Choose how Atlan connects to Tableau
Compare the four ways Atlan can reach your Tableau environment - direct, direct with IP allowlisting, AWS PrivateLink, and the self-deployed agent.
There are four ways for Atlan to reach your Tableau environment. This page helps you pick the right one in about two minutes - before you touch any credentials or network settings.
Before you start: Two facts you need
Everything below depends on these two answers. Gather them first.
| Fact | How to find it |
|---|---|
| Is it Tableau Cloud or Tableau Server? | Look at the address in your browser when you use Tableau. Ends in online.tableau.com (e.g. prod-useast-a.online.tableau.com) → Tableau Cloud. Your own company domain (e.g. tableau.example-corp.com) → Tableau Server, run by your own team. |
| Can that address be reached from the internet? | Tableau Cloud: yes, always (though your admin may have turned on an IP allowlist that restricts who). Tableau Server: ask whoever runs it - is it public, behind a firewall/VPN, or reachable only inside your network? Their answer decides your method below. |
Compare four methods
| Direct (public) | Direct + IP allowlist | AWS PrivateLink | Self-deployed agent | |
|---|---|---|---|---|
| Works with | Tableau Cloud, or a Tableau Server that is publicly reachable | Tableau Cloud with IP restrictions on, or a Server behind a firewall that can open a hole | Tableau Server running on AWS EC2 | Any Tableau Server, including fully on-premises |
| Traffic path | Public internet, HTTPS-encrypted | Public internet, HTTPS, but only from Atlan's fixed outbound IPs | Never leaves AWS's private network | Extraction runs inside your own network; only results go to Atlan |
| Who is involved | You + Tableau admin | You + Tableau admin + your network team + Atlan support (for the IPs) | You + your cloud team + Atlan support | Your infrastructure team |
| Typical setup time | Under an hour | Hours–days (one support ticket + one firewall change) | 2–5 business days | Days to weeks |
| Start here | Cloud guide · Server guide | Allowlist guide | Special cases | Self-deployed runtime docs |
The Docker-based "offline extraction" mode for on-premises Tableau was deprecated on June 30, 2026 and is no longer supported (see Set up on-premises Tableau access). If you used it, migrate to the self-deployed agent.
Which method to pick
- Tableau Cloud, no IP restrictions → Direct. Nothing network-side to do at all; go straight to the Cloud guide.
- Tableau Cloud with an IP allowlist turned on → Direct + allowlist. One support ticket gets you your tenant's outbound IPs; your Tableau admin adds them. See Allowlists, firewalls & WAFs.
- Tableau Server reachable from the internet → Direct. If it sits behind a firewall or WAF, also do the allowlist step. Have an SSL certificate question ready - it's the #2 cause of failed Server connections (see the Server guide).
- Tableau Server on AWS, not publicly reachable → AWS PrivateLink. Your cloud team builds a private "front door"; see Special cases.
- Tableau Server on-premises, no inbound access possible → Self-deployed agent.
Create the connection with a dedicated Tableau service account (with the Site Administrator Explorer role), never a person's own login. When that person changes their password, loses the role, or leaves the company, the connection breaks.
See also
- How Atlan connects to Tableau: The 5-minute explainer - the two Tableau APIs, what a PAT is, and the traffic path. Read this if "Metadata API" or "certificate chain" are new terms.
- Atlan Network Details: How to get your tenant's outbound IPs and what to ask support for - all in one ticket.
- Connect Tableau Cloud: Four phases, each labeled with who performs it and how long it takes.
- Connect Tableau Server: Adds the two Server-only steps: enabling the Metadata API and getting SSL certificates right.