Tableau Security Review

A workbook author who chooses Embed password when publishing a data source hands every viewer of that workbook their own Connect access, and Tableau’s documentation confirms this directly.

One embedded password can hand every viewer of a Tableau workbook the publisher’s own data access

Tableau’s own site role table shows the two roles with full connect-and-publish rights, Site Administrator Creator and Creator, sit above Explorer (Can Publish), which has limited publishing capabilities, and Explorer, Viewer, Read Only and Unlicensed, which cannot publish at all. Underneath that, every project, workbook and data source carries its own permission rule for each capability, set to allowed, denied or unspecified, and a project’s Asset permissions setting is either Locked, so every nested item inherits one uniform rule, or Customizable, so an individual workbook can carry different rules from its own project. We map who actually holds each site role and where a project has quietly gone from Locked to Customizable against what your business intended.

Publishing a workbook against a published data source means choosing between Embed password, using the author’s own Connect access to that data, or Prompt users, requiring each viewer’s own credentials, and Tableau’s permission capability reference is direct that embedding a password means the author is essentially embedding their own Connect capability for anyone who opens the workbook. A separate Download Data Source capability lets a user take the whole data source away as a TDSX file, at which point every embedded credential travels with it. We test which authentication choice is live on every published workbook and data source in scope, and who can walk away with the file entirely.

Row-level security in Tableau runs through a user filter mapped manually or built dynamically against a reference security or entitlement table, but it only restricts data when the filter is set at the data source level, not the workbook or sheet, and a centralised alternative exists in a virtual connection’s data policy, which applies its own policy condition against an entitlement table across every workbook built on it, the equivalent layer we test on our Power BI and Snowflake reviews. Embedded analytics adds another identity to check, since a connected app’s JWT names the connected app and the user a session is generated for, and we confirm that identity is genuine rather than shared or over-scoped, alongside whether a Guest user account, a Tableau Server feature tied to core-based licensing, is quietly live on a deployment that should have none.