Permissions When Moving Tableau Server Content
Moving content in Tableau Server is inevitable, even with how much we plan ahead for content organization. Let’s talk about how moving content can affect its permissions. We’ll start with what can and cannot be moved.
What can I move?
Projects, workbooks, and published data sources can all be moved between projects. Views and embedded data sources are tied to specific workbooks and therefore cannot be moved between projects and workbooks in Tableau Server.
To move any of these items, click the “…” next to it and choose Move. From here, select which project to move it to.
So we know what we can move, but what effect does that have on the permissions to that content?
Permissions: Some Background
Now is a good time to point out an important distinction that determines how permissions are handled when content is moved. That is whether project permissions are locked or unlocked.
Locked permissions are set at the Project level. This means that the permissions of any content published to that project will have the same permissions set at the top project folder. Any subprojects are locked to those permissions.
Unlocked permissions are set at the Content level by the content owner. The default behavior when publishing will be to set the content permissions to the same as the project, but this can always be overridden by the content owner. If the top level project permissions are changed, this will not propagate to content beneath it in the hierarchy.
Also worth calling out is that if a top-level project is unlocked, none of its child projects can be locked. The idea to lock child projects is currently on the roadmap and the functionality is tracked on the ideas forum here. I’m very excited for this and am watching this idea like a hawk. As the kids say, we stan this idea.
Whether a project is locked or unlocked is determined in the project permissions by clicking “Edit Content Permissions.”
Moving to a Locked Project
Moving to a locked project is pretty straight forward. We’ll use the diagram below to guide us.
Here you can see Workbook 1 starts in Project 1 with access for SG Tableau Project 1 Creators. Project 2 has locked permissions, with all of its content being given access to SG Tableau Project 2 Creators and SG Tableau Project 2 Viewers.
Let’s say we want to move Workbook 1 to Project 2. Because the project permissions are locked, we immediately see those top level permissions automatically propagated to Workbook 1. The final state of Workbook 1 has the same permissions are Project 2: SG Tableau Project 2 Creators and SG Tableau Project 2 Viewers.
Moving to an Unlocked Project
Moving to an Unlocked project looks a little different. Again, we will walk through the visual below.
Again you can see Workbook 1 starts in Project 1 with access for SG Tableau Project 1 Creators. Project 2 now has unlocked permissions, again with top-level project access to SG Tableau Project 2 Creators and SG Tableau Project 2 Viewers.
Now if we move Workbook 1 to Project 2, the permissions will not change automatically. Workbook 1 retains all permissions it had prior to the move.
But what if you want the Workbook 1 to match the project permissions? You’ve basically got two options outside of scripting:
Note that in our case above, if you choose to lock the top-level project permissions on Workbook 2 will be overridden in addition to our moved content.
Tableau Server’s flexibility makes moving between projects a breeze, you just need to think through some of the permissions implications. Obviously, our locked project keeps things really simple, which is one of the reasons I really like locked permissions. However, if you need the flexibility of an unlocked project, there are workaround toward aligning permissions properly.