11.1 Tableau Server & Cloud: Sites, Projects, Roles & Permissions
Key Takeaways
- Tableau Server is customer-managed; Salesforce operates Tableau Cloud while customers administer their own content and access.
- Sites are stronger content boundaries, while projects organize and govern assets within a site.
- A site role is a capability ceiling; permissions determine access to a particular project or item.
- Explorer (Can Publish) and Explorer are distinct roles with different publishing rights.
- A custom view saves a user-specific interaction state without changing the underlying workbook.
11.1 Tableau Server & Tableau Cloud: Sites, Projects, Roles & Permissions
Tableau Server and Tableau Cloud host published analytical content for governed sharing. Tableau Server is customer-managed software: the organization installs, upgrades, configures, backs up, and monitors the deployment. Tableau Cloud is Salesforce-managed software as a service: Salesforce operates the hosting platform, while each customer still administers users, groups, sites, projects, permissions, content, credentials, and governance policies available to it.
Sites and projects
A site is a content and administration boundary. Users sign in to a particular site and ordinarily see only content available there. On Tableau Server, administrators can create multiple sites to separate communities on one deployment. A site is stronger isolation than two projects, but exact administration and user visibility depend on the deployment's settings and administrator roles.
Projects are containers inside a site. They organize workbooks, data sources, flows, and related content. Nested projects can create a business hierarchy such as Finance > Planning. A project leader can administer content and permissions within the authority granted for that project. Use groups rather than many individual rules so membership changes remain manageable.
Project permissions can be locked so contained assets use the project's rules, or customizable so eligible owners and leaders can manage child permissions. Locking supports consistency. Customizable permissions support exceptions but require more auditing. Always inspect effective permissions rather than inferring access from ownership alone.
Site roles
A site role establishes the maximum level of capability a user can receive on a site; permissions decide what that user can do with a specific resource.
- Server Administrator is a Tableau Server role with broad deployment authority.
- Site Administrator Creator and Site Administrator Explorer administer a site within their respective license capabilities.
- Creator can publish from Tableau Desktop and Tableau Prep Builder and can create new data connections, subject to permissions.
- Explorer (Can Publish) can use browser authoring and publish or save content when permissions permit, but does not receive Tableau Desktop or Prep Builder from that role.
- Explorer can interact with and edit existing workbooks in the browser when granted, but cannot publish new content.
- Viewer consumes and interacts with published views within granted capabilities.
- Unlicensed cannot sign in and consume licensed content.
Do not shorten Explorer (Can Publish) to Explorer in a scenario about saving a new workbook; they are distinct site roles. A Creator still cannot publish into a project whose permissions deny Save, and a Viewer cannot be elevated beyond the site's role merely by an Allow rule.
Permissions evaluation
Capabilities include View, Web Edit, Download Data, Download Workbook/Save a Copy, Connect, and Save. Permission templates are starting configurations, not separate license types. Access comes from the interaction of site role, ownership, group rules, user rules, project locking, and asset-level rules. An explicit deny in a relevant rule can remove a capability that another group allows, subject to Tableau's permission evaluation rules and administrator privileges.
The most reliable troubleshooting sequence is:
- Confirm the user is licensed on the correct site.
- Confirm the site role permits the broad action.
- Check project and content permission rules, including group membership.
- Check whether the project is locked or permissions are customizable.
- Use the effective-permissions display to see why a capability is allowed or denied.
Web authoring
Web authoring edits a workbook through the browser. The available actions depend on site role, Web Edit and Save capabilities, site settings, and the connector or data source. Creator users can establish supported connections and create content. Explorer (Can Publish) users can create and save workbooks from permitted published data sources; standard Explorer users can edit existing content but cannot publish new workbooks. Owners and administrators may have additional management abilities, but ownership does not bypass the site-role ceiling.
Custom views
A custom view saves a user's interaction state for an existing published view, including filters, sorting, selections, and zoom where supported. It does not change the underlying workbook. A user can make a custom view the default and may share it when the site allows sharing. Custom views are useful when viewers repeatedly need the same slice without creating copies of the workbook.
Architecture choices in scenarios
Choose separate sites when the requirement is strong administrative and content separation. Choose locked projects when a group should inherit consistent capabilities. Choose customizable projects when controlled asset-level exceptions are explicitly required. Choose the least-powerful site role that supports the work, then grant only the necessary content capabilities. This separation of license ceiling, container policy, and content permission is central to accurate Tableau administration.
An enterprise organization is deciding between deploying Tableau Server on AWS EC2 versus adopting Tableau Cloud. The IT infrastructure team mandates that they must retain complete control over background process worker allocation, custom process topologies for heavy batch extract refreshes, and direct access to Tableau Services Manager (TSM) for local backups. Which platform meets these technical requirements, and why?
Two divisions on the same Tableau Server deployment require the strongest available separation of ordinary users, projects, and published content. Which container should the administrator use?
A financial analyst has the Explorer (Can Publish) site role on Tableau Cloud and permission to save in a project. Which action can the analyst perform directly?