> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Tableau Cloud
Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we deeply integrate your Tableau Cloud site into the Oleria platform. This document provides step-by-step guidance for integrating Tableau Cloud with your Oleria workspace.
A single Oleria connection covers **one Tableau Cloud site** - Oleria discovers every user, group, site role, and content resource the connection can reach.
## Prerequisites
* A **Tableau Cloud** site with Site Administrator or Creator access.
* One of the following credentials for the connecting account:
* A **Personal Access Token** (recommended) generated from the account's Tableau profile.
* A **username and password** for a Tableau account with site administrator access.
* A **Connected App** (Direct Trust JWT) registered on the site, with a secret.
* A **Unified Access Token** (UAT) issued by your identity provider, configured at the Tableau Cloud Manager level.
* Your site's **Server URL** (the Tableau Cloud pod, for example `https://10ax.online.tableau.com`) and **Site Content URL** (the short identifier in your site's URL; leave blank for the pod's default site).
Oleria recommends using a dedicated service account rather than a named employee account, so the connection doesn't break on personnel changes. The account must have **Site Administrator Explorer** or **Site Administrator Creator** access to reach all users, groups, and content permissions.
## What Oleria discovers
| Area | Detail |
| :----------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Users** | Site users as Accounts, including their site role and license information. |
| **Non-human identities** | Connected Apps (as NHI Accounts) and their individual secrets (as sub-credential NHI Accounts). |
| **Groups** | Local and Active Directory-synced groups, with per-user membership. Tableau groups are flat - no parent/child hierarchy. |
| **Site roles** | The eight fixed Tableau site roles (Creator, Explorer, ExplorerCanPublish, ServerAdministrator, SiteAdministratorCreator, SiteAdministratorExplorer, Viewer, and Unlicensed), with role-to-user assignment. |
| **Resources** | Projects, Workbooks, and DataSources, with nested containment and the full permission-grant surface (direct user and group grants, including inherited grants from Locked projects). |
| **Activity** | Workbook and DataSource create, update, and delete events, sourced from Admin Insights via VizQL Data Service. Requires Admin Insights to be enabled and accessible to the connecting account - silently emits nothing if it isn't. |
## Set up the integration
Tableau Cloud supports four authentication methods. All four exchange credentials for a session token at sign-in, so Oleria can reach the same REST API surface regardless of which method you use. **Personal Access Token is recommended** - it doesn't require a live user session and has a long, configurable lifetime.
Choose one of the following methods and prepare the required values:
**Personal Access Token (recommended)**
1. Sign in to Tableau Cloud as the service account.
2. Select the account menu in the top right corner, then go to **Account Settings**.
3. Under **Personal Access Tokens**, select **Create new token**, give it a name (for example `Oleria`), and copy the **Token Name** and **Token Secret**.
The token secret is shown only once. Save it immediately and securely.
**Username and Password**
Use the service account's username and password. No additional setup is required.
**Connected App (Direct Trust JWT)**
1. In the Tableau Cloud site admin panel, go to **Settings** -> **Connected Apps** -> **New Connected App** -> **Direct Trust**.
2. Give it a name, confirm the access level, and select **Enable**.
3. Select **Generate New Secret**, and copy the **Client ID**, **Secret ID**, and **Secret Value**.
4. Note the **email address** of the user Oleria will impersonate - this is the JWT Subject Email.
**Unified Access Token**
Configure a UAT at the Tableau Cloud Manager (TCM) level (`cloudmanager.tableau.com`). You need the **Issuer**, **Username**, **Tenant ID**, optionally the **Key ID**, and the **RSA private key** from your identity provider.
## Connect Tableau Cloud to Oleria
Go to your Oleria workspace, select **Integrations** -> select **Tableau Cloud**.
Fill in the fields that apply to your chosen method:
**Always required**
| Field | Notes |
| :------------------------ | :----------------------------------------------------------------------------------------------------------- |
| **Authentication Method** | Select one of the four methods. Defaults to **Personal Access Token**. |
| **Server URL** | Your Tableau Cloud pod URL, for example `https://10ax.online.tableau.com`. |
| **Site Content URL** | The short identifier in the site's URL (the segment after `/site/`). Leave blank for the pod's default site. |
**Personal Access Token**
| Field | Notes |
| :------------------------------- | :--------------------------------------------- |
| **Personal Access Token Name** | The token name from your account settings. |
| **Personal Access Token Secret** | The token secret, shown only at creation time. |
**Username and Password**
| Field | Notes |
| :----------- | :-------------------------------------- |
| **Username** | The service account's Tableau username. |
| **Password** | The service account's password. |
**Connected App (Direct Trust JWT)**
| Field | Notes |
| :----------------------------- | :-------------------------------------------------------- |
| **Connected App Client ID** | The Client ID from the Connected App settings. |
| **Connected App Secret ID** | The Secret ID generated for this Connected App. |
| **Connected App Secret Value** | The Secret Value generated alongside the Secret ID. |
| **JWT Subject Email** | Email address of the user the Connected App impersonates. |
**Unified Access Token**
| Field | Notes |
| :----------------------------------- | :-------------------------------------------------------------------------- |
| **Unified Access Token Issuer** | The issuer (`iss`) claim value for the UAT. |
| **Unified Access Token Username** | The Tableau username the UAT acts as. |
| **Unified Access Token Tenant ID** | Your Tableau Cloud Manager tenant ID. |
| **Unified Access Token Key ID** | Optional - leave blank if your identity provider's JWTs don't use a key ID. |
| **Unified Access Token Private Key** | The RSA private key from your identity provider, in PEM format. |
Select **Authenticate** to validate and save the integration.
## Verify the integration
Confirm Tableau Cloud appears in your Oleria workspace connected integrations. After the first sync completes, you can review the discovered users, groups, site roles, resources, and access grants in your Oleria workspace. If Admin Insights is enabled on the site, activity appears alongside them.
## Supported remediation actions
| Action | What it does |
| :------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Set Site Role to Unlicensed** | Removes the user's licensed access to the site. Oleria captures the user's prior site role so it can restore it if the action is reverted. |
| **Assign Site Role** | Sets the user's site role to the selected value. Oleria captures the prior site role so it can restore it if the action is reverted. |
| **Remove Site Role** | Downgrades the user to Unlicensed - the same end state as Set Site Role to Unlicensed. Oleria captures the prior site role so it can restore it if the action is reverted. |
| **Add / Remove from group** | Adds or removes the user from the selected group. Both directions support revert. |
## Notes and limitations
* **No separate disable state.** Tableau Cloud has no suspend/disable concept - `Unlicensed` is both the deprovisioning and the role-removal destination. Setting a user to `Unlicensed` effectively disables their access.
* **All site-role actions capture the prior role for revert.** Set Site Role to Unlicensed, Assign Site Role, and Remove Site Role all record the user's prior site role and can restore it on revert.
* **Activity requires Admin Insights.** If Admin Insights isn't enabled on the site or isn't accessible to the connecting account, activity data is silently empty - all other data is unaffected.
* **Activity scope is bounded.** Only Workbook and DataSource create, update, and delete events are collected in v1. Access-category events (view, download, login signals) and fine-grained history events are deferred to a later release.
* **No group hierarchy.** Tableau groups are flat - there are no parent/child group relationships.
* **Personal Access Tokens (PATs) as NHI** are out of scope - no REST surface was confirmed to enumerate a user's active PATs. Connected App secrets are modeled as NHI Accounts.
## Contact us
For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).