Skip to main content
Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we deeply integrate your Tableau Cloud site into the Oleria platform. This document provides step-by-step guidance for integrating Tableau Cloud with your Oleria workspace. A single Oleria connection covers one Tableau Cloud site - Oleria discovers every user, group, site role, and content resource the connection can reach.

​
Prerequisites

  • A Tableau Cloud site with Site Administrator or Creator access.
  • One of the following credentials for the connecting account:
    • A Personal Access Token (recommended) generated from the account’s Tableau profile.
    • A username and password for a Tableau account with site administrator access.
    • A Connected App (Direct Trust JWT) registered on the site, with a secret.
    • A Unified Access Token (UAT) issued by your identity provider, configured at the Tableau Cloud Manager level.
  • Your site’s Server URL (the Tableau Cloud pod, for example https://10ax.online.tableau.com) and Site Content URL (the short identifier in your site’s URL; leave blank for the pod’s default site).
Oleria recommends using a dedicated service account rather than a named employee account, so the connection doesn’t break on personnel changes. The account must have Site Administrator Explorer or Site Administrator Creator access to reach all users, groups, and content permissions.

​
What Oleria discovers

​
Set up the integration

Tableau Cloud supports four authentication methods. All four exchange credentials for a session token at sign-in, so Oleria can reach the same REST API surface regardless of which method you use. Personal Access Token is recommended - it doesn’t require a live user session and has a long, configurable lifetime.
1

Create credentials for the connecting account

Choose one of the following methods and prepare the required values:Personal Access Token (recommended)
  1. Sign in to Tableau Cloud as the service account.
  2. Select the account menu in the top right corner, then go to Account Settings.
  3. Under Personal Access Tokens, select Create new token, give it a name (for example Oleria), and copy the Token Name and Token Secret.
The token secret is shown only once. Save it immediately and securely.
Username and PasswordUse the service account’s username and password. No additional setup is required.Connected App (Direct Trust JWT)
  1. In the Tableau Cloud site admin panel, go to Settings -> Connected Apps -> New Connected App -> Direct Trust.
  2. Give it a name, confirm the access level, and select Enable.
  3. Select Generate New Secret, and copy the Client ID, Secret ID, and Secret Value.
  4. Note the email address of the user Oleria will impersonate - this is the JWT Subject Email.
Unified Access TokenConfigure a UAT at the Tableau Cloud Manager (TCM) level (cloudmanager.tableau.com). You need the Issuer, Username, Tenant ID, optionally the Key ID, and the RSA private key from your identity provider.

​
Connect Tableau Cloud to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Tableau Cloud.
2

Complete the connection form

Fill in the fields that apply to your chosen method:Always requiredPersonal Access TokenUsername and PasswordConnected App (Direct Trust JWT)Unified Access Token
3

Save the integration

Select Authenticate to validate and save the integration.

​
Verify the integration

Confirm Tableau Cloud appears in your Oleria workspace connected integrations. After the first sync completes, you can review the discovered users, groups, site roles, resources, and access grants in your Oleria workspace. If Admin Insights is enabled on the site, activity appears alongside them.

​
Supported remediation actions

​
Notes and limitations

  • No separate disable state. Tableau Cloud has no suspend/disable concept - Unlicensed is both the deprovisioning and the role-removal destination. Setting a user to Unlicensed effectively disables their access.
  • All site-role actions capture the prior role for revert. Set Site Role to Unlicensed, Assign Site Role, and Remove Site Role all record the user’s prior site role and can restore it on revert.
  • Activity requires Admin Insights. If Admin Insights isn’t enabled on the site or isn’t accessible to the connecting account, activity data is silently empty - all other data is unaffected.
  • Activity scope is bounded. Only Workbook and DataSource create, update, and delete events are collected in v1. Access-category events (view, download, login signals) and fine-grained history events are deferred to a later release.
  • No group hierarchy. Tableau groups are flat - there are no parent/child group relationships.
  • Personal Access Tokens (PATs) as NHI are out of scope - no REST surface was confirmed to enumerate a user’s active PATs. Connected App secrets are modeled as NHI Accounts.

​
Contact us

For questions about this integration, contact us at support@oleria.com.