04/20/2021 | News release | Distributed by Public on 04/21/2021 02:56
Modern identity providers (IdP) are designed to allow customers to manage user access across all of their cloud applications, including Tableau Online. By using an external IdP, Tableau Online customers can take advantage of the many benefits provided by the IdP such as single sign-on and multi-factor authentication. Increasingly, customers have also set up automatic user provisioning with their IdPs in order to improve security and save time by managing their users and groups centrally in the IdP.
Tableau Online supports automatic user provisioning with multiple IdPs. Here we want to walk through a couple of ways to set up automatic user provisioning with Azure Active Directory (Azure AD), the identity service provided by Microsoft and one of the most popular IdPs used by Tableau Online customers.
Before diving into the details, we'd like to describe two key concepts that are related, but separate-user authentication and provisioning:
Tableau Online customers using Azure AD will typically first set up authentication by configuring single sign-on with Azure AD using SAML, then set up automatic user provisioning using one of the following two options.
The quickest way to enable automatic user provisioning from Azure AD to Tableau Online is to use the Tableau Online app from the Azure Marketplace. To do this, you will need a site administrator account of your Tableau Online site. This account must use Tableau ID authentication type with username and password (not single sign-on). You will also need access to the Azure portal of your organization or work with someone that has the access.
Once in the Azure portal, you can follow the Microsoft tutorial and set it up in just a few minutes.
Once set up, the app automatically adds new users or groups assigned to Tableau Online in the Azure portal to the Tableau Online site, and sets the user site roles according to the assignments. It also updates the user site roles when their assignments change in Azure portal, and deprovisions users or groups no longer assigned to Tableau Online.
If your organization has multiple Tableau Online sites and needs to provision users to more than one site, no problem. You can add more instances of the Tableau Online app to the same Azure AD tenant and configure them the same way as the first-just be sure to name them differently as you create them, so you can easily distinguish them in the application list.
While we expect the Tableau Online app to meet the majority of Tableau Online customers' needs for automatic user provisioning, it has a few limitations:
If you need more granular control over how user provisioning is performed for your organization, you can develop a custom app using the Tableau Online REST API and the Azure AD API. We've provided a ready-to-use, open-source application TabProvision to demonstrate how to automate the provisioning of users from Azure AD to Tableau Online. The app reads the user and group information from the IdP, such as Azure AD, and automatically adds, modifies, or removes them on your Tableau Online site to keep them in sync with the IdP.
While this option requires more upfront setup, including developing the app and an environment to host it, it provides several advantages over the out-of-the-box app from Azure Marketplace:
Tableau Online supports a mixture of Tableau ID and external IdP on the same site. When you set up Azure AD provisioning on your Tableau Online site, you may want to think through whether there are exceptions and if so how they should be configured.
For example, some users of your Tableau Online sites may be external partners, suppliers, or clients who are not in your organization's Azure AD. For them, the Tableau ID authentication type may be the most appropriate.
Similarly, sometimes defining local groups not synchronized with Azure AD makes sense. For instance, Tableau Online site administrators may want more control over the grouping of some users for permission or subscriptions.
Check out these additional resources to better streamline the user provisioning process of your Tableau Online sites: