This article covers how to get started with the Enterprise Reporting Platform Tableau, explaining key topics such as licensing, site administration, permissions, data sources, and server environment setup.
There are many different components for Tableau. Whether you need a license to be able to publish data sources, are looking for a site to be able to share information more widely, or have questions about permissions and projects, we have tried to provide enough information here to get you started.
Before You Begin
To either use the desktop version of Tableau or to publish a data source, a user needs a creator/desktop license (they're the same thing). To have a site, there must be at least one member of the site who has a creator's license. It does not have to be the site administrator, but that is fairly common. A creator is typically more focused on project, data source, and dashboard creation whereas a site administrator is focused on the infrastructure of the site. How your site is maintained is up to you and your team.
In This Article:
Tableau Licensing
A Tableau license enables a user to publish data sources, workbooks, and dashboards to a Tableau site.
How do I purchase initial or additional creator (desktop) licenses?
Tableau Creator's license (also known as desktop license) are available for purchase from the BuyCarolina site. If you do not have access to purchase, please work with your purchasing/finance team to obtain the license.
Tableau licenses are based on a three-year agreement, but the end user will only be billed per year. Software Distribution bills at the beginning of the fiscal year, so you will not get a charge for a license until the start of the fiscal year. Currently, a three-year license is $1800, so a user is billed ~600 per year.
Does the Site Administrator need a Creator License?
No, Site Administrators can have an Explorer license and free up the creator license to a dashboard developer.
Do I have to have a creator license to use Tableau desktop?
Yes, if you want to publish your content to the UNC server.
Can explorer licenses use Tableau Desktop?
Explorers can create Tableau content on the Tableau server environment to which they have been granted access. They will not be able to publish content from Tableau Desktop. Please work with your Tableau site admin about working with an explorer's license.
We already have desktop licenses. Do those need to be replaced by UNC's or can we import them into UNC's Licensing?
You can continue to use those licenses, when you renew you will need to renew under UNC. You will need to submit a service request to the ITS-Enterprise Reporting and Departmental Systems group in order to do this.
Get Tableau Desktop and Site
To get Tableau desktop, you have 2 options:
- You can download Tableau Desktop from the Tableau site
- You need to be within 2 '.' version of the current Tableau server. You can see which version we are on by signing into UNC Tableau site, clicking the "?" and "about Tableau server"
- You can use Tableau Desktop through UNC Apps. In the Apps, there is a Tableau Desktop. Launch and input your license key.
To get a Tableau site, submit a service request via Enterprise Reporting Services, select Tableau Help for 'What do you need help with?' drop-down.
Tableau Site Administration
Tableau site administrators are responsible for the main infrastructure and functions of their Tableau sites. They control permissions, folder creation, and can help with troubleshooting.
Your site's environment?
If you have not already requested a Tableau site, see Get Tableau Desktop and Site to request one. Once the site is created, the site admin will have a site and 3 initial grouper groups created (site admin, explorer, viewer).
Organize your content
How you organize your content is up to you, but keep in mind that if there is content you only want certain users to see, then you may want to create a Top-Level project specifically for the content you want those users to see and set permissions accordingly.
You can organize projects based on user, subject area, department, etc.
How do I create Projects in Tableau?
Think of projects as folders and create as many Top-level projects as necessary by function and/or purpose.
If, for example, you have 3 top-level Projects: Project A, Project B, and Project C, and you only want certain users to access Project A, another set of users to access Project B, and a third group of users to access only Project C, then your best bet is to create appropriate Grouper (or AD) groups for each one of these subsets of users.
The article Managing Groups With Grouper will provide additional information on how to request Grouper groups & how to add/remove users from Grouper Groups.
Can data sources in the system live beside the project, not inside the project?
Yes, they can live outside of projects or in other projects. We recommend you publish the data source separately, in a project that your users will have access to.
Data sources can also be embedded in the workbook (we strongly discourage this).
Tableau Permissions and Groups
Tableau permissions can be maintained in a few different ways. The standard recommendation is via groups (either through Grouper or AD).
Managing Permissions
- Determine how you want to control access to your content. At the Project-level? Sub-project level? Dashboard level?
ITS recommends controlling at the project level and our documentation is based on this assumption.
- Create groups to manage your users
- ITS recommends managing groups through Grouper due to its simple interface.
- However, if you are familiar with managing groups via Active Directory, or have groups already available in AD, then you can this as well.
We do not recommend or support managing local groups in Tableau.
- Tableau also offers local groups. This can be an option if a project/dashboard is only for a very few number of people.
Feel free to reach out with questions regarding which option to choose.
Request Tableau Grouper Groups
To get a Grouper group created, follow these steps:
- Submit a Request for Enterprise Reporting Services.
- From the What do you need help with? drop-down, choose Tableau Help.
- From the Tableau Help drop-down, choose Grouper Group.
- In the Additional Information text box, provide the following:
- Group Name
- Tableau Site
- Tableau Site admin name
Managing Group Math Groups
Most Tableau groups will use Group Math, this provides Site Admins with an automated way to handle users that leave the university or change departments. If you specifically requested a non-group math group, then follow the steps in the "Managing Non Group Math Groups" section of this article.
1) Log into Grouper
2) Find your group by typing the name in the search box or by clicking on “My Groups”

3) Click on "Allow Sources"

4) Click on “Add Members”

5) Type the Onyen or name of the user you want to add and click the “Add” button.

Your user is now a member of this group.

Managing Non-Group Math Groups
1) Log into Grouper:
2) Find your group by typing the name in the search box or by clicking on “My Groups”

3) Click on “Add Members”

4) Type the Onyen or name of the user you want to add and click the “Add” button.

Your user is now a member of this group.

Remove Members
Follow steps 1 and 2 above to find your group.
Find your user by typing their name or Onyen in the “Member Name” textbox and clicking Apply Filter. Or you can find the name manually on the list.
Select “Revoke Membership” from the actions menu

Any changes you make in Grouper will be visible in Tableau in approximately one hour.
Adding Grouper or AD Groups to Tableau
1) Log into Grouper and go to "My Groups" on the Quick Links section.

2) Find the group you want to import into Tableau, Click on "More".

3) Find the ID.

4) Log in to Tableau and click on "Groups".

5) Click on "Add Groups", then "Active Directory Group"

6) Type the ID from Step 3. Click on the group's long name. If you get no results, try typing the first few letters of the ID.

7) Select the appropriate Site Role.
Note: Do not choose Creators as this will use up Creator licenses that may or may not belong to your team. Please send a Request to the Enterprise Reporting team if you have any questions about this. Please see
Set Users' Site Roles for more information.

Your group has been imported. You will not be able to manage group membership from Grouper and it will be reflected in Tableau within an hour.
Note: Do Not manage group memberships in Tableau since they will be overwritten during the hourly syncs.
Additional Tableau documentation on creating groups via AD can be found on
Tableau's website.
Permissions Special Topics
Tableau Data Sources
Tableau data sources enable users to connect data to their workbooks and dashboards.
How do I publish data sources?
Publish a Data Source
How do I create extracts?
Extract Your Data
How do I refresh extracts?
Refresh Data on a Schedule
Can you export workbooks/data sources and publish them somewhere else?
Yes, you can download any content you have access to into Tableau Desktop and publish to any other Tableau environment you have permissions to publish in. Keep in mind that you may need to work with your systems group in order to make sure your data sources are accessible by this Non UNC Tableau environment.
What are Data Connectors?
Data Connectors allow you to connect to many different types of data and applications. Tableau keeps an up-to-date list in their own support documents. Some connectors require specific support related to our environment. Some of those are:
Databases:
- To connect to a database, you will need to have a firewall in place in order for Tableau to read the data. Tableau environment, including firewall rules, are available in the Tableau Server Environment section of this article. You can then submit a Service Request for a firewall update. If you have any questions, please submit a service request via Enterprise Reporting Services, select Tableau Help for 'What do you need help with?' drop-down, and the Tableau team will help you work through what is needed
If you are connecting to SQL Server, please use the FQDN instead of the short name. The short name may not work..
SharePoint:
You cannot connect to SharePoint Lists in Tableau via your onyen because of MFA being turned on in the O365 environment. You will need a service account.
To connect:
- Request a service account to use for connecting a data source between Tableau and SharePoint Lists. This can be done through your local IT support or, you can request this via UNC help site by submitting a general service request.
- Once you have the account, you will also need to request the office365 sysadmins to give the account special permissions to authorize the connection.
- You will need to add the service account as a member to the list that you want to publish.
- Finally, once all of the above is completed, you can set up the connection box as follows:
- SharePoint Site: only the URL to the site, not to the list (ie, it will look like adminlive.unc.sharepoint.com/sites/sitename
- Edition: SharePoint Online
- Authentication: Username and password
- username: serviceaccountname.svc@ad.unc.edu
- password: service account password
OneDrive:
You can connect to OneDrive via an individual user account. HOWEVER, you cannot connect to shared drives due to how Microsoft Authentication works. If you would like to be able to share an account, you can request a service account and got through steps 1-4 from the Sharepoint advice above.
Microsoft enforces a 90-day MFA token. This means that if your data source is not edited or directly accessed within 90 days, you have to re-add the authentication in Tableau or your extracts will fail. There are currently 2 ways to update the connection re-establishing:
If you have embedded your own account try:
- Going to the data source, "edit connection" for the data source, choose "Add a OneDrive account." This will log you back in.
If using a service account, you may need to try the following:
- Go to Tableau Online
- Click my picture in the upper right
- Select "My Account Settings"
- Delete saved credentials for that OneDrive service account
- Then, re-establish the connection in Tableau Desktop and re-publish the data source (overwriting)
Tableau Server Environment
If you need to open a new data source to the UNC Tableau Server, you will need to Submit a Firewall request. Select Add/Change for request type.
Tableau object development occurs via the Tableau Desktop application and/or via a web browser. As objects are completed, they are published to the Tableau Server environment. Connectivity to the desired resources must be opened from the Tableau Server IP addresses, as an initial step. The connectivity could be a database run centrally or de-centrally, but can also include network shares for flat file consumption.
Following the notion of least privilege, only request the necessary IP/ports for connectivity that are required. Always use the Address Group specified in the example below for requests.
- NonProd Tableau Servers Address Group: MW-Tableau-Tst
- Prod Tableau Servers Address Group: MW-Tableau-Prd
.
If your database server is running a host based firewall the Tableau Server IP addresses are listed below. You will need to send this information to the Database Administrator if it is configured with a host based firewall.
Tableau non prod servers
- 172.22.207.136
- 172.22.207.139
- 172.22.207.142
Tableau prod servers
- 172.22.207.6
- 172.22.207.5
- 172.22.207.4
If you are connecting to an external database, you will also need to include the following IP in the external allowlist:
- Tableau non prod servers: 152.2.253.119
- Tableau prd servers: 152.2.253.118
Both the Address Group(s) and Destination DB(s) should have passed recent Qualys scans.