> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tableau

*This article applies to Tableau connections created after July 2025 (the Domain ID under your Lumos domain shows `tableau_ics`). If your Domain ID shows `tableau.com`, your connection uses the archived pre-July-2025 setup, and the differences are noted inline below.*

## After this article

You'll be able to connect Tableau to Lumos to sync users, groups, site roles, licenses, and project/workbook permissions. You can also provision users, grant site roles, and manage project and workbook permissions.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | User account records |
| Groups | Permission | Yes | No | Access control groups |
| Site Roles | Permission | Yes | Yes | Grant only (site roles can't be unassigned) |
| License | Permission | Yes | No | License, mapped from the user's site role |
| Project Permissions | Permission | Yes | Yes | Project-level permissions |
| Workbook Permissions | Permission | Yes | Yes | Workbook-level permissions |

| AppStore | Offboarding | Access Reviews | License Management |
| - | - | - | - |
| Yes | Yes | Yes | Yes |

| Deprovisioning Action | Type | Description |
| - | - | - |
| Delete | User | Delete a user in Tableau (the user is removed from the site, removal from all sites means the user is deleted, and this reclaims a license) |

**Account status mapping:** users whose site role is anything other than Unlicensed sync as **Active**. Users with the Unlicensed site role sync as **Suspended**. Users no longer returned by Tableau show as **Deprovisioned**. This mapping also applies when Lumos creates or activates an account: a user created with, or already holding, the Unlicensed site role is reported as Suspended, and Lumos then runs its activation step. When a request would activate a user whose current site role is higher than the one requested, Lumos keeps the existing site role and license rather than downgrading them.

**Create Account authentication method:** the Create Account action can set an Authentication Method (from Tableau's AuthSettings): `SAML` (sign-in via the site's IdP), `OpenID` (Tableau Cloud only: Google, Salesforce, or OpenID Connect), `TableauIDWithMFA` (Tableau Cloud only), or `ServerDefault` (the server's default method, which corresponds to TableauID). If you omit it, Tableau falls back to the site default. Only the **site role** entitlement is valid for Create Account, and other entitlement types aren't supported.

**Activity tracking:** supported. Lumos tracks each user's last login.

## Required plan and roles

* **Lumos plan:** no minimum plan required.
* **Tableau role:** the setup user must be a **Site Administrator** (single site) or **Server Administrator** (Tableau Server). If you use Tableau Server with multiple sites, a system administrator user must create the PAT.
* **Authentication:** either a **Personal Access Token (PAT)** or a **Connected App (Direct Trust)**, chosen on the **Tableau (Multi-Auth)** card. A PAT inherits the permissions of the user who created it. Direct Trust signs a JWT with a Connected App secret and runs as the Tableau user you name, so that user needs the Site Administrator role described above.
* **Permission scoping:** a read-only connection isn't available. Tableau doesn't provide a view-only permission for user management, so a Site Administrator role with read/write access to users is required.
* **Tableau Server:** requires version 2020.1 or later.

<Note>
  The Tableau (Multi-Auth) card with Connected App (Direct Trust) authentication is in Early Access. Contact your Lumos team to have it enabled for your domain.
</Note>

## Read-only access vs provisioning

**Is read-only possible?** No. Tableau doesn't provide a view-only permission for user management, so every Personal Access Token inherits full read/write access from the Site Administrator (or Server Administrator) who created it.

**What full provisioning requires.** A Personal Access Token created by a Site Administrator, or by a system administrator user if you're on Tableau Server with multiple sites. The token carries whatever access that user has, so provisioning, project and workbook permission changes, and site role grants all follow from the steps below with no separate credential.

**Watch out for.** The token carries the access of the user who created it, so if that person loses Site Administrator rights or is deactivated, provisioning stops working. Create a new PAT under an active administrator and reconnect. Tableau also requires every user with site access to keep one site role, so Lumos cannot unassign a site role or a license. To remove someone's access, assign them the Unlicensed site role instead.

## Instructions

**Phase 1 (option A): Create a Personal Access Token in Tableau**

1. Log in to Tableau as the Site Administrator (or Server/system administrator, per above).
2. Click your avatar and choose **My Account Settings**.
3. Scroll to **Personal Access Tokens**, enter a name (for example, `Lumos Integration`), and click **Create new token**.
4. Copy the **Token Secret**. It's shown only once.

If you see *"Your site administrator has disabled PAT creation."*, a site administrator must first enable PAT creation in site settings (it's off by default for new accounts).

**Phase 1 (option B): Create a Connected App with Direct Trust in Tableau**

1. In Tableau, go to **Settings → Connected Apps**, create a **Direct Trust** connected app, and enable it.
2. Generate a secret and copy the **Client ID**, **Secret ID**, and **Secret Value**. The secret value is shown only once.
3. Note the username of the Site Administrator the connection will run as.

**Phase 2: Connect in Lumos**

1. Find the Tableau card in your Lumos integrations (reconnect an existing card or add a new one).
2. Choose **Tableau Cloud** in the dropdown. *(Pre-July-2025 connections also offered **Tableau Server**, so choose it if you self-host.)*
3. Choose the credential. For **Personal Access Token (PAT)**, enter the token value and the **Personal Access Token (PAT) Name**. For **Connected App (Direct Trust)**, enter the **Client ID**, **Secret ID**, and **Secret Value**, plus the username the connection runs as. Enter the **Tableau Server URL** in both cases.
4. Copy your Tableau instance URL, including the site name, into the **Server URL** field, for example `https://[something].online.tableau.com/#/site/[my_company_tableau_site_name]` (Tableau Server: `https://[domain.of.my.tableau.tld]/#/site/...`).
5. Click **Connect Tableau**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Deprovision fails with "cannot unassign site role/license".** This is expected behavior, not an error. Tableau requires every user with site access to keep one site role, and Lumos can't unassign licenses. To remove someone's access, assign them the **Unlicensed** site role instead.

**Create Account fails with 409 Conflict.** Tableau automatically moves users to Unlicensed after 30 days of inactivity, and Lumos syncs them as Suspended. When such a user requests access again, the account already exists on Tableau's side, so a create attempt is rejected with 409. Re-license or reactivate the existing account (for example, grant a site role) rather than creating a new one.

**Sync starts fine, then fails with 401 mid-sync.** Long paginated syncs can outlive the Tableau session token. Lumos refreshes the auth token and retries 401s during pagination, so transient 401s recover automatically. If a sync still fails this way, re-run it and verify the PAT is still valid.

**Cannot delete a user who owns content.** A user who still owns content (assets other than subscriptions) on Tableau Server can't be deleted until you reassign ownership.

**"Your site administrator has disabled PAT creation."** PAT creation is off by default for new Tableau accounts. A site administrator must enable it in site settings before you can create the token.

**Provisioning stopped after the setup user changed.** The PAT inherits the permissions of the user who created it. If that user loses Site Administrator rights or is deactivated, create a new PAT under an active administrator and reconnect.