Self-service security in Tableau Server via Outlook Groups

Managing Tableau Server security can be a lot of work, especially when you’re dealing with tons of users from all over the enterprise. Fortunately, Tableau has an easy way to set this up once and let users manage it themselves using Active Directory Groups (aka Outlook Groups).

Pre-requisites

  • Tableau Server with Active Directory integration
  • Exchange Server with Outlook Web Access (OWA)

Process when complete

  1. Users browse to OWA and join groups
  2. Owners of the outlook groups, usually department heads, approve access to the groups
  3. Tableau has an automated sync job (attached) that imports the users to Tableau Server

Outlook Group Setup

    1. Browse to your OWA site, typically mail.yourcompany.com
    2. Click on ‘options’
    3. Click ‘All Options’
    4. Click on ‘New’ under ‘Public Groups I Own’

Outlook Web Access Create New Group for Tableau Server

    1. This is a good time to start a best practice in your group naming convention. I recommend something starting with ‘Tableau – ‘ and then maybe the department or group name.
    2. Ideally you have a group for every project which also loosely match your org structure
    3. It’s important to set the correct membership approval option for the group. If the group will have access to sensitive information then make it either owner approval or closed. Then you can assign the business owner of the group who will manage membership (aka self-service)

Outlook Web Access New Group Dialogue for Tableau Server

  1. *I also recommend creating a ‘Tableau – Users’ and ‘Tableau – Publishers’ groups which are totally self-service w/o any approval required

Add the Outlook Groups to Tableau Server

    1. Browse to the import groups page in your Tableau Server environment (http://your-tableau-url/import/groups)
    2. Search for the groups (it may take ~10min after creating the groups for Tableau Server to find them)

Import Active Directory Group into Tableau Server for Self-Service security configuration

  1. Select the groups, then click ‘Import’. If you get 0 records found it may be because of an AD setting (more here)
  2. Go into the projects in your environment and add these new groups to them with the appropriate level of security
  3. With all of the groups imported and groups setup, it’s time to automate the process

Automate the Outlook Group sync to Tableau Server

    1. Login to your Tableau Server (usually using Remote Desktop)
    2. Create a new folder c:tasks
    3. Save the following script into this directory and rename it, removing the .txt file extension Tableau_SyncADGroups_2.0.bat
    4. Edit the script, replacing and adding the ‘tabcmd syncgroup’ command for every group you wish to import automatically.
    5. Now is a good time for a test run. Right click on the .bat file and choose ‘Run’. If all goes well, check the server in the background tasks view (http://your-tableau-url/admin/views/tabbed_admin_views/BackgroundTasks) to make sure it actually performed the sync.
    6. Lastly, we need to schedule this to run on a regular basis. I recommend nightly as to not conflict with active sessions of users. For detailed steps on creating a windows task go here: http://technet.microsoft.com/en-us/library/cc748993.aspx
    7. In the step for choosing an Action select ‘Start a Program’ and browse to our script. It should look like this

Create a Windows Scheduled Task to Automate the Synchronization of Active Directory Groups into Tableau Server

There will be some maintenance of this script to add the new groups you import to Tableau but it should only be a fraction of what the maintenance is of adding users manually to Tableau Server. As always if you have any questions about this or want to have a chat about the approach feel free to reach out to us.

Thanks!

  • Hi Ben

    I ran into trouble using the “Contact Me” page so I am trying to connect via your blog.

    Initially I am contacting you about your availability for consulting work. We are looking for a lead to design and develop scorecards and dashboards tying together PerformancePoint, ProClarity, Excel Services and Reporting Services components for a SharePoint BI project getting underway in the next month. Are you interested/available yourself or can you recommend someone?

    Secondly, I really like your app! My CIO is like you – Tough Mudder events, 10k races, etc. all to benefit charities. I’m going to share it with him.

    Thanks for the site and I look forward to connecting.

    Best regards,

    Susan Lebas

  • Hi Susan,

    Thanks for reaching out. Feel free to reach out to me directly via email (ben.sullins@interworks.com) and we can take it from there.

    Re the app: yes please do! I need more folks submitting requests for events. I used it heavily during the CrossFit Games this past year but haven’t updated it much since then.

    Cheers,
    Ben

Free 5 Day Video Course | Tableau Quick Start

Everything you need to become dangerous :)

x