Tableau User Management Guide

• Model type: hybrid
• Description: Tableau Cloud uses a two-layer permission model. The first layer is the site role (license tier), which sets a hard ceiling on what a user can ever do. The second layer is content-level capability rules applied to users or groups on specific projects, workbooks, views, and data sources. Capabilities (e.g., View, Download, Edit, Delete) can be explicitly Allowed or Denied at the content level, but they cannot exceed the ceiling set by the site role. Groups are the recommended unit for managing content permissions at scale.
• Custom roles: No
• Custom roles plan: Not documented
• Granularity: Per-content-object (project, workbook, view, data source, flow) with inherited defaults from parent project; individual capability toggles per user or group

1. Sign in to Tableau Cloud as a Site Administrator.
2. Navigate to the left navigation panel and select 'Users'.
3. Click 'Add Users'.
4. Choose 'Add Users by Email' to add individually, or 'Import Users from CSV' for bulk.
5. Enter the user's email address.
6. Select a site role (e.g., Viewer, Explorer, Creator) from the role dropdown.
7. Optionally assign the user to one or more groups.
8. Click 'Add Users'. An invitation email is sent to each new user.

Required fields: Email address, Site role

Watch out for:

• If SAML SSO is enforced on the site, the email address must match the identity provider's username/email attribute exactly; mismatches prevent sign-in.
• Users added manually while SCIM provisioning is active may have their attributes overwritten on the next IdP sync.
• Invitation emails expire; if a user does not accept within the expiry window, the admin must resend the invitation.
• Adding a user does not automatically grant them access to any content; project or workbook permissions must be configured separately.
• The total number of licensed users cannot exceed the seat count purchased; attempting to add users beyond the contracted limit will be blocked.

• Can delete users: Yes
• Delete/deactivate behavior: Tableau Cloud allows admins to remove (delete) users from the site. Before deletion, the admin must reassign or delete all content owned by that user. If the user owns content that has not been reassigned, Tableau will prompt the admin to handle it before the removal can complete. Once removed, the user account no longer exists on the site and the license seat is freed.

1. Sign in to Tableau Cloud as a Site Administrator.
2. Navigate to 'Users' in the left navigation.
3. Locate the user to remove using search or the user list.
4. Check the checkbox next to the user's name.
5. Click 'Actions' and select 'Remove Users'.
6. If the user owns content, Tableau will display a prompt to reassign owned content to another user or delete it.
7. Confirm the reassignment or deletion of owned content.
8. Confirm the removal. The user is deleted from the site and the seat is released.

Watch out for:

• A user cannot be removed while they still own content; the admin must explicitly reassign or delete all owned content first.
• If the site uses SCIM provisioning, a user deprovisioned in the IdP will be removed from Tableau Cloud automatically on the next sync; manual removal in Tableau is not required in that workflow.
• Removing a user deletes their personal space content (My Workbooks) unless it is moved to a shared project first.
• Subscriptions and data-driven alerts set up by the removed user are permanently deleted and cannot be recovered.
• There is no 'deactivate' or 'suspend' state in Tableau Cloud; the only options are to keep the user (potentially setting them to Unlicensed role to revoke access without deleting) or to fully remove them.

• Where to check usage: Tableau Cloud → Site Admin → General (or Status) → License Usage; also visible under Users list with role column showing current seat consumption
• How to identify unused seats: Admins can review the 'Last Sign In' column on the Users page to identify users who have not signed in recently. Tableau Cloud also provides Activity Log and Admin Insights (a pre-built data source) that includes user login frequency and last-active dates for identifying inactive licensed users.
• Billing notes: Tableau Cloud is sold on an annual subscription basis. Seat counts are contracted annually; adding seats mid-term is typically prorated. Reducing seats below the contracted minimum requires waiting until renewal. The Tableau+ bundle (includes agentic AI features) is available as an add-on or separate SKU. Pricing listed is standard list price; actual pricing may vary by contract or reseller.

Every app has a version of this problem, but Tableau's role model makes it sharper than most. Assigning a lower site role to a Creator-licensed user wastes the seat - the license cost is incurred regardless of the role displayed. There is no native suspend or deactivate state;

the only way to block access without deleting a user is to manually set their site role to Unlicensed, a workaround that requires deliberate action on every offboarding.

Content ownership reassignment is a required blocking step before any user can be removed, which compounds the manual effort when a departing user owns many workbooks or data sources.

Community evidence is not specific enough to quote or summarize yet for this app.

Manual administration is workable for small, stable teams where role assignments rarely change and content ownership is well-organized. It becomes a liability at scale: every app added to a growing stack multiplies the offboarding steps, and Tableau's content-ownership gate means a single missed reassignment blocks user removal entirely.

Teams already running Okta, Microsoft Entra ID, or OneLogin have a clear path to SCIM-based automation. Teams without SSO cannot use SCIM at all and must manage provisioning entirely by hand or via the REST API.

Bottom line

Tableau Cloud's permission model is precise but layered - license tier, site role, and content-level capabilities each interact, and misconfiguration at any layer produces access outcomes that are hard to audit after the fact.

Manual administration is viable for small teams but introduces real risk at scale: no suspend state, a blocking content-ownership step on every removal, and IdP sync behavior that can silently undo manual role changes.

Teams with SSO already in place should treat SCIM provisioning as the default path; those without it should factor the ongoing manual overhead into their operational planning.