Tableau Server permissions offer a lot of flexibility. Permissions can be assigned all the way down to the dashboard (view) level. However in medium to large Tableau environments ongoing maintenance should be a key consideration.
Tableau Server permissions work at many levels and sometimes they need at each level – i.e. view => workbook => project. However if you assign permissions at the workbook level or below the maintenance becomes increasingly time consuming.
Therefore the most efficient way to assign permissions is from the top down: project => workbook => view. I’ll explain the reasons later in the article.
To add permissions to an object simply select it and click Permissions.
You can select your groups/users and assign their permissions. This is where it can start to get painful should you have many to add. Each group/user needs to be added individually.
Another thing to note is, generally by default, that permissions don’t automatically apply to objects within the project. For example when adding permissions to a Project the workbooks don’t automatically inherit the same permissions.
There is a Project setting to have the project “Locked” or “Managed By Owner” / “Customisable”. Locking the project means the objects within that project automatically inherit the same permissions as the project. “Customisable” / “Managed By Owner” means permissions need manually setting on each object.
Top down management of permissions is best
It is far more efficient to manage Tableau Server permissions at the Project level and using Tableau Groups. Locking the Project so all objects inherit the permissions is far more maintainable. There will be far fewer projects to manage than workbooks and this is relatively simple to centrally manage.
Using Tableau Groups for permissions means bulk-managing the permissions of many users sharing a role. Far more efficient than managing on an individual basis.
Especially within large organisations, with many thousands of people moving jobs / changing role. Synchronising Tableau Groups with Active Directory groups is also more efficient when relevant AD groups exist. Particularly in large global organisations for a Tableau Site administrator to individually know the names and roles of all users is impossible. Therefore accurately maintaining permissions is a significant challenge. Valid AD groups can assist this ongoing maintenance.
Trying to manage at the workbook / view level would become almost impossible once there are more than 100 users on the Tableau Site. Therefore better to start correctly and set up an appropriate Project structure to allow a much larger scaling out of your Tableau operations.