Tableau

Applies to: Tableau Cloud, Tableau Server (version 2022.3 or later)

Connect your Tableau Server or Tableau Cloud environment to Datalogz Control Tower.

How authentication works

Datalogz authenticates to Tableau with a direct-trust connected app, Tableau's recommended long-lived authentication method. You provide an administrative Personal Access Token (PAT), and Control Tower creates and configures the connected app for you on each site you select.

The setup wizard lets you choose, per site, between a connected app and a PAT. A connected app is the recommended option.

What you'll need

• An administrative Personal Access Token (PAT):

  • For a single site, a Site Administrator PAT for that site (for example, Site Administrator Creator on Tableau Cloud).

  • For multiple sites on a Tableau Server, a Server Administrator PAT, which lets Control Tower list every site. A Site Administrator PAT covers the single site you sign in to.

• Your Tableau host URL (for example, https://10ax.online.tableau.com for Cloud, or https://tableau.acme.internal for Server).

• The site name, which is the URL slug after /site/ (for example, acme-prod). Tableau Cloud requires it. For Tableau Server, leave it blank to use the default site.

Control Tower detects your Tableau REST API version automatically.

Step 1: Create an administrative PAT in Tableau

1. In Tableau, open My Account Settings.

2. Under Personal Access Tokens, enter a token name (for example, datalogz-pat) and click Create Token.

3. Copy the token name and the secret. Tableau shows the secret only once.

Assign the token to a user with the right role: Site Administrator for a single site, or Server Administrator to connect multiple sites on a Server.

Step 2: Add the connector in Control Tower

1. Go to Settings → BI Connectors and click New Connector.

2. On Select a BI platform, choose Tableau.

3. On Authenticate and connect, fill in the credential card:

   • Host: your Tableau URL (a Cloud or Server badge appears as you type).

   • Site: the site URL slug (required for Cloud, blank for the default Server site).

   • Token: your PAT name from Step 1.

   • Secret: your PAT secret from Step 1.

4. Click Test Connection. Control Tower signs in, detects the API version, and lists the site(s) it can see.

5. In the site table, select the site(s) you want to connect. For each selected site, use the "Use" dropdown to choose how Datalogz authenticates:

   • Connected App (default, recommended): Control Tower creates a direct-trust connected app and secret on that site and uses it for all future syncs.

   • Personal Access Token: Control Tower keeps using the PAT you entered for that site.

   To connect another host, click + Add another credential set and repeat.

6. Click Continue.

7. On Choose connector components, enter a Connector Name and set the Asset Snapshots schedule (for example, Every Day at 1:00 PM). Click Next.

8. On Finish, review the name and schedule, then click Confirm and Finish.

Step 3: Verify the connected app in Tableau

For any site you connected with Connected App:

1. In Tableau, go to Settings → Connected Apps.

2. Look for a direct-trust app named Datalogz Connector <id>, shown as enabled.

3. Datalogz uses read-only scopes for metadata extraction: tableau:content:read plus related read scopes (users, groups, projects, sites, tasks, and, on newer Tableau versions, databases, tables, permissions, flows, and others). All access is read-only.

Step 4: Revoke the setup PAT (optional)

After the connector completes its first successful sync, the connected app handles authentication on its own for sites set to Connected App. At that point you can delete or revoke the administrative PAT in Tableau.

Revoke the PAT only for sites you set to Connected App. Sites set to Personal Access Token keep using the PAT, so revoking it stops those sites from syncing. Keep the PAT if you might want to re-provision a connected app later.

Notes

• Multiple sites and hosts: A single Tableau connector can cover multiple sites and multiple hosts (via + Add another credential set). You can use Connected App for some sites and Personal Access Token for others.

• Snapshot schedule: Choose daily or weekly, at a time of day you prefer. You can change this later in the connector's settings.