---
schema_version: "1"
id: fb70f451fe734e6d27ac01be2ca9bfd1a5603c484848e4158038bf9ed1c84574
title: Setup Inbound Private Connect
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/online/private_connect_inbound_setup.md
canonical_url: https://help.tableau.com/v0.0/online/en-us/private_connect_inbound_setup.htm
source_site: help.tableau.com
content_type: documentation
content_hash: f5b614fe54cc830715e7b8d972343560f1a56aa7a49af89acf096ffd73f9b9a7
description: This topic explains how to set up Inbound Private Connect for a Tableau Cloud site
---
[Skip to main content](#main-content)

# Setup Inbound Private Connect

This topic explains how to set up Inbound Private Connect for a Tableau Cloud site.

## Prerequisites

- Verify that your organization has enabled Inbound Private Connect. To check, log in to Tableau Cloud Manager, and select Settings. If you don't have the Private Connect tab, contact your account executive to enable Inbound Private Connect.
- Record the Tableau Cloud pod name. For example, if your site hostname is `10ay.online.tableau.com`, the pod name is "10ay".
- Record the Tableau Cloud Manager (TCM) tenant name. For example, if your TCM URL is `mytenant.cloudmanager.tableau.com`, your tenant name is "mytenant".
- Record the Region common to both the Virtual Private Cloud (VPC) and Tableau Cloud pod. (Your AWS account must have a VPC in the same region as your Tableau Cloud pod.) See [IP addresses for data provider authorization](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#safelist) for a table with a list of pods and regions.
- Record the Endpoint Service Name for your pod's region. The Endpoint Service Name is in the AWS Regions, IAM ARNs, and Endpoint Service Names table on the Tableau Cloud Manager Private Connect page.
- The VPC must have Domain Name System (DNS) hostnames and DNS resolution enabled. For more information, see [DNS attributes for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/AmazonDNS-concepts.html#vpc-dns-support) in the AWS documentation.

## Step 1: Create a VPC endpoint

Create an interface VPC endpoint in your AWS account that connects to the Tableau Cloud endpoint service. For more information, see [Create a VPC endpoint](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html#create-interface-endpoint-aws) in the AWS documentation.

1. Name tag (optional): Name the endpoint if desired.
2. Type: Select the Endpoint services that use NLBs and GWLBs category.
3. Service name: Use the Endpoint Service Name that you recorded in the prerequisites.
4. Select Verify service to proceed with setup.
5. Make sure that Enable Cross Region endpoint isn't checked.
6. VPC: Select your AWS VPC.
7. Subnets: Select subnets in at least two Availability Zones for high availability.
8. Make sure that Enable DNS Name isn't checked. (Configure private DNS manually in Step 5.)
9. Security group: Select an existing security group or create one. (Configure security groups in step 3.)
10. Select Create endpoint. The new endpoint status should be Pending acceptance.
11. Select the new endpoint to see Details.
12. Record the Endpoint ID. (Example: `vpce-0123456789abcdef0`)
13. Record the first entry in the list of DNS names. (Example: `vpce-0123456789abcdef0-12345678.vpce-svc-0123456789abcdef0.us-west-2.vpce.amazonaws.com`)

## Step 2: Configure the endpoint in Tableau Cloud Manager

Configure the Tableau Cloud side of Private Connect.

1. Log in to TCM.
2. Select Settings > Private Connect.
3. Under Inbound Connections, select Create.
4. Provide a Name and Description for the inbound private connection.
5. Select the Region. The region matches the VPC region and Tableau pod region.
6. VPC Endpoint ID: Use the Endpoint ID that you recorded in step 1.
7. Select Create. The new endpoint status should be Allocating.
8. Provisioning can take a few minutes. In the actions menu (...) of the new private connection, click Sync to refresh the status.
9. The private connection is ready when the status is Ready in TCM and Available on the AWS Endpoints page. (Refresh the endpoint list with the refresh icon.)

## Step 3: Configure security groups

Configure a rule on a AWS security group to allow traffic. For more information, see [Control traffic to your AWS resources using security groups](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html) in the AWS documentation.

- **Endpoint Security Group**: Allow HTTPS to the VPC Endpoint.

Keep in mind that your particular network architecture may require other security group configurations.

After you successfully establish the connection and configure the security group, proceed to Steps 4 & 5 in [DNS for Inbound Private Connect](https://help.tableau.com/v0.0/online/en-us/private_connect_inbound_dns.htm).