extensions" in Tableau Cloud Help or Tableau Server Help.
Publish to Salesforce (Beta on Tableau Cloud and Tableau Server)	Allows site users to publish views to a Salesforce app. When a view is published to Salesforce, anyone with access to the selected app can see that the content exists. However, only those signed in with existing Tableau permissions can see the view. For more information, see Publish Views to Salesforce (Beta).

## Connected Apps tab

Setting	Description
Connected Apps	Create and manage Tableau connected apps, or explicit direct trust or OAuth 2.0 trust relationship between your Tableau Cloud site and custom applications and programmatically authorize access to the Tableau REST API on users' behalf using JSON web tokens (JWTs). For more information, see Use Tableau Connected Apps for Application Integration in the Tableau Cloud Help.

## Mobile tab

Setting	Description
App Lock	Requires a biometric method or device passcode for users to open this site on Tableau Mobile. For more information, see Enable App Lock for Added Security in the Tableau Mobile Deployment Guide.
Offline Previews	Controls whether offline previews are generated for display when users access the site on Tableau Mobile. For more information, see Manage Tableau Mobile Data on Devices in the Tableau Mobile Deployment Guide.
Mobile Security Policies	Some security policies are enabled automatically and cannot be disabled. Mobile security policies are not available for MAM versions of Tableau Mobile.
Jailbreak Detection	Controls whether a Tableau Mobile app user with a device that has been "jailbroken" or "rooted" is allowed to access content on Tableau, and what level of response occurs when a jailbroken or rooted device is detected. For more information, see Tableau Mobile App Security Settings.
Malware Detection (Android only)	Controls whether malware detection is enabled for mobile devices, and what level of response occurs when malware is detected. For more information, see Tableau Mobile App Security Settings. [!IMPORTANT] In September 2025, Tableau Mobile retired support for the malware detection setting. The malware detection setting was removed from the Tableau Cloud settings page in September 2025 and from the Tableau Server settings page in Tableau Server version 2025.2.3. Any configuration of the malware detection setting on previous versions of Tableau Server has no effect on the Tableau Mobile app.
Maximum Days Offline Without Policy Refresh	Controls whether there is a maximum number of days a mobile device can be offline and still use the app. For more information, see Tableau Mobile App Security Settings.
Prevent Debugging	Controls whether debuggers are prevented on mobile devices. For more information, see Tableau Mobile App Security Settings.
Screen Sharing and Screenshots (Android only)	Controls whether a Tableau Mobile user is able to take screenshots or use screen sharing while in the app. For more information, see Tableau Mobile App Security Settings.

[Skip to main content](#main-content) # Spell Check (Tableau Cloud and Tableau Server Only) As of Tableau 2024.2, you can use your web browser's built-in spell check functionality to identify spelling errors and find correct spelling suggestions on your text content on the following rich text authoring components in Tableau: - Tooltips - Captions - Worksheet Titles - Dashboard Titles - Dashboard Descriptions - Legend Titles - Filter Control Titles - Parameter Control Titles - Annotations - Highlighter Control Titles - Pages Control Titles - Story Titles - Story Descriptions - Mark Labels - Viz Alt Text - Field Comments - Edit Groups and Alias Dialog When entering text in these rich authoring components, words that are identified as a possible spelling error will be flagged. For example, if you're using Google Chrome or Safari, the words are underlined with a red, squiggly line. You can right-click the word and see a list of spelling suggestions from your web browser. Spell check isn’t currently supported for Tableau attributes, such as creating custom field names using SQL elements. As this feature is powered by your web browser, there may be slight variations in the appearance and spelling recommendations provided by the browser. If your text is being flagged incorrectly, you can add words to your web browser's local word library. The web browser that you're using determines whether the feature is turned on and which languages are supported. If you'd like to turn off spell check you can do it through your web browser's spell check settings. ## Supported browsers and languages Tableau is available in the following languages: English (US), English (UK), Dutch, French (France), French (Canada), German, Italian, Spanish, Brazilian Portuguese, Swedish, Japanese, Korean, Traditional Chinese, Simplified Chinese, and Thai. Because this feature is powered by your web browser, be sure to check your browser's documentation to confirm that the browser supports spell check in your chosen language. [Skip to main content](#main-content) # Start a Refresh Task Manually You can refresh extracts of data hosted with most cloud data providers directly on Tableau Cloud. You can run a refresh from Tableau Bridge for data sources you’ve set up there. If a data source has scheduled refreshes, running a manual refresh does not affect the schedule. ## Run a refresh on Tableau Cloud 1. Sign in to the Tableau Cloud site to which the data source is published. 2. On the Data Sources page, select the More actions icon (…) next to the data source you want to refresh, and then select Refresh Extracts Now from the menu. ![](/tableau/next/en-us/online/en-us/Img/data_source_refresh_manual_221x707.png) 3. Under Refresh Extracts Now, click Incremental Refresh or Full Refresh. ![](/tableau/next/en-us/online/en-us/Img/data_source_refresh_now_617x132.png) Incremental Refresh This option fetches and appends only the new data to the extract, which reduces download time. Full Refresh This option rebuilds the entire data extract from scratch, which can take longer and be expensive on the database. **Note:** For data sources that have scheduled refreshes, site administrators can initiate a refresh also from the Actions menu on the Tasks > Extract Refreshes page. ## Run a refresh in the Tableau Bridge client Open Tableau Bridge from the Windows system tray, and select the Run now icon (![](/tableau/next/en-us/online/en-us/Img/to_sync_runnow_icon.png)) for the data source. [Skip to main content](#main-content) # Stop Keeping Data Fresh Through Bridge You can stop refreshing data through Tableau Bridge when running Bridge schedules. If you stop using Bridge, views that depend on data sources that rely on Bridge will no longer display data and produce blank pages instead. Bridge legacy schedules do not support refreshes for virtual connections. ## Change the connection type of a refresh to use Tableau Cloud By default, Tableau Cloud uses Bridge when a published data source has multiple data connections. Multiple data connection types are data sources that have at least one public cloud connection and one on-premise connection. You can edit the connection type of extract refreshes for Bridge refresh schedules to use Tableau Cloud instead of Bridge. To change the connection type: 1. From the Connections tab of the data source, click Edit Connection. ![A data source named World Indicators appears in the data connections list.](/tableau/next/en-us/online/en-us/Img/bridge_network_edit.png) 2. To stop using Bridge for the network connection type, choose **Tableau Cloud**. To use Bridge for the connection type, choose **Private Network**. **Note**: You must change all data connections related to the data source to the same connection type. ![The Edit Data Connection dialog box allows you to edit a data connection and choose between Tableau Cloud or a private network.](/tableau/next/en-us/online/en-us/Img/bridge_network_edit_private.png) ## Other articles in this section [Skip to main content](#main-content) # Stop Refreshing Data Through the Windows Client This topic describes the ways a data source owner can stop refreshing data through Tableau Bridge Windows client when running Bridge schedules. ## Remove a data source One way you can stop a client from refreshing a data source that uses the Bridge (Legacy) schedule by removing the data source from the client. 1. Open the Windows system tray and click the Bridge icon to open the client. 2. Hover over the data source name and click the Remove icon next to the data source name. ## Stop using Bridge temporarily or permanently - To stop using a client and temporarily suspend updates to data sources performed by the client, open the client from the system tray, and on the settings menu in the upper-right, select Exit. When you exit, the data sources and connection settings remain intact. - To stop a client and permanently remove the data sources the client links to Tableau Cloud, right-click the Bridge icon in the system tray, and select Unlink. ![Unlink to remove all data information and stop sending refreshes to Tableau Cloud](/tableau/next/en-us/online/en-us/Img/to_sync_unlink.png) Unlinking a client also removes all connection information from the client, including stored database credentials and Tableau Cloud account credentials. ### Effects of exit and unlink If you exit the client and the next refresh occurs while the client is temporarily stopped, the data source owner will see an alert in Tableau Cloud and be sent an email notification. If you unlink a client, we recommend you delete the Bridge (legacy) schedules the client runs. For more information, see [Delete the Bridge (legacy) schedule after unlinking a client](#Delete), below. ### Delete the Bridge (legacy) schedule after unlinking a client When you unlink the client, you should also delete the Bridge (legacy) refresh schedules that the client runs. If a schedule is not deleted, the refresh will attempt to run as scheduled. In cases like this, you might receive refresh failure notifications. 1. Sign in to Tableau Cloud and navigate to the data source. 2. On the data source page, click the **Extract Refreshes** tab. 3. Select the check box next to the schedule and select Actions > Delete. ## Permanently remove a client from a site You can permanently remove a client from a site, which will make the client no longer visible when setting up a Bridge (legacy) schedule. 1. Sign in to Tableau Cloud and navigate to your Account Settings page. 2. Under Connected Clients, click Delete next to the client you want to permanently remove from the site. [Skip to main content](#main-content) # Subscriptions Data Source The Subscriptions data source provides details about subscriptions on the site, including the name of the creator and recipient, content item, job status, and schedules. Site administrators can use this data to improve the viewing experience for users who access content through subscriptions. Starting in February 2024, the Subscriptions data source includes Tableau Pulse information for your site. The "Subscriber Group Name" and "Subscriber Group LUID" fields have been included in the User folder. These fields display the group name and LUID when a user is following a metric as part of a group. ## Create custom views If you're a site admin or someone who has been granted access to the Admin Insights project, you can access the Admin Insights data sources directly from Tableau Cloud using Web Authoring or through Tableau Desktop to build custom views. For more information about connecting to Admin Insights data sources, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Example: How often do users receive subscriptions? Use the following steps to create a view that displays how often users receive subscriptions. 1. Connect to the Subscriptions and TS Events data sources. 2. Select Data > Edit Blend Relationships. 3. In the Blend Relationships dialog, set the primary data source to Subscriptions, and select the Custom radio button. 4. Click Add. 5. In the Add/Edit Field Mapping dialog, map Subscriber Email to Actor User Name, and click OK. 6. Click OK to exit the Blend Relationships dialog. 7. From the Data pane, drag Subscriber Email, Subject, and Last Sent (local) to the Rows shelf. 8. From the Data pane, drag Number of Events to the Columns shelf. 9. Verify that Item LUID, Item Type, and Actor User Name are the linking fields in the Data pane. If there are broken links, click the icon next to the field name to link the two data sources. 10. From the Data pane, drag Subscription Status to Color on the Marks card. ### Example: What are the most popular Pulse metrics? Use the following steps to create a view that displays the most popular Tableau Pulse metrics. 1. Connect to the Subscriptions data source. 2. From the Data pane, drag Item Type to the Filter shelf, and then select the Metric checkbox in the dialog. 3. Drag Item LUID and Item Name to the Rows shelf. 4. Drag CNT(Subscriber User LUID) to the Columns shelf. 5. From the toolbar, select the Sort Descending button to sort the X axis. **Note:** The viz displays subscribed users individually. To view users subscribed by group, use the "Subscriber Group Name" and "Subscriber Group LUID" fields. 6. From the menu, click Analysis > Create Calculated Field. 1. Name: Is Group Follow 2. Calculation: NOT ISNULL(Subscriber Group LUID) 7. From the Data pane, drag Is Group Follow to Color on the Marks card. 8. Drag Subscriber Group Name to Detail on the Marks card. > [!TIP] > > Understanding which users chose to follow a metric themselves, rather than being added by others, can help identify which metrics are naturally popular. 9. From the menu, click Analysis > Create Calculated Field. 1. Name: User Self-Followed 2. Calculation: NOT \[Is Group Follow\] AND \[Created By User Email\] <> \[Subscriber Email\] 10. From the Data pane, drag User Self-Followed to Color on the Marks card. ## Do more with your data Using Tableau Prep, you can join Subscriptions with other Admin Insights data sources on the following fields to get more visibility into your site. If you're analyzing data from multiple Tableau Cloud sites, you must also join on "Site LUID = Site LUID". - Join Subscriptions to TS Events on "Subscriber Email = Actor User Name" For more information, see [Aggregate, Join, or Union Data](https://help.tableau.com/current/prep/en-us/prep_combine.htm) in Tableau Prep Help. ## Data schema The following table lists the fields included in the Subscriptions data source. Each row of data corresponds to a subscription and recipient combination.

Folder	Field Name	Type	Description
Content	Item LUID	String	The LUID of the item included in the subscription
	Item Type	String	The type of item included in the subscription, either a workbook or view.
	Item Name	String	Display name of the item included in the subscription
	Item Owner Email	String	Email address of the item owner
	Item Hyperlink	String	Full URL of the item on the site
Subscription	Data Conditions	String	The condition for when subscriptions are sent, either Always or When data is available
	Has Image Attached	Boolean	Indicates whether an image is attached to the subscription email
	Has PDF Attached	Boolean	Indicates whether a PDF is attached to the subscription email
	Is Extract Refresh Triggered	Boolean	Indicates whether the data extract associated with the subscription has been refreshed
	Schedule LUID	String	The LUID of the schedule
	Schedule Name	String	Name of the schedule
	Subject	String	The subject of the subscription
	Subscription LUID	String	The LUID of the subscription
	Subscription Status	String	Status of the subscription, either Active or Suspended.
	Subscription ID	Number	The ID of the subscription
	Created At	Date-time	Date and time the subscription was created in UTC
	Created At (Local)	Date-time	Date and time the subscription was created, adjusted by the Timezone parameter.
	Last Sent	Date-time	Date and time the subscription was last sent in UTC
	Last Sent (Local)	Date-time	Date and time the subscription was last sent, adjusted by the Timezone parameter.
User	Created By User Email	String	Email address of the user that created the subscription
	Created By User LUID	String	The LUID of the user that created the subscription
	Subscriber Email	String	Email address of the user receiving the subscription
	Subscriber User LUID	String	The LUID of the user receiving the subscription
	Subscriber Group Name	String	If user is following a metric as part of a group, the name of the group.
	Subscriber Group LUID	String	If user is following a metric as part of a group, the LUID of the group.
Schedule	Day of Month	String	Day of the month on which this schedule will run
	Day of Week	String	Day of the week on which this schedule will run
	Schedule Type	String	Indicates whether the schedule runs on an hourly, daily, weekly, or monthly basis.
	Minute Interval	String	How frequently the schedule runs, in minutes.
	Start At Minute	String	Time of day when the schedule will start
	End At Minute	String	Time of day when the schedule will end
Task	Task LUID	String	The LUID of the task
	Task ID	Number	The ID of the task
	Task Type	String	The type of background job associated with this task, such as extract, subscription, or Bridge refresh.
	Consecutive Failure Count	Number	Number of times the task has failed
	Historical Queue Time	Number	Amount of time the task has spent in the queue, in seconds.
	Historical Run Time	Number	Amount of time taken for the task to complete, in seconds. Doesn't include queue time.
-	Admin Insights Published At	Date-time	Date and time the Admin Insights data source was last published in UTC
	Number of Recipients	Number	Distinct count of recipients
	Number of Subscriptions	Number	Distinct count of subscriptions
	Timezone	String	Specifies the timezone for displaying dates. This field represents an integer value used to determine the number of hours to offset from UTC. It doesn't account for Daylight Saving Time adjustments.

[Skip to main content](#main-content) # tabcmd **Important:** Between August 2024 and March 2025, Tableau Cloud sites were migrated to Salesforce's [Hyperforce](https://help.salesforce.com/s/articleView?id=000388902&type=1). As a result of the migration, tabcmd 1.0 is no longer supported. Plan your migration to tabcmd 2.0 as soon as possible to ensure you will not be impacted. This retirement does not impact Tableau Server. **Note:** In most cases, you must use tabcmd command-line utility 2.0 (tabcmd 2.0) with Tableau Cloud. Tabcmd 2.0 is available at [Tableau tabcmd](https://tableau.github.io/tabcmd). This new version allows you to: run tabcmd commands on MacOS and Linux, authenticate using personal access tokens (PATs), and allows you to be multi-factor authentication (MFA) compliant. Version 2.0 is built on public endpoints available in the Python-based Tableau Server Client (TSC). Tableau provides the tabcmd command-line utility which you can use to automate site administration tasks on your Tableau Cloud site. For example, creating or deleting users, projects, and groups. **Important:** tabcmd 1.0 does not support multi-factor authentication (MFA). To use tabcmd with Tableau Cloud, use [Tableau tabcmd 2.0](https://tableau.github.io/tabcmd) (new window). For more information about Tableau Cloud and MFA, see [Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/current/online/en-us/to_security_mfa.htm). ## Install tabcmd **Note:** These instructions are for installing the tabcmd 1.0 command-line utility. To install the tabcmd 2.0 command-line utility, go to [Tableau tabcmd](https://tableau.github.io/tabcmd) (new window). When Tableau Server or Tableau Cloud is upgraded to a new version, if an updated version of tabcmd is required, you can download it from the Tableau _Server_ Releases page on the Tableau website. For Tableau Server, we recommend you download the version that matches your server version. For Tableau Cloud, we recommend you always download the latest version to avoid issues caused by version incompatibilities. In either case, using an out of date version of tabcmd can cause errors and unpredictable results. 1. Open a web browser and go to the [Tableau Server Releases](https://www.tableau.com/support/releases/server) page. Go to this page even if you use Tableau Online. 2. If you're using: - **Tableau Cloud**, use [Tableau tabcmd 2.0](https://tableau.github.io/tabcmd) (new window). - **Tableau Server (Windows or Linux):** select the release that matches your server version. In either case, if the expanded information shows maintenance releases, select the latest maintenance release or the one that matches your server version. ![Select the server version you use (latest release for Tableau Cloud)](/tableau/next/en-us/online/en-us/Img/tabcmd_download1.png) This takes you to the release notes page, called Resolved Issues, where you can read about security improvements and resolved issues. 3. Scroll to the **Download Files** section under the resolved issues, select the tabcmd download link that is compatible with the computer on which you’ll run the tabcmd commands. ![Select the tabcmd installer for the computer you'll use it on (32- or 64-bit)](/tableau/next/en-us/online/en-us/Img/tabcmd_download.png) The remaining steps refer to this computer as “the tabcmd computer.” 4. Save the installer to the tabcmd computer, or a location accessible from that computer . 5. Complete the installation steps as appropriate for the operating system of the tabcmd computer: - Windows By default tabcmd is installed to `C:\Program Files\Tableau\Tableau Server\\extras\Command Line Utility`. You can change this during installation and recommend that you install tabcmd to a folder named `tabcmd` at the root of the C:\\ drive (`C:\tabcmd`). This can make it easier to locate and run, and will accommodate some limitations with the Windows operating system if you add the tabcmd directory to the Windows PATH. **Note** The tabcmd Setup program does not add the tabcmd directory to the Windows PATH variable. You can add it manually, or you can include the full path to tabcmd each time you call it. You can install tabcmd in two ways on Windows: - Double-click the installer to follow the steps in the UI: 1. Accept the license agreement. 2. If you want to install to a non-default location, click Customize and type or browse to the location you want to install tabcmd to. 3. Click Install. If you are prompted by Windows Defender Firewall or User Account Control, click **Allow access**. - Run the installer from a command prompt: 1. Open a command prompt as administrator on the tabcmd computer. 2. Navigate to the directory where you copied the tabcmd installer. 3. Install tabcmd: tableau-setup-tabcmd-tableau--x64.exe /quiet ACCEPTEULA=1 To install to a non-default location: tableau-setup-tabcmd-tableau--x64.exe /quiet ACCEPTEULA=1 INSTALLDIR="" For example: tableau-setup-tabcmd-tableau--x64.exe /quiet ACCEPTEULA=1 INSTALLDIR="C:\\tabcmd" For a complete list of command line options you can use with the tabcmd installer, run the installer with a /?. For more information on tabcmd installer command line options, see [Install Switches and Properties for tabcmd (Windows)](https://help.tableau.com/v0.0/online/en-us/tabcmd_install_flags.htm). The tabcmd Setup program creates logs in `C:\Users\\AppData\Local\Temp` you can use if you have problems installing tabcmd. The logs use the naming convention `Tableau_Server_Command_Line_Utility_()_##############.log`. - Linux **Note:** To run tabcmd on a Linux computer, you must have Java 11 installed. On RHEL-like systems, this will be installed as a dependency when you install tabcmd. On Ubuntu systems, you need to install Java 11 separately if it is not already installed. As of July 2022, Debian distributions are no longer supported. For more information, see [this Tableau Community post](https://community.tableau.com/s/news/a0A4T0000011xDOUAY/debian-end-of-life). 1. Log on as a user with sudo access to the tabcmd computer. 2. Navigate to the directory where you copied the `.rpm` or `.deb` package that you downloaded. - On RHEL-like distributions, including CentOS, run the following command: `sudo yum install tableau-tabcmd-.noarch.rpm` - On Ubuntu, run the following command: `sudo apt-get install ./tableau-tabcmd-_all.deb` To uninstall tabcmd from a Linux computer, see the documentation for the Linux variety you are running. 6. (Optional) Add the fully qualified location where tabcmd is installed to your system path to allow you to run tabcmd commands without changing to that location, or specifying the location with each command. Steps to do this depend on the type and version of your operating system. For more information, see [PATH\_(variable)](https://en.wikipedia.org/wiki/PATH_$variable$). ## How to use tabcmd The basic steps for using tabcmd are as follows: 1. Open the Command Prompt as an administrator. **Note:** Do not use PowerShell to run tabcmd commands on Windows. Using PowerShell can cause unexpected behavior. 2. On a Windows computer, if you installed tabcmd on a computer other than the initial node, change to the directory where you installed tabcmd. On a Linux computer, you do not need to change to the install directory. 3. Run the tabcmd command. When you use tabcmd, you must establish an authenticated server session. The session identifies the server or Tableau Cloud site and the user running the session. You can start a session first, and then specify your command next, or you can start a session and execute a command all at once. **Important:** If you are using tabcmd to perform more than one task, you must run tasks one after another (serially), rather than at the same time (in parallel). Commands (such as `login`) and the options (such as `-s`, `-u`, etc.) are not case sensitive, but the values you provide (such as `User@Example.com`) are case sensitive. ## Examples The following command demonstrates starting a session: `tabcmd login -s https://prod-useast-b.online.tableau.com -t mysite -u authority@email.com -p password` Here’s how to start a session and delete a workbook with one command—note that you do not need `login` here: `tabcmd delete "Sales_Workbook" -s https://prod-useast-b.online.tableau.com -t campaign -u admin@email.com -p password` The options `-s`, `-t`, `-u`, and `-p` are among the tabcmd global variables, which can be used with any command. For more information, see [tabcmd Commands](https://help.tableau.com/v0.0/online/en-us/tabcmd_cmd.htm). [Skip to main content](#main-content) # tabcmd Commands **Important:** Between August 2024 and March 2025, Tableau Cloud sites were migrated to Salesforce's [Hyperforce](https://help.salesforce.com/s/articleView?id=000388902&type=1). As a result of the migration, tabcmd 1.0 is no longer supported. Plan your migration to tabcmd 2.0 as soon as possible to ensure you will not be impacted. This retirement does not impact Tableau Server. **Note:** In most cases, you must use tabcmd command-line utility 2.0 (tabcmd 2.0) with Tableau Cloud. Tabcmd 2.0 is available at [Tableau tabcmd](https://tableau.github.io/tabcmd). This new version allows you to: run tabcmd commands on MacOS and Linux, authenticate using personal access tokens (PATs), and allows you to be multi-factor authentication (MFA) compliant. Version 2.0 is built on public endpoints available in the Python-based Tableau Server Client (TSC). You can use the following commands with the tabcmd command line tool in Tableau Cloud: [login](#id5fba51c9-5608-4520-8ceb-2caf4846a2be) [logout](#id8f512aec-57a4-4ed4-94c4-86e91ea9cc9c) [get _url_](#id7e0a0627-ad89-4135-a1c2-85b1d8472568) [addusers](#id1999d76f-638e-47d4-86ac-fe8e206ed364) (to group) [creategroup](#idbfa546df-2be7-444f-8bb8-07978b127783) [deletegroup](#id0d009916-bee3-4ef0-a6ac-22188c0e7f30) [export](#id7cb8d032-a4ff-43da-9990-15bdfe64bcd0) [createproject](#id5a3316ed-45bb-4da4-b557-58492b2d4ac8) [deleteproject](#idfdf59712-84ed-4590-9471-541d316917a6) [publish](#iddf805b62-18ff-4497-9245-adc6905b2084) [createextracts](#id5a3316ed-45bb-4da4-b557-1111112d4ac8) [refreshextracts](#id4cdb3410-1c41-4dad-b1d2-306542ac9b32) [deleteextracts](#id5a3316ed-45bb-4da4-b557-2222222d4ac8) [delete _workbook-name_ or _datasource-name_](#idfdf59712-84ed-4590-9471-541d316917a6) [createsiteusers](#idd1b7729f-dd20-475a-96f6-17fcd2577894) [deletesiteusers](#deletesiteusers) [removeusers](#id5cc30cba-44b8-48b0-93d6-5707938d157a) [version](#id825f5d18-529c-408a-b876-57693195bbdd) ## addusers _group-name_ Adds users to the specified group. **Example** `tabcmd addusers "Development" --users "users.csv"` ### Options `--users` Add the users in the given `.csv` file to the specified group. The file should be a simple list with one user name per line. User names aren't case sensitive. The users should already be created on Tableau Cloud. For more information, see [CSV Import File Guidelines](https://help.tableau.com/v0.0/online/en-us/csvguidelines.htm). `--[no-]complete` When set to `complete` this option requires that all rows be valid for any change to succeed. If not specified, `--complete` is used. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## createextracts Creates extracts for a published workbook or data source. ### Options `-d`, `--datasource` The name of the target data source for extract creation. `--embedded-datasources` A space-separated list of embedded data source names within the target workbook. Enclose data source names with double quotes if they contain spaces. Only available when creating extracts for a workbook. `--encrypt` Create encrypted extract. `--include-all` Include all embedded data sources within target workbook. Only available when creating extracts for workbook. `--parent-project-path` Path of the project that is the parent of the project that contains the target resource. Must specify the project name with --project. `--project` The name of the project that contains the target resource. Only necessary if --workbook or --datasource is specified. If unspecified, the default project 'Default' is used. `-u`, `-url` The canonical name for the resource as it appears in the URL. `-w`, `-workbook` The name of the target workbook for extract creation. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## creategroup _group-name_ Creates a group. Use `addusers` to add users after the group has been created. **Example** `tabcmd creategroup "Development"` Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## createproject _project-name_ Creates a project. **Example** `tabcmd createproject -n "Quarterly_Reports" -d "Workbooks showing quarterly sales reports."` ### Options `-n`, `--name` Specifies the name of the project that you want to create. `--parent-project-path` Specifies the name of the parent project for the nested project as specified with the `-n` option. For example, to specify a project called "Nested" that exists in a "Main" project, use the following syntax: `--parent-project-path "Main" -n "Nested"`. `-d`, `--description` Specifies a description for the project. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## createsiteusers _filename.csv_ Adds users to a site, based on information supplied in a comma-separated values (CSV) file. If the user isn't already created on the server, the command creates the user before adding that user to the site. The CSV file must contain one or more user names and can also include (for each user) a password, full name, license type, administrator level, publisher (yes/no), and email address. For information about the format of the CSV file, see [CSV Import File Guidelines](https://help.tableau.com/v0.0/online/en-us/csvguidelines.htm). As an alternative to including administrator level and publisher permissions in the CSV file, you can pass access level information by including the `--role` option and specifying the site role you want to assign users listed in the CSV file. By default, users are added to the site that you're logged in to. To add users to a different site, include the global `--site` option and specify that site. (You must have permissions to create users on the site you specify.) **Example** `tabcmd createsiteusers "users.csv" --role "Explorer"` ### Options `--admin-type` Deprecated. Use the `--role` option instead. `--auth-type` Sets the authentication type (`TableauID` or `SAML`) for all users in the `.csv` file. If unspecified, the default is `TableauID`. **Note:** To use SAML authentication, the site itself must be SAML-enabled as well. For information, see [Enable SAML Authentication on a Site or TCM](https://help.tableau.com/v0.0/online/en-us/saml_config_site.htm). `--[no-]complete` Deprecated. Default error behavior: if there are more than 3 errors within a ten-row span, then the command will fail. `--no-publisher` Deprecated. Use the `--role` option instead. `--nowait` Don't wait for asynchronous jobs to complete. `--publisher` Deprecated. Use the `--role` option instead. `--role` Specifies a site role for all users in the `.csv` file. When you want to assign site roles using the --role option, create a separate CSV file for each site role. Valid values are: `ServerAdministrator`, `SiteAdministratorCreator`, `SiteAdministratorExplorer`, `SiteAdministrator`, `Creator`, `ExplorerCanPublish`, `Publisher`, `Explorer`, `Interactor`, `Viewer`, and `Unlicensed`. The default is `Unlicensed` for new users and unchanged for existing users. Users are added as unlicensed also if you have a user-based server installation, and if the `createsiteusers` command creates a new user, but you have already reached the limit on the number of licenses for your users. **Note:** On a multi-site Tableau Server, if you want to assign the `ServerAdministrator` site role using the `--role` option, use the [`createusers`](#createusers) command instead of `createsiteusers`. `--silent-progress` Don't display progress messages for the command. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## delete _workbook-name_ or _datasource-name_ Deletes the specified workbook or data source from the server. This command takes the name of the workbook or data source as it is on the server, not the file name when it was published. **Example** `tabcmd delete "Sales_Analysis"` ### Options `-r`, `--project` The name of the project containing the workbook or data source you want to delete. If not specified, the “Default” project is assumed. `--parent-project-path` Specifies the name of the parent project for the nested project as specified with the `-r` option. For example, to specify a project called "Nested" that exists in a "Main" project, use the following syntax: `--parent-project-path "Main" -r "Nested"`. `--workbook` The name of the workbook you want to delete. `--datasource` The name of the data source you want to delete. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## deleteextracts Deletes extracts for a published workbook or data source. ### Options `-d`, `--datasource` The name of the target data source for extract deletion. `--embedded-datasources` A space-separated list of embedded data source names within the target workbook. Enclose data source names with double quotes if they contain spaces. Only available when deleting extracts for a workbook. `--encrypt` Create encrypted extract. `--include-all` Include all embedded data sources within target workbook. `--parent-project-path` Path of the project that is the parent of the project that contains the target resource. Must specify the project name with --project. `--project` The name of the project that contains the target resource. Only necessary if --workbook or --datasource is specified. If unspecified, the default project 'Default' is used. `-u`, `-url` The canonical name for the resource as it appears in the URL. `-w`, `-workbook` The name of the target workbook for extract deletion. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## deletegroup _group-name_ Deletes the specified group from the server. **Example** `tabcmd deletegroup "Development"` Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## deleteproject _project-name_ Deletes the specified project from the server. Using `tabcmd`, you can specify only a top-level project in a project hierarchy. To automate tasks you want to perform on a project within a parent project, use the equivalent Tableau [REST API](https://help.tableau.com/current/api/rest_api/en-us/help.htm#REST/rest_api_ref.htm%23API_Reference "Opens REST API reference in new browser tab") call. **Example** `tabcmd deleteproject "Designs"` ### Option `--parent-project-path` Specifies the name of the parent project for the nested project as specified with the command. For example, to specify a project called "Designs" that exists in a "Main" project, use the following syntax: `--parent-project-path "Main" "Designs"`. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## deletesiteusers _filename.csv_ Removes users from from the site that you're logged in to. The users to be removed are specified in a file that contains a simple list of one user name per line. (No additional information is required beyond the user name.) By default, if the server has only one site, or if the user belongs to only one site, the user is also removed from the server. On a Tableau Server Enterprise installation, if the server contains multiple sites, users who are assigned the site role of **Server Administrator** are removed from the site but aren't removed from the server. If the user owns content, the user's role is change to **Unlicensed**, but the user isn't removed from the server or the site. The content is still owned by that user. To remove the user completely, you must change the owner of the content and then try removing the user again. **Example** `tabcmd deletesiteusers "users.csv"` Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## export Exports a view or workbook from Tableau Cloud and saves it to a file. This command can also export just the data used for a view. View data is exported at the summary level. To export detail-level data, you must use the Tableau Server UI. For details, see [Download Views and Workbooks](https://help.tableau.com/current/pro/desktop/en-us/export.htm). Note the following when you use this command: - **Permissions**: To export, you must have the Export Image permission. By default, this permission is Allowed or Inherited for all roles, although permissions can be set per workbook or view. - **Exporting data**: To export just the data for a view, use the `--csv` option. This exports the summary data used in a view to a .csv file. - **Specifying the view, workbook, or data to export**: - Use part of the URL to identify what to export, specifically the `"workbook/view"` string as it appears in the URL for the workbook or view. Don't use the “friendly name,” and exclude the `:iid=__` session ID at the end of the URL. For example, the Tableau sample view _Order Details_ in the _Superstore_ workbook has a URL similar to this: `/#/views/Superstore/OrderDetails?:iid=2` To export the _Order Details_ view, use the string `Superstore/OrderDetails`. Do _not_ use `Superstore/Order Details`, or `Superstore/OrderDetails?:iid=2`. - If the server is running multiple sites and the view or workbook is on a site other than Default, Use `-t `. - To export a workbook, get the URL string by opening a view in the workbook, and include the view in the string you use. In the above example, to export the _Superstore_ workbook, use the string `Superstore/OrderDetails`. - To export a workbook, it must have been published with Show Sheets as Tabs selected in the Tableau Desktop Publish dialog box. **Note:** The Tableau workbook that contains the [admin views](https://help.tableau.com/current/online/en-us/adminview.htm) can't be exported. - To filter the data you download, add a parameter filter using this format: ?=value or, if filtering on a parameter and that parameter has a display name that matches the name of a measure or dimension: `?Parameters.=value` - The saved file's format: Your format options depend on what's being exported. A workbook can only be exported as a PDF using the `--fullpdf` argument. A view can be exported as a PDF (`--pdf`) or a PNG (`--png`). - **The saved file's name and location** (optional): If you don't provide a name, it will be derived from the view or workbook name. If you don't provide a location, the file will be saved to your current working directory. Otherwise, you can specify a full path or one that's relative to your current working directory. **Note**: You must include a file name extension such as `.csv` or `.pdf`. The command doesn't automatically add an extension to the file name that you provide. - **Dashboard web page objects not included in PDF exports**: A dashboard can optionally include a web page object. If you're performing an export to PDF of a dashboard that includes a web page object, the web page object won't be included in the PDF. - **Non-ASCII and non-standard ASCII characters and PDF exports**: If you're exporting a view or workbook with a name that includes a character outside the ASCII character set, or a non-standard ASCII character set, you need to URL encode (percent-encode) the character. For example if your command includes the city `Zürich`, you need to URL encode it as `Z%C3%BCrich`: `tabcmd export "/Cities/Sheet1?locationCity=Z%C3%BCrich" -fullpdf` **Clearing the Cache to Use Real-Time Data** You can optionally add the URL parameter `?:refresh=yes` to force a fresh data query instead of pulling the results from the cache. If you're using tabcmd with your own scripting and the `refresh` URL parameter is being used a great deal, this can have a negative impact on performance. It's recommended that you use `refresh` only when real-time data is required—for example, on a single dashboard instead of on an entire workbook. **Examples** _Views_ `tabcmd export "Q1Sales/Sales_Report" --csv -f "Weekly-Report.csv"` `tabcmd export -t Sales "Sales/Sales_Analysis" --pdf -f "C:\Tableau_Workbooks\Weekly-Reports.pdf"` `tabcmd export "Finance/InvestmentGrowth" --png` `tabcmd export "Finance/InvestmentGrowth?:refresh=yes" --png` _Workbooks_ `tabcmd export "Q1Sales/Sales_Report" --fullpdf` `tabcmd export "Sales/Sales_Analysis" --fullpdf --pagesize tabloid -f "C:\Tableau_Workbooks\Weekly-Reports.pdf"` ### Options `-f`, `--filename` Saves the file with the given filename and extension. `--csv` View only. Export the view's data (summary data) in `.csv` format. `--pdf` View only. Export as a PDF. `--png` View only. Export as an image in `.png` format. `--fullpdf` Workbook only. Export as a PDF. The workbook must have been published with Show Sheets as Tabs enabled. `--pagelayout` Sets the page orientation (`landscape` or `portrait`) of the exported PDF. If not specified, its Tableau Desktop setting will be used. `--pagesize` Sets the page size of the exported PDF as one of the following: `unspecified`, `letter`, `legal`, `note folio`, `tabloid`, `ledger`, `statement`, `executive`, `a3`, `a4`, `a5`, `b4`, `b5`, or `quarto`. Default is `letter`. `--width` Sets the width in pixels. Default is 800 px. `--height` Sets the height in pixels. Default is 600 px. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## get _url_ Gets the resource from Tableau Cloud that's represented by the specified (partial) URL. The result is returned as a file. Note the following when you use this command: - **Permissions**: To get a file, you must have the Download/Web Save As permission. By default, this permission is allowed or inherited for all roles, although permissions can be set per workbook or view. - **Specifying a view or workbook to get**: You specify a view to get using the `"/views//."` string, and specify a workbook to get using the `"/workbooks/."` string. Replace `` and `` with the names of the workbook and view as they appear in the URL when you open the view in a browser and replace with the type of file you want to save. Don't use the session ID at the end of the URL (`?:iid=`) or the "friendly" name of the workbook or view. For example, when you open a view _Regional Totals_ in a workbook named _Metrics Summary_, the URL will look similar to this: `/views/MetricsSummary_1/RegionalTotals?:iid=1` Use the string `/views/MetricsSummary_1/RegionalTotals.` to get the view. Use the string `/workbooks/MetricsSummary_1.` to get the workbook. When downloading workbooks and views from Tableau Cloud, the content of the .twb or .twbx file is stored in plain text. All data, including filter values that may give semantic clues to the data, will be readable by anyone who opens the file. - **File extension**: The URL must include a file extension. The extension determines what's returned. A view can be returned in PDF, PNG, or CSV (summary data only) format. A Tableau workbook is returned as a TWB if it connects to a published data source or uses a live connection, or a TWBX if it connects to a data extract. **Note**: If you're downloading a view to a PDF or PNG file, and if you include a `--filename` parameter that includes the .pdf or .png extension, you don't have to include a .pdf or .png extension in the URL. - **The saved file's name and location** (optional): The name you use for `--filename` should include the file extension. If you don't provide a name and file extension, both will be derived from the URL string. If you don't provide a location, the file is saved to your current working directory. Otherwise, you can specify a full path or one that's relative to your current working directory. - **PNG size** (optional): If the saved file is a PNG, you can specify the size, in pixels, in the URL. **Clearing the cache to use real-time data** You can optionally add the URL parameter `?:refresh=yes` to force a fresh data query instead of pulling the results from the cache. If you're using tabcmd with your own scripting, using the `refresh` parameter a great deal can have a negative impact on performance. It's recommended that you use `refresh` only when real-time data is required—for example, on a single dashboard instead of on an entire workbook. **Examples** _Views_ `tabcmd get "/views/Sales_Analysis/Sales_Report.png" --filename "Weekly-Report.png"` `tabcmd get "/views/Finance/InvestmentGrowth.pdf" -f "Q1Growth.pdf"` `tabcmd get "/views/Finance/InvestmentGrowth" -f "Q1Growth.pdf"` `tabcmd get "/views/Finance/InvestmentGrowth.csv"` `tabcmd get "/views/Finance/InvestmentGrowth.png?:size=640,480" -f growth.png` `tabcmd get "/views/Finance/InvestmentGrowth.png?:refresh=yes" -f growth.png` _Workbooks_ `tabcmd get "/workbooks/Sales_Analysis.twb" -f "C:\Tableau_Workbooks\Weekly-Reports.twb"` Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## login **Important:** tabcmd 1.0 does not support multi-factor authentication (MFA). To use tabcmd with Tableau Cloud, use [Tableau tabcmd 2.0](https://tableau.github.io/tabcmd) (new window). For more information about Tableau Cloud and MFA, see [Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/current/online/en-us/to_security_mfa.htm). Logs in a Tableau Cloud user. Use the `--server`, `--site`, `--username`, `--password` global options to create a session. **Note**: When you use the **tabcmd login** command, you can't use SAML single sign-on (SSO), even if your site is configured to use SAML. To log in, you must pass the user name and password of a user who has been created in your site. You will have the permissions of the Tableau Cloud user that you're signed in as. If you want to log in using the same information you've already used to create a session, just specify the `--password` option. The server and user name stored in the cookie will be used. If the server is using a port other than 80 (the default), you will need to specify the port. You need the `--site` (`-t`) option only if the server is running multiple sites and you're logging in to a site other than the Default site. If you don't provide a password you will be prompted for one. If the `--no-prompt` option is specified and no password is provided the command will fail. Once you log in, the session will continue until it expires on the server or the `logout` command is run. **Example** Log in to the Tableau Cloud site with the specified site ID: `tabcmd login -s https://prod-useast-b.online.tableau.com -t siteID -u user@email.com -p password` ### Options `-s`, `--server` If you're running the command from a Tableau Server computer that’s on your network, you can use `http://localhost`. Otherwise, specify the computer's URL, such as `http://bigbox.myco.com` or `http://bigbox`. If the server is using SSL, you will need to specify `https://` in the computer's URL. For Tableau Cloud, specify the full URL including the pod that your site is deployed to. For example: `https://prod-useast-b.online.tableau.com`. `-t`, `--site` Include this option if the server has multiple sites, and you're logging in to a site other than the default site. The site ID is used in the URL to uniquely identify the site. For example, a site named West Coast Sales might have a site ID of west-coast-sales. `-u`, `--username` The user name of the user logging in. For Tableau Cloud, the user name is the user's email address. `-p`, `--password` Password for the user specified for `--username`. If you don't provide a password you will be prompted for one. `--password-file` Allows the password to be stored in the given `filename.txt` file rather than the command line, for increased security. `-x`, `--proxy` Use to specify the HTTP proxy server and port (Host:Port) for the tabcmd request. `--no-prompt` Don't prompt for a password. If no password is specified, the `login` command will fail. `--cookie` Saves the session ID on login. Subsequent commands won't require a login. This value is the default for the command. `--no-cookie` Don't save the session ID information after a successful login. Subsequent commands will require a login. `--timeout SECONDS` The number of seconds the server should wait before processing the `login` command. Default: 30 seconds. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## logout Logs out of the server. **Example** `tabcmd logout` ## publish _filename.twb(x)_, _filename.tds(x)_, or _filename.hyper_ Publishes the specified workbook (.twb(x)), data source (.tds(x)), or extract (.hyper) to Tableau Cloud. If you're publishing a workbook, by default, all sheets in the workbook are published without database user names or passwords. The permissions initially assigned to the workbook or data source are copied from the project that the file is published to. Permissions for the published resource can be changed after the file has been published. If the workbook contains user filters, one of the thumbnail options must be specified. **Note:** Publishing extended or composed data sources using tabcmd isn't supported at this time. If you publish a composed workbook or data source file with tabcmd, it won't be properly linked to its parents on the server. **Example** `tabcmd publish "analysis_sfdc.hyper" -n "Sales Analysis" --oauth-username "user-name" --save-oauth` If the file isn't in the same directory as tabcmd, include the full path to the file. **Example** `tabcmd publish "\\computer\volume\Tableau Workbooks\analysis_sfdc.hyper" -n "Sales Analysis" --oauth-username "username" --save-oauth` ### Options `-n`, `--name` Name of the workbook or data source on the server. If omitted, the workbook, data source, or data extract will be named after filename. `-o`, `--overwrite` Overwrites the workbook, data source, or data extract if it already exists on the server. `-r`, `--project` Publishes the workbook, data source, or data extract into the specified project. Publishes to the “Default” project if not specified. `--parent-project-path` Specifies the name of the parent project for the nested project as specified with the `-r` option. For example, to specify a project called "Nested" that exists in a "Main" project, use the following syntax: `--parent-project-path "Main" -r "Nested"`. `--db-username` Use this option to publish a database user name with the workbook, data source, or data extract. If you connect to the data through a protected OAuth connection and access token, us the `--oauth-username` option instead. `--db-password` Use this option to publish a database password with the workbook, data source, or extract. `--save-db-password` Stores the provided database password on the server. `--oauth-username` The email address of the user account. Connects the user through a preconfigured OAuth connection, if the user already has a saved access token for the cloud data source specified in `--name`. Access tokens are managed in user preferences. For existing OAuth connections to the data source, use this option instead of `--db-username` and `--db-password`. `--save-oauth` Saves the credential specified by `--oauth-username` as an embedded credential with the published workbook or data source. Subsequently, when the publisher or server administrator signs in to the server and edits the connection for that workbook or data source, the connection settings will show this OAuth credential as embedded in the content. If you want to schedule extract refreshes after publishing, you must include this option with `--oauth-username`. This is analogous to using `--save-db-password` with a traditional database connection. `--thumbnail-username` If the workbook contains user filters, the thumbnails will be generated based on what the specified user can see. Can't be specified when `--thumbnail-group` option is set. `--thumbnail-group` If the workbook contains user filters, the thumbnails will be generated based on what the specified group can see. Can't be specified when `--thumbnail-username`option is set. `--tabbed` When a workbook with tabbed views is published, each sheet becomes a tab that viewers can use to navigate through the workbook. Note that this setting will override any sheet-level security. `--append` Append the extract file to the existing data source. `--replace` Use the extract file to replace the existing data source. `--disable-uploader` Disable the incremental file uploader. `--restart` Restart the file upload. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## refreshextracts _workbook-name_ or _datasource-name_ Performs a full or incremental refresh of extracts belonging to the specified workbook or data source. This command takes the name of the workbook or data source as it appears on the server, not the file name when it was published. Only an administrator or the owner of the workbook or data source is allowed to perform this operation. **Notes:** - This method will fail and result in an error if your Server Administrator has disabled the **RunNow** setting for the site. For more information, see [Tableau Server Settings](https://help.tableau.com/current/server/en-us/maintenance_set.htm). - You can use tabcmd to refresh supported data sources that are hosted in the cloud. For example, SQL Server, MySQL, PostgreSQL on a cloud platform; Google Analytics; and so on. - To refresh on-premises data with tabcmd, the data source must be a type that can be configured for Tableau Bridge [Recommended schedules](https://help.tableau.com/current/online/en-us/to_sync_schedule.htm). For all other data sources that connect to on-premises data, you can use Bridge or the command-line data extract utility. Learn more at [Use Bridge to Keep Data Fresh](https://help.tableau.com/v0.0/online/en-us/qs_refresh_local_data.htm) and [Automate Extract Refresh Tasks from the Command Line](https://help.tableau.com/v0.0/online/en-us/to_refresh_extract_commandline.htm). **Examples** tabcmd refreshextracts --datasource sales\_ds tabcmd refreshextracts --project "Sales External" --datasource sales\_ds tabcmd refreshextracts --project "Sales External" --parent-project-path "Main" --project "Sales External" --datasource sales\_ds tabcmd refreshextracts --workbook "My Workbook" tabcmd refreshextracts --url SalesAnalysis tabcmd refreshextracts --workbook "My Workbook" --addcalculations tabcmd refreshextracts --datasource sales\_ds --removecalculations ### Options `--incremental` Runs the incremental refresh operation. `--synchronous` Adds the full refresh operation to the queue used by the Backgrounder process, to be run as soon as a Backgrounder process is available. If a Backgrounder process is available, the operation is run immediately. The refresh operation appears on the Background Tasks report. During a synchronous refresh, `tabcmd` maintains a live connection to the server while the refresh operation is underway, polling every second until the background job is done. **Note:** The `--synchronous` option isn't available for data sources refreshed with Tableau Bridge. `--workbook` The name of the workbook containing extracts to refresh. If the workbook has spaces in its name, enclose it in quotes. `--datasource` The name of the data source containing extracts to refresh. `--project` Use with `--workbook` or `--datasource` to identify a workbook or data source in a project other than _Default_. If not specified, the Default project is assumed. `--parent-project-path` Specifies the name of the parent project for the nested project as specified with the `--project` option. For example: - To specify a project called "Nested" that exists in a "Main" project, use the following syntax: - \--parent-project-path "Main" --project "Nested" - To specify a project called "Nested2" that is nested within the "Nested" project: - \--parent-project-path "Main/Nested" --project "Nested2" `--url` The name of the workbook as it appears in the URL. A workbook published as “Sales Analysis” has a URL name of “SalesAnalysis”. `--addcalculations` Use with `--workbook` to materialize calculations in the embedded extract of the workbook or `--datasource` to materialize calculations in the extract data source. Adds the operation to the queue used by the Backgrounder process. If a Backgrounder process is available, the operation runs immediately. This operation appears on the [Background Tasks for Extracts](https://help.tableau.com/current/online/en-us/adminview_backgrnd.htm) administrative view. `--removecalculations` Use with `--workbook` or `--datasource` to remove calculations that were previously materialized. Adds the operation to the queue used by the Backgrounder process. If a Backgrounder process is available, the operation runs immediately. This operation appears on the [Background Tasks for Extracts](https://help.tableau.com/current/online/en-us/adminview_backgrnd.htm) administrative view. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` ## removeusers _group-name_ Removes users from the specified group. **Example** `tabcmd removeusers "Development" --users "users.csv"` ### Options `--users` Remove the users in the given `.csv` file from the specified group. The file should be a simple list with one user name per line. `--[no-]complete` Requires that all rows be valid for any change to succeed. If not specified `--complete` is used. Global options The following options are used by all `tabcmd` commands. The `--server`, `--user`, and `--password` options are required at least once to begin a session. An authentication token is stored so subsequent commands can be run without including these options. This token remains valid for five minutes after the last command that used it. `-h`, `--help` Displays the help for the command. **Note:** Some commands listed may not apply when using tabcmd with Tableau Cloud. `-s`, `--server` The Tableau Cloud URL, which is required at least once to begin session. `-u`, `--user` The Tableau Cloud username, which is required at least once to begin session. `-p`, `--password` The Tableau Cloud password, which is required at least once to begin session. `--password-file` Allows the password to be stored in the given `.txt` file rather than the command line for increased security. `-t`, `--site` Indicates that the command applies to the site specified by the Tableau Cloud site ID, surrounded by single quotes or double quotes. Use this option if the user specified is associated with more than one site. Site ID is case-sensitive when using a cached authentication token. If you do not match case you may be prompted for a password even if the token is still valid. `--no-prompt` When specified, the command will not prompt for a password. If no valid password is provided the command will fail. `--[no-]cookie` When specified, the session ID is saved on login so subsequent commands will not need to log in. Use the `no-` prefix to not save the session ID. By default, the session is saved. `--timeout` Waits the specified number of seconds for the server to complete processing the command. By default, the process will wait until the server responds. `--` Specifies the end of options on the command line. You can use `--` to indicate to `tabcmd` that anything that follows `--` should not be interpreted as an option setting and can instead be interpreted as a value for the command. This is useful if you need to specify a value in the command that includes a hyphen. The following example shows how you might use `--` in a `tabcmd` command, where `-430105/Sheet1` is a required value for the `export` command. `tabcmd export --csv -f "D:\export10.csv" -- -430105/Sheet1` **Tip**: For Tabcmd 1.0 commands available for Tableau Server, see [tabcmd commands](https://help.tableau.com/current/server/en-us/tabcmd_cmd.htm). [Skip to main content](#main-content) # Table Extensions Table Extensions allow you to create data tables with an analytics extensions script. You can write a custom TabPy or Rserve script and optionally add one or more input tables. Table extensions are supported by Tableau Cloud, Tableau Server, and Tableau Desktop. This document focuses on Tableau Cloud. **Note:** Similar to a live connection, the Table Extension refreshes every time you open up a workbook or refresh a data source. ### Benefits Table Extensions have the following benefits for both new and experienced users. - Easily integrate scripts or advanced functions into Tableau - Easily drag data from Tableau data connections as input into scripts - Low code editor makes adding code to data sources easy - Integrates with [Data Guide](https://help.tableau.com/current/server/en-us/data_guide.htm) and [Explain Data](https://help.tableau.com/current/server/en-us/explain_data_basics.htm) - Integrates with TabPy, Rserve, and other analytics extensions - Results can be used to construct dashboards or visualizations ## Prerequisites Before you can use table extensions, you must complete the following list. - Open a data source in Desktop or Web Authoring. - Configure an analytics extension - For steps to configure analytics extension connections, see [Pass Expressions with Analytics Extensions](https://help.tableau.com/current/pro/desktop/en-us/r_connection_manage.htm). ## Create a Table Extension To create a table extension, complete the following steps. 1. Open a published workbook. 2. Open a data source or create one. 3. Under **connections**, choose **New Table Extension**. ![connections menu](/tableau/next/en-us/online/en-us/Img/new_table_extension.png) 4. Drag it into the data model. 5. (Optional) Drag tables from the data connection into the table extension pane to use as input into your analytics extensions script or function. - By default data from Tableau is passed to the analytics extension and defined as the `variable _arg1`, a dictionary-like structure such as: `{‘colum_name’: [1,2,3], ‘column_name_2’: [3,4,5]` **Python example:** The input data could be converted to a pandas dataframe using the following. `import pandas as pddf = (pd.DataFrame(_arg1))` - When using RServe, the input data is defined as the variable .arg1 and the data type are a named list of lists. - For supported relational data sources, you can use Custom SQL as an input into a table extension. When parameters are used in the Custom SQL query, changing the parameter causes the query to rerun and the script to recompute. This creates a path to dynamically update parameters in a dashboard and filter or otherwise pass values to the table extension script. ![relational data sources](/tableau/next/en-us/online/en-us/Img/table_ext_2.png) 6. In the Script area, enter your script or function call. The script must return a dictionary or list of lists, essentially a JSON object. A script for RServe must return a data.frame or list of named lists while the script for Python must return a dictionary. **Python example:** We use the following explicit return command. `return df.to_dict(orient='list')` **Note:** Table extensions don't support directly calling TabPy endpoints if TABPY\_EVALUATE\_ENABLE is disabled in TabPy. 8. Select **Apply** to run the script. 9. (Optional) If you’re relating the table extension to another table in the data model, define the relationship between at least one field in each table. If the fields have the same name, this may happen automatically. 10. Choose **Update Now** and the results appear in the **Output Table** tab. ![output results table](/tableau/next/en-us/online/en-us/Img/table_ext_3.png) **Note:** If you don't define a relationship to a table in the data model, the Input Table tab is empty and will display the message ‘Data preview unavailable’. 1. (Optional) In the **Name** field, enter a unique name for your table extension. 2. Go to the Sheet tab to start exploring and visualizing the data. Results from a table extension functions like any other data in Tableau queried from a flat file or relational source. 3. Publish the workbook to share it. The publishing destination, Server or Tableau Cloud, must have an analytics extension of the appropriate type enabled and configured. > [!TIP] > > **Troubleshooting tip**: Errors from analytics extensions will be surfaced in a Tableau error message if there’s a problem executing the script. If your table extension is hitting an error, ensure all code and formatting is correct and try using the circular Refresh Data Source button, located next to the Save button, or click Apply again. ### **Table Extensions vs Analytics Extensions** While some of these products aren't related, table extensions and analytics extensions share several features. The table extensions feature relies on a connection with analytics extensions to work. Let's break down each feature. #### Dashboard Extensions [Dashboard extensions](https://help.tableau.com/current/pro/desktop/en-us/dashboard_extensions.htm) allow custom web applications to be added to dashboards using the Dashboard Extension SDK, however, this extension type isn’t related to table extensions. #### Table Extensions The Table extensions feature lets you create a table in a data source that can send data and a script to your analytics extension and return a full table of arbitrary shape as a result. The returned results are displayed as a table in the data model in the Data Source tab and as measures and dimensions in the workbook. #### Analytics Extensions The [Analytics extensions](https://www.tableau.com/developer/learning/getting-started-analytics-extensions-api) feature allows you to extend Tableau calculations with programming languages like Python, external tools, and external platforms. After you create a connection to an analytics extension, you can communicate with your external server through calculated fields called SCRIPT\_X or MODEL\_EXTERNAL\_X, where X is the data type of the expected return values. For more information, see [Pass Expressions with Analytics Extensions](https://help.tableau.com/current/pro/desktop/en-us/r_connection_manage.htm). [Skip to main content](#main-content) # Table Extensions Table Extensions allow you to create new data tables with an analytics extensions script. You can write a custom TabPy or Rserve script and optionally add one or more input tables. Table extensions are supported by Tableau Cloud, Tableau Server, and Tableau Desktop. This document focuses on Tableau Server. **Note:** The data refreshes every time you open up a workbook or refresh a data source. ### Benefits Table Extensions have the following benefits for both new and experienced users. - Faster data processing - Low code editor - Integrates with [Ask Data](https://help.tableau.com/current/server/en-us/ask_data.htm) and [Explain Data](https://help.tableau.com/current/server/en-us/explain_data_basics.htm) - Integrates with TabPy and Rserve - Results can be used to construct dashboards or visualizations. ## Prerequisites Before you can use table extensions, you must complete the following list. - Configure an analytics extension - For steps to configure analytics extension connections, see [Configure Connections with Analytics Extensions](https://help.tableau.com/current/server/en-us/config_r_tabpy.htm).. - Publish your workbook. ## Create a Table Extension To create a new table extension, complete the steps below. 1. Open a published workbook. **Note:** The workbook must be published before you can add a table extension. 3. Under **Sheets**, choose **New Table Extension**. ![connections menu](/tableau/next/en-us/online/en-us/Img/new_table_extension.png) 4. (Optional) Drag sheets into the table extension pane. 5. Under **Choose a Connection**, select an analytics extension. ![analytics extensions drop down menu](/tableau/next/en-us/online/en-us/Img/choose_analytics_extension.png) 6. In **Script**, enter your script. 7. Select **Apply**. 8. Choose **Update Now** and the results will appear in the **Output Table** tab. ![output results table](/tableau/next/en-us/online/en-us/Img/table_extension_output_table.png) 9. In the **Name** field, enter a unique name for your new table extension. 10. Go to the sheet tab and publish the workbook to save it. **Note:** If you edit the input table you have to press **Apply** again before you can see or use the updated output table data. > [!TIP] > > **Troubleshooting tip**: If your table extension is hitting an error, try using the circular **Refresh** **Data** **Source** button, located next to the **Save** button. ### **Table Extensions vs Analytics Extensions** Tableau has a few different features with "extension" in the name. While some of these products aren't related, table extensions and analytics extensions are. The table extensions feature relies on a connection with a analytics extensions to work. Let's break down each feature. #### Table Extensions The table extensions feature lets you create workbook calculations that send data and a processing script to your analytics extension. The returned results are displayed as a table on the Data Source tab and as measures and dimensions in the workbook. #### Analytics Extensions The analytics extensions feature allows you to extend Tableau dynamic calculations with programming languages like Python, external tools, and external platforms. After you create a connection to an analytics extension, you can communicate with your external server through calculated fields. For more information, see [Configure Connections with Analytics Extensions](https://help.tableau.com/current/server/en-us/config_r_tabpy.htm). [Skip to main content](#main-content) # Site Admin Cheatsheet: Salesforce Integration ## Business Science ![Add description of the image](/tableau/next/en-us/online/en-us/Img/Help_Spot_Business-Services_big.png) - [Integrate Einstein Discovery Predictions in Tableau](https://help.tableau.com/current/pro/desktop/en-us/einstein_discovery_predictions.htm) - [Explore Predictions in Tableau with the Einstein Discovery Dashboard Extension](https://help.tableau.com/current/pro/desktop/en-us/einstein_discovery_dashboard_extension.htm) - [Einstein Discovery: Pass Expressions with Analytics Extensions](https://help.tableau.com/current/pro/desktop/en-us/r_connection_manage.htm#Einstein2) ## Connect and Embed Salesforce Data ![Deploy in the cloud.](/tableau/next/en-us/online/en-us/Img/Help_Spot_ConnectToData_big.png) - [Embed Tableau Views into Salesforce](https://help.tableau.com/current/pro/desktop/en-us/embed_ex_lwc.htm) - [Create Salesforce Datasource](https://help.tableau.com/current/pro/desktop/en-us/examples_salesforce.htm) - [Set Up OAuth for Salesforce CDP](https://help.tableau.com/current/online/en-us/config_oauth_sfdc_cdp_online.htm) - [Github: Lightning Web Component for embedding Tableau into Salesforce](https://github.com/tableau/tableau-viz-lwc) - [Trailhead: Embed Tableau Visualizations in Salesforce](https://trailhead.salesforce.com/en/content/learn/projects/embed-tableau-visualizations-in-salesforce) ## Authentication ![Deploy Tableau Server.](/tableau/next/en-us/online/en-us/Img/Help_Spot_Collaborate_big.png) - [Configure SAML for Tableau Viz Lightning Web Component](https://help.tableau.com/v0.0/online/en-us/saml_config_TOL_LWC.htm) - [Configure SAML with Salesforce](https://help.tableau.com/v0.0/online/en-us/saml_config_salesforce.htm) - [Salesforce Authentication](https://help.tableau.com/v0.0/online/en-us/security_auth_sfdc.htm) [Skip to main content](#main-content) # Tableau Agent Best Practices Tableau Agent does its best to understand the intent of your questions as well as the context of your data and your business. But without data that is optimized for AI, Tableau Agent can get things wrong. This article describes some steps you can take to make sure you get the best results from Tableau Agent. ## General Information ### Use clean, well modeled data Messy data is hard to analyze and Tableau Agent is focused on analysis, not cleaning and prepping your data. - **Do**: Clean and prep your messy data before analysis. Try using [Tableau Agent in Tableau Prep](https://help.tableau.com/current/prep/en-us/prep_einstein.htm) to clean your data. - **Don't**: Expect an analytical agent to do data prep. - **Do**: Use relationships in data modeling. - **Don't**: Use data blending. Tableau Agent doesn’t understand blending and can only be used with the primary data source. - **Do**: Use certified data sources and update them for AI consumption. - **Do**: Hide unnecessary fields. If a user shouldn't build a viz with it, the agent shouldn't see it. ### Use clear field names and descriptions Tableau Agent doesn’t understand the data in the same way a human would. Without good names and descriptions, Tableau Agent may misinterpret a field or get confused about which field to query. Remove any guesswork about how the data fits into an analysis. - **Do**: Use unique, descriptive, and complete field names. - **Don't**: Leave a field name as "Age" when it could be "Case Age at Close" - **Don't**: Leave abbreviations or ambiguous fields like "P\_ID" or "Name" - **Don't**: Use duplicate field names or names that are too similar. For example "Region1", "Region1\_copy". Use a distinct name for each field, or hide duplicates if they aren't needed in your analysis. - **Do**: Provide a description that defines what the field is. - **Do**: Include the business context and expected synonyms. - **Don't**: Assume all your users will always refer to the field by its official name - **Do**: Describe how the field is typically used in analysis and how it's different from similar fields. - **Don't**: Copy and paste descriptions across similar fields - **Do**: Maintain the descriptions for standard Salesforce fields. - **Do**: Document any unique business logic or data anomalies (such as how to interpret nulls, or when to use "Invoice Date" rather than "Purchase Date"). ### Create Business Preferences _Applies to Tableau Agent in Dashboards in the Dashboard Q&A capability only_ To ground Tableau Agent in your organization’s business knowledge, you can define Business Preferences. Business preferences can include things like your organization-wide rules, terminology, and business logic (such as defining fiscal years or stock thresholds). Starting in version 20206.3, Tableau Agent in Dashboards can integrate with Tableau Knowledge to ingest global business preferences. Tableau Knowledge is an enterprise knowledge management solution that helps AI agents understand your organization's data and business context by connecting Tableau Cloud content and business knowledge into live knowledge graphs. For more information see [About Tableau Knowledge](https://help.tableau.com/current/online/en-us/tableau_knowledge_about.htm). Business preferences can be configured at two levels: - **Global Business Preferences** (defined in Tableau Knowledge): - Set globally across an entire Knowledge Graph in Tableau Knowledge. - Tableau Agent uses these global preferences when responding to user questions processed through natural language capabilities if the workbook is included as a node in the knowledge graph. **Note**: Global preferences set in Tableau Knowledge apply during query evaluation but do not appear when querying or listing business preferences directly from Tableau Agent in Dashboard Q&A. Tableau Knowledge must be turned on in the Site settings. Tableau Knowledge is available in Tableau Cloud only. For more information see [Turn on AI in Your Tableau Cloud Site](https://help.tableau.com/current/online/en-us/setup_tabAI_site_setting.htm). - **Workbook-level Business Preferences** (set in Workbook/Dashboard settings): - Uploaded or added directly to a workbook in Tableau. - Tableau Agent uses these preferences when responding to user queries for dashboards in that workbook. - Workbook business preferences appear when requesting or reviewing the list of preferences for that workbook. - Tableau Knowledge automatically ingests these workbook business preferences on publish, and associates them with the workbook node if it is included in the knowledge graph. - If you ask for a list of Business Preferences using Tableau Agent in Dashboard Q&A, Tableau Agent will return only the workbook-level Business Preferences. For more information, see [Improve response quality for Dashboard Q&A](https://help.tableau.com/current/pro/desktop/en-us/dashboard-narratives.htm#improve-response-quality-for-dashboard-Q&A). When creating your business preferences file, follow these guidelines: - **Do**: Create clear, concise, individual preferences identified with a “#” at the beginning of each preference item. Tableau Agent reads this line entry as the separator between preferences. You can have one or more additional lines in between this separator to further explain the business preference. Example: \# Revenue is in USD Format with a $, use comma as thousands separators. Do not include cents. - **Don’t**: Create workbook-level business preferences that conflict with global business preferences defined in Tableau Knowledge. Tableau Agent can reference both global business preferences and workbook-level business preferences when responding to questions. Conflicting business preferences can cause tableau Agent to get confused. **Note**: This only applies if you are using Tableau Knowledge and your workbook is included as a node in the knowledge graph. - **Don't**: Include more than 50 preferences or over 8000 characters. **Note**: The 8,000-character limit starts from the first valid preference header and includes whitespace (front matter excluded). If a file exceeds 8,000 characters, preferences are loaded in order up to that limit. Also, total file size (including front matter) cannot exceed 500 KB. - **Don't**: Include complex instructions. Instead break them down into simple, distinct preferences. - **Do**: Refer directly to exact field names or calculated fields in your data source to clarify which fields your business preference applies to. - **Don't**: Use vague or ambiguous field references that make Tableau Agent guess which field or metric you are referring to. - **Do**: Create calculated fields directly in your data source before writing your preferences, then reference those calculated fields in your instructions. - **Don't**: Write rules in your business preferences that require Tableau Agent to perform raw mathematical manipulations or define multi-step formulas on the fly. For example, "Multiply percentages by 100". - **Do**: Include domain-specific guidelines, unique terminology for your organization. For example “When referring to opportunities, TPS is short for total product sales”, or information not included in your semantic model schema. - **Don’t**: Include general business information. Tableau Agent needs specific information about how to interpret or display data. The following types of business preferences aren’t currently supported: - **Not for AI use**: Blocking topics or questions. For example, “Don’t answer any questions about salary". - **Visual formatting**: For example “Use a line chart when displaying Sales over time.” - **LLM response structure**: For example, "When responding, don't show a visualization" or "On every response, first tell the user 'Thank you,' then show the answer, and then end with 'Goodbye.'" ### Pre-define calculated fields While Tableau Agent can help create calculations through natural language, if a user asks for a calculation incorrectly or vaguely, an incorrect calculation can result. - **Do**: Create any common calculations ahead of time so you can ensure consistency and accuracy. ### Specify field properties The agent relies on field properties as analytical guardrails. Default or misconfigured properties can lead to poor analytical outcomes. - **Do**: Verify field roles (dimensions and measures) and data types (such as date, numeric, boolean). - **Don't**: Leave a field such as Postal Code as a numeric field (measure) if it should be considered an attribute (dimension). - **Don't**: Leave dates stored as text. - **Do**: Set a default aggregation. - **Don't**: Assume the user or agent will know to use average with "unit price" rather than sum ## AI readiness checklist Use this checklist to implement best practices when preparing your published data source and workbooks for AI consumption. **Model Structure** ![Check box](/tableau/next/en-us/online/en-us/Img/tab_gai_best_practice_checkbox.png "tab_gai") Clean data ![Check box](/tableau/next/en-us/online/en-us/Img/tab_gai_best_practice_checkbox.png "tab_gai") Business preferences (.md or .txt) are uploaded to the workbook with clear rules that describe unique domain logic and Global business preferences are defined if using Tableau Knowledge. **Note**: Business Preferences are currently only used by Tableau Agent in Dashboards, in Dashboard Q&A. ![Check box](/tableau/next/en-us/online/en-us/Img/tab_gai_best_practice_checkbox.png "tab_gai") Use relationships in data modeling ![Check box](/tableau/next/en-us/online/en-us/Img/tab_gai_best_practice_checkbox.png "tab_gai") No data blending **Fields** ![Check box](/tableau/next/en-us/online/en-us/Img/tab_gai_best_practice_checkbox.png "tab_gai") Field names are specific and contextual ![Check box](/tableau/next/en-us/online/en-us/Img/tab_gai_best_practice_checkbox.png "tab_gai") All fields have useful, differentiated descriptions ![Check box](/tableau/next/en-us/online/en-us/Img/tab_gai_best_practice_checkbox.png "tab_gai") Unnecessary fields are hidden ![Check box](/tableau/next/en-us/online/en-us/Img/tab_gai_best_practice_checkbox.png "tab_gai") Common or expected calculations already exist ![Check box](/tableau/next/en-us/online/en-us/Img/tab_gai_best_practice_checkbox.png "tab_gai") Fields have the correct properties: role, data type, default aggregation [Skip to main content](#main-content) # Tableau Agent FAQ Find answers to commonly asked questions about using Tableau Agent in Tableau Desktop, Tableau Cloud and Tableau Server web authoring. To learn more about Tableau Agent in Tableau Prep or Tableau Catalog, see [Build Tableau Prep Flows with Tableau Agent](https://help.tableau.com/current/prep/en-us/prep_einstein.htm) or [Describe projects, workbooks, or data sources](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm#gen-ai-description). ## General Information ### What is Tableau Agent? Tableau Agent is a generative AI feature in Tableau that can help you explore data, create visualizations, and uncover insights using a conversational assistant. It allows you to interact with your data through natural language in Tableau Desktop, Tableau Prep, and when using web authoring in Tableau Cloud and Tableau Server. ### Is there a free trial? Yes. You can sign up for a Tableau Cloud free trial which now includes Tableau Agent features. Simply fill out this [form](https://www.tableau.com/products/trial), or contact your Account Executive. You can currently try Tableau Agent in Tableau Desktop (starting in 2025.1), Tableau Cloud web authoring, Tableau Prep Builder (starting in 2025.2), and Tableau Prep on the web as part of a limited trial. Starting in July 2026, you can also try Tableau Agent in Dashboards. This Beta feature enables you to get an overview about your dashboard, get a summary of insights, viz-by-viz, and ask questions about your data using natural language. For more information, see [Tableau Agent in Dashboards](https://help.tableau.com/current/online/en-us/dashboard_narratives_overview.htm). The trial gives you full access to Tableau Agent functionality but there are some restrictions on the overall experience. - You can only trial in a new site, not add a trial of Tableau Agent to your existing production site. - Tableau Agent in Tableau Catalog isn't included in the trial. - Tableau Agent in Tableau Desktop is supported for Viz Authoring or configuring Tableau Agent in Dashboard settings. - Tableau Agent is free to use during the trial but limits may apply to the number of requests you can make per hour. ### How do I access Tableau Agent? To access Tableau Agent, click the Tableau Agent icon in the toolbar next to Show Me or at the top of the toolbar while connected to a data source. Availability depends on the application, site connection type, feature settings, and permissions: ![Blank worksheet with Einstein icon highlighted](/tableau/next/en-us/online/en-us/Img/tab_gai_einstein_icon_webauth.png) - **Tableau Desktop**: Available in worksheets when signed into: - A Tableau Cloud site with Tableau+ or Tableau Cloud+, (or Tableau Cloud free trial) with AI in Tableau turned on for web authoring. - A Tableau Server site with AI in Tableau turned on for web authoring. - **Tableau Prep**: Available in Prep flows (web or Prep Builder) when signed into: - A Tableau Cloud site with Tableau+ or Tableau Cloud+, (or Tableau Cloud free trial) with AI in Tableau turned on for Tableau Prep. - A Tableau Server site with AI in Tableau turned on for Tableau Prep. - **Tableau Web Authoring**: Available when AI in Tableau is turned on for your site and you are assigned a Creator or Explorer role: - Worksheet tabs: Supported on both Tableau Cloud and Tableau Server. Requires Tableau+ or Tableau Cloud+, (or Tableau Cloud free trial). - Dashboard tabs: Supported on both Tableau Cloud and Tableau Server version 2026.3 and later (requires Tableau Server+) **Note**: If Tableau Server connects through a Custom Gateway using OAuth authentication, Tableau Agent in Dashboards is not supported. - **Dashboard Viewers (web)**: Viewers can access Tableau Agent in Dashboards (Tableau Cloud version 2026.2.4 and later and Tableau Server version 2026.3 and later). Tableau Agent in Dashboards must be is turned on in the site settings, the capabilities must be turned on for the dashboard, and the user must be granted both AI Access and Full Data Query permissions. **More information**: - [Explore Your Data with Tableau Agent](https://help.tableau.com/current/online/en-us/web_author_einstein.htm) - [Build Tableau Prep Flows with Tableau Agent](https://help.tableau.com/current/prep/en-us/prep_einstein.htm) - [Build Views and Explore Data with Tableau Agent](https://help.tableau.com/current/pro/desktop/en-us/desktop_einstein.htm) - [Tableau Agent in Dashboards (Beta)](https://help.tableau.com/current/online/en-us/dashboard_narratives_overview.htm) - [Turn on AI in Tableau for your Tableau Cloud Site](https://help.tableau.com/current/online/en-us/setup_tabAI_site_setting.htm) - [Turn on AI in Your Tableau Server Site](https://help.tableau.com/current/server/en-us/sites_gai_server.htm) ### Can I limit user access to Tableau Agent? Yes. You can turn on AI in Tableau features for either a single user group or for all users on your site. Currently this option is only available when configuring AI in Tableau in Tableau Cloud for Viz Authoring and Tableau Prep. This option is not currently available when turning on AI in Tableau in Tableau Server. For more information, see [Configure AI in Tableau](https://help.tableau.com/current/online/en-us/setup_tabAI_site_setting.htm#configure-ai-in-tableau). For Tableau Agent in Dashboards (Beta), you can control access using the Permissions settings. For more information, see [Permissions](https://help.tableau.com/current/online/en-us/permissions.htm#DashboardAgent). ### Why is the Tableau Agent button not available? **Note**: Tableau Agent is not supported if you’re using a Salesforce Government Cloud Org. To use Tableau Agent, the following must be true: - You must be connected to a Tableau Cloud site that has Tableau Cloud+ or Tableau+ and AI in Tableau turned on or a Tableau Server site (version 2025.3 or later) with AI in Tableau turned on. - If you’re using Tableau Desktop, you must be signed into a Tableau Cloud or Tableau Server site. In Tableau Desktop only Tableau Agent in authoring is available. - You must be on a worksheet or dashboard. - For Tableau Agent in Dashboards, you must be connected to a Tableau Cloud site and have opted into the Tableau Agent in Dashboards (Beta). As a viewer, you must also be granted the AI Access and Full Data Query permissions. - Starting in version 2026.3, Tableau Agent in Dashboards (Beta) is also available in Tableau Server in web authoring. As an administrator, you must opt into the beta and turn on the feature. Viewers must be granted the AI Access and Full Data Query permissions. For more information, see [Turn On AI in Your Tableau Server Site](https://help.tableau.com/current/server/en-us/sites_gai_server.htm). - You must be connected to a data source. - For Tableau Agent in Dashboards Overview and Insights capabilities, you must be connected to a published data source. The Dashboard Q&A capability supports both published data sources and embedded data sources. - AI in Tableau must be enabled for your site and, for use in the browser, the option for Tableau Web Authoring must be turned on. ## Usage and Capabilities ### Can I use Tableau Agent on any type of data? Tableau Agent is recommended for use on data extract or file-based data for improved performance, but Tableau Agent for viz authoring also works with live connections, or uploaded files with .hyper, .csv, .txt, and .xlsx file types. Tableau Agent in Dashboards Overview and Insights capabilities work with a published data source. The Dashboard Q&A capability works with both published data sources and embedded data sources. Cubes are not supported. Also, if you're using data blending, Tableau Agent can only be used with the primary data source. ### Can I use Tableau Agent in my language? Starting in version 2025.1, Tableau Agent supports English (en\_US) and a subset of other languages. Tableau Agent in Dashboards Q&A capability only supports English (en\_US). If your Cloud site, Server site, or Tableau Desktop application is set to a language that isn't supported, Tableau Agent responses will be in English (en\_US). For more information about supported languages, see [AI in Tableau supported languages and locales](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust.htm#supported_language). **Note**: If your data source field names and values aren’t in the same language as your user language settings or not the same as the language you’re interacting with Agent in, use the exact field name and values in your requests. ### Can I choose which Large Language model (LLM) I want to use in Tableau Cloud? No. Currently with Tableau Agent, choosing a Salesforce-managed Large Language Model (LLM) isn't supported. Instead, Tableau tests and selects the best model to use, based on performance, accuracy and cost. For more information, see [Geo-aware LLM request routing](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust.htm#geoaware-llm-request-routing). ### Can I choose which Large Language Model (LLM) I want to use in Tableau Server? Yes, starting in Tableau Server version 2026.2, you can select either OpenAI or Azure OpenAI. Starting in version 2026.3, you can also connect using a Custom Gateway (Beta) to connect to the LLM provider of your choice. For more information, see [Turn On AI in Your Tableau Server Site](https://help.tableau.com/current/server/en-us/sites_gai_server.htm). ### What can I ask Tableau Agent to do? Tableau Agent has several capabilities. It can create vizzes and help you create and understand calculations. If you’ve opted into the Tableau Agent in Dashboards (Beta), it can analyze your dashboard and create overviews and insight summaries for your dashboard users. Dashboard users can also dive deeper into their data and ask questions using natural language. Tableau Agent can help you build visualizations, choose the best chart types for your data, perform date-based analysis, and manage data filtering and sorting. For example, you can ask it to "show sales data for a specific region" or "compare sales to profit". For more information, see [Build and change a viz](https://help.tableau.com/v0.0/online/en-us/web_author_einstein.htm#build_viz). Tableau Agent can also create calculations from natural language. Using the same conversation pane that you would use for generating a viz, you can ask Tableau Agent to create, update, or explain a calculation. For more information, see [Create calculations](https://help.tableau.com/v0.0/online/en-us/web_author_einstein.htm#create_calcs). Available in Beta starting in July 2026, Tableau Agent in Dashboards can analyze your dashboard and create a quick overview about the dashboard, or create a summary of insights for the charts on the dashboards, helping users find data insights fast so that they can take action on the things that matter most. Users can also query the underlying data source (with the proper permissions) and ask questions about the data, letting them dive deeper into their analysis using natural language. For more information see [Tableau Agent in Dashboards (Beta)](https://help.tableau.com/current/pro/en-us/dashboard_narratives_overview.htm). ### How can I add context for my fields to get the best answers from Tableau Agent? Add descriptions for your fields. Tableau Agent indexes the field descriptions from comments in Tableau Desktop or Tableau Catalog. Currently there is a limit where Tableau Agent will only index the first 150 characters of each description with an overall limit of 4000 characters. If you have many fields, as a best practice, use short, concise descriptions to get the best results. For more tips, see [Tableau Agent Best Practices](https://help.tableau.com/current/online/en-us/web_author_einstein_best_practice.htm). ### Can I teach Tableau Agent business-specific rules or custom formulas for my organization? Yes. You can define Business Preferences at two levels to help Tableau Agent provide accurate, organization-specific answers grounded in your business logic (such as defining fiscal years, stock thresholds, or domain terminology): - **Global Business Preferences** (Tableau Knowledge): Tableau Cloud sites using Tableau Knowledge can set global business preferences across an entire knowledge graph. Tableau Agent uses these global preferences when responding to user utterances routed through its capabilities. **Note**: Global preferences apply during query processing, but they do not appear in the workbook-level preferences list. - **Workbook Business Preferences**: Dashboard authors can upload or manage a Business Preferences file (.txt or .md) directly in a workbook under Configure Settings > Configure Business Preferences in the Tableau Agent pane. These preferences apply to dashboards in that workbook and are visible in the workbook settings. If Tableau Knowledge is enabled, these workbook-level preferences are automatically ingested into the knowledge graph when the workbook is published if the workbook is included as a node in the knowledge graph. For more information, see [Improve response quality for Dashboard Q&A](https://help.tableau.com/current/pro/desktop/en-us/dashboard-narratives.htm#improve-response-quality-for-dashboard-Q&A), [Tableau Agent Best Practices](https://help.tableau.com/current/online/en-us/web_author_einstein_best_practice.htm#create-business-preferences), and [About Tableau Knowledge](https://help.tableau.com/current/online/en-us/tableau_knowledge_about.htm). ### What is Tableau Knowledge and how does Tableau Agent use it? Tableau Knowledge (requires Tableau Cloud+ or Tableau+) creates connected knowledge graphs that combine trusted Tableau Cloud content (workbooks, data sources, sheets) with organizational context and business preferences. When a user asks questions, Tableau Agent queries the Knowledge Graph (or default knowledge graph) to retrieve relevant metadata, asset relationships, and global business rules. This allows Tableau Agent to provide more accurate, grounded, and explainable answers tailored to your organization's terminology and business logic. For more information see [About Tableau Knowledge](https://help.tableau.com/current/online/en-us/tableau_knowledge_about.htm). ### Are there limitations to what Tableau Agent can do? Yes, Tableau Agent has some limitations. For example, it can't pick a data source for you, do data modeling, build dashboards, suggest relevant content or answer data lineage questions, answer consulting questions (such as “How should I analyze my data?”), or create interactivity with elements like filter controls and parameters. It's primarily aimed at helping novice users and those exploring ad-hoc data questions. For more information, see [Tableau Agent limitations](https://help.tableau.com/v0.0/online/en-us/web_author_einstein.htm#einstein_limitations). ### What is the best way to use Tableau Agent effectively? Start by working with clean data - Optimize your workbook and data source using [Tableau Agent Best Practices](https://help.tableau.com/current/online/en-us/web_author_einstein_best_practice.htm) - Make sure field names are descriptive and unique - For Dashboard Q&A, upload [Business Preferences](https://help.tableau.com/current/online/en-us/web_author_einstein_best_practice.htm#create-business-preferences) to help Tableau Agent better understand your business - When you start a Tableau Agent session, if you see similarly named fields in a data source, hide the ones that aren't relevant. Tableau Agent won't ground its answers on hidden fields - Specify the aggregation function for a measure if you know what you want - Make sure fields have the correct field role (measure or dimension) and data type (location, string, boolean, etc.) - Like traditional Tableau, Tableau Agent performs better with extracts. When using live data sources, the time it takes to initiate your Tableau Agent session might be longer and viz load time will be slower Only ask about analyzing your data. Tableau Agent isn't a general-purpose chat-bot. When it comes time to ask questions, start each request as if Tableau Agent is only aware of the current state of the visualization. Ask questions about what you want to see. For example, “What are my sales over time in California?". Be specific and descriptive in your requests to help Tableau Agent better understand and respond to your data analysis needs. Break your request into discrete tasks. For example, first request a calculation, then ask for a viz that uses that new field, instead of asking for a viz and a new calculated field at the same time. For more information, see [Tips for getting the best results from Tableau Agent](https://help.tableau.com/v0.0/online/en-us/web_author_einstein.htm#tips). ### Can I use Tableau Agent for dashboards or stories? Tableau Agent is still not available for stories, but starting in July 2026, Tableau Agent is now available in Beta for dashboards in Tableau Cloud and on the Tableau Cloud Trial site. Starting in version 2026.3, Tableau Agent in Dashboards is also available in Beta on Tableau Server. For more information see [Tableau Agent in Dashboards (Beta)](https://help.tableau.com/current/pro/en-us/dashboard_narratives_overview.htm). ## Technical Details ### How does Tableau Agent handle data privacy and security? #### Tableau Cloud Tableau Agent in Tableau Cloud ensures data privacy and security by adhering to a zero data retention policy with third-party LLM providers. It respects all existing permissions and data policies within Tableau Cloud, ensuring only authorized users have access. Additionally, it can also employ pattern-based data masking techniques to protect personally identifiable information (PII) before it is processed by LLMs. For more information, see [AI in Tableau and the Einstein Trust Layer](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust_layer.htm) and [Select What Data to Mask](https://help.salesforce.com/s/articleView?id=ai.generative_ai_mask_select.htm&type=5) in the Salesforce help. #### Tableau Server (version 2025.3 and later) When using Tableau Agent in Tableau Server, you'll connect to your own LLM provider. Your requests don’t use the Einstein Trust Layer and its associated data governance features, including built-in PII masking. Instead, you'll be relying on the LLM provider's security measures to protect sensitive data. ### Does Tableau Agent in Tableau Server use the Einstein Trust Layer when I connect to my own LLM provider? No. When you connect to your LLM provider in Tableau Server, all requests from Tableau Agent are sent directly to the LLM provider. This process doesn't use the Einstein Trust Layer's security and PII masking features. You will be relying on the LLM provider's security measures to protect sensitive data. For more information, see [AI in Tableau and Trust](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust.htm). ### What is a Custom Gateway for Tableau Server, and why would I use one? A Custom Gateway is a proxy that sits between Tableau Server and your LLM provider that lets you use the models of your choice. It also lets you add policies to your Tableau AI traffic, such as: - Maintain strict network security perimeters, such as, keeping traffic inside a private VPC/VPN. - Avoid distributing long-lived vendor API keys to Tableau Server administrators by managing authentication centrally. - Audit, log, rate-limit, and track AI usage and cost across your organization. - Support enterprise authentication protocols, such as IP allowlisting. For more information, see [Turn on AI in Your Tableau Server Site](https://help.tableau.com/current/server/en-us/sites_gai_server.htm). ### What authentication modes are supported when connecting via a Custom Gateway? When configuring a Custom Gateway in Tableau Server, you can choose from three authentication modes: - No Authentication: Used when the gateway is already secured inside a zero-trust network perimeter (such as an internal VPC/VPN with IP allowlisting). - API Key: Tableau authenticates against your internal API gateway using an API token generated by your proxy management system. - OAuth: Tableau authenticates against an Identity Provider (IdP) using client credentials (Client ID and Client Secret) to issue short-lived access tokens. For more information, see [Turn on AI in Your Tableau Server Site](https://help.tableau.com/current/server/en-us/sites_gai_server.htm). ### What end-user experience should I expect when OAuth is configured on a Custom Gateway? If a Custom Gateway is configured using OAuth authentication, end users will be prompted to log in when opening Tableau Agent. A Sign in to LLM Gateway button will appear in the Tableau Agent pane. When clicked, it opens your organization's Identity Provider (IdP) login screen in a browser window. Once authenticated, users can begin using Tableau Agent. **Note**: In Tableau Prep (version 2026.3) users will need to first open a workbook in web authoring to authenticate, then go back to Tableau Prep to begin using Tableau Agent. ### Which Tableau Agent features are supported when using a Custom Gateway? Configuring and using a Custom Gateway is currently only available in Tableau Server. Tableau Server currently supports the following Tableau Agent features: - Tableau Agent in Authoring for viz authoring - Tableau Agent in Tableau Prep for building flows to clean and transform your data - Tableau Agent in Dashboards (Beta) to get overviews, insights and ask questions about your data Tableau Agent in Authoring and Tableau Agent in Prep are supported for all authentication methods when using a custom gateway. Tableau Agent in Dashboards (Beta) is not available when using the OAuth authentication method. ### How does Tableau Agent know what is in my data? Tableau Agent indexes your data source at the start of each session to understand what data is present. Indexing takes in the data type, field name, and samples 1000 unique values for a field. This ensures responses are grounded in your data. Remember that Tableau Agent respects data masking if it is enabled, and might not be able to respond to requests that involve masked data. If you have fields with high cardinality (many distinct values for a single field), Tableau Agent might not have indexed all the values. If you try to filter on a high cardinality field, Tableau Agent creates a filter for the field but might prompt you to select the values you want to include or exclude. ### What if the viz created by Tableau Agent isn’t correct? As with all AI, it's important to review the results you get when using Tableau Agent. Although Tableau Agent can scan your data source for the field names and data in those fields, it doesn't truly understand the data the way a human can. Always review the results from Tableau Agent. If a viz doesn't meet your expectations, try clarifying your request or asking Tableau Agent to recreate it. You can also interact directly with the viz to adjust the analysis to meet your needs. Think of the viz created by Tableau Agent as a starting point to jump start your analysis. You can also always provide feedback using the thumbs up and thumbs down icon in the conversation pane. ### Does Tableau Agent remember previous interactions? Tableau Agent is a per-sheet experience, meaning it doesn't retain conversation history across different sheets. It has limited memory based on the information in the conversation pane of the current sheet. If you close and reopen the conversation pane while still in your same session, your conversation history persists. If you close your workbook, this clears the conversation with Tableau Agent. The conversation history isn’t saved and doesn’t appear the next time you open the published or saved workbook. [Skip to main content](#main-content) # Tableau Bridge FAQ Find answers to commonly asked questions about Tableau Bridge. ## Bridge Basics ### What is Tableau Bridge? Tableau Bridge is a proxy client that runs on a machine in your network and is used to connect your private network data to Tableau Cloud. Bridge is installed behind your organization's firewall. It can access on-premises and virtual cloud (isolated private cloud hosted within a public cloud) data through an established and secure outbound connection from your data to Tableau Cloud. See [Use Tableau Bridge](https://help.tableau.com/current/online/en-us/data_fresh_sync_section.htm). ### What is Tableau Bridge used for? If some or all of your data is on premise or in a virtual cloud that is behind the firewall, you can use Bridge to securely access and connect data to Tableau Cloud. The data can range from .csv files on your private network or stored in a data warehouse. Bridge also keeps your data current. If you have a viz that must be refreshed as the data is modified, Bridge can keep data fresh in Tableau Cloud, either by automatically refreshing extracts, or by passing live queries to your on-premise data sources. ### What's the cost of Tableau Bridge? Tableau Bridge is a free, supported client that is used with Tableau Cloud. ### What are the supported OS systems and minimum hardware requirements for Tableau Bridge? Bridge is supported on Windows 64-bit machines and Linux. For Bridge for Linux you must create a customized Docker image. For information about minimum hardware requirements, see [Recommended software and hardware.](https://help.tableau.com/current/online/en-us/to_bridge_scale.htm#system) ### Do we need a separate Tableau Bridge installation for each Tableau Cloud site? Yes. Tableau Bridge can only connect to one Tableau Cloud site at any given time. Tableau recommends installing the Bridge client on a dedicated virtual machine behind your firewall so that it doesn’t compete with resources from other applications. Only one client can be installed on a machine. For more information, see [Install Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm). ### Can I use Bridge even if I can connect to the data directly from Tableau Cloud? You don’t need to use Bridge if Tableau Cloud can access the data directly. Bridge acts as a proxy, and depending on throughput, it’s possible that Bridge will be slower than a direct connection to the data source. ### How do I install Bridge? (Windows) Download the installer from the [Downloads](https://www.tableau.com/support/releases/bridge?_ga=2.221107416.1990179398.1663001829-720568525.1657234993) page and follow the [Install Bridge](https://help.tableau.com/current/online/en-us/to_bridge_install.htm) instructions. See [Recommended software and hardware.](https://help.tableau.com/current/online/en-us/to_bridge_scale.htm#system) (Linux) To use Bridge for Linux you must create a customized Docker image, install the RPM package, and then run Bridge from inside the container image. ## Security ### How does Bridge keep data secure? All traffic between Bridge and Tableau Cloud is secured using TLS. Bridge makes an initial outbound connection; all communication is initiated from behind a firewall using ports 80 and 443. After the initial outbound connection, communication is bidirectional. Data in transit, to and from Tableau Bridge, is encrypted. Bridge uses the following protocols depending on the connection type used by the content: - For live connections and extract refreshes that use Bridge refresh schedules, secure WebSockets (wss://). - For extract refreshes that use Bridge (legacy) schedules, HTTP Secure (https://). To ensure that your data is transmitted to Tableau Cloud only, you can implement domain-based filtering on outbound connections (forward proxy filtering) from the Bridge client. See [Bridge Security](https://help.tableau.com/current/online/en-us/to_bridge_security.htm). ### Are there other ways to secure data? You can use whitelisting to identify sites that are allowed access to your data and exclude sites that aren’t included in the list. Some data sources are always “cloud-native”, such as Amazon Athena, Redshift, Azure SQL Database, Google Cloud SQL. In these cases, Tableau Cloud expects to connect directly through IP whitelisting by default when the native connector is used. It’s possible to configure Tableau Bridge to work with “cloud-native” data sources if the data is isolated from the Internet in a private subnet (and therefore IP whitelisting isn’t an option). ### What permissions do I need? - You need access to the Tableau Cloud account used to log in to the Tableau Bridge client and the site associated with the data. - To assign the Bridge client to a pool (either a default pool or a named pool), you need either Site Administrator Creator or Site Administrator Explorer role. - To run refresh extracts: - For Bridge refresh schedules, the user needs Creator or Explorer (can publish). The Bridge client must be set up correctly by site admin. - For Bridge legacy schedules, because the schedule must be assigned to a particular Bridge client, the user must either be the owner of that Bridge client (if the customer only has Creator or Explorer (can publish) permission) or be a site admin. - The Creator or Explorer (can publish) role and the Data Management license is required to publish virtual connections and refresh data with Bridge. - (Windows) The Windows account that is running Bridge must have access to all data sources that are being connected to. - (Windows) The Windows user account must be a member of the local admin group to run the client in service mode. If the user isn’t a local admin, they can run the Bridge client in Application mode, but they must remain logged in to the Windows machine. ### What credentials are used when accessing data? For extracts with Bridge legacy schedules, access information must be embedded in the Bridge client. The Bridge client owner must log in to the Windows machine and manually enter the credentials. This process results in database credentials being stored on the computer using the Windows credentials manager. For Bridge refresh schedules, the credentials can be embedded for the published data source in Tableau Cloud. For data sources accessed via Windows Authentication, there are no credentials to embed, but the Windows account that Bridge is running under must have access to the source database. Tableau Bridge supports OAuth when connecting to private data that uses OAuth and public data that uses OAuth when it’s joined to private data. Both saved credentials or managed keychain connectors are supported by OAuth: The type of functionality depends on the connector that you use. Bridge supports both live and extract refreshes for data sources with OAuth authentication. **Note**: Support for single use refresh tokens (sometimes called one-time use refresh tokens, rolling refresh tokens, or refresh token rotation) for OAuth connections was added in Tableau Cloud with the 2025.2 (Summer 2025) release and added in Tableau Server with the 2025.3 release if the IDP of the data source provider supports it. These are not yet supported on Tableau Bridge connections to Tableau Cloud. If you use the external OAuth configuration for the connection, please see the [OAuth Configuration and Usage documentation](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth Config docs") in GitHub for more information. Tableau Bridge supports integrated Windows authentication that uses Kerberos. See [Integrated Windows Authentication](https://learn.microsoft.com/en-us/aspnet/web-api/overview/security/integrated-windows-authentication) However, Bridge doesn't support connections that use Kerberos as a standalone authentication mechanism. ### What are the multi-factor authentication requirements? If multi-factor authentication (MFA) is enabled with Tableau authentication, he connected client option must be enabled for the site to allow Bridge clients to run unattended and, if enabled, support multi-factor authentication with Tableau authentication. If connected clients are disabled for the site, Bridge can only support Tableau username and password authentication. See [Access Sites from Connected Clients](https://help.tableau.com/current/online/en-us/to_connected_clients.htm#bridge). ## Connections ### What connection types does Bridge support? **Extract connection**: When data sources or virtual connections use extracts to connect to private network data, Bridge can be used to perform scheduled refreshes of those extracts. See [Additional requirements for extract connections](https://help.tableau.com/current/online/en-us/to_bridge_client.htm#conn_extract). **Live connection**: Bridge supports data sources or virtual connections with live connections to a private network. If the content owner publishes a data source or virtual connection that uses a live connection to data that Tableau Cloud detects that it can't reach directly, live queries are used to keep the content fresh. See [Additional requirements for live connections](https://help.tableau.com/current/online/en-us/to_bridge_client.htm#conn_live). The type of data that Bridge can support falls into one of the following categories: - Relational data - File data, including Excel, text, and statistical (.sas7bdat) files. - Private cloud data, including Amazon Redshift, Teradata, and Snowflake. For more information, see [Connect to Private Cloud Data](https://help.tableau.com/v0.0/online/en-us/to_bridge_vpc.htm). - (Limited) JDBC data. - (Limited) ODBC data. - Web Data Connector 2.0 SDK. See [Keep Data Fresh](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm). - Data used in a multi-connection data source (that is, data sources that contain a cross-database join), when all connectors are supported by Bridge. For more information, see [Refreshing Cross-Database Joined Data Sources on Tableau Bridge](https://kb.tableau.com/articles/HowTo/refreshing-federated-multi-connection-data-sources-on-tableau-bridge) in the Tableau Knowledge Base. ### What connection types are not supported by Bridge? Unsupported connectors: - Microsoft Analysis Services - Microsoft PowerPivot - Oracle Essbase - SAP NetWeaver Business Warehouse - Select onnectors (.taco) built with the [Tableau Connector SDK](https://tableau.github.io/connector-plugin-sdk/docs/) and connectors available through [Tableau Exchange](https://exchange.tableau.com/connectors). See [Connectors and data types](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm#Connecto). Unsupported connection types: - Live connections to file-based data (excel, .csv, and so on) - Live connections to Google Cloud SQL, OData, Progress OpenEdge, and Tableau extracts - All connections to cube-based data - Snowflake when used with virtual connections ### Can Bridge be set up to run continuously? (Windows) Bridge can run in two different modes: Application mode and Service mode. Tableau recommends that you run Bridge in Service mode. If your client is set up to run in Service mode, you don’t need to be logged on to the computer running the client, but your computer must be on. By default, the client runs as an Application. This means the Windows user must be logged on to the computer where the client is running for scheduled refreshes to complete. After sign-in, the Bridge client opens from the system tray. (Linux) Bridge on Linux runs in the background of Linux, which is the equivalent to Service mode in Tableau Bridge on Windows. See [Application versus Service mode](https://help.tableau.com/current/online/en-us/to_bridge_client.htm#application--versus-service-mode). ### Can I connect to a data source embedded in a workbook? Yes. Tableau Bridge supports publishing a workbook directly to Tableau Cloud using embedded data sources. ## Load Balancing and Pooling ### How can I load balance data refreshes with Bridge? You can configure a pool to distribute data refresh tasks among the available Bridge clients. Pools map to domains, allowing you to dedicate pools to keeping specific data fresh and maintaining security by restricting access to protected domains in your private network. See [Configure the Bridge Client Pool](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm). ## Scaling and Deployment ### How can I scale with Bridge? As a starting point, we recommend initially configuring at least two Tableau Bridge clients for redundancy, and in many Bridge deployments, more than one Bridge client is necessary to support data freshness needs. Bridge supports up to 10 concurrent published data source extract refreshes by default. This value can be changed based on your workload and hardware requirements. See [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm). Determine how many published data source extracts are necessary in the available time window. In many situations, there are several concentrated time blocks when extracts must occur. You need enough Bridge clients to complete all required extract refreshes this time window. For example, if you have 7 hours of extract refreshes to run, and a 4-hour window to run them in, then 2 Bridge clients would be a reasonable number to use. Bridge supports 16 live queries per client. Determine the number of concurrent users. Site admins can monitor traffic to data sources with live connections using a built-in administrative view in Tableau Cloud. This gives a high-level view into how often particular data sources with live connections are being accessed. As part of your pilot and rollout you should monitor usage over time. See [Plan Your Bridge Deployment](https://help.tableau.com/current/online/en-us/to_bridge_scale.htm). ## Monitoring ### How can I monitor Bridge? You can use the [Traffic to Bridge Connected Data Sources](https://help.tableau.com/current/online/en-us/adminview_bridge_datasources.htm) admin view to see the usage of data sources with live connections. This view can help you determine which data sources are most heavily used and those that are used less often. The [Bridge Extracts](https://help.tableau.com/current/online/en-us/adminview_bridge_extract.htm) admin view captures the last 30-days' worth of refresh activity by Tableau Bridge. Only jobs that have been successfully started by the Bridge client have a record in the Bridge Extract admin view. On the Jobs page, you can hover over scheduled jobs that are in progress or have completed to see information about the Bridge client and pool that was used for the job. Event information about Tableau Bridge jobs will also appear in the Activity log. See [bridge\_job](https://help.tableau.com/v0.0/online/en-us/activity_log_schema.htm#bridge-job) in the Activity Log Site Event Type Reference topic. [Skip to main content](#main-content) # Tableau Cloud Capacity Tableau Cloud is provisioned with capacity to support your users’ analytic needs. With the introduction of capacity management capabilities in May 2026 (Tableau 2026.1), cloud administrators have greater visibility and control of how these capacities are allocated across the sites in a tenant. **Notes:** - The capacity information discussed in this topic applies to sites in your Tableau Cloud Manager (TCM) tenant. The tenant is the top-level administrative layer where cloud administrators manage their organization's Tableau Cloud deployment. Depending on your Tableau edition, TCM includes up to 3 sites by default. The number of sites increases with different edition types: Up to 10 sites with [Enterprise](https://help.tableau.com/current/online/en-us/to_tab_enterprise_features.htm) edition and a maximum of 50 sites with [Cloud+](https://help.tableau.com/current/online/en-us/to_tab_cloud_plus_features.htm) or [Tableau+](https://help.tableau.com/current/online/en-us/to_tab_plus_features.htm) edition. However, you might not be able to create the maximum number of sites allowed if there is no available capacity. - Licensing capacity is managed at the tenant level and can be allocated to sites by cloud administrators using site role limits. For more information, see [Manage Site Role Limits](https://help.tableau.com/v0.0/online/en-us/cloud_manager_site_role_limit.htm). ## Capacity summary The following table summarizes the capacity allowances for your site by feature. You can find more capacity information by the feature areas listed in the table below. **Important:** Capacity limits specific for sites in TCM are subject to change as we evolve our infrastructure. #### Additional notes - **Edition and license:** Several capacities are calculated based on your Tableau Cloud edition and Creator license count, and noted where applicable. - **Advanced Management add-on:** As of September 16, 2024, Advanced Management is no longer available as an independent add-on option. If your site was previously licensed with the Advanced Management add-on, your site or tenant capacity is equivalent to the capacity Tableau+ or Enterprise edition unless noted otherwise.

Feature area	Capacity type	Capacity allowance	Configurable in TCM	More information

Storage	Site storage	Standard: 1 TB per site Enterprise, Cloud+, Tableau+: 5 TB per site	No	Storage
	Site storage	Advanced Management: Up to 5 TB per site	No	About Tableau Advanced Management on Tableau Cloud
	Individual workbook, published data source, or flow size	Standard, Enterprise, Cloud+, Tableau+: 25 GB per site (suggested limit for optimal performance)	No	Storage
	Individual workbook, published data source, or flow size	Advanced Management: 25 GB per site (suggested limit for optimal performance)	No	About Tableau Advanced Management on Tableau Cloud

Extracts	Daily refreshes	Up to 8 backgrounder hours per Creator license per site	No	Extracts - daily, runtime, and memory usage
	Concurrent refreshes	Standard: Up to 15 jobs* per tenant Enterprise: Up to 25 jobs* with 1 additional job for every 10 Creator licenses per tenant Cloud+, Tableau+: Up to 50 jobs* with 1 additional job for every 5 Creator licenses per tenant Capacity-based Viewer Blocks: See Deployments with capacity-based license model	Yes	Extract concurrency
	Individual refresh runtime	120 minutes (2 hours)	-	Extracts - daily, runtime, and memory usage
	Refresh memory usage size	20 GB	-	Extracts - daily, runtime, and memory usage

Extract APIs	Calls	Standard: 120 calls per hour per tenant Enterprise: 240 calls with 1 additional call for every 1 Creator license per hour per tenant Cloud+, Tableau+: 480 calls with 2 additional calls for every 1 Creator license per hour per tenant Capacity-based Viewer Blocks: See Deployments with capacity-based license model	Yes	Extract APIs

Subscriptions	Concurrent subscriptions	Standard: Up to 20 jobs* per tenant Enterprise: Up to 25 jobs* with 1 additional job for every 10 Creator licenses per tenant Cloud+, Tableau+: Up to 50 jobs* with 1 additional job for every 5 Creator licenses per tenant Capacity-based Viewer Blocks: See Deployments with capacity-based license model	Yes	Subscription concurrency
	Individual subscription runtime	30 minutes	-	Subscriptions - runtime and email size
	Individual email size	2 MB	-	Subscriptions - runtime and email size

Publish APIs	Calls	Standard: 800 calls per hour per tenant Enterprise: 1,200 calls with 1 additional call for every 2 Creator licenses per hour per tenant Cloud+, Tableau+: 2,400 calls with 1 additional call for every 1 Creator license per hour per tenant Capacity-based Viewer Blocks: See Deployments with capacity-based license model	Yes	Publish APIs

Flows	Concurrent flows	Standard, Enterpise, Cloud+, Tableau+: 1 Resource Block per site	No	Flow concurrency
	Additional concurrent flows	Enterprise, Cloud+, Tableau+: Dependent on purchased resource blocks per tenant	Yes	Flow concurrency
	Flow memory usage size	19.5 GB	-	Flows - user requests, daily, runtime, and memory usage

VizQL Data Service (VDS) APIs	Calls	Standard, Enterprise, Cloud+, Tableau+: 100 calls per every 1 Creator license per hour per tenant (excludes tenants licensed with UBL)	Yes	VizQL Data Service APIs
VizQL Data Service (VDS) APIs	Calls	Capacity-based Viewer Blocks: See Deployments with capacity-based license model	No	Visualizations

Visualizations	Idle timeout	120 minutes (2 hours)	-	Visualizations - timeout, request rate, memory usage
	Request rate	Up to 600 requests per hour per user	No	Visualizations - timeout, request rate, memory usage
	Request rate	Capacity-based Viewer Blocks: See Deployments with capacity-based license model	Yes	Visualizations
	Query memory usage size	40 GB	-	Visualizations - timeout, request rate, memory usage

View Acceleration	Accelerated views	Minimum 30 accelerated views with an additional 20 views per Creator license per site. Maximum 750 accelerated views per site.	No	Capacity Set at the Site
	Daily refreshes	Up to 12 jobs per day per view (per site)	No
	Individual accelerated views runtime	Up to 30 minutes	-
	Accelerated views memory usage size	20 GB	-

\*To ensure optimal performance and fair resource distribution across Tableau Cloud, capacities are managed dynamically based on real-time demand. During peak periods or at Tableau's discretion, requests beyond the allowed limit might be rejected to prioritize system stability. ### Deployments with capacity-based license model The capacity-based license model, Capacity-based Viewer Blocks, replaces your edition's default capacity for the following capacity types: extracts, extract APIs, publish APIs, and subscriptions. Under this model, you also get capacity for scheduled Pulse digests and additional visualizations capacity. **Note:** Capacity for visualizations and VizQL Data Service (VDS) APIs are combined into a single pool in the capacity-based license model.

Feature area	Capacity type	Capacity allowance	Configurable in TCM	More information

Extracts	Concurrent refreshes	For each unit purchased, 15 total jobs per tenant (replaces edition capacity)	Yes	Extract concurrency

Extract APIs	Calls	For each unit purchased, 1000 total calls per hour per tenant (replaces edition capacity)	Yes	Extract APIs

Publish APIs	Calls	For each unit purchased, 1000 total calls per hour per tenant (replaces edition capacity)	Yes	Publish APIs

Pulse digests	Scheduled digests	For each unit purchased, up to 1000 requests** per day per tenant	Yes	Pulse digests

Subscriptions	Concurrent subscriptions	For each unit purchased, 25 total jobs per tenant (replaces edition capacity)	Yes	Subscription concurrency

Visualizations	Request rate	For each unit purchased, up to 300 total requests** per hour per tenant	Yes	Visualizations

\*\*To ensure optimal performance and fair resource distribution across Tableau Cloud, capacities are managed dynamically based on real-time demand. During peak periods or at Tableau's discretion, requests beyond the allowed limit might be rejected to prioritize system stability. ## Other articles in this section [Skip to main content](#main-content) # Tableau Cloud Help ## Get Started ![](/tableau/next/en-us/online/en-us/Img/Help_Spot_GetStarted_big.png) - [Tableau Cloud Release Notes](https://help.tableau.com/v0.0/online/en-us/whatsnew_online.htm) - [Sign In to Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_signin.htm) - [Tour Your Tableau Site](https://help.tableau.com/current/pro/desktop/en-us/navigating.htm) - [Get Started with Web Authoring](https://help.tableau.com/current/pro/desktop/en-us/getstarted_web_authoring.htm) - [Tableau Cloud Manual Migration Guide](https://help.tableau.com/current/guides/migration/en-us/emg_intro.htm) - [more](https://help.tableau.com/v0.0/online/en-us/to_get_started.htm) ## Use Tableau Cloud Manager ![](/tableau/next/en-us/online/en-us/Img/Help_Spot_ManageServer_big.png) - [Use Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_intro.htm) - [Cloud Administrator Role and Tasks](https://help.tableau.com/v0.0/online/en-us/cloud_manager_admin.htm) - [Sign In to Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_signin.htm) - [Add, Rename, Delete, or Activate Sites](https://help.tableau.com/v0.0/online/en-us/cloud_manager_sites.htm) - [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm) - [more](https://help.tableau.com/v0.0/online/en-us/cloud_manager_intro.htm) ## Administer a Site ![](/tableau/next/en-us/online/en-us/Img/Help_Spot_ManageSites_big.png) - [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm) - [Site Administrator Role and Tasks](https://help.tableau.com/v0.0/online/en-us/to_site_startup.htm) - [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-us/users_site_roles.htm) - [Add Users to a Site](https://help.tableau.com/v0.0/online/en-us/sites_addusers.htm) - [Manage Content Ownership](https://help.tableau.com/v0.0/online/en-us/owner.htm) - [more](https://help.tableau.com/v0.0/online/en-us/to_site_startup.htm) ## Configure Site Authentication ![](/tableau/next/en-us/online/en-us/Img/Help_Spot_InstallConfigure_big.png) - [Enable SAML Authentication on a Site or TCM](https://help.tableau.com/v0.0/online/en-us/saml_config_site.htm) - [Authentication](https://help.tableau.com/v0.0/online/en-us/security_auth.htm) - [Configure SAML with Microsoft Entra ID](https://help.tableau.com/v0.0/online/en-us/saml_config_azure_ad.htm) - [Configure SAML with Okta](https://help.tableau.com/v0.0/online/en-us/saml_config_okta.htm) - [more](https://help.tableau.com/v0.0/online/en-us/security_auth.htm) ## Create and Interact with Views on the Web ![](/tableau/next/en-us/online/en-us/Img/Help_Spot_UseOnWeb_big.png) - [Create a Subscription to a View or Workbook](https://help.tableau.com/v0.0/online/en-us/subscribe_user.htm) - [Connect to Data on the Web](https://help.tableau.com/v0.0/online/en-us/creator_connect.htm) - [What Can I Do with a Tableau Web View](https://help.tableau.com/current/pro/desktop/en-us/viewer_tut.htm) - [more](https://help.tableau.com/v0.0/online/en-us/web_author.htm) ## Manage Data ![](/tableau/next/en-us/online/en-us/Img/Help_Spot_ManageData_big.png) - [Manage Data](https://help.tableau.com/v0.0/online/en-us/to_publish.htm) - [Allow Live Connections to Data Hosted on a Cloud Platform](https://help.tableau.com/v0.0/online/en-us/to_connect_live_sql.htm) - [Managing Background Jobs in Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/server_backgrounder_job_management.htm) - [Tableau Cloud IP Addresses for Data Provider Authorization](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#safelist) - [more](https://help.tableau.com/v0.0/online/en-us/to_publish.htm) ## Refresh Data ![](/tableau/next/en-us/online/en-us/Img/Help_Spot_RefreshData_big.png) - [Schedule Refreshes on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/schedule_add.htm) - [Keep Data Fresh](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm) - [Start a Refresh Task Manually](https://help.tableau.com/v0.0/online/en-us/to_refresh_extract_manual.htm) - [Automate Extract Refresh Tasks from the Command Line](https://help.tableau.com/v0.0/online/en-us/to_refresh_extract_commandline.htm) - [more](https://help.tableau.com/v0.0/online/en-us/data_fresh_section.htm) ## Use Tableau Bridge ![](/tableau/next/en-us/online/en-us/Img/Help_Spot_Bridge_big.png) - [Connectivity with Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm) - [Use Bridge to Keep Data Fresh](https://help.tableau.com/v0.0/online/en-us/qs_refresh_local_data.htm) - [Install Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm) - [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#to) - [more](https://help.tableau.com/v0.0/online/en-us/data_fresh_sync_section.htm) ## Automate and Extend ![](/tableau/next/en-us/online/en-us/Img/Help_Spot_Embed_big.png) - [Tableau REST API](https://help.tableau.com/current/api/rest_api/en-us/help.htm) - [Tableau Web Data Connector SDK](https://tableau.github.io/webdataconnector/docs/) - [Manage Dashboard Extensions](https://help.tableau.com/v0.0/online/en-us/dashboard_extensions_server.htm) - [Tableau Metadata API](https://help.tableau.com/current/api/metadata_api/en-us/index.html) - [more](https://help.tableau.com/v0.0/online/en-us/dev_resources.htm) ## Explore Data Management ![](/tableau/next/en-us/online/en-us/Img/Help_Spot_Addon_big.png) - [About Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_overview.htm) - [About Tableau Prep Conductor](https://help.tableau.com/v0.0/online/en-us/prep_conductor_online_intro.htm) - [About Data Management](https://help.tableau.com/v0.0/online/en-us/dm_overview.htm) - [License Data Management](https://help.tableau.com/v0.0/online/en-us/dm_license.htm) - [more](https://help.tableau.com/v0.0/online/en-us/dm_overview.htm) [Skip to main content](#main-content) # Tableau Cloud Manager Authentication Authentication refers to the options for how TCM cloud administrators can sign in to Tableau Cloud Manager (TCM), and how they access it after signing in the first time. Authentication verifies a user's identity. TCM supports multiple authentication types, which you can configure on the **Settings** page. The configuration steps discussed in this topic are limited to TCM, with site admins configuring site authentication separately. ## Supported authentication types Tableau Cloud Manager (TCM) supports the following authentication types: - **SSO:** If you enable external authentication on TCM, you can select which users you want to sign in by using external credentials and which to use Tableau credentials. You can allow Tableau with MFA and one external provider on TCM, but each user must be set to use one or the other type. You can configure user authentication options on the Users page. For more information, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm). - **Google:** If your organization uses Google applications, you can enable TCM to use Google accounts for single sign-on (SSO) with MFA using OpenID Connect (OIDC). When you enable Google authentication, users are directed to the Google sign-in page to enter their credentials, which are stored with Google. - **OpenID Connect (OIDC):**You can enable SSO through generic OIDC. To do this, you use a third-party identity provider (IdP) with MFA, and configure the site to establish a trust relationship with the IdP. When you enable OIDC, users are directed to the IdP's sign-in page, where they enter their SSO credentials, already stored with the IdP. **Note:** Enabling OIDC authentication for TCM requires a separate setup and app integration from Tableau Cloud. - **Salesforce:** If your organization uses Salesforce, you can enable TCM to use Salesforce accounts for single sign-on (SSO) with MFA using OpenID Connect (OIDC). When you enable Salesforce authentication, users are directed to the Salesforce sign-in page to enter their credentials, which are stored and managed in Salesforce. - **Security Assertion Markup Language (SAML):** Finally, another way to use SSO is through SAML. To do this, you use a third-party identity provider (IdP) with MFA, and configure the site to establish a trust relationship with the IdP. When you enable SAML, users are directed to the IdP's sign-in page, where they enter their SSO credentials, already stored with the IdP. **Note:** Enabling SAML authentication for TCM requires a separate setup and app integration from Tableau Cloud. - **Tableau with MFA:** The built-in and default authentication type. It requires users to provide their Tableau ID (username and password stored with TCM) and an MFA verification method, such as an authenticator app or security key, to confirm a user's identity. For more information about supported MFA methods, see [Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_security_mfa.htm). > [!IMPORTANT] > > In addition to the authentication requirements described above, we recommend that you dedicate a cloud administrator account that is configured for **Tableau with MFA** authentication. If you encounter an issue, a dedicated **Tableau with MFA** account helps ensure that you have access to TCM. ## Authentication requirements Regardless of the authentication type you configure, multi-factor authentication (MFA) is the default and mandatory authentication method when accessing TCM. MFA ensures that users provide an additional verification method beyond their primary credentials, significantly enhancing sign-in security and protecting your organization's data. ### Implementing MFA Multi-factor authentication (MFA) is a multi-step sign-in process that requires users to provide more than just a password to access their accounts. MFA can be implemented in one of two ways: - **Single sign-on (SSO) and MFA (recommended method):** To satisfy the MFA requirement, enable MFA with your Google, OIDC, Salesforce, or SAML identity provider (IdP). - **Tableau with MFA (alternative method):** If you don't work directly with an SSO IdP, you can instead enable a combination of 1) Tableau with MFA credentials, which are stored with Tableau, and 2) an additional verification method before cloud administrators access TCM. We also recommend that users set up recovery codes as a backup verification method for emergency cases only. For more information, see [Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_security_mfa.htm). ### Step 1: Configure authentication for Tableau Cloud Manager To configure authentication in Tableau Cloud Manager (TCM), follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Navigate to the Settings page. 3. Under Authentication types, select Enable an additional authentication method. 4. From the dropdown menu, select your preferred authentication type. ![](/tableau/next/en-us/online/en-us/Img/tcm_auth_type.png) 5. Click Save Changes. ### Step 2: Assign authentication to cloud administrators After configuring TCM authentication, you can assign the authentication method to cloud administrators on the Users page. For more information about changing other user details, see [Manage Users With Tableau Cloud Manager](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm). To assign authentication, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Navigate to the Users page and select the users to modify. **Note:** You can select up to 50 users at a time. To modify more than 50 users, import a CSV file containing the desired changes. For more information about modifying users in bulk, see [Bulk import users](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm#bulk-import-users). 3. Select Actions > Site Membership. 4. Select an authentication method from the Authentication for Tableau Cloud Manager dropdown menu. ![](/tableau/next/en-us/online/en-us/Img/tcm_auth_admin.png) **Note:** If an authentication type other than Tableau with MFA has been configured for TCM authentication, TCM will default to using the non-default authentication type when adding a new Tableau Cloud administrator. This can be changed at any time from the Authentication for Tableau Cloud Manager dropdown in the Site Membership dialog pictured above. 5. Click Save. ## Manage Tableau with MFA As a TCM cloud administrator, you can manage your Tableau with MFA verification methods in TCM, and reset the Tableau with MFA verification methods for other cloud administrators and users on sites across the tenant. ### Manage your verification methods You can manage your Tableau with MFA verification methods from your My Account Settings page. After clicking the Manage MFA Verification Methods link, you can add or remove additional verification methods, including adding recovery codes. **Important:** We strongly recommend that you register the Recovery Codes option to help avoid being locked out of the tenant. Recovery codes should be used in emergency cases only. 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. In the upper-right corner of the page, click your profile, and select My Account Settings. 3. Under Account, click Manage MFA Verifications Methods. ![A curved arrow points to a list of verification methods.](/tableau/next/en-us/online/en-us/Img/mfa_manage_methods_tcm.png) ### Reset verification methods As a cloud administrator, you're responsible for users across the sites on the tenant. As part of your management capabilities, you can reset the MFA verification methods for other cloud administrators, site admins, and site users on the tenant. If a user is locked out of the tenant or site, reset their Tableau with MFA verification methods to enable access back to the site or tenant. Review the table below to determine next steps.

Your role	Target user	Target membership	Can reset MFA?	Reason or next steps
TCM cloud administrator	TCM cloud administrator	Same tenant	Yes	Reset verification methods from the TCM Users page. For more information, see Reset verification methods for users on your tenant below.
	TCM cloud administrator	Different tenants	No	For security purposes, cloud administrators can't reset verification methods for multi-tenant users. For more information, see About resetting verification methods for users on multiple tenants.
	Site admin or site user	Single or multiple sites, same tenant	Yes	Reset verification methods from the TCM Users page. For more information, see Reset verification methods for users on your tenant below. Note: If resetting the verification method for a site-level user who is also a cloud administrator, this process resets Tableau with MFA verification methods for the sites they belong to and TCM.
	Site admin or site user	Multiple sites, different tenants	No	For security purposes, cloud administrators can't reset verification methods for multi-tenant users. For more information, see About resetting verification methods for users on multiple tenants.
Only TCM cloud administrator on tenant	Yourself	Single tenant	No	Contact your Tableau Support. To contact Tableau Support, follow the steps described in the How to Create a Case on Salesforce Help knowledge article.

#### Reset verification methods for users on your tenant You can reset the Tableau with MFA with Tableau verification methods from the Users page in TCM to enable cloud administrators, site admins, or site users to regain access to TCM or sites on your tenant. 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Go to the Users page and navigate to the user who needs to regain access to TCM or sites. 3. From the Actions menu, select Reset MFA Verifiers. 4. In the Reset MFA Verifiers dialog box, click the Reset MFA Verifiers button. **Notes:** - As a reminder, the option to reset the verification methods is available only when _any_ of the following conditions are true: - The user belongs to one or more sites under the same TCM tenant. - The cloud administrator belongs to only one TCM tenant. - If resetting the verification method for a site-level user who is also a cloud administrator, this process resets Tableau with MFA verification methods for the sites they belong to and TCM. #### About resetting verification methods for users on multiple tenants As a security best practice, you must contact Tableau Support to reset the MFA with Tableau verification methods for cloud administrators that belong to multiple tenants or for users who belong to sites across multiple tenants. To contact Tableau Support, follow the steps described in the [How to Create a Case on Salesforce Help](https://help.salesforce.com/s/articleView?id=000393090&type=1) knowledge article. ## Configure authentication for Tableau Cloud sites Site authentication is configurable only by site admins directly at the site level. If you're a cloud administrator, you must also have site admin privileges to change authentication settings. To modify site authentication, follow these steps: 1. Sign in to Tableau Cloud Manager as a cloud administrator. 2. Navigate to the Sites page. 3. Click the ellipsis icon (**...**) next to the site you want to modify. 4. From the Actions menu, select Authentication Type to redirect to the site's authentication settings. For more information about configuring site authentication as a site admin, see [Authentication](https://help.tableau.com/v0.0/online/en-us/security_auth.htm). If you're not a site admin, a dialog is displayed with instructions on how to assign the necessary role. You must be a site admin with the Site Administrator Explorer or Site Administrator Creator role to proceed with configuring site authentication. ![](/tableau/next/en-us/online/en-us/Img/tcm_auth_site_permission.png) ### Assign user authentication for site users As a cloud administrator, you can't directly configure site authentication settings. However, if multiple authentication methods are set up on the site, you can modify a user's authentication to a site on the Users page of Tableau Cloud Manager. For more information, see [Manage users' site membership](https://help.tableau.com/v0.0/online/en-us/cloud_manager_users.htm#manage-site-membership). [Skip to main content](#main-content) # Tableau Cloud Release Notes > [!TIP] > > Tableau Online is now Tableau Cloud. This topic describes what’s new in the latest release. Use the visualization below to explore new features in Tableau Cloud. Click on a feature to bring up the tooltip with a link to detailed documentation for that feature. Explore the filters to refine your search. Download the data to create a customized list. You can also use the Search by Feature dashboard to see a list of new features for a product or version, or explore when a feature was released. The dashboard currently defaults to Tableau Cloud for the latest version of Tableau Cloud. ## Web authoring and interacting with views For new features and enhancements related to web authoring and interacting with views, see [Tableau Desktop and Web Authoring Release Notes](https://help.tableau.com/current/pro/desktop/en-us/whatsnew_desktop.htm). For more topics related to those tasks, see [Using Tableau on the Web](https://help.tableau.com/current/pro/desktop/en-us/web_author_home.htm). ## Other articles in this section [Skip to main content](#main-content) # Tableau Cloud System Maintenance Tableau Cloud undergoes periodic maintenance to sustain the infrastructure supporting Tableau Cloud services and deliver enhanced features and functionality. As a Tableau Cloud site administrator, you don't have to worry about managing updates to your site. But we recommend reviewing the reserved maintenance schedule to plan for scheduled downtime and to avoid service interruptions. For more information about releases, see [Tableau Cloud release cadence](#release-cadence). Starting in April 2025, Tableau+ customers can create release preview sites to assess major Tableau Cloud releases before they go live in production environments. These sites are hosted in dedicated limited-release preview environments and are updated separately from standard Tableau Cloud sites. For more information, see [About Tableau Release Preview](https://help.tableau.com/v0.0/online/en-us/release_preview.htm). ## Maintenance communication Tableau communicates system maintenance through the Salesforce Trust Status page and notification emails to site administrators. ### Salesforce Trust notifications Salesforce Trust is where all Tableau Cloud status updates are posted. Status updates include system maintenance, as well as reported incidents that might affect the use of Tableau Cloud. You can quickly check the status of your Tableau Cloud instance by visiting the trust page, or by subscribing to Trust to stay informed. To subscribe to Trust, go to [https://status.salesforce.com/products/tableau](https://status.salesforce.com/products/tableau), and click the Subscribe to Notifications button. You can receive updates by email or notifications whenever Tableau Cloud creates, updates, or resolves an incident. For detailed instructions, see the [Salesforce Trust Status Notification Guide](https://trust1-public.s3.amazonaws.com/notifiction_guide/en/TrustNotificationGuide.pdf). ### Site Administrator emails Tableau Cloud users with the Site Administrator role will automatically receive notification emails about their site. Emails include system maintenance and reported incidents that might affect the use of Tableau Cloud. Notification emails will include the date and time, name of the Tableau Cloud instance, type of maintenance scheduled, impact to users, and estimated time to completion. ## Reserved system maintenance schedule Tableau has reserved system maintenance windows for sustaining the security, availability, and performance of the infrastructure supporting Tableau Cloud services. The reserved maintenance schedule will help you plan for scheduled downtime and avoid service interruptions to your Tableau Cloud site. While there is a pre-defined window in which maintenance can occur, there might be months when maintenance is not required. When maintenance is scheduled, we publish the dates and times of the maintenance windows on the [Salesforce Trust](https://status.salesforce.com/products/tableau) page. For maintenance that impacts an entire Tableau Cloud instance, Trust Status notifications are sent to subscribers and site administrators via email. Notifications are sent when the maintenance schedule is posted to Trust Status and 14-days before the maintenance will occur. Trust Status notifications will also be sent at the start and end of each maintenance and 48 hours prior as a reminder. In the event that we need to reschedule maintenance, the maintenance record will be updated on the Trust Status page, and an email will be sent to Trust Status subscribers. **Note:** If priority maintenance is required, Trust Status subscribers and Tableau Cloud site administrators may be notified less than one week in advance. Whenever possible, and only as maintenance is necessary, Tableau will schedule system maintenance the **first and third weekends of the calendar month** during the windows listed in the table below. Plan the maintenance activities for your organization (software upgrades, integration changes, etc.) outside of the Tableau system maintenance windows for your instances. In extreme circumstances, there may be times when system maintenance is scheduled outside of these windows to maintain system availability, performance, and security of the Tableau Cloud infrastructure.

Reserved System Maintenance Windows
Location		Pod	Pacific time (PST)	Local time (standard time)
Asia Pacific	Australia	prod-apsoutheast-a	Saturday, 07:00 – 11:00	Sunday, 01:00 – 05:00 AEST
	India	prod-in-a	Saturday, 14:00 – 18:00	Sunday, 03:30 – 07:30 IST
	Indonesia	prod-apsoutheast-c	Saturday, 07:00 – 11:00	Saturday, 22:00 – Sunday, 02:00 WIB
	Japan	prod-apnortheast-a	Saturday, 07:00 – 11:00	Sunday, 00:00 – 04:00 JST
	Singapore	prod-apsoutheast-b	Saturday, 07:00 – 11:00	Saturday, 23:00 – Sunday, 03:00 SGT
	South Korea	prod-kr-a	Saturday, 08:00 – 12:00	Sunday, 01:00 – 05:00 KST
Canada	Quebec	prod-ca-a	Sunday, 00:00 – 04:00	Sunday, 03:00 – 07:00 EST
Europe	Germany	DUB01, EW1A	Saturday, 14:00 – 18:00	Saturday, 23:00 – Sunday, 03:00 CET
	Switzerland	prod-ch-a	Saturday, 14:00 – 18:00	Saturday, 23:00 – Sunday, 03:00 CET
	UK	prod-uk-a	Saturday, 14:00 – 18:00	Saturday, 22:00 – Sunday, 02:00 GMT
United States - West	Oregon	10AY, 10AZ, UW2B, prod-uswest-c	Sunday, 00:00 – 04:00	Sunday, 00:00 – 04:00 PST
United States - East	Virginia	prod-useast-a, prod-useast-b, useast-1, prod-useast-c	Sunday, 00:00 – 04:00	Sunday, 03:00 – 07:00 EST

**Notes:** - Local maintenance windows use standard time. The local time might change +/- 1 hour seasonally during daylight saving time. - Maintenance windows were updated on April 15, 2026 in effort to better support customers and help minimize disruptions. Previous reserved system maintenance windows In effort to better support customers and help minimize disruptions, the reserved system maintenance windows were updated on April 15, 2026. For the current reserved system maintenance windows, see the table [above](#maintenance-windows). The previous reserved system maintenance windows are listed below for **reference only**.

Reserved System Maintenance Windows
Region	Pod	Interval	Local Time	UTC
United States - West	10AY, 10AZ, UW2B, prod-uswest-c	1st monthly weekend 3rd monthly weekend	Saturday, 08:00 - 14:00 PST	Saturday, 16:00 – 22:00
United States - East	prod-useast-a, prod-useast-b, useast-1, prod-useast-c	1st monthly weekend 3rd monthly weekend	Sunday, 11:00 - 17:00 EST	Sunday, 16:00 – 22:00
Europe	DUB01, EW1A, prod-uk-a, prod-ch-a	1st monthly weekend 3rd monthly weekend	Saturday, 02:00 - 08:00 CET	Saturday, 01:00 – 07:00
Canada - Quebec	prod-ca-a	1st monthly weekend 3rd monthly weekend	Sunday, 11:00 - 17:00 EST	Sunday, 16:00 – 22:00
Asia Pacific - Japan	prod-apnortheast-a	1st monthly weekend 3rd monthly weekend	Sunday, 01:00 - 07:00 JST	Saturday, 16:00 – 22:00
Asia Pacific - Australia	prod-apsoutheast-a	1st monthly weekend 3rd monthly weekend	Sunday, 03:00 - 09:00 AEST	Saturday, 16:00 – 22:00
Asia Pacific - Singapore	prod-apsoutheast-b	1st monthly weekend 3rd monthly weekend	Sunday, 00:00 - 06:00 SGT	Saturday, 16:00 – 22:00
Asia Pacific - Indonesia	prod-apsoutheast-c	1st monthly weekend 3rd monthly weekend	Sunday, 23:00 - Monday, 05:00 WIB	Saturday, 16:00 – 22:00
Asia Pacific - India	prod-in-a	1st monthly weekend 3rd monthly weekend	Saturday, 22:00 - Sunday, 04:00 IST	Saturday, 16:00 - 22:00
Asia Pacific - South Korea	prod-kr-a	1st monthly weekend 3rd monthly weekend	Sunday, 01:00 - 07:00 KST	Saturday, 16:00 - 22:00

## Tableau Cloud release cadence To ensure our products continue to help people use data to solve problems every day, Tableau is constantly innovating. We ship new features and functionality three times a year (Winter, Spring, Summer). ### Release communication Releases are communicated through in-product notifications to let you know when your site is scheduled to be upgraded, and then again once the upgrade is complete. Sites can be accessed during the upgrade, meaning that all features and functionality are available to users. There's no downtime associated with release upgrades. ### Release schedule Major releases are rolled out across Tableau Cloud’s worldwide infrastructure over several weeks before upgrading our on-premises software. Because our releases are rolled out worldwide in sequence, exact dates and times aren't announced. Instead, in-product notifications are there to inform users and administrators when releases are coming. You'll see an in-product notification approximately two weeks before your site is scheduled to upgrade, and another after the upgrade is complete. Here's an example of the upgrade coming soon notification when signed in to a site: ![Tableau Cloud upgrade notification.](/tableau/next/en-us/online/en-us/Img/to_coming_soon.png) ### Learn about new features For more information about the new features on your site, see [Coming Soon](https://www.tableau.com/products/coming-soon). The Coming Soon page offers information about upcoming and in-progress Tableau releases. As a Tableau Cloud customer, you might already have access to the features listed on this page. Broader website updates happen once customers across all of our products can upgrade and take advantage of the new features. [Skip to main content](#main-content) # Allow Live Connections to Data Hosted on a Cloud Platform You have many options for managing the data underlying your Tableau Cloud workbooks. You can choose how to keep the data current based on your business needs. Depending on the data source, you can leverage a live connection, or you can create an extract and define an extract schedule to keep the data fresh. You can also embed credentials or require users to provide credentials for accessing the data when they open views that connect to content. If you maintain relational data on a cloud platform, you can use live connections to that data when you publish workbooks and data sources to Tableau Cloud. When you use a live connection, you don't need to publish a static extract of the data. ## Enable encrypted connections Encrypting connections using SSL is an option for underlying data sources. You can enable SSL encryption for connections to your hosted SQL data when you create the connection in Tableau Desktop. Complete the following steps to enable encrypted connections. > [!TIP] > > Make sure that Tableau Cloud is on your data provider's authorized list (safe list). 1. In Tableau Desktop, connect to the data. 2. In the Server Connection dialog box, select the Require SSL check box. 3. For PostgreSQL, SQL Server-compatible connections, and other connections that don't have an option to embed certificates in the data source, click OK to finish. For some compatible connections, linked text appears under the Require SSL checkbox. This indicates that you can specify an alternative certificate file to use, such as a self-signed certificate. 4. (Optional) Use a self-signed or other custom certificate to connect to this data over SSL. 1. Select the link text that appears. ![](/tableau/next/en-us/online/en-us/Img/to_connect_live_sql1.png) 2. In the Configure and Use SSL Certificate dialog, specify the certificate’s **.pem** file. For example, for MySQL connections to data hosted on Amazon RDS, you can point to Amazon’s self-signed certificate file at [this address](https://rds.amazonaws.com/doc/mysql-ssl-ca-cert.pem). ### Untrusted certificates If you are using certificates that aren't trusted by Tableau Cloud, such as self-signed certificates, or certificates signed by your company's internal CA, you may have problems connecting from Tableau Cloud. Try one of the following solutions. - If your connector allows embedding custom certificates, then use that. (This is the method used in the previous section) - Get new certificates for your database which are signed by a trusted public CA. - Use [Tableau Bridge](https://help.tableau.com/current/online/en-us/to_sync_local_data.htm), which is Tableau’s connection proxy. You can configure your certificates to be trusted on the machine running Bridge, either by using TDC files, properties files, or by installing your certificates in the Windows System Trust Store. ### Supported connectors Refer to the "Tableau Cloud" tab in the [Creators: Connect to Data on the Web](https://help.tableau.com/v0.0/online/en-us/creator_connect.htm#connector_list) topic for the list of supported connectors. For more information about supported features by connector, refer to the specific connector topic in the [Supported Connectors](https://help.tableau.com/current/pro/desktop/en-us/exampleconnections_overview.htm) section of the Tableau User Help. **Note**: Not all connectors in this list are supported by Tableau Prep Conductor. To see the supported list of connectors, open Tableau Prep Builder and expand the Connect pane. ## See also - [Connector Examples](https://help.tableau.com/current/pro/desktop/en-us/help.htm#exampleconnections_overview.htm) in the Tableau Help [Skip to main content](#main-content) # Upload a Custom Logo for your Site To incorporate brand identity into your site header, you can change the Tableau logo to your own logo. 1. Sign in to Tableau Cloud as a site administrator. 2. On the site you want to show your logo, click Settings. 3. In the Site Logo section, do either of the following: - Drag the image file from your computer to the area indicated on the Settings page. ![](/tableau/next/en-us/online/en-us/Img/to_custom_logo1.png) - Click Select File to open a dialog box where you can browse to and select the image file. The preview area updates to show how your image will look in the space provided in the header. 4. (Optional) If your logo doesn’t fit quite right in the available space, and you want to make adjustments outside of Tableau before uploading it, you can do either of the following: - Click Reset to Default to show the original Tableau logo. - Click Revert to go back to the last saved settings. This is useful if you already have a custom logo in place but want to try a different one. 5. Click Save. ### Image file tips - The recommended image size is 48 x 48 pixels, up to 160 x 160 pixels (the maximum). - Images that have a transparent background and light colors work best against the near-black background of the Tableau Cloud site. [Skip to main content](#main-content) # Customize the Site and Content Settings As a Tableau administrator, you can customize a site for your organization. The settings available to you depend on your site configuration and whether you use Tableau Cloud or Tableau Server. To view and edit site settings, you must be a Site Administrator on Tableau Cloud or Server Administrator on Tableau Server. Use the topics below to customize your site. ## Other articles in this section [Skip to main content](#main-content) # Keep Data Fresh After you publish workbooks and data sources to Tableau Cloud, you can decide how you want to keep the data current. Options for keeping published data fresh depend on the characteristics of your data sources. ## Data freshness options by data source The following table lists data freshness options (and exceptions) that are available depending on the data source. #### Exceptions - Tableau Cloud does not support connections to any cube-based data source. - Tableau Cloud does not support published connections that use Kerberos authentication. - Although you can publish extracts of SAP BW data to Tableau Cloud, refreshes are not supported. The best way to update SAP BW data sources is to republish them. #### Options

Source	Publish options	Freshness options	Authentication
On-premises data (accessible only from a private network)
File-based data (Excel, .csv, .txt)	Extract only	Use Tableau Bridge (recommended) Manual refresh from Tableau Desktop Automated command-line scripts	n/a
Statistical file (SAS (*.sas7bdat))	Extract only	Use Tableau Bridge (recommended) Manual refresh from Tableau Desktop Automated command-line scripts	n/a
Data hosted on a cloud platform (For example, Oracle on Amazon RDS)	Live connection or extract, depending on database	Use Tableau Bridge (recommended) Manual refresh from Tableau Desktop Automated command-line scripts	Embedded credentials in Tableau Bridge settings
Relational database (Relational databases that Tableau Desktop connects to. For example, SQL Server, Oracle, IBM DB2)	Live connection or extract, depending on database	Use Tableau Bridge (recommended) Manual refresh from Tableau Desktop Automated command-line scripts	Embedded credentials in Tableau Bridge settings
Cloud data (accessible from the public internet)
Data hosted on cloud platforms (See the list of supported platforms in Allow Live Connections to Data Hosted on a Cloud Platform	Live connection or extract	Extracts: Schedule directly on Tableau Cloud	Embedded credentials + IP safe list Edit Connections on Tableau Cloud
Salesforce, Google Analytics	Extract only	Schedule directly on Tableau Cloud Refresh Data Using Saved Credentials	OAuth Connections
Google BigQuery, Google Sheets	Live connection or extract	Extracts: Schedule directly on Tableau Cloud Refresh Data Using Saved Credentials	OAuth Connections
Cloud (Box, Dropbox, OneDrive, Google Drive) file-based data (Excel, .csv, .txt, .tab, .tsv, .json)	Live connection or extract	Extracts: Schedule directly on Tableau Cloud Refresh Data Using Saved Credentials	OAuth Connections
Anaplan Oracle Eloqua ServiceNow ITSM	Extract only	Schedule directly on Tableau Cloud Refresh Data Using Saved Credentials	Embedded credentials Edit Connections on Tableau Cloud
Marketo	Extract only	Schedule directly on Tableau Cloud	Embedded credentials
Web Data Connectors	Extract only	For basic user name and password credentials, use Tableau Bridge. For custom (non-basic) user name and password credentials, use the Tableau Desktop Refresh From Source command, or run a manual refresh from Tableau Desktop. For more information, see the WDC Authentication topic in the Tableau Web Data Connector API Help.	Tableau Bridge: Embedded credentials Other: n/a

## IP addresses for data provider authorization As a security measure, cloud-based data providers might require you to supply authorized IP addresses from which external applications request access to your data. A request from an IP address that is not explicitly approved could be rejected. To ensure live connections you publish to Tableau Cloud remain uninterrupted, add Tableau Cloud to your data provider’s allowlist. The table below lists [Hyperforce](https://help.salesforce.com/s/articleView?id=000388902&type=1) IP addresses Tableau Cloud uses based on the pod your site resides on. You can see the pod in the URL that appears after you sign in to Tableau Cloud. The table below lists IP addresses for each pod. It also lists Hyperforce VPCE IDs to use when your Tableau Cloud data resides in the same region as your Tableau Cloud instance. You can see the pod in the URL that appears after you sign in to Tableau Cloud. **Notes:** - In addition to enabling communication over the Tableau Cloud IP range, you might need to enable access over the appropriate database port (for example, 80 or 443) depending on the communication type (HTTP or HTTPS). - IP addresses are dedicated to and controlled by Salesforce. - The IP address ranges are listed in Classless Inter-Domain Routing (CIDR) notation. ### IP addresses for Tableau Cloud Hyperforce IP addresses are added periodically and will require your data provider's allowlist to be updated. Site admins will receive an email notification alerting them when new IP addresses become available. You can also stay informed of new IP addresses using _one_ or _both_ options: - **Option 1—periodically review the IP address table below:** At least 30 days before the IP addresses are enabled, the IP address table below is updated. - **Option 2—automate IP address updates using the JSON text file:** Salesforce recommends that your data provider’s allowlist mirror the [https://ip-ranges.salesforce.com/ip-ranges.json](https://ip-ranges.salesforce.com/ip-ranges.json) text file at all times by automating the IP address updates. New IP addresses are added to the text file at least 30 days before they’re enabled. In the text file, the IP address for your pod are listed by the Hyperforce region that your pod resides in. To determine the Hyperforce region, refer to the "Pod" and the associated "Hyperforce Region" columns in the table below. For example, if your pod name is "prod-ca-a", your Hyperforce region is "ca-central-1". In [https://ip-ranges.salesforce.com/ip-ranges.json](https://ip-ranges.salesforce.com/ip-ranges.json) text file, search for "ca-central-1" for the appropriate IP address to include in your data provider's allowlist. **Notes:** - When new IP addresses become available, a new version of the text file that contains both new and existing IP addresses replaces the previous text file. - The text file version is indicated by the “createDate” (in UTC). - Salesforce recommends that you make a copy of the previous version of the text file for your records. - Not all regions will receive new IP addresses at the same time. #### IP addresses

Location		Hyperforce Region	Pod (Pod Name)	Pod Time Zone	IP Address and Range after Hyperforce Migration (Alternatively, search for the Hyperforce region in https://ip-ranges.salesforce.com/ip-ranges.json)
Asia Pacific	Australia	ap-southeast-2	prod-apsoutheast-a	AEDT/AEST	141.163.192.0/23
	India	ap-south-2	prod-in-a	UTC	141.163.216.0/24
	Indonesia	ap-southeast-3	prod-apsoutheast-c	UTC	141.163.212.0/24
	Japan	ap-northeast-1	prod-apnortheast-a	JST	141.163.208.0/23
	Singapore	ap-southeast-1	prod-apsoutheast-b	UTC	141.163.196.0/23
	South Korea	ap-northeast-2	prod-kr-a	UTC	141.163.200.0/23
Canada	Quebec	ca-central-1	prod-ca-a	CST/CDT	155.226.152.0/23
Europe	Germany	eu-central-1	dub01 (DUB01)	UTC	145.224.208.0/23
	Germany	eu-central-1	eu-west-1a (EW1A)	UTC	145.224.208.0/23
	Switzerland	eu-central-2	prod-ch-a	UTC	145.224.198.0/24
	UK	eu-west-2	prod-uk-a	GMT/BST	145.224.200.0/23
United States - West	Oregon	us-west-2	10ax (10AX)	PST/PDT	155.226.128.0/21
			10ay (10AY)	PST/PDT
			10az (10AZ)	PST/PDT
			uw2b (UW2B)	UTC
			prod-uswest-c	PST/PDT
United States - East	Virginia	us-east-1	prod-useast-a	UTC	155.226.144.0/22
			prod-useast-b	EST/EDT
			us-east-1 (useast-1)	UTC
			prod-useast-c	UTC

#### About the Hyperforce migration Between August 2024 and March 2025, Tableau Cloud sites were migrated to Salesforce's [Hyperforce](https://help.salesforce.com/s/articleView?id=000388902&type=1). This move enhances broader compliance, improves security and privacy, increases regional availability, and ensures future scalability, delivering these benefits more quickly and reliably worldwide. **Previous IP addresses** The migration to Hyperforce resulted in a change to Tableau Cloud IP addresses. The old IP addresses are provided below for reference and to assist you in identifying and removing any inactive IP addresses from your data provider's allowlist. For active IP addresses, see the table [above](#new_ip_addresses). IP addresses before Hyperforce migration

Location		Hyperforce Region	Pod (Pod Name)	IP Address before Hyperforce Migration
Asia Pacific	Australia	ap-southeast-2	prod-apsoutheast-a	3.25.37.32/28
Asia Pacific	Japan	ap-northeast-1	prod-apnortheast-a	18.176.203.96/28
Canada	Quebec	ca-central-1	prod-ca-a	3.98.24.208/28
Europe	Germany Note: Formerly Ireland region prior to the Hyperforce migration.	eu-central-1	dub01 (DUB01)	34.246.74.86 52.215.158.213
		eu-central-1	eu-west-1a (EW1A)	34.246.62.141 34.246.62.203
	UK	eu-west-2	prod-uk-a	18.134.84.240/28
United States - West	Oregon	us-west-2	10ax (10AX)	34.208.207.197 52.39.159.250
			10ay (10AY)	34.218.129.202 52.40.235.24
			10az (10AZ)	34.218.83.207 52.37.252.60
			us-west-2b (UW2B)	34.214.85.34 34.214.85.244
United States - East	Virginia	us-east-1	prod-useast-a	3.219.176.16/28
			prod-useast-b	3.219.176.16/28
			us-east-1 (useast-1)	50.17.26.34 52.206.162.101

### VPCE IDs for Tableau Cloud After the migration to Hyperforce, some new requirements apply when accessing Tableau Cloud data stored in an Amazon S3 bucket. When the data is _in the same region_ as your Tableau Cloud instance: - You _must_ use a VPC endpoint (VPCE) instead of IP source addresses to control access to your S3 data. VPC endpoints are private connections between a virtual private cloud (VPC) and a resource (your data in S3). Using an endpoint is a better solution because an IP address can change over time. When the S3 bucket is _in a different region_ than the Tableau Cloud site: - You need to use the IP addresses to control access to the S3 bucket. This applies to both the S3 connector and the Snowflake connector when the Snowflake instance is on AWS in the same region as the Pod and [Internal stage protection is enabled](https://docs.snowflake.com/en/user-guide/network-policies#protecting-internal-stages-on-aws "link to Snowflake documentation about protecting internal stages on AWS") in the Snowflake instance. #### IP addresses and VPCE IDs

Location		Hyperforce Region	Pod (Pod Name)	IP Address and Range / VPCE ID
Asia Pacific	Australia	ap-southeast-2	prod-apsoutheast-a	141.163.192.0/23 vpce-071ca855ea8cc1154
	India	ap-south-2	prod-in-a	141.163.216.0/24 vpce-02e14aeeeccOa2eef
	Indonesia	ap-southeast-3	prod-apsoutheast-c	141.163.212.0/24 vpce-05825e2ebed977018
	Japan	ap-northeast-1	prod-apnortheast-a	141.163.208.0/23 vpce-045516807606e4738
	Singapore	ap-southeast-1	prod-apsoutheast-b	141.163.196.0/23 vpce-0c47ba2622417575b
	South Korea	ap-northeast-2	prod-kr-a	141.163.200.0/23 vpce-053ebbbe86f5411ca
Canada	Quebec	ca-central-1	prod-ca-a	155.226.152.0/23 vpce-0fd4bd6f2f928fcf7
Europe	Germany	eu-central-1	dub01 (DUB01)	145.224.208.0/23 vpce-091ff41bc3686e6e8
	Germany	eu-central-1	eu-west-1a (EW1A)	145.224.208.0/23 vpce-091ff41bc3686e6e8
	Switzerland	eu-central-2	prod-ch-a	145.224.198.0/24 vpce-0fbf9d552ffbb6be2
	UK	eu-west-2	prod-uk-a	145.224.200.0/23 vpce-0101caa470966f49d
United States - West	Oregon	us-west-2	10ax (10AX)	155.226.128.0/21 vpce-090a7c76e361d5013
			10ay (10AY)
			10az (10AZ)
			uw2b (UW2B)
			prod-uswest-c
United States - East	Virginia	us-east-1	prod-useast-a	155.226.144.0/22 vpce-0ea40e596e16259d1
			prod-useast-b
			us-east-1 (useast-1)
			prod-useast-c

## Tableau Bridge connections to Tableau Cloud To facilitate connections between on-premises data and Tableau Cloud, Tableau Bridge uses common port 443 to make outbound requests to Tableau Cloud. For more information, see [Network access](https://help.tableau.com/current/online/en-us/to_bridge_install.htm#network-access) section in the Install Tableau Bridge topic. ## See also - [Manage Data](https://help.tableau.com/v0.0/online/en-us/to_publish.htm) - [Best Practices for Published Data Sources](https://help.tableau.com/current/pro/online/mac/en-us/help.htm#publish_datasources_about.htm) (Tableau Help) - [Notify Owners When Extract Refreshes Fail](https://help.tableau.com/v0.0/online/en-us/to_refresh_enable_emails.htm) - [Edit Connections on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_connections_modify.htm) [Skip to main content](#main-content) # Tableau Content Migration Tool Log Files Tableau Content Migration Tool generates log files when you run migrations. These can be helpful for troubleshooting problems. **Note:** For information on all the Content Migration Tool settings, see [Tableau Content Migration Tool Settings](https://help.tableau.com/v0.0/online/en-us/cmt-settings.htm). ## Content Migration Tool Log File Location To find the Content Migration Tool log files from within the Content Migration Tool: 1. Start Content Migration Tool. 2. Click Help and Settings: ![The Settings option in the Help dropdown menu.](/tableau/next/en-us/online/en-us/Img/cmt-help-settings.png) 3. In the Settings dialog, click Open Log Folder: ![A cursor hovers over the blue button labeled “Open Log Folder”.](/tableau/next/en-us/online/en-us/Img/cmt-logfile-folder.png) A window opens with the log files. If you are working with Tableau Support and they ask you to send log files, zip the files up before you send them. For more information on sending log files to Tableau, see the [Tableau Knowledge Base](https://kb.tableau.com/articles/howto/alternative-method-for-sending-large-files). ## Who can do this Typically, the tasks listed above can only be done by a user with Administrator access on the machine. [Skip to main content](#main-content) # Tableau Content Migration Tool Settings The Tableau Content Migration Tool default settings work in most cases, but you can change these if you need to, or if you are working with Tableau Support and they ask you to make changes. To view or update the Content Migration Tool settings: 1. Open Content Migration Tool. 2. Click Help > Settings. The Settings dialog opens: ![Advanced tab of the Settings window showing advanced options for the content management tool.](/tableau/next/en-us/online/en-us/Img/cmt-settings.png) Diagnostics—Click Open Log Folder to open the logs location. Here you can view the logs, and zip them up if you need to send them to Tableau. For more information, see [Tableau Content Migration Tool Log Files](https://help.tableau.com/v0.0/online/en-us/cmt-logfiles.htm). Select Enable Network Tracing if you are working with Support and they ask you to include a network trace in the logs. This applies until you clear the option or restart the Content Migration Tool. Security—The encryption key is automatically generated on installation. If you change the encryption key, any migration plans with embedded passwords that were created with the previous key cannot be opened. If you have multiple installations of Tableau Content Migration Tool and want to share migration plans, you need to make sure the encryption key used by each instance of the tool is the same. Migration Scripts—By default, a warning is displayed when running a migration plan that includes migration scripts or executables. Other users can edit these files, so verify that they're safe before running the migration. Toggling this setting on and off will also update your warning preference for the console runner. For more information, see [Using the Tableau Content Migration Tool Console Runner](https://help.tableau.com/v0.0/online/en-us/cmt-deployment_console_runner.htm). Tuning—In almost all cases you can leave these set to the defaults. If you are working with Support, they may ask you to change these settings. Temporary Files—Select a location for temporary files if you want to change the default. This is the location where content is copied during a migration. You may want to change this if the default location does not have enough space to temporarily hold migrated content. Networking—Selecting Allow Legacy HTTPS Connections gives you the ability to connect to Tableau Server installations running with older HTTPS configurations (for example, SSL v3). This is not recommended. ## Who can do this Typically, the tasks listed above can only be done by a user with Administrator access on the machine where Content Migration Tool is installed. [Skip to main content](#main-content) # Tableau Content Migration Tool Use Cases Tableau Content Migration Tool as the name suggests, is primarily used for moving Tableau Cloud content from one project to another. However, there are many features in the tool that makes it ideal for accomplishing several tasks related to content migration and maintenance. **Note:** In many of the use cases we use the term migration to describe moving content from one environment, site, or project to another. However, technically the Content Migration Tool copies content and does not automatically delete or archive the original or source content. The information below describes some common use cases where you can leverage the Content Migration Tool. ## Content promotion You can use the Content Migration Tool to create content for development projects and then perform routine migrations to promote content to staging or production projects on your site. Use the following steps to migrate content to production projects: 1. **Create a plan** and select the site to use as your source. In this example, we describe a migration between projects on the same site, so choose the same Tableau site as your destination. For more information, see Create a Plan in [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm#step-1-start) topic. When migrating workbooks between two projects on the same site, your sign-in credentials for the source and destination may be similar or identical. In this scenario, we recommend using personal access tokens for a more reusable connection. For more information, see [Personal Access Tokens](https://help.tableau.com/v0.0/online/en-us/security_personal_access_tokens.htm). 2. **Select the development project** with the content you want to migrate. You can select entire projects, specific workbooks and data sources, and user permissions. For more information, see Planning in [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm#step-2-planning) topic. If you need to make any **changes or transformations** to the content during this migration, you can configure that in the plan as well. This is referred to as **Mapping**. 3. Select Change Project from the Add Mapping menu to add a project mapping. Select your development project as the source and production project as the destination, or click Add New to create a new project. Other types of mapping include: - **Changes to workbooks:** Includes renaming workbooks and changing the destination project. For a full list of workbook transformations, see [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm). ![A dropdown menu in the Migration window that lists options for renaming workbooks, projects, prefixes, and suffixes.](/tableau/next/en-us/online/en-us/Img/cmt-workbook-mapping-options.png) - **Changes to data sources:** Includes replacing table or schema names, settings calculation formulas, and setting connection information. For a full list of data source transformations, see [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm#step-3-workbook-transformations) (embedded data sources) and [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm#step-3-data-source-transformations) (published data sources). ![The Add Transformation dropdown menu for data source transformations.](/tableau/next/en-us/online/en-us/Img/cmt-datasource-mapping-options.png) - **Changes to Users:** Includes domain, user, and group name changes in the destination. 4. When you are ready, click **Run Migration** to end the Planning phase and prepare to run your plan. 5. **To schedule** this to run regularly, you can [script this as a job](https://help.tableau.com/v0.0/online/en-us/cmt-scripting_migration_example.htm) using the Content Migration Tool Runner and schedule it. For more information on using the Content Migration Tool Runner, see [Using the Tableau Content Migration Tool Console Runner](https://help.tableau.com/v0.0/online/en-us/cmt-deployment_console_runner.htm). ## Tailoring content for customers When working in a consulting scenario, you can customize content for each of your customers using the Content Migration Tool. Each workbook functions as a template for your migration plan, allowing you to apply styling (text, images, etc.) and replace data sources for specific customers. In this example, we describe a migration between projects; an internal project where you store templates, and an external project you share with customers. **Use the following steps to customize content for your customers:** 1. **Create a plan** and select the site to use as your source. Choose the same Tableau site as your destination. For more information, see Create a Plan in [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm#step-1-start) topic. When migrating workbooks between two projects on the same site, your sign-in credentials for the source and destination may be similar or identical. In this scenario, we recommend using personal access tokens for a more reusable connection. For more information, see [Personal Access Tokens](https://help.tableau.com/v0.0/online/en-us/security_personal_access_tokens.htm). 2. **Select the internal project** that contains the template content you want to migrate. You can select entire projects, specific workbooks and data sources, and user permissions. For more information, see Planning in the [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm#step-1-start). If you need to make any **changes or transformations** to the content during this migration, you can configure that in the plan as well. This is referred to as **Mapping**. 3. Select Change Project from the Add Mapping menu to add a project mapping. Select your internal project as the source and production project as the destination, or click Add New to create a new project. 4. **In the Workbooks** step of the Migration Plan, use workbook mappings and transformations to customize your content. Below are two examples of frequently used transformations. For a full list of workbook transformations, see [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm). - To personalize content, you can use the Replace Image and Replace Text transformations to update the workbook with a customer's company name and logo. - When it comes to data sources, you can use the Replace Table/Schema Name or Set Custom SQL transformations to modify content for your customer. 5. **Verify and run** the plan. When you are ready, click Run Migration to end the Planning phase and prepare to run your plan. ## Environment migration You can use the Content Migration Tool to migrate content between Tableau Cloud and Tableau Server environments with a valid Advanced Management license. Use the following steps to migrate content between Tableau deployments: 1. **Create a plan** and **select the site** you want to migrate from as your source. For more information, see Create a Plan in [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm#step-1-start) topic. 2. **Select the content** you want to migrate from your source site. You can select entire projects, specific workbooks and data sources, and user permissions. 3. **Create user permissions mappings** to customize and secure content. For more information, see [Migration Plans: Permissions and Ownership](https://help.tableau.com/v0.0/online/en-us/cmt-plan_users.htm). ![A menu with options for planning, mapping, and running a migration, with user mapping highlighted.](/tableau/next/en-us/online/en-us/Img/cmt-user-mapping-options.png) 4. **Verify and run** the plan. When you are ready, click Run Migration to end the Planning phase and prepare to run your plan. > [!TIP] > > **Tips** > \- Before you perform an environment migration, make sure you understand the [Migration Limitations](https://help.tableau.com/v0.0/online/en-us/cmt-migration_limitations.htm) when using the Content Migration Tool. > \- You can migrate your content in stages, test and validate content iteratively before final migration is complete. > \- Content Migration Tool migration does not handle embedded credentials, subscriptions, and custom views. These will have to be migrated manually. ## External content sharing You can use the Content Migration Tool to share internal content with external collaborators, without allowing access to your project. This keeps your data secure and allows you to publish only select workbooks and data sources. Once content has been shared, collaborators sign in to their Tableau Cloud site to view and make changes, without affecting content stored on your internal project. Before you continue, make sure the content you are sharing is compatible between the internal and external projects. **Use the following steps to share content externally:** 1. **Prepare internal content**. As a best practice, we recommend separating content on the internal project, with locked permissions and strict governance rules. Workbooks and data sources should be clearly labeled to indicate the content is for external use. For more information, see [Use Projects to Manage Content Access](https://help.tableau.com/v0.0/online/en-us/projects.htm). **Note:** Content shared with external projects must use data extracts unless the data source is publicly accessible. For information about creating extracts and replacing data sources, see [Extract Your Data](https://help.tableau.com/current/pro/desktop/en-us/extracting_data.htm) and [Replace Data Sources](https://help.tableau.com/current/pro/desktop/en-us/connect_basic_replace.htm) in Tableau Desktop help. If you have implemented row level security, those data sources must be updated to reflect user filters and other details for the external project. For more information about row level security, see [Restrict Access at the Data Row Level](https://help.tableau.com/current/pro/desktop/en-us/publish_userfilters.htm) in Tableau Desktop help. 2. **Create a plan** and select the site to use as your source. Choose the same Tableau site as your destination. For more information, see Create a Plan in [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm#step-1-start) topic. When migrating workbooks between two projects on the same site, your sign-in credentials for the source and destination may be similar or identical. In this scenario, we recommend using personal access tokens for a more reusable connection. For more information, see [Personal Access Tokens](https://help.tableau.com/v0.0/online/en-us/security_personal_access_tokens.htm). 3. **Select the internal project** that contains the template content you want to migrate. You can select entire projects, specific workbooks and data sources, and user permissions. For more information, see Planning in the [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm#step-1-start). If you need to make any **changes or transformations** to the content during this migration, you can configure that in the plan as well. This is referred to as **Mapping**. 4. Select Change Project from the Add Mapping menu to add a project mapping. Select your internal project as the source and external project as the destination, or click Add New to create a new project. 5. **Verify and run** the plan. When you are ready, click Run Migration to end the Planning phase and prepare to run your plan. ## Validating database migrations This use case is when you intend to validate content after a migration of the underlying databases. One example of database migration is moving from SQL Server to Snowflake. CMT can help you validate the content built from both data sources is the same before you finalize your migration, but it cannot perform the actual database migration. Use the following steps to validate database migrations: 1. **Create a plan** and select the site to use as your source. Choose the same Tableau site as your destination. For more information, see Create a Plan in [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm#step-1-start) topic. 2. **Select the content** you want to change the data source or database connections. 3. **Configure the migration** to copy your content to a new project. Let's call the **source** project as **Project A**, and the new or the **destination** project as **Project B**. - Changes to workbooks: Create a workbook mapping to change Project A to Project B. For a full list of workbook transformations, see [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm). - Changes to data sources: Create a data source mapping to change the Project A to Project B. For a full list of data source transformations, see [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm). 4. **Verify and run** the plan. When you are ready, click **Run Migration** to end the Planning phase and prepare to run your plan. 5. **Update the content** in **Project B** with the new database connections or replace the data sources. This needs to be done manually by authoring. 6. **Test each workbook** in **Project A** with the copy in **Project B** and review for any inconsistencies in the data due to the change in data source. 7. Once you have confirmed everything is working as expected, **overwrite the content** in Project A with the updated content in Project B. **Note:** If the content already exists in the destination project and you do not select the Overwrite Newer Workbooks and Overwrite Newer Data Sources publish options, the content will not be copied to the destination project. ## Maintenance tasks You can use the Content Migration Tool to perform a variety of maintenance tasks. ### Tagging stale content Using the Content Migration Tool, you can manage archiving stale content. For example, you can build a plan that runs on a regular schedule that can automatically pick up content tagged as Stale Content and move it to an Archive project. After a certain amount of time, the content in this project can be purged from the system. For more information see, [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm). ### Restoring content You can use the Content Migration Tool to restore content removed (accidentally or purposefully) from a project with content from a backup project. Use the following steps to restore content from a backup project: 1. **Create a plan** and select the site to use as your source. Choose the same Tableau site as your destination. For more information, see Create a Plan in [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm#step-1-start) topic. 2. **Select the content** you want to restore from the backup project. 3. **Configure the migration** to restore content from your backup project. Let's call the backup project **Project A** and the project you want to restore to **Project B**. - Changes to workbooks: Create a workbook mapping to change Project A to Project B. For a full list of transformations, see [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm). - Changes to data sources: Create a data source mapping to change Project A to Project B. For a full list of data source transformations, see [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm). 4. **Verify and run** the plan. When you are ready, click Run Migration to end the Planning phase and prepare to run your plan. 5. **Review the content** on the production site. ### Partial backup Once you have a backup project, you can use the Content Migration Tool to transfer new content from production to the backup project. **Notes:** \- Before you perform a partial backup, make sure you understand the [Migration Limitations](https://help.tableau.com/v0.0/online/en-us/cmt-migration_limitations.htm) when using the Content Migration Tool. \- The Content Migration Tool shouldn't be used to backup your entire site. We recommend prioritizing the content you need most. Use the following steps to perform a partial backup of your content: 1. **Create a plan** and select the site to use as your source. Choose the same Tableau site as your destination. For more information, see Create a Plan in [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm#step-1-start) topic. 2. **Select the content** you want to backup from the production project. You can select entire projects, specific workbooks and data sources, and user permissions. To migrate only new content, make sure the publish options Overwrite Newer Workbooks and Overwrite Newer Data Sources are not selected. For more information, see [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm). 3. **Configure the migration** to copy content to your backup project. Let's call the source project **Project A** and the backup project **Project B**. - Changes to workbooks: Create a workbook mapping to change Project A to Project B. For a full list of transformations, see [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm). - Changes to data sources: Create a data source mapping to change Project A to Project B. For a full list of data source transformations, see [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm). 4. **Verify and run** the plan. When you are ready, click Run Migration to end the Planning phase and prepare to run your plan. 5. **To schedule** this to run on a regular basis, you can script this as a job using the Content Migration Tool Runner and schedule it. For more information on using the Content Migration Tool Runner, see [Using the Tableau Content Migration Tool Console Runner](https://help.tableau.com/v0.0/online/en-us/cmt-deployment_console_runner.htm). [Skip to main content](#main-content) # Tableau Mobile App Security Settings Adjust Tableau Cloud security policies for the Tableau Mobile app. These policies help keep your data secure by checking to see if mobile devices are compromised, and by limiting certain interactions with the Tableau Mobile app. The policies apply to only the standard version of Tableau Mobile, not the MAM versions of the app. If you have deployed an MAM app, use the specific to Tableau Mobile, in addition to your MAM system’s settings, to secure the app. ## Security settings Configure security settings for Tableau Mobile either on the site settings page for Tableau Cloud or using the REST API. For more information about the REST API, see [Mobile Settings Reference](https://help.tableau.com/current/api/rest_api/en-us/REST/rest_api_ref_mobile_settings.htm) in the Tableau REST API Help. To access the site settings page: 1. Sign into your Tableau Cloud site as administrator. 2. From the navigation pane, select Settings. 3. Select the Mobile tab. Starting in December 2022 settings related to mobile device security are available. These settings include detecting the following conditions: - Jailbreak Detection This setting is enabled by default at the Critical level and detects whether the app is running on a device that has been jailbroken or rooted. - Malware Detection (Android devices only) This setting is enabled by default at the Critical level and detects whether the device has malware on it. > [!IMPORTANT] > > In September 2025, Tableau Mobile retired support for the malware detection setting. The malware detection setting was removed from the Tableau Cloud settings page in September 2025 and from the Tableau Server settings page in Tableau Server version 2025.2.3. Any configuration of the malware detection setting on previous versions of Tableau Server has no effect on the Tableau Mobile app. - Maximum Days Offline Without a Policy Refresh This setting is enabled by default at the Critical level with a default maximum of 14 days. It determines if the app can be used on a device that has been offline (and thus without a policy refresh) longer than the configured maximum. - Prevent Debugging This setting is on by default and cannot be disabled. It detects whether the device has a debugger attached to it. - Screen Sharing and Screenshots (Android devices only) This setting is enabled by default and determines whether a Tableau Mobile app user can share screenshots or use screen sharing with the app. You can change the severity level for the Jailbreak Detection setting: - **Warn**: Enforce the policy and if it fails, show a dismissible blocking message. - **Error**: Enforce the policy and if it fails, show a blocking message until the issue is resolved. - **Critical**: Enforce the policy and if it fails, show a blocking message and the app decides how to handle the logout/clear session through the providers. This is the default. [Skip to main content](#main-content) # Tableau Prep Conductor Tableau Prep Conductor enables you to leverage the scheduling and tracking functionality available in Tableau Cloud to run your flows automatically to update the flow output. Tableau Prep Conductor is part of Data Management and must be enabled to schedule your flows to run. **Note**: The Data Management is only required if you plan to run flows on a schedule or set up email notifications. You do not need the Data Management license to publish flows and manually run them on the web. As a Creator, you can also create and edit flows directly on your server. For more information authoring flows on the web, see [Tableau Prep on the Web](https://help.tableau.com/v0.0/online/en-us/prep_web_auth.htm). Flows created in Tableau Prep Builder must be published to Tableau Cloud before they can be scheduled to run. Publishing flows is similar to publishing data sources and workbooks. You can package files with the flow or specify a direct connection to data sources to update the flow input as data changes. If your flow connects to databases, specify the authentication type and set credentials to access the data. You can also publish a flow to share it with others or to continue editing it on the web. For example, publish an incomplete flow to Tableau Cloud and then open the flow on the web in Edit mode to continue working on it. You could also create a flow with only Input steps (that are properly configured) and share it with co-workers who can then download the flow to their computers and create and publish their own flows. For flows to run they must include output steps and have no errors or incompatible features. For more information about publishing a flow, see [Publish a Flow to Tableau Server or Tableau Cloud](https://help.tableau.com/current/prep/en-us/prep_conductor_publish_flow.htm). For more information about incompatibility, see [Version Compatibility with Tableau Prep](https://help.tableau.com/current/prep/en-us/prep_conductor_compatibility.htm). The following table shows the flow management features that are available with and without the Data Management and Tableau Prep Conductor enabled.

Data Management with Tableau Prep Conductor enabled

No Data Management

View and monitor the details about your flow, including recent activity in the Content pages.
Edit your flow (starting in version 2020.4).
View the results of the flow runs and any errors in the Run History tab.
Use Administrative Views to monitor server and site activity including a new view that tracks flow performance history.
Run flows using REST API
View detailed alerts for failed flow runs.
Set up email notification alerts to send emails to flow owners notifying them when the flow failed to run and why.

For more information about setting up alerts, see Monitor Flow Health and Performance.

View the details about your flow, including recent activity in the Content pages.
Edit your flow (starting in version 2020.4).
View and edit your connections on the Connections tab.

## Enabling Tableau Prep Conductor on Tableau Cloud After you purchase and license Data Management, you must enable Prep Conductor on Tableau Cloud. For more information, see [](https://help.tableau.com/current/online/en-us/prep_conductor_configure_online)[Enable Tableau Prep Conductor on your Tableau Cloud Site](https://help.tableau.com/v0.0/online/en-us/prep_conductor_configure_online.htm) and [License Data Management](https://help.tableau.com/v0.0/online/en-us/dm_license.htm) ## Other articles in this section [Skip to main content](#main-content) # Tableau Prep on the Web _Internet Explorer 11 on Windows and compatibility mode for Internet Explorer is not supported._ Starting in version 2020.4 ,Tableau Prep supports web authoring for flows. Now you can create flows to clean and prepare your data using Tableau Prep Builder, Tableau Server, or Tableau Cloud. You can also manually run flows on the web and the Data Management is not required. While most of the same Tableau Prep Builder functionality is also supported on the web, there are a few differences when creating and working with your flows. > [!IMPORTANT] > > To create and edit flows on the web you must have a Creator license. Data Management is only required if you want to run your flows on a schedule using Tableau Prep Conductor or via API. For more information about configuring and using Tableau Prep Conductor, see Tableau Prep Conductor in the [Tableau Server](https://help.tableau.com/current/server/en-us/prep_publishserver_overview.htm) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/prep_conductor_online_intro.htm) help. ## Installation and Deployment To enable users to create and edit flows on the web, you'll need to configure several settings on your server. For more information about each of these settings, see [Create and Interact with Flows on the Web](https://help.tableau.com/current/server/en-us/web_author_flows.htm). - **Web Authoring**: Enabled by default, this option controls whether users can create and edit flows on Tableau Server or Tableau Cloud. - **Run Now**: Controls whether users or only administrators can run flows manually using the Run Now option. The Data Management isn't required to run flows manually on the web. - **Tableau Prep Conductor**: If Data Management is licensed, enable this option to let users schedule and track flows. - **Tableau Prep Extensions** (version 2021.2.0 and later): Controls whether users can connect to Einstein Discovery to apply and run predictive models against data in their flow. - **Autosave**: Enabled by default, this feature automatically saves a user's flow work every few seconds. ### Sample data and processing limits To maintain performance while working with flows on the web, limits are applied to the amount of data you can include in a flow. The following limits apply: - When connecting to files, the maximum file size is 1GB. - The data sampling option to include all data is not available. The default sample data limit is 1 million rows. The Tableau Server Administrator can set the data sample limit using TSM. For more information, see [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm#maestroappsettingssamplingmaxrowlimit). In Tableau Cloud, this limit is fixed and cannot be set by the administrator. - In Tableau Cloud, the number of flow runs you can perform in a day is limited by the site administrator. For more information, see [Tableau Cloud Site Capacity](https://help.tableau.com/current/online/en-us/to_site_capacity.htm). For more information about setting your data sample, see [Set your data sample size](https://help.tableau.com/current/prep/en-us/prep_configure_dastaset.htm#set-your-data-sample-size) in the Tableau Prep help. Need help debugging a slow flow? Try turning on Enable Query Logging from the Help\>Settings and Performance menu. For more information, see [Enable Query Logging](https://help.tableau.com/current/prep/en-us/prep_troubleshoot.htm#enable-query-logging). ## Available features on the web When you create and edit flows on the web you may notice a few differences in navigation and the availability of certain features. While most features are available across all platforms, some features are limited or not yet supported in Tableau Server or Tableau Cloud. The following table identifies features where differences might apply.

Feature area	Exceptions	Tableau Prep Builder	Tableau Server	Tableau Cloud
Connect to Data	Some connectors may not be supported on the web. Open the Connect pane on your server to see supported connectors.
Build Tableau Prep flows with Tableau Agent	Starting in version 2025.2, supported in Tableau Cloud (requires Tableau+), and Tableau Prep Builder when connected to Tableau Cloud with Tableau Agent turned on. Starting in version 2025.3, supported in Tableau Server and Tableau Prep Builder when connected to Tableau Server with Tableau Agent turned on. For more information see Turn On AI in Your Tableau Cloud Site and Turn On AI in Your Tableau Server Site.
Build and Organize your Flow
Set your data sample size	In Tableau Server the data sample size is subject to limits set by your administrator using a TSM command. In Tableau Cloud, this limit is fixed to 1,048,576 rows and cannot be changed by the administrator.
Union files and database tables in the input step	Input unions can't be edited or created in Tableau Server or Tableau Cloud. Only in Tableau Prep Builder.
Clean and Shape Data
Copy data grid values	Available in Tableau Prep Builder and Tableau Server starting in version 2022.3 and Tableau Cloud starting in 2022.2 (August)
Aggregate, Join, or Union Data
Use R and Python Scripts in your Flow	Script steps can't be added when creating or editing a flow in Tableau Cloud. This is currently supported only in Tableau Prep builder and Tableau Server.
Create reusable flow steps
Automatically save your flows on the web		Not Applicable
Automatic file recovery			Not Applicable	Not Applicable
Enable Query Logging
View flow output in Tableau Desktop
Create an extract to a file
Create an extract to a Microsoft Excel worksheet
Connect to a Custom SQL Query
Create a published data source
Save flow output to external databases
Add Einstein Discovery Predictions to your Flow

### Autosave and working with drafts When you create or edit flows on the server, your work is automatically saved as a draft every few seconds so that in the event of a crash, or when closing a tab by accident, you don't lose your work. Drafts are saved to the server and project you are signed into. You can't save or publish a draft to another server, but you can save the flow to another project on that server using the File > Publish As menu option. ![A data preparation flow with sample data, field names, and field values.](/tableau/next/en-us/online/en-us/Img/prep_save_draft1.png) Draft content can only be seen by you until you publish it. If you publish changes and need to revert them, you can use the Revision History dialog to view and revert to a previously published version. For more information about saving flows on the web, see [Automatically save your flows on the web](https://help.tableau.com/current/prep/en-us/prep_save_share.htm#automatically-save-your-flows-on-the-web). ## Publishing flows on the web Whether you create a flow from scratch on the web or edit an existing flow, before you can run the flow you'll need to publish it. - You can only publish draft flows to the same server you are signed into. - You can publish a draft to a different project using the File menu and selecting Publish As. - You can embed credentials for your flow's database connections to enable the flow to run without having to manually enter the credentials when the flow runs. If you open the flow to edit it, you'll need to re-enter your credentials. ### Embed credentials Embedding credentials only applies to running flows on your server. Starting in Tableau Cloud version 2025.2, flow owners can edit their flow in web authoring without having to re-authenticate to all of their database connections if those connections are embedded in the flow or saved to the user profile. If using Tableau Server, you will manually need to enter your credentials when editing a flow connected to a database. Embedding credentials can only be set at the flow level and not at the server or site level. Do one of the following: - From the top menu, select File > Connection Credentials > Embed in Published Flow. ![The File menu showing the Connection Credentials sub menu, Embed in Published Flow to embed your data connection credentials in a flow when it is published.](/tableau/next/en-us/online/en-us/Img/prep_embed_credentials.png) - When publishing a flow, select the Embed credentials check box. This option shows when you select Publish As to publish the flow to a new project for the first time or when you are editing a flow that was last published by someone else. ![The Publish Flow As dialog with fields to name and publish a flow, with options for project and embedding credentials.](/tableau/next/en-us/online/en-us/Img/prep_embed_credentials_prompt.png) ### Publish a flow When you publish your flow, it becomes the current version of the flow and can be run and seen by others who have access to your project. Flows that are never published or flow changes that you make to a draft can only be seen by you until you publish the flow. For more information about flow statuses, see [Automatically save your flows on the web](https://help.tableau.com/current/prep/en-us/prep_save_share.htm#automatically-save-your-flows-on-the-web). To publish your flow, do one of the following: - From the top menu, select File > Publish or File > Publish As ![The File menu on the web highlighting the Publish option to publish a flow.](/tableau/next/en-us/online/en-us/Img/prep_pwa_publish_menu.png) - From the top bar, click the Publish button or click the drop arrow to select Publish As. ![The top bar of a Tableau Prep flow on the web showing the Publish and Publish As buttons.](/tableau/next/en-us/online/en-us/Img/prep_pwa_publish.png) ### Who can do this - Server Administrator, Site Administrator Creator, and Creator allow full connecting and publishing access. - Creator can perform web authoring tasks. [Skip to main content](#main-content) # Tableau Pulse Release Notes Learn about what's new in recent Tableau Pulse releases. For general information about Tableau Pulse, see [About Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_about.htm). The release notes on this page are specific to Tableau Pulse. For other features on Tableau Cloud, see [Tableau Cloud Release Notes](https://help.tableau.com/v0.0/online/en-us/whatsnew_online.htm). ## Release notes ### Added October 23, 2026 #### Ask Tableau Agent in Pulse about any date in your data (Tableau+ or Try AI required) Whether you ask about three days ago or three years ago, Tableau Agent in Pulse filters the data to answer your question without the need for a custom calendar or comparison. You can explore any date that exists in your data source and any comparison date. Previously, you were limited to asking about the period-to-date, complete-period, and rolling-window time periods that are available as metric filters. Tableau Agent in Pulse uses pre-computed insights to answer your questions about these dates, so you can trust that the insights are rooted in the same statistical analysis that underpins other Tableau Pulse insights. However, Tableau Agent in Pulse links to a metric source for an insight only if a metric can be generated for that time period, which is possible if the time period aligns with the available period-to-date, complete-period, or rolling-window filters. To learn how to access Tableau Agent in Pulse, see [Ask questions with Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm#quick-query). ![Tableau Agent in Pulse comparing market share for August and September to June and July](/tableau/next/en-us/online/en-us/Img/pulse_agent_specific_time_period.png) ### Added October 8, 2026 #### Add links to the dimension members for a metric Help metric viewers get more information or take action by adding links to the breakdown and insight bar charts for metrics. You add links to the dimensions displayed on these charts as part of the Insights step when you create or edit a metric definition. The links that you define can include dimensions as variables to create dynamic links specific to individual dimension members. For example, if you have unique workflows for different product territories, you can insert a variable to send metric viewers to the correct workflow for each territory. For more information, see [Add dimension links](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#dimension-links). When you hover over a bar on a chart, you can see whether that dimension member has any associated links. Click on the bar to access the links. If a dimension member has no links, clicking on the bar takes you to a metric filtered to that dimension member. If a dimension member does have links, an option appears above the links to go to the filtered metric. ![A link to CSAT Feedback on the Burger member for the Menu Category dimension](/tableau/next/en-us/online/en-us/Img/pulse_insight_link.png) #### Get the full picture of your metrics in Slack You don't need to leave Slack to investigate and collaborate with metrics. Now, when you share a metric link in Slack, that link unfurls to show the complete metric, including top insights and any alerts. Click on the metric to open more details and the conversation history. On the Conversations tab, you see all of the public threads where the metric link has been shared, keeping you up to date and making discussions about the data transparent for everyone in your organization. For more information, see [Share metrics in Slack](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#slack-share). ![The metric Market Share unfurled in Slack with the details pane open to show the filters, value, comparison, status, alerts, and insights](/tableau/next/en-us/online/en-us/Img/pulse_slack_unfurling.png) ### Added August 26, 2026 #### Receive metric digests and alerts in Microsoft Teams Tableau Pulse helps you monitor your data in your flow of work. Now, you can get important updates about your metrics sent to you in Microsoft Teams. Tableau Pulse digests and alerts appear in your messages, so you don't need to open the app to see how your metrics are performing. To learn about the Tableau app for Microsoft Teams, see [Access Tableau Content in Microsoft 365](https://help.tableau.com/v0.0/online/en-us/teams_explore.htm). ![Tableau Pulse digest sent as a Microsoft Teams message with 3 sales metrics](/tableau/next/en-us/online/en-us/Img/pulse_teams_digest.png) To receive digests and alerts in Microsoft Teams, you must use the Tableau app at least once and follow at least one metric. These digests are delivered according to the preferences you have set on the Tableau Pulse website. If you want to receive digests at a different frequency, receive only your favorite metrics in digests, or turn off alerts for specific metrics, select Manage Digest to go to the Tableau Pulse website and update your preferences. For more information, see [Manage your Tableau Pulse digest](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#manage-digest) and [Turn off alerts for a metric](https://help.tableau.com/v0.0/online/en-us/pulse_alerts.htm#turn-off). #### Organize metrics with tags You can now add up to 10 tags to a metric definition when you set up the core definition. To learn how, see [Configure the core definition](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#create). The tags that you add appear on the definition and on metrics based on that definition. With these tags, you can sort metrics and filter metric definitions. To sort your metrics, on the Following tab on the Tableau Pulse home page, select the Sort by menu, then select Tags. ![Metrics on the Tableau Pulse home page sorted by the tag Sales Leaders](/tableau/next/en-us/online/en-us/Img/pulse_sort_tags.png) Tags also appear as filters on the Browse Metrics tab on the Tableau Pulse home page. To filter metric definitions by tag, select one of the tags above the list of definitions. ![A list of metric definitions filtered by the tag Sales Leaders](/tableau/next/en-us/online/en-us/Img/pulse_browse_tags.png) #### Ask Tableau Agent in Pulse about top or bottom dimension members (Tableau+ or Try AI required) Want to learn which products are selling the best or which accounts are in trouble? Ask Tableau Agent in Pulse about the top or bottom contributors, detractors, or drivers for a dimension. If there are goals or thresholds that can be broken down for that dimension, you can ask how the dimension members are performing relative to the goal or threshold. By default, Tableau Agent in Pulse reports the top or bottom 7 dimension members if you don’t specify the number. You can learn about up to 50 dimension members by specifying the number in your question. To learn how to access Tableau Agent in Pulse, see [Ask questions with Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm#quick-query). ![A bar chart showing the top 20 sales reps by market share](/tableau/next/en-us/online/en-us/Img/pulse_discover_top_n.png) #### Start a conversation with Tableau Agent in Pulse from an email digest (Tableau+ or Try AI required) Investigate the metrics in your email digest by selecting the questions that appear next to metric group names. These questions open Tableau Agent in Pulse, where you can continue the conversation to uncover additional insights about that group of metrics. For these questions to appear in your email digest, you must have your metrics sorted by data source or metric definition. ![An email digest with the question What's driving these changes? Ask Tableau Agent in Pulse.](/tableau/next/en-us/online/en-us/Img/tableau_email_digest_hook.png) ### Added July 2, 2026 #### See your metrics in dark mode Tableau Pulse now uses the theme that you have set for Tableau Cloud. You can set your theme on your Tableau Cloud account settings page. 1. To set your theme, go to the Tableau Cloud home page. If you're viewing Tableau Pulse, to navigate back to Tableau Cloud, select the arrow icon next to the Tableau Pulse title in the header. 2. Select your profile icon in the upper-right corner. 3. Select My Account Settings. 4. Under Accessibility, for the Theme, select Dark. 5. Select Save Changes. ![The Tableau Pulse home page showing metrics in dark mode](/tableau/next/en-us/online/en-us/Img/pulse_dark_mode.png) #### Get improved answers with an upgraded Tableau Agent in Pulse (enhanced Q&A) Tableau Agent in Pulse (formerly known as enhanced Q&A or Discover) is now powered by GPT-5.2. This upgraded large language model allows Tableau Agent in Pulse to handle more complex data with greater accuracy when answering your questions. For more information about Tableau Agent in Pulse, see [Ask Questions and Discover Insights in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm). The GPT-5.2 model was selected because it’s the best fit for providing reliable and trustworthy answers for Tableau Agent in Pulse. Note that this model doesn’t analyze your data. Instead, it draws upon pre-calculated insights that are rooted in statistical analysis done by Tableau to answer questions about your metrics. #### Find out who edited a metric definition The new Last Modified By label shows the user who most recently edited a metric definition. This label appears on the Browse Metrics tab on the home page, on the page that lists metrics based on a definition, and in the metadata information for a metric. ![Last modified column on list of metric definitions](/tableau/next/en-us/online/en-us/Img/pulse_last_modified_browse.png) ![Last modified listing on metric details metadata](/tableau/next/en-us/online/en-us/Img/pulse_last_modified_details.png) ### Added June 18, 2026 #### Try Tableau Agent in Pulse (enhanced Q&A) for free on your existing Tableau site If you’re a Tableau site administrator, you can now activate a trial of Tableau Agent in Pulse (enhanced Q&A) with the Try AI site setting. Try AI is the only way to test AI capabilities on an existing Tableau site. Starting the trial is as simple as activating the setting on Tableau Cloud, with no Salesforce org set up required. The trial runs for 60 days, and you can limit access to Tableau Agent in Pulse (enhanced Q&A) to specific user groups or make it available to all users on a site. To learn more, see [Try Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/tableau_gai_trial.htm). #### Limit access to Tableau Agent in Pulse (enhanced Q&A) As a Tableau site administrator, when you turn on Tableau Agent in Pulse (enhanced Q&A), you can limit access to specific user groups. This setting makes it easy for a subset of users to explore Tableau Agent in Pulse before you make it accessible to all users on a site. To learn how to adjust the site settings, see [Turn on Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-enhancedQA-discover). **Note:** Enhanced Q&A (Discover) has been renamed to Tableau Agent in Pulse. The functionality remains the same. Only the name has changed. You'll see the name change in upcoming releases. ### Added June 4, 2026 #### Create point-in-time metrics to track snapshots of your data The new temporality setting on a metric definition has two options: over time and latest point in time. This temporality setting controls whether a metric value is cumulative over the entire period or a snapshot of the data on the latest date. To learn about how to configure the core metric definition, see [Define the metric value](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#Define). ![Temporality setting on the core metric definition](/tableau/next/en-us/online/en-us/Img/pulse_point_in_time_setting.png) When you set the temporality to the latest point in time, the metric value is the aggregate of the data on the latest date in the period. In the case where the points on the metric chart represent more than a single day, the value for each point on the chart is for the latest date in the period represented by the point. This setting is useful for data where a cumulative metric value for the entire time period doesn't make sense, such as inventory data. A “Latest Point in Time” badge appears on metrics of this type. ![Point in time badge on the metric details page](/tableau/next/en-us/online/en-us/Img/pulse_point_in_time_badge.png) Over time is the default temporality. The value for metrics with an over-time temporality is cumulative for the entire time period, and each point on a non-cumulative metric chart is the aggregate value for the period covered by that point. Prior to the introduction of the temporality setting, all metrics were of the over-time temporality unless you used the advanced editor to calculate a point-in-time metric. ### Added April 14, 2026 #### Monitor Pulse metrics on your home screen To keep a closer eye on your favorite Pulse metrics, add the Tableau widget to your home screen. For the widget to show Pulse metrics, you’ll need to add metrics as favorites and adjust app settings so that the widget can access your data. To learn how to configure settings and select metrics for the widget, see [Configure the Tableau widget to show metrics on your home screen](https://help.tableau.com/current/mobile/mobile-user/en-us/tableau_mobile_interact.htm#widget). ![Widget showing metrics for talk time and wait](/tableau/next/en-us/online/en-us/Img/pulse_mobile_widget.png) ### Added March 26, 2026 #### Filter Pulse metrics on dashboards The Pulse object lets you add metrics to dashboards alongside visualizations. You can now configure the Pulse object so that it responds when you select an input filter on the dashboard. For the Pulse object to respond to a filter, the filter must be a dimension from the same data source that the metric definition connects to, and that dimension must be an adjustable metric filter on the metric definition. For information about configuring the Pulse object and about how filters work with the Pulse object, see [Add metrics to a dashboard](https://help.tableau.com/v0.0/online/en-us/pulse_dashboard.htm#dashboard-object). ![Pulse dashboard object filter option](/tableau/next/en-us/online/en-us/Img/pulse_dashboard_object_filters.png) #### See Pulse metrics in dashboard subscription and export images If you receive a dashboard subscription that contains an image, or if you export an image of a dashboard, Pulse metrics are now included in the dashboard image. Note that PDF and PowerPoint exports of dashboards don’t yet support Pulse metrics. To learn about subscribing to a dashboard, see [Create a Subscription to a View or Workbook](https://help.tableau.com/v0.0/online/en-us/subscribe_user.htm). ![Pulse sales metrics in an email subscription image](/tableau/next/en-us/online/en-us/Img/pulse_dashboard_subscription.png) ### Added March 12, 2026 #### Get an overview of your metrics with streamlined email digests Tableau Pulse email digests have a new layout that helps you quickly catch up with your metrics. The compact design puts key information about more of your metrics on the screen. To make sure that you receive email digests, see [Manage your Tableau Pulse digest](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#manage-digest). ![A compact list of metrics in an email digest](/tableau/next/en-us/online/en-us/Img/pulse_digest_redesign.png) #### Understand enhanced Q&A insights with inline visualizations (Tableau+ license edition required) When enhanced Q&A answers your question, it provides an insight brief with citations for each insight source. That insight brief is now illustrated with an inline visualization from the most critical insight source. Previously, you needed to click on each citation to see the insight source. If there are multiple insight sources, you can still click on the citation numbers to see the other insight sources and their visualizations. For information about using enhanced Q&A, see [Explore groups of metrics with Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm#Explore). ![An inline bar chart supporting an insight about total revenue](/tableau/next/en-us/online/en-us/Img/pulse_inline_viz.png) ### Added February 6, 2026 #### Easily dig in to your data from your Tableau Pulse home page (Tableau+ license edition required) The new Discover with AI button on the Tableau Pulse home page provides you with quick access to the enhanced Q&A experience. Enhanced Q&A, also known as Discover, is an AI-powered conversational way to investigate your data. Ask a question using natural language, and enhanced Q&A will look across the metrics in a group to uncover insights. For the Analyze with AI button to appear on your home page, your metrics must be sorted by data source or definition. For more information about enhanced Q&A, see [Explore groups of metrics with Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm#Explore). ![Analyze with AI button above a group of metrics](/tableau/next/en-us/online/en-us/Img/pulse_discover_quick_query.png) ### Added January 29, 2026 #### Turn off alerts for a metric You receive an alert when a metric that you're following crosses into an unfavorable threshold range or has a new unfavorable trend. If you don't want to receive alerts for a specific metric, turn off alerts for that metric. To turn off alerts, select the actions (⋮ or ⋯) menu for that metric, then select Turn Off Alerts. ![Turn off alerts menu option for a metric](/tableau/next/en-us/online/en-us/Img/pulse_turn_off_alert.png) To see a list of the metrics that you’ve turned off alerts for, select your user icon in the upper-right corner of any Tableau Pulse page. Select Preferences, then select the Alerts tab. If you decide that you want to receive alerts again, click on a metric from this list to open it, select the actions menu, then select Turn On Alerts. ![List of metrics with alerts that are turned off](/tableau/next/en-us/online/en-us/Img/pulse_alert_preferences.png) #### Give your goal or threshold a custom name If the default label of “goal” or “threshold” doesn't represent your organization's data, you can enter a custom label to be shown to metric viewers. You can set a custom label for both data source goals and thresholds and manual goals and thresholds. For information about setting goals and thresholds, see [Configure data source goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#ds-goal) and [Set Manual Goals and Thresholds with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_goals.htm). ![Custom goal label option](/tableau/next/en-us/online/en-us/Img/pulse_custom_goal_label.png) This custom label appears on the goal or threshold progress indicator, the metric chart, and in insights. For example, a goal with the custom label “target” states the amount of the target met. ![Custom label showing amount of target met goal indicator](/tableau/next/en-us/online/en-us/Img/pulse_custom_goal_progress.png) #### Learn about correlated metrics with enhanced Q&A (Tableau+ license edition required) You can now ask enhanced Q&A about similarities between metrics. Enhanced Q&A provides insights on the strength and direction of the correlation and whether it’s positive or negative. To access enhanced Q&A, select the Ask button on a metric, then select an enhanced Q&A question. Or, from the Pulse home page, select one of the enhanced Q&A questions for a group of metrics. ![Correlated metric insight brief show relationship between COGS and material price per unit](/tableau/next/en-us/online/en-us/Img/pulse_discover_correlation.png) Enhanced Q&A looks for correlations only on metric definitions that have correlation candidates identified. For enhanced Q&A to explain a correlation, the correlation coefficient must be at least 0.7, and the correlation must occur within the specific time period that you ask about. For information about configuring correlation candidates, see [Configure insights](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#configure-insights). ### Added January 8, 2026 #### Monitor if a metric is on track to meet its goal (Tableau+ license edition required) For metrics that have a goal set, you can now see if the metric is expected to meet its goal by the end of the current period. The on track or off track status for a metric appears next to the goal progress, and the forecast line on the chart turns green or red to reflect this status. If you don't want this information to appear on a metric, turn off the pace to goal insight type on the metric definition. For more information, see [Configure insights](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#configure-insights). ![Pace to goal insight showing a goal on track for the quarter](/tableau/next/en-us/online/en-us/Img/pulse_pace_to_goal.png) #### Keep track of your favorite metrics If there are key metrics that you want to monitor, select the star icon to add them to your favorites. To add a metric as a favorite, you must be following it. ![Favorite star icon on a metric](/tableau/next/en-us/online/en-us/Img/pulse_favorite_metric.png) You can filter the metrics that appear on your Tableau Pulse homepage so that you see only favorites. You can also adjust your digest preferences to show only favorite metrics in email and Slack digests. Note that if you set your digests to show only favorites, you still receive alerts for any metrics that you follow. For information about setting your digest preferences, see [Manage your Tableau Pulse digest](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#manage-digest). ![Filter by all or favorites metric options](/tableau/next/en-us/online/en-us/Img/pulse_favorite_filter.png) ### Added December 18, 2025 #### Validate your custom calendar When you configure a custom calendar as part of a metric definition, Tableau Pulse validates the data to make sure that it’s in the correct format. If your custom calendar doesn’t pass this validation, you see an error message that helps you troubleshoot the calendar. The error displayed is the first error that Tableau Pulse encounters. To understand how Tableau Pulse validates the fields in your custom calendar, see [Requirements for custom calendars](https://help.tableau.com/v0.0/online/en-us/pulse_data_source_requirements.htm#ds-requirement-calendar). ![Custom calendar error message for month already in use](/tableau/next/en-us/online/en-us/Img/pulse_custom_calendar_validation.png) ### Added November 20, 2025 #### Receive mobile notifications for important changes to your metrics Tableau Mobile now sends you alerts as push notifications when it detects unfavorable changes to the metrics that you follow. These alerts include when a metric crosses into an unfavorable threshold range and when a new unfavorable trend is detected. Tap on an alert to learn more about these changes to your data. ![Mobile notification for unfavorable trend](/tableau/next/en-us/online/en-us/Img/pulse_mobile_push_notification.png) To receive push notifications, you must turn on notifications for the Tableau app on your device. You receive these notifications even if the Tableau Mobile app is closed, as long as you have notifications turned on. If you have an Android device, when you install the Tableau app, these notifications are turned off by default. ##### Turn on notifications on Android 1. On your Android device, navigate to Settings > Notifications > App notifications. 2. From the menu, select All apps. 3. Select Tableau. 4. Under notification categories, select Show unused categories. 5. Select Other. 6. Make sure that the Tableau Pulse toggle is on. ##### Turn on notifications on iOS 1. On your iOS device, navigate to Settings > Notifications. 2. Select Tableau. 3. Make sure that the Allow Notifications toggle is on. #### Get insights from enhanced Q&A about goals and thresholds (Tableau+ license edition required) If a metric has a goal or threshold, enhanced Q&A now has that context and provides you with insights about how the data is performing relative to the goal or threshold. To access enhanced Q&A, select the Ask button on a metric, then select an enhanced Q&A question. Or, from the Tableau Pulse home page, select one of the enhanced Q&A questions for a group of metrics. ![Insight about likelihood of meeting goal](/tableau/next/en-us/online/en-us/Img/pulse_discover_goal.png) #### Check goals and thresholds on your Tableau Pulse home page The metric cards shown on the Following tab of the home page now show goal and threshold information. At a glance, you can see how all of your metrics are performing both compared to the prior period and relative to goals or thresholds. ![Goal for the quarter displayed on metric card](/tableau/next/en-us/online/en-us/Img/pulse_home_card_goal.png) #### Go to the connected data source for a metric Metrics and metric definitions now link to the data source that they are connected to, letting you easily open that data source in Tableau Cloud. - On a metric definition, go to the core definition step, then select the data source name. ![Link to data source on metric definition](/tableau/next/en-us/online/en-us/Img/pulse_definition_data_source_link.png) - On a metric, select the info icon to see the metric metadata, then select the data source name. ![Link to data source on metric](/tableau/next/en-us/online/en-us/Img/pulse_metric_data_source_link.png) ### Added November 6, 2025 #### See a descriptive legend on charts The overview chart for a metric now shows a legend that labels each of the elements on the chart. The legend helps you understand which data on the chart is complete, which is still in progress, and which is a forecast, as well as any goals or thresholds. ![Chart legend showing completed and in progress values and forecast](/tableau/next/en-us/online/en-us/Img/pulse_legend.png) #### Filter data with user functions in advanced definitions When you create a metric definition using the advanced editor, you can now add user functions that filter the data for specific users or groups. These functions are a useful alternative if you don’t have row-level security on the data source that the metric definition is connected to. For more information about writing user functions, see [User Functions](https://help.tableau.com/current/pro/desktop/en-us/functions_functions_user.htm). ### Added October 23, 2025 #### Control the channels where users can receive digests As a Tableau Cloud administrator, you can now turn off the ability for users to receive Tableau Pulse digests and alerts via email and Slack. When a channel is turned off, a message appears informing users of this in their Tableau Pulse preferences. For more information, see [Configure digests](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#digest-time). ![Site setting for digest channels](/tableau/next/en-us/online/en-us/Img/pulse_channel_setting.png) #### Set the day when digests are generated As a Tableau Cloud administrator, you can now set the day of the week and the day of the month when weekly and monthly digests are generated. Tableau Pulse begins generating digests at the designated start time on these days. For more information, see [Configure digests](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#digest-time). ![Site setting for digest schedule](/tableau/next/en-us/online/en-us/Img/pulse_schedule_setting.png) ### Added October 3, 2025 #### Check the forecast for a metric The overview chart for a metric now shows a forecast of how the metric is expected to perform for the remainder of the period. Forecasts are available for sites with a Tableau+ license edition and appear only on metrics with period-to-date time ranges. If Tableau Pulse isn’t confident in a forecast, the forecast doesn’t appear on the overview chart, but you can still use the Ask button to see the forecast. If you don’t want a metric to show a forecast, turn off the forecast insight type on the metric definition. For more information about the forecast insight type, see [Insight types in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_insights_platform_insight_types.htm#InsightTypesList). ![Metric forecast for the end of the month](/tableau/next/en-us/online/en-us/Img/pulse_forecast.png) #### Clone an existing metric definition Get a head start on creating a metric definition by cloning an existing definition. When you clone a definition, all of the configuration from the original definition carries over except for the governance step. Cloning is particularly useful if you need to set up definitions for different measures from the same data source. To save a cloned definition, you must change one or more of the measure, aggregation, time dimension, or adjustable metric filters so that the cloned definition isn’t identical to the original definition. For more information, see [Clone a metric definition](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#clone). ![Clone definition button](/tableau/next/en-us/online/en-us/Img/pulse_clone_definition.png) #### Ask questions about rolling time periods with enhanced Q&A You can now ask questions about what has happened with your data in the last 7, 14, 30, 60, or 90 days. Enhanced Q&A will provide an answer that analyzes that precise period, using the same rolling date window filter that you can apply to metrics. To access enhanced Q&A, select the Ask button on a metric, then select an enhanced Q&A question. Or, from the Pulse home page, select one of the enhanced Q&A questions for a group of metrics. Enhanced Q&A requires a Tableau+ license edition. ![Enhanced Q and A results for last 14 days time period](/tableau/next/en-us/online/en-us/Img/pulse_discover_last_14_days.png) ### Added September 11, 2025 #### Set a date offset that dynamically adjusts to your data For metrics that cover a period-to-date time range, the value shown for a metric is for today’s date. If the data source for the metric doesn’t have data for today, then the metric value is null. Set a dynamic date offset on the metric definition so that the metric shows the value for a date in the past instead of null. With a dynamic offset, Tableau Pulse adjusts the time series for a metric to end with the most recent date that has data. For more information, see [Set a date offset](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#date-offset). ![Dynamic offset time setting](/tableau/next/en-us/online/en-us/Img/pulse_dynamic_offset.png) #### Easier to read Discover briefs Enhanced Q&A (Discover) now uses intelligent markdown formatting to generate easy-to-read insight briefs. AI-generated insight briefs are automatically structured with headings, bullet points, and summaries, making it easier for you to scan and understand your insights quickly. **Note:** Custom formatting controls are not currently supported for insight briefs in Discover. ![Discover insight brief](/tableau/next/en-us/online/en-us/Img/pulse_discover_formatted_briefs.png) ### Added August 28, 2025 #### Show more contributors on the breakdown chart Curious about how different dimension members are contributing to a metric? Select Show more to list more contributors on the breakdown chart. The breakdown chart shows 7 contributors to begin with, and 7 more are shown each time you select show more, up to 50 contributors total. ![Show more contributors button](/tableau/next/en-us/online/en-us/Img/pulse_show_more.png) #### Set a metric’s time range to a rolling time window A rolling window shows the most recent 7, 14, 30, 60, or 90 days of data. You can also select a window that shows the data for 1 year in months, and that window ends with the most recent complete month. The comparison period for these metrics follows the same rolling window. To adjust the time range, select the Filter option on a metric. When you set this filter, you create a new metric if one with those filters doesn’t already exist. Be sure to follow the filtered metric to keep track of it. Followers don’t carry over from the previous metric. ![Rolling time window options](/tableau/next/en-us/online/en-us/Img/pulse_rolling_window.gif) #### Use generative AI to ask questions when exploring a metric (Tableau+) For any metric, you can click Ask to ask questions using semantic search or go deep with generative AI. In the same interface, use Ask Q&A to find trusted insights quickly, or use Enhanced Q&A (Discover) for a more conversational, LLM-guided exploration in the same context. ![Genertive AI questions about a metric](/tableau/next/en-us/online/en-us/Img/pulse_insight_ask_discover.png) From any metric detail page in Tableau Pulse, under Discover Top Insights, click the Ask button. Enter a question in the first search bar to run semantic search on detected insights. From the search results, click a question with the sparkle icon to use enhanced Q&A with LLM-guided exploration. In the Discover page that opens, ask follow-up questions about the same metric or related metrics you follow, all in the same conversational flow. You can ask questions about metrics that share the same data source. Response from the LLM responses may vary based on available data and insight coverage. Available in Tableau+ only. #### Geo-aware LLM request routing now supported in Enhanced Q&A (Discover) experience and insight summaries Tableau Pulse Enhanced Q&A (Discover) now supports geo-aware LLM routing through the Einstein GPT Gateway using Azure Open AI. (Tableau+ or Einstein 1 is required.) LLM requests are routed to the nearest supported region based on your Salesforce org, which improves latency and supports data residency requirements. Discover requests are made using your Salesforce org ID, which allows masking and routing controls when the necessary entitlement is used. Insight summaries in Tableau Pulse, which use Tableau-managed org IDs, also support geo-aware LLM queries. No manual setup or region selection is required beyond the necessary entitlements. Masking can be controlled when tied to a paid entitlement. If your nearest region is unavailable or overloaded, traffic automatically falls back to the Azure OpenAI location in the US. Fallback from any Azure OpenAI region always routes to the US Azure OpenAI region, never to OpenAI directly. For more information, see [Geo-Aware LLM Request Routing on the Einstein Generative AI Platform](https://help.salesforce.com/s/articleView?id=ai.generative_ai_platform_geo_aware_routing.htm). The fallback setting can't be disabled. Only Tableau+ customers have audit log access to see when fallback occurs, and can get the fallback event data from audit logs. ### Added August 14, 2025 #### See how related metrics are similar or dissimilar with the Correlated Metric insight Correlated Metrics is a new insight type that can answer questions such as "How is Customer Satisfaction related to Wait Time?" Tableau Pulse can now show how a metric is similar or dissimilar to another metric that has been flagged as a candidate for consideration. ![Metric chart showing correlation](/tableau/next/en-us/online/en-us/Img/pulse_insight_correlated_metric.png) When editing a metric definition, you can choose up to five candidates for Tableau Pulse to consider for correlation to the metric. These candidates are metric definitions that you consider to be related to the metric and that are expected to move in similar or strongly dissimilar ways. ![Options to select correlation candidates](/tableau/next/en-us/online/en-us/Img/pulse_insight_correlated_metric_candidates.png) For more information on setting up Correlated Metrics, see [Configure insights](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#configure-insights). #### Catch up with Tableau Pulse insights and alerts in the Tableau App for Microsoft Teams More Tableau Pulse features are now available in the Tableau App. - Insight summary: Check the insight summary on the Tableau Pulse home to get an overview of important changes to your data. - Alerts: See alerts for unfavorable changes to the metrics that you follow. - Metric insights in your preferred language: The insights shown for individual metrics automatically reflect the language that is set for Microsoft Teams. Note that the insight summary uses the language that is set for the Tableau app, which is a separate setting from the Microsoft Teams language setting. ![Tableau Pulse in the Microsoft Teams app](/tableau/next/en-us/online/en-us/Img/pulse_teams_app.png) For information about the Tableau App for Microsoft Teams, see [Setup Guide: Tableau App for Microsoft Teams](https://github.com/tableau/tableau-app-msft-teams). ### Added August 7, 2025 #### Show goals or thresholds on the metric breakdown chart On the Breakdown tab for a metric, you can change the chart details to show goal or threshold data. This option appears only if there's a data source goal or threshold set on the definition for a metric. You can turn off this option by adjusting the Goal and Threshold Breakdown insight on the insight settings for a metric definition. For information about adjusting insights, see [Configure insights](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#configure-insights). For information about metric details, see [Explore metrics in detail, adjust the time range, or apply filters](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#explore-detail). ![Chart details options](/tableau/next/en-us/online/en-us/Img/pulse_chart_detail.png) #### Get off-cycle Slack alerts If you aren’t scheduled to receive a Slack digest on a day that Tableau Pulse identifies an alert, you now receive a Slack message with that alert. Tableau Pulse checks the metrics that you follow every 24 hours to see if they have crossed into an unfavorable threshold range or if there's a new unfavorable trend for the data. On days when you do receive a Slack digest, the alert appears at the top of the digest rather than as a separate message. For information about alerts, see [Get Tableau Pulse Alerts](https://help.tableau.com/v0.0/online/en-us/pulse_alerts.htm). ![Tableau Pulse alert in Slack](/tableau/next/en-us/online/en-us/Img/pulse_slack_alert.png) ### Added July 24, 2025 #### Get threshold alerts When a metric that you’re following crosses into an unfavorable threshold range, you get notified in email, Slack, and Tableau Mobile, and an alert appears on the Tableau Pulse site. For more information, see [Get Tableau Pulse Alerts](https://help.tableau.com/v0.0/online/en-us/pulse_alerts.htm). ![Threshold crossed alert](/tableau/next/en-us/online/en-us/Img/pulse_threshold_crossed_alert.png) #### Set an unfavorable threshold range Define whether a metric should stay above or below a threshold. You can set an unfavorable range for both data source thresholds and manual thresholds. When the aggregate value for a metric crosses into the unfavorable range, Tableau Pulse generates a threshold alert. For more information, see [Configure data source goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#ds-goal) and [Create a manual goal or threshold](https://help.tableau.com/v0.0/online/en-us/pulse_goals.htm#create-goal). ![Unfavorable threshold range setting](/tableau/next/en-us/online/en-us/Img/pulse_threshold_unfavorable_range.png) #### Search and sort metric definitions On the Browse Metrics tab, select the search icon to search the list of metric definitions. Select the Certified, Metric Definition, or Metrics column headers to sort by those columns. ![Search for metric definitions](/tableau/next/en-us/online/en-us/Img/pulse_search_definitions.png) ### Added July 10, 2025 #### Discover insights across multiple metrics with cross-metric analysis Enhanced Q&A (Discover) now supports cross-metric analysis, allowing you to compare metrics side-by-side and surface meaningful patterns. It can highlight shared contributors, detect when trends move together or in opposite directions, flag entities that are outliers across multiple metrics, and identify metrics that are jointly above or below expected ranges, all in a single, natural-language response. For more information, see [Ask Questions and Discover Insights in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm). ### Added June 5, 2025 #### Stay informed with off-cycle alert emails Tableau Pulse now sends an email if it identifies alerts on a day that you aren’t scheduled to receive a digest. Previously, alerts were sent only as part of digests. If your digest frequency was set to weekly or monthly, you didn’t get email notifications about alerts found on days without a digest. For more information about alerts, see [Get Tableau Pulse Alerts](https://help.tableau.com/v0.0/online/en-us/pulse_alerts.htm). ![Tableau Pulse alert email](/tableau/next/en-us/online/en-us/Img/pulse_alert_email.png) ### Added May 22, 2025 #### Set thresholds for metrics Measure how a metric is performing relative to a threshold value by setting a data source or manual threshold. Data source thresholds are dynamic values that you set on a metric definition. Manual thresholds are a single static value that you set on an individual metric. Anyone who views a metric sees the threshold value. For more information, see [Configure data source goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#ds-goal) and [Set Manual Goals and Thresholds with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_goals.htm). ![Threshold set on a metric](/tableau/next/en-us/online/en-us/Img/pulse_threshold.png) ### Added May 7, 2025 #### Set a custom calendar If the standard Gregorian calendar doesn't fit your organization's data, set a custom calendar. You now have the flexibility to configure calendars such as a 4-5-4 retail calendar. Tableau Pulse aggregates metric data for different time ranges and comparison periods based on the custom calendar. For more information, see [Set a custom calendar](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#custom-calendar). ![Custom calendar settings](/tableau/next/en-us/online/en-us/Img/pulse_custom_calendar.png) #### Ask questions based on dimension members in Enhanced Q&A (Discover) Let your users follow their curiosity freely—exploring different regions, segments, or time periods—all through natural language in Enhanced Q&A (Discover). Discover can now handle questions that filter metrics based on dimension values (region, product, segment) or compare dimension members (West versus East) to uncover meaningful patterns. For example, you could ask "Show sales for California" or "Compare APAC vs. EMEA" to automatically expand your exploration to the full set of compatible metrics. For more information, see [Ask Questions and Discover Insights in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm#top). ![The Discover page with a question about dimension members for scoping the context](/tableau/next/en-us/online/en-us/Img/pulse_discover_dimension_question.png) #### Ask questions and get responses in your preferred language with Enhanced Q&A (Discover) Enhanced Q&A (Discover) now supports multilingual questions and responses, aligned with Tableau Cloud supported languages. Suggested questions, follow-up questions, and insight briefs adapt to the site’s language setting. Discover detects your input language as you ask questions and it returns LLM responses in that language—even if it differs from the site or data language. Metric names and filters always remain in their original, authored language for clarity and consistency. For more information, see [Multilingual support for questions and responses in Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm#Multilin). ![Enhanced Q and A Discover page with insight brief and question in Spanish](/tableau/next/en-us/online/en-us/Img/pulse_discover_multilingual.png) ### Added April 24, 2025 #### Certify metric definitions Tell others that a metric definition is trusted and recommended by certifying it. A certified badge appears on metrics that are based on certified definitions. That badge helps users feel confident relying on those metrics to make business decisions. You certify a metric definition on the new governance step that is part of editing or creating definitions. The existing permission settings for metric definitions have also moved to the governance step. For more information, see [Configure governance](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#configure-governance). ![Certified definition toggle](/tableau/next/en-us/online/en-us/Img/pulse_certified_definition.png) ### Added April 10, 2025 #### Customize the metrics in your insights summary When you follow a metric, notable changes about that metric can appear in the insights summary at the top of your Tableau Pulse home page and in your Slack and email digests. You can now further customize these summaries by muting metrics. When you mute a metric, insights about that specific metric are removed from your summary without unfollowing the metric. For more information, see [Customize your home page and digests](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#Grouping). ### Added March 27, 2025 #### Set a custom comparison date for metrics For metrics filtered to Today or Yesterday, a custom comparison overrides the comparison to the prior day or the same day from a year ago. This comparison option allows you to compare data for events that don’t fall on the same date each year. For more information, see [Set a custom daily comparison](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#custom-daily). ![Custom daily comparison and reference date settings](/tableau/next/en-us/online/en-us/Img/pulse_custom_comparison.png) #### Choose the number of decimal places for metric values If your data needs to be formatted with a consistent number of decimal places, you can choose the precise number, from 0 to 5. By default, Tableau Pulse automatically determines the number of decimal places to show, with larger values showing fewer decimal places. For more information, see [Define metric options](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#options). ![Decimal place options 0 through 5](/tableau/next/en-us/online/en-us/Img/pulse_decimal_places.png) Added March 13, 2025 #### Discover more insights with enhanced Q&A (Tableau+) Enhanced Q&A (Discover) makes it easier to explore insights across groups of business-critical metrics, and then dig deeper on the Discover page. When metrics in Tableau Pulse are grouped by data source, definition, or time range, Discover uses statistical algorithms to examine grouped metrics and surface insights that are relevant, interesting, and worth investigating. ![The Discover page in Tableau Pulse with an insight brief, metric sources, and new question entered by a user](/tableau/next/en-us/online/en-us/Img/pulse_discover_intro.png) The enhanced Q&A experience provides intuitive key insights, relevant visualizations, source references, and suggested follow-up questions to help you dig deeper. Because it is powered by AI in Tableau, you can ask questions in your own words to get relevant, natural language answers about your data. Enhanced Q&A (Discover) is available as a Tableau+ premium feature in Tableau Pulse on both web and mobile. Enhanced Q&A (Discover) must be turned on in Tableau Cloud site settings, and requires a connection to a Salesforce org that has Einstein generative AI set up for the selected Salesforce org. For more information, see [Ask Questions and Discover Insights in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm) and [Turn on Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-enhancedQA-discover). #### Better semantic matches in any language for Ask Q&A Turning on this setting enhances semantic matching for any language when you use Ask Q&A. When this setting is on, questions and insights text are sent to OpenAI as part of semantic matching. All calls to OpenAI go through the [Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=sf.generative_ai_trust_layer.htm&type=5). For more information, see [Turn on better semantic matches for Ask Q&A in Tableau](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-better-semantic-match-ask) #### Get alerts for new unfavorable trends If Tableau Pulse detects a new unfavorable trend in the data for a metric that you follow, you receive an alert about that trend in your email and Slack digests. If you use Tableau Mobile, you also receive a notification on your mobile device. For more information, see [Get Tableau Pulse Alerts](https://help.tableau.com/v0.0/online/en-us/pulse_alerts.htm). ![Tableau Mobile Pulse alert for new unfavorable trend](/tableau/next/en-us/online/en-us/Img/pulse_mobile_alert.png) #### Control who can create metric definitions from a data source Data sources have a new Create Metric Definitions permission capability. With this capability, you can now separately control who can create metric definitions from a data source and who can view metrics that use that data source. For more information, see [Permissions for creating metric definitions](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#permissions-create-definition). ![Data source permission for Create Metric Definitions](/tableau/next/en-us/online/en-us/Img/pulse_data_source_permission.png) #### Adjust when Tableau Pulse starts generating digests Tableau site administrators can set the time at which Tableau Pulse starts generating email and Slack digests. That way, if your data refreshes at a specific time, the digests reflect the freshest data. For more information, see [Configure digests](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#digest-time). ![Site setting for Digest start time](/tableau/next/en-us/online/en-us/Img/pulse_digest_site_setting.png) #### Set the aggregation type for data source goals You can now choose how Tableau Pulse aggregates the data for a data source goal. Measures can be aggregated as a sum, average, median, maximum, or minimum, and dimensions can be aggregated as a count or distinct count to produce a measure. Previously, all data source goals were aggregated as a sum. Additionally, you can now set data source goals for metric definitions that use any aggregation. Previously, you could create data source goals only for metric definitions where the measure was aggregated as a sum or count. For more information, see [Configure data source goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#ds-goal). ![Data source goals aggregation selector](/tableau/next/en-us/online/en-us/Img/pulse_ds_goal_aggregation.png) #### Create an advanced data source goal The advanced editor lets you create data source goals using the familiar Tableau viz authoring environment. You can use the advanced editor to create goals based on calculated fields. For more information, see [Configure data source goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#ds-goal). ![Data source goal advanced goal option](/tableau/next/en-us/online/en-us/Img/pulse_ds_goal_advanced.png) Added in January 2025 #### Tableau Pulse data source goals When creating or editing a metric definition, you can set a goal that uses a field from your data source to specify the goal values. This goal appears on the metrics based on the definition and is summed based on a metric’s time range. For more information, see [Configure data source goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#ds-goal) and [Data source requirements for metric definitions](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#ds-requirement-goals). #### Tableau Pulse available in 14 languages Tableau Pulse now reflects the language and locale set by the user on Tableau Cloud and the language set for the device on Tableau Mobile. Tableau supports English (US), English (UK), French (France), French (Canada), German, Italian, Spanish, Brazilian Portuguese, Swedish, Japanese, Korean, Traditional Chinese, Simplified Chinese, and Thai. For more information, see [Technical Specifications for Tableau Cloud](https://www.tableau.com/products/techspecs). #### Tableau Pulse links to related content When creating or editing a metric definition, you can add links to related content. These links appear on each metric’s Insights Exploration page. Consider including links to related dashboards, Slack channels, or workflows to help others follow up on the data. For more information, see [Configure the core definition](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#create). #### Tableau Pulse new border style for dashboard object When embedding a metric in a dashboard, you can select the Tableau Pulse style option so that the dashboard object resembles the rounded-corner metric cards in Tableau Pulse. Without this style option, the metrics on a dashboard resemble other borderless dashboard objects. For more information, see [Add metrics to dashboards and create metrics from dashboards](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#dashboard-object). Added in December 2024 #### Turn off the Unexpected Values insight in Tableau Pulse In metric definition settings (Insights tab), you can turn off the Unexpected Values insight to hide the text description and expected range (blue shaded band in chart). For more information, see [Insight types in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_insights_platform_insight_types.htm#InsightTypesList). Added in November 2024 #### Tableau Pulse personalized insight ranking setting Administrators can turn Tableau Pulse personalized insight ranking off or on in site settings, independent of the setting to deploy Tableau Pulse. For more information, see [Turn off Personalized Insight Ranking](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#PersonalizedInsightRankingSet). Added in September 2024 #### Tableau Pulse currency setting When you set your definition to use the currency number format, you can now set which nation's currency to use, and Tableau Pulse will display that currency symbol and number format. ### Added in August 2024 #### Tableau Pulse dashboard object You can now add a Pulse Metric object to your dashboards. When you add this object, you can choose from metrics that connect to the same published data sources that are used by the workbook. For more information, see [Add metrics to dashboards and create metrics from dashboards](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#dashboard-object). #### Tableau Pulse grouping and sorting Customize your Tableau Pulse home page and digests by grouping and sorting metrics. You can now sort metrics based on how recently you followed the metric, or group metrics that share a metric definition or a data source. For more information, see [Customize your home page and digests](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#Grouping). #### Tableau Pulse goals Create a goal in Tableau Pulse to track a metric’s progress toward the goal. After a goal is created, you’ll see your progress toward that goal in your Tableau Pulse digests and on your Tableau Pulse home page. For more information, see [Set Manual Goals and Thresholds with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_goals.htm). #### Tableau Pulse improved Ask experience for exploring insights Ask more questions about a metric to get suggestions for insights based on the same metric definition. You can now enter questions that adjust the time granularity and apply dimensional filters for the current metric view. For example, "Sales in California last week," "Zoom into technology," or "What about yesterday?" For more information, see [How Tableau Pulse Approaches NLP with Q&A to Empower Everyone](https://www.tableau.com/blog/how-tableau-pulse-approaches-nlp-with-qa). #### Tableau Pulse for Salesforce app The Pulse for Salesforce app connects your Salesforce org with Tableau, creates metrics based on your Salesforce data, and surfaces these metrics in Salesforce. For more information, see [Set Up the Pulse for Salesforce App](https://help.tableau.com/v0.0/online/en-us/pulse_salesforce.htm). Added in July 2024 #### Tableau Pulse minimum time granularity You can now set a minimum time granularity for a metric definition, which limits the time ranges that users can select when filtering to create metrics. This prevents users from selecting time ranges that would result in an empty chart because data doesn’t exist for that granularity. For more information, see [Define the metric value](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#Define). #### Tableau Pulse week start based on data source If the data source that a metric connects to has a different week start than the default (Sunday), the metric reflects that start day. That day appears as the first day of the week for metric charts and insights that deal with weekly values. #### Tableau Pulse restrict metric definition editing You can restrict who can edit or delete a metric definition so that only specific users and groups have access. For more information, see [Restrict editing for definitions and manual goals and thresholds](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#edit-permissions). #### Tableau Pulse record-level outliers insight type A new insight type, record-level outliers, is now available to help you easily spot outliers in your data that are impacting metric values. This insight type shows notably high or low values for a metric, in the context of row-level values of the metric across a period of time. For more information, see [Insight types in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_insights_platform_insight_types.htm#InsightTypesList). #### Tableau Pulse outlier insight setting Turn on or off the record-level outliers insight type to control whether Tableau Pulse looks for extremely high or low values in your data. For more information, see [Configure insights](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#configure-insights). Added in June 2024 #### Tableau Pulse date offsets You can now add a date offset to your metric definition to change the final point in the time series from “Today” to a set number of days in the past. For more information, see [Define the metric value](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#Define). #### Tableau Pulse adjustable metric filter improvements The metric filter options that you can select now show only relevant values when definition filters have been applied to a metric definition. This means that if a metric definition has a definition filter set to limit the data to a certain region, for example, only cities in that region will appear as options for adjustable metric filters. #### Tableau Pulse personalized insight ranking Enhance your insights experience by letting Tableau Pulse know which insights you find most valuable. Your thumbs-up and thumbs-down feedback on insights influence which insights you see first. #### Tableau Pulse charts in Slack When you check your Tableau Pulse digest in Slack, you'll now see a sparkline chart that shows that period's data. Added in March 2024 #### Tableau Pulse improved metric recommendations for dashboards When you explore recommended metrics for dashboards, Tableau now shows more relevant and informative recommendations. Additionally, calculated fields from the data source now appear in recommendations. #### Tableau Pulse pre-aggregated fields in metric definitions When creating a definition, you can now select a field that is pre-aggregated in the data source and use it as the measure. #### Tableau Pulse applied filters shown for metrics When you visit the Insights Exploration page for a metric, the specific filters that are applied to that metric are now listed above the chart. #### Tableau Pulse improved navigation options The Tableau Pulse sparkle (upper-left corner of the Insights Exploration page) now includes drop-down options for navigating to the Tableau Cloud home page and followed metrics. #### Tableau Pulse ad-hoc questions for insights In the guided insights experience, click the Ask button and enter your own questions related to the insights surfaced for a metric. Receive semantically matched suggestions for more insights. For more information, see [How Tableau Pulse Approaches NLP with Q&A to Empower Everyone](https://www.tableau.com/blog/how-tableau-pulse-approaches-nlp-with-qa). Added in February 2024 #### Tableau Pulse follow metrics Adjust filter values and follow different metrics based on the same definition. When you follow a metric, the time period and filter selections are preserved in your Tableau Pulse home page and digests. For more information, see [Follow metrics](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#follow). #### Tableau Pulse guided insights Tableau Pulse provides a path for exploring your data by surfacing questions for each insight that it detects for a metric. As you click through the suggested questions about your data, answers are revealed in easy-to-read charts with insights about the underlying data. For more information, see [Explore metrics in detail, adjust the time range, or apply filters](https://help.tableau.com/v0.0/online/en-us/pulse_explore_metrics.htm#explore-detail). #### Tableau Pulse insights platform The insights platform automatically detects drivers, trends, contributors, and outliers for metrics. It proactively flags and describes insights that matter using natural language and visual explanations. For more information, see [The Insights Platform and Insight Types in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_insights_platform_insight_types.htm). #### Tableau Pulse insight summaries Tableau Pulse looks across the metrics that you follow and leverages AI in Tableau to summarize the most important insights. Insight summaries make use of a large language model (LLM) to provide a personalized overview in plain language. AI in Tableau is built on the Einstein Trust Layer, meaning it enables trusted, ethical, and open AI-powered experiences without compromising data security and privacy. For more information, see [Insight summaries highlight metrics of interest](https://help.tableau.com/v0.0/online/en-us/pulse_insights_platform_insight_types.htm#insight-summaries). #### Tableau Pulse metrics layer The metrics layer provides a single source of truth for your data. Create metric definitions to specify the core metadata that metrics are based on, then adjust filters and time options to create metrics for different groups of followers. For more information, see [Create Metrics with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm). #### Tableau Pulse recommended metrics for dashboards Get a head start on creating metrics by selecting the recommended metrics displayed for Tableau dashboards. For more information, see [Add metrics to dashboards and create metrics from dashboards](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#recommended-metrics). #### Tableau Pulse deployment setting Choose to deploy Tableau Pulse for a single group of users or for all users on your Tableau site. For more information, see [Deploy Tableau Pulse for your site](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#site-setting). #### Tableau Pulse insight summaries setting Insight summaries can be turned on or off independently of the site setting used to deploy Tableau Pulse. For more information, see [AI in Tableau for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-ai). #### Tableau Pulse fiscal calendar support Tableau Pulse now reflects fiscal calendars that have been set on a data source or on specific fields in a data source. For more information, see [How fiscal calendars work with metrics](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#fiscal) . #### Tableau Pulse admin insights Tableau Puse metadata has been added to the Site Content, Users, and Subscriptions data sources for Admin Insights. Admins can use these data sources to learn about the definitions and metrics on a site. For more information, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). #### Tableau Pulse primary time comparison You can now set a primary time comparison as part of a metric definition, and all metrics based on the definition will use that comparison in digests and insights. For more information, see [Define the metric value](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#Define). [Skip to main content](#main-content) # Test Row-Level Security with Preview as User Use Preview as user to test your data policy. You can see the data as the user sees it and ensure that row-level security is working as expected. This helps when the data policy keeps you from seeing the rows in the table (for example, if only salespeople can see rows, and you're not a salesperson). To preview the data when the data policy is applied: 1. Select a table. 2. In the Table Details section, select the With policy applied check box. 3. Click Preview as user, select a Group (optional) and a User. 4. Verify that the policy shows the correct data for that user in the table details. 5. Repeat for other users as needed. > [!TIP] > > In Table Details, click ![Pane icon that shows the range of values in a column for a data policy.](/tableau/next/en-us/online/en-us/Img/ipa_Panes_show_16px_medium.png) to show the range of values for a column, including which values show and which are filtered out by the data policy. Select one or two columns that are good indicators that the policy is correctly filtering the data. ## Who can do this To test a virtual connection, you must - have credentials to the database that the virtual connection connects to, and - be a server or site administrator, or a Creator. ## Next step After you test your data policy, when you're ready to share the virtual connection with others, see [Publish a Virtual Connection and Set Permissions](https://help.tableau.com/v0.0/online/en-us/dm_vconn_publish_save.htm). [Skip to main content](#main-content) # The Insights Platform and Insight Types in Tableau Pulse When you create a metric in Tableau Pulse, you automatically get the insights that Tableau Pulse detects for each metric. The Insights platform in Tableau Pulse detects drivers, trends, contributors, and outliers for metrics. It proactively flags and describes insights that matter using natural language and visual explanations. The top insight for each metric is displayed with the metric. Tableau Pulse also surfaces questions for the insights that it detects for a metric. This guided question-and-answer experience progressively reveals insights in the context of the metric. As you click through suggested questions about the data, answers are revealed in charts with insights about the underlying data. For more information, see [Tableau Pulse: Proactive Answers to Your Common Business Questions with Automated Insights](https://www.tableau.com/blog/tableau-pulse-automated-business-insights) and [How Tableau Pulse approaches NLP with Q&A to empower everyone](https://www.tableau.com/blog/how-tableau-pulse-approaches-nlp-with-qa). ## Types of insights detected by Tableau Pulse The questions users typically ask about metrics can be grouped into well-known patterns of analysis: descriptive, diagnostic, predictive, and prescriptive. - Descriptive questions: What happened to my Metric? - Diagnostic questions: Why did it happen? - Predictive questions: What is likely to happen next? - Prescriptive questions: What actions should I take? The Insights platform in Tableau Pulse focuses on helping users answer basic descriptive questions they have about their metrics, such as: - How much has a metric value changed since the last period or the same period last year? - How is a metric trending over time? - Which members of a dimension contribute most to a metric value? - What other dimensions are driving a metric value in a favorable direction? Insights in Tableau Pulse can alert users to hidden changes or anomalies in Tableau Pulse metrics so they can better diagnose issues. For example: - Is the metric value higher or lower than normal? - Is the metric value unusually concentrated in a few entities of a dimension? - Has the trend of the metric changed recently? - Are there any unusually large records or outliers that are impacting the metric value? ## Insight types in Tableau Pulse The following insight types are used in Tableau Pulse:

Insight Type	Description	Configurable?
Period Over Period Change	Shows how a metric has changed between two periods. This insight is displayed as part of every metric.	Always on by default Tableau Pulse considers the Period over Period Change insight for insight summaries.
Correlated Metrics (Tableau+ license edition required)	Shows a relationship between two metrics based on candidates that are considered for correlation.	Can be turned on or off in the Insights tab in metric definition settings. Requires selection of up to five possible correlation candidates to be compared with a single metric definition. For more information, see Configure insights.
Record-level Outliers	Shows extremely high or low values for a metric, in the context of row-level values of the metric across a period of time.	Can be turned on or off in the Insights tab in metric definition settings. Requires selection of a record identifier field. For more information, see Configure insights.
Forecast (Tableau+ license edition required)	Shows the expected values for a metric for the remainder of the period, along with a forecast confidence range. Forecasts are calculated based on historical metric data and appear on the overview chart for a metric only if Tableau Pulse is confident in the forecast. Forecast confidence is affected by data quality, variance, and recency and the number of date periods to be forecast. You can see a low-confidence forecast by using the Ask button on a metric’s insights exploration page.	Can be turned on or off in the Insights tab in metric definition settings.
Current Trend	Shows current trends to communicate the rate of change, direction, and fluctuations for the metric value.	Can be turned on or off in the Insights tab in metric definition settings.
Trend Change Alert	Shows new trends that vary significantly from the current trend. This insight communicates the rate of change, direction, and fluctuations for the metric value.	Can be turned on or off in the Insights tab in metric definition settings.
Unexpected Values	Shows when the value of a metric for a given time range is higher or lower than the expected range based on historic observations of the metric.	Can be turned on or off in the Insights tab in metric definition settings. Turn this insight off to hide the text description and the expected range (blue shaded band in chart) for the Unexpected Values insight. Tableau Pulse considers the Unexpected Values insight for insight summaries.
Goal and Threshold Breakdown	Shows the progress to goal or threshold on the breakdown chart for a metric.	Can be turned on or off in the Insights tab in metric definition settings.
Pace to Goal (Tableau+ license edition required)	Shows whether a metric with a sum or count aggregation is on track to reach its goal by the end of the period. Requires the Forecast insight to be on.	Can be turned on or off in the Insights tab in metric definition settings. If you turn off the Forecast insight, the Pace to Goal insight is also turned off.
Top Drivers	Shows values for dimension members that changed the most in the same direction as the observed change in the metric.	Can be turned on or off in the Insights tab in metric definition settings.
Top Detractors	Shows values for dimension members that changed the most in the opposite direction to the observed change in the metric.	Can be turned on or off in the Insights tab in metric definition settings.
Concentrated Contribution Alert (Risky Monopoly)	Shows when a small number of dimension members make up a majority (50% or more) of the contribution to a metric.	Can be turned on or off in the Insights tab in metric definition settings.
Top Contributors	Shows the highest values in a dimension for a metric within a given time range. A top contributor is a dimension member that ranks in the top N in contribution to the scoped metric’s value, aggregated on a specified time range.	Always on by default Tableau Pulse uses the Top Contributors insight in metrics for breakdowns.
Bottom Contributors	Shows the lowest values in a dimension for a metric within a given time range. A bottom contributor is a dimension member that ranks in the bottom N in contribution to the scoped metric’s value, aggregated on a specified time range.	Can be turned on or off in the Insights tab in metric definition settings.

## How Tableau Pulse generates and maintains trusted insights Here are a few ways the Insights platform generates automated business insights users can trust: - Tableau Pulse Insights Service starts by using standardized, deterministic statistical models to detect facts about metrics that are guaranteed to be accurate. These facts act as the ground truth when generating insights. - Every insight that is generated is restricted to the data security context (such as RLS settings) of the user who made the request. This approach ensures users can only see the data they're authorized to see. - Analysts can enable or disable different insights being detected for a metric so they can control what is delivered to their users. Here’s how Tableau Pulse brings it all together: the Insights platform statistical service uses the analytical context of the metric being followed or viewed to run automatic statistical analysis that generates facts about the metric. These facts answer the different questions using the user's data security context. Insight summaries are generated using natural language grounded in statistical truths. The most relevant facts are processed by AI in Tableau. These facts are used as ground truths to contextualize language generation. The resulting facts generated are bundled together and surfaced in several features throughout Tableau Pulse as insight summaries when AI in Tableau is turned on for a site. ## How the Insights platform determines relevance To reduce noise, Tableau Pulse only surfaces the most relevant, useful insights—and avoids displaying noisy or spurious findings. The Insights platform considers the following factors to ensure the insights users see are relevant and useful: - **The analytic context for insights is based on the Tableau Pulse metric definition**. Unlike other solutions that look for insights across all columns in the data, the Insights platform restricts its analysis to the measures and dimensions referenced by the metric definition, as curated by analysts. In addition, only the filtered context of the metric user is viewing or following is considered when generating insights. - **Insights are ranked based on impact to the metric**. Each fact detected by the Insights platform is scored based on the impact it has on the metric value. Only the facts determined to be most statistically impactful to the metric value are returned first. - **Feedback further personalizes insights**. Users can provide thumbs-up or thumbs-down feedback on the insights they see to indicate whether the insights are useful. The Insights platform learns from this to further personalize the types of insights it shows to a user. **Note**: When the Personalized Insight Ranking site setting is turned on for your Tableau site, users can provide thumbs-up or thumbs-down feedback on insights. This setting is on by default. For more information, see [Turn off Personalized Insight Ranking](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#PersonalizedInsightRankingSet). When applied in combination, these factors ensure that of all insights detected for a metric, only those found to be most useful are surfaced to users in Tableau Pulse. ## How AI in Tableau highlights insights in Tableau Pulse When the required AI in Tableau site settings are turned on, Tableau Pulse presents insights in natural language summaries and in a conversational data exploration experience. ### Insight summaries highlight metrics of interest When insight summaries are turned on and you follow two or more metrics, Tableau Pulse provides an overview to help you see the latest insights across your metrics. This insight summary appears at the top of digests and in the Tableau Pulse home page. For information on turning on insight summaries, see [Turn on metric insight summaries](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#pulse-insight-summaries). Tableau Pulse looks across the metrics that you follow and leverages AI in Tableau to summarize the most significant changes. Period Over Period Change and Unexpected Values are the insight types considered for insight summaries. Insight summaries use a large language model to provide a personalized overview in plain language. AI in Tableau is built on the Einstein Trust Layer, which enables trusted, ethical, and open AI-powered experiences without compromising data security and privacy. For more information, see [AI in Tableau for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-ai) and [Einstein Generative AI for Tableau](https://help.tableau.com/current/tableau/en-us/about_tableau_gai.htm). ### Tableau Agent in Pulse presents relevant insights for groups of metrics When Tableau Agent in Pulse is turned on, it's surfaced on the Tableau Pulse home page for metrics grouped by data source, definition, or time range. Selecting a question takes you to a page with key insights, relevant visualizations, source references, and suggested follow-up questions. Because it's powered by AI in Tableau, you can ask questions in your own words to get natural language answers about your data. Tableau Agent in Pulse is a Tableau+ feature that must be turned on in Tableau Cloud site settings. For more information, see [Ask Questions and Discover Insights in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm) and [Turn on Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-enhancedQA-discover). [Skip to main content](#main-content) # The Tableau Data Model Every data source that you create in Tableau has a data model. You can think of a data model as a diagram that tells Tableau how it should query data in the connected database tables. The tables that you add to the canvas in the Data Source page create the structure of the data model. A data model can be simple, such as a single table. Or it can be more complex, with multiple tables that use different combinations of relationships, joins, and unions. The data model has two layers: - The default view that you first see in the Data Source page canvas is the _logical layer_ of the data source. You combine data in the logical layer using relationships (or noodles). Think of this layer as the Relationships canvas in the Data Source page. For more information, see [Use Relationships for Multi-table Data Analysis](https://help.tableau.com/current/pro/desktop/en-us/datasource_multitable_normalized.htm). - The next layer is the _physical layer_. You combine data between tables at the physical layer using [joins](https://help.tableau.com/current/pro/desktop/en-us/datasource_relationships_learnmorepage.htm#where-did-joins-go) and unions. Each logical table contains at least one physical table in this layer. Think of the physical layer as the Join/Union canvas in the Data Source page. Double-click a logical table to view or add joins and unions.

Logical Layer		Physical Layer
Noodles = Relationships		Venn diagram = Joins

The top-level view of a data source with multiple, related tables. This is the logical layer. Logical tables can be combined using relationships (noodles). They don't use join types. They act like containers for physical tables.		Double-click a logical table to open it and see its physical tables. Physical tables can be combined using joins or unions. In this example, the Book logical table is made of three, joined physical tables (Book, Award, Info).

| Logical Layer | | Physical Layer | | --- | --- | --- | | Relationships canvas in the Data Source page | | Join/Union canvas in the Data Source page | | Tables that you drag here are called logical tables | | Tables that you drag here are called physical tables | | Logical tables can be related to other logical tables | | Physical tables can be joined or unioned to other physical tables | | Logical tables are like containers for physical tables | | Double-click a logical table to see its physical tables | | Level of detail is at the row level of the logical table | | Level of detail is at the row level of merged physical tables | | Logical tables remain distinct (normalized), not merged in the data source | | Physical tables are merged into a single, flat table that defines the logical table | ## Layers of the data model The top-level view that you see of a data source is the [logical layer](#dm_log_phys) of the data model. You can also think of it as the Relationships canvas, because you combine tables here using relationships instead of joins. When you combine data from multiple tables, each table that you drag to the canvas in the logical layer must have a relationship to another table. You do not need to specify join types for relationships; during analysis Tableau automatically selects the appropriate join types based on the fields and context of analysis in the worksheet. The [physical layer](#dm_log_phys) of the data model is where you can combine data using joins and unions. You can only use pivots in this canvas. You can think of it as the Join/Union canvas. In previous versions of Tableau, the physical layer was the only layer in the data model. Each logical table can contain one or more physical tables. > [!TIP] > > **Important**: You can still create single-table data sources in Tableau that use joins and unions. The behavior of single-table analysis in Tableau has not changed. Your upgraded workbooks will work the same as they did before 2020.2. **Learn more**: For related information on combining data using relationships, also see these topics and blog posts: - [How Relationships Differ from Joins](https://help.tableau.com/v0.0/online/en-us/datasource_relationships_learnmorepage.htm) - [Use Relationships for Multi-table Data Analysis](https://help.tableau.com/v0.0/online/en-us/datasource_multitable_normalized.htm) - [Relate Your Data](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm) - [Relationships, part 1: Introducing new data modeling in Tableau](https://www.tableau.com/about/blog/2020/5/relationships-part-1-meet-new-tableau-data-model) - [Relationships, part 2: Tips and tricks](https://www.tableau.com/about/blog/2020/5/relationships-part-2-tips-and-tricks) - [Relationships, part 3: Asking questions across multiple related tables](https://www.tableau.com/about/blog/2020/6/relationships-part-3-asking-questions-across-multiple-related-tables) Also see video podcasts on relationships from [Action Analytics](https://action-analytics.com/library/), such as [Why did Tableau Invent Relationships?](https://action-analytics.com/ep-1-why-did-tableau-invent-relationships/) Click "Video Podcast" in the [Library](https://action-analytics.com/library/) to see more. ## Understanding the data model The data model has a logical (semantic) layer and a physical layer. This gives you more options for combining data using schemas to fit your analysis. ![A data model diagram displays a logical layer with two tables linked by a relationship, and a physical layer that illustrates how the logical tables are constructed from physical tables.](/tableau/next/en-us/online/en-us/Img/data_model_layers_sm.png) Each logical table contains physical tables in a physical layer. In earlier versions of Tableau (pre-2020.2), the data model in your data source consisted of a single, physical layer where you could specify joins and unions. Tables added to the physical layer (joined or unioned) create a single, flattened table (denormalized) for analysis.

Physical Layer Data Source		Logical Layer Data Source

Tables at the logical layer are not merged in the data source, they remain distinct (normalized), and maintain their native level of detail. Logical tables act like containers for merged physical tables. A logical table can contain a single, physical table. Or it can contain multiple physical tables merged together through joins or unions. ### Add descriptions to logical tables Logical tables can have descriptions that appear in their tooltips. These tooltips only appear in the Data Source tab. To add a description: 1. Select a table in the canvas 2. In the bottom pane, click the edit icon (pencil) next to **Description** 3. Enter your description in the rich text editor **Note**: In web authoring only, any links in a description are live and can be clicked to open directly. ![a table's tooltip with a description of the field and a highlight around the description section of the bottom pane](/tableau/next/en-us/online/en-us/Img/environ_workspace_datasource_tabledescriptions.png) ## Build a new model When you add one or more tables to the logical layer, you are essentially building the data model for your data source. A data source can be made of a single, logical table, or you can drag multiple tables to the canvas to create a more complex model. - The first table that you drag to the canvas becomes the root table for the data model in your data source. - After you drag out the root table, you can drag out additional tables in any order. You will need to consider which tables should be related to each other, and the matching field pairs that you define for each relationship. - If you are creating a star schema, it can be helpful to drag the fact table out first, and then relate dimension tables to that table. - Deleting a table in the canvas automatically deletes its related descendants as well. If you delete the root table, all other tables in the model are also removed. - Each relationship must be made of at least one matched pair of fields. Add multiple field pairs to create a compound relationship. Matched pairs must have the same data type. Changing the data type in the Data Source page does not change this requirement. Tableau will still use the data type in the underlying database for queries. - Relationships can be based on calculated fields. - You can specify how fields used in the relationships should be compared by using operators when you define the relationship. For more information about relationships, see [Create and define relationships](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm#create-and-define-relationships) in [Relate Your Data](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm). ### Multi-table model - To create a multi-table model, drag tables to the logical layer of the Data Source page canvas. ![To create a multi-table model, drag tables to the logical layer of the Data Source page canvas.](/tableau/next/en-us/online/en-us/Img/data_model_multitableanalysis.gif) Tables that you drag to the logical layer of the Data Source page canvas must be related to each other. When you drag additional tables to the logical layer canvas, Tableau automatically attempts to create the relationship based on existing key constraints and matching fields to define the relationship. If it can't determine the matching fields, you will need to select them. If no constraints are detected, a **Many-to-many** relationship is created and referential integrity is set to **Some records match**. These default settings are a safe choice and provide the most a lot of flexibility for your data source. The default settings support full outer joins and optimize queries by aggregating table data before forming joins during analysis. All column and row data from each table becomes available for analysis. You can add more data inside any logical table by double-clicking the table. This opens the physical layer of the Data Source page canvas. If you need to use joins or unions, you can drag the tables you want to join or union into the physical layer canvas. The physical tables are merged in their logical table. Follow the steps in [Create and define relationships](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm#create-and-define-relationships) to combine multiple tables. ### Single-table model - To create a single-table model, drag a table into the logical layer canvas of the Data Source page. You can then use the fields from that table in the Data pane for analysis. ![Data model with a single table analysis.](/tableau/next/en-us/online/en-us/Img/data_model_singletableanalysis.gif) #### Single-table model that contains other tables You can add more data inside the single, logical table by double-clicking the table. This opens the physical layer of the Data Source page canvas. If you need to use joins or unions, you can drag the tables you want to join or union into the physical layer canvas. The physical tables are merged in their logical table. ![Data model with two joins.](/tableau/next/en-us/online/en-us/Img/data_model_singletable_joins.gif) This example shows the Book table in the Relationships canvas (logical layer) of the data source. Double-clicking the Book logical table opens the Join/Union canvas (physical layer). In this example, the joins merge the Award and Info tables with the Book table. In this case, the join between Book and Award will be one-to-many, at the level of detail of awards. This would duplicate measure values for Book and Info. To avoid duplication, you could relate Award and Info to Book instead of joining them inside of the Book logical table. ## Supported data model schemas The data modeling capabilities in Tableau (version 2020.2 and later) are designed to make analysis over common multi-table data scenarios—including star and snowflake data models—easy. The following types of models are supported in Tableau data sources. ### Single-table Analysis over a single logical table that contains a mixture of dimensions and measures works just as in Tableau pre-2020.2. You can build a logical table using a combination of joins, unions, custom SQL, and so on. ![Object labeled customers with three blue bars stacked on top of two green bars.](/tableau/next/en-us/online/en-us/Img/data_model_schema1.png) ### Star and snowflake In enterprise data warehouses, it is common to have data structured in star or snowflake schemas where measures are contained in a central fact table and dimensions are stored separately in independent dimension tables. This organization of data supports many common analysis flows including rollup and drill down. ![Customers object with lines showing a relationship with the dimension 1, dimension 2, and dimension 3 objects.](/tableau/next/en-us/online/en-us/Img/data_model_schema2.png) These models can be directly represented with relationships in the data modeling capabilities available in Tableau 2020.2 and later. Drag the fact table into the model first and then relate the dimension tables to the fact table (in a star schema) or to other dimension tables (in a snowflake). Typically, in a well-modeled star or snowflake schema, the relationships between the fact table and the dimension tables will be many-to-one. If this information is encoded in your data warehouse, Tableau will automatically use this to set the relationship's Performance Options. If not, you can set this information yourself. For more information, see [Optimize Relationship Queries Using Performance Options](https://help.tableau.com/current/pro/desktop/en-us/datasource_relationships_perfoptions.htm). In a well-modeled star or snowflake schema, every row in the fact table will have a matching entry in each of the dimension tables. If this is true and captured in your data warehouse integrity constraints, Tableau will automatically use this information to set the referential integrity setting in Performance Options. If some fact table rows do not have a matching row in a dimension table (sometimes called "late-arriving dimensions" or "early-arriving facts"), Tableau will default to retaining all rows when computing measures, but may drop values when showing dimension headers. For more information, see [Optimize Relationship Queries Using Performance Options](https://help.tableau.com/current/pro/desktop/en-us/datasource_relationships_perfoptions.htm). ### Star and snowflake with measures in more than one table In some star or snowflake schemas, all the measures for your analysis are contained in the fact table. However, it is often true that additional measures of interest may be related to the dimension tables in your analysis. Even if the dimension tables do not contain measures, it is common in analysis to want to count or otherwise aggregate dimension values. In these cases, the distinction between fact tables and dimension tables is less clear. To create clarity when viewing your data model, we recommended adding the finest grain table to the data source canvas first, and then relating all other tables to that first table. ![Data model illustrates how customers are segmented into three dimensions.](/tableau/next/en-us/online/en-us/Img/data_model_schema3.png) If you were to join these tables together into a single logical table, the measures in the dimension tables would be replicated, resulting in distorted aggregates unless you took precautions to deduplicate the values using LOD calculations or COUNT DISTINCT. However, if you instead create relationships between these tables, Tableau will aggregate measures before performing joins, avoiding the problem of unnecessary duplication. This relieves you of the need to carefully track the level of detail of your measures. ### Multi-fact analysis In version 2024.2 and later, Tableau's data modeling capabilities support multi-fact analysis through the use of multi-fact relationships. For in-depth information on how to create multi-fact relationships data models, see: - [About Multi-fact Relationship Data Models](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm) - [When to Use a Multi-fact Relationship Model](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_when_to_use.htm) - [Build a Multi-fact Relationship Data Model](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_build.htm) A multi-fact relationship model—a data model with multiple base tables—permits unrelated tables in the model when shared tables also exist in the model. During analysis, fields from a shared table "stitch" together otherwise unrelated tables of data based on the shared dimensions they have in common (such as happening in the same place or at the same time). All the benefits of relationships are maintained, including the retention of each table's grain, or native level of detail. Similar to a single base table data model, Tableau determines the best join type to use behind the scenes based on the structure of the viz. But in a multi-fact relationship model, the join options are expanded to include outer and cross joins to handle different levels of relatedness. For more information, see [About Multi-fact Relationship Data Models](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm). **Note**: In versions 2020.2 through 2024.1, you can add fact tables (containing measures) to star and snowflake models only if they are related to a single dimension table. For example, you can bring two or more fact tables together to analyze a shared dimension, such as in Customer 360-like analyses. These fact tables can be at a different level of detail than the dimension table, or from each other. They can also have a many-to-many relationship with the dimension table. In these scenarios, Tableau will ensure that values are not replicated before aggregation. ![Data model illustrates how customers are segmented into three dimensions and shows the connections between sales and campaigns.](/tableau/next/en-us/online/en-us/Img/data_model_schema5.png) If you don't have a shared dimension table that relates your fact tables, you can sometimes dynamically build one using custom SQL or by using joins or unions of other dimension tables. Two fact tables can be related directly to each other on a common dimension. This type of analysis works best when one of the fact tables contains a superset of the common dimension. ![Data model shows relationship between sales and campaigns.](/tableau/next/en-us/online/en-us/Img/data_model_schema6.png) There are various scenarios that may indicate you should build a multi-fact relationship model with multiple base tables rather than a single base table data source: - **Circular relationships**. Circular relationships are not supported. If you're trying to build a data source with a cycle, use multi-fact relationships and make the downstream table another base table instead. - **Conformed dimensions** and **Contextual OR relationships**. If you have a series of tables that are related on the same sets of relationship clauses (such as date and location), those dimensions should be pulled out and made into shared tables instead. - This is especially useful because multiple relationship clauses must all be true (logically, an AND) for the tables to be related for those records. - If, instead, you want to analyze records where one may be true at a time (a contextual OR), this flexibility is provided by setting up a data model with shared dimension tables instead. - **Equivalent blends**. If you're using a blend but want to have an equivalent blend without primary and secondary data sources, build a data model that combines the data sources from the blend with their linking fields in a shared table or tables. ## Requirements for relationships in a data model - When relating tables, the fields that define the relationships must have the same data type. Changing the data type in the Data Source page does not change this requirement. Tableau will still use the data type in the underlying database for queries. - You can't define relationships based on geographic fields. - Circular relationships aren't supported in the data model. ### Factors that limit the benefits of using related tables - Dirty data in tables (i.e. tables that weren't created with a well-structured model in mind and contain a mix of measures and dimensions in multiple tables) can make multi-table analysis more complex. - Using data source filters will limit Tableau's ability to do join culling in the data. Join culling is a term for how Tableau simplifies queries by removing unnecessary joins. - Tables with a lot of unmatched values across relationships. [Skip to main content](#main-content) # Tokens Data Source Tokens contains information about active, unexpired user tokens on the site, including personal access tokens (PATs), refresh tokens, and OAuth tokens. Site administrators can monitor token usage and expiration through the data source, rotating essential tokens as needed. The following tokens are included in the data source: - **OAuth Database** - Manage the access tokens used for OAuth connections. The tokens are valid until a Tableau Cloud user deletes it, or the data provider revokes it. For more information, see [OAuth Connections](https://help.tableau.com/v0.0/online/en-us/protected_auth.htm). - **OAuth Client** - Manage refresh tokens used by connected clients, such as Tableau Desktop and Tableau Prep. For more information, see [Access Sites from Connected Clients](https://help.tableau.com/v0.0/online/en-us/to_connected_clients.htm). - **Personal access tokens (PATs)** - Manage long-lived authentication tokens used to sign in to Tableau Cloud, such as automated scripts and tasks that are created with the Tableau REST API. For more information, see [Personal Access Tokens](https://help.tableau.com/v0.0/online/en-us/security_personal_access_tokens.htm). At any time, site administrators can quickly revoke a token by unlicensing a user with the undesired token. With the caveat that new tokens have to be created when the user is relicensed. For steps on removing or revoking specific types of tokens, follow the links in the previous section. ## Create custom views If you're a site admin or someone who has been granted access to the Admin Insights project, you can access the Admin Insights data sources directly from Tableau Cloud using Web Authoring or through Tableau Desktop to build custom views. For more information about connecting to Admin Insights data sources, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Example: When were OAuth Database tokens last updated? Use the following steps to create a view that measures when OAuth database tokens were last update and token rotation compliance within an organization. 1. Connect to the Tokens data source. 2. From the Data pane, drag Token Type to the Filter shelf. Select the OAuth Database checkbox, and click OK. 3. Drag Database Type, Database User Name, and Last Updated to the Rows shelf. 4. On the Rows shelf, right-click Last Updated and select Exact Date from the context menu. Change the field from continuous to discrete. 5. From the menu, click Analysis > Create Calculated Field. 1. Name: Days Since Last Update 2. Calculation: ``` ROUND(TODAY()-[Last Updated]) ``` 6. Click OK. 7. From the Data pane, drag Days Since Last Update to the Rows shelf. Change the field from continuous to discrete. ### Example: When do embedded OAuth database tokens expire? To prevent disruptions such as view load errors and failed extract refreshes, it's important to monitor the expiration of embedded OAuth database tokens. Use the following steps to create a view that identifies tokens nearing expiration, enabling users to refresh their credentials proactively. **Note:** Tableau doesn't store expiration times for OAuth database tokens. To obtain this information, contact your database administrator to verify expiration details for each database type. 1. Connect to the Tokens data source. 2. From the Data pane, drag Token Type to the Filter shelf. Select the OAuth Database checkbox, and click OK. 3. Drag Database Type and Owner Email to the Rows shelf. 4. From the menu, click Analysis > Create Calculated Field. In this example, we use a Snowflake database with a 90-day expiration period. 1. Name: `Expires At (all tokens)` 2. Calculation: IF \[Token Type\] = 'OAuth Database' THEN IF \[Database Type\] = 'snowflake' THEN DATEADD('day', 90, \[Last Updated\]) // add conditions for other database types here // ELSE NULL END ELSE \[Expires At\] END 5. From the menu, click Analysis > Create Calculated Field. 1. Name: `Days Until Expiration` 2. Calculation: DATEDIFF('day', TODAY(), \[Expires At (all tokens)\]) 6. Drag Days Until Expiration to the Rows shelf. Change the field from continuous to discrete. 7. Drag Days Until Expiration to the Filters shelf. Select All Values, setting the Maximum to 14. This filters tokens expiring in the next 14 days or those already expired. Adjust as needed. 8. Use the resulting values to contact users whose tokens are set to expire soon. ### Example: Which users own PATs on the site? The following example displays the names and site roles of users who own PATs on the site. You can adjust the filter for other token types. 1. Connect to the Tokens and TS Users data sources. 2. Select Data > Edit Blend Relationships. 3. In the Blend Relationships dialog, set the primary data source to Tokens, and select the Custom radio button. 4. Click Add. 5. In the Add/Edit Field Mapping dialog, map Owner Email to User Email, and click OK > OK. 6. From the Data pane, drag Token Type to the Filter shelf. Select the PAT checkbox, and click OK. 7. From the Data pane, drag User Name, User Site Role, Expires At, and Last Used At At to the Rows shelf. 8. Verify that User Email is the linking field in the Data pane. If there is a broken link, click the icon next to the field name to link the two data sources. 9. On the Rows shelf, right-click Expires At and select Exact Date from the context menu. Change the field from continuous to discrete. 10. Repeat step 7 for Last Used At. ## Do more with your data Using Tableau Prep, you can join Tokens with other Admin Insights data sources on the following fields to get more visibility into your site. If you're analyzing data from multiple Tableau Cloud sites, you must also join on "Site LUID = Site LUID". - To see the site role of the token owner, join Tokens to TS Users on "Owner Email" = "User Email" - To see group membership of the token owner, join Tokens to Groups on "Owner Email" = "User Email" For more information, see [Aggregate, Join, or Union Data](https://help.tableau.com/current/prep/en-us/prep_combine.htm) in Tableau Prep Help. ## Data schema The following table lists the fields included in the Tokens data source. Each row of data corresponds to a combination of Token ID and Owner Email.

Folder	Field Name	Type	Description
Database	Asset Key ID	Numeric	ID of the database entry. Applies to OAuth Database tokens.
	Database Type	String	The type of database, for example, Salesforce, Snowflake, etc. Applies to OAuth Database tokens.
	Database User Name	String	Name of the user connecting to the database. Applies to OAuth Database tokens.
	Instance URL	String	The instance URL for the data provider, for example, https://login.salesforce.com. Applies to OAuth Database tokens.
	Last Updated	Date-time	Date and time the data source credentials were last changed in UTC. Applies to OAuth Database tokens.
Devices	Device ID	String	ID of the connected client associated with the token. Applies to OAuth Client tokens.
Devices	Device Name	String	Name of the connected client associated with the token. Applies to OAuth Client tokens.
Site	Site LUID	String	The LUID of the Tableau Cloud site. Primarily used to reference content via the REST API.
Site	Site Name	String	Name of the Tableau Cloud site.
Token	Expires At	Date-time	Date and time the token expires in UTC. Applies to PAT and OAuth Client tokens.
	GUID	String	Unique ID of the token. Applies to PAT and OAuth Client tokens.
	Issued At	Date-time	Date and time the token was issued in UTC.
	Last Used At	Date-time	Date and time the token was last used in UTC. Applies to PAT and OAuth Client tokens.
	Owner Email	String	Email address of the token owner.
	PAT Name	String	Name of the personal access token. Applies to PATs.
	Token Identifier	String	Uniquely identifies a row of data using the GUID for PAT and OAuth Client tokens and Asset Key ID for OAuth Database tokens.
	Token Type	String	An enumerated value for the token type. Either personal access token (PAT), OAuth Client, or OAuth Database.
-	Admin Insights Published At	Date-time	Date and time the Admin Insights data source was last published in UTC.

[Skip to main content](#main-content) # Traffic to Bridge Connected Data Sources The Traffic to Bridge Connected Data Sources admin view gives the site admin the ability to see usage of data sources with live connections. This view can help you determine which data sources are most heavily used and those that are used less often. You can filter the information you see by selecting the Bridge client name, data source, and the time range. This view gives you a snapshot of Tableau Cloud activity over the past 30 days. ![A dashboard that presents Bridge data source usage and user activity over the past seven days.](/tableau/next/en-us/online/en-us/Img/adminview_bridge_datasources.png) The top of the view shows you how data sources are being used over the Time Range you specify (the default is the last 7 days): - What is the Data Source Usage by Project—this shows total data source usage by project, based on the filters you set. Hover over a mark to see the number of times a data source was used. Select the mark to update the other sections of the view based on your selection. - What is the Total Data Source Usage by Day—this shows total data source usage by day, based on the filters you set. Hover over a point on the line to see the count. Select the point to update the other sections of the view based on your selection. Two bar graphs at the bottom of the view show results that are filtered by Min Interactions. These show you which data sources are most used, and who uses data sources most often. Only those data sources and users with interaction counts greater than or equal to the minimum interactions value are displayed: - What Data Sources are Used Most—this is a list of the most used data sources. Like the other sections of the view, the information is limited by filters and any selection you make. - Who Uses Data Sources Most Often—this shows the users who most often use the data sources. This is impacted by filters and any selection you make. [Skip to main content](#main-content) # Troubleshoot Connected Apps - Direct Trust When embedded content fails to display in your custom application or Tableau REST API authorization fails, you can use a browser’s developer tools to inspect and identify error codes that might be associated with the Tableau connected app (direct trust) that’s used to display the embedded content. **Note:** In order for the session token to be valid, the clocks of the external application and the server that hosts the external application must be set to Coordinated Universal Time (UTC). If either clock uses a different standard, the connected app will not be trusted. Refer to the table below to review the description of the error code and potential resolution.

Error code	Summary	Description	Potential resolution or explanation
5	SYSTEM_USER_NOT_FOUND	Tableau user could not be found	To resolve this issue, verify the '`sub`' (Subject) claim value in the JWT is the user name (email address) of the authenticated Tableau Cloud user. This value is case sensitive.
16	LOGIN_FAILED	Login failed	This error is typically caused by one of the following claim issues in the JWT: The '`exp`' (Expiration Time) exceeds the default maximum validity period. To resolve this issue, review registered claims required for a valid JWT and ensure the correct value does not exceed 10 minutes. The '`sub`' (Subject) is calling an unknown user. To resolve this issue, verify the '`sub`' value is the user name (email address) of the authenticated Tableau Cloud user.
67	FEATURE_NOT_ENABLED	On-demand access is not supported	On-demand access is available through licensed Tableau Cloud sites only.
126	CONNECTED_APP_NOT_FOUND	The connected app could not be found	To resolve this issue, verify the connected app is enabled and the correct client ID (also known as the connect app ID) is referenced in the JWT.
127	CONNECTED_APP_SECRET_NOT_FOUND	The connected app's secret could not be found	To resolve this issue, verify the correct connected app's secret ID and secret value are referenced in the JWT.
128	CONNECTED_APP_SECRET_LIMIT_EXCEEDED	Maximum limit for secrets has been reached	A maximum of two secrets are allowed for a connected app. This error can occur when there's an attempt to create a third secret. To resolve this issue, delete a secret from the connected app before creating a new one.
133	INVALID_CONNECTED_APP_DOMAIN_SAFELIST	Domain allowlist contains one or more invalid characters	This error can occur when the domain allowlist contains one or more invalid characters.
10083	BAD_JWT	JWT header contains issues	The '`kid`' (Secret ID) or '`clientId`' (Issuer) claims are missing from the JWT header. To resolve this issue, ensure this information is included.
10084	JWT_PARSE_ERROR	JWT contains issues	To resolve this issue, verify the following: The '`aud`' (Audience) value referenced in the JWT uses the "tableau" value. This value is case sensitive. The '`aud`' (Audience) and '`sub`' (Subject) are included in the JWT. Review IssueTime or ensure there's no clock mismatch between the machine hosting the connected app and Tableau Cloud.
10085	COULD_NOT_FETCH_JWT_KEYS	JWT could not find keys	Could not find the secret. To resolve this issue, verify the correct 'kid' (Secret ID) is used in the JWT header.
10089	CONNECTED_APP_NOT_FOUND	Could not find connected app	To resolve this issue, ensure the issuer is calling the correct connected app ID (also known as the client ID).
10090	CONNECTED_APP_DISABLED	Connected app is disabled	The connected app used to verify trust is disabled. To resolve this issue, enable the connected app.
10091	JTI_ALREADY_USED	Unique JWT required	The JWT has already been used in the authentication process. To resolve this issue, a new JWT must be generated.
10092	NOT_IN_DOMAIN_ALLOW_LIST	Domain of the embedded content is not specified	To resolve this issue, ensure the `unrestrictedEmbedding` setting is set to `true` or `domainAllowlist` parameter includes the domains where Tableau content is embedded using the Update Embedding Settings for Site method in the Tableau REST API.
10094	MISSING_REQUIRED_JTI	Missing JWT ID	To resolve this issue, verify the '`jti`' (JWT ID) is included in the JWT.
10096	JWT_EXPIRATION_EXCEEDS_CONFIGURED_EXPIRATION_PERIOD	Issue with expiration time	The '`exp`' (Expiration Time) exceeds the default maximum validity period. To resolve this issue, review registered claims required for a valid JWT and ensure the correct value does not exceed 10 minutes.
10097	SCOPES_MALFORMED	Issues with scopes claim	This error can occur when the '`scp`' (Scope) claim is either missing from the JWT or not passed as a list type. To resolve this issue, verify '`scp`' is included in the JWT and passed as a list type. For troubleshooting help with a JWT, see Debugger on the auth0 site.
10098	JWT_UNSIGNED_OR_ENCRYPTED	JWT is unsigned or encrypted	Tableau does not support an unsigned or encrypted JWT.
10099	SCOPES_MISSING_IN_JWT	Missing scopes claim	The JWT is missing the required '`scp`' (scope) claim. To resolve this issue, verify '`scp`' is included in the JWT. For troubleshooting help with a JWT, see Debugger on the auth0 site.
10100	JTI_PERSISTENCE_FAILED	Unexpected JWT ID error	There was an unexpected '`jti`' (JWT ID) error. To resolve this issue, a new JWT with a new '`jti`' must be generated.
10101	EPHEMERAL_USER_LOGIN_FAILED_SITE_NOT_UBP_ENABLED	On-demand access is not supported	The site is not licensed with the Embedded Analytics usage-based model that is required to enable on-demand access. For more information, see Understanding License Models.
10102	EPHEMERAL_USER_NOT_SUPPORTED	On-demand access is not supported when iframe-auth attribute is enabled	This error can occur when the iframe-auth attribute is enabled. To resolve this issue, verify that the Tableau Embedding API version 3.6 or later is being used.
10103	JWT_MAX_SIZE_EXCEEDED	JWT exceeds maximum size	This error can occur when JWT size exceeds 8000 bytes. To resolve this issue, make sure that only the necessary claims are being passed to Tableau Cloud.
10105	ORIGIN_HEADER_NOT_A_VALID_URI	Invalid Origin header	This error can occur because 1) a URL is specified in the domain allowlist and 2) the Origin header does not contain a valid URL.
10106	ORIGIN_HEADER_NOT_SET	Missing Origin header	This error can occur because 1) a URL is specified in the domain allowlist and 2) the Origin header is not set.
10113	EPHEMERAL_USER_LOGIN_FAILED_SITE_NOT_ENTITLED_FOR_ODA_ACCESS	On-demand access is not supported	This site is not licensed with Embedded Analytics usage-based model; or Capacity-based Viewer Blocks is not enabled with Cloud+ or Tableau+ edition, which is required for on-demand access. For more information, see Usage-based license model or Capacity-based license model.

[Skip to main content](#main-content) # Troubleshoot Private Network Issues Different parts of the Tableau Bridge workflow require coordination with Tableau Desktop and Tableau Cloud. Depending on the task you're trying to complete, the underlying data that you're working with, and the data source's connection (live or extract), and on the symptoms you're seeing, some troubleshooting steps might require you to work in one or both of these respective products in addition to the client itself. The issues and the steps to help resolve these issue might apply to data source owners or site admins. ## Understanding common issues after upgrade After upgrading to Bridge, you might notice some changes to your Bridge-specific workflows. **Can't configure 15 minute or 30 minute refreshes** Bridge refresh schedules only run as frequently as every 60 minutes. However, you can have multiple refresh schedules on the same data source. To enable a refresh to occur more frequently, set up four refresh schedules on the same data source. Then have all four schedules start at 15 minute increments and repeat hourly. This will result in refreshes that begin every 15 minutes. **Note:** When using Bridge legacy schedules, the data source owner must be the same user that is signed into the client that is designated to refresh the data source. Depending on how client management is administered in your organization, your site admin might need to take ownership of your data source. **Can't find the "Refresh this extract on" or "Select where to run refreshes" button** Beginning with Bridge 2020.2, Bridge schedules are better integrated with Tableau Cloud schedules and can be accessed and set up directly in the same location as Tableau Cloud schedules. For more information about Bridge schedules, see [Set Up a Private Network Refresh Schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm). **Can't find the Run Now option** The **Run Now** option in Tableau Cloud is not available on individual data source pages for data sources that use Bridge legacy schedules. In most cases, a manual refresh of a data source that uses a Bridge legacy schedule can only be performed from the client that the data source is linked to. **Can't refresh data sources that use Relationships** Bridge 2019.4 (or earlier) does not support data sources created with [Relationships](https://help.tableau.com/current/pro/desktop/en-us/whatsnew_desktop.htm#https://help.tableau.com/current/pro/desktop/en-us/whatsnew_desktop.htm#relate_data) in Tableau 2020.2 (or later). To keep your private network data fresh, make sure you're running the latest version of the client. To get the latest client, see the [Downloads](https://www.tableau.com/support/releases/bridge) page. **Some data sources are not listed or missing from the client** Data sources that use Bridge refresh schedules or whose schedules have been migrated to use Bridge refresh schedules are not visible from the client. As a site admin, you can monitor data sources with Bridge refresh schedules using the Jobs page. For more information, see [About Bridge Refresh jobs](https://help.tableau.com/v0.0/online/en-us/server_backgrounder_job_management.htm#bridge). Data sources that use live queries and Bridge legacy schedules (which includes schedules created with Bridge 2020.1 and earlier) continue to display in the client. ## Locating Bridge If you can't find the Bridge client or the option to use Bridge, try one or more of the suggestions below. **Can't find the Bridge installer** To download the client, go to the [Downloads](https://www.tableau.com/support/releases/bridge) page on the Tableau website and click the download button. For more information about the Bridge installer and the installation process, see [Install Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm) topic in the Tableau Cloud Help. **Can't find Bridge on my machine** After installing the client on your machine, you can do one of the following tasks to open the client: - Double-click the Bridge shortcut (![A blue and white logo with a stylized cross symbol, representing the Tableau Bridge shortcut icon.](/tableau/next/en-us/online/en-us/Img/bridge_shortcut.png)) on your desktop. - From your desktop, in the Windows system tray, click the Bridge icon (![A white plus sign with a black outline.](/tableau/next/en-us/online/en-us/Img/bridge_tray.png)). - Using Windows file explorer, search **Tableau Bridge** to locate the client. - If Tableau Desktop is installed on the same machine as the client, open Tableau Desktop and select Server > Start Tableau Bridge Client. **Note:** This task opens the correct client if you're using Tableau Desktop 2018.2 and later. If you're using Tableau Desktop 2018.1 and earlier, using the Start Tableau Bridge Client option will cause an older version of the client to open. **Can't find the Bridge option in the publishing dialog** The reason you might not see Bridge option in the publishing dialog depends on what you are publishing to Tableau Cloud: a data source or a workbook. If you're publishing a data source: - The data source is file-based. Therefore, the option to use Bridge displays _after_ you have successful published the data source to Tableau Cloud. After you successfully publish the data source, you see the Publishing Complete dialog, which allows you to schedule refreshes for your file-based data source using Bridge while on Tableau Cloud. For more information about scheduling refreshes using Bridge while on Tableau Cloud, see [Set Up a Private Network Refresh Schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm). - The data source connects to data that Tableau Cloud can reach directly. If Tableau Cloud can reach the data directly, you don't need to use Bridge to keep the data fresh. For a list of connectors that Tableau can use to reach the data directly, see [Allow Live Connections to Data Hosted on a Cloud Platform](https://help.tableau.com/v0.0/online/en-us/to_connect_live_sql.htm#connectors). - The data source connects to data that is not supported by Bridge. For a list of connectors that Bridge can support, see [Connection types](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm#connectors). ## Resolving installation issues **Using macOS or Linux** Bridge is not supported on macOS (operating system). To use Bridge, you must use a Windows or Linux computer. For more information about other system requirements, see [Connectivity with Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm#reqs). **Local admin on the machine** The Windows user account you're logged in to must be a member of the local Administrators group. For more information about minimum installation requirements, see [Before installing Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm#before). For more information on system requirements, see [About the Bridge Client](https://help.tableau.com/v0.0/online/en-us/to_bridge_client.htm#client-requirements). ## Resolving sign-in issues **Working with multiple Tableau Cloud sites or Bridge is signed in to the incorrect site** Make sure you're entering the correct user name and password for the Tableau Cloud site that the client is associated with. If you suspect that an incorrect user name and password is saved for a site or that the client is singed in to the incorrect site, use the Unlink option in the client to remove its association with the site and to clear the password. ## Identifying causes for scheduled refresh issues There are several symptoms that can indicate that scheduled refreshes are not performing as expected. Symptoms might include, but not limited to, the following: - As the site admin or data source owner, you see an alert on Tableau Cloud that a scheduled refresh could not complete. - As the site admin or data source owner, you receive an email notification from Tableau indicating that a Bridge refresh could not complete. - As a data source owner, you receive an email notification from Tableau indicating that a Bridge refresh could not start on schedule because the Bridge client is not running. - You see an alert in the client next to the data source whose refresh could not complete. - Outdated data in the view. If any of the above symptoms apply to your situation, follow the procedure below. If the procedure doesn't resolve your issue, then try one or more of the tasks below the procedure to help identify the cause of the refresh issue. 1. Open the client, click the data source, and then click the Details button to review the error message. 2. If the error message doesn't provide enough information to resolve the refresh issue, go to the [Tableau Knowledge Base](https://www.tableau.com/support/knowledgebase) and search for the refresh issue. **Important:** If you see the "There was a problem and the data engine could not start properly" error message and you're running client version 2018.2-2018.3, Tableau strongly recommends upgrading to version 2019.1 or later. For more information, see [Error "There was problem and the data engine could not start properly"](https://kb.tableau.com/articles/Issue/error-there-was-problem-and-the-data-engine-could-not-start-properly-when-refreshing-data-in-tableau-bridge) article in the Tableau Knowledge Base. If the Tableau Knowledge Base doesn't address your specific issue, then try one or more of the following tasks: - **Validate authentication information in the client:** If a data source requires authentication, ensure that the correct database credentials are being reference by the client, even if the database credentials are already referenced in Tableau Cloud. For information about embedding database credentials in the client, see [Embed or update database credentials](https://help.tableau.com/v0.0/online/en-us/to_sync_client_settings.htm#embed-credentials). - **Upgrade the client:** Upgrade to the latest version of the client. You can get the latest version of the client from the [Downloads](https://www.tableau.com/support/releases/bridge) page on the Tableau website. For more information about installation, see [Install Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm). **Note:** Because of an issue that’s preventing Bridge 2018.2-2018.3 from performing extract refreshes, Tableau strongly recommends that you upgrade to Bridge 2019.1 or later. - **Make sure that the client is running:** Log onto the machine where client is installed and make sure the client is running. After you verify the client is running, you can run a manual refresh of the data source or wait until the next scheduled refresh. - **Confirm file-based data source uses UNC path:** If you're working with a file-based data source using Bridge legacy schedules, ensure that the client references the UNC path. For more information, see [Change the file path for a data source](https://help.tableau.com/v0.0/online/en-us/to_sync_client_settings.htm#file-path). - **Confirm whether Application mode or Service mode requirements are met:** If the client is set up to run in Application mode, you must be logged onto the machine where the client is running in order for scheduled refreshes to complete. If your client is set up to run in Service mode, you don't have to be logged on to the machine where the client is running. However, the machine must be on. - **Confirm that all connections in the data source are supported by Bridge:** If refreshing a multi-connection data source (that is, a data source that uses a cross-database join), make sure all connections in the data source are supported by Bridge. If one or more connections are not supported, Bridge is unable to refresh the data source until the unsupported connection is removed. For a list of supported connectors, see [Connection types](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm#connectors). To remove a connection from a data source, you must edit the data source in Tableau Desktop. For more information, see [Editing a Published Data Source](https://kb.tableau.com/articles/HowTo/edit-a-published-data-source) in the Tableau knowledge base. - **Manually refresh the data source:** Manually refreshing the data source can help determine whether the issue is caused by the client or by a different part of the Bridge workflow, such as publishing from Tableau Desktop or the data source itself. - **From the client** - To determine if the issue is isolated to the specific scheduled refresh or all scheduled refreshes managed by the client, do a manual refresh of the published data source from the client. 1. Open the client. 2. Hover over the data source whose schedule refresh is not working, and click the Run Now icon (![The run now icon.](/tableau/next/en-us/online/en-us/Img/bridge_runnow.png)) to manually start a refresh. If the manual refresh is successful, you have a temporary workaround for the refresh issue. If the refresh is unsuccessful, review the error in the client to help resolve the issue. - **From Tableau Desktop** - To determine whether or not the issue is a client issue or an issue with the published data source, you can do a manual refresh of the data source from Tableau Desktop. 1. Open Tableau Desktop. 2. In the Connect pane, click Tableau Server and connect to the published data source that is not refreshing. 3. From the Data menu, select the data source and then select Tableau Data Server > Refresh from Source. If the refresh from source is successful, you have temporary workaround for the refresh issue. If the refresh is unsuccessful with the same error that shows in the client, contact [Tableau Technical Support](https://www.tableau.com/support/case) on the Tableau website. - **From Tableau Desktop, create a local copy of the data source** - To determine that the issue is not with the publishing process or with Tableau Cloud in general, first create a local copy and then manually refresh the published data source. 1. Open Tableau Desktop. 2. In the Connect pane, click Tableau Server and connect to the published data source that is not refreshing. 3. From the Data menu, select the data source and then select Create Local Copy. 4. From the Data menu, select the local copy of the data source and then select Refresh. If refreshing from a local copy of the data source is successful, you have a temporary workaround for the refresh issue. The issue is likely with the publishing process. - **Refresh the data source using the Tableau Extract Command-Line Utility:** Refreshing the data source using the Tableau Extract Command-Line Utility is another method for isolating whether the issue is specific to the client or with the data source or other part of the Bridge workflow. This method can also provide an automated or temporary way of refreshing the extract. For more information about setting up and using the Tableau Extract Command-Line utility, see [Automate Extract Refresh Tasks from the Command Line](https://help.tableau.com/v0.0/online/en-us/to_refresh_extract_commandline.htm). If the refresh is successful through the command line utility, you have a temporary workaround for the refresh issue. If the refresh is unsuccessful, contact [Tableau Technical Support](https://www.tableau.com/support/case) on the Tableau website. - **Scheduled refreshes appear to be running outside of schedule:** After Tableau Cloud's upgrade to 2019.2, a data source owner might receive multiple email notifications when an upcoming scheduled refresh can't start because the client is not running. Because a data source owner can receive up to five consecutive email notifications per day for up to ten data sources that they own, it might appear the scheduled refreshes are running outside of their scheduled times. As a data source owner, you might be receiving the notifications for the following reasons: - **The machine where the client is running from is not on.** To stop notifications in this scenario, make sure the machine where the client is installed on is on and the client itself is running before the upcoming scheduled refresh is to occur. Alternatively, if the extract data source doesn't need to be refreshed regularly, consider removing the schedule and manually refreshing it from the client when needed. For more information about removing a schedule, see [Stop Keeping Data Fresh Through Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_signout_unlink.htm#remove-schedule). - **Extract data sources continue to be associated with a client that is no longer in use.** To stop notifications in this scenario, as a site admin, you can delete the client from the site. For more information, see [Stop Keeping Data Fresh Through Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_signout_unlink.htm#remove-client). If you're not a site admin, consider the following: - If the extract data source doesn't need to be refreshed, you can remove the data source from the client. For more information, see [Stop Keeping Data Fresh Through Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_signout_unlink.htm#remove-ds). - If the extract data source needs to be refreshed, albeit infrequently, you can change the client associated with that extract data source (and its schedule). For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#change-computer). **Refreshes stop responding for data sources that use JDBC-based connections** **Note:** Bridge provides limited support for data sources that use JDBC drivers to connect to unsupported databases. For more information, see [Connectivity with Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm#limited). Refreshes for extract data sources whose connections rely on JDBC-based drivers can fail with timeout errors or the refreshes themselves stop responding, or hangs, because of CPU or RAM spikes. In most cases, these refresh issues can occur when there are several concurrent refreshes of data sources that use JDBC-based connections being handled by a client on a machine that does not have sufficient hardware to support the resource-intensive JDBC-based connections. To help resolve this type of issue, review the following suggestions: - **If you’re a site admin managing the clients in your organization**, review the log files, _jprotocolserver\__ and _stdout\_jprotocolserver\__, in the Logs folder in the My Tableau Bridge repository. Then, consider doing one of the following: - Reduce the number of concurrent refreshes allowed by the client. For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#poolcapacity). - Consider increasing CPU cores and RAM on the machine running the Bridge client to better handle the resource intensive JDBC-based connections. - **If you’re the data source owner**, update the data sources to use a Tableau built-in connector instead. For more information, see [Supported Connectors](https://help.tableau.com/current/pro/desktop/en-us/exampleconnections_overview.htm) in the Tableau User Help. **Refresh issues after changing network type to Private Network** After updating the network type associated with a data source, from Tableau Cloud to Private Network or Private Network to Tableau Cloud, existing schedules associated with the data source must be recreated. For more information, see [About switching network types](https://help.tableau.com/v0.0/online/en-us/to_bridge_vpc.htm#vpc_type_change). **Refresh issues when a published data source has multiple data connections** After publishing a file-based online data source to Tableau Cloud, the extract refresh can fail when the published data source has multiple data connections. By default, Tableau Cloud uses Bridge when a published data source has multiple data connections. You can edit the connection type of extract refreshes for Bridge refresh schedules to use Tableau Cloud instead of Bridge. For more information, see [Change the connection type of a refresh to use Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/to_sync_signout_unlink.htm#use_cloud). **Refresh issues on file-based data published from Tableau Desktop on a Mac** When using 1) Tableau Desktop on a Mac, 2) publishing a file-based data source from a Windows network file share, and then 3) configuring a Bridge refresh schedule, the refreshes will fail. If this file-based data source is business critical resource for your organization, consider configuring a Bridge legacy schedule instead. For more information, see [Set up a Bridge legacy schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm#Set). ## Identifying causes for live query issues Issues around live queries are typically due to the option not being enabled or that Bridge doesn't support the data source type. **No "Live" data sources listed in the client** A few things need to happen in order for "Live" data sources to display in the client. First, the site admin has to enable pooling for the site. Second, the site admin must also add at least one client to the pool. Finally, the data source must be published with a live connection. All three factors need to happen in order for "Live" data sources to display in the client. **The option to publish with a live connection or the "Maintain connection to a live data source" option during publishing is missing** The option to use Bridge to support live queries for an private network data source must be enabled by your Tableau Cloud site admin through pooling. If the option is not available to you during publishing, consider contacting your site admin to enable the option. If you're a site admin, see [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm). You're prompted for database credentials If the data source requires authentication by the database, the credentials must be embedded in the data source at the time of publishing. If the credentials are not embedded in the data source at the time of publishing, the credentials can be added to the published data source on Tableau Cloud. 1. Sign in to Tableau Cloud and navigate to the data source. 2. From the data source page, on the Connections tab, select the check box next to the connection. 3. From the Actions menu, click Edit Connections. 4. Select the Embedded password in connection and enter the necessary database credentials. ![A window that enables the user to modify a data connection.](/tableau/next/en-us/online/en-us/Img/to_datasource_live_embedcredentials.png) **You're working with a file-based or statistical file-based data source** Bridge doesn't support data sources with live connections to file-based and statistical file-based data sources. To keep data fresh for these types of data sources, you can publish extracts and set up a refresh schedule for each data source instead. For a list of connectors that Bridge supports, see [Connection types](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm#connectors). For more information about setting up refresh schedule, see [Set Up a Private Network Refresh Schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm). **Data source doesn't display as "Live" in the client:** If the data source doesn't show as "Live" in the client, the data source was likely published as an extract. To validate that the data source was published as an extract, follow the steps below. 1. Sign in to Tableau Cloud and navigate to the data source. 2. On the data source page, check whether the data source has an "Extract Refreshes" tab or an extract icon (![Extract icon.](/tableau/next/en-us/online/en-us/Img/to_ds_extract.png)). If the data source shows the tab then it was published as an extract. ![An inventory page for a data extract with its refresh schedule.](/tableau/next/en-us/online/en-us/Img/to_datasource_extract.png) To resolve the issue, republish the data source from Tableau Desktop, ensuring that you select the Maintain connection to a live data source option. This option tells Bridge to maintain a live connection to your data. ![A dialog box for publishing a data source to Tableau Online with the option to connect live or create an extract.](/tableau/next/en-us/online/en-us/Img/to_publish_bridge_live.png) **Client is running Application mode** If you're using Bridge 2018.2 and later, after the site admin has enabled pooling, live queries are supported in both Application and Service modes. However, if the client is running Application mode, you must be logged on to keep data fresh. If you're using Bridge 2018.1 and earlier, even if live queries are enabled by the site admin, Bridge can't support live queries in Application mode. The client must be running in Service mode to support live queries. For more information about running the client in Application mode or Service mode, see [Application versus Service mode](https://help.tableau.com/v0.0/online/en-us/to_bridge_client.htm#mode). ## Understanding other common issues **Delay before list of data sources populate in client** There is a short delay, usually several seconds, populating the list of data sources in the client. This is expected behavior. The client is contacting Tableau Cloud to get the list of data sources before it can display that information. **"No linked data found" in the client** If the client shows a green indicator and "Connected" status, but also shows a "No linked data found," review the suggestions below based on the type of data source you're expecting to see. If you're expecting to see an extract data source that uses a Bridge legacy schedule listed in the client, try the following: - Validate that the extract refresh schedule is assigned to the correct client. For more information, see [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm#add-computer). If you're expecting to see a data source with a live connection or an extract data source that uses Bridge refresh schedules, try one or more of the following: - Validate that the data source was published with a live connection. 1. Sign in to Tableau Cloud and navigate to the data source. 2. From the data source page, check whether the data source has an "Extract Refreshes" tab or a extract icon (![Extract icon.](/tableau/next/en-us/online/en-us/Img/to_ds_extract.png)). If the data source shows the tab then it was published as an extract. ![An inventory page for a data extract with its refresh schedule.](/tableau/next/en-us/online/en-us/Img/to_datasource_extract.png) - Make sure at least one client is part of the pool to facilitate data sources with live connections. To do this, contact your site admin. If you're the site admin, verify that you've enabled pooling for the site and client. For more information, see [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#set-up-bridge-client). **Red indicator and "Disconnected" status in the client** If the client shows a red indicator and "Disconnected" status, try the following tasks, in the order listed: 1. In the client menu, click Repair. 2. If step 1 doesn't resolve the issue, from the Mode drop-down menu, select Application and wait a few seconds. Switch back to Service and wait a few more seconds. 3. If step 2 doesn't resolve the issue, restart the machine. Make sure that there are no scheduled refreshes that are in progress. In some cases, the client shows a red indicator and "Disconnected" status if the client is running on a machine that is "locked down." This means that the client is restricted to connecting to a minimum set of domains. For a list of the minimum set of domains that the client needs to connect to in order to work, see [Forward proxy filtering](https://help.tableau.com/v0.0/online/en-us/to_bridge_security.htm#domain_filtering). **Missing subscription emails** Data refresh-initiated [Subscriptions](https://help.tableau.com/current/online/en-us/subscribe_user.htm) are not supported for views and workbooks that rely on Bridge to keep data fresh. This means you do not receive subscription emails when the following are true: 1) subscriptions are configured for When Data Refreshes and 2) the views or workbooks you're subscribing to rely on extract data sources that refresh using Bridge. To use subscriptions in this scenario, consider configuring your subscriptions to use On Selected Schedule instead. For more information, see [Troubleshoot Subscriptions](https://help.tableau.com/v0.0/online/en-us/subscribe_trouble.htm#cant-set-subscription-frequency-to-when-data-refreshes). "**Test Connection" button doesn't support Bridge connections** Test connection only supports data sources that connect to Tableau Cloud. As an alternative to testing your connection with this button, consider running a manual refresh to test the connection instead. For more information about running a manual refresh, see [Start a Refresh Task Manually](https://help.tableau.com/v0.0/online/en-us/to_refresh_extract_manual.htm). ## Understanding common errors While using Bridge, you might see one of the following errors. _"An error occurred while communicating with Tableau Server: Tableau Bridge does not have a client configured for your site to handle live connections."_ or _"Cannot connect to database"_ This is an error that you might see when connecting to a published data source whose data freshness is being facilitated through Bridge. To resolve these errors, try the following tasks in the order listed. - Make sure the client is added to the pool. To do this, contact your site admin. If you're a site admin, verify that you've enabled pooling for the site and at least one client. For more information, see [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm#set-up-bridge-client). - Make sure the client shows a green indicator and "Connected status. If it shows a red or "Disconnected" status, see [Red indicator and "Disconnected" status in the client](#disconnected). _"This data source requires a correct file path"_ or _"Unable to refresh data source because of an unsupported operation"_ If you're working with a file-based or statistical file-based data source (that uses Bridge legacy schedules) you might see this error because the path referenced by the client is the mapped drive path instead of the UNC path. To resolve this issue, you must update the file location path in the client. For more information, see [Change the file path for a data source](https://help.tableau.com/v0.0/online/en-us/to_sync_client_settings.htm#file-path). While refreshing on Tableau Cloud, you might see the following error: **"Error: Failed to queue _n_ tasks"** This error can occur if you've selected to use the Run Now option on multiple data sources and one or more data sources connect to file data. The Run Now option can only be used for data sources that use Bridge refresh schedules. ### Virtual connections While trying to create a virtual connection, you might see one of the following errors: - **INVALID\_ARGUMENT**: "_INVALID\_ARGUMENT: Can't display the view because of Tableau Cloud site settings that affect the data source used by this view. Contact your site administrator to connect at least one Tableau Bridge client to the site._" This error can occur when there are no Bridge 2021.4 clients in a pool to perform data freshness tasks for virtual connections that connect private network data. To resolve this error, contact your site admin to ensure that version 2021.4 clients are running and in a connected state, and the pool is mapped to the domain where the underlying data is located. - **UNKNOWN**: "_UNKNOWN: There was an unknown connection error to the database. The error message below has additional information, but you might need to ask the database administrator to review the database logs._" This error can occur when the domain where the underlying data of the virtual connection is located does not map to a specific Bridge pool. To resolve this error, contact your site admin to ensure that the domain where the underlying data is located is mapped to a Bridge pool and at there is at least one Bridge 2021.4 client running, in a connected state, and is assigned to a pool. ## Preparing and sending log files to Tableau Technical Support If the troubleshooting steps in this article don't help isolate or solve the issue you're having with Bridge, you can contact Tableau for help. Before you contact Tableau for help, consider following the steps below to gather and send the necessary Bridge client log files that Tableau will needs to diagnose and help resolve the issue. ### Prepare clean log files **On Windows client:** 1. On the machine, close the client: - If your client is running Application mode, from the client menu, select Exit. - If your client is running Service mode, change the client to Application mode, and then from the client menu, select Exit. 2. Go to and open the **My Tableau Bridge Repository** folder. The default location of the My Tableau Bridge Repository folder is C:\\Users\\jsmith\\Documents\\My Tableau Bridge Repository. 3. In the My Tableau Repository folder, rename the **Log** folder. For example, Logs\_archive. By changing the name of this folder, the client will create a new "Logs" folder. 4. Open the Command Prompt as an admin. 5. Change to the Tableau Bridge bin folder. For example: C:\\Program Files\\Tableau\\Tableau Bridge\\bin. 6. Run the following command: `TabBridgeClient.exe -DLogLevel=Debug` **Note:** The above command is case-sensitive. If the command is not typed exactly as written, the log files will not capture the issue at the level of detail that is necessary to help diagnose the issue. After this step, the client opens automatically. **On Linux clients (Containers):** 1. Open a shell terminal session as the root administrative user and set the log environment variable: `export TAB_ENV_LOGLEVEL=debug` This command is case sensitive. 2. Launch the Bridge application service. export TAB\_ENV\_LOGLEVEL=debug ### Reproduce the issue After you prepare the client to create new log files, try to reproduce the issue you're having with Bridge. By reproducing the issue, the new log files can capture specific details about the issue. These details are essential for Tableau to have in order to isolate, diagnose, and resolve the problem. ### Send log files 1. After the issue has been reproduced, right-click the Bridge icon in the Windows system tray and select Exit to stop Bridge. This step ensures that all errors are recorded in the log file. 2. Using Windows file explorer, go to and open the **My Tableau Bridge Repository** folder. 3. Right-click the **Logs** folder and select **Send to** > **Compressed (zipped) folder**. 4. Contact [Tableau Technical Support](https://www.tableau.com/support/case) on the Tableau website. **Note:** If the .zip file you created in step 2 is larger than 5 MB, see [Sending Large Files](https://kb.tableau.com/articles/howto/alternative-method-for-sending-large-files) in the Tableau Knowledge Base. 5. Locate and start Bridge. If the client was previously running in Service mode, ensure that Service is selected in the client. ## Troubleshooting Draining Issues ### Draining does not run - **Check Configuration**: Verify that `enableDraining` is active in the configuration file used by the running process. - **Verify Stop Method**: Ensure the container was stopped gracefully (`docker stop`, `podman stop`,and pod deletion) rather than forcefully terminated (`docker kill`, `kill -9`, or a grace period of 0). - **Check Grace Period**: Confirm that the orchestrator grace period was long enough to allow draining to begin. ### Refreshes fail during container shutdown - **Extend Orchestrator Timeout**: Ensure your container runtime’s grace period (`--time` or `terminationGracePeriodSeconds`) is set to a higher value than `drainingTimeOutInSeconds`. - **Inspect Logs for Timeout Clamps**: Review logs to confirm the effective timeout duration matches your configured value. - **Review Specific Job Errors**: Check job execution logs on Tableau Cloud to determine if the failure was caused by a premature `SIGKILL` or an external refresh error. [Skip to main content](#main-content) # Troubleshoot Refresh Issues When Tableau Cloud is unable to complete a scheduled refresh, an alert appears to indicate that the refresh has failed. If a scheduled refresh fails five consecutive times, Tableau Cloud suspends the refresh. When a refresh is suspended, Tableau Cloud does not try to run it again until you take an action that attempts to correct the cause of the failure. To display an alert that describes the reason the refresh failed, select the notification icon (![A new notification icon.](/tableau/next/en-us/online/en-us/Img/notification_indicator.png)) in the upper-right corner of the browser window. ### Resolve errors and resume suspended refreshes To help resolve refresh issues, you can take any of these actions, based on the cause indicated in the alert: - **Errors related to access token validation or user credentials** To correct these issues, click the Connection Details link in the alert to go to the Connection tab on the data source page for the data source whose scheduled failed. On the Connections tab, select the check box next to the data connection, and click Edit Connection so you can update a user name or password, or select a different access token. After you update the connection information, Tableau Cloud restarts the refresh schedule. ![Edit Connection for a data extract.](/tableau/next/en-us/online/en-us/Img/refresh_troubleshoot_connectionstab.png) If you originally embedded the credentials or other data connection information when you published the workbook or data source from Tableau Desktop, you can also republish the workbook or data source. As part of the publishing process, you can choose to set a new refresh schedule. Otherwise, Tableau Cloud restarts the existing schedule. - **Errors that indicate the database was unreachable** Confirm that the underlying database is online and that you can sign in to access its data. You can use the Try again link in the alert to restart the refresh schedule. - **Errors related to Tableau Bridge** To troubleshoot errors related to Bridge, see [Troubleshoot Private Network Issues](https://help.tableau.com/v0.0/online/en-us/to_bridge_troubleshoot.htm). - **Errors related to Tableau Prep** To troubleshoot error related to Tableau Prep, see [Monitor Flow Health](https://help.tableau.com/current/online/en-us/prep_conductor_monitor_flow.htm). [Skip to main content](#main-content) # Troubleshoot SAML This topic provides information about resolving issues that can occur when you configure SAML authentication. ## Required assertions and metadata do not map correctly Most issues occur because metadata that you import from the IdP, or assertion names that you enter, do not match the corresponding IdP attributes. To troubleshoot SAML issues, start by making sure the information shown in steps 1–5 in Tableau Cloud or steps 1-4 in TCM of the Authentication page matches the IdP’s SAML configuration settings. Tableau Cloud or TCM requires the IdP assertion that contains username. In addition to checking steps 2-5 in Tableau Cloud or steps 2-4 in TCM, make sure that users' usernames match between Tableau Cloud and the IdP. ## Identity provider does not display sign-in page A user provides their username on the Tableau Cloud or TCM sign-in page, Tableau redirects the request to the identity provider (IdP), but the IdP does not return its SAML sign-in page. The IdP can fail to return the sign-in page for any of the following reasons: - SSO service URL is not valid. When you import the IdP metadata, make sure the SSO Service URL field shows the correct URL. - The IdP does not recognize the authentication request received. For example, the Tableau Cloud or TCM entity ID might be incorrect. This can occur if SAML configuration settings on the Authentication page have become corrupted or inadvertently changed. To resolve the issue, repeat Steps 1–2 of the SAML configuration: 1. Sign in to your IdP account and export the IdP metadata. 2. Do one of the following: - Sign in to Tableau Cloud, go to Settings > Authentication page, next to the authentication configuration, click the Actions menu and select Edit. On the Edit Configuration page, in step 2, re-import and upload the metadata. - Sign in to TCM, go to Settings > Authentication page, under the SAML authentication type, click the Configuration (required) drop-down arrow. In step 2, re-import and upload the metadata. ## Nothing happens after IdP sign-in If a user provides incorrect credentials on the IdP’s sign-in page, or if the user is not authorized to use SAML, some IdPs will not return control to Tableau when authentication fails. In Tableau Cloud, on the Users page, you can see whether a user is authorized for SAML authentication. ![](/tableau/next/en-us/online/en-us/Img/saml_site_troubleshoot1.png) ## Full Name field shows users’ email addresses For a SAML site, the Full Name field is populated with the email address if the assertions for first and last name or full name are not provided in step 3\. Map attributes of the SAML settings in the Authentication page. ## Unable to authenticate users when using single sign-on SAML authentication takes place outside Tableau, so troubleshooting authentication issues can be difficult. However, login attempts are logged by Tableau Cloud. You can create a snapshot of log files and use them to troubleshoot problems. If a user is having trouble being authenticated on Tableau Cloud, you should examine the log file to ensure that username attribute values returned by the IdP match the usernames of users. To download the log file: 1. Sign in to Tableau Cloud or TCM. 2. Go to Settings > Authentication page, and do one of the following: - In Tableau Cloud, next to the authentication configuration, click the Actions menu and select Edit. Under step 7\. Test configuration, under Troubleshoot SAML, click the Download Log button. - In TCM, under the SAML authentication type, click the Configuration (required) drop-down arrow. Under step 6\. Test configuration, under Troubleshoot SAML, click the Download Log button. ## Signing in through command line utilities SAML is not used for authentication when you sign in to Tableau Cloud using [tabcmd](https://help.tableau.com/v0.0/online/en-us/tabcmd.htm), even if Tableau Cloud is configured to use SAML. This tool require personal access tokens.. [Skip to main content](#main-content) # Troubleshoot Subscriptions ## "The view snapshot in this email could not be properly rendered." If you receive a subscription with this error message, there could be several reasons: - **Missing credentials**: Some views are published with embedded credentials. You may receive the above error if the embedded credentials are now out-of-date, or if the view was republished without the embedded credentials. - **Database temporarily down**: If the view has a live database connection and the database was temporarily down when the subscription was being generated, you might receive the above error. ## Can't see images in email For images of content to display in a subscription email, users subscribed to views, in addition to View permissions, must also have Download Image/PDF permissions. For more information, see [Permissions](https://help.tableau.com/v0.0/online/en-us/permissions.htm#permissioncapabilities). ## Can't see extensions or Pulse objects Starting in Tableau Cloud 2026.1, subscriptions now support many extensions. However, they may appear blank in your subscription email or attachment if they don't meet certain criteria: - **Extension type:** Only Tableau Trusted Extensions (available in the Tableau Exchange) and Pulse Dashboard Objects are supported. If the dashboard uses a Network-Enabled extension, that zone will appear blank in the subscription image. - **View state:** Subscriptions are rendered based on the published version of the view or a saved Custom View. If you have made unsaved changes or selections, they will not appear in the subscription email. - **Format:** Subscriptions only support these objects when the message includes an image. These objects don't currently render in PDF attachments. - **Workbook saving:** If you recently added a Viz Extension via Web Authoring, ensure the workbook is saved; otherwise, the subscription engine can’t access the new content. ## Can't subscribe If you can see a view on Tableau Server and it has a subscription icon (![Subscribe icon.](/tableau/next/en-us/online/en-us/Img/subscribe_icon.png)) in the upper right corner, you can subscribe to it. To subscribe to a view, the view you're subscribing to must either have embedded credentials for its data source or not rely on credentials at all. Examples of the latter include a workbook that connects to an extract that isn't being refreshed, or a workbook whose data is in a file that was included with the workbook at publish time. Embedding credentials is a step that happens in Tableau Desktop (see the [Tableau Help](https://help.tableau.com/current/pro/desktop/en-us/publishing_sharing_authentication.htm) for details). ## No subscription icon It's possible to see a view but be unable to subscribe to it. This can happen : - **The view uses a live database connection**: Views with live database connections, where you’re prompted for your database credentials when you first click the view, aren't available for subscription. A subscription includes a view (or workbook), data, and a schedule. To deliver the data required for the view, Tableau Server either needs embedded database credentials or data that doesn't require credentials. Where live database connections are concerned, Tableau Server doesn't have the credentials, only the individual users do. This is why you can only subscribe to views that either don’t require credentials or have them embedded. - **A live database connection uses OAuth authentication**: A user may not be able to subscribe to the view if the OAuth credential isn’t embedded with the Live data source or saved with the user keychain, or if the OAuth refresh token has expired. ## Missing attachments You can add a PDF attachment to your subscription if your administrator has it enabled. If the PDF attachment is missing from your subscription, it might be because the size of the PDF exceeds the email size limit. In Tableau Cloud, each site has a maximum email size of 2MB. For details, see [Tableau Cloud Capacity](https://help.tableau.com/v0.0/online/en-us/to_site_capacity.htm). Starting in Tableau 2024.1, you can send emails with your own sending server, which allows you to send attachments with a maximum email size of 10MB. To enable this feature, navigate to site settings, find the Customize Email Notifications section, and check the box next to Use your SMTP server. Note: If you're using your own sending server, Tableau will attempt to send a subscription email with a subset of the attachment that is under the 10MB limit, but this isn’t guaranteed. If Tableau can't send the attachment, you'll see a message letting you know that the attachment is too large to send. ## Suspended Subscriptions By default, a subscription is suspended after 5 consecutive subscription failures. ### Resume suspended subscriptions Subscription owners can resume subscriptions: - from My Subscription tab in Content Settings - from the Subscriptions tab per workbook When a subscription is resumed, the alert failing count goes back to zero. The next evaluation of the subscription will occur at the next scheduled evaluation time. ### Can't set subscription frequency to "When Data Refreshes" You can set subscriptions to run when an extract refreshes if the workbook uses a connection to a published extract. When creating or modifying a subscription, you might not see a Frequency option if the workbook uses: - An extract refresh through Tableau Bridge - More than one extract refresh - A live data connection **Note**: If a workbook's data source contains multiple connections where one connection is to a published extract and the other connection requires Tableau Bridge, you might be able to set the subscription frequency to When Data Refreshes. If selected, the subscription will run on the extract refresh, not the Tableau Bridge refresh. ## Missing data quality warnings or sensitivity labels Data quality warnings and sensitivity labels are included in subscription emails when: - Tableau Server or Tableau Cloud is licensed with Data Management. For more information, see [About Data Management](https://help.tableau.com/v0.0/online/en-us/dm_overview.htm). - Tableau Catalog is enabled. For more information, see [Enable Tableau Catalog](https://help.tableau.com/v0.0/online/en-us/dm_catalog_enable.htm). - In site settings, the check box under High-Visibility Data Labels in View and Workbook Subscriptions is selected. (In earlier versions, the check box is under Data Quality Warnings in Subscriptions.) [Skip to main content](#main-content) # Try Tableau Agent in Pulse **Note:** Enhanced Q&A (Discover) has been renamed to Tableau Agent in Pulse. The functionality remains the same. Only the name has changed. You'll see the name change in upcoming releases. Try AI is a 60-day trial of Tableau Agent in Pulse for existing Tableau Cloud sites. With Tableau Agent in Pulse, your users have a conversational way to explore groups of metrics and get insights. During the trial, there’s no limit to the number of questions that your users can ask. For more information about Tableau Agent in Pulse, see [Ask Questions and Discover Insights in Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm). Outside of the trial, Tableau Agent in Pulse requires a Tableau+ license edition. After the trial ends, contact your sales representative to purchase a Tableau+ license edition and give your users continued access. Try AI is the only way to test Tableau Agent in Pulse on an existing Tableau site. Try AI doesn't provide access to other AI in Tableau features, such as Tableau Agent in web authoring or Tableau Prep. The only way to test those AI in Tableau features is with a trial of a new Tableau Cloud site. There isn’t a way to test those features on an existing Tableau site. For more information, see [Turn on AI in Tableau with a Tableau Cloud new site trial](https://help.tableau.com/v0.0/online/en-us/setup_tabAI_site_setting.htm#GenAI_trial). The two additional AI in Tableau features for Tableau Pulse are insight summaries and semantic matching when asking questions. These features are available without a Tableau+ license edition, so you don’t need Try AI to turn them on. ## How AI in Tableau protects your data Tableau Agent in Pulse is built on top of the Salesforce Einstein Trust Layer, which keeps your data secure. Additionally, Tableau Agent in Pulse uses Azure OpenAI to ensure data residency and geoscaling. The Einstein Trust Layer detects sensitive data such as personally identifiable information (PII) and automatically masks that PII before sending prompts to the large language model (LLM). Your data isn't retained by the LLM provider or used to train the LLM. To learn more about how AI in Tableau secures your data, see [AI in Tableau and Data Usage](https://help.tableau.com/current/tableau/en-us/tableau_gai_data.htm), [AI in Tableau and Trust](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust.htm), and [AI in Tableau and the Einstein Trust Layer](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust_layer.htm). The Einstein Trust Layer collects prompt and response data as well as feedback data. This information is stored securely in Salesforce Data 360 for audit purposes but isn’t shared with the LLM provider. To learn about the data that the Einstein Trust Layer collects, see [About Generative AI Audit and Feedback Data](https://help.salesforce.com/s/articleView?language=en_US&id=ai.generative_ai_feedback_about.htm&type=5). ## Start your trial of Tableau Agent in Pulse Before starting the trial, make sure that Tableau Pulse is already set up on your site. To learn how to turn on Tableau Pulse, see [Set Up Your Site for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm). There’s no way to pause the trial after it starts. Even if you turn off Tableau Agent in Pulse or turn off Tableau Pulse entirely, the trial continues to run. 1. On the Tableau Cloud navigation panel, select Settings. 2. Under AI in Tableau > Try AI, select Start Free Trial. Starting the trial also turns on Tableau Agent in Pulse for your site. 3. At the top of the settings page, select Save. > [!TIP] > > Tableau Agent in Pulse was formerly known as enhanced Q&A / Discover. The site settings might display the former name. There's no further configuration required for the trial. AI in Tableau is powered by Einstein generative AI in Salesforce, but you don’t need to connect your Tableau site to Salesforce for the duration of the trial. The trial automatically connects to a shared Salesforce org, which is the same way that Tableau Pulse insight summaries are powered. ### Next steps after the trial ends Users lose access to Tableau Agent in Pulse when the trial ends. If users interact with old email digests that have links to Tableau Agent in Pulse, those links will no longer launch the Tableau Agent in Pulse experience. During the trial, when Tableau Agent in Pulse answers a question, it automatically creates metrics and suggests that users follow those metrics. Users do retain access to any metrics that are created during the trial. You can purchase a Tableau+ license edition to give your users continued access to Tableau Agent in Pulse. If you purchase a Tableau+ license edition, you’ll be provisioned with a dedicated Salesforce org to power Tableau Agent in Pulse. At that point, you’ll connect your Tableau site to your dedicated Salesforce org. For information about setting up your Salesforce org and connecting it to Tableau after the trial, see [Configure Tableau Cloud sites for AI](https://help.tableau.com/v0.0/online/en-us/setup_tabAI_site_setting.htm#GenAI_config_SF_Tab). ## Limit the trial to specific user groups (optional) By default, Tableau Agent in Pulse is available for all users on your site. If you want only a subset of your users to be able to test Tableau Agent in Pulse, limit access to specific user groups. 1. On the Tableau Cloud navigation panel, select Settings. 2. Under AI in Tableau > AI Settings by Feature, select the Actions (...) menu for Tableau Pulse: Uses Pulse Discover for an in-depth, integrated exploration of groups of metrics and insights. 3. Select User Access. 4. Select the user groups to limit access to, then select Apply. 5. At the top of the settings page, select Save. ## Onboard your users For your users to get the most out of Tableau Agent in Pulse, make sure that they're following metrics that they can explore, and help them understand the types of questions that they can ask. - For information about creating metric definitions and metrics, see [Create Metrics with Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm). - For information about adding followers to metrics, see [Manage followers](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#Manage). - For information about how to access Tableau Agent in Pulse, see [Explore groups of metrics with Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm#Explore). - For information about the types of questions that Tableau Agent in Pulse can answer, see [Example questions for Tableau Agent in Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_ask_discover_qa.htm#example-questions). [Skip to main content](#main-content) # TS Events Data Source TS Events functions as a primary audit data source. It contains data about the various events happening on your site, including sign-in, publishing, and accessing views. ## Create custom views If you're a site admin or someone who has been granted access to the Admin Insights project, you can access the Admin Insights data sources directly from Tableau Cloud using Web Authoring or through Tableau Desktop to build custom views. For more information about connecting to Admin Insights data sources, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Example: What are the most popular views? Use the following steps to create a view that displays the most popular views on the site. 1. Connect to the TS Events data source. 2. From the Data pane, drag Item Name to the Rows shelf and Number of Events to the Columns shelf. 3. From the Data pane, drag Item Type to the Filters shelf, and select the View checkbox. ## Do more with your data Using Tableau Prep, you can join TS Events with other Admin Insights data sources on the following fields to get more visibility into your site. If you're analyzing data from multiple Tableau Cloud sites, you must also join on "Site LUID = Site LUID". - Join TS Events to TS Users on "Actor User ID = User ID" - Join TS Events to Site Content on "Item ID = Item ID" and "Item Type = Item Type" For more information, see [Aggregate, Join, or Union Data](https://help.tableau.com/current/prep/en-us/prep_combine.htm) in Tableau Prep Help. ## Data schema The following table lists the fields included in the TS Events data source. Each row of data correlates with a single event that occurs on the Tableau Cloud site.

Folder	Field Name	Type	Description
Who Acted	Actor License Role	String	The license role for the user who initiated the event; one of Creator, Explorer or Viewer.
	Actor Site Role	String	The site role for the user who initiated the event
	Actor User Id	Number	The user id of the user who initiated the event.
	Actor User Name	String	The email address of the user who initiated the event
	Target User Id	Number	The user ID of the user who was the target of the event.
What Was Acted Upon	Historical Item Name	String	The name of the Data Source or Workbook the event was performed against, at the time that the event was performed.
	Historical Item Repository Url	String	A unique, url-style path to the Data Source, Workbook, or View that the event was performed against. This value preserves the historical path of an item during the time the event was performed.
	Historical Project Name	String	The name of the Project within which the event took place, as it was named at the time of the event.
	Item Id	Number	The Id of the Data Source, Workbook or View the event was performed against.
	Item LUID	String	The LUID of the data source, workbook, or view the events was performed against.
	Item Type	String	If the event was performed against content, the value is Data Source, Workbook, or View. Item Type will be NULL if the event wasn't performed against content.
	Item Name	String	Display name of the item included in the subscription. The current name of the Data Source or Workbook the event was performed against.
	Item Owner Email	String	Email address of the item owner. The email of the user who currently owns the View, Datasource or Workbook the event was performed against.
	Item Owner Id	Number	The Id of the user who currently owns the View, Datasource or Workbook the event was performed against.
	Item Repository Url	String	A unique, url-style path to the Data Source, Workbook or View that the event was performed against. This value describes the CURRENT path an item is available at. It will be NULL if the event was not performed against one of the three items listed above, or if the item has since been deleted.
	Project Name	String	The current name of the Project the event took place in, if it was performed against content.
	Site Luid	String	The Luid of the Site on which the event took place
	Site Name	String	The name of the Site on which the event took place
	Workbook Name	String	The name of the Workbook the event was performed against, at the time that the event was performed.
What Action Was Taken	Event Date	Date-time	The date and time that the event in question took place, in UTC.
	Event Date (local)	Date-time	The date and time that the event in question took place, adjusted by the Timezone parameter you've set. Note: For older data, a simple adjustment like this will not be accurate if your timezone uses Daylight Savings.
	Event Id	Number	Unique identifier for the event.
	Event Name	String	The name of the specific event that occurred.
	Event Type	String	Events are grouped together into action types, such as Create, Access, Update and Delete.
-	Admin Insights Published At	Date-time	Date and time the Admin Insights data source was last published in UTC
	Count of Distinct Actors	Calculated field	Measure representing the count of unique actors (users initiating the events).
	Number of Events	Calculated field	Measure representing the total number of events

[Skip to main content](#main-content) # TS Users Data Source TS Users contains data about your users, such as remaining licenses, site roles, and workbooks owned by a user. Starting May 2023, TS Users includes product activation and usage data for Tableau Desktop, Tableau Prep, web authoring, and site role-specific capabilities. If a user's site role is changed to unlicensed, their information remains in the TS Users data source. However, when a user is removed from the site, their information is also removed from TS Users within 36 hours. ## Create custom views If you're a site admin or someone who has been granted access to the Admin Insights project, you can access the Admin Insights data sources directly from Tableau Cloud using Web Authoring or through Tableau Desktop to build custom views. For more information about connecting to Admin Insights data sources, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Example: How many licenses are being used? Use the following steps to create a view that displays the number of licenses used. 1. Connect to the TS Users data source. 2. From the Data pane, drag Measure Names to the Rows shelf and Measure Values to the Columns shelf. 3. Right-click the Measure Names field in the Rows shelf and select Show Filter. 4. Click the Measure Names filter dropdown menu, and select Customize > Show Apply Button. 5. In the filter, select the Total Allowed Licenses and Total Occupied Licenses checkboxes, and then click Apply. ## Do more with your data Using Tableau Prep, you can join TS Users with other Admin Insights data sources on the following fields to get more visibility into your site. If you're analyzing data from multiple Tableau Cloud sites, you must also join on "Site LUID = Site LUID". - Join TS Users to Groups on "User LUID = User LUID" - Join TS Users to TS Events on "User ID = Actor User Id" - Join TS Users to Site Content on "User Email = Owner Email" or "User Email = Item Parent Project Owner Email" For more information, see [Aggregate, Join, or Union Data](https://help.tableau.com/current/prep/en-us/prep_combine.htm) in Tableau Prep Help. ## Data schema The following table lists the fields included in the TS Users data source. Each row of data corresponds to a unique user on the Tableau Cloud site.

Folder	Field Name	Type	Description
License Utilization	Allowed Creators	Number	Total number of allowed Creator licenses
	Allowed Explorers	Number	Total number of purchased Explorer licenses
	Allowed Viewers	Number	Total number of purchased Viewer licenses
	Occupied Creator Licenses	Calculated field	Number of occupied Creator licenses
	Occupied Explorer Licenses	Calculated field	Number of occupied Explorer licenses
	Occupied Viewer Licenses	Calculated field	Number of occupied Viewer licenses
	Total Allowed Licenses	Number	Total number of allowed licenses
	Total Occupied Licenses	Calculated field	Total number of occupied licenses
	Total Remaining Licenses	Calculated field	Total number of remaining licenses
Site	Site Luid	String	LUID of the site associated with the user. Primarily useful for referencing sites in the Tableau Server API.
	Site Name	String	Name of the Tableau Cloud site
	Site Version	String	The version of Tableau Server running on the Tableau Cloud pod that hosts your site
Traffic to Content - Historical	Total Traffic - Data Sources	Number	Total number of times the user's data sources were accessed
	Total Traffic - Views	Number	Total number of times the user's views were accessed
	Unique Visitors - Data Sources	Number	Number of unique users who accessed the user's data sources
	Unique Visitors - Views	Number	Number of unique users who accessed the user's views
User	User Creation Date	Date-time	Date and time the user's account was created in UTC
	User Email	String	Email address associated with the user's account
	User Friendly Name	String	User friendly name associated with the user's account
	User ID	Number	Internal ID of the user
	User License Type	String	User-based license associated with the user: Viewer, Explorer, or Creator.
	User LUID	String	LUID of the user. Primarily useful for referencing users in the Tableau Server API
	User Name	String	User name associated with the user's account.
	User Site Role	String	Site role of the user. Determines the maximum level of access a user can have on the site.
User Activity - Historical	Access Events - Data Sources	Number	Number of times the user accessed a published data source.
	Access Events - Views	Number	Number of times the user accessed a view.
	Publish Events - Data Sources	Number	Number of times the user published a data source.
	Publish Events - Workbooks	Number	Number of times the user published a workbook.
User Activity - Most Recent Event	Data Source - Last Access Date	Date-time	Date and time the user last accessed a published data source in UTC
	Data Source - Last Publish Date	Date-time	Date and time the user last published a published data source in UTC
	Last Login Date	Date-time	Date and time the user last logged in, in UTC.
	Tableau Desktop - Last Access Date	Date-time	Date and time the user last connected to Tableau Cloud from Tableau Desktop in UTC. Only recorded when using login-based license management (LBLM) to activate Tableau Desktop.
	Tableau Desktop - Last Access Date (Local)	Date-time	Date and time the user last connected to Tableau Cloud from Tableau Desktop, adjusted by the Timezone parameter. Only recorded when using login-based license management (LBLM) to activate Tableau Desktop.
	Tableau Desktop - Last Product Version	String	Version of Tableau Desktop that was last used to connect to Tableau Cloud. Only recorded when using login-based license management (LBLM) to activate Tableau Desktop.
	Tableau Prep - Last Access Date	Date-time	Date and time the user last connected to Tableau Cloud from Tableau Prep in UTC. Only recorded when using login-based license management (LBLM) to activate Tableau Prep.
	Tableau Prep - Last Access Date (Local)	Date-time	Date and time the user last connected to Tableau Cloud from Tableau Prep, adjusted by the Timezone parameter. Only recorded when using login-based license management (LBLM) to activate Tableau Prep.
	Tableau Prep - Last Product Version	String	Version of Tableau Prep that was last used to connect to Tableau Cloud. Only recorded when using login-based license management (LBLM) to activate Tableau Prep.
	View - Last Access Date	Date-time	Date and time the user last accessed a view, in UTC.
	Web Authoring - Last Access Date	Date-time	Date and time the user last accessed the web authoring environment in UTC.
	Web Authoring - Last Access Date (Local)	Date-time	Date and time the user last accessed the web authoring environment, adjusted by the Timezone parameter.
	Web Authoring - Last Publish Date	Date-time	Date and time the user last published a workbook, in UTC
User Content	Certified Data Sources	Number	Number of certified data sources the user owns.
	Data Sources	Number	Number of published data sources the user owns
	Projects	Number	Number of projects the user owns.
	Size of Data Sources (MB)	Number	The combined size of all published data sources owned by the user, in megabytes.
	Size of Workbooks (MB)	Number	Combined size of all workbooks owned by the user, in megabytes.
	Views	Number	Number of views the user owns.
	Workbooks	Number	Number of workbooks the user owns.
User Metrics	Days Since Last Login	Number	Number of days since the user last logged in.
User Metrics	User Account Age	Number	Number of days since the user's account was created
-	Admin Insights Published At	Date-time	Date and time the Admin Insights data source was last published in UTC

[Skip to main content](#main-content) # Turn On AI in Your Tableau Cloud Site > [!WARNING] > > As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged. AI in Tableau brings trusted generative AI capabilities to the entire Tableau platform. AI in Tableau can enhance your data analysis by suggesting steps to help you clean your data in Tableau Prep flows, creating calculations for Tableau Prep flows or when building a viz, recommending insightful questions to explore your data, summarizing key metrics, and creating compelling visualizations directly from your data sets. AI in Tableau is powered by generative AI and inherits the [Einstein Trust Layer](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust_layer.htm) and security controls. To learn more about AI in Tableau, see [AI in Tableau](https://help.tableau.com/current/tableau/en-us/about_tableau_gai.htm). For general information about Einstein Generative AI, see [About Einstein Generative AI](https://help.salesforce.com/s/articleView?id=ai.generative_ai_about.htm&type=5) in the Salesforce help. This topic includes procedures for three different scenarios and walks you through the steps necessary to configure AI for use in Tableau Cloud in each of those scenarios. The steps you follow depend on what you are trying to do: - **Trial customers:** If you are trying AI in Tableau with a trial, go to the instruction later in this topic: [Turn on AI in Tableau with a Tableau Cloud new site trial](#GenAI_trial). - **Tableau Pulse customers:** Tableau Cloud administrators can turn on insight summaries and better semantic matching for Ask Q&A in Tableau Pulse. For details, see [AI in Tableau for Tableau Pulse](https://help.tableau.com/current/online/en-us/pulse_set_up.htm#tableau-ai-in-tableau-pulse). - **Tableau Cloud+ and Tableau+ customers:** Tableau Cloud+ and Tableau+ customers can configure Tableau Agent in Pulse, as well as other generative AI and Tableau Agent features. These features require additional configuration steps in Salesforce and are described in [Configure Tableau Cloud sites for AI](#GenAI_config_SF_Tab). **Accessing Tableau Agent in other applications** - **Tableau Desktop** (version 2025.1 and later): Users who are signed into a Tableau Cloud site with Tableau Cloud+ or Tableau+ with AI enabled will be able to access Tableau Agent and configure settings for Tableau Agent in Dashboards (version 2026.2.4 and later). For more details, see [Build Views and Explore Data with Tableau Agent](https://help.tableau.com/current/pro/desktop/en-us/desktop_einstein.htm) in the Tableau Desktop and Web Authoring Help. - **Tableau Prep** (version 2025.2 and later): Users who are signed into a Tableau Cloud site with Tableau Cloud+ or Tableau+ with AI enabled will be able to access Tableau Agent in Tableau Prep Builder and in Tableau Cloud for Tableau Prep web authoring to help clean and transform your data. For more details about this feature, see [Build Tableau Prep flows with Tableau Agent](https://help.tableau.com/current/prep/en-us/prep_einstein.htm) in the Tableau Prep help. - **Tableau Server** (version 2025.3 and later): Use Tableau Agent when you connect to Tableau Server with AI enabled. For more information about using Tableau Agent with Tableau Server, see [Turn on AI in Your Tableau Server Site](https://help.tableau.com/current/server/en-us/sites_gai_server.htm). ## Prerequisites for Enabling AI in Tableau Cloud **Note**: AI in Tableau is not available for Government Cloud users. Tableau Cloud customers have a few options for configuring generative AI in their sites. The necessary steps depend on what features you have access to and want to use. - Tableau Pulse features such as insight summaries and better semantic matching for Ask Q&A, need to be turned on in Tableau Cloud site settings, but don't require you to log into a Salesforce org. - Tableau Agent in Pulse must be turned on in Tableau Cloud site settings, and also requires a connection to a Salesforce org. For more information, see [Configure Tableau Cloud sites for AI](#GenAI_config_SF_Tab) and [AI in Tableau for Tableau Pulse](https://help.tableau.com/v0.0/online/en-us/pulse_set_up.htm#tableau-ai). - To use generative AI with other features such as Tableau Cloud web authoring, Tableau Prep, and Tableau Catalog you must have Tableau Cloud+ or Tableau+, and configuration is necessary in both Tableau and in Salesforce. For instructions, see [Configure Tableau Cloud sites for AI](#GenAI_config_SF_Tab). To turn on AI in Tableau for these features, you'll need the following: - A Tableau Cloud site with Tableau Cloud+ or Tableau+. For more information, see [About Tableau Cloud+ Edition](https://help.tableau.com/current/online/en-us/to_tab_cloud_plus_features.htm) or [About Tableau+](https://help.tableau.com/current/online/en-us/to_tab_plus_features.htm) - A Salesforce org that has Einstein generative AI set up. When you purchase Tableau Cloud+ or Tableau+ a Salesforce org is provisioned for you if you don't already have one, but you'll need to configure it for Einstein generative AI. The instructions below walk you through this. - A Data Cloud instance. When you purchase Tableau Cloud+ Tableau+ a Data Cloud instance is provided if you do not already have one. - The proper permissions and credentials for Tableau and Salesforce. These are explained below. For complete instructions go to [Configure Tableau Cloud sites for AI](#GenAI_config_SF_Tab) below. ### Permissions and credentials to connect Tableau and Salesforce To connect your Salesforce Org to your Tableau Site, you'll need user credentials with the following roles and permissions: - **Tableau**: _Tableau Cloud Site Administrator (Explorer or Creator)_ role. For more information about setting this site role and its permissions, see [Set Users' Site Roles](https://help.tableau.com/current/online/en-us/users_site_roles.htm). - **Salesforce**: _Customize Application Profile_ permission. For more information about this permission, see [User capabilities with 'Customize Application' Profile permission](https://help.salesforce.com/s/articleView?id=000386451&type=1) in the Salesforce help. If you get an error "API\_CURRENTLY\_DISABLED: API is disabled for this User" when trying to connect to your Salesforce org, check the user profile under System > System Permissions and make sure that the API Enabled check box is selected. **Note**: When the Salesforce Org is provisioned for Tableau Cloud+ or Tableau+ customers, the admin user that is created should already have the Customize Application permission assigned. For more information about this permission, see [Custom Permissions](https://help.salesforce.com/s/articleView?id=sf.custom_perms_overview.htm&type=5), and [Grant Permissions on Custom Settings](https://help.salesforce.com/s/articleView?id=sf.cs_grant_permission.htm&type=5) in the Salesforce help. ## Configure Tableau Cloud sites for AI To take full advantage of generative AI in Tableau, you must make configuration changes in both Salesforce and your Tableau Cloud site. This is a multi-step process and the following procedures describe how to do this. These options are available to Tableau+ customers. Briefly, the configuration includes two main parts, setting up Einstein generative AI in Salesforce, and then setting it up in your Tableau Cloud site. **Note**: If you have an existing instance of Salesforce with Tableau+, you'll need to work with your Salesforce Admin to ensure proper configuration of the Salesforce org. After the Salesforce admin has completed configuration of the Salesforce org, they can provide a set of credentials for a Salesforce user with the required permissions to the Tableau admin. The Tableau admin can then use those credentials to enable the connection for AI in Tableau and that Salesforce org. Here is an outline of these steps, followed by detailed instructions: - Set up Einstein generative AI in Salesforce: [Step 1: Activate your Salesforce Org](#GenAI_activate_SForg). [Step 2: Set up a Data Cloud Architect User](#setup_dc_permissions). [Step 3: Turn on Data Cloud](#GenAI_enable_DC). [Step 4: Configure your Salesforce org](#configure_SF_org). - [Configure AI in Tableau](#GenAI_config_Tab) ### Set up Einstein generative AI in Salesforce To set up Einstein generative AI for your Salesforce org, complete the following steps. #### Step 1: Activate your Salesforce Org After your purchase is completed, Salesforce will email an invitation to activate your new Salesforce Org if you do not already have one. Your activation will provision your Salesforce Org and finalize the creation of your Salesforce Org User. **Note**: If you provided an existing Salesforce Org, work with your Salesforce Admin to turn on Data Cloud and Einstein generative AI. If your org is configured as a Data Cloud One Companion, you'll need to perform the Setup Generative AI steps in the home org it is connected to. For more information, see the [Data Cloud One](https://help.salesforce.com/s/articleView?id=data.c360_a_data_cloud_one.htm&type=5) content in the Salesforce help. #### Step 2: Set up a Data Cloud Architect User To turn on Data Cloud, you need to have the Data Cloud Architect permission set. If you don't see Data Cloud Setup in your setup menu, complete the steps in this section. Otherwise, proceed to the next section to turn on Data Cloud. For more information about Data Cloud permission sets, see [Data 360 Standard Permissions Sets](https://help.salesforce.com/s/articleView?id=data.c360_a_userpermissions.htm&type=5) in the Salesforce help. ![The Salesforce setup menu.](/tableau/next/en-us/online/en-us/Img/tab_gai_data_cloud_setup2.png) ##### Add the Data Cloud Architect permission set to a user 1. In the top right corner, select the Setup![Salesforce setup gear icon](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_icon_19x20.png) icon. 2. Select Setup from the drop-down menu. ![The Salesforce setup menu option.](/tableau/next/en-us/online/en-us/Img/tab_gai_data_cloud_setup3.png) 3. In the Quick Find box, type Users, then select **Users** from the results. ![The Users setup menu](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_users.png) 4. On the Users page, select the user who should have Data Cloud permissions. Click on the User name, Alias, or Username to open and edit the user profile. ![Admin Users list page in Salesforce.](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_user_list.png) 5. To view the permission sets assigned to the user, on the User profile page, hover over Permission Set assignments, then select Edit Assignments. If the user is already assigned the Data Cloud Architect or Data Cloud Marketing Admin permission set, it would be shown in the first 5 permission sets. ![](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_user_permissions.png) 6. In the Permission Sets page, select the Data Cloud Architect permission in the Available Permission Sets then select the Add arrow to add it to the Enabled Permissions Sets. Then select Save. ![The Permissions Sets page in Salesforce.](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_add_permissions.png) You should now see Data Cloud Setup in the Setup menu. ![Salesforce Setup menu with Data Cloud Setup menu option highlighted](/tableau/next/en-us/online/en-us/Img/tab_gai_data_cloud_setup.png) #### Step 3: Turn on Data Cloud Enable Data Cloud in your provisioned Salesforce org. Users must have the Data Cloud Architect permission set assigned to enable Data Cloud. For more information about setting up Data Cloud in Salesforce, see [Set up and Turn On Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_setup_provision.htm&type=5) in the Salesforce help. 1. Log in to your Salesforce org in Salesforce. 2. In the top right corner, select the Setup![Salesforce setup gear icon](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_icon.png) icon. 3. Select Data Cloud Setup from the drop-down menu. If you don’t see this option, your users might not have Data Cloud permissions set up. If this is the case, follow the steps in [Step 2: Set up a Data Cloud Architect User](#setup_dc_permissions). ![Salesforce Setup menu with Data Cloud Setup menu option highlighted](/tableau/next/en-us/online/en-us/Img/tab_gai_data_cloud_setup.png) 4. On the Data Cloud Setup page, in the bottom left hand corner, select Get Started to begin provisioning your org’s Data Cloud. This may take a few minutes. ![Data Cloud Setup page in Salesforce org.](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_datacloud.png) The process runs automatically. Once complete your page will look similar to the page below. ![The Welcome to Data Cloud screen once initial setup is complete.](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_datacloud2.png) #### Step 4: Configure your Salesforce org Set up your Salesforce org to turn on Einstein generative AI. Data Cloud setup must be complete before you can turn on the Einstein Trust Layer, set up data masking and turn on Einstein generative AI data collection and storage. You'll need to do the following: - Turn on Einstein Generative AI to sync Einstein and Data Cloud and use generative AI features. - Set up Einstein Trust and set up data masking for Personally Identifying Information (PII). - (optional) Turn on Einstein data collection and storage to store your Einstein generative AI audit and feedback data in Data Cloud. For more information, see [Set Up Einstein Generative AI](https://help.salesforce.com/s/articleView?id=ai.generative_ai_enable.htm&type=5) in the Salesforce help. ##### Turn on Einstein 1. In your Salesforce Org, if you aren't already in the Setup pages, select the Setup![Salesforce setup gear icon](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_icon.png) icon in the top right corner of the page. Then select Setup from the drop-down menu. 2. In the Setup Quick Find box, type Einstein Setup, then select Einstein Setup from the results. ![](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_einstein.png) 3. Enable Turn on Einstein. ![Einstein Setup dialog with options to enable Einstein generative AI, Trust and Auditing](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_einstein_setup.png) ##### Set up the Einstein Trust Layer The Einstein Trust Layer identifies and masks sensitive information in the prompts before sending them to the large language model (LLM). The Einstein Trust Layer uses data masking to protect sensitive data such as personally identifiable information (PII) from being exposed to external LLMs. Complete this step to build trust in your generative AI and personalize data privacy controls that are integrated into the end-user experience. **Note**: Data Cloud setup must be complete before you can turn on the Einstein Trust Layer and configure data masking. 1. In the Einstein Setup page, in the Configure Einstein Trust Layer Settings section, select Go to Einstein Trust Layer. 2. In the Einstein Trust Layer page, turn on Large Language Model Data Masking and set the PII masking options for your organization. ![Einstin Trust Layer and PII masking settings page.](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_trust_pii.png) ![](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_trust_pii_2.png "Einstein Trust Layer PII masking settings.") ##### Turn on Einstein Generative AI data collection and storage Track the use of generative AI in your Salesforce org and ensure that AI usage complies with your security, privacy, regulatory, and AI governance policies. This feature may consume Data Cloud credits. For more information see [AI in Tableau Usage](https://help.tableau.com/current/tableau/en-us/tableau_gai_usage.htm). **Note**: Data Cloud setup must be complete before you can turn on Einstein generative AI data collection and storage. 1. In the Setup Quick Find box, type Einstein Audit, then select Einstein Audit, Analytics, and Monitoring Setup from the results. ![Salesforce Org Setup quick find box searching for Einstein feedback page.](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_feedback.png) 2. In the Einstein Audit, Analytics, and Monitoring Setup page, turn on Audit and Feedback. It can take a few hours before Einstein Generative AI audit data is available in Data Cloud. ![Einstein Feedback page in the Salesforce Org.](/tableau/next/en-us/online/en-us/Img/tab_gai_sf_setup_feedback2.png) ### Configure AI in Tableau Turn on generative AI functionality for specific features in Tableau Cloud by following the procedures below. For some features, you can choose to turn it on for a single group of users or for all users on your site. For more information, see [Turn on AI in Tableau for users in a group](#AI_user_groups). **Note:** This feature uses generative AI, which is built on the Einstein Trust Layer. Your data stays safe and secure through data and privacy controls that are seamlessly integrated into the user experience. For more information, see [Einstein Trust Layer](https://help.tableau.com/current/tableau/en-us/tableau_gai_einstein_trust_layer.htm). 1. Sign in to Tableau Cloud as a site administrator. 2. On the site where you want to turn on generative AI features, select Settings. 3. (Optional) In the AI Setting by Feature section, select the Actions ![Actions menu.](/tableau/next/en-us/online/en-us/Img/tab_gai_site_setting_actions_menu_24x13.png)menu, and select Turn On next to Tableau Pulse: Summarizes key metric insights and Tableau Pulse: Gets better semantic matches on insights in any languages when asking questions. These capabilities don't require a Salesforce org. 4. Log in to your Salesforce org. - Select Connect to Salesforce. - On the Login|Salesforce page, enter the Salesforce user credentials for the Salesforce org. - The Salesforce user Id must be assigned the Customize Application Profile permission. For more information, see [User capabilities with 'Customize Application' Profile permission](https://help.salesforce.com/s/articleView?id=000386451&type=1) in the Salesforce help. - Your Salesforce org must have Einstein generative AI turned on. ![Salesforce login page with fields for username and password and a blue Log In button.](/tableau/next/en-us/online/en-us/Img/tab_gai_site_login_sf.png) - On the Allow Access page, select Allow. - After successfully connecting to your Salesforce org, you can also edit, test, or delete your connection as needed. ![AI in Tableau site setting showing the Connect section.](/tableau/next/en-us/online/en-us/Img/tab_gai_site_setting_agent_cloud_connect.png) 5. For each AI in Tableau feature that you want to turn on, select the Actions ![Actions menu](/tableau/next/en-us/online/en-us/Img/tab_gai_site_setting_actions_menu.png)menu , then select Turn On. Select from the following features: - Tableau Pulse: Uses Pulse Discover for an in-depth, integrated exploration of groups of metrics and insights: Enable users to explore groups of metrics using Tableau Agent in Pulse. Tableau Agent in Pulse uses statistical algorithms to examine grouped metrics and surface insights that are relevant, interesting, and worth investigating. For more information about this feature, see [Turn on Tableau Agent in Pulse](https://help.tableau.com/current/online/en-us/pulse_set_up.htm#turn-on-enhanced-qa-discover-in-tableau). **Note:** Enhanced Q&A (Discover) has been renamed to Tableau Agent in Pulse. The functionality remains the same. Only the name has changed. - Tableau Agent in Authoring: Builds visualizations or completes tasks for you using a conversational UI: Enable users to create visualizations and create and understand calculations with the assistance of Tableau Agent in Tableau Cloud web authoring and in Tableau Desktop (version 2025.1 and later). For more information about Tableau Agent, see [Explore Your Data with Tableau Agent](https://help.tableau.com/current/online/en-us/web_author_einstein.htm). - Tableau Agent in Dashboards (Beta): Delivers Dashboard summaries and insights and lets users ask questions about their data using natural language: Enable dashboard consumers to quickly get an overview or insights about their dashboards as well as query the underlying data source to ask questions about their data. Dashboard authors can control access to these capabilities as well as configure which worksheets and insights to include. For more information, see [Tableau Agent in Dashboards (Beta)](https://help.tableau.com/current/pro/desktop/en-us/dashboard_narratives_overview.htm). You must first opt in to the Beta to turn on this feature. **Note**: Tableau Agent in Dashboards requires users to have the AI Access and Full Data Query permission capability on all workbooks where they want to use Tableau Agent. The Full Data Query permission ensures the agent has access to the underlying data needed to function. For more information, see [Permissions](https://help.tableau.com/current/online/en-us/permissions.htm#DashboardAgent). - Tableau Agent in Tableau Prep: Suggests steps to clean and transform your data: Enable users to clean their data, create calculated fields, and build flows with the help of Tableau Agent. This feature is available in Tableau Prep web authoring in Tableau Cloud and in Tableau Prep Builder (version 2025.2 and later). For more information about Tableau Agent in Tableau Prep, see [Build Tableau Prep flows with Tableau Agent](https://help.tableau.com/current/prep/en-us/prep_einstein.htm). - Tableau Agent in Tableau Catalog: Drafts asset descriptions: Enable users to automatically generate descriptions for data sources, workbooks, and tables. For more information about generative AI in Tableau Catalog, see [Manage Web Content](https://help.tableau.com/current/pro/desktop/en-us/qs_content_page.htm). - Tableau Knowledge: Manage and optimize business knowledge to improve AI Agent accuracy: Use Tableau Knowledge to create connected knowledge graphs that combine trusted Tableau Cloud content (workbooks, data sources, sheets) with organizational context and business preferences. For more information, see About Tableau Knowledge. ![AI in Tableau Site Setting section showing the list of avaialble AI features.](/tableau/next/en-us/online/en-us/Img/tab_gai_site_setting_agent_264.png) #### Turn on AI in Tableau for users in a group You can turn on AI in Tableau features for either a single user group or for all users on your site. Currently this option is available for Tableau Agent in Pulse (selected features), Tableau Agent in Authoring, and Tableau Agent in Tableau Prep features. To learn how to create a user group for these AI in Tableau features, see [Create a Group and Add Users to It](https://help.tableau.com/current/online/en-us/to_add_users_groups.htm). 1. Under AI in Tableau, select the Actions ![Actions menu.](/tableau/next/en-us/online/en-us/Img/tab_gai_site_setting_actions_menu_24x13.png)menu for the feature where you want to set group access. 2. If the feature isn't turned on, select Turn On. 3. Select the Actions ![Actions menu.](/tableau/next/en-us/online/en-us/Img/tab_gai_site_setting_actions_menu_24x13.png)menu again, then select Select User Group. ![Select User Group Actions menu.](/tableau/next/en-us/online/en-us/Img/tab_gai_site_setting_actions_group_menu.png) 4. In the Select User Group dialog, select a single user group, then click Apply. Only users in this user group will be able to access Tableau Agent for the selected feature area. All other users might be able to click the Tableau Agent icon, but will get a permissions error. ![Select User Group dialog.](/tableau/next/en-us/online/en-us/Img/tab_gai_site_setting_select_user_groups.png) 5. Click Save at the top of the page to save your Site Settings. ## Turn on AI in Tableau with a Tableau Cloud new site trial You can test AI in Tableau on a new Tableau site by signing up for a free trial of Tableau Cloud. To get started with the trial, [fill out the sign up form](https://www.tableau.com/products/trial), or contact your account executive. After you sign up, you’ll receive access to your new Tableau Cloud site. As a trial user, most of the configuration is taken care of for you. While requests are free with the trial, limits may apply to the number of requests you can make per hour. The Tableau Cloud new site trial includes the following AI in Tableau features. - Tableau Agent in Pulse. Tableau Pulse insight summaries and Tableau Pulse semantic matching when asking questions don’t require Tableau+, so you don’t need a trial site to turn on those features. - Tableau Agent features in web authoring, Tableau Desktop (version 2025.1 and later), and Tableau Prep Builder (version 2025.2 and later). - Tableau Agent in Dashboards if you opt into the beta. The following features and options are not available when using the trial experience: - Tableau Agent in Tableau Catalog - Tableau Knowledge - Customized data masking - Audit trail in Data Cloud > [!TIP] > > You can't add a trial of all AI in Tableau features to an existing Tableau site. However, you can try Tableau Agent in Pulse on an existing site. For more information, see [Try Tableau Agent in Pulse on an existing site](#Try-AI-Discover). To start using AI in Tableau complete the following steps: 1. Sign into your trial Tableau Cloud Site as a site administrator. 2. Select Settings. 3. In the AI in Tableau section, AI Settings by Feature, select the Actions ![Actions menu](/tableau/next/en-us/online/en-us/Img/tab_gai_site_setting_actions_menu.png)menu , then select Turn On. **Note**: For some features, you can choose to turn it on for a single group of users or for all users on your site. For more information, see [Turn on AI in Tableau for users in a group](#AI_user_groups). ![The AI in Tableau site settings page where you can turn on AI features for your trial site.](/tableau/next/en-us/online/en-us/Img/tab_gai_admin_trials_264.png) 4. Select from the following features: - Tableau Pulse Insight Summaries: Summarizes key insights for the metrics that users follow: Enable users to see their personalized insights summaries and get a quick overview of important changes to their metrics. For more information about generative AI in Tableau Pulse, see [AI in Tableau for Tableau Pulse](https://help.tableau.com/current/online/en-us/pulse_set_up.htm#tableau-ai-in-tableau-pulse). - Tableau Pulse Semantic Matching: Gets better matches on insights in any language for Ask Q&A: Enable users to get the best semantic results when using Ask Q&A to explore a single metric, in any language. For more information about this feature, see [Turn on better semantic matches for Ask Q&A in Tableau](https://help.tableau.com/current/online/en-us/pulse_set_up.htm#turn-on-better-semantic-matches-for-ask-qa-in-tableau). - Tableau Agent in Pulse: Uncover deeper insights with conversational analytics: Enable users to explore groups of metrics using Tableau Agent in Pulse and surface insights that are relevant, interesting, and worth investigating. For more information about this feature, see [Turn on Tableau Agent in Pulse](https://help.tableau.com/current/online/en-us/pulse_set_up.htm#turn-on-enhanced-qa-discover-in-tableau). - Tableau Agent in Authoring: Builds visualizations or completes tasks for you using a conversational UI: Enable users to create visualizations and create and understand calculations with the assistance of Tableau Agent. For more information about Tableau Agent in Tableau Cloud web authoring, see [Explore Your Data with Tableau Agent](https://help.tableau.com/current/online/en-us/web_author_einstein.htm). - Tableau Agent in Dashboards (Beta): Delivers dashboard summaries and insights and lets users ask questions about their data using natural language:Enable dashboard consumers to quickly get an overview or insights about their dashboards as well as query the underlying data source to ask questions about their data. Dashboard authors can control access to these capabilities as well as configure which worksheets and insights to include. For more information, see [Tableau Agent in Dashboards (Beta)](https://help.tableau.com/current/pro/desktop/en-us/dashboard_narratives_overview.htm). You must first opt in to turn on this feature. **Note**: Tableau Agent in Dashboards requires users to have the AI Access and Full Data Query permission capability on all workbooks where they want to use Tableau Agent. The Full Data Query permission ensures the agent has access to the underlying data needed to function. For more information, see [Permissions](https://help.tableau.com/current/online/en-us/permissions.htm#DashboardAgent). - Tableau Agent in Tableau Prep: Suggests steps to clean and transform your data: Enables users to use Tableau Agent to help them clean their data, create calculated fields, and build flows. This feature is available in Tableau Prep web authoring in Tableau Cloud and in Tableau Prep Builder (version 2025.2 and later). For more information about Tableau Agent in Tableau Prep, see [Build Tableau Prep flows with Tableau Agent](https://help.tableau.com/current/prep/en-us/prep_einstein.htm). 5. Navigate to a Tableau workbook, dashboard, or Tableau Prep flow and select the Tableau Agent ![Tableu Agent icon.](/tableau/next/en-us/online/en-us/Img/tab_gai_desktop_agent_icon.png) icon to open the Tableau Agent pane and type a request. In Tableau Prep Builder, users must be signed into the Cloud site with AI in Tableau turned on to see the icon. **Important**: To use AI in Tableau in your production site after your trial expires, you'll need to purchase Tableau Cloud+ or Tableau+, connect to a Salesforce org that has Einstein generative AI set up, and complete the configuration steps described above in this topic. ## Try Tableau Agent in Pulse on an existing site You can try Tableau Agent in Pulse on your existing Tableau site with the Try AI site setting. This free trial is 60 days and limited to only Tableau Agent in Pulse. To learn more, see [Try Tableau Agent in Pulse](https://help.tableau.com/current/online/en-us/tableau_gai_trial.htm). Tableau Agent in Pulse was formerly known as Enhanced Q&A (Discover). > [!TIP] > > Try AI for existing Tableau sites doesn’t provide access to Tableau Agent for web authoring or dashboards. To try other AI in Tableau features, you must sign up for a Tableau Cloud new site trial. For more information, see [Turn on AI in Tableau with a Tableau Cloud new site trial](#GenAI_trial). [Skip to main content](#main-content) # Understand Tooltips for Multi-fact Relationship Data Models **Note**: For single table data sources or single-base table data sources, all the tables are related. Everything on this page refers to multiple base table data sources. ## Field-level relatedness Data models with multiple base tables have a lot of flexibility in how the tables can relate—or not relate—to each other. The relatedness of the _tables_ is a constant based on the data model. However, the relatedness of _fields_ in a viz depends on what fields are active (that is, what fields are in use on the worksheet shelves as pills). At the level of a single viz, Tableau evaluates active fields in pairs to determine [how they relate to each other](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm#fieldlevel). An unrelated icon ![unrelated icon](/tableau/next/en-us/online/en-us/Img/mfr_icon_unrelated.png) on a field means it's unrelated to at least one other field in the viz. This icon can appear in a pill on a shelf or in the Data pane. (In some instances, there may be a related icon ![](/tableau/next/en-us/online/en-us/Img/MFR_icon_related.png "relatedness icon").) Hovering over the icon opens a tooltip with more information. There are different messages for different types of field relatedness, including: - Unrelated dimension-dimension pairs - Unrelated dimension-measure pairs - Stitching dimensions - Unrelated filter pairs > [!TIP] > > In Tableau, aggregated dimensions—such as ATTR(dimension) or MIN(dimension)—function as measures. The messages also varies slightly depending on whether the field is in use on a shelf or in the Data pane. - **On a shelf**: The tooltip for pills on shelves provides information about how the fields in the viz are related to each other and what impact that has on how Tableau computed the results. - **In the Data pane**: The tooltip for fields in the data pane provides information about what _would_ happen if that field were added to the viz. Fields in the Data pane can also be de-emphasized with light gray text if they don't related to any fields in the viz. There are various features that might add to field's comment, such as table calcs and user-provided comments. All of these pieces of information are displayed in one unified tooltip. ![](/tableau/next/en-us/online/en-us/Img/unified_tooltip.png "Tooltip for a field with information about relatedness, table calcs, and a user comment") ### Know your data model Whenever you're working with a data model that contains multi-fact relationships, it's useful to refer to the model regularly. Use the [View Data Model](https://help.tableau.com/current/pro/desktop/en-us/viewdatamodel.htm) option (Worksheet menu > View Data Model) to open a dialog with the data model you can refer to while on a sheet tab. The examples in this topic are based on a data model with two base tables, Classes and Clubs, and two shared tables, Students and Rooms. ![a data model with two base tables, Classes and Clubs, and a shared table, Students](/tableau/next/en-us/online/en-us/Img/mfr_basic_4table_model.png)

Classes

Clubs

Students

Rooms

View Data for the Classes table, showing three fields and their values

View Data for the Clubs table, showing three fields and their values

Fields:

Class, a dimension with values of Nesting Basics, Advanced Songs, Flying for Fledglings, and Alarm Calls 101
Room, a dimension used to relate to the Rooms table
Student, a dimension used to relate to the Students table
Length, a measure

Fields:

Club, a dimension with values of Photography, Travel, Juggling, Art, and First Aid
Room, a dimension used to relate to the Rooms table
Student, a dimension used to relate to the Students table
Dues, a measure

Fields:

Bus Rider, a dimension with values of yes or no
Student, a dimension with values of Finch, Cardinal, Sparrow, Robin, and Jay. Used to relate to the base tables
Age, a measure

Fields:

Room, a dimension with values of Cedar, Alder, Maple, Fir, and Madrone
Branches, a measure

## Unrelated dimension-dimension pair Unrelated dimensions are cross joined, which can result in combinations of dimension members across the headers that do not reflect actual combinations of data in the underlying tables. The message for an unrelated dimension-dimension pair is: - **On a shelf**: Unrelated dimensions show all possible combinations of values. Unrelated to: __ - **In the Data pane**: If used, this dimension will show all possible combinations of values with unrelated dimensions: __ - **Grayed out in the Data pane**: This dimension isn't related to any dimensions in the viz. If used, it will show all possible combinations of values with other unrelated dimensions. And for an unrelated filter, the message is: - **In the viz**: This field isn't filtered by unrelated filters: __ - **In the Data pane**: If used, this field will be ignored by unrelated filters: __ Cross joins can be expensive operations that negatively impact performance. Because of this, Tableau also displays a [Relatedness warning dialog](https://help.tableau.com/v0.0/online/en-us/datasource_mfr_multiple_base_tables.htm#Relatedn) if you add an unrelated dimension to the viz. ## Stitching dimensions Although there are analytically relevant reasons to visualize unrelated dimensions alone, a common "happy path" for analysis with multiple base tables is to use a stitching dimension in addition. In the presence of a stitching dimension, the unrelated dimensions are no longer cross joined but are outer joined instead. Outer joins may still introduce nulls, but the dimension member headers are trimmed down from every possible combination to combinations that are relevant to at least one side of the outer join. They also don't have the same potential for performance impacts as cross joins. If there are no other relatedness issues that would call for an unrelated icon, a stitching dimension shows a related icon ![](/tableau/next/en-us/online/en-us/Img/MFR_icon_related.png "related icon") instead. The message for a stitching dimension is: - **On a shelf**: This dimension stitches together the following fields: __ - **In the Data pane**: If used, this dimension will stitch together the following fields: __ - **Grayed out in the Data pane**: _doesn't apply, stitching only occurs in a viz_ Comparing unrelated dimensions with stitched dimensions

Unrelated: Cross join	Stitched: Outer join of intermediate inner joins
A viz showing a cross join of Class and Club with rows for every combination of Advanced Songs/Alarm Calls 101/Flying for Fledglings/Nesting Basics with Art/First Aid/Juggling/Photography.	A viz showing the results of an outer join of the Student-Class inner join and the Student-Club inner join. Not all combinations of classes and clubs are represented, and there are rows for students and clubs without a class.

## Unrelated dimension-measure pair For information about how measure values are computed and why relatedness of the dimensions matters, see [An aside on how measure values are computed](#computemeasures). The message for the measure is: - **On a shelf**: This measure can't be broken down by unrelated dimensions: __. - **In the Data pane**: If used, this measure won't be broken down by unrelated dimensions: __ - **Grayed out in the Data pane**: This measure isn't related to any dimensions in the viz. If used, it won't be broken down. The message for the dimension is: - **On a shelf**: This dimension can't break down unrelated measures: __ - **In the Data pane**: If used, this dimension won't break down unrelated measures: __ - **Grayed out in the Data pane**: This dimension isn't related to any measures in the viz. If used, it won't break down measure values. And for an unrelated filter, the message is: - **In the viz**: This field isn't filtered by unrelated filters: __ - **In the Data pane**: If used, this field will be ignored by unrelated filters: __ The result in a viz is a repeated value for the measure across the unrelated dimension's values. This behavior is similar to when an LOD expression is used to set the level of aggregation for a measure at a different level of detail from the native granularity of the viz. An unrelated dimension is essentially EXCLUDED from the computation of the measure's aggregated value. ![](/tableau/next/en-us/online/en-us/Img/mfr_measures_repeated.png "A viz where the value for Dues is tied to the Club, and Clubs are repeated across Classes") ## Not yet related Fields with potential relationships are called [not yet related](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm#notyet) and are evaluated as unrelated in the viz. [Resolving](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm#resolve) not yet related fields is done differently than resolving truly unrelated fields (which can only be stitched), so the tooltip calls out why they're considered unrelated. The message for the dimension depends on if it's not yet related to another dimension, measure, or filter. - For a dimension-dimension pair, the message for the dimension is: - **On a shelf**: Unrelated dimensions show all possible combinations of values. This dimension is not yet related to and so is treated as unrelated to the following: __ - **In the Data pane**: If used, this dimension won't yet be related to and so is treated as unrelated to the following: __ - For a dimension-measure pair, the message for the dimension is: - **On a shelf**: This dimension is not yet related to and so can't break down the following: __ - **In the Data pane**: If used, this dimension will not yet be related to and so won't break down the following: __ - For a dimension-filter pair, the message for the dimension is: - **On a shelf**: This field is not yet related to and so is ignored by these filters: __ - **In the Data pane**: If used, this field won't yet be related to and so will be ignored by unrelated filters: __ The message for the measure depends on if it's not yet related to a dimension or a filter. - For a measure-dimension pair, the message for the measure is: - **On a shelf**: This measure is not yet related to and so can't be broken down by the following: __ - **In the Data pane**: If used, this measure won't yet be related to and so won't be broken down by the following: __ - For a measure-filter pair, the message for the measure is: - **On a shelf**: This field is not yet related to and so is ignored by these filters: __ - **In the Data pane**: If used, this field won't yet be related to and so will be ignored by unrelated filters: __ For information about how measure values are computed and why relatedness of the dimensions matters, see [An aside on how measure values are computed](#computemeasures). ## Ambiguously related Fields with more than one active possible relationship are called [ambiguously related](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm#ambiguously) and are evaluated as unrelated in the viz. [Resolving](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm#resolve) ambiguously related fields is done differently than resolving truly unrelated fields (which can only be stitched), so the tooltip calls out why they're considered unrelated. The message for the dimension is: - **On a shelf**: This dimension is ambiguously related to and so can't break down the following: __ - **In the Data pane**: If used, this dimension will be ambiguously related to and so won't break down the following: __ The message for the measure depends on if the ambiguity is with a dimension or a filter. - For a measure-dimension pair, the message for the measure is: - **On a shelf**: This measure is ambiguously related to and so can't be broken down by the following: __ - **In the Data pane**: If used, this measure will be ambiguously related to and so won't be broken down by the following: __ - For a measure-filter pair, the message for the measure is: - **On a shelf**: This measure is ambiguously related to and so is ignored by these filters: __ - **In the Data pane**:If used, this measure will be ambiguously related to and therefore ignored by the following filters: __ For information about how measure values are computed and why relatedness of the dimensions matters, see [An aside on how measure values are computed](#computemeasures). ## Measure from a shared table When a dimension from a shared table (like Students) is used, it stitches together the dimensions from otherwise unrelated tables (such as Classes and Clubs). But what if instead of a dimension, you use a measure from the Students table instead? Measures can't stitch. ![a data model with two base tables, Classes and Clubs, and a shared table, Students](/tableau/next/en-us/online/en-us/Img/mfr_basic_3table_model.png) In a case where there are unrelated dimensions visualized together, the measure can't be broken down by those dimensions simultaneously. (For information about how measure values are computed and why relatedness of the dimensions matters, see [An aside on how measure values are computed](#computemeasures).) In this case, we treat the measure as unrelated to the combination of dimensions even though it would be related to any dimension individually. To resolve this type of ambiguity and prevent the measure from being table scoped, the unrelated dimensions could be stitched or one or more dimensions could be removed until there is a clear relationship path for aggregating the measure. ### All dimensions are unrelated to each other The message for a measure shared across unrelated dimensions is: - **On a shelf**: This measure can only be broken down by one of these dimensions at a time: __ - **In the Data pane**: If used, this measure can only be broken down by one of these dimensions at a time: __ The message for each of the dimensions is: - **On a shelf**: This dimension can't break down the measure __ in combination with the following dimensions: __ - **In the Data pane**: If used, this dimension can't break down the measure __ in combination with the following dimensions: __ ### Some dimensions are related to each other If some of the dimensions are related to each other, the related dimensions could break down the measure without the presence of the unrelated dimension. It's useful to know if any of the dimensions are related amongst themselves. (For example: If a viz is made with related dimensions Dim1 and Dim2 and a dimension DimA that's unrelated to both of them, a measure from the shared table isn't unrelated to all three dimensions equally. Dim1 and Dim2 don't conflict with each other, but both of them conflict with DimA. To resolve by removing fields, you could either remove DimA alone or both Dim1 and Dim2.) In this situation, the dimensions are listed in groups in the tooltip message. The message for the measure shared across groups of unrelated dimensions is: - **On a shelf**: This measure can only be broken down by one of the following groups of dimensions at a time:__ - **In the Data pane**: If used, this measure can only be broken down by one of the following groups of dimensions at a time: __ The message for each of the dimensions is: - **On a shelf**: This dimension can't break down the measure __ in combination with the following groups of dimensions: __ - **In the Data pane**: If used, this dimension can't break down the measure __ in combination with the following groups of dimensions: __ ## Related measure When a measure is related to some dimensions in the viz but not others, the measure may have an additional message in the tooltip that explains what dimensions it is related to. This can help explain how the measure is aggregated. This message only appears when the measure is also unrelated to a dimension in the viz. Otherwise, it's standard behavior that the measure is aggregated to the level of detail of its related measures. The message for the measure is: - **On a shelf**: This measure is aggregated to the level of detail of related dimensions: __ - **In the Data pane**: If used, this measure will be aggregated to the level of detail of related dimensions: __ This message is intended to help identify which dimension or dimensions are considered when the measure value is computed. For information about how measure values are computed and why relatedness of the dimensions matters, see [An aside on how measure values are computed](#computemeasures). ## Filters Relatedness is also evaluated for fields on the filter shelf compared to fields otherwise active in the viz. An icon and tooltip appears when a filter is unrelated to at least one field in the viz. Both the filter field and field in the viz have a tooltip. The message for a filter is: - **Unrelated filter**: This filter doesn't apply to unrelated fields: __ - **Ambiguous filter**: This filter ignores the following measures because it is ambiguously related to them: __ - **Not yet related filter**: This filter ignores the following fields because it is not yet related to them: __ The behavior of filters also depends on their relatedness to other fields in the viz. A filter doesn't impact the values of fields it isn't related to. Unless the filter is set to no values (excluding everything or including nothing), the viz will remain unchanged for any fields that aren't related to the filter. However, deselecting every option in the filter will return a blank viz. ![A viz with an unrelated filter, showing that deselecting options in the interactive filter control doesn't impact the viz](/tableau/next/en-us/online/en-us/Img/mfr_tt_unrelatedfilter.png) Two screenshots of viz with an unrelated filter, showing that deselecting options in the interactive filter control doesn't impact the viz Related fields are filtered as expected. In a more complex viz with a combination of related and unrelated fields (such as in a stitching context), the filter will only impact values that are related to the filter field. ## An aside on how measure values are computed When a measure isn't related to a dimension, it can't be broken down by that dimension's members (that is, you can't break down the average class length per club when clubs don't have a class length). Instead, the measure will be aggregated at a different level than the dimension member's headers in the view. Terminology for dimensions and measures In Tableau, _measures_ are _aggregations_—they're aggregated up to the _granularity_ set by the _dimensions_ in the view. The value of a measure therefore depends on the context of the dimensions. For example, "number of cereal boxes" depends on if we mean the total inventory or the number of boxes per brand. _Dimensions_ are usually categorical fields, such as country or brand. In Tableau, dimensions set the granularity, or the _level of detail_, of the view. We typically want to group our data into marks by some combination of categories. What dimensions we use to build the view determines how many marks we have. _Aggregation_ refers to how the data is combined. Tableau's default aggregation is SUM. You can change the aggregation to other options, including: average, median, count distinct, minimum, and so on. _Granularity_ refers to how detailed or broken down the measure is—which is controlled by the related dimensions. Unless the granularity of the measure is row level (aka disaggregated), its value must be aggregated. #### Example ![a table of values for number of boxes of cereal, across five brands and three sizes of boxes](/tableau/next/en-us/online/en-us/Img/mfr_ex_cereal_rawdata.png) **What's the value of "number of boxes of cereal"?** Well, it depends on the aggregation type and the granularity as set by the dimensions. - Aggregations: - Sum (or total) - Average - Granularity: - Table scoped / fully aggregated (the blue bars in the example) - Broken down by the **Brand** dimension (the colored bars in the example) ![A dashboard with four vizzes, one for the summed table scoped number of boxes (54), one with the average table scoped number of boxes (6), and then versions of those two broken down by the five brands](/tableau/next/en-us/online/en-us/Img/mfr_ex_cereal.png) ### The value of a measure trails the dimension members A measure's value is determined by the dimensions it is related to. A measure without a related dimension is table scoped. A measure with a related dimension is broken down by the related dimension's members (that is, the value of the measure is computed for each dimension member). If a related dimension's members are repeated due to the presence of an unrelated dimension, the measure's values are repeated based on its dimension members. 1. A measure without a dimension is table scoped to its overall value. ![](/tableau/next/en-us/online/en-us/Img/mfr_measures_tablescoped.png) 2. A measure, in the presence of an unrelated dimension alone, is table scoped and repeated for the unrelated dimension's members. ![](/tableau/next/en-us/online/en-us/Img/mfr_measures_tablescoped_unrelated.png) 3. A measure in the presence of related dimension is broken down more granularly and its value is computed per member of the related dimension. ![](/tableau/next/en-us/online/en-us/Img/mfr_measures_broken_down.png) 4. A measure, in the presence of an unrelated dimension and a related dimension, is broken down by the dimension it's related to. Wherever those related dimension members are repeated for unrelated dimensions, the measure value trails along with its related dimension member. ![](/tableau/next/en-us/online/en-us/Img/mfr_measures_broken_down_and_repeated.png) Because dues are per club, the value of dues for each club is repeated every time that club is repeated. [Skip to main content](#main-content) # Understanding License Models This topic describes the different licensing models and the product keys or subscriptions that may be associated with them. A useful visual of how product keys and subscriptions are represented in Tableau Cloud can be found in the [Tableau Customer Portal](http://customer.tableausoftware.com/). When viewing product keys using the Tableau Customer Portal (Tableau Desktop and Tableau Prep Builder), note the product specific prefixes.

Product Key Prefix	Description
TC	Tableau Creator product key, can be used to activate or deactivate Tableau Desktop and Tableau Prep Builder.
TD	Tableau Desktop product key, can be used to activate or deactivate Tableau Desktop only. This is a legacy product key that is no longer sold or provided.

## Term licensing models Tableau’s term license model is defined by the metric that permits use of Tableau Cloud. Term licenses are also called subscription licenses. Tableau currently sells access to Tableau Cloud with subscription licenses. In the subscription license model, customers pay a yearly subscription fee. If the subscription expires, the software will stop working. Tableau Cloud subscription licenses are role-based, core-based, or capacity-based. A single license key can be purchased with all roles and features and this license is called an Updatable Subscription License (USL). Only one key needs to be activated on Tableau Cloud to represent the entire purchase. - A _role-based license_ allows you to add users based on the available licenses of each role type. - A _usage-based license_ imposes no constraints on the number of Viewer user accounts in Tableau Cloud. Instead, the license is per usage, more specifically analytical impressions. An _Embedded Analytics usage-based license_ is one type of usage-based license. - A _capacity-based license_ provides unlimited Viewer users for Tableau Cloud, replacing per-user-per-month Viewer licensing. Instead of paying per Viewer, you purchase capacity units that define how much concurrent usage your deployment can support. At least one Creator license deployment is required. Creators and Explorers continue to be licensed per user per month. ### Role-based license model Tableau offers role-based term licenses that grant a range of capabilities at various price points. Four types of role-based term licenses are available: Display, Viewer, Explorer, and Creator. - _Display licenses_ let users share and display Tableau content with a broad, internal audience of users who consume dashboards via shared displays with no interaction. There is no separate site role for Display licenses; when using a Display license, administrators create a dedicated login account for each licensed Display location, which is not the same as an individual user’s login account, and assign the maximum site role of Viewer. - _Viewer licenses_ let users view and interact with workbooks in Tableau Cloud. Viewer licenses also let users access Tableau Mobile, add comments to workbooks, export visuals in various formats, download workbook summary data, create subscriptions for themselves, and receive data-driven alerts. - _Explorer licenses_ are similar to the user-based licenses available in previous Tableau Cloud releases, and include the capabilities provided with Viewer licenses, and additional capabilities. An Explorer license allows access to workbook authoring capabilities using a web browser, as well as a full set of collaboration features. - _Creator licenses_ permit a wide range of capabilities when using Tableau Cloud, and also grant use of Tableau Desktop and Tableau Prep Builder. A Creator license allows all of the capabilities available under the Explorer license, as well as the following capabilities when using Tableau Cloud: - Create and publish new workbooks from a new data source. - Edit embedded data sources in the Data pane. - Create and publish new data connections. - Use login-based license management activation on Tableau Desktop and Tableau Prep Builder. ### Usage-based license model In a usage-based licensing (UBL) model, Usage Viewers are licensed per usage measured in analytical impressions, while Creators and Explorers are defined per user. An analytical impression is generated when a Usage Viewer (who must be a viewer outside your organization) accesses one or more embedded analytics within (or related to) your external facing application, or a Pulse metric. For example, when a Viewer is performing these following actions: - Loading a dashboard. - Loading a worksheet. - Downloading or exporting a visualization (dashboard or worksheet) such as an image, PDF, PowerPoint or Tableau workbook via API or the UI. - Receiving a subscription. - Successful requests for detail Pulse insights. A successful detail request can happen either from users interacting with the Pulse interface within Tableau or from embedded scenarios where an external application is making requests to the Pulse Insights API. - Getting a response from a VizQL Data Service request. **Note:** Tableau Pulse will be available for usage-based sites at release, and will begin measuring analytical impressions in June 2024. Site administrators will receive [monthly overview emails](https://help.salesforce.com/s/articleView?id=000390885&type=1) updating them on Analytical Impressions consumption so they can track their usage and manage their budget. You can also request usage metrics at any time from your account managers to monitor usage. ### Capacity-based license model Starting in July 2026, the capacity-based licensing model provides customers who need to expand and scale their analytics access more broadly the option to purchase capacity-based units. In a capacity-based licensing model, Viewer users are not licensed per user account. Instead, you can purchase Capacity-based Viewer Blocks that define how much concurrent usage your deployment needs to support. With this model, there is no limit on the number of Viewer user accounts you can add to Tableau Cloud. Creators and Explorers continue to be licensed on a per-user, per-month basis. At least one Creator license is required per deployment to be able to purchase Capacity-based Viewer Blocks. A deployment can use either capacity-based or role-based Viewer licensing, but not both. Each Capacity-based Viewer Block defines limits for the following types of actions. These types are subject to change as we evolve our infrastructure. **Visualization actions:** - Opening and refreshing dashboards and views - VizQL Data Service (VDS) API calls - Exploring Pulse metrics - Pulse insights API calls **Background actions:** - Concurrent extract refreshes - Extract API calls - Publish API calls - Concurrent subscriptions - Scheduled Pulse digests Capacity-based licensing is available in Standard, Enterprise, Cloud+, and Tableau+ Bundle editions. Capacity is provisioned at the tenant-level and can be allocated to individual sites by Tableau cloud administrators in Tableau Cloud Manager (TCM). For more information about specific capacity types and limits, see [Tableau Cloud Capacity](https://help.tableau.com/v0.0/online/en-us/to_site_capacity.htm). ## Embedded Analytics Tableau’s Embedded Analytics offering is a limited-use license for Tableau Cloud that’s made available to customers who want to embed Tableau Cloud analytics into an external facing solution to provide Tableau content and insights to clients outside of their organization. **Note:** Embedded Analytics licenses cannot be used in the same environment as full-use licenses. To change to an Embedded Analytics license, first deactivate your existing full-use licenses and then activate the Embedded Analytics license. For example, consider an organization that runs a service where they analyze consumer data and generate reports on behavioral patterns regarding different consumer demographics. In this scenario, Tableau Cloud acts in support of a specific proprietary application titled ‘Demographics Analyzer’ and connects with exported TXT files and a SQL database. The organization makes visualizations available to its clients in a secure portal, where clients log in to manage their account and view the results. End users are uniquely identified by the account they use to access the portal. To verify the license contact [Customer Success](https://www.tableau.com/support/customer-success). ## License editions License editions include a suite of features and functionality to which users are entitled. License editions cannot be mixed within a deployment, meaning all users on a deployment must be on the same license edition. Consider the needs of your entire deployment when selecting your license edition. ### Tableau Cloud license editions - #### Tableau Standard Edition License Tableau Standard edition is the base Tableau Cloud edition. It provides Tableau Cloud access for each licensed user, governance, collaboration, data prep, and visual analytics functionality. - #### Tableau Enterprise Edition License Enterprise edition is designed for sophisticated business environments on Tableau Cloud. It is ideal for organizations that require advanced administration, security, and data management functionality to scale to more users in more complex data environments and meet Enterprise standards. For more information and a list of features included with Tableau Enterprise, see [About Tableau Enterprise](https://help.tableau.com/v0.0/online/en-us/to_tab_enterprise_features.htm). - #### Tableau Cloud+ Edition License Tableau Cloud+ edition is available exclusively for Tableau Cloud. It is tailored for wall-to-wall adoption of AI-powered, self-service analytics. It encompasses premium features tailored for larger or more complex deployments like premium AI functionality with Tableau Agent, a 50 site limit, Release Preview and Premier Success for Tableau Cloud. For more information and a list of features included with Tableau Cloud+ edition, see [About Tableau Cloud+ Edition](https://help.tableau.com/v0.0/online/en-us/to_tab_cloud_plus_features.htm). - #### Tableau+ Bundle License Tableau+ Bundle is available for Tableau Cloud. It includes agentic analytics with Tableau Next, and the Tableau Cloud+ edition license. For more information and a list of features included with Tableau+ Bundle, see [About Tableau+ Bundle](https://help.tableau.com/v0.0/online/en-us/to_tab_plus_features.htm) . ### Tableau Server license editions - #### Tableau Standard Edition License Tableau Standard edition is the base Tableau Server edition. It provides Tableau Server access for each licensed user, governance, collaboration, data prep, and visual analytics functionality. - #### Tableau Enterprise Edition License Enterprise edition is designed for sophisticated business environments on Tableau Server. It is ideal for organizations that require advanced administration, security, and data management functionality to scale to more users in more complex data environments and meet Enterprise standards. For more information and a list of features included with Tableau Enterprise, see [About Tableau Enterprise](https://help.tableau.com/v0.0/online/en-us/to_tab_enterprise_features.htm). - #### Tableau Server+ Edition License Server+ edition is designed for organizations that want the full power of Tableau Server with the flexibility and intelligence to scale further. It is ideal for enterprises that require expanded deployment environments (1 production and up to 6 additional non-production environments for testing), accelerated setup with pre-built containers, and premium success support to drive adoption and maximize value across their organization. For more information and a list of features included with Tableau Server+ edition, see [About Tableau Server+ edition](https://help.tableau.com/current/online/en-us/tab_server_plus_features.htm "Link to topic covering Tableau Server+ features") in the Tableau Server Help. ## Private Connect licensing If you have Tableau Cloud with a Tableau Enterprise or Tableau Cloud+ edition, or Tableau+ Bundle, Private Connect is available for purchase as an add-on license. You need an add-on license for each private connection. You also need to purchase data usage blocks to send and receive data over the private connection. Private connection data usage is billed per terabyte. Monthly summaries of usage are sent as described in [Monthly Account Summary FAQs](https://help.salesforce.com/s/articleView?id=000390885&type=1). Cloud administrators that want more frequent and granular statistics can use the [Activity Log](https://help.tableau.com/v0.0/online/en-us/activity_log_overview.htm) to get usage. The private connection Endpoint ID that appears in the list of private connections in Tableau Cloud Manager maps to `endpointID` in activity log events. ## Feature licenses **Important:** As of September 16, 2024, Advanced Management and Data Management are no longer available as an independent add-on options. Advanced Management and Data Management capabilities are only available if you previously purchased these, or if you purchase certain license editions: Tableau Enterprise, Tableau Cloud+, or Tableau+ Bundle (available for Tableau Cloud), or Tableau Enterprise or Tableau Server+ (available for Tableau Server). Feature licenses are sold differently than other licenses. Features with independent licenses must be licensed for every user in the deployment. These features are licensed annually, and in the context of licensing, the availability of these features to the user base are “all or none:” - Data Management - Advanced Management - Login-based License Management **Note:** Updatable subscription licenses include both features and roles in one license. You no longer need to activate multiple licenses and product key(s) for different features and their associated roles. ### Data Management The Data Management license includes Tableau Catalog and Tableau Prep Conductor. For more information, see [About Data Management](https://help.tableau.com/v0.0/online/en-us/dm_overview.htm). ### Advanced Management Tableau Cloud Advanced Management is licensed on a per deployment basis. For more information on Advanced Management and the capabilities included, see [About Tableau Advanced Management on Tableau Cloud](https://help.tableau.com/v0.0/online/en-us/itm_intro.htm). ### Login-based License Management Login-based license management (LBLM) simplifies licensing for Tableau Desktop and Tableau Prep Builder. Instead of end users needing to activate product keys, Cloud Creators can activate and use Tableau Desktop and Tableau Prep Builder by signing in to the Cloud site (LBLM). For more information, see [Activate Tableau using Login-based License Management](https://help.tableau.com/v0.0/online/en-us/license_lblm.htm). [Skip to main content](#main-content) # Update Bridge Connection Information This topic describes how a data source owner can update the connection information for a data source that connects to private network data. **Note:** For information about connection information for virtual connections, see [Create a Virtual Connection](https://help.tableau.com/v0.0/online/en-us/dm_vconn_create_conn.htm). ## Embed or update database credentials For live queries and scheduled refreshes to run as expected, data sources that require user authentication must have the database credentials embedded with the data source. You can embed database credentials for your data source in one of two ways: 1) during publish time from Tableau Desktop or 2) after publishing from the data source's Connection tab in Tableau Cloud. The procedure below describes how to embed database credentials on Tableau Cloud. For more information about embedding database credentials in Tableau Desktop, see [Set Credentials for Accessing Your Published Data](https://help.tableau.com/current/pro/desktop/en-us/publishing_sharing_authentication.htm). 1. Sign in to Tableau Cloud and navigate to your data source. 2. From the data source page, click the Connections tab. 3. Select the check box next to the connection, click the Actions menu, and select Edit Connection. 4. In the Edit Connection dialog box, enter the database credentials required for accessing the data, and click Save. ### Embed or update database credentials for Bridge legacy schedules If you use **Bridge legacy** schedules to refresh your data sources, you must embed the database credentials in the connection information in the Bridge client. This task must be done even if you embedded the database credentials at publishing time on Tableau Desktop. 1. Open the Windows system tray and click the Bridge icon to open the client. 2. Point to the data source, and then click the **Edit** icon (![](/tableau/next/en-us/online/en-us/Img/to_sync_edit_icon.png)) that appears. 3. In the dialog box, enter the database credentials required for accessing the data, and then click **Save**. ## Change the file path for a data source In some cases, you might need to update the file location that the client references under the following circumstances: - **Source file location has changed** - **Data source was published from a mapped drive:** If a client used to perform refresh is running in Service mode and the data source was published from a mapped drive, the file path referenced by the client must be updated to use the full UNC path. The Windows services account that the client is running under must also have access to the UNC path location of the file. We strongly recommend clients running in Application mode also reference the UNC path for its file-based data sources. If you are using Bridge refresh schedules, you can change the data source file path to use the full universal naming convention (UNC) path by performing the following steps: 1. Download the data source from Tableau Cloud. 2. Launch Tableau Desktop. 3. Open the published data source or workbook. 4. Navigate to the Data Source tab. 5. Right-click the data source name then select Edit Connection. 6. In the file navigator window and the file path field, type the UNC path to the file. For example: \\\\server\_name\\datasource.xls. 7. Select Server > Publish Data Source and publish the data source. You can confirm the UNC path is recognized for the data source in Tableau Desktop, by right-clicking the data source and selecting Properties. ### Change the file path for (legacy) If **Bridge legacy** schedule is used to refresh, saved with the data source is the location of the file. You can use the following procedure below to change the file path for the data source. 1. Open the Windows system tray and click the Bridge icon to open the client. 2. Point to the data source, and then click the **Edit** icon (![](/tableau/next/en-us/online/en-us/Img/to_sync_edit_icon.png)) that appears. ![Library data with edit and calendar icons.](/tableau/next/en-us/online/en-us/Img/bridge_client_editpath.png) 3. In the dialog box, enter the path location information and then click Save. ![A dialog box featuring a file path input field and options to save or cancel.](/tableau/next/en-us/online/en-us/Img/bridge_client_filepath.png) ## Use .tdc files for generic JDBC or ODBC connections You can use the steps described below to ensure customizations for generic JDBC or ODBC connections enabled through a Tableau Datasource Customization (TDC) file are also used by Bridge. Step 1: Customize the generic JDBC or ODBC connection If you aren’t already familiar with the type of customizations you can make to your JDBC and ODBC connections and how to create a TDC file, see [Customize and Tune a Connection](https://help.tableau.com/current/pro/desktop/en-us/connect_customize.htm) in the Tableau Help. Step 2: Save the TDC file in the My Tableau Bridge Repository In order for Bridge to use the customizations specified for generic ODBC or JDBC connections, you must save the TDC file in the location specified by the procedure below. To refresh JDBC or ODBC connections through Bridge pools, this step must be performed for all clients in the pool. 1. On the machine where the client is installed, go to the Datasources folder in the My Tableau Bridge Repository. The default location of the folder is - Windows: `C:\Users\myuser\Documents\My Tableau Bridge Repository\Datasources` - Linux: `/root/Documents/My_Tableau_Bridge_Repository/Datasources/` 2. Place the TDC (.tdc) file into the Datasources folder. 3. Exit and restart the client for the changes to take effect. The way you restart the client depends on whether the client is running in Application or Service mode. - For Application mode - from the client menu, select Exit. - For Service mode - from the Mode drop-down menu, select Application; then from the client menu, select Exit. 4. Repeat steps 1-3 for all clients in the pool. **Notes:** - For more information about creating and customizing a TDC file, see the Tableau Desktop help topic, [Customize and Tune a Connection.](https://help.tableau.com/current/pro/desktop/en-us/connect_customize.htm) - After you save the TDC file to the required location, customizations are applied to all generic JDBC or ODBC connections to the same underlying data. - To validate the TDC file is being used, you can review the client log files (for example, C:\\Users\\jsmith\\Documents\\My Tableau Bridge Repository\\Logs) for either of the following log entries: - `Found matching TDC` - `Applying customization for genericjdbc` or `Applying customization for genericodbc` ## Change the connection type A data source can use one of two connection types: live or extract. The connection type determines the frequency at which the content can be updated to reflect the changes in the underlying data. Depending on the data that is being connected to, some data sources can have live or extract connections but other data sources can only have extract connections. For more information, see [Connectivity with Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm). To change the connection type of an embedded data source of a workbook, see [Editing the data source](https://help.tableau.com/v0.0/online/en-us/to_bridge_eds.htm#editing-the-data-source). ## Repair connections Occasionally something causes one or more of the connections to stop functioning normally. When this happens, an alert appears in the client, and it usually provides information that can direct you toward the cause of the problem. However, if the alert can't provide any troubleshooting information and your client is running in Service mode, you can use the Repair option to try to reset the connections. 1. Open the Windows system tray and right-click the Bridge icon. 2. From the drop-down menu, select Repair. This option stops and restarts the service, which can be enough to resolve the issue. [Skip to main content](#main-content) # URL Actions A URL action is a hyperlink that points to a web page, file, or other web-based resource outside of Tableau. You can use URL actions to create an email or link to additional information about your data. To customize links based on your data, you can automatically enter field values as parameters in URLs. > [!TIP] > > URL actions can also open in a web page object in a dashboard. See [Actions and Dashboards](https://help.tableau.com/current/pro/desktop/en-us/actions_dashboards.htm) to learn more. ![A URL action run from a tooltip menu. The link reflects the action name, not the target URL.](/tableau/next/en-us/online/en-us/Img/urlaction_tooltip.png) A URL action run from a tooltip menu. The link reflects the action name, not the target URL. ## Open a web page with a URL action 1. On a worksheet, select Worksheet > Actions. From a dashboard, select Dashboard > Actions. 2. In the Actions dialog box, click Add Action and then select Go to URL. 3. In the next dialog box, enter a name for the action. To enter field variables in the name, click the Insert menu to the right of the Name box. **Note:** Give the action a descriptive name, because the link text in the tooltip is the name of the action, not the URL. For example, when linking to more product details, a good name could be "Show More Details". 4. Use the drop-down list to select a source sheet or data source. If you select a data source or dashboard you can select individual sheets within it. ![A menu for choosing source sheets and selecting an action.](/tableau/next/en-us/online/en-us/Img/urlaction3.png) 5. Select how users will run the action.

If you choose this option...	The action is run when the user...
Hover	Mouses over a mark in the view. This option works best for highlight actions within a dashboard.
Select	Clicks a mark in the view. This option works well for all types of actions.
Menu	Right-clicks (control-clicks on Mac) a selected mark in the view, then clicks an option in a tooltip (menu). This option works particularly well for URL actions.

6. For URL Target, specify where the link will open: - **New Tab if No Web Page Object Exists** — Ensures that the URL opens in a browser on sheets that lack web page objects. This is a good choice when Source Sheets is set to All or a data source. - **New Browser Tab** — Opens in the default browser. - **Web Page Object** — (Available only for dashboards with Web Page objects) Opens in the web page object you select. ![three radio buttons for URL target: new tab if no web page object exists, new browser tab, and web page object. Below the web page object option is a drop down box to select the web page object](/tableau/next/en-us/online/en-us/Img/urlaction-webpageobject.jpg) **Note**: For New Tab options, the first time the action is run it opens a new tab. After that, the action will open in the same tab instead of opening additional ones. 7. Enter a URL - The URL should start with one of the following prefixes:`http`, `https`, `ftp`, `mailto`, `news`, `gopher`, `tsc`, `tsl`, `sms`, or `tel` **Note**: If no prefix is entered, `http://` is automatically appended to the beginning and the URL action will work in Tableau Desktop. However, if a URL action with no prefix is published to Tableau Server or Tableau Cloud, it will fail in the browser. Always provide a fully qualified URL for actions if the dashboard will be published. **Note**: You can specify an ftp address only if the dashboard doesn't contain a web object. If a web object exists, the ftp address won't load. - Tableau Desktop also supports local paths like `C:\Example folder\example.txt`, as well as file URL actions. - To enter field and filter values as dynamic values in the URL, click the Insert menu to the right of the URL. Be aware that any referenced fields must be used in the view. For details, see [Using field and filter values in URLs](#Using). ![A form for adding a URL action with a hyperlinked example.](/tableau/next/en-us/online/en-us/Img/urlaction5.png) Below the URL you enter is a hyperlinked example you can click for testing. 8. (Optional) In the Data Values section, select any of the following options: - **Encode Data Values that URLs Do Not Support** — Select this option if your data contains values with characters that browsers don't allow in URLs. For example, if one of your data values contains an ampersand, such as "Sales & Finance," the ampersand must be translated into characters that your browser understands. - **Allow Multiple Values via URL Parameters** — Select this option if you are linking to a web page that can receive lists of values via parameters in the URL. For example, say you select several products in a view and you want to see each product's details hosted on a webpage. If the server can load multiple product details based on a list of identifiers (product ID or product name), you could use multi-select to send the list of identifiers as parameters. When you allow multiple values, you must also define the delimiter escape character, which is the character that separates each item in the list (for example, a comma). You must also define the Delimiter Escape, which is used if the delimiter character is used in a data value. ## Create an email with a URL action 1. On a worksheet, select Worksheet > Actions. From a dashboard, select Dashboard > Actions. 2. In the Actions dialog box, click **Add Action**, and select **Go to URL**. 3. In the Source Sheets drop-down list, select the sheet that contains the field with the email addresses you want to send to. 4. In the URL box, do the following: - Type **mailto:**, and click the Insert menu at right to select the data field that contains email addresses. - Type **?subject=**, and enter text for the Subject line. - Type **&body=**, and click the Insert menu at right to select the fields of information that you want to include in the body of the email. In the example below, the "Email" field contains the email addresses, the subject is "City Information", and the body text of the email consists of the city and state data that is associated with the email address. ![ ](/tableau/next/en-us/online/en-us/Img/UsingActionEmail_BodyText.png): 5. (Optional) Display data from your workbook in the body of your email as a vertical list instead of the default horizontal list. For example, suppose you have a horizontal list of cities, such as Chicago, Paris, Barcelona, which you would rather display vertically, like this: Chicago Paris Barcelona To make the list vertical, in the Data Values section, do the following: - Deselect **Encode Data Values that URLs Do Not Support** - Select **Allow Multiple Values via URL Parameters**. - Type **%0a** in the **Value Delimiter** text box to add line breaks between each item in the list. (These are the URL-encoded characters for a line break.) ## Using field and filter values in URLs When users trigger URL actions from selected marks, Tableau can send field, filter, and parameter values as variables in the URL. For example, if a URL action links to a mapping website, you could insert the address field to automatically open the currently selected address on the website. 1. In the Edit URL Action dialog box, begin typing the URL for the link. 2. Place the cursor where you want to insert a field, parameter, or filter value. 3. Click the Insert menu to the right of the text box and select the field, parameter, or filter you want to insert. The variable appears within angle brackets. You can continue adding as many variables as you need. **Note:** Any referenced fields must be used in the view. Otherwise, the link won't display in the viz, even if it functions when you click Test Link. ![A window with fields to add a new URL action.](/tableau/next/en-us/online/en-us/Img/parameter1.png) ### Including aggregated fields The list of available fields includes only non-aggregated fields. To use aggregated field values as link parameters, first create a related calculated field, and add that field to the view. (If you don't need the calculated field in the visualization, drag it to Detail on the Marks card.) ### Inserting parameter values When inserting parameter values, URL actions send the Display As value by default. To instead send the actual value, add the characters `~na` after the parameter name. For example, say you have a parameter that includes IP addresses, with Actual Value strings such as 10.1.1.195 and Display As strings with more friendly values such as `Computer A (10.1.1.195)`. To send the actual value, you'd revise the parameter in the URL to look like this: `http:///page.htm`. [Skip to main content](#main-content) # Use a Custom Domain with Tableau Cloud You can use a custom domain to redirect traffic to your Tableau Cloud site. A custom domain lets you configure a subdomain, such as `analytics.example.com`, to embed and access published content without exposing Tableau site details. With a custom domain, you can direct users to content using your organization's URL. This topic describes how to configure a custom domain in Tableau Cloud site settings. For information about configuring a custom domain using the Tableau REST API, see [Tableau REST API OpenAPI Endpoints](https://help.tableau.com/current/api/rest_api/en-us/REST/TAG/index.html#tag/Custom-Domain-Methods). ## Before you begin To add a custom domain to Tableau Cloud, you must meet the following user and TLS certificate requirements. ### User requirements - **Administrator access to your Tableau Cloud site.** You must have administrator access to the Tableau Cloud site on which you want to add a custom domain. - **Administrator privileges to the DNS configuration of the parent domain.** You must have administrator privileges to add CNAME records to the DNS configuration of the parent domain. A parent domain is the primary domain in a DNS hierarchy. It contains child domains, or subdomains. For example, `example.com` is a parent domain, while subdomains such as `abc.example.com` or `xyz.example.com` sit beneath it. ### TLS certificate requirements Acquire a valid TLS certificate chain file and private key from a trusted authority (for example, Verisign, Thawte, Comodo, GoDaddy). You can't use an internal certificate issued by your organization. When acquiring a TLS certificate for the custom domain, follow these guidelines and requirements: - **TLS certificate that includes the full certificate chain.** The TLS certificate must include the full certificate chain in the order of identity certificate > intermediate certificate > root certificate. - **Valid PEM-encoded x509 certificates.** All certificate files must be valid PEM-encoded x509 certificates. - **SHA-256 is used as the signing algorithm.** Certificate files must use the SHA-2 (256 bit or 512 bit) signature hash. - **RSA is used as the encryption algorithm.** Certificate files must use the RSA encryption algorithm. - **Common Name that matches the custom domain.** The certificate Common Name (CN) must match the custom domain entered on the Tableau Cloud Settings page. Tableau doesn't support wildcard certificates, such as `*.example.com`, or check the Subject Alternate Name (SAN) field. - **Expiration within 90 days to 365 days.** The certificate expiration date must be within 90 days to 365 days from the issue date. The maximum validity period for publicly trusted TLS certificates is 397 days, which includes the standard 30-day grace period from the provider. **Note:** When you add or replace a certificate, it must have at least 88 days of remaining validity from the upload date. - **Valid RSA private key file.** In addition to the certificate file, upload a corresponding TLS certificate key file. The key file must be a valid RSA private key with extension `.key` and have a bit length of 2048 bits or higher. ### PEM-encoded file example This example shows the format for PEM-encoded certificate and private key files. The content has been shortened for illustration purposes. > [!IMPORTANT] > > The certificate chain file must start with `-----BEGIN CERTIFICATE-----`. Additionally, don't include comments between the `-----END` and `-----BEGIN` sections of the certificate chain file. **Certificate chain file** \-----BEGIN CERTIFICATE----- MIIGiTCCBHGgAwIBAgIIY5dpPr2gQjowDQYJKoZIhvcNAQENBQAwgYsxCzAJBgNV ... A7jcIyoWtoPP1rZ3VjP4LIVVro8pce7MNtD9CzUYN8kQk1iftBKWjcCd20Km -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIGqzCCBJOgAwIBAgIIYifB1rX/1pAwDQYJKoZIhvcNAQELBQAwgYUxCzAJBgNV ... g+qyDLoAy/td0D8ha8SlWt5ee2cAF9Xu7Y9jNe21Ug== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDpjCCAyugAwIBAgIQDTYMRISRziTtCzVA2HCg3TAKBggqhkjOPQQDAzBhMQsw ... 7LX35CV+ypuVTbKZkjATTvROgmL5AgTbsAg= -----END CERTIFICATE----- **Private key file** \-----BEGIN PRIVATE KEY----- MIIEpAIBAAKCAQEAgN9TePjxsgvjZ8QERQILf3YbofaBHGks5E3k9dRP0cx7sw1O ... xpAh+dRkr0vjsj/ZnJyYfaUQDcV4wslFcn6eKoINEQrtBj40P1iqig== -----END PRIVATE KEY----- ## Compatibility with SAML single sign-on (SSO) If your Tableau Cloud site uses SAML authentication, you must update your identity provider (IdP) configuration after adding a custom domain. Specifically, update the following values in your IdP to reflect your site's custom domain: - Entity ID - ACS URL For more information about configuring SAML authentication, see [SAML](https://help.tableau.com/v0.0/online/en-us/saml.htm). **Note:** Starting in June 2026, custom domains are supported with [SCIM](https://help.tableau.com/current/online/en-us/scim_config_online.htm) integration. ## Compatibility with custom OAuth connections When configuring a new OAuth client, use your custom domain for the Redirect URL. For example, if your custom domain is `analytics.example.com`, the Redirect URL is `https://analytics.example.com/auth/add_oauth_token`. Existing workbooks continue to function as expected, regardless of your custom domain configuration. For more information about custom OAuth clients, see [OAuth Connections](https://help.tableau.com/v0.0/online/en-us/protected_auth.htm). ## Add a custom domain to your site To add a custom domain to your Tableau Cloud site, use the steps in the following sections. ### Add domain name 1. Sign in to the Tableau Cloud site as an administrator and select Settings. 2. On the General tab, scroll to Custom Domain. 3. Enter a domain name for your site. The value must be a subdomain. Tableau doesn't support parent domains, such as `example.com`, for the custom domain. 4. Select Save. ![A three-step custom domain setup interface showing an active first step to add a domain name.](/tableau/next/en-us/online/en-us/Img/custom_domain_add.png) ### Validate CNAME 1. Using the Tableau Created Domain displayed in Step 1, create a CNAME record in your DNS configuration. This step is performed outside Tableau Cloud and requires network administrator access in your organization. CNAME validation expires 48 hours after adding the custom domain, at which point you must restart the process. > [!TIP] > > Use a time to live (TTL) value of 30–60 minutes for the CNAME record. 2. Select the check box to confirm you've created a CNAME record from the chosen custom domain to the Tableau CNAME in your DNS configuration. 3. Select Validate. ![A custom domain setup interface showing a completed domain name step and an active CNAME validation step.](/tableau/next/en-us/online/en-us/Img/custom_domain_validate.png) ### Upload TLS certificate and private key 1. Upload the full certificate chain and private key files associated with the custom domain. The certificate chain must include root, intermediate, and end-user certificates. For more information about certificate requirements, see [TLS certificate requirements](#TLS-certificate-requirements). 2. Select Save. ![A custom domain setup interface showing completed domain name and CNAME validation steps and an active TLS certificate upload step.](/tableau/next/en-us/online/en-us/Img/custom_domain_upload_cert.png) After the files are successfully uploaded, provisioning your domain can take up to 60 minutes. A status notification appears while provisioning is in progress and disappears when the custom domain is available. ![A custom domain interface showing a provisioning status banner and current configuration details.](/tableau/next/en-us/online/en-us/Img/custom_domain_provision.png) ## What to expect when using a custom domain When you use a custom domain, a few user interface changes apply. - The URL in the address bar shows the custom domain instead of the Tableau Cloud pod hosting your site. This change doesn't affect sign-in. Users can still access the site from [https://online.tableau.com](https://online.tableau.com/). - The Share dialog link and embed code point to the custom domain instead of the Tableau Cloud pod hosting your site. This happens because the dialog populates fields using information from the current URL. For content that was shared or embedded previously, the URL continues to reference the Tableau Cloud pod. To use the custom domain instead, you must update previous links using the new Share dialog values. For more information about sharing Tableau content, see [Share Web Content](https://help.tableau.com/current/pro/desktop/en-us/shareworkbooks.htm) in Tableau Desktop help. - For users who are members of multiple sites, the site picker isn't available when accessing content with a custom domain. To switch sites, sign out and authenticate to the site you want. ## Replace or update TLS certificate Replace the TLS certificate and key files as they near expiration or when your organization requires it. The certificate expiration date is displayed in the Custom Domain section of the Settings page. To replace the TLS certificate and private key files: 1. Sign in to the Tableau Cloud site as an administrator and select Settings. 2. On the General tab, scroll to Custom Domain. 3. Select Replace Certificate and follow the steps listed in [Upload TLS certificate](#upload-certificate-and-private-key). The replacement certificate must have at least 88 days of remaining validity. If the certificate expires in fewer than 88 days from the upload date, the upload fails. ![A custom domain interface showing a provisioning status banner, current configuration details, and active certificate and private key upload fields.](/tableau/next/en-us/online/en-us/Img/custom_domain_replace_update.png) ## Remove the custom domain When you remove a custom domain, the URLs used to share and embed content are no longer available. To avoid broken links, have users update their bookmarks and embedded content before removing the domain. The updated URLs must use the name of the Tableau Cloud pod hosting their site. For the list of Tableau Cloud pods, see [Salesforce Trust](https://status.salesforce.com/products/Tableau). To remove the custom domain from your site: 1. Sign in to the Tableau Cloud site as an administrator and select Settings. 2. On the General tab, scroll to Custom Domain. 3. Select Remove Domain > Remove. ![A custom domain interface displaying a Remove Domain confirmation dialog box.](/tableau/next/en-us/online/en-us/Img/custom_domain_remove.png) ## Troubleshooting ### Delayed DNS propagation when adding a CNAME record If you experience a delay while adding the CNAME record to your DNS configuration, verify that the CNAME reflects the expected mapping. You can use command-line tools such as `dig` and `nslookup` to verify the CNAME mapping. ### Certificate errors To correct certificate errors, follow the on-screen instructions and verify the certificate meets the [TLS certificate requirements](#TLS-certificate-requirements). [Skip to main content](#main-content) # Use a Custom SMTP Server for Email Notifications Tableau Cloud sends email notifications when users subscribe to workbooks and views or receive data-driven alerts. By default, these emails come from a built-in Tableau email server (`@cloudmail.tableau.com`). You can update this setting to route emails through your own Simple Mail Transfer Protocol (SMTP) server. With a custom server, notifications come from your domain and subscription attachments can be up to 10 MB instead of the default 2 MB. Tableau Cloud supports basic authentication and OAuth 2.0 for Microsoft SMTP. ## Prerequisites Before you use a custom mail server, confirm you have site administrator access to your site. Your organization's email gateway and spam filters must allow emails from the specific domain and sender values you configure in your site settings. Your network must also allow inbound traffic from these dedicated Tableau Cloud IP addresses: - `155.226.128.24/32` - `155.226.128.25/32` - `155.226.128.26/32` Depending on your authentication method, gather the required information: ### Requirements for basic authentication - **SMTP server address.** For example, `mail.example.com`. - **Port number.** Use port `587` for secure delivery. - **Username and password.** This is the identity for the sending mailbox account. ### Requirements for OAuth 2.0 for Microsoft SMTP - **SMTP server address.** This is typically `smtp.office365.com`. - **Port number.** Use port `587` for secure delivery. - **Microsoft Entra app credentials and API permissions.** You need a `Tenant ID`, `Client ID`, and `Client Secret`. Your Microsoft administrator must register the application in the Microsoft Entra admin center and assign the specific mail permissions required for SMTP access. If your team hasn't configured these settings yet, see [Authenticate an IMAP, POP, or SMTP application by using OAuth](https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth#add-the-pop-imap-or-smtp-permissions-to-your-microsoft-entra-application) on Microsoft Learn for the exact permission assignment steps. **Note:** These requirements reflect a third-party application and are subject to change without our knowledge. If the field names or labels don't match your Microsoft Entra admin center, refer to Microsoft's documentation. ## Configure custom SMTP settings in Tableau Cloud To use a custom SMTP server for your site: 1. Sign in to your Tableau Cloud site as a site administrator. 2. In the navigation pane, select Settings. 3. On the General tab, scroll to the Customize Email Notifications section. 4. Select the Use your SMTP server (links go to the domain you set) option. 5. Enter your mail server address in the SMTP server address field. 6. Enter your network port in the Port number field. 7. Select one of the choices for SMTP authentication method: - **Basic authentication:** Enter the Username and Password for the mail account. - **OAuth 2.0 for Microsoft SMTP:** Enter your Microsoft Tenant, Client ID, and Client secret values exactly as they appear in the Microsoft Entra admin center. 8. Enter the domain name you want Tableau Cloud to use for navigation hyperlinks in the Domain used for links field. 9. Enter an Email sender name and an Email local name or email address to customize the From line of your notifications. 10. Select the Include links in notification emails check box if you want to include links back to Tableau Cloud. An unsubscribe link is always included. 11. Select Save. ## SMTP field reference Use this table to map your mail settings to the fields in Tableau Cloud:

Field name	Description
SMTP server address	The address of your outbound mail server. For example, `smtp.office365.com`.
Port number	The network port your server uses for secure mail.
SMTP authentication method	The security type for your mailbox. Either Basic authentication or OAuth 2.0 for Microsoft SMTP.
Tenant	The tenant ID for your Microsoft app registration. This field only appears for OAuth 2.0.
Client ID	The application ID for your Microsoft app registration. This field only appears for OAuth 2.0.
Client secret	The secret value, also known as the application password, generated for your Microsoft app registration. This field only appears for OAuth 2.0.
Domain used for links	The domain name Tableau Cloud adds to navigation links inside your emails.
Email sender name	The name that users see in the From line of their inbox. For example, `Internal Analytics Alerts`.
Email local name or email address	The email address that sends the messages, such as `no-reply@yourdomain.com`.
Include links in notification emails	The option to add links back to the view inside the email text. An unsubscribe link is always included.

## Revert to the default Tableau email server To stop using your custom SMTP configuration, select the default Tableau email server option in your site settings. Confirm your organization's security policies allow traffic from these addresses to avoid blocked auser accounts and delivery failures: - **Default domain:** `@cloudmail.tableau.com` - **Default IP addresses:** `54.240.86.205`, `54.240.86.204`, `54.240.119.142`, and `54.240.119.141` ## Troubleshooting custom SMTP connections ### Missing or partial email attachments Custom SMTP servers support subscription attachments up to 10 MB. If a workbook exceeds this size, Tableau Cloud attempts to send a partial attachment. If the attachment is still too large to deliver, the subscriber receives an error notification. ### Emails stop sending If your custom SMTP account password changes or your Microsoft client secret expires, the authentication handshake fails and Tableau Cloud stops sending notifications. To prevent service disruptions, regularly review your credential lifecycles. [Skip to main content](#main-content) # Use a Table Calculation in a Tableau Data Story **Important changes for Tableau Data Stories** Tableau Data Stories were retired in Tableau Desktop, Tableau Cloud, and Tableau Server in January of 2025 (2025.1). With advances in natural language technologies, we're developing an improved interface that will make it easier to ask questions of your data and stay on top of changes. For more information, see [How Tableau Pulse powered by Tableau AI is Reimagining the Data Experience](https://www.tableau.com/blog/tableau-pulse-and-tableau-ai). You can use a Table Calculation as a measure in a Tableau Data Story in addition to the measure that you used to create the table calculation. 1. From the Marks card, click the right side of your field to open a menu, and click Quick Table Calculation. ![The menu that opens when you right click a field in the Marks card. Quick Table Calculation is selected.](/tableau/next/en-us/online/en-us/Img/data_stories_quick_tablecalc.png) 1. After you create your table calculation, drag it to Measures in the Data pane and rename it. ![An animation of dragging the calculation from the shelf to the Data pane.](/tableau/next/en-us/online/en-us/Img/data_stories_tablecalc_1.gif) 1. Drag your original measure (e.g., Sales) back to the Rows shelf, and then drag your new calculation (e.g., Sum of Sales) into the Tooltip. Your visualization may remain the same, but you now have access to the new measure. ![An animation of dragging the measure to the shelf.](/tableau/next/en-us/online/en-us/Img/data_stories_tablecalc_2.gif) 1. Go to your dashboard and drag the Data Story object onto the dashboard. Both measures appear when creating your story. [Skip to main content](#main-content) # Use a Virtual Connection After a virtual connection is published and permissions are set, it's available to users to connect to data in the same ways that users access all data in Tableau. When you must edit a virtual connection or the data policy in the connection—for example, when the underlying schema changes—simply open the connection in the virtual connection editor, make your changes, and either save or publish the updates. You can also replace an existing data source in a workbook with a virtual connection. ## Connect to a virtual connection For web authoring in Tableau Cloud or Tableau Server: 1. On the Home or Explore page, click New. 2. Select the type of content you want to create: workbook, flow, or published data source. 3. In Connect to Data > On This Site > Content Type dropdown menu, select Virtual Connections. 4. Select the name of the connection and click Connect. For Tableau Desktop and Tableau Prep: 1. On the Connect pane, under Search for Data, click Tableau Server. 2. Enter the server name and click Connect, or click Tableau Cloud. 3. Enter the information prompted for. 4. On the Search for Data dialog box, from the Content Type dropdown menu, select Virtual Connections. 5. Select the name of the connection and click Connect. **Note:** There's no need to enter credentials when you connect using a virtual connection. The credentials to access the data are embedded in the connection. ## Edit a virtual connection or data policy When editing a published virtual connection, the connection stays available to users in its current published state. For more information, see [Publish a Virtual Connection and Set Permissions](https://help.tableau.com/v0.0/online/en-us/dm_vconn_publish_save.htm). To edit a connection, navigate to it from the Explore page. Note that even though database credentials are embedded in the connection, only those with the database credentials can make any changes to a virtual connection. 1. From the dropdown menu, select All Virtual Connections, then select the connection you want to edit. 2. Click Edit Virtual Connection. 3. Enter the information prompted for to connect. To edit a connection, you must enter the credentials required to access the data. 4. Click Sign In. 5. In the virtual connection editor, make your changes and then either save a draft or publish the connection. ### Respond to underlying schema changes When the underlying schema in a virtual connection changes—for example, a table is added or deleted, or a column is added or renamed—you must edit the virtual connection to reflect the schema changes and then republish the connection. (If the connection has extracts, remember to refresh the extracts.) This way, you can add or edit the tables, columns, and policies in the connection before new data is exposed to everyone. ## Work with virtual connection revision history When you publish a virtual connection, a version is saved in the revision history for Tableau Cloud or Tableau Server. You can revert to a previous version at any time. To access revision history, you must have a Creator site role and the View and Overwrite permissions. To see the virtual connection revision history, click the actions menu (. . .) for the virtual connection, then click Revision History. ![The actions menu with Revision History highlighted](/tableau/next/en-us/online/en-us/Img/dm_vconn_rev_hist_menu.png) ### Restore or delete a virtual connection revision To restore a virtual connection revision, select a revision, and then click Open. You are then prompted to discard the existing version of the connection. When you click Discard and Continue, the revision you selected becomes the current version of the connection. ![The “Open Revision” dialog with the “Discard and Continue” highlighted.](/tableau/next/en-us/online/en-us/Img/dm_vconn_rev_hist_replace.png) To delete a revision, from the revision's actions menu (. . .), click Delete. ![A revision’s actions menu with "Delete…" highlighted.](/tableau/next/en-us/online/en-us/Img/dm_vconn_rev_hist_del.png) ## Replace an existing data source in a workbook with a virtual connection For web authoring in Tableau Cloud or Tableau Server: 1. Download the workbook. For more information, see [Download Views and Workbooks](https://help.tableau.com/current/pro/desktop/en-us/export.htm) in Tableau Desktop Help. 2. In Tableau Desktop, open the workbook and replace its existing data source with a virtual connection. For more information, see [Replace Data Sources](https://help.tableau.com/current/pro/desktop/en-us/connect_basic_replace.htm) in Tableau Desktop Help. 3. In Tableau Desktop, upload the workbook to your Tableau Cloud or Tableau Server site. For more information, see [Upload Workbooks to a Tableau Site](https://help.tableau.com/current/pro/desktop/en-us/upload.htm) in Tableau Desktop Help. 4. In Tableau Cloud or Tableau Server, click Publish to save your changes to the server. For Tableau Desktop: 1. Open the workbook and replace its existing data source with a virtual connection. For more information, see [Replace Data Sources](https://help.tableau.com/current/pro/desktop/en-us/connect_basic_replace.htm) in Tableau Desktop Help. 2. Republish the workbook. For more information, see [Simple Steps to Publish a Workbook](https://help.tableau.com/current/pro/desktop/en-us/publish_workbooks_share.htm) in Tableau Desktop Help. ## Who can do this To use a virtual connection, you must be a Server Administrator, Site Administrator Creator, or Creator. To edit a virtual connection or data policy, you must - have credentials to the database that the virtual connection connects to, and - be a server or site administrator, or a Creator. To migrate existing content to use a virtual connection, you must - be a server or site administrator, or - be a Creator who is also the data source owner. [Skip to main content](#main-content) # Use Accelerators to Quickly Visualize Data Tableau Accelerators are pre-built dashboards designed to help you get a jumpstart on data analysis. Tailored to specific industries and enterprise applications, Accelerators are built with sample data that you can swap out for your own data, allowing you to discover insights with minimal setup. ![An example of an accelerator](/tableau/next/en-us/online/en-us/Img/accelerator_example.png) Salesforce Sales Cloud Pipeline Accelerator ## Where to find Accelerators You can access the complete set of Accelerators on the [Tableau Exchange](https://exchange.tableau.com) and in Tableau Desktop. Additionally, select Accelerators are available to use when you create a workbook in Tableau Cloud. ### On the Tableau Exchange website 1. Visit the [Accelerators page](https://exchange.tableau.com/accelerators) on the Tableau Exchange website. You can filter to find Accelerators based on the industry they're applicable to and the type of data they connect to. 2. Sign in to the Tableau Exchange website. If you don't have an account, create one. 3. When you find an Accelerator you want to use, select Download to get the TWBX file. Because Accelerators are simply packaged workbooks, you can open the downloaded file in Tableau Desktop or upload it to your site on Tableau Cloud or Tableau Server. For information about uploading workbooks, see [Upload Workbooks to a Tableau Site](https://help.tableau.com/current/pro/desktop/en-us/upload.htm). ### In Tableau Desktop 1. On the Start Page in Tableau Desktop, select More Accelerators. ![Accelerators on start page](/tableau/next/en-us/online/en-us/Img/accelerator_desktop_more.png) 2. The Accelerators in this list are the same as those shown on the Tableau Exchange website, with the added convenience that you can open the Accelerators without leaving Tableau Desktop. 3. When you find an Accelerator you want to use, select Open to start working with it. ### In Tableau Cloud A limited number of Accelerators are available when you create a workbook in Tableau Cloud. These Accelerators connect to cloud-based data like Salesforce, ServiceNow ITSM, LinkedIn Sales Navigator, Marketo, and Oracle Eloqua. 1. If you're a Creator in Tableau Cloud, go to the Home or Explore page, then select the New button and select Workbook. ![Create button options](/tableau/next/en-us/online/en-us/Img/jumpstarts_new_workbook.png) **Note**: Site administrators can also access Accelerators from the Home page, under the section labeled Accelerators. 2. At the top of the Connect to Data window, select Accelerator to browse the Accelerators available to connect to on Tableau Cloud. You can also upload additional Accelerators from the Tableau Exchange to Tableau Cloud and use them as you would in Tableau Desktop. However, you'll need to follow the Tableau Desktop instructions to get your data into the Accelerator instead of the Tableau Cloud instructions. ## Use an accelerator from the Tableau Exchange Follow the instructions in this section to use an Accelerator downloaded from the Tableau Exchange website or opened from within Tableau Desktop. For instructions on using Accelerators when you create a workbook in Tableau Cloud, see [Use an Accelerator directly in Tableau Cloud](#Create). ### Add your data to the Accelerator in Tableau Desktop #### Use the data mapper Data mapping was introduced for a limited number of Accelerators in Tableau Desktop in 2023.1. Starting in 2023.2, the data mapper now: - Saves your selections, if you close it, so that you can pick up where you left off - Allows you to switch between different connected data sources - Supports a larger number of Accelerators The data mapper helps you connect to data and map the fields in your data to those required for the Accelerator. If the Accelerator you have downloaded supports the data mapper, a prompt will appear to help you get started. To find Accelerators that support the data mapper, select the filter Data Mapping enabled on the [Tableau Exchange website](https://exchange.tableau.com/accelerators). For Accelerators that don't support the data mapper, follow the instructions in the next section to [Manually add your data](#manual). When you open an Accelerator that supports it, the data mapper opens. 1. Select Get Started. If you close the data mapper, you can reopen it at any time by selecting Open Data Mapper from the Data menu. 2. If you've already connected to data, select the data source to use for mapping. Otherwise, select Connect to Data, then select the file or cloud-based data to use with the Accelerator. 3. For unpublished data sources with more than one table, you must add data to the canvas so that Tableau can access the fields. If you see a prompt to set up your data, drag one or more tables or sheets to the data source canvas. The data you add will be available to map to the Accelerator. ![Data source canvas](/tableau/next/en-us/online/en-us/Img/accelerator_data_source.gif) For more information about building a data source, see [Use Relationships for Multi-table Data Analysis](https://help.tableau.com/current/pro/desktop/en-us/datasource_multitable_normalized.htm). 4. After you add your data, your fields appear in the To column on the data mapper. For each Accelerator field (From), select a field of the same data type as your data (To). Hover fields to see details about them. - If you notice that a field in your data is marked as the wrong type, change the [data type](https://help.tableau.com/current/pro/desktop/en-us/datafields_typesandroles_datatypes.htm) so that it can be mapped. - If you want to switch the data source you're bringing into the Accelerator, select the data source name after To, then select a different connected data source, or select New Data Source. Switching the data source clears any selections you have made for individual fields. ![Data mapper selection screen](/tableau/next/en-us/online/en-us/Img/data_mapper.png) 5. The indicator in the lower left of the data mapper shows how many fields you've assigned. After you complete your assignments, select Replace Data. Any fields you leave unmapped will cause the dashboards that use those fields to break. This is because all sample data is removed from the Accelerator when you replace the data. 6. Your data replaces the sample data in the Accelerator. Before you close the data mapper, check the dashboards to make sure that the data was mapped as you expected. If you notice issues with the data, select Make Changes to return to the assignment page. Make your adjustments, then replace the data again. Starting in Tableau Desktop 2023.2, if you want to make adjustments after you've closed the data mapper, select Data > Open Data Mapper to refine your selections. In Tableau Desktop 2023.1, the selections you made don't persist, and if you reopen the data mapper, you'll need to repeat the process of adding a data source and making assignments for each field. #### Manually add your data There are two methods to add your data to the Accelerator: replace the data source with a new data source (method 1) or add a new connection to the existing data source (method 2). | Method 1: Replace data source | Method 2: Add new connection | | --- | --- | | Works with data sources that have more than one table. | Data sources must have only one physical table. | | Allows you to change field names to match the Accelerator. | Field names in your data source must match the fields in the Accelerator. | | Doesn't preserve the folder structure in the Accelerator. | Preserves the folder structure, which keeps the fields used by the Accelerator organized. | #### Method 1: Replace the data source Use this method if you're adding a data source with multiple tables. 1. With the Accelerator open in Tableau Desktop, select Data > New Data Source. ![Data menu](/tableau/next/en-us/online/en-us/Img/accelerator_new_datasource.png) 2. Connect to the data you want to use. For more information, see [Connect to Your Data](https://help.tableau.com/current/pro/desktop/en-us/basicconnectoverview.htm). If you're using a Salesforce Accelerator, make sure your account has API access to your Salesforce instance. 3. On the Data Source tab, drag tables onto the canvas to build your new data source. For more information, see [Use Relationships for Multi-table Data Analysis](https://help.tableau.com/current/pro/desktop/en-us/datasource_multitable_normalized.htm). 4. Open a dashboard, then select the Go to Sheet icon for any of the sheets listed. ![Go to sheet button](/tableau/next/en-us/online/en-us/Img/accelerator_go_to_sheet.png) This step is necessary because you can only replace data from a worksheet, not from a dashboard or story tab. For more information about the types of sheets in a workbook, see [Workbooks and Sheets](https://help.tableau.com/current/pro/desktop/en-us/environ_workbooksandsheets.htm). 5. Select Data > Replace Data Source. For more information, see [Replace Data Sources](https://help.tableau.com/current/pro/desktop/en-us/connect_basic_replace.htm). ![Data menu](/tableau/next/en-us/online/en-us/Img/accelerator_replace_datasource.png) 6. Under Replacement, select the data source you added, then select OK. 7. In the Data pane, right-click the original data source, then select Close. For more information, see [Close Data Sources](https://help.tableau.com/current/pro/desktop/en-us/close_connection.htm). ![Data source menu](/tableau/next/en-us/online/en-us/Img/accelerator_datasource_close.png) #### Fix broken references If the new data source doesn't have the same field names as the original, parts of the Accelerator will be blank. Replace the broken references so that they use the correct fields from your new data source. 1. Open a dashboard, then select the Go to Sheet icon for one of the sheets listed. ![Go to sheet button](/tableau/next/en-us/online/en-us/Img/accelerator_go_to_sheet.png) 2. In the Data pane, identify the required fields for the Accelerator. The Accelerator page on the [Tableau Exchange](https://exchange.tableau.com) should list these fields in the description section. 3. Replace the field references for any fields that are marked with a red exclamation point. - To do so, right click on the field name and select Replace References.... Then select the correct field name from the list. - For more information, see [Replace Field References](https://help.tableau.com/current/pro/desktop/en-us/howto_connect.htm#replace-field-references). ![Broken reference indicator](/tableau/next/en-us/online/en-us/Img/accelerator_broken_references.png) #### Method 2: Edit the data source Use this method if you have a data source with only one physical table that can directly replace the physical table in the Accelerator. 1. With the Accelerator open in Tableau Desktop, select the Data Source tab. ![Data source tab](/tableau/next/en-us/online/en-us/Img/accelerator_datasource_tab.png) 2. Next to Connections, select Add. Connect to the data you want to use. For more information, see [Connect to Your Data](https://help.tableau.com/current/pro/desktop/en-us/basicconnectoverview.htm). ![Add connection](/tableau/next/en-us/online/en-us/Img/accelerator_add_datasource.png) 3. On the data source canvas, double-click the logical table to open the physical table. For information about logical and physical tables, see [Layers of the data model](https://help.tableau.com/current/online/en-us/datasource_datamodel.htm#layers-of-the-data-model). ![Data source logical table](/tableau/next/en-us/online/en-us/Img/accelerator_table.png) 4. Drag the table from the data source you added and drop it onto the existing physical table to replace the sample data. Your data source must be only one physical table. ![Dragging new table to replace physical table](/tableau/next/en-us/online/en-us/Img/accelerator_table_replace.png) 5. Under connections, right-click the connection for the sample data, then select Remove. ![Remove connection](/tableau/next/en-us/online/en-us/Img/accelerator_connection_remove.png) ## Use an Accelerator directly in Tableau Cloud A limited number of Accelerators are available for you to use when you create a workbook in Tableau Cloud. These Accelerators prompt you to connect directly to a cloud-based data source, rather than requiring you to add data manually. 1. On Tableau Cloud, create a new workbook. 2. At the top of the Connect to Data window, select Accelerator. 3. From the list of pre-built designs, find an option that reflects the data source and business metrics you need, and select Use Dashboard. 4. To quickly see how a workbook looks with sample data, select Continue without signing in. Or select Continue to create a workbook with your data. 5. Specify a name and containing project for the workbook. 6. If you chose to create a workbook with your data, connect to your data source. While Tableau prepares an extract of your data, sample data appears so you can explore the layout. **Note:** If you download an Accelerator from the Tableau Exchange with the intention of uploading it to Tableau Cloud, you'll need to replace the data by following the instructions under [Use an accelerator from the Tableau Exchange](#exchange). ## Change permissions to share Accelerators with colleagues To avoid exposure of confidential data, workbooks for Accelerators are visible only to authors and administrators by default. To share a Accelerator with your colleagues, follow these steps: 1. In Tableau Cloud, [navigate to the workbook](https://help.tableau.com/current/pro/desktop/en-us/navigating.htm) for the Accelerator. 2. On the workbook, select Actions > Permissions. 3. Give View permissions to any user or group you want to see the dashboard. For more information, see [Edit Permissions](https://help.tableau.com/current/online/en-us/permissions.htm) in Tableau Cloud Help. ## Replace sample data with your data If you chose to use sample data in a dashboard, you can replace it with your data at any time. 1. In Tableau Cloud, [navigate to the workbook](https://help.tableau.com/current/pro/desktop/en-us/navigating.htm) for the Accelerator. 2. On the Data Sources tab, select the data source. From the Actions menu, select Edit Connection. 3. For authentication, select Embedded credentials in the connection, and either select an existing user account or add a new one. Then select Save. 4. On the Refresh Schedules tab, select the schedule. From the Actions menu, select Run Now. ## Fix grayed-out views by replacing field names If your organization has customized the data structure for a cloud-based system, you may need to match those changes in Accelerators after your data loads in them. For example, if your organization has renamed the Salesforce "Account" field to "Customer", you'll need to make a corresponding change in Accelerators to avoid grayed-out views like this: ![A grayed out sales performance dashboard.](/tableau/next/en-us/online/en-us/Img/jumpstarts_grayed_out.png) Replace the field references to fix the broken fields. 1. On the dashboard, select Edit. 2. [Navigate directly to the grayed-out sheet](https://help.tableau.com/current/pro/desktop/en-us/help.htm#environ_workbooksandsheets_sheets_hideshow.htm#Temporar). 3. In the Data pane at left, look for red exclamation points (!) next to field names, which indicate that your organization uses different names. 4. Right-click each of those fields, and select Replace References.... Then select the correct field name from the list. ![Context menu expanded from a measure with the option to replace references highlighted.](/tableau/next/en-us/online/en-us/Img/jumpstarts_replace_references.png) ## Fix empty dashboards by changing default date ranges If a dashboard looks completely empty, the likely cause is a default date range that doesn't correspond to the dates in your source data. 1. [Download the workbook](https://help.tableau.com/current/pro/desktop/en-us/help.htm#export.htm), then open it in Tableau Desktop. 2. Select the Data Source tab. 3. In the upper-left corner, select the arrow next to the data source name, and select Edit Connection. Then sign in. ![Context menu for a connection with the option to edit the connection selected.](/tableau/next/en-us/online/en-us/Img/jumpstarts_empty_connection.png) 4. Specify a date range that reflects the dates in your data, then select Connect. 5. Select Server > Publish Data Source to update extracts of the data on Tableau Cloud. [Skip to main content](#main-content) # Use Admin Insights to Create Custom Views You can get more visibility into your Tableau Cloud deployment by using Admin Insights. Admin Insights is a Tableau Cloud-only project that is pre-populated with carefully curated data sources and a pre-built workbook of your site's data. Using the resources available to you through the Admin Insights project, you can create custom views to help answer a range of common questions you might have about your site. For example: - What's my Tableau Cloud adoption rate in my organization? - What are common trends around the site's deployment? - What content is popular? - What are my users doing? - How should licenses be allocated? ## Connect to Admin Insights data If you're a site admin or someone who has been granted access to the Admin Insights project, you can access the Admin Insights data sources directly from Tableau Cloud using Web Authoring or through Tableau Desktop. **From Tableau Cloud** 1. Sign in to Tableau Cloud and navigate to the Admin Insights project. 2. Select Create > Workbook and select one of the data sources to get started. **From Tableau Desktop** 1. Open Tableau Desktop, under Connect, select Tableau Server. **Note:** If you're not already signed in to Tableau Cloud, in the Tableau Server Sign In dialog, click the Tableau Cloud hyperlink. Enter your Tableau Cloud credentials and then click Sign In. 2. In the search box, type the name of the data source you're looking for. 3. Select a data source and click Connect to get started with your analysis. ## Start creating custom views As you think about how you want to approach the analysis of your site and user metrics, consider some of the following questions that organizations commonly ask: - What are the most popular views or data sources? - Who are the most active users (i.e., who are the power users)? - What are the most common tasks performed on the site? - How many licenses are being used? - Who hasn't signed in to the site in more than 90 days? ### Explore the pre-built workbook To help you answer the previous questions (and more), go to the pre-built workbook, Admin Insights Starter, to see what kind of insights it can offer. The workbook serves as a template for creating more detailed dashboards and workbooks that address unique questions related to your site or organization. Starting in October 2024, localized versions of the Admin Insights Starter workbook are available as accelerators on [Tableau Exchange](https://exchange.tableau.com/search?q=admin+insights+starter). ![A dashboard with data about users, login activity, traffic, and adoption of admin templates.](/tableau/next/en-us/online/en-us/Img/insights_workbook.png) **Focus:** Site activity **Data source:** TS Users Use this dashboard to explore high-level site activity by user role. This dashboard shows you some of the ways you can analyze your site's log and activity metrics. Admin Insights captures up to 90 days of data by default and up to 365 days with an [Advanced Management](https://help.tableau.com/current/online/en-us/itm_intro.htm) license. The "Last Publish" and "Last Access" dates can go back to the date the site was created, except for these fields: - last\_datasource\_access\_date - last\_datasource\_publish\_date - last\_view\_access\_date - last\_workbook\_publish\_date - web\_authoring\_last\_access\_date **Do more with this dashboard:** - Change the "Inactivity threshold" (yellow by default) using the parameter control in the upper-right corner. - Create URL actions that can email users based on their activity type. For example, email users when they haven't signed in to the site, accessed content, or published content in the last 90 days. - Create additional views for this dashboard that compares the last 90 days (default) of activity (sign in, access, or publish) to the last 30 days, 60 days, and all days. **Focus:** Group membership and licensing **Data source:** Groups, TS Events, TS Users The dashboard shows you the count of groups and grouped users on the site. Use the filters or click a row or mark in the Group Breakdown worksheet to select a group. After a single group is selected, you can view membership and license details. The dashboard shows you the following types of information: - Group membership: How many groups and grouped users are on the site - License consumption: The percentage of groups using licenses on sign-in - Site roles and license type: Which users are members of the group and what site role are they assigned **Do more with this dashboard:** Select a user from the membership worksheet to email all group members. **Focus:** Sign-in activity **Connects to:** TS Events (primary), TS Users (secondary) Use this dashboard to explore trends in sign-in activity. Using the "Select Events or Distinct Actors" selector on the left, you can see your site's weekly, daily, and hourly sign-in-related activity. Because there are two data sources behind this dashboard, you can see sign-ins by all users, not just users with recent sign-in activity. **Do more with this dashboard:** Duplicate the dashboard and keep only the "Login user breakdown." Then change the filter on the "Last Login Date" to null to see a list of users who have never signed in to the site. You can also email them depending on what kind of action you want users to take. **Focus:** Content access and usage **Connects to:** TS Events The information in the dashboards show you the following types of information: - View access activity: When a view has been accessed and by whom. - Data source access activity: When 1) a published data source has been connected to through Web Authoring or Tableau Desktop or 2) a user has viewed or published a workbook that uses the published data source. - Workbook publish activity: When a workbook has been published and by whom. - Data source publish activity: When a published data source has been published and by whom. **Do more with this dashboard:** Using the "Project Name" selector in the upper-right corner, select a project on your site to filter on. This filter affects all sheets in the Admin Insights Starter. **Focus:** Content usage and disk space **Connects to:** Site Content, TS Events The dashboard shows you the following types of information: - Disk space usage by activity: Amount of space used by stale content and content considered active - content accessed in the time frame below the stale threshold. - Space used by item: Amount of space used by content on the site. The x-axis shows the number of days since the content was last viewed, while the y-axis shows the size. - Space used by stale and unused content: Total amount of space used by stale and unused content. You can use this information to determine which content is the most stale or takes the most space. **Do more with this dashboard:** - Use the Inactivity Threshold to determine how long content can go unused before it's deemed stale. Changing this value filters content items that don't meet the threshold. - Use the Project Name selector to filter content by project. This filter affects all sheets in the Admin Insights Starter. - To maintain a clean site, remove content that is no longer in use. If you're unsure, select an item to email the content owner before deleting it. **Focus:** Content ownership and disk space **Connects to:** Site Content, TS Events The dashboard shows you the following types of information: - Site capacity: Amount of space used in relation to the total site capacity. - Space usage by project: Amount of space used by top-level projects. Selecting a project filters the other worksheets to show content items, size, and ownership details. - Space usage by item: Amount of space used by content items, such as workbooks, data sources, flows, and virtual connections. - Space usage by user: Check how much space content owners are using and identify if any groups or users are exceeding their allotted space. **Do more with this dashboard:** - Use the Project Name selector to filter content by project. This filter affects all sheets in the Admin Insights Starter. - Select an item or user to send an email and clarify how the content is used. **Focus:** Dashboard performance **Connects to:** Viz Load Times The dashboard shows you the following types of information: - Success metrics: See the average dashboard load time, total number of requests, and total number of content owners. - Performance ratings: Users can set performance thresholds to see what percentage of dashboards fall into each rating. By using performance ratings, you can quickly identify content that needs improvement. - Number of requests: Users can filter by the number of requests to see the most popular content. Understanding how often content is viewed can help prioritize performance fixes. - Content list: See the count and average load time for projects, workbooks, and views. Users can filter columns by item name or the entire dashboard by workbook owner. **Do more with this dashboard:** - Use performance ratings to understand the overall health of dashboards. To see the most problematic dashboards, select the lower percentage within each performance rating to filter content. - Identify performance issues and trends over time. To collaborate with content owners on performance problems, hover over or select the marks in the Views column to see their username. ### Explore the data sources You can connect to Admin Insights data sources from Tableau Cloud and Tableau Desktop. Connecting to the data sources directly allows you to explore the data and build dashboards or workbooks specific to your organization. For more information about how to connect, see [Connect to Admin Insights data](#connect) in this topic. The following table provides an overview of each data source.

Data source	Description
TS Events	TS Events functions as a primary audit data source. It contains data about the various events happening on your site, including sign-in, publishing, and accessing views.
TS Users	TS Users contains data about your users, such as remaining licenses, site roles, and workbooks owned by a user. It also includes product activation and usage data for Tableau Desktop, Tableau Prep, web authoring, and site role-specific capabilities.
Groups	The Groups data source identifies the group membership of users on the site.
Site Content	The Site Content data source provides essential governance information about the assets on your site, such as projects, workbooks, flows, and views. It also includes Tableau Pulse information.
Viz Load Times	Viz Load Times contains the load time information for views on your site, helping content authors understand the user experience when loading views.
Job Performance	Job Performance contains events and runtime information for background jobs on the site, such as extract refreshes and flow runs. It also includes Tableau Bridge refresh data, such as the Bridge client name, pooling data, and refresh started and completed times.
Permissions	Permissions contains the effective permissions for all users and content on the site. Site administrators can use the data source to identify gaps in permissions security and ensure that only the appropriate users can access content items.
Subscriptions	The Subscriptions data source provides details about subscriptions on the site, including the name of the creator and recipient, content item, job status, and schedules. It also includes Tableau Pulse information.
Tokens	Tokens contains information about active, unexpired user tokens on the site, including personal access tokens (PATs), refresh tokens, and OAuth tokens. Site administrators can monitor token usage and expiration through the data source, rotating essential tokens as needed.

## Other articles in this section [Skip to main content](#main-content) # Use an External KMS for Credential Encryption Keys You can store the master keys you use to encrypt and decrypt stored data credentials in an external key management system (KMS). By providing direct control over encryption keys, using an external KMS can help enhance the security posture for organizations, meet regulatory mandates, and maintain data sovereignty. For general information on the benefits of using an external KMS for key management, see [Use an External KMS for Key Management](https://help.tableau.com/v0.0/online/en-us/to_external_kms.htm). Note: The External KMS for Credential Encryption Keys feature is available starting with Tableau Cloud August 2026 if you have Tableau +, Tableau Enterprise, or Advanced Management. If at some point you no longer have Tableau +, Tableau Enterprise, or Advanced Management, working with your encrypted objects will still work, but you won't be able to manage keys. ## Setup overview The summary-level steps to use the AWS KMS for storing data credentials encryption keys are: 1. [Enable extract encryption using an external KMS](#Enable-for-extracts) 2. [Enable credentials encryption](#Enable) 3. [Generate a data key in Tableau](#Generate) ### Key statuses When using an external KMS, the keys used for credential encryption in Tableau Cloud have these statuses and capabilities:: - **Active** — The key is being used to encrypt credentials, and to decrypt credentials that it encrypted. - **Archived** — The key was active in the past, but was superseded by a later key. It's not being used to encrypt credentials, but is being used to decrypt credentials that it encrypted. - **Deactivated** — The key was active in the past, was later archived, and has since been deactivated. It's not being used for encrypting or decrypting any credentials. #### Status quick reference | Key status | Can encrypt credentials | Can decrypt credentials | | --- | --- | --- | | Active | ✓ | ✓ | | Archived | | ✓ | | Deactivated | | | ## Setup details Configuration starts with: 1. Log in to your Tableau Cloud site. 2. Select Settings in the left navigation pane. 3. Select the Security tab. ### 1\. Enable extract encryption using an external KMS To use an external KMS for data credential encryption, enable external KMS for extract encryption first. See the "Setup Details" section of [Use an External KMS for Extract Encryption Keys](https://help.tableau.com/v0.0/online/en-us/to_external_kms_extracts.htm#kms-extracts-setup-details). ### 2\. Enable credentials encryption To enable credentials encryption: 1. Under the Credentials Encryption section, select Encrypt saved credentials. ### 3\. Generate a data key To encrypt and decrypt saved data credentials, generate a data key. To generate a data key: 1. Under the Credentials Encryption section, select Generate Data Key. 2. In the dialog, select Generate Data Key. Note that you can't generate more than one data key in a 7 day period. If the dialog doesn't contain the Generate Data Key button, it means you've generated a data key within the last 7 days. After generation, the new key's status is Active, which means it's being used to encrypt and decrypt stored data credentials. Note: After you enable encryption and activate the first key on a site, Tableau Cloud creates encryption jobs for all data credentials on your site. These jobs run in the background and are set to the lowest priority, meaning they run only when there are extra resources. ## Other Actions ### Archive a key Archived keys can decrypt credentials they encrypted, but aren't used to encrypt them. The only way to archive a key is by generating a new data key. See [Generate a data key](#Generate). ### Deactivate a key Deactivate an archived key to make it unusable for encrypting or decrypting any stored credentials. You might do this if the key has been compromised. The Deactivate Key action is only available on an Archived key. When you deactivate a key, it can't be used to decrypt credentials it encrypted (in contrast to an archived key, which _can_ decrypt credentials it encrypted). Note: You can Restore a deactivated key if necessary. Restoring a key will change it from Deactivated to Archived. See [Restore a Key](#Restore). To deactivate a key: 1. Under the Credentials Encryption section, select actions (...) next to the appropriate Archived key. 2. Select Deactivate Key.... 3. Enter "Deactivate this key" into the text field to confirm your action. 4. Select Deactivate Data Key. ### Restore a key Restore a deactivated key to make it usable for decrypting credentials it encrypted. The Restore Key action is only available on a Deactivated key, and changes it to Archived. When you restore a key to the archived state, it won't be used to encrypt any credentials. It's only used to decrypt credentials that it wrote. 1. Under the Credentials Encryption section, select actions (...) next to the appropriate Deactivated key. 2. Select Restore Key.... 3. Select Restore Data Key. ### Delete a key You can't delete credentials encryption keys. A key can only be archived (which retains the ability to decrypt credentials it wrote), or deactivated (which can neither encrypt nor decrypt). See [Key Statuses](#Key). Note: If you disable the customer master key (CMK) in the AWS KMS, Tableau keys descended from it stop working for encryption or decryption. Likewise, if you remove the Tableau-generated clause from the CMK's policy in the AWS KMS, Tableau keys descended from it stop working. [Skip to main content](#main-content) # Use an External KMS for Extract Encryption Keys You can store the master keys you use to encrypt and decrypt extracts in an external key management system (KMS). By providing direct control over encryption keys, using an external KMS can help enhance the security posture for organizations, meet regulatory mandates, and maintain data sovereignty. For general information on the benefits of using an external KMS for key management, see [Use an External KMS for Key Management](https://help.tableau.com/v0.0/online/en-us/to_external_kms.htm). Note: The External KMS for Extract Encryption feature is available starting with Tableau Cloud February 2026 if you have Tableau +, Tableau Enterprise, or Advanced Management. If at some point you no longer have Tableau +, Tableau Enterprise, or Advanced Management, working with your encrypted objects will still work, but you won't be able to manage keys. ## Setup overview The summary-level steps to use the AWS KMS with Tableau are: 1. **AWS KMS**: [Create the customer master key](#Create) (CMK). 2. **Tableau Cloud**: [Enable extract encryption](#Enable) (or migrate from customer-managed encryption keys, which uses the Salesforce KMS). 3. **Tableau Cloud**: [Generate a key in Tableau](#Generate), using the customer master key's ARN from the AWS KMS. 4. **AWS KMS**: [Add the Tableau key policy](#Policy) JSON to the AWS customer master key's policy. 5. **Tableau Cloud**: [Activate the key](#Activate). ### Key statuses When using an external KMS, the keys used for extract encryption in Tableau Cloud have these statuses and capabilities: - **Pending** — You generated the key, but aren't using it yet. It can't be used to write or read any extracts until you activate it. - **Active** — The key is being used to write extracts, and to read extracts that it wrote. - **Archived** — The key was active in the past, but was superseded by a later key. It's not being used to write extracts, but is being used to read extracts that it wrote. - **Deactivated** — The key was active in the past, was later archived, and has since been deactivated. It's not being used for reading or writing any extracts. #### Status quick reference | Key status | Can write/encrypt extracts | Can read/decrypt extracts | | --- | --- | --- | | Pending | | | | Active | ✓ | ✓ | | Archived | | ✓ | | Deactivated | | | ## Setup details Configuration starts with: 1. Log in to your Tableau Cloud site. 2. Select Settings in the left navigation pane. 3. Select the Security tab. ### 1\. Create a master key in the AWS KMS The keys that Tableau uses for encryption are based on customer master keys (CMKs) that exist in the [AWS KMS](https://console.aws.amazon.com/kms/). Therefore, you need a CMK in the AWS KMS before Tableau can generate keys. The Tableau key generation dialog contains a link to the [AWS KMS](https://console.aws.amazon.com/kms/) so that you can create a CMK or get info about one that already exists. If you need help with keys in the AWS KMS, consult with your local key expert. AWS keys are uniquely identified by an Amazon Resource Name (ARN). You’re asked to provide the CMK ARN during the Tableau key generation process. Key ARNs are formatted like: `arn:aws:kms:us-east-2:123456789012:key/12345678-90ab-cdef-1234-567890abcdef` After the customer master key is created in AWS, you can enable extract encryption in Tableau Cloud. ### 2\. Enable extract encryption with an external KMS Note: After you enable encryption, you can't disable it. Similarly, switching from customer-managed encryption keys (using the Salesforce KMS) to an external KMS is permanent and can't be undone. To enable an external KMS: 1. Under the Extract Encryption section, select Encrypt Extracts. 2. Select Use an external KMS. - If Use the Salesforce KMS is already selected, you're currently using customer-managed encryption keys through the Salesforce KMS. (For more information, see [Customer-Managed Encryption Keys](https://help.tableau.com/v0.0/online/en-us/to_customer_managed_encryption_keys.htm).) Changing the setting to Use an external KMS will irreversibly change from the Salesforce KMS to an external KMS. Before you change your KMS, see [Migrate from Customer-Managed Encryption Keys to External KMS](https://help.tableau.com/v0.0/online/en-us/to_external_kms_migrate.htm). 3. Select Generate Key. - If you're migrating from the Salesforce KMS to an external KMS, read the warning, then select Switch to External KMS. ### 3\. Generate a key Generating a key is the first step towards reading and writing encrypted extracts. If you already have an active key, you generate another key as a first step towards replacing the currently active key. To generate a key in Tableau: 1. Under the Extract Encryption section, select Generate Key. 2. If you're generating the first key for a site, you see the Configure the AWS KMS dialog. If you already have an active key, proceed through the Generate Key confirmation dialog first. 3. Select Launch the AWS KMS and log in if needed. 4. In the AWS KMS, create a new key or find an existing one, then copy the key ARN. If you need help with keys in the AWS KMS, consult with your local key expert. 5. Return to the Tableau Configure the AWS KMS dialog and paste the key ARN into the Key ARN from AWS field. 6. Optionally, enter a Description. 7. Select Next (or Enable Encryption, if this is the first key for the site). 8. Select Done to add the key policy JSON to the AWS KMS later, or follow [Add Key Policy JSON to KMS Key Policy](#Policy) to do it now. The key can't be used to read or write extracts until you add the key policy JSON to the AWS KMS policy and then activate it. ### 4\. Add key policy JSON to KMS key policy A newly-generated key has a status of Pending. It can't be used to read or write extracts until you add the key policy JSON to the AWS KMS policy and then activate it. To see the key policy JSON, continue from the [Generate a Key](#Generate) process. Or, if you're _not_ continuing from that process: 1. Under the Extract Encryption section, select actions (...) next to the appropriate Pending key. 2. Select Key Policy. To add the key policy JSON to the AWS KMS policy, copy the relevant `Statement` object from Tableau to the policy JSON in the AWS KMS. You only need part of the complete JSON text. Keep in mind that selecting Copy Key Policy for pasting and editing in a text editor can be easier. From the JSON text, copy the object in the `Statement` array. Then, in the AWS KMS key's policy, add the copied text to the `Statement` array, following standard JSON syntax. (You may need to add a comma to the end of the existing AWS KMS's `Statement` array before adding the new JSON.) Example: The highlighted portion is the section to add to the AWS KMS policy: ``` { "Version": "2012-10-17", "Id": "sfdc-key-access-policy", "Statement": [ { "Sid": "AllowSalesforceShieldKeyBroker1234567890abc", "Effect": "Allow", "Principal": { "AWS": "arn:aws:sts::123456789abc:assumed-role/EkmAwsKmsAccessRole/1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ12" }, "Action": [ "kms:GenerateDataKey*", "kms:Decrypt" ], "Resource": "*", "Condition": { "StringEquals": { "kms:EncryptionContext:sf-auth": "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ" } } } ] } ``` ### 5\. Activate a key Activate a key to use it for reading and writing new extracts. The Activate Key action is only available on a Pending key. 1. Under the Extract Encryption section, select actions (...) next to the appropriate Pending key. 2. Select Activate Key.... If you already have an active key, activating a new key changes the existing key status to Archived. An archived key is only used to read extracts that it wrote. The new key will become Active, and will be used to write new extracts and read extracts that it wrote. Note: After you enable encryption and activate the first key on a site, Tableau Cloud creates an extract encryption background job for each extract on your site. These jobs are set to the lowest priority, meaning they run only when there are extra resources. Existing extract refresh jobs run before extracts are encrypted. ## Other actions ### Archive a key Archived keys can read extracts they wrote, but aren't used to write new extracts. The only way to archive a key is by activating a new key. See [Activate a Key](#Activate). ### Deactivate a key Deactivate an archived key to make it unusable for reading or writing any extracts. You might do this if the key has been compromised. The Deactivate Key action is only available on an Archived key. When you deactivate a key, it can't be used to read extracts it wrote (in contrast to an archived key, which can read extracts it wrote). This means that some extract-based content could stop working if it hasn't been encrypted with an active key. If you need to retain access to extract-based content that uses the old key, make sure the extracts are refreshed with an active key before deactivating the old one. Note: You can Restore a deactivated key if necessary. Restoring a key will change it from Deactivated to Archived. See [Restore a Key](#Restore). To deactivate a key: 1. Under Extract Encryption section, select actions (...) next to the appropriate Archived key. 2. Select Deactivate Key.... 3. Enter "Deactivate this key" into the text field to confirm your action. 4. Select Deactivate Key. ### Restore a key Restore a deactivated key to make it usable for reading extracts it wrote. The Restore Key action is only available on a Deactivated key, and changes it to Archived. When you restore a key to the archived state, it won't be used to write any extracts. It's only used to read extracts that it wrote. 1. Log in to your Tableau Cloud site. 2. Select Settings in the left navigation pane. 3. Select the Security tab. 4. Under Extract Encryption section, select actions (...) next to the appropriate Deactivated key. 5. Select Restore Key.... 6. Select Restore Key. ### Delete a key You can't delete extract encryption keys. A key can only be archived (which retains the ability to read content it wrote), or deactivated (which can neither read nor write). See [Key Statuses](#Key). Note: If you disable the customer master key (CMK) in the AWS KMS, Tableau keys descended from it stop working for encryption or decryption. Likewise, if you remove the Tableau-generated clause from the CMK's policy in the AWS KMS, Tableau keys descended from it stop working. ### See key policy The Key Policy dialog shows the key policy JSON for adding to the AWS KMS key's policy. The key policy JSON can be added during the [Generate a Key](#Generate) process, or later. For more information, see [Add Key Policy JSON to KMS Key Policy](#Policy). To see the key's policy JSON: 1. Under the Extract Encryption section, select actions (...) next to the appropriate key. 2. Select Key Policy. ### See key history Each row of the key history table shows an event, the key status after the event, and the date and time of the event. To see a key's history: 1. Under the Extract Encryption section, select actions (...) next to the appropriate key. 2. Select Key History. ### Test configuration Use the Test Configuration action on a pending key to determine if it can be activated. Use the Test Configuration action on keys with other statuses to show whether they’re working, should work, or won't work. To test the configuration for a key: 1. Under the Extract Encryption section, select actions (...) next to the appropriate key. 2. Select Test Configuration.... **Success:** - The key can be used to encrypt extracts. If the key is pending, it’s safe to activate. If the key is already active, it’s working. **Errors:** - POLICY\_DENIED — The external KMS doesn't have a policy that allows this key. Confirm that you've copied the policy from this key to the external KMS. - KEY\_NOT\_FOUND — The key wasn't found, or the key is deactivated in Tableau. Confirm the AWS KMS key ARN and policy. - UNKNOWN — An unknown error occurred. Make sure the key isn't disabled in the AWS KMS and try again. Note: If you disable the customer master key (CMK) in the AWS KMS, Tableau keys descended from it stop working for encryption or decryption. Likewise, if you remove the Tableau-generated clause from the CMK's policy in the AWS KMS, Tableau keys descended from it stop working. [Skip to main content](#main-content) # Use an External KMS for Key Management Many organizations require direct control over the encryption keys that protect their business-critical data. Using an external key management service (KMS) addresses this requirement by allowing customers to maintain control of their encryption keys with a trusted external key management vendor. By providing direct control over encryption keys, using an external KMS significantly enhances the security posture for organizations, particularly those concerned about unauthorized access to these critical keys. Furthermore, for many organizations, the ability to control their encryption keys externally is crucial for meeting various regulatory and compliance mandates. And direct control over encryption keys assists organizations in maintaining data sovereignty, which is important for legal and geographical considerations of data storage and access. As of February 2026, Tableau Cloud offers external key management exclusively through the Amazon Web Services (AWS) KMS. Note: External KMS features are available starting with Tableau Cloud February 2026 if you have Tableau +, Tableau Enterprise, or Advanced Management. If at some point you no longer have Tableau +, Tableau Enterprise, or Advanced Management, working with your encrypted objects will still work, but you won't be able to manage keys. ## Features with external KMS support You can use an external KMS to store encryption keys for: - Extract encryption - Data credentials encryption Note: To use an external KMS for data credentials encryption, enable external KMS for extract encryption first. Tableau encrypts both extracts and data credentials using the Salesforce-standard AES-GCM algorithm. ## Other articles in this section [Skip to main content](#main-content) # Use Bridge to Keep Data Fresh For data sources or virtual connections data that Tableau Cloud can't reach directly, you can use Tableau Bridge to keep data fresh. For example, use Bridge when your data source connects to data hosted behind a firewall. **Note:** If a data source connects to underlying data hosted in the cloud and is accessible from the public internet, connections run from Tableau Cloud directly. ## What is Bridge Tableau Bridge is client software that runs on a machine in your network. The client works in conjunction with Tableau Cloud to keep data sources that connect to private network data, which Tableau Cloud can't reach directly, up to date. Private network data includes on-premises data and private network cloud data. ## How does it work Tableau Bridge functions like a conduit between private network data, such as Excel files and SQL Server data, and Tableau Cloud. The client communicates with Tableau Cloud through an outbound encrypted connection to enable connectivity between data behind a firewall and your Tableau Cloud site. ![shows connectivity between data behind a firewall and Tableau Cloud](/tableau/next/en-us/online/en-us/Img/bridge_basic_overview_cloud2_sz.png) For more information about how Bridge communicates with Tableau Cloud, see [Tableau Bridge Security](https://help.tableau.com/current/online/en-us/to_bridge_security.htm). ## Who can use it Although any authorized user of Tableau Cloud can use Bridge, Bridge is optimized for users that perform the following functions in an organization: site admins and data source owners. **Site admins**, or users who have the Site Administrator or Site Administrator Creator role on Tableau Cloud, install and manage Bridge clients. For more information, see [Plan Your Bridge Deployment](https://help.tableau.com/current/online/en-us/to_bridge_scale.htm). **Content owners**, or users who have the Creator or Explorer (can publish) role on Tableau Cloud, typically publish and manage their own content. Content owners use Bridge to facilitate the live and extract connections between Tableau Cloud and private network data. - For **live connections**, Bridge is detected automatically as part of the data source or virtual connection publishing process. Support for live connections are enabled through pooling. **More about data sources:** Users see the option to publish the data source with a live connection during the publishing process. This option is available when live connections are supported for relational or cloud databases accessible only from inside the network. After the user publishes the data source, an available client in the pool facilitates the live queries. That’s all there is to it. To get started, users publish a data source to Tableau Cloud, and select the option to maintain a live connection. Or, publish a workbook, then specify a live connection. For more information about publishing data sources, see [Publish a Bridge Data Source with a Live Connection](https://help.tableau.com/current/online/en-us/to_bridge_livequery.htm). **Note:** If publishing a data source that connects to a private cloud database, follow the steps described at [Publish private cloud-based data sources](https://help.tableau.com/current/online/en-us/to_bridge_vpc.htm) to ensure Bridge is used to facilitate the data freshness tasks. - For **extract connections**, users can set up refresh schedules for data sources or virtual connections. For more information, see [Set Up a Bridge Refresh Schedule](https://help.tableau.com/current/online/en-us/to_sync_schedule.htm). **Note:** If publishing a data source that connects to a private cloud database, follow the steps described at [Set up schedules for private cloud-based data sources](https://help.tableau.com/current/online/en-us/to_bridge_vpc.htm) to use Bridge facilitated refresh schedules. [Skip to main content](#main-content) # Use Certification to Help Users Find Trusted Data In a self-service environment with multiple publishers, it's common for a project on Tableau Cloud to contain a variety of content that is named similarly, or is based on the same or similar underlying data, or is published without any descriptive information about it. When this is the case, analysts might lack confidence about the data they should use. To help your users find the data that's trusted and recommended for their type of analysis, you can _certify_ the data that complies with your organization's data standards. In addition to certifying published data sources, if you have a Data Management license for Tableau Server or Tableau Cloud: - If Tableau Catalog is enabled, you can certify databases and tables that are associated with your Tableau content. (For more information about Tableau Catalog, see "About Tableau Catalog" in the [Tableau Server](https://help.tableau.com/current/server/en-us/dm_catalog_overview.htm) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/dm_catalog_overview.htm) Help.) - Starting in Tableau 2022.1, you can certify virtual connections and virtual connection tables. ## How certification helps users find trusted data When you certify an asset, users see a green badge or green check mark, depending on where the asset is being viewed. ![Certified badge on database](/tableau/next/en-us/online/en-us/Img/datasource_cert_badge_1.png) ![Certified badge on data source as it appears in Web Authoring or Desktop](/tableau/next/en-us/online/en-us/Img/datasource_cert_badge_2.png) ![Certified badge on data source as it appears in Server list view](/tableau/next/en-us/online/en-us/Img/datasource_cert_badge_3.png) Certified data sources rank higher in search results and are added to recommended data sources. In addition, you can provide notes about the certification status, which appear when users click the badge, or in a tooltip when they hover over the data source icon in web authoring or Tableau Desktop. The information also shows who certified the data source. ![](/tableau/next/en-us/online/en-us/Img/datasource_cert_badge_tooltip.png) ## Create guidelines for selecting data to certify As with most Tableau functionality, certification is flexible. You can define for your organization the criteria you use to determine when to certify an asset. As you do so, document and share your guidelines. The guidelines can help you, other administrators, and project leaders to be consistent with your certification choices. They can also help users understand what certification means. Whether you use the same certification criteria across all projects, or define unique criteria for each project, the important thing is to be clear about what certification means in your environment. ## Who can certify data To certify a data source, you must - be a Server or Site Administrator, _or_ - have a site role of Explorer (Can Publish) or Creator _and_ be the project owner or have the Project Leader capability for the project containing the data you want to certify. To certify virtual connections and virtual connection tables, you must have a Data Management license in your environment, and you must - be a Server or Site Administrator, _or_ - have a site role of Explorer (Can Publish) or Creator _and_ be the project owner or have the Project Leader capability for the project containing the data you want to certify. To certify databases or tables, you must have Tableau Catalog enabled in your environment, and you must - be a Server or Site Administrator, _or_ - have the Set permissions capability on the database to certify that database or any tables within that database. ## How to certify data The data you can certify depends on the permissions you have, and whether you have a Data Management license and Tableau Catalog enabled in your environment. - All users with permissions can certify data sources. - If you have a Data Management license, users with permissions can also certify virtual connections and virtual connection tables. - If you have a Data Management license and Tableau Catalog is enabled, users with permissions can also certify databases, tables, and files. To certify an asset: Note: Starting in Tableau Cloud February 2024 and Tableau Server 2024.2, you add and remove certifications using the consolidated Data Labels dialog instead of separate dialogs for each type of label. For information on the Data Labels dialog, see [The Data Labels dialog](https://help.tableau.com/v0.0/online/en-us/dm_labels.htm#data-labels-dialog). 1. Search for or navigate to the asset. The steps to navigate depend on the type of asset you want to certify: - Data source or virtual connection - on the Explore page, select All Data Sources or All Virtual Connections. - Virtual connection table - on the Explore page, select All Virtual Connections, and select the virtual connection that contains the virtual connection table you want to certify. Then select the virtual connection table. - Database or table - on the Explore page, navigate to the database or table. Or on the External Assets page, select Databases and Files or Tables and Objects. 2. On the page, select the More actions menu (...) next to the asset name you want to certify. 3. Select Data Labels > Certification (or Edit Certification in Tableau Server 2023.1 and earlier) 4. Select the Certified checkbox. (In earlier versions of Tableau Server, use the switch.) 5. Add a message if desired. The message gives users context for the certification status, intended use for the data, or other helpful information. Information you add to the Message section appears in the certification badge or tooltip, mentioned earlier in [How certification helps users find trusted data](#certify-how-it-helps). You can format the text in a message with bold, underline, and italics, and include a link or an image. To see text formatting tips, click the information (i) icon above the Save button. (Starting in Tableau Cloud February 2024, the message is optional. Earlier versions of Tableau Cloud and Tableau Server required it.) ![](/tableau/next/en-us/online/en-us/Img/datasource_cert_certify_checkbox.png) 6. Select Save. ## Customize certification Beginning with Tableau Cloud June 2023 and Tableau Server 2023.3, using the label manager on the Data Labels page or the REST API, an administrator can change the certification description that users see in the certification dialog. For more information, see [Manage Data Labels](https://help.tableau.com/v0.0/online/en-us/dm_labels_manage.htm). [Skip to main content](#main-content) # Use Custom Views A custom view is a shortcut to a specific state of interaction, such as filter selections and sorting, for a published viz. Custom views don't impact the underlying content. They're a good option if you find yourself adjusting the same filters or zooming into the same data every time you look at a viz. Custom views aren't the same as web editing, which changes the underlying published content itself. See [Edit Tableau Views on the Web](https://help.tableau.com/current/pro/desktop/en-us/web_author_build_view.htm). If the custom views are specifically for filter settings, consider using embedding filter parameters in a shared URL. See [Filter a published dashboard by editing the URL](https://www.thedataschool.co.uk/paul-hunt/filter-a-published-dashboard-by-editing-the-url) from [The Data School](https://www.thedataschool.co.uk/). ## Notes on custom views - A custom view doesn't modify the content it's built on. - Deleting the original content deletes its custom views. - If the original content is updated or republished, the custom view is also updated. > [!TIP] > > Some changes to the original content can break the custom view. See [Maintain Content with Custom Views](https://help.tableau.com/current/pro/desktop/en-us/customview_update.htm) for best practices on modifying content with custom views. - If a user is removed from the site, any shared custom views they owned are also lost. - Subscriptions and data-driven alerts based on custom views may be more fragile than those based on the original content. **Note**: As of the 2022.3 release, Tableau replaced usernames in the custom view URL with IDs. Bookmarked URLs still work but are redirected to the new URL schema. This change is to add more company and user data protection. ## Create a custom view Start by going to the individual view. Make whatever changes you want to capture in the custom view, such as selecting marks, filtering data, or changing sorts. 1. When you're ready to save the changes you've made as a custom view, select Save Custom View from the toolbar. **Note**: The Save Custom View button appears in the toolbar after any changes are made to the current view. 2. In the Save Custom View dialog, enter a name for the custom view. If you choose a name already in use by an existing custom view, what happens next depends on your worksheet tabs. **If your workbook has visible worksheet tabs,** saving overwrites the existing view. **If your workbook doesn't have visible worksheet tabs**, an alert appears to warn you that another custom view with that name already exists. You must name the view a unique name to continue saving. 3. (Optional) Select Make it my default. 4. (Optional) Select Make visible to others. This makes the custom view available to everyone who can see the original content. However, there are several instances when this option isn't available: - The user is a Viewer site role. - The site's [User Visibility setting](https://help.tableau.com/current/server/en-us/user_visibility.htm#limit-user-visibility) is set to Limited. - The permission capability [Share Customized](https://help.tableau.com/current/server/en-us/permissions_capabilities.htm#workbooks) is denied on the workbook. 5. Save your changes. ## Find a custom view ### From a view When you're looking at a viz, you can change to a different custom view by selecting the View icon in the toolbar. If there's room in the toolbar, the name of the custom view you're looking at is shown. Any custom views you've made, and all visible custom views made by other users, appear in the list. ### From the workbook When you're looking at content at the workbook level, use the Custom Views tab to see all the available custom views for that workbook. ![Table of custom views with names, actions, original view, and owner information. The context menu is expanded for one of the views in the list, revealing the options to change owner or delete.](/tableau/next/en-us/online/en-us/Img/customviews_tab.png) ## Set a default custom view After you've found or made a custom view, you make it the default you see when you open that viz. 1. Select the View icon in the toolbar. 2. Check the Set this view a your default option. 3. Close the dialog to save. The next time you open that viz, you'll land on that custom view. ## Share a custom view By default, custom views are private and only appear for the user who created them. **Note**: Users with a Viewer site role can't make custom views visible to others. However, they can share a custom view by copying and sharing the URL. Users with a site role of Explorer or higher can set a custom view as visible to others. This setting allows anyone with access to the original content to see the custom view. To change an existing private custom view to be visible to others (or to make a visible view private): 1. Select the View icon in the toolbar. 2. Toggle the eye icon to the view you want to share to the desired state. 3. Close the dialog to save. The eye with a slash ![The Hide Custom Views icon, which is an eye with a diagonal line through it.](/tableau/next/en-us/online/en-us/Img/customviews_hide.png) indicates the view is private to you. The eye ![Show Custom Views icon, which is an open eye symbol.](/tableau/next/en-us/online/en-us/Img/customviews_show.png) indicates the view is visible to others. ## Delete a custom view To delete a custom view: 1. Select the View icon in the toolbar. 2. Select the trash icon of the view you want to delete. 3. Confirm that you want to delete the view. ### Take care when deleting If you're the owner of a custom view that's visible to others, remember it's deleted for everyone if you delete it. Deleting a custom view also deletes any subscriptions or data-driven alerts based on that custom view. ## Manage custom views Administrators can change ownership for custom views and delete custom views created by other users, unless [user visibility](https://help.tableau.com/current/server/en-us/user_visibility.htm) is set to limited for the site. Custom views can be managed for a piece of content or for a specific user. 1. Go to the Custom Views tab for the workbook or user. 2. Use the action menu to change the owner or delete the custom view. ![Table of custom views with names, actions, original view, and owner information. The context menu is expanded for one of the views in the list, revealing the options to change owner or delete.](/tableau/next/en-us/online/en-us/Img/customviews_tab.png) > [!TIP] > > It's a best practice to change ownership of any custom views belonging to a user before removing them from the site. Deleting a user also deletes their custom views, including public views others may be using. ### Safely change content with custom views If you modify a view that has custom views (or the data source the view is built on), be aware that certain changes can break custom views. For more information, see [Maintain Content with Custom Views](https://help.tableau.com/current/pro/desktop/en-us/customview_update.htm). [Skip to main content](#main-content) # Use Dashboard Extensions Extensions let you add unique features to dashboards or directly integrate them with applications outside Tableau. Adding extensions is easy; you incorporate them into dashboard layouts just like other dashboard objects. Extensions expand dashboard functionality with the help of web applications created by third-party developers. If you're a developer and want to create your own extensions, see the [Tableau Extensions API documentation](https://tableau.github.io/extensions-api/) on GitHub. **Note**: Tableau administrators can turn off dashboard extensions for [Tableau Desktop](https://help.tableau.com/current/desktopdeploy/en-us/desktop_deploy_setting_changes.htm#dashboard_extensions), [Tableau Server](https://help.tableau.com/current/server/en-us/dashboard_extensions_server.htm), and [Tableau Cloud](https://help.tableau.com/current/online/en-us/dashboard_extensions_server.htm). ## Add an extension to a dashboard 1. In a Tableau workbook, open a dashboard sheet. 2. From the Objects section, drag Extension to the dashboard. ![Arrow showing how to add an extension to a dashboard.](/tableau/next/en-us/online/en-us/Img/dashboard_extension_add.png) 3. In the "Add an Extension" dialog box, do either of the following: - Search for and select an extension. - Click Access Local Extensions, and navigate to a .trex file you previously downloaded. 4. If prompted, allow or deny the dashboard extension access to data in the workbook. For more information, see [Data security, Tableau Trusted, and network-enabled extensions](#Data). If you allow access, follow any on screen instructions for configuring the extension. **Note:** If you're using Tableau Server or Tableau Cloud, Extension objects will appear blank in prints, PDFs, and images of dashboards (including images in subscription emails). ### Configure a dashboard extension Some dashboard extensions provide configuration options that let you customize features. 1. Select the extension in the dashboard, and from the drop-down menu in the upper-right corner, choose Configure. 2. Follow the on-screen instructions to configure the extension. ![Context menu to configure an extension on a dashboard.](/tableau/next/en-us/online/en-us/Img/dashboard_extension_configure.png) ### Reload a dashboard extension If a dashboard extension becomes unresponsive, you might need to reload it, which is similar to refreshing a web page in a browser. 1. Select the extension in the dashboard, and from the drop-down menu in the upper-right corner, choose Reload. The dashboard extension is refreshed and set to its original state. 2. If reloading the extension fails to return it to a useable state, try removing it from the dashboard and adding it again. ## Data security, Tableau Trusted, and network-enabled extensions Extensions are web applications that come in two standards: - _Tableau Trusted extensions_ have been specifically reviewed by and deployed on Tableau-managed hosts. These include extensions developed and managed by Tableau, extensions built by Tableau Exchange Partners and deployed with Tableau's extension review and host service, and extensions within our legacy Sandboxed extension host. - _Network-enabled extension_s are hosted by a third-party host. These extensions allow developers to manage the delivery of their extensions without the mediation of Tableau. These include extensions that partners manage directly to provide better production support, extensions that are hosted and deployed within your local network, and extensions that require communication with third-party services outside of Tableau. Before you allow a network-enabled extension, be certain that you trust the developer and website that hosts it. By default, extensions use the HTTPS protocol, which guarantees an encrypted channel for sending and receiving data and ensures some privacy and security. For more information about data security when using dashboard extensions, see [Extension Security - Best Practices for Deployment](https://help.tableau.com/current/server/en-us/security_extensions.htm). ### Allow or deny a network-enabled extension By default, network-enabled extensions must request permission to run. This permission dialog will provide information about the third-party server it is hosted from and data access level that the extension requires. We recommend you review this information before allowing an extension to run. Extensions typically access visible data in a view. An extension may request deeper data access in the workbook when it requests "Full Data Access." This can include access to full underlying data, table and field names from data sources, and information about data source connections. Before allowing the extension to run in the workbook , you should review the declared information in the extension permission dialog and decide if you want to allow or deny the extension to run and access this data. If you're viewing a dashboard with an extension that requires full data access, and that access has been denied, a message appears in place of the extension. If you trust the extension and want to use it, you can reset permissions and allow the extension to run. ![Context menu to reset permessions for an extension on a dashboard.](/tableau/next/en-us/online/en-us/Img/dashboard_extension_reset_perms.png) 1. Select the extension in the dashboard, and from the dropdown menu in the upper-right corner, choose Reset Permissions. 2. Click either Allow to let the extension run and access data, or Deny to prevent the extension from running. ### Ensure that JavaScript is enabled in Tableau Desktop Dashboard extensions interact with data using the Tableau Extensions API library, a JavaScript library. If you want to use extensions, be sure that JavaScript is enabled in the dashboard security settings: Choose Help > Settings and Performance > Set Dashboard Web View Security > Enable JavaScript. ## Ensure that extensions run on Tableau Cloud or Tableau Server You can add extensions to workbooks you publish from Tableau Desktop or directly in the web-authoring mode of Tableau Cloud and Tableau Server. A Tableau administrator must allow extensions to run on a site and add Network-enabled extensions to a safe list. Administrators should only allow extensions that you have tested and trust. If you want to use a dashboard extension on Tableau Cloud or Tableau Server, direct your administrator to [Manage Dashboard Extensions in Tableau Cloud](https://help.tableau.com/current/online/en-us/dashboard_extensions_server.htm) or [Manage Dashboard Extensions in Tableau Server](https://help.tableau.com/current/server/en-us/dashboard_extensions_server.htm). ### Make sure that the extension has permissions to access the workbook or view If you publish a workbook that contains an extension, make sure that the extension has access to the visible data in the view. The visible data is also known as the summary data. To grant this access on Tableau Server or Tableau Cloud, be sure the workbook or view allows permission to Download Summary Data. The extension doesn't download your data. The extension just requires permission so it can interact with the data in the view. Depending upon whether you selected to show sheets as tabs when you published the workbook, you set the permission to Download Summary Data at either the workbook or view level. If the sheets weren't shown as tabs, you set the permission at the view level. If you publish the workbook or view to Tableau Public, the extension also requires access to the visible data. To grant permission, open Settings and select Allow Access. ### Supported web browsers for Sandboxed extensions Sandboxed extensions run in all browsers supported [Tableau Server](https://www.tableau.com/products/techspecs#server) and [Tableau Cloud](https://www.tableau.com/products/techspecs#online) except Internet Explorer 11. ### Supported versions of Tableau Server for Sandboxed extensions You can use Sandboxed extensions in Tableau Server 2019.4 and later. ## Get support for third-party and Tableau partner-built dashboard extensions Tableau Partner-built and third-party extensions are not are not supported directly by Tableau. However, if you need help, there are a few places you can look for more information. - Some partner pages on Tableau Exchange provide a direct **Support** link to assist you. - Contact the extension's creators through the **Developer Website link** in Tableau Exchange. For questions regarding the Extensions API, we encourage developers to share questions and seek help through the [DataDev Slack Channel](https://tableau-datadev.slack.com/archives/CHJ9BHKG9), or the [submit an issue on GitHub](https://github.com/tableau/extensions-api/issues) for the Extension API. [Skip to main content](#main-content) # Use Dynamic Axis Ranges It's key that your users understand the range represented in a viz so that they can correctly analyze the data. Especially when analyzing multiple vizzes in a dashboard or multiple worksheets at the same time, it can be easy for users to misinterpret data when the range of the axes is different between vizzes. For example, when two bar charts appear next to each other, the bars in both charts might appear to be equivalent sizes. However, the axes might have very different ranges, making the charts misleading. To help users understand the range of the axis, in 2023.3 and later, authors can use Dynamic Axis Ranges to set the minimum and maximum values of an axis range by using numeric parameters or date parameters. Then, as users navigate across vizzes, the axes update synchronously. This makes it easier for your users to analyze data across vizzes easily and accurately. And by limiting the range of the data, you can view a subset of data without filtering the underlying data or impacting the moving average of your data. Dynamic Axis Ranges can also be used to extend or shorten the range of an axis without filtering out the underlying data. This is ideal for showing progress against a goal or showing a moving average. ## Supported field types Dynamic Axis Ranges support any parameter that is compatible with the selected continuous axis, for example: - Numeric parameters - Temporal parameters (date or dateTime) ## Configure a dynamic axis range based on selection Starting in Tableau 25.3, you can automatically update the axis range based on area selection, eliminating the need for separate parameter and parameter action workflows. 1. From a worksheet, right-click the axis and choose Edit Axis… 2. For the Range, choose Custom. 3. Expand the dropdown menus, choose Update on interaction for the start and end range points. 4. Close the dialog. 5. Return to your visualization and select an area on the viz to set the corresponding value for the chosen range point. ![Edit axis dialog with option to set custom range to start and end based on interaction.](/tableau/next/en-us/online/en-us/Img/dynamic_axis_selection.png) ## Configure a dynamic axis range with an existing parameter You can also configure your dynamic axis range by tying it to an existing parameter. 1. From a worksheet, [create a parameter](https://help.tableau.com/current/pro/desktop/en-us/parameters_create.htm) for your axis. 2. Right-click the axis, and choose Edit Axis. 3. For the Range, choose Custom. Then, select the parameter that you created for either the start or end axis extent. 4. Close the dialog box. 5. If you're using multiple sheets on a dashboard, repeat these steps for the axes across the different sheets. ![An animation that shows a parameter used to create a dynamic axis range, and then the animation shows how filtering is affected by dynamic ranges.](/tableau/next/en-us/online/en-us/Img/dynamic_axis_ranges.gif) ## Understand limitations and edge cases Dynamic Axis Ranges aren't updated within [Stories](https://help.tableau.com/current/pro/desktop/en-us/stories.htm). If the parameter used for the axis is deleted, then the most recent parameter value remains as the axis extent. The next time you edit the axis, an error message will prompt you to choose a new parameter to be used. [Skip to main content](#main-content) # Use Dynamic Axis Titles Tableau's flexibility empowers authors to quickly analyze different data sets and visualize data differently for deeper analysis. But with that flexibility, comes the responsibility to communicate accurately the data that is used in a viz. For example, it's critical to communicate the units of measure that change based on a parameter value. Imagine that you're looking at a viz of the weather that shows a forecast of 25 degrees. In Fahrenheit, that forecast might be a great ski trip. But in Celsius, that forecast might call for a trip to the beach. As an author, you can use Dynamic Axis Titles to update the axis title based on the value of a parameter or a single-value field (for example, an LOD calculation). If you use [swap parameters](https://help.tableau.com/current/pro/desktop/en-us/parameters_swap.htm), the axis titles update to match the data being used. ## Supported field types To be used as a Dynamic Axis Title, fields must be: - A single-valued and a [fixed LOD calculation](https://help.tableau.com/current/pro/desktop/en-us/calculations_calculatedfields_lod_fixed.htm) - A parameter - A constant calculated field - A top 1 set ## Configure a dynamic axis title 1. From a Tableau sheet, drag a continuous field onto a shelf. 2. Double-click the axis to open the Edit Axis dialog. 3. Under the Axis Titles section, choose the field you want to use for your axis title from the list. 4. Close the Edit Axis dialog. For a more complex use case, first follow the steps in [Example: Swap Measures Using Parameters](https://help.tableau.com/current/pro/desktop/en-us/parameters_swap.htm). Then, follow these steps: 1. Double-click the X axis to open the Edit Axis dialog. 2. Under the Axis Titles section, select Parameter, and then choose the Placeholder 2 selector. 3. Close the Edit Axis dialog. 4. Repeat these steps for the Y axis using Placeholder 1. Now, when the parameters are changed, the axes titles update to reflect the data being displayed. ## Understand limitations and edge cases Dynamic axis titles are cleared when the viz type is changed using Show Me. Also if you use subtitles, then the subtitle appears after the Dynamic Axis Title, just as it does for custom titles. Automatic subtitles are populated only when you have a continuous date value axis that is filtered to a single year with at least two time periods. The dynamic axis title functionality doesn't work when using the worksheet in [Stories](https://help.tableau.com/current/pro/desktop/en-us/stories.htm) (a sequence of visualizations that work together to convey information). [Skip to main content](#main-content) # Use Dynamic Zone Visibility Dashboard space is valuable, especially when you want to progressively reveal insights about data. With Dynamic Zone Visibility, you can hide or reveal zones (tiled or floating dashboard elements) based on the value of a field or parameter. As you interact, zones on your dashboard appear or disappear. The result is a dynamic dashboard that doesn't compromise your desired layout. While you can [show or hide objects by clicking a button on a dashboard](https://help.tableau.com/current/pro/desktop/en-us/dashboards_create.htm#Show), Dynamic Zone Visibility allows you to show and hide objects automatically. This is ideal for dashboards that are used by different user groups. For example, you might want to show different user groups different zones when they visit your dashboard. And you can use Dynamic Zone Visibility with [Parameter Actions](https://help.tableau.com/current/pro/desktop/en-us/actions_parameters.htm). For example, when a user clicks a mark on a viz, a previously hidden zone appears. This is ideal for complex dashboards because it allows you to choose when deeper levels of data are revealed. ## Supported field types To be used for Dynamic Zone Visibility, a field or parameter must be: - Boolean. - Single value. - Independent of the viz, meaning the field returns a constant value independent of the structure of the viz, such as a fixed level of detail (LOD) calculation. ## Configure a dynamic dashboard zone The following example has two sheets that use [Superstore data](https://help.tableau.com/current/guides/get-started-tutorial/en-us/get-started-tutorial-connect.htm): the first sheet has a bar chart with Sales by Category, and the second sheet has a bar chart with Sales by Sub-Category. By using Dynamic Zone Visibility, the second sheet is visible only after a mark is clicked in the Sales by Category zone. This example relies on a boolean calculated field, which is used as the source field for a parameter action. For the calculation to be used as the source field for the parameter action, the calculation must be added to the marks card. 1. From the Sales by Category sheet, [create a parameter](https://help.tableau.com/current/pro/desktop/en-us/parameters_create.htm). In this example, the parameter Data type must be set to Boolean. 2. From the Sales by Category sheet, [create a calculated field](https://help.tableau.com/current/pro/desktop/en-us/calculations_calculatedfields_formulas.htm). This example uses the following calculation: `True` 3. On the Sales by Category sheet, drag the calculation that you created to Details on the marks card. 4. Create a dashboard. 5. Drag the sheet that you always want to be visible onto your dashboard. In our example, we want Sales by Category to be visible. 6. From your dashboard, click the Sales by Category zone (dashboard object). Then, from the Worksheet menu on your dashboard, [create a parameter action](https://help.tableau.com/current/pro/desktop/en-us/actions_parameters.htm). This example uses the following Change Parameter action: The source sheet is set to use the dashboard you created and the Category Sales sheet. The Target Parameter is the parameter you created. The Source Field is the calculation you created. ![A parameter action configured as described in the text preceding this image](/tableau/next/en-us/online/en-us/Img/dynamic_zone_action.png) 7. Drag the Sales by Sub-Category worksheet onto your dashboard. 8. Click the Sales by Category zone. From the upper right corner, click the dropdown arrow and select Use as Filter. 9. Click the Sales by Sub-Category zone, and then click the Layout tab. 10. Check the box for Control visibility using value. 11. From the dropdown, choose the parameter you created to control zone visibility. **Note:** If the option to Control visibility using value doesn't contain the field you want to use, be sure that the field is a supported field type. ![The "Control visibility using value" box is checked, and a parameter called "Hide zone with parameter" is selected](/tableau/next/en-us/online/en-us/Img/dynamic_zone_visibility.png) Now, when you click a category mark in the Sales by Category zone, the Sales by Sub-Category zone appears in your dashboard. ![An animation of clicking a mark on a dashboard that makes another chart appear using Dynamic Zone Visibility](/tableau/next/en-us/online/en-us/Img/dynamic_zone_demo.gif) ## Understand limitations and edge cases Dynamic Zone Visibility doesn't work when using the worksheet in [Stories](https://help.tableau.com/current/pro/desktop/en-us/stories.htm) (a sequence of visualizations that work together to convey information). [Skip to main content](#main-content) # Use Entity Snapshots Entity snapshots provide cloud administrators with a tabular record of the content, users, and relationships that make up your site. While standard event logs record what occurred at a specific moment, entity snapshots capture the full state of everything that existed at that time. Entity snapshots are available only through the Tableau Cloud Manager (TCM) REST API, not through the Activity Log S3 integration. With entity snapshots, you can monitor and optimize your deployment, automate content management, and ensure your site meets security and compliance requirements. ## Before you begin - You must have a Tableau Enterprise or Tableau+ license. - You must have the cloud administrator role in TCM. - You must configure a personal access token (PAT) or unified access token (UAT) to authenticate your TCM REST API sessions. ## Entity snapshots versus event logs Entity snapshots and event logs are both valuable administrative tools, but they serve different purposes. To determine which data type fits your use case, consider the following:

	Entity snapshots	Event logs
Purpose	Captures the full state of site content, users, and relationships at a specific moment.	Captures actions and activities across tenants and sites as they occur.
Update frequency	Every 60 minutes	Tableau (default): 1 day Advanced Management, Tableau Enterprise, and Tableau+: Less than 15 minutes
Data retention	14 days	Tableau (default): 14 days Advanced Management, Tableau Enterprise, and Tableau+: Up to 365 days
Format	Tabular data sets delivered as parquet files	Semi-structured event records delivered as JSON text files
Access	Tableau Cloud Manager REST API	Tableau Cloud Manager REST API or Amazon S3

## Retrieve entity snapshots To retrieve entity snapshots, use the `List entity snapshots for site` and `Get entity snapshots for site` platform data methods in the Tableau Cloud Manager REST API. For more information, see [Platform Data](https://help.tableau.com/current/api/cloud-manager/en-us/docs/platform_data.html). The retrieval process involves these steps: 1. Authenticate your session using a PAT or UAT. 2. Identify your site LUID (locally unique identifier). 3. Generate download URLs for your snapshot files. ## Understand the snapshot schema Each snapshot download contains a set of tables, where each table represents a specific entity type on your site, such as workbooks, users, or projects. To understand the attributes available in each table, review the schema definitions before building integrations or dashboards. For a full list of entity snapshot tables, see [Entity Snapshots Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_entity_snapshots_reference.htm). ## Integrate snapshot data After you download your snapshot files, complete these steps to store and integrate the data into your workflows. You can also automate this process using the [Tableau Cloud Platform Data Loader](https://github.com/tableau/tabcloud_platform_data_loader), an open source tool available on GitHub. 1. **Copy to centralized storage**: Upload your files to a cloud repository, such as Amazon S3, Azure, or Google Cloud Storage. You can also use local file storage if you prefer. 2. **Import to data warehouses**: Import the data into data warehouses such as Snowflake, Amazon Redshift, or Google BigQuery. 3. **Create monitoring dashboards**: Combine your historical snapshot data with Activity Log events in Tableau or other analytical tools to build compliance and site performance dashboards. These dashboards can also be shared with non-admins through row-level security. Entity snapshots refresh every 60 minutes and are retained for 14 days. For update frequency and data retention for Activity Log events, see [Event update frequency and data retention](https://help.tableau.com/v0.0/online/en-us/activity_log_overview.htm#update-frequency-and-data-retention). [Skip to main content](#main-content) # Use Lineage for Impact Analysis Knowing where your data comes from is key to trusting the data, and knowing who else uses it means you can analyze the impact of changes to data in your environment. The lineage feature in Tableau Catalog helps you do both these things. When you have a Data Management license and Tableau Catalog enabled, you have access to lineage information for your content. For more information about Tableau Catalog, see "About Tableau Catalog" in the [Tableau Server](https://help.tableau.com/current/server/en-us/dm_catalog_overview.htm) or [Tableau Cloud](https://help.tableau.com/current/online/en-us/dm_catalog_overview.htm) Help. ## Navigate lineage To see the lineage for an asset, first navigate to the asset's page. Your options for this step include: - Search for the asset and select it. - Navigate to it from Explore. - If it's an external asset (such as a database or table) that's not in a project, navigate to it through External Assets.(This option also works for external assets that _are_ in projects.) Then select the Lineage tab. If you see a Lineage tab but don't have a license that includes Data Management, clicking on the Lineage tab displays a promotion for Data Management. The promotion can be disabled in your Account Settings. **Note**: Lineage data for flows won't show if the flow includes parameter values. For more information about using parameters in flows see [Create and Use Parameters in Flows](https://help.tableau.com/current/prep/en-us/prep_parameters.htm) in the Tableau Prep help. ![Lineage appears on the content page's Lineage tab](/tableau/next/en-us/online/en-us/Img/dm_lineage_content.png) Lineage shows dependencies in relationship to the lineage anchor, which is the asset selected. A lineage anchor can be a database, table, workbook, published data source, virtual connection, virtual connection table, Pulse metric definition, or flow. (In the image above, the anchor is the "Orders (superstore)"data source, and in the image below, the anchor is the "Batters" table.) All the assets below the anchor depend, either directly or indirectly, on the anchor and are called outputs or downstream assets. The assets above the anchor are the assets the anchor is either directly or indirectly dependent on and are called inputs or upstream assets. ![Lineage pane appears on the right side of a table or database page](/tableau/next/en-us/online/en-us/Img/dm_lineage_example.png) Starting in Tableau Cloud June 2024, Pulse metric definitions appear in lineage. (Tableau Pulse is not available on Tableau Server.) Starting in Tableau Cloud June 2023 and Tableau Server 2023.3, lineage pages for data sources include search and filtering (in the top-right of the fields list) that allow you to quickly find fields of interest or relevance. When you select a field in a data source or a column in a table, the lineage is filtered to show only downstream assets that depend on the field (or column) or upstream inputs to the field (or column), as in this 'Batters' table example that shows the lineage filtered for the 'Games' column: ![Lineage is filtered to show the count of assets that include the selected field or column](/tableau/next/en-us/online/en-us/Img/dm_lineage_filter.png) You can select an upstream or downstream asset in the Lineage pane to see its details. For example, when you select Data Sources, the list of data sources that depend on this table appear to the left of the Lineage pane. From the Lineage pane, you can navigate to any asset related to your initial choice, in this case the table, by following the links that interest you. ### Embedded asset appears in External Assets Tableau Catalog treats an external asset as 'embedded' if the Include external files check box is selected when a data source or workbook is published. When an external asset (database, table, or file) is embedded in published Tableau content (workbooks, data sources, and flows), the external asset is used by the content, but is not shareable with other users. That embedded external asset appears in the lineage upstream from its Tableau content and is listed in External Assets. To see if an external asset is embedded, go to the external asset's detail page and see if "Embedded Asset" is listed under Category. !['Embedded Asset' appears under the Category label](/tableau/next/en-us/online/en-us/Img/dm_embedded_asset.png) For information about embedded data, see [Publishing data separately or embedded in workbooks](https://help.tableau.com/current/pro/desktop/en-us/publish_datasources_about.htm#publishing-data-separately-or-embedded-in-workbooks) in Tableau Desktop and Web Authoring Help. ### Lineage and custom SQL connections When you view the lineage of a connection that uses custom SQL, keep in mind the following: - Lineage might not be complete. - Catalog doesn't support showing column information for tables that it only knows about through custom SQL. - Field details cards might not contain links to connected columns, or might not show any connected columns at all. - Column details cards might not contain links to fields that use the column, or might not show any fields at all. For more information, see [Tableau Catalog support for custom SQL](https://help.tableau.com/current/pro/desktop/en-us/customsql.htm#tableau-catalog-support-for-custom-sql) in the Tableau Desktop and Web Authoring Help. ### Catalog doesn't support cubes Cube data sources (also known as multidimensional or OLAP data sources) are not supported by Tableau Catalog. Tableau content (such as a data source, view, or workbook) that relies on cube data does not display any cube metadata or cube lineage in Catalog. ## Mismatch between lineage count and tab count You might notice a mismatch in the count of assets between the Tableau Catalog Lineage tool and the tabs in Tableau Server or Tableau Cloud. The count mismatch is explained by the fact that each—lineage count vs. tab count—counts assets a different way. For example, at any given point in time, Catalog can count only assets that are indexed, whereas Tableau Server or Tableau Cloud counts any assets that are published. Other reasons for count differences include whether: - You have "View" permissions for the asset. - An asset is hidden. - Any fields are used in a workbook. - An asset is directly or indirectly connected to. - An asset is in a Personal Space. ### Workbook count mismatch example As an example, here's how the tab count vs. the lineage count is determined for workbooks. ![Connected Workbooks tab count is 239, Workbooks count in Lineage is 230](/tableau/next/en-us/online/en-us/Img/dm_count_mismatch.png) Connected Workbooks tab counts workbooks that meet both these criteria: - Connects to the data source (whether or not any fields are actually used in the workbook). - The user has permissions to view (whether it's a worksheet, dashboard, or story). Tableau Catalog Lineage counts workbooks that meet all these criteria: - Has been indexed by Tableau Catalog. - Connects to the data source and uses at least one field in the data source. - Contains worksheets, including dashboards or stories that contain a worksheet, that use at least one field in the data source. When metadata is blocked because of limited permissions, or the asset is in a Personal Space, Catalog still counts the workbook. But instead of seeing some of the sensitive metadata, you see Permissions required. For more information, see [Access lineage information](https://help.tableau.com/v0.0/online/en-us/dm_perms_assets.htm#lineage). ## Use email to contact owners At the end of the lineage is Owners. The list of owners includes anyone assigned as the owner or contact for any content downstream from the lineage anchor. You can email owners to let them know about changes to the data. (To email owners, you must have the 'Overwrite' (Save) capability on the lineage anchor content.) 1. Select Owners to see the list of people who are impacted by the data in this lineage. 2. Select the owners you want to send a message to. 3. Click Send Email to open the email message box. 4. Enter the Subject and your message in the text box, and click Send. [Skip to main content](#main-content) # Use Projects to Manage Content Access When Tableau Desktop users publish content to a site on Tableau Cloud, they can select a _project_ to publish it to. Projects can be used for navigation, organization, and access management for assets like workbooks, data sources, lenses, and nested projects. Starting in Tableau Cloud October 2022 / Server 2022.3, if Data Management is licensed and Catalog is enabled, a project can also contain external assets like databases. The following image shows content within the top-level Operations project in the web authoring environment. The Operations project contains a few nested projects (highlighted) and published workbooks. A project can also contain other asset types. ![](/tableau/next/en-us/online/en-us/Img/project_and_content.png) ## Why use projects Projects help you to create a scalable process for managing access to the content published to Tableau Cloud. Advantages they have include: - They enable administrators to delegate content management to project leaders who work with the content more closely, without having to give them administrator access to site or server settings. - Project leaders can create nested projects under their top-level project, enabling them to maintain their team’s content within a single hierarchy. - **Note:** Project owners can delete top-level projects they own. Project leaders cannot delete top-level projects. - They can make the site easier to navigate for self-service users. - They segment the Tableau Cloud site into areas that give users access based on how they use the data published to those areas, or on the Tableau user group they work with. - You can hide projects from groups who don’t need to use them, create a distinguishable project-naming scheme, and take advantage of project descriptions to clarify how to use the project. - They enable you to track permissions effectively. - You can create groups based on the level of content access users in the group need, and set default permissions on projects. This enables you to know exactly which capabilities new users get by default, and likewise which capabilities all users get when a new project is created. ### When to create project hierarchies (example) Many organizations have several or more distinct groups of Tableau users, each with its own priorities and leaders. These groups might share some organization-wide content (or even draw from an org-wide pool of data sources), but primarily they use data and reports that are specific to their team. In this or similar scenario, an example for using project hierarchies might look as follows: 1. You, as a site or server administrator, can create top-level projects for each of your distinct Tableau teams. 2. On each top-level project, you assign the Project Leader status to team leads, and change project ownership. Project leaders effectively are the content administrators, so it’s important that they understand how permissions work in Tableau, along with Tableau content management best practices. 3. Each project leader can manage their project, creating the structure within the project that works for their team. That is, they can create child projects they need, based on how their team members collaborate and share data and reports. The benefit to you as the site administrator is that you can focus on system health. The benefit to your Tableau users is that people who know the best practices for working with Tableau and data can manage these things for their teams, without having to submit IT requests to change permissions or add projects. ### Use the project tree to navigate projects By default, the Explore pane displays a project tree to help you easily navigate your projects. You can use the project tree to find sub-projects within a project folder. You can also use the project tree to search for projects. ![The project tree on the explore pane in Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/Cloud_ProjectTree.png) You can hide and unhide the project tree by clicking the project tree icon located on the Explore pane. ![The project tree icon on the explore pane in Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/Cloud_ProjectTreeIcon.png) > [!TIP] > > **Note**: To ensure the project tree is visible, maintain a browser window width of at least 1441px on the Explore page. A narrower window (1440px or less) or a lower-resolution display will hide the project tree. ## Project-level administration For more information about administering projects, see [Manage Permissions with Projects](https://help.tableau.com/v0.0/online/en-us/permissions_projects.htm). ## Other articles in this section [Skip to main content](#main-content) # Use Relationships for Multi-table Data Analysis Tables that you drag to the data source tab canvas use relationships. Relationships are a flexible way to combine data for analysis in Tableau. Think of a relationship as a contract between two tables. When you're building a viz with fields from these tables, Tableau brings in data using that contract to build a query with the appropriate joins. We recommend using relationships as your first approach to combining your data because it makes data preparation and analysis easier and more intuitive. [Use joins only when you absolutely need to](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_faq.htm#can-i-use-joins-between-logical-tables). Learn more about the basics of creating relationships in this 5-minute video. **Note**: The interface for editing relationships shown in this video differs slightly from the current release but has the same functionality. Learn more about how relationships work in these Tableau blog posts: - [Relationships, part 1: Introducing new data modeling in Tableau](https://www.tableau.com/about/blog/2020/5/relationships-part-1-meet-new-tableau-data-model) - [Relationships, part 2: Tips and tricks](https://www.tableau.com/about/blog/2020/5/relationships-part-2-tips-and-tricks) - [Relationships, part 3: Asking questions across multiple related tables](https://www.tableau.com/about/blog/2020/6/relationships-part-3-asking-questions-across-multiple-related-tables) Also see video podcasts on relationships from [Action Analytics](https://action-analytics.com/library/), such as [Why did Tableau Invent Relationships?](https://action-analytics.com/ep-1-why-did-tableau-invent-relationships/) Click "Video Podcast" in the [Library](https://action-analytics.com/library/) to see more. In Tableau version 2024.2 and later, the Tableau data model supports multi-fact analysis and shared dimensions through multi-fact relationships. For more information, see [About Multi-fact Relationship Data Models](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm), [When to Use a Multi-fact Relationship Model](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_when_to_use.htm), and [Build a Multi-fact Relationship Data Model](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_build.htm). Are you building a new data source and workbook? Drag a table to the Data Source page canvas to start building your data source. A data source can be made of a single table that contains all of the dimension and measure fields you need for analysis... ![Data model with a single table analysis.](/tableau/next/en-us/online/en-us/Img/data_model_singletableanalysis.gif) Or, you can create a multi-table data source by dragging out more tables and defining their relationships... ![Create a data relationship on the data source pane.](/tableau/next/en-us/online/en-us/Img/data_model_createrelationship.gif) Watch this 1-minute video about getting started with using relationships. **Note**: The interface for editing relationships shown in this video differs slightly from the current release but has the same functionality. For more information about using relationships, see [Relate Your Data](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm), [How Relationships Differ from Joins](https://help.tableau.com/v0.0/online/en-us/datasource_relationships_learnmorepage.htm), [The Tableau Data Model](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel.htm), and [Create and define relationships](https://help.tableau.com/current/pro/desktop/en-us/relate_tables.htm#create-and-define-relationships). For more information, see [What's Changed with Data Sources and Analysis](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_whatschanged.htm) and [Questions about Relationships, the Data Model, and Data Sources](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_faq.htm). Are you opening an older workbook or data source? When you open a pre-2020.2 workbook or data source in 2020.2, your data source will appear as a single logical table in the canvas, with the name "Migrated Data" or the original table name. Your data is preserved and you can continue to use the workbook as you did before. ![If your data source contained multiple joined or unioned tables, the single logical table is displayed with the name "Migrated Data".](/tableau/next/en-us/online/en-us/Img/data_model_migrated_data.gif) To see the physical tables that make up the single logical table, double-click that logical table to open it in the physical layer. You'll see its underlying physical tables, including joins and unions. For more information, see [What's Changed with Data Sources and Analysis](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_whatschanged.htm) and [Questions about Relationships, the Data Model, and Data Sources](https://help.tableau.com/current/pro/desktop/en-us/datasource_datamodel_faq.htm). ## Other articles in this section [Skip to main content](#main-content) # Use Tableau Bridge ## Get Started ![Get started with Bridge](/tableau/next/en-us/online/en-us/Img/Help_Spot_Bridge_big.png) - [Use Bridge to Keep Data Fresh](https://help.tableau.com/v0.0/online/en-us/qs_refresh_local_data.htm) - [Install Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_install.htm) - [Set Up a Private Network Refresh Schedule](https://help.tableau.com/v0.0/online/en-us/to_sync_schedule.htm) - [Connect to Private Cloud Data](https://help.tableau.com/v0.0/online/en-us/to_bridge_vpc.htm) - [Tableau Bridge FAQ](https://help.tableau.com/v0.0/online/en-us/to_bridge_faq.htm) ## Quick Reference for Site Admins ![Quick reference for site admins](/tableau/next/en-us/online/en-us/Img/Help_Spot_InstallConfigure_big.png) - [About the Bridge Client](https://help.tableau.com/v0.0/online/en-us/to_bridge_client.htm) - [Configure Pools](https://help.tableau.com/v0.0/online/en-us/to_enable_bridge_live_connections.htm) - [Manage Pools](https://help.tableau.com/v0.0/online/en-us/to_bridge_manage.htm) - [Change the Bridge Client Settings](https://help.tableau.com/v0.0/online/en-us/to_sync_change_computer_site.htm) - [Manage Routing Rules](https://help.tableau.com/v0.0/online/en-us/routing_rules.htm) ## Quick Reference for Publishers ![Quick reference for publishers](/tableau/next/en-us/online/en-us/Img/Help_Spot_RefreshData_big.png) - [Publish a Private Network Data Source with a Live Connection](https://help.tableau.com/v0.0/online/en-us/to_bridge_livequery.htm) - [Stop Keeping Data Fresh Through Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_signout_unlink.htm) - [Manage Alerts for Tableau Bridge](https://help.tableau.com/v0.0/online/en-us/to_bridge_alerts.htm) - [Troubleshoot Private Network Issues](https://help.tableau.com/v0.0/online/en-us/to_bridge_troubleshoot.htm) ## Enterprise ![Enterprise Bridge](/tableau/next/en-us/online/en-us/Img/Help_Spot_Deploy_big.png) - [Plan Your Bridge Deployment](https://help.tableau.com/v0.0/online/en-us/to_bridge_scale.htm) - [Best Practices for Data Connect and Tableau Bridge](https://www.tableau.com/learn/whitepapers/tableau-bridge-data-connect-best-practices-guide) - [Monitor Bridge Extracts Activity](https://help.tableau.com/current/online/en-us/adminview_bridge_extract.htm) - [Monitor Traffic to Bridge Connected Data Sources](https://help.tableau.com/current/online/en-us/adminview_bridge_datasources.htm) - [Monitor Bridge Refresh Jobs](https://help.tableau.com/v0.0/online/en-us/server_backgrounder_job_management.htm#bridge) - [Drain a Bridge Linux Client Before Shutdown](https://help.tableau.com/v0.0/online/en-us/to_bridge_drain.htm) ## Connectivity ![Connectivity with Bridge](/tableau/next/en-us/online/en-us/Img/Help_Spot_ConnectToData_big.png) - [Connectivity with Bridge](https://help.tableau.com/v0.0/online/en-us/to_sync_local_data.htm) - [Update Bridge Connection Information](https://help.tableau.com/v0.0/online/en-us/to_sync_client_settings.htm) ## Security ![Quick reference for publishers](/tableau/next/en-us/online/en-us/Img/Help_Spot_ManageData_big.png) - [Bridge Security](https://help.tableau.com/v0.0/online/en-us/to_bridge_security.htm) ## Other articles in this section [Skip to main content](#main-content) # Use Tableau Cloud Manager Tableau Cloud Manager (TCM) provides administrators with a centralized management interface for overseeing their organization's Tableau Cloud sites. With TCM, cloud administrators can create and edit sites, manage users, and monitor license consumption across multiple sites, all from a single location. Any changes made within TCM are applied at the top level, or tenant, and then shared across all associated sites, ensuring streamlined administration and governance. For information about Tableau Cloud Manager REST API capabilities, see [Tableau Cloud Manager REST API](https://help.tableau.com/current/api/cloud-manager/en-us/index.html). Cloud administrators are the only users with access to Tableau Cloud Manager, a role assigned explicitly within TCM. While most cloud administrators typically access a single TCM tenant, your organization's structure may permit access to multiple tenants. Now that we've discussed the capabilities of TCM, let's explore the concepts it manages within Tableau Cloud. ## Understanding tenant and site administration in Tableau Cloud Before you jump into Tableau Cloud Manager (TCM), it's important to learn the concepts of tenant and site to understand the administrative structure of Tableau Cloud. **Tenant:** A tenant in Tableau Cloud is the top-level administrative layer that encompasses your organization's Tableau Cloud deployment. Think of a tenant as the container that holds all your sites, users, and licenses. Cloud administrators operate at this level through TCM, ensuring centralized control over Tableau Cloud. Within this structure, TCM acts as a centralized location to configure changes for multiple sites, such as adding or deleting users and license management. **Site:** A site, by comparison, is under the tenant and can be thought of as a workspace or a dedicated environment for a specific team, department, or project. Each site has its own set of content, users, and permissions, which site administrators manage. While site administrators have control over their individual sites, including managing workbooks, data sources, and user access, they operate within the constraints set at the tenant level. Sites provide a focused area for collaboration and analytics without exposing the administrative functions of the tenant. ![](/tableau/next/en-us/online/en-us/Img/tcm_tenant_sites.png) In summary, the tenant is the administrative layer that holds all the sites, and a site is a contained environment where teams can work independently. This structure allows for centralized control at the tenant level and flexible management at the site level, enabling organizations to scale their use of Tableau Cloud efficiently and securely. ## Other articles in this section [Skip to main content](#main-content) # Use Tableau Connected Apps for Application Integration Beginning in early January 2022, Tableau connected apps enable a seamless and secure authentication experience by facilitating an explicit trust relationship between your Tableau Cloud site and external applications where Tableau content is embedded. In June 2022, Tableau connected apps extended its capabilities to support REST API authorization. And as of October 2023, REST API authorization using connected apps is respected by the Tableau Metadata API. As of February 2025, REST API authorization using connected apps is respected by the Tableau VizQL Data Service. **Note:** Tableau connected apps and Salesforce connected apps are different and offer different functionality. Today, Tableau connected apps are optimized for embedding Tableau views and metrics in external applications and used to authorize access to the Tableau REST API. (In October 2023, Tableau retired the ability to embed metrics in Tableau Cloud and Tableau Server version 2023.3.). There are two types of connected apps you can configure: direct trust or OAuth 2.0 trust. ### Direct trust Using _direct trust_, you can: - Restrict access to which content can be embedded and where that content can be embedded - Provide users the ability to access embedded content using single sign-on (SSO) without having to integrate with an identity provider (IdP) - Provide users the ability to authenticate directly from your external application - Programmatically authorize access to the Tableau REST API and Tableau Metadata API (starting in Tableau Cloud October 2023) on users' behalf using JSON Web Token (JWT) - Programmatically authorize access to the Tableau REST API and Tableau VizQL Data Service (starting in Tableau Cloud February 2025) on users' behalf using JSON Web Token (JWT) - Scope Tableau REST API capabilities users or applications can perform - Enable additional features like: - User attribute functions (March 2023) - On-demand access (October 2023) - Dynamic group membership using assertions (June 2024) - External tokens for SCIM (June 2025) For more information about this connected app type, see [Configure Connected Apps with Direct Trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_direct.htm). ### OAuth 2.0 trust Using _OAuth 2.0 trust_, you can: - Restrict access to which content can be embedded and where that content can be embedded - Provide users the ability to access embedded content using single sign-on (SSO) through your identity provider (IdP) - Provide access using standard OAuth 2.0 standard protocol - Programmatically authorize access to Tableau REST API and the Metadata API (starting in Tableau Cloud October 2023) on users' behalf - Programmatically authorize access to Tableau REST API and the VizQL Data Service (starting in Tableau Cloud February 2025) on users' behalf - Scope Tableau REST API capabilities users or applications can perform - Enable additional features like: - User attribute functions (March 2023) - On-demand access (October 2023) - Dynamic group membership using assertions (June 2024) - External tokens for SCIM (June 2025) For more information about this connected app type, see [Configure Connected Apps with OAuth 2.0 Trust](https://help.tableau.com/v0.0/online/en-us/connected_apps_eas.htm). ## Other articles in this section [Skip to main content](#main-content) # Receive Notifications, Search, and Share Using the Tableau App for Slack The Tableau App for Slack lets you work and collaborate right where you work in Slack. In Tableau 2023.1 or later, you can search for views and workbooks, and easily access your favorite and recently viewed Tableau content from the Tableau App for Slack. With the Tableau App for Slack, you can also see snapshots of visualizations, with links back to your Tableau site for further exploration. Some features (such as sharing and searching Tableau content from Slack) aren’t yet available in Tableau Server. Currently, Tableau Server users can receive notifications. In Tableau 2021.3 and later, you can get Tableau notifications in Slack for data-driven alerts, sharing activity, and comment mentions. If the notification contains a view or workbook you have access to, the notification will also contain a visual snapshot. Administrators can connect their Tableau site to a Slack workspace to enable the Tableau App for Slack for their entire organization. For more information, see "Integrate Tableau with a Slack Workspace" in the [Tableau Cloud](https://help.tableau.com/current/online/en-us/slack_admin.htm) or [Tableau Server](https://help.tableau.com/current/server/en-us/slack_admin.htm) help. After your Tableau admin connects your Tableau site to a Slack workspace: 1. Add the Tableau App for Slack. 2. Select **Connect to Tableau**. 3. Log in to your Tableau site. 4. Authorize the app by choosing **Allow**. **Note:** For information about privacy, see the [Privacy Policy](https://www.salesforce.com/company/privacy). ## Search, share, and access recents and favorites from Slack From the Tableau App for Slack **Home** tab, you can search for views and workbooks on your Tableau Cloudsite. After you’ve found the Tableau content you’re looking for, select the name of the Tableau content to open it directly in Tableau or select Share to send the content to an individual or Slack channel. You can also write a custom message to provide context about the Tableau content you’re sharing. ![The Search popover in the Tableau App for Slack showing results for two Tableau workbooks.](/tableau/next/en-us/online/en-us/Img/slack_search.png) Choose **Share with Snapshot** to include a preview (Slack link unfurling) of the Tableau content in your message. You can share a snapshot if the Tableau content doesn't contain filters that restrict data access (for example, row-level security). The snapshot is visible to all people you share it with, regardless of their access level. ![A Tableau link that’s been shared in Slack, including the unfurled link with a preview image of the workbook and workbook details.](/tableau/next/en-us/online/en-us/Img/slack_unfurl.png) And without leaving Slack, you can access recently viewed Tableau content and your Tableau favorites. From the Tableau App for Slack **Home** tab, you see the five Tableau views or workbooks you visited most recently. You can also access five of your favorite Tableau views or workbooks. Select the name of the Tableau view or workbook to open it directly in Tableau, or select the more actions menu (...) to share favorite or recently viewed Tableau content. ## Receive Tableau notifications in Slack #### Comments Get notified when you're @mentioned in a comment to keep the conversation going. For more information, see [Comment on Views](https://help.tableau.com/current/pro/desktop/en-us/comment.htm). ![A Slack notification that shows another user mentioned you in a comment in Tableau.](/tableau/next/en-us/online/en-us/Img/slack_mention.png) #### Share See when a teammate sends a Tableau asset your way, including views, workbooks, and more. For more information about sharing, see [Share Web Content](https://help.tableau.com/current/pro/desktop/en-us/shareworkbooks.htm). ![A Slack preview of a Tableau workbook that’s been shared with you](/tableau/next/en-us/online/en-us/Img/slack_share.png) #### Data-driven Alerts You can specify a threshold for your data and get alerted when it's met. For more information, see [Send Data-Driven Alerts from Tableau Cloud or Tableau Server](https://help.tableau.com/current/pro/desktop/en-us/data_alerts.htm). ![A Slack notification about a Tableau dashboard that has reached a defined threshold ](/tableau/next/en-us/online/en-us/Img/slack_dda.png) ## Manage Tableau notifications for Slack Your Tableau site admin can turn on or off all notifications across the site. Tableau admins and Slack workspace admins integrate your Tableau site with Slack, and control whether site users can receive notifications. If it's enabled and your Tableau site administrator allows notifications, all site users can receive notifications in Slack through the Tableau App for Slack. Sometimes notification preferences aren't available because the site has other settings configured that affect notifications. To control which notifications appear in your Slack workspace, or to turn off Slack notifications, at the top of a page, click your profile image or initials, and then select **My Account Settings**. ![The My Account Settings menu in Tableau](/tableau/next/en-us/online/en-us/Img/useracct_menus_acct.png) Under Notifications, select or clear the check boxes under **Slack** for comment mentions, share, and data alerts. ![Slack notification preferences, including comment mentions, share, and data alerts](/tableau/next/en-us/online/en-us/Img/slack_notifysettings.png) Select Save Changes. For more information, see **Change notification settings** in [Manage Your Account Settings](https://help.tableau.com/current/pro/desktop/en-us/useracct.htm). ## Get trusted answers by connecting Slackbot to the Tableau Model Context Protocol (MCP) After you connect the Tableau Model Context Protocol (MCP) and Slackbot, you can ask Slackbot about your data in plain language. Tableau MCP is grounded in your context and data, so you can manage your Tableau site and ask follow-up questions with Slackbot across Slack messages, Slack canvases, or any other tools connected to Slackbot via MCP. To learn more about the Tableau MCP, see the [Tableau MCP documentation on GitHub](https://tableau.github.io/tableau-mcp/). 1. [Integrate Tableau with a Slack Workspace](https://help.tableau.com/current/online/en-us/slack_admin.htm). If Tableau and Slack are already integrated, your Tableau admin might need to [disconnect your Tableau site from Slack](https://help.tableau.com/current/server/en-us/slack_admin.htm#disconnect-a-tableau-site-from-slack) and reconnect to get the latest updates. 2. [Add the Tableau app for Slack](https://slack.com/help/articles/202035138-Add-apps-to-your-Slack-workspace). You might need a Slack admin for this step. 3. Open Slack, and then open a conversation with Slackbot. 4. Click the Apps icon (plug) to confirm the Tableau MCP is connected. 5. Ask Slackbot a question about your data by using conversational language. After the Tableau MCP is set up, try asking Slackbot a question, for example, “Which data sources do you have access to?” or “What insights can you generate from my data from Tableau?” And you can create skills that specify your company’s specific workflows or best practices for using Tableau. For example, create a Slackbot Skill that generates a weekly report by aggregating insights across views, data sources, and Tableau Pulse metrics. For more information, see [How to use Slackbot](https://slack.com/help/articles/202026038-How-to-use-Slackbot). To [use the Tableau MCP with Slackbot across multiple Tableau sites](https://tableau.github.io/tableau-mcp/docs/configuration/mcp-config/authentication/oauth#hosted-tableau-mcp): 1. Disconnect Slack from your Tableau site. 2. Sign into another Tableau site in Slack. 3. Reconnect in Slackbot. [Skip to main content](#main-content) # Use Viewer Controlled Themes Starting in Tableau Cloud version 2026.2, you can customize your viewing experience in Tableau Cloud by changing your viewer theme. You can switch the toolbar and navigation areas—also known as the chrome—to a dark theme. At this time, the visualization (viz) area continues to appear in the default light theme. This includes elements like sheet tabs, cards, headers, axes, and the chart background. ## Theme availability Viewer controlled themes are currently available in viewing mode only. The dark theme isn't yet available when you build or edit visualizations. When you enter authoring mode, the interface automatically switches back to the default light theme. The interface re-enters your chosen dark theme as soon as you leave authoring mode. ![Dark mode theme set on a Tableau Cloud home page.](/tableau/next/en-us/online/en-us/Img/VCT_darkmode.png) ## Change your viewer theme To change your theme setting, open your account settings page. 1. Go to your user settings page. 2. Scroll down to the Accessibility section. 3. Under Theme, select Dark. The interface updates the toolbar and navigation areas to use the dark theme. To switch back at any time, repeat these steps and select Default/Light. ![Theme settings under the accessibility setting in Tableau Cloud.](/tableau/next/en-us/online/en-us/Img/VCT_setting.png) **Note:** Changing your viewer theme only affects your personal account view. Your selection won't change the experience for any other users who view the same visualizations. [Skip to main content](#main-content) # Use Embedded Data Sources Tableau Bridge supports embedded data sources (EDS) and published data sources. With EDS support, existing content requiring Bridge can be migrated as-is rather than converting embedded data sources to published data sources. **Note**: For Bridge extract refresh connections that contain embedded data sources, you can combine data from multiple sources. See [Multiple connection scenarios](https://help.tableau.com/current/online/en-us/to_bridge_manage.htm). ## Considerations - Bridge can support up to 16 live queries per client. With embedded data sources support, there’s an additional count against the refreshed quota. - See [Bridge Site Capacity](https://help.tableau.com/current/online/en-us/to_bridge_site_capacity.htm) for information about how Tableau Bridge can impact site capacity. - When data is embedded in the workbook it's exclusive to the workbook; it's not available for other Tableau Desktop users to connect to. You can set up extract refresh schedules as you do for data sources that are published. - Each embedded data source has a separate connection to the data. Performance can be affected when connecting to duplicate copies of data, for example when connecting to the same original data and each workbook has its own refresh schedule. - Existing scheduled jobs will be routed to Bridge once the pool mappings and private network allowlist for the data source are configured. This is because the network type for embedded data sources is determined by the pool mappings and private network allowlist. - A published data source is typically the best option for long-running extract refresh tasks. For more information, see [Optimize Bridge Refresh Performance](https://help.tableau.com/v0.0/online/en-us/to_bridge_eds_performance.htm). - Embedded extracts refreshed using Tableau Bridge use live queries. The extract is written on the Tableau Cloud server rather than on the Tableau Bridge client computer. Therefore, consider the live query timeout as you plan your organization's embedded extract usage. See [Timeout limits](https://help.tableau.com/v0.0/online/en-us/to_bridge_scale.htm#timeout). ### Limitations - Bridge legacy schedules aren’t supported. - The default pool does not support embedded data sources. You must use a pool that has been configured. For more information, see [Configure the Bridge Client Pool](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm). - Live connections for file data (such as .cvs and .xlsx) aren’t supported by Bridge when the connection is an embedded data source. - Extract refreshes for embedded data source files are supported on the Bridge Windows client. You must use a configured pool for embedded data sources and the file path must use the UNC format. Tableau recommends that you limit the size of files to 5 GB. - File data isn’t supported on Bridge for Linux for Containers. - Workbooks published with the Tableau REST API, or tools that use the API (such as the Content Migration Tool), do not support data refreshes through Tableau Bridge if the data sources are embedded. - This limitation also applies to workbooks uploaded manually using the "Upload" option directly within the Tableau Cloud web interface. - For Excel or flat files pointing to a UNC path, publishing with the REST API will result in a [`FAKEPATH` error](https://help.salesforce.com/s/articleView?id=005232592&type=1). This occurs because the API-based publishing process cannot properly resolve the local or network file path for the Bridge client. - Workaround: To ensure that embedded Excel data sources can refresh successfully with Tableau Bridge, you must publish the workbook directly from Tableau Desktop. Alternatively, we recommend publishing the data source separately to Tableau Cloud and then connecting the workbook to that published data source. ### Embedded Data Source with a Live connection 1. Set up pool mappings for the data source. For more information, see [Configure the Bridge Client Pool](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm). 2. From Tableau Desktop set the data source connection to Live. 3. From the worksheet, click Server \> Publish Workbook. ![](/tableau/next/en-us/online/en-us/Img/bridge_eds_wb.png) 5. To see the data sources embedded in the workbook, click Data Sources. ![](/tableau/next/en-us/online/en-us/Img/bridge_eds_ds.png) 7. Click Publish. After the workbook is published, the workbook is rendered with the data sources included in the workbook. ### Embedded Data Source with an Extract connection 1. Set up pool mappings for the data source. For more information, see [Configure the Bridge Client Pool](https://help.tableau.com/current/online/en-us/to_enable_bridge_live_connections.htm). 2. From Tableau Desktop set the data source connection to Extract. 3. Click the worksheet and in the Save Extract As form, provide a name for the extract data source. 4. From the worksheet, click Server \> Publish Workbook. ![](/tableau/next/en-us/online/en-us/Img/bridge_EDS_extract2.png) 6. (Optional) In the Manage Data Sources menu, choose to allow refresh access. ![](/tableau/next/en-us/online/en-us/Img/bridge_EDS_extract_access.png) 8. Click Publish. After the workbook is published, the workbook is rendered with the data sources included in the workbook. ### Editing the data source Optionally, after you publish the workbook, you can change the connection type from Live to Extract from the Data Sources tab or from the workbook. You can also change the connection type from Extract to Live from the workbook. To change the connection type from Live to Extract from the Data Sources tab: 1. Go to the Data Sources tab. 2. From the Actions menu, select Extract. ![](/tableau/next/en-us/online/en-us/Img/bridge_eds_extract.png) To change the connection type from Live to Extract from the workbook: 1. Go to the View tab. 2. Click Edit Workbook. ![](/tableau/next/en-us/online/en-us/Img/bridge_eds_edit_workbook.png) 4. Click the Data Source tab in the lower left corner, and then click Extract in the upper right corner. 5. Click Create Extract. When a workbook data source is changed to Extract, a job is automatically created. To change the connection type from Extract to Live, change the connection from the workbook. Do not change the data source from Extract to Live from the Data Sources tab. 1. Go to the View tab. 2. Click Edit Workbook. ![](/tableau/next/en-us/online/en-us/Img/bridge_eds_edit_workbook.png) 4. Click the Data Source tab in the lower left corner, and then click Live in the upper right corner. 5. Click Publish and refresh the workbook page. ### Viewing refresh jobs There are several Task Types available to view from the Jobs page. For embedded data sources that use Bridge, the task type is Extract Refresh/Creation. For published data sources that use the Bridge client, the task type is Bridge Refresh. ![](/tableau/next/en-us/online/en-us/Img/bridge_eds_jobs2.png) > [!IMPORTANT] > > **Note**: When changing the published workbook connection type from Live to Extract, a scheduled job is created. However, the Task type doesn’t indicate that the Bridge client was used for the data source for the scheduled job refresh or when running Refresh Now. The task type is listed as Extract Refresh/Creation. ### Refreshing an Extract You can refresh extracts of data hosted with most cloud data providers directly on Tableau Cloud. 1. Sign in to the Tableau Cloud site to which the data source is published. 2. On the Data Sources page, select the More actions icon (…) next to the data source you want to refresh, and then select Refresh Extracts or Refresh Extracts from the menu. ![](/tableau/next/en-us/online/en-us/Img/bridge_edsextract_refresh.png) 4. Selecting Refresh Extract schedules the refresh, but doesn’t run the refresh immediately. To run the refresh, go to the Extract Refreshes tab, select the More actions icon (…) next to the data source, then click Run Now. ## Other articles in this section [Skip to main content](#main-content) # Using Tableau Content Migration Tool The following steps are designed to guide you through using the Tableau Content Migration Tool: - [Migration Plan Overview](https://help.tableau.com/v0.0/online/en-us/cmt-depl_plan_overview.htm) - [Migration Plans: Sites](https://help.tableau.com/v0.0/online/en-us/cmt-plan_servers.htm) - [Migration Plans: Source Projects](https://help.tableau.com/v0.0/online/en-us/cmt-plan_source_projects.htm) - [Migration Plans: Workbooks](https://help.tableau.com/v0.0/online/en-us/cmt-plan_workbooks.htm) - [Migration Plans: Published Data Sources](https://help.tableau.com/v0.0/online/en-us/cmt-plan_datasources.htm) - [Migration Plans: Permissions and Ownership](https://help.tableau.com/v0.0/online/en-us/cmt-plan_users.htm) - [Migration Plans: Migration Scripts](https://help.tableau.com/v0.0/online/en-us/cmt-plan_scripts.htm) - [Migration Plans: Plan Options](https://help.tableau.com/v0.0/online/en-us/cmt-plan_options.htm) - [Using the Tableau Content Migration Tool Console Runner](https://help.tableau.com/v0.0/online/en-us/cmt-deployment_console_runner.htm) [Skip to main content](#main-content) # Using the Tableau Content Migration Tool Command Line Interface The Tableau Content Migration Tool includes a command line interface, `tabcmt.cmd`, located in the installation folder. The default installation folder is `%PROGRAMFILES%\Tableau\Tableau Content Migration Tool` (32-bit Windows) or `%PROGRAMFILES(x86)%\Tableau\Tableau Content Migration Tool` (64-bit Windows). **Note:** The `tabcmt.cmd` utility is not the same as the Content Migration Tool console runner, `tabcmt-runner.exe`. The console runner is a separate command line utility used for running migrations from the command line. For information on using the Content Migration Tool console runner, see [Using the Tableau Content Migration Tool Console Runner](https://help.tableau.com/v0.0/online/en-us/cmt-deployment_console_runner.htm). Here are the commands that can be used with the `tabcmt` command line: - [migrate](#migrate) - [help](#help) - [update](#update) - [version](#version) ## migrate Opens a migration plan file to the migrate step in the GUI: tabcmt migrate ## help Shows general help about the command line interface and the available commands. ### Examples Show all commands available: tabcmt help Show help and usage information for a specific command: tabcmt help ## license Deprecated in July 2022. This command is only applicable for legacy licenses. Manages the application license for the current user. ### Examples Show the current license information: tabcmt license Remove/deactivate the current license: edt license remove Set/activate a serial key or offline license key: tabcmt license Set/activate using a license file: tabcmt license \[--passphrase=\] ## update Manages the options for application updates. ### Examples Show the current update settings: tabcmt update Enable or disable the automatic update notifications: tabcmt update --disabled= Set the URL to detect/download updates from: tabcmt update --url= Enable or disable showing beta updates. Set to false to only show stable release updates. tabcmt update --beta= ## version Shows the current application version information. tabcmt version ## Who can do this To use the command line interface, you must have all the following: - Administrator permissions on the Content Migration Tool machine. - Tableau site user account with an Explorer role or higher. - View and Download Workbook/Save a Copy permissions on the source site. - Publishing rights for the destination site. [Skip to main content](#main-content) # Using the Tableau Content Migration Tool Console Runner The Tableau Content Migration Tool includes a command-line utility for running migrations, `tabcmt-runner.exe`, located in the installation folder. The default installation folder is `%PROGRAMFILES%\Tableau\Tableau Content Migration Tool`. **Note:** The `tabcmt-runner.exe` utility is not the same as the `tabcmt.cmd` command line utility which is used to configure the Content Migration Tool graphical application. For more information about `tabcmt.cmd`, see [Using the Tableau Content Migration Tool Command Line Interface](https://help.tableau.com/v0.0/online/en-us/cmt-command_line.htm). Usage: - tabcmt-runner \[options\] - tabcmt-runner license --remove - tabcmt-runner license - tabcmt-runner license \[--passphrase=\] - tabcmt-runner encryption --reset - tabcmt-runner encryption - tabcmt-runner improvement \[on|off\] - tabcmt-runner --help - tabcmt-runner --version - tabcmt-runner script-warning \[on|off\] Options: - \--version - \--help - \--quiet - \--info - \--logfile=VALUE - \--src-user=VALUE - \--src-password=VALUE - \--dest-user=VALUE - \--dest-password=VALUE - \--https=VALUE - \--allow-scripts ## Run Plan Executes a migration plan immediately. tabcmt-runner \[options\] ### Available options: - `--logfile=` sets the file name to log output to - `--https=` sets the HTTPS mode - `--quiet` disables logging to stdout - `--src-user=` sets the username of the source connection - `--src-password=` sets the password of the source connection - `--dest-user=` sets the username of the destination connection - `--dest-password=` sets the password of the destination connection ### Exit codes: - 0 indicates that the migration was successful. - 1 indicates that the migration was successful but warning messages were logged. - 2 indicates that the migration failed. Specific errors will be included in the log output. ## Show Plan Summary Shows a summary of the migration plan and then exits. tabcmt-runner --info ### help Shows usage information for the command line utility. tabcmt-runner --help ### version Shows the current application version information. tabcmt-runner --version ### encryption Reset the encryption key, or specify a new one. You must specify the encryption key before using the `tabcmt-runner` utility, even if you already done so from the Content Migration Tool UI. tabcmt-runner encryption | --reset ### improvement Default value: `on` Enables or disables collection of anonymous usage information by the application. This information is completely anonymous and is sent periodically to Tableau to help us improve Content Migration Tool. #### Examples Show whether the improvement program is enabled or disabled: tabcmt-runner improvement Enable or disable the improvement program: tabcmt-runner improvement ### license Deprecated in July 2022. This command is only applicable for legacy licenses. Manages a legacy application license for the current user. When using a legacy key, to use the `tabcmt-runner` utility you must activate the license using this command, even if you already activated it from the Content Migration Tool UI. #### Examples Show the current license information: tabcmt-runner license Set/activate a serial key or offline license key: tabcmt-runner license Remove/deactivate the current license: tabcmt-runner license --remove Set/activate using a license file: tabcmt-runner license \[--passphrase=\] ### script-warning Default value: `on` Shows a warning message when running a migration plan that includes migration scripts. **Note:** This command updates your selection on the Settings page. For more information, see [Tableau Content Migration Tool Settings](https://help.tableau.com/v0.0/online/en-us/cmt-settings.htm). #### Examples Show if script warning is turned on or off. tabcmd-runner script-warning Turn script warning on or off tabcmd-runner script-warning If turned on, you must include the option `--allow-scripts` to execute migration plans. tabcmd-runner --allow-scripts ## Who can do this To use the console runner, you must have all the following: - Administrator permissions on the Content Migration Tool machine. - Tableau site user account with an Explorer role or higher. - View and Download Workbook/Save a Copy permissions on the source site. - Publishing rights for the destination site. ## Other articles in this section [Skip to main content](#main-content) # View, Manage, or Remove Users Site administrators can manage a site’s users such as adding and removing users, setting the groups they’re members of, setting their site roles, and so on. View and manage users on a site Sign in to a site as an site administrator and then select Users. On this page you can do any of the following to manage users: - Set group membership, set site role, or remove the user from the site. If you’ve configured the site for single sign-on (SSO), you can set the selected users’ authentication method. ![The Site Users list with Site Role highlighted in the actions menu.](/tableau/next/en-us/online/en-us/Img/user_site_view_settings_cloud.png) - Select a user's name to see details about them, such as content they own, views they subscribe to, and their account settings. The user's Settings page is available to you when a user is a member of only the sites that you are a site admin of. Under Account, you can update the email address where the user receives notifications. The email address is used for notifications purposes only and not used for sign-in. For security purposes, you can only update the email address of a user who is a member of only one site. Search for users (or groups) To search for a specific user (or group), use the filter toggle in the upper right to display the search box and site role filter. Then use the search box or filters to find the users (or group) you want. The search operation checks the display name and user name attributes. The search box supports the wildcard (\*) character. For example, searching for `John*` will return all names that start with _John_. In addition, you can do the following: - Use the wildcard character (\*) with a special character to search for names that contain special characters. For example, `sync-*` or `*sync-*`. - Use the wildcard character (\*) with AND or OR conditions when filtering user names. For example, searching for `*aw* AND John*` returns all users whose user names contain _aw_ and whose names start with _John_. - Note that the wildcard with AND or OR is only available when filtering user names, not display names. - When searching for names with diacritics, names must be entered with exact diacritics to return relevant results. For example, to search for _José_, enter `José`. Searching for `Jose` will not return results. ![A search bar and dropdown menus for filtering by site role.](/tableau/next/en-us/online/en-us/Img/user_view_search.png) Remove users from a site You can remove a user only if the user does not own any content (projects, workbooks, views, data sources, collections, or data alerts for example). If you attempt to remove a user who owns content, the user site role will be set to **Unlicensed**, but the user will not be removed. If the default All Users group has enabled Grant site role on sign in, that user's content must be reassigned to another user or removed before they can be unlicensed or removed. For more information on Grant role on sign in, see [Removing users affected by Grant role on sign in](https://help.tableau.com/v0.0/online/en-us/grant_role.htm#remove). For more information on changing content ownership, see [Manage Content Ownership](https://help.tableau.com/v0.0/online/en-us/owner.htm) **Note:** On Tableau Server, when an administrator removes a user from a site (and the user belongs only to that one site), the user is also deleted from the server. 1. Sign in to a site as an administrator and go to the Users page. Select one or more users to remove, and then select Actions > Remove from Site. ![The Site Users list with the actions menu.](/tableau/next/en-us/online/en-us/Img/user_site_remove_server.png) 2. Click **Remove Users** button in the confirmation dialog. [Skip to main content](#main-content) # Visual Segment Creation to Data 360 Segmentation enables data analysts to curate relevant portions of data from their analyses in Tableau and seamlessly transfer them to [Salesforce Data 360](https://www.salesforce.com/products/data/). Once in Data 360, marketing professionals can use various platforms (such as [Data 360 for Marketing](https://www.salesforce.com/products/data-cloud-marketing/)) to quickly take high-impact steps to boost marketing campaigns with ease. ## About segmentation ### Overview and examples Segmentation that starts in Tableau provides a way for analysts to visually explore their audience (typically customers) and send data about relevant portions of the target population to Data 360. From Data 360, marketers can publish to other Salesforce clouds or platforms for further analysis and action. To better understand the benefits of segmentation and how it works, let’s consider a likely use case. A data analyst reviewing an analysis of data about a recent marketing campaign in Tableau identifies a segment with lower engagement than the overall campaign audience. The data analyst knows this is an important subset of the overall data that the marketing team will want to address. So, the data analyst sends this low-engagement segment to Data 360. From Data 360, a member of the marketing team (or marketer) can access the segment to get a filtered view of the campaign data related to the low-engagement group. With a focused snippet of the overall data, it’s easier for the marketer to determine the actions they need to take to improve engagement. With an action plan in mind, the marketer publishes the segment on Salesforce Marketing Cloud or a similar platform where they created the original campaign. In this example and similar scenarios, the data analyst benefits from the robust analysis capabilities in Tableau while efficiently handing off their findings to the marketer. The marketer benefits from accessing a targeted view of data that’s relevant to them that they can manage and send to the marketing tools they’re already using. Most importantly, the customers benefit from marketing campaigns that effectively reach them. ### Workflow With segmentation, you can streamline the collaboration between data analysts working in Tableau and marketers working in Data 360 and connected marketing platforms. The typical workflow looks like: 1. The data analyst uses a viz in Tableau to analyze and identify a subset of the customer data that’s relevant, meaningful, and actionable to marketers. 2. The data analyst creates a segment of their audience data from their Tableau viz and sends it to Data 360. 3. The marketer accesses the segment from Data 360. From there, they create a plan for acting on the segment data, and send it to their activation target. The activation target is typically a marketing platform or tool that the marketing team uses to manage marketing campaigns, such as [Data 360 for Marketing](https://www.salesforce.com/products/data-cloud-marketing/). 4. The marketer launches the marketing campaign from the activation target, and analyzes the campaign results from their platform of choice. ### Learn more To learn more about segmentation, check out these helpful resources: - [Segmentation](https://help.salesforce.com/s/articleView?id=sf.c360_a_create_segments.htm&type=5) (Salesforce Help) - Get a comprehensive review of segmentation and activation on Data 360. - [Segmentation and Activation module](https://trailhead.salesforce.com/content/learn/modules/customer-360-audiences-segmentation?trailmix_creator_id=mcguide2&trailmix_slug=customer-360-audiences-and-the-ethical-use-of-data) (Trailhead) - Learn how to create, filter, and activate marketing segments with Data 360. - [Segmentation Filter Examples](https://help.salesforce.com/s/articleView?id=sf.c360_a_examples_of_segmentation_filters.htm&type=5) (Salesforce Help) - For common use cases for segmentation and get inspiration for creating your own segments. - [Data 360 and the Ethical Use of Data trailmix](https://trailhead.salesforce.com/users/mcguide2/trailmixes/customer-360-audiences-and-the-ethical-use-of-data) (Trailhead) - Learn how you can use ethical practices when building marketing segments in Data 360. ## Requirements for segmentation ### License requirements To create a segment in Tableau, data analysts need a Creator license for Tableau Cloud. To publish a segment in Data 360, marketers need: - Developer, Enterprise, Performance, or Unlimited Salesforce edition - Segmentation and Activation add-on license for Data 360 (**Note:** As of September 2025, this add-on license is not needed. For more information, see [Data 360 License, Credits, and Permission Set Changes in September through November 2025](https://help.salesforce.com/s/articleView?id=005131350&type=1 "Link to Salesforce Data 360 Help")). - Standard Data 360 permission set and the appropriate marketing-specific permissions (see [Data 360 Standard Permission Sets](https://help.salesforce.com/s/articleView?id=sf.c360_a_userpermissions.htm&type=5) for more information) - (Recommended) [Data 360 for Marketing](https://www.salesforce.com/products/data-cloud-marketing/), for activating segments - (Optional) The Ad Audiences add-on license for Data 360, for activating segments to advertising platforms ### Data requirements #### Data sources and connections To create a segment, your [data source](https://help.tableau.com/current/pro/desktop/en-us/datasource_prepare.htm) must use a single [direct connection to live data](https://www.tableau.com/blog/tableau-cloud-tips-extracts-live-connections-cloud-data) (no extracts) and your viz must use a single data source. Published data sources, multiple connections, and multiple data sources aren’t supported. #### Data model configuration When configuring your data model in Data 360, be sure to: - Connect to a Profile DMO, and have the Profile DMO set as the left-most table in the Data Source tab - Use only one [primary key](https://help.salesforce.com/s/articleView?id=sf.c360_a_primary_key.htm&type=5) When configuring your data model in Tableau, be sure to: - Use a table that’s used only one time in the data source - Only use a single table in the logical layer (multiple logical tables aren’t supported) - Avoid including unions or custom SQL tables - Only use joins between DMOs that match existing Data 360 relationships - Use linear joins between DMOs in which each object is only joined to a single object (rather than joining multiple objects to the same object) For example, instead of: ![Example of an incompatible join that connects multiple tables to the same object](/tableau/next/en-us/online/en-us/Img/segments_joins1.png) Do this: ![Example of a compatible join comprised of three tables joined only to a single object each](/tableau/next/en-us/online/en-us/Img/segments_joins2.png) - Use join expressions that only include fields (calculations and multiple joins from a single table aren’t supported) and the equals operator (other operators aren’t supported) When connecting your data model in Tableau to your data model in Data 360, you can recreate any necessary portions of the model using [Tableau joins](https://help.tableau.com/current/pro/desktop/en-us/joining_tables.htm). #### Authentication To create segments in Tableau, you must allow Tableau to connect to Data 360 using the Salesforce Data 360 connector. If the Data 360 connector isn't already configured on your Tableau site, [follow these steps](https://help.tableau.com/current/server/en-us/config_oauth_sfdc_cdp.htm). In the connected app, add the following scopes: - Perform ANSI SQL queries on Customer Data Platform data (cdp\_query\_api) - Manage Customer Data Platform profile data (cdp\_profile\_api) - Manage Customer Data Platform Ingestion API data (cdp\_ingest\_api) - Perform segmentation on Data 360 data (cdp\_segment\_api) #### User permissions requirements To create a segment, work with your Salesforce admin to confirm that you have access to the following application programming interfaces (APIs): - Write access for the [Create Segment API](https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/connect_resources_cdp_ssot_segments.htm) - Read access for the [Data 360 Metadata API](https://developer.salesforce.com/docs/atlas.en-us.c360a_api.meta/c360a_api/c360a_api_metadata_api.htm) #### Field requirements When you create a segment, use fields in your filters that are either existing database fields (rather than fields created by Tableau), or [groups](https://help.tableau.com/current/pro/desktop/en-us/sortgroup_groups_creating.htm). Fields that are cast to other data types might cause errors. The following types of fields aren’t supported in segment filters: - Measures with MEDIAN, PERCENTILE, or ATTR aggregations - Table calculations - Calculations - Bins - Groups based on sets, calculations, or combined fields - Tableau-generated fields, such as: - Metadata fields (measure names/values) - Generated map-related fields (latitude and longitude) - Table type fields (count of object or logical table) - Calculated insights - Clusters #### Filter requirements When you create a segment, multiple filters are applied based on your configuration. Segment filters can include a combination of data source filters, context filters, view filters, and filters based on your viz selection. Use quantitative filters for: - A measure (with or without aggregation) - A range of dates Use categorical filters for segments with individual values selected. The following types of filters aren’t supported in segments: - Categorical filters with a top, wildcard, or condition filter - Relative to current date filters with anything other than date and year for next/last N - Relative to current date filters with anything other than date, month, and year for the current period - Date filters with Month/Day/Year - Date filters with date truncation - Date filters with a datetime exact comparison to another datetime Relative date filters with a specified anchor date are supported. ## Create a segment using engagement data To create a segment from Tableau to Data 360 using engagement data, you must configure the correct modeling in Tableau using join clauses. Use joins within a single logical table and join on the same field as defined in the relationships in the Data Model tab in Data 360. For example, to create a segment using Email Engagement data for the Unified Individual in Tableau, configure your data model and map the relationships as shown. ![Data model mapping with Email Engagement data and Unified Individual](/tableau/next/en-us/online/en-us/Img/UnifiedInd1.png) ![Data model mapping with Email Engagement data and Unified Individual](/tableau/next/en-us/online/en-us/Img/UnifiedInd2.png) ![Data model mapping with Email Engagement data and Unified Individual](/tableau/next/en-us/online/en-us/Img/UnifiedInd3.png) ![Data model mapping with Email Engagement data and Unified Individual](/tableau/next/en-us/online/en-us/Img/UnifiedInd4.png) **Note:** This example is for illustrative purposes only. Data in your Data 360 instance might use different relationships. ## Create a segment in Tableau 1. In Tableau, select the desired portion of the data in your viz, and then right-click and select Publish Segment to Salesforce. ![A viz with a portion of data selected and the Publish Segment to Salesforce menu option selected](/tableau/next/en-us/online/en-us/Img/TableauSegmentMenu.png) 2. Configure your segment in the Create Segment for Data 360 dialog. Segment name is required. The name must start with a letter and can only contain alphanumeric characters and underscores. The name can’t contain consecutive underscores or end with an underscore, and spaces aren’t allowed. In Data 360, the segment name displays as the name that you specify in the Segment name field plus a timestamp of when you create the segment. When you add filters in the dialog, the filter field names appear under Rules. You can hover over a rule to learn more about it, such as the filter or mark selection that the rule was built on. Multiple rules might filter on the same field, but learning more about a rule’s origins can help you identify any duplicates. As you add each filter, a segment population count displays. The population count represents the count of individual data points (typically customers) who meet your filter criteria. You can use the population count to verify that your segment is working as expected by confirming that the count is the same in Tableau and Data 360. Tableau counts all individual records in your viz, but the segment only counts distinct individuals. To see distinct individuals in a Tableau viz that matches the segment count, use the Count Distinct (COUNTD) aggregated function. When you add rules, the Description is pre-populated with details about them. You can edit the description as needed, but there's a 255 character maximum. A description is optional, but it can make it easier to find the segment in Data 360. 3. Click Create. When the segment is created, a confirmation message appears with a link to view the segment in Data 360. ![Confirmation message showing segment was published with link to view it in Data Cloud](/tableau/next/en-us/online/en-us/Img/SegmentToast.png) If you receive an error after clicking Create, confirm that you meet the [requirements to publish to Data 360](#Requirem) and [check the status of your organization’s Salesforce instance](https://help.salesforce.com/s/articleView?id=000384755&type=1). 4. In the confirmation message, click View in Data 360. For segments created in Tableau, you can modify the Segment Name, Description, and Publish Schedule in Data 360. To do so, click Edit Properties. You can’t revise a segment’s rules after you publish it. Instead, you must [delete the segment in Data 360](https://help.salesforce.com/s/articleView?id=sf.c360_a_delete_segment.htm&type=5) and create a new one in Tableau. 5. From Data 360, your marketing team can [publish the segment to the appropriate activation targets](https://help.salesforce.com/s/articleView?id=sf.c360_a_publish_segment.htm&type=5). [Skip to main content](#main-content) # Viz Load Times Data Source Viz Load Times contains the load time information for views on your site to help content authors better understand the user experience when loading views. ## Create custom views If you're a site admin or someone who has been granted access to the Admin Insights project, you can access the Admin Insights data sources directly from Tableau Cloud using Web Authoring or through Tableau Desktop to build custom views. For more information about connecting to Admin Insights data sources, see [Use Admin Insights to Create Custom Views](https://help.tableau.com/v0.0/online/en-us/adminview_insights.htm). ### Example: Which views take the longest to load? Use the following steps to create a view that displays load times, helping to identify which views take the longest to load. 1. Connect to the Viz Load Times data source. 2. From the Data pane, drag Item Name to the Rows shelf and Duration to the Columns shelf. 3. From the Data pane, drag Status Code Type to the Filters shelf and select the Success checkbox. 4. In the Columns shelf, right-click Dimensions and select Measure (Count) > Median. ## Do more with your data Using Tableau Prep, you can join Viz Load Times with other Admin Insights data sources on the following fields to get more visibility into your site. If you're analyzing data from multiple Tableau Cloud sites, you must also join on "Site LUID = Site LUID". - Join Viz Load Times to TS Events and Site Content on "Item Repository URL = Item Repository URL" - Join Viz Load Times to TS Events and Site Content on "Item Type = Item Type" For more information, see [Aggregate, Join, or Union Data](https://help.tableau.com/current/prep/en-us/prep_combine.htm) in Tableau Prep Help. ## Data schema The following table lists the fields included in the Viz Load Times data source. Each row of data corresponds to a request for a content item and the load duration, measured in seconds.

Folder	Field Name	Type	Description
Item	Item Hyperlink	String	Full URL of the item on the site
	Item Luid	String	LUID of the item (data source or view) that was requested.
	Item Name	String	Display name of the item
	Item Owner Email	String	Email address of the item owner
	Item Repository URL	String	A unique name for the item (data source or view) that the request relates to, derived from the ASCII characters in the name, which can be used in URLs to refer to it.
	Item Type	String	The type of item, either a data source or view.
Project	Project Name	String	The name of the project that contains the item
Project	Project Owner User Name	String	Email address of the project owner
Request	HTTP Request URI	String	The request URI
	HTTP User Agent	String	The agent string supplied by the client
	Request ID	String	Primary key for the request
	Request Time	Date-time	The date and time that the request started, in UTC.
	Request Time (local)	Date-time	The date and time that the request started, adjusted by the Timezone parameter.
	Status Code	Number	The status returned to the client
	Status Code Type	String	The type of status code. The value 1 = Informational response, 2 = Success, 3 = Redirect, 4 = Client error, and 5 = Server error.
Workbook	Workbook Name	String	For views, the name of their parent workbook that contains the item requested.
Workbook	Workbook Owner User Name	String	For views, the email address of the owner of the parent workbook that contains the item requested.
-	Admin Insights Published At	Date-time	Date and time the Admin Insights data source was last published in UTC
-	Timezone	String	Specifies the timezone for displaying dates. This field represents an integer value used to determine the number of hours to offset from UTC. It doesn't account for Daylight Saving Time adjustments.

[Skip to main content](#main-content) # Web Authoring and Tableau Desktop Feature Comparison For anyone familiar with Tableau Desktop and new to the web authoring environment in Tableau Server and Tableau Cloud, this topic provides a summary of the web features that you use similarly to the way you do in Tableau Desktop. It also lists some fundamental differences between the two environments. **Note:** This topic summarizes core authoring functionality and does not cover every difference between the desktop and web environments. ## Features listed by version For a list of the latest web editing features to be added to each release, see the web authoring sections in [Tableau Desktop and Web Authoring Release Notes](https://help.tableau.com/current/pro/desktop/en-us/help.htm#whatsnew_desktop.htm) and [Tableau Cloud Release Notes](https://help.tableau.com/current/online/en-us/whatsnew_online.htm), or check out the [Release Navigator](https://public.tableau.com/views/ReleaseNavigator-V21/FeaturesInVersionDash?:language=en-US&:display_count=n&:origin=viz_share_link) viz to filter and compare changes by release. ## General differences in web authoring - Your authoring capabilities are determined by your license level. For an overview of what you can do with each license level, see [What can I do with a Tableau site?](https://help.tableau.com/current/pro/desktop/en-us/help.htm#web_author_overview.htm) - You can access right-click menu actions on fields in the view, but not on every item in the workspace. - Keyboard shortcuts for web authoring and Tableau Desktop are not the same. For a list of web authoring keyboard shortcuts, see [Shortcuts for web authoring](https://help.tableau.com/current/pro/desktop/en-us/shortcut.htm#Shortcuts_webauth). ## Web authoring capabilities In the web environment, you can connect to data and create workbooks from those data sources, or data published through Tableau Desktop. You can edit views created on the web or published from Tableau Desktop. Administrators can set at the site level what web authoring abilities users can have. Explorers can edit workbooks, create new workbooks from published data sources, connect to published data sources, and create and edit views, dashboards, and stories. Creators have those same capabilities, but can also create new workbooks, connect to data on the web, and use Ask Data and (in Tableau Cloud) Dashboard Starters to quickly dive into analysis. ### Data management - **Creators**: Connect to data sources, upload files (text, excel, and Tableau workbooks), or use pre-built Dashboard Starter templates for certain data sources. For more information, see [Creators: Connect to Data on the Web](https://help.tableau.com/current/pro/desktop/en-us/help.htm#creator_connect.htm). - **Creators**: Prepare data on the web in the Data Source page. For more information, see [Creators: Prepare Data on the Web](https://help.tableau.com/current/pro/desktop/en-us/help.htm#creator_data_prep.htm). **Note**: There is a limitation on the number of rows that can be viewed in the Data Source page when authoring data on the web, determined by browser: - Internet Explorer: 10,000 rows - Other browsers: 100,000 rows Independent of browser, the total number of records (rows by columns) that can be viewed in the Data Source page on the web is **3 million**. - Run Initial SQL when connecting with some data sources - Relate your data to combine data from multiple tables - Join data from different tables in the same data source or from different databases using a multi-connection data source - Add a join calculation - Union data - Pivot data - Copy values in a grid (Ctrl+C, or Command-C on a Mac) - [Edit Data Sources](https://help.tableau.com/current/pro/desktop/en-us/howto_connect.htm) - Clean data using the Data Interpreter - Create a Custom SQL query - **Explorers**: Connect to published data sources. - Blend published data sources. - Save a data source (embedded in a published workbook) as a separate, published data source. - Change aggregation of measures in the view. Change the default aggregation of measures in the Data pane. - Search for fields in the schema. - Duplicate, hide, or rename fields. - Change the data type of fields. - Convert measures to dimensions or vice versa. - Convert a discrete field to continuous and vice versa. This option is available for measures and date dimensions. - Assign a geographic role for a field. - Create aliases for members of dimensions. - Create and edit groups. - Create and edit sets (conditioned sets are not available) - Create, edit, and remove parameters. Formatting numbers and dates, and adding comments for the parameter are not supported on the web. ### Analytics - Create, edit, rename, duplicate, and clear sheets (views, dashboards, and stories) in a workbook. - Use [Ask Data](https://help.tableau.com/current/pro/desktop/en-us/ask_data.htm) to automatically create views. - Use [Explain Data](https://help.tableau.com/current/pro/desktop/en-us/explain_data.htm) to automatically create views. - Search for fields in the Data pane with schema search - Drag fields to the view, Rows, Columns, and different mark types in the **Marks** card. - Use **Show Me** to create views. Also, from the Data pane, select and drag a field of interest to the view area to automatically create a "Show Me" view. - View underlying data (via tooltips). - Viz in Tooltip works in web views, but must be configured in Tableau Desktop. [Viz in Tooltip worksheets can be hidden](https://help.tableau.com/current/pro/desktop/en-us/help.htm#viz_in_tooltip.htm#Hide), the same way you would hide worksheets used in stories or dashboards. - [Actions](https://help.tableau.com/current/pro/desktop/en-us/actions.htm) work in web views, but must be configured in Tableau Desktop. - Create and edit calculated fields. - Create bins from continuous measures, and edit bins. - Create and edit table calculations, and use quick table calculations. - Create sets and show set controls. (Note that you cannot create sets from cube data sources in web authoring.) - Use the **Analytics** pane to drag reference lines, trend lines, and other objects into the view. Edit reference lines, trend lines, and bands. Create and configure reference distributions on a continuous axis. Adding a cluster, and adding and modifying a forecast, are not supported for the web. - Create groups by selecting marks in the view and then clicking Group Members (paperclip) in the tooltip for that selection. You can also edit existing groups in the Data pane. - Create hierarchies by dragging one dimension onto another in the Data pane. **Note**: You can't create hierarchies when fields are already grouped within a folder. - Change options for interacting with maps, including enabling or disabling pan and zoom, or showing map search, the view toolbar, or map scale. Users can also map units. - Drill up and down a continuous hierarchy in the view. In a view with a continuous hierarchy, hover near the headers on a continuous axis to display the + and - controls. Click to drill down or up. - Show labels, totals, and subtotals. - Show, hide, and format mark labels - Show and hide titles and captions. - Show and hide cards for filters and highlighters. - Show, hide, and resize headers in the view. - Swap X and Y axes. Resize axes in the view. - Change the view size. - Show and hide the View Toolbar for any view or dashboard. - Duplicate a sheet as a crosstab view. ### Filtering and sorting - Use data highlighting. - Add, edit, and remove filters, and edit filter control layouts. **Note**: There is a limitation on the number of results that can be filtered when authoring data on Tableau Cloud or Tableau Server. Only the first 100 results are returned to limit the performance impact one user has when loading a large domain on the server. - Filter across published data sources. - Apply filters to multiple sheets - Create context filters (Add to Context option in the Filters shelf) and dependent filters (Only Relevant Values option in a filter control shown in a view). - Apply table calculation filters to totals in the view. - Show hidden fields, and exclude or remove fields from the view. - Sort fields in the view in ascending or descending order. Access the Sort dialog box by right-clicking a dimension on the Rows or Columns shelf. Nested sorting on dimension values within the context of each pane. - Drag and drop headers to create a custom sort order within a view. ### Formatting - Resize the width of row headers and the height of column headers. - Edit workbook formatting, including formatting lines. - Edit worksheet and dashboard titles. - Edit axes (double-click an axis in the view). Other options available: **Synchronize dual axes**, clearing the axis range (**Reset**), and tick mark settings. Enable or disable **Dual axis** in a field context menu (right-click a measure field on Rows or Columns shelf). Logarithmic scales can be positive or symmetric (includes 0 and negative values). - Edit number formatting (decimal places, percentage, thousands separator, units, and currency). - Create, edit, move, and resize point, mark, and area annotations. - Add and edit dashboards objects, including: horizontal and vertical layout containers, text, images, navigation buttons, web page links, and dashboard extensions. - Create transparent worksheet backgrounds (set background color to None). Combine transparent worksheets with transparent filters, highlighters, and parameters. - Change the color palette. For categorical fields you can assign specific colors and custom colors (using a hex code) to data items. For continuous fields, you can set custom colors for start and end colors (using a hex code). - Create, rearrange, and preview device-specific dashboard layouts - Set a dashboard item's exact size, position, and spacing. - Add padding, borders, and background colors around items in dashboards. - Select a background map in map views. - Legends per measure. If you create separate color legends for the measures in your view, Tableau assigns the default color palette to each new color legend. To change the color legend for each measure, click the drop-down arrow on the color legend to open the Edit Colorsdialog box and select the palette that you want to use. For more details, see [Legends per measure](https://help.tableau.com/current/pro/desktop/en-us/help.htm#view_parts.htm#LegendsPerMeasure). ## Related topics [What can I do with a Tableau site?](https://help.tableau.com/current/pro/desktop/en-us/help.htm#web_author_overview.htm) [Set a Site’s Web Authoring Access](https://help.tableau.com/current/server/en-us/web_author_enable.htm) [Getting Started with Web Authoring](https://help.tableau.com/current/pro/desktop/en-us/help.htm#getstarted_web_authoring.htm) [Creators: Connect to Data on the Web](https://help.tableau.com/current/pro/desktop/en-us/help.htm#creator_connect.htm) [Creators: Prepare your Data on the Web](https://help.tableau.com/current/pro/desktop/en-us/help.htm#creator_data_prep.htm) [Build Views on the Web](https://help.tableau.com/current/pro/desktop/en-us/help.htm#web_author_build_view.htm) [Grant Web Edit, Save, and Download Permissions](https://help.tableau.com/current/server/en-us/web_author_who.htm) [Skip to main content](#main-content) # When to Use a Multi-fact Relationship Model A multi-fact relationship model is a data model that lets you add unrelated tables in a single data source and then uses related fields during visual analysis to essentially stitch the tables together based on the context. Unlike blending, the data exists within a single data source—the concepts of primary and secondary data sources don't apply and no data is dropped from left joins. Unlike a single table data model, multiple base tables maintain their own context regarding tables shared between them. A multi-fact relationship data model gives you more options for performing multi-fact analysis in Tableau. Imagine you want to analyze how weather and ice cream sales trend together. Weather and ice cream sales both happen at specific times and specific places, but there's no direct connection between ice cream sales and weather. These are unrelated pieces of data that both relate to the shared concepts of date and location. This question lends itself to creating a multi-fact relationship model. Ice Cream Sales and Weather each can be added as a base table and related on Date and Location, which are shared tables. ![a multiple base table data model with two base tables and two shared tables](/tableau/next/en-us/online/en-us/Img/mfr_ex_icw_.png) A multiple base table data model, with two unrelated tables (Ice Cream Sales and Weather) and two shared tables (Date and Location). There is an intermediate table, Parlor Info, between Ice Cream Sales and Location. ### Why did we build the capability to model unrelated tables? Analysis often involves bringing together tables of data that don't even have a direct relationship to each other but that both relate to the same, common information (such as date or location). A multi-fact relationship model supports loose semantic coupling by introducing the concept of degrees of relatedness and the ability to build a data model with multiple, unrelated base tables. - Semantic coupling is a term used to describe how tightly combined data is. A _join_ or a _union_ is a tight semantic coupling; they bring multiple tables together into a new physical table that then acts as a single table. A _relationship_ is a looser coupling between tables that ties tables together logically, maintaining their distinct status as separate tables. Even further along the semantic coupling spectrum is _data blending_, where results from separate data sources are visually combined based on elements shared between both them. A _multi-fact relationship model_ is closer to the blending end of the spectrum, but within a single data source instead of across data sources. A multi-fact relationship model—a data model with multiple base tables—permits unrelated tables in the model as long as shared tables exist in the model, too. During analysis, fields from a shared table "stitch" together otherwise unrelated tables of data based on the shared dimensions they have in common (such as happening in the same place or at the same time). All the benefits of relationships are maintained, including the retention of each table's grain, or native level of detail. Similar to a single base table data model, Tableau determines the best join type to use behind the scenes based on the structure of the viz. But in a multi-fact relationship model, the join options are expanded to include outer and cross joins to handle different levels of relatedness. For more information, see [About Multi-fact Relationship Data Models](https://help.tableau.com/v0.0/online/en-us/datasource_mfr_multiple_base_tables.htm). ### Where did the name come from? Multi-fact relationships get their name from multi-fact analysis. In a data warehouse model, data is stored in a central fact table surrounded by dimension tables. In this context, _fact_ refers to measurements or metrics, which are numeric fields of data that capture facts about the data—Tableau's measures. Dimension tables contain attributes about these facts. Schemas based on fact tables are often structured as a star or snowflake, depending on how the dimension tables are organized. When analysis needs to be performed across fact tables, this is called multi-fact analysis. Analysis is done in the context of the common dimension tables, known as shared dimensions or conformed dimensions. In Tableau you build these data models using relationships, so we've named this suite of capabilities multi-fact relationships. ## When to use multi-fact relationship data models If your data consists of tables that are all related to each other, you can stick with single base table data sources built with relationships. A multi-fact relationship model is called for when your data spans different concepts, either in the form of multiple fact tables, or different unrelated contexts. Whenever possible, build your data sources with a single base table. In a single base table data model every table is related and there is no need to consider degrees of relatedness. Only use multi-fact relationships when that data model structure is called for. ### Multi-fact analysis Multi-fact analysis is a core use case for multi-fact relationships in Tableau. In this example, Fact A and Fact B share a table Date. ![a multi-fact data model](/tableau/next/en-us/online/en-us/Img/mfr_use_mfa_model.png) To model this in Tableau, the fact tables become base tables and multiple incoming relationships are established for their shared dimension table. ![a multi-fact relationship data model](/tableau/next/en-us/online/en-us/Img/mfr_use_mfr_model.png) ### Other scenarios Multi-fact relationship data models aren't just for multi-fact analysis, however. Tableau doesn't require a strict definition of fact or dimension tables. Any table can be a base table (although it should suit the [characteristics of base tables](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_when_to_use.htm#characteristics)). Some scenarios that indicate a multiple base table data source might be helpful include: - **Moving through stages**, such as base tables for applications, transcripts, and alumni events for a shared student table. - **Different contexts for the same events**, such as base tables for the events of medical appointments and billing invoices, with shared tables to set the context to doctors or patients. - **Different domains that may correlate,** such as scenarios that would previously be best handled with data blending, like ice cream sales and weather correlated through the shared tables of date and location. Learn more about when multi-fact relationships are useful in this Tableau blog post: [When and How to Use Multi-fact Relationships in Tableau](https://www.tableau.com/blog/when-how-use-multi-fact-relationships-tableau). ## Identify the base tables In a multi-fact relationship model, directionality matters. That is to say, which tables are the base tables along the left side of the model and which tables are shared downstream impacts how the relationships are evaluated to return the analytical results. Consider a conceptual bow tie of invoices, appointments, doctors, and patients: ![a bowtie data model with invoices and appointments on the outside and doctors and patients in the middle](/tableau/next/en-us/online/en-us/Img/mfr_bowtie1.png) The correct way to build the data model in Tableau is with Invoices and Appointments as the base tables, and with Doctors and Patients as the shared tables (not with Doctors and Patients as the base tables).

Correct: Invoices and Appointments as the base tables	Incorrect: Doctors and Patients as the base tables

Conceptually, a patient (or doctor) is the entity that stitches together the event of an appointment and the event of an invoice. If your data model is backwards (such as with Doctors and Patients as the base tables instead of Appointments and Invoices), the [outer join stitching behavior](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_multiple_base_tables.htm#Stitched) won't be as useful. Your analysis might show a lot of table scoped measures and ambiguity. If you find yourself with ambiguously related fields that you weren't expecting , reevaluate the tables you are using as base tables and see if your data model needs to be reversed. ### Characteristics of base tables and shared tables If you're performing multi-fact analysis, the fact tables become the base tables and any shared dimension tables are shared tables. Tableau doesn't require a strict adherence to fact and dimension table characteristics. However, there are certain attributes that can help you identify which tables should be base tables and which should be shared tables.

Base table	Shared table
Fact tables in a data warehouse schema	Shared or conformed dimension tables in a data warehouse schema
Specific to the context or analysis (flight information, energy usage)	Consistent concept across various contexts (date, location)
Measure heavy	Primarily dimensions
More frequently updated/transactional (medical appointments, prescriptions, vitals)	More stable/durable (doctor, patient)
Has foreign key fields	Has primary key fields
Event based (class schedule, grade on an assignment)	Entity based (student, classroom)

Note that if there are intermediate tables between a base table and a shared table, you can [swap which one is the base table](https://help.tableau.com/current/pro/desktop/en-us/datasource_mfr_build.htm#swap) without fundamentally altering the data model. (Such as Parlor Info and Ice Cream Sales in the first example.) What matters is which tables are upstream of the shared tables and which are shared. ### Try an additional base table instead There are various scenarios that may indicate you should build a multi-fact relationship model with multiple base tables rather than a single base table data source: - If you're trying to build a data source with a cycle, the downstream table should be another base table instead. - If you have a series of tables that are related on the same sets of relationship clauses (such as date and location), those dimensions should be pulled out and made into shared tables instead. - This is especially useful because multiple relationship clauses must all be true (logically, an AND) for the tables to be related for those records. - If, instead, you want to analyze records where one may be true at a time (a contextual OR), this flexibility is provided by setting up a data model with shared dimension tables instead. - If you're using a blend but want to have an equivalent blend without primary and secondary data sources, build a data model which combines the data sources from the blend with their linking fields in a shared table or tables. [Skip to main content](#main-content) # Work with Group Sets Beginning in June 2024 (Tableau 2024.2), you can create a container for your groups using group sets. A group set can contain one or more groups and be used to apply more granular rules for content permissions that are dependent on the group set. When enabling capabilities based on a group set, users in the groups that belong to the group set must be members of all the groups for the capability to be evaluated. In this way, group sets enforce AND logic. **Benefits of group sets:** - You can mix and match synchronized groups with local groups in permission rules to enable more dynamic access control scenarios. - Use AND logic for groups in permission rules, which can simplify access control in some scenarios **Notes:** - Group set permission rules are evaluated after user and group rules. For more information about those rules, see [Evaluate permission rules](https://help.tableau.com/v0.0/online/en-us/permission_effective.htm#EvaluatePermRules). - Group sets can only be created by site admins. - Group sets are not to be used as a group of groups. ## Turn on group sets Before group sets can be used for permissions, group sets settings must be enabled. 1. Sign in to Tableau Cloud as site admin. 2. Navigate to the Settings page. 3. Under the Group Sets section, select the Allow group sets check box. ![](/tableau/next/en-us/online/en-us/Img/abac_groupset_setting.png) After enabling group sets, a dedicated Group Sets page displays in the navigation pane. ## Create group sets To create a group set, navigate to the Group Sets page and create a group set as you would a group. 1. Sign in to Tableau Cloud as site admin. 2. Navigate to the Group Sets page and click the New Group Sets button. 3. Enter a name for the group set and click Create. ![](/tableau/next/en-us/online/en-us/Img/abac_groupset_create.png) 4. In the Group Sets table, click the name of the group set you just created and click the Add Groups button. 5. From the list of available groups, select the groups you want to add to the group set and click the Add button. ![](/tableau/next/en-us/online/en-us/Img/abac_groupset_add_groups.png) ## Set permissions on group sets To use group sets, as a site admin, project leader, or content owner, add or edit the permissions of the content to use the group set. For example, suppose you are the owner of the "Batters" workbook. To apply permissions based on the group set, do the following: 1. Go to the workbook and select Permissions from the actions menu. 2. In the Permissions dialog box, click the Add Group/User Rule button, and do the following: 1. In the text box, enter the group set name, for example "All Contractors." 2. Select the desired capabilities in the template. 3. Click Save. ![](/tableau/next/en-us/online/en-us/Img/abac_groupset_permissions.png) When permissions are applied using the group set model, you create permissions that affects the users that have membership in _all_ groups in the group set. For example, you might restrict access to different workbook views based on a user’s regional group affiliation. Suppose you have users who are, contractors, contractor managers, full time employees, and full time managers accessing these workbook views. Groups that have default permissions to view the workbook: All, North, South, East, West, Full Time, and Managers. - For the North Region Detailed view: - Permissions are based on group set: North Region - Groups in the group set: Full Time, North Outcome: Only full time employees and full time managers in the north can see the data in the North Region Detailed view. - For the All Region Detailed view: - Group set is called Managers - Groups in the group set: All, Managers Outcome: Only contractor managers and full time managers can see the data in the All Region Detailed view. For more information about permissions, see [Configure Projects, Groups, Group Sets, and Permissions for Managed Self-Service](https://help.tableau.com/v0.0/online/en-us/projects_data_gov.htm). [Skip to main content](#main-content) # Work with Tableau Pulse Metrics and Dashboards Bring Tableau Pulse metrics into dashboards with the Pulse dashboard object, and create recommended metrics based on the data used in a dashboard. ## Add metrics to a dashboard To show metrics alongside other content in a dashboard, add the Pulse Metric object. The metrics that are available to add to a dashboard are those that connect to the same published data sources that are used by the workbook. For more information about dashboard objects, see [Add dashboard objects and set their options](https://help.tableau.com/current/pro/desktop/en-us/dashboards_create.htm#add-dashboard-objects-and-set-their-options). 1. On a dashboard, from the Objects section, drag the Pulse Metric object to the dashboard. 2. Select a metric definition to see the list of metrics based on that definition. If there are no metric definitions shown, create one in Tableau Pulse. 3. Select a metric. 4. For the metric display, choose whether to display the full card or a compact card. 5. To style the metric like the cards on the Tableau Pulse home page, toggle on Use Tableau Pulse style. Tableau Pulse style adds rounded corners and an elevated border. Without this style option, the metrics on a dashboard resemble other borderless dashboard objects. 6. To make it so the metric is filtered when users select dashboard filters, toggle on Respond to filter selection. To understand which filters apply to Pulse metrics, see [How dashboard filters affect Pulse metrics](#filters). 7. To link the metric card to the Tableau Pulse insights exploration page, toggle on Link to Tableau Pulse. This link opens in a new tab. 8. Select Add to Dashboard. After you’ve added a Pulse Metric object, you can change the metric or adjust the settings by selecting Configure from the object’s context menu. ![Dashboard object context menu](/tableau/next/en-us/online/en-us/Img/pulse_dashboard_object_configure.png) ### How dashboard filters affect Pulse metrics For a Pulse metric to respond to a dashboard filter, the filter must meet certain conditions. - The filter is from the same data source that the metric definition connects to. - The filter is an adjustable metric filter on the metric definition. - The filter is a dimension. Time and measure filters from a dashboard don’t filter Pulse metrics. - The filter is applied through an exposed filter (see [Display interactive filters in the view](https://help.tableau.com/current/pro/desktop/en-us/filtering.htm#ShowFilter)) or by selecting keep only or exclude on a mark or header (see [Select to keep or exclude data points in your view](https://help.tableau.com/current/pro/desktop/en-us/filtering.htm#SelectData)). Filter actions that send information between sheets (see [Filter Actions](https://help.tableau.com/current/pro/desktop/en-us/actions_filter.htm)) don’t filter Pulse metrics. If there are multiple filters for the same dimension on a dashboard, Pulse metrics respond to the combination of filters based on these rules. - If the set of filters either both include values or both exclude values, the combined set of selected values applies to the metric. So if filter 1 includes values A and B, and filter 2 includes values B and C, then filters for A, B, and C apply to the metric. - If filter 1 includes a set of values, and filter 2 excludes that same set of values, the filters cancel out, and no filters are applied to the metric. - If filter 1 includes values, and filter 2 excludes values, and the values aren’t the same, then the values that don’t cancel out apply to the metric. So if filter 1 includes A, B, and C, and filter 2 excludes A and B, then the only value included is C. - If all of the values for filter 1 are selected, either to include or exclude, then that is treated the same as no filter. So only filter 2, where selections have been made, applies to the metric. ## See recommended metrics for a dashboard To get a head start when creating a metric definition, you can create one from the list of recommended metrics shown for dashboards. 1. While viewing the dashboard that you want to create a metric definition from, select the Data Guide button in the toolbar. 2. On the dashboard, select the viz with the data you want to use. Data guide shows recommended metrics for this viz. Depending on how well the data in the viz fits the requirements for a metric, you might not see recommended metrics. If data guide can't recommend a complete metric, it might show recommended measures or dimensions or the primary data source used for you to connect to. ![The Data Guide pane showing recommended metrics](/tableau/next/en-us/online/en-us/Img/pulse_data_guide_bootstrapping.png) 3. Select a recommendation to configure it in Tableau Pulse. 4. The recommendation is pre-populated in the Tableau Pulse definition editor. To finish setting up your definition, see [Configure the core definition](https://help.tableau.com/v0.0/online/en-us/pulse_create_metrics.htm#create).