## Choose how Atlan connects to Tableau

URL: https://docs.atlan.com/apps/connectors/business-intelligence/tableau/how-tos/choose-how-atlan-connects-to-tableau

> Compare the four ways Atlan can reach your Tableau environment - direct, direct with IP allowlisting, AWS PrivateLink, and the self-deployed agent.

There are four ways for Atlan to reach your Tableau environment. This page helps you pick the right one in about two minutes - before you touch any credentials or network settings.

## Before you start: Two facts you need

Everything below depends on these two answers. Gather them first.

| Fact | How to find it |
|---|---|
| **Is it Tableau Cloud or Tableau Server?** | Look at the address in your browser when you use Tableau. Ends in `online.tableau.com` (e.g. `prod-useast-a.online.tableau.com`) → **Tableau Cloud**. Your own company domain (e.g. `tableau.example-corp.com`) → **Tableau Server**, run by your own team. |
| **Can that address be reached from the internet?** | Tableau Cloud: yes, always (though your admin may have turned on an *IP allowlist* that restricts who). Tableau Server: ask whoever runs it - is it public, behind a firewall/VPN, or reachable only inside your network? Their answer decides your method below. |

## Compare four methods

| | Direct (public) | Direct + IP allowlist | AWS PrivateLink | Self-deployed agent |
|---|---|---|---|---|
| **Works with** | Tableau Cloud, or a Tableau Server that is publicly reachable | Tableau Cloud with IP restrictions on, or a Server behind a firewall that can open a hole | Tableau Server running on AWS EC2 | Any Tableau Server, including fully on-premises |
| **Traffic path** | Public internet, HTTPS-encrypted | Public internet, HTTPS, but only from Atlan's fixed outbound IPs | Never leaves AWS's private network | Extraction runs inside your own network; only results go to Atlan |
| **Who is involved** | You + Tableau admin | You + Tableau admin + your network team + Atlan support (for the IPs) | You + your cloud team + Atlan support | Your infrastructure team |
| **Typical setup time** | Under an hour | Hours–days (one support ticket + one firewall change) | 2–5 business days | Days to weeks |
| **Start here** | [Cloud guide](https://docs.atlan.com/llms/connectors/tableau/connect-tableau-cloud/llms.txt) · [Server guide](https://docs.atlan.com/llms/connectors/tableau/connect-tableau-server/llms.txt) | [Allowlist guide](https://docs.atlan.com/llms/connectors/tableau/allowlists-firewalls-and-wafs/llms.txt) | [Special cases](https://docs.atlan.com/llms/connectors/tableau/special-cases/llms.txt) | [Self-deployed runtime docs](https://docs.atlan.com/llms/platform/self-deployed-runtime/llms.txt) |

:::caution Offline extraction is gone

The Docker-based "offline extraction" mode for on-premises Tableau **was deprecated on June 30, 2026 and is no longer supported** (see [Set up on-premises Tableau access](https://docs.atlan.com/llms/connectors/tableau/set-up-on-premises-tableau-access/llms.txt)). If you used it, migrate to the self-deployed agent.

:::

## Which method to pick

- **Tableau Cloud, no IP restrictions** → Direct. Nothing network-side to do at all; go straight to the [Cloud guide](https://docs.atlan.com/llms/connectors/tableau/connect-tableau-cloud/llms.txt).
- **Tableau Cloud with an IP allowlist turned on** → Direct + allowlist. One support ticket gets you your tenant's outbound IPs; your Tableau admin adds them. See [Allowlists, firewalls & WAFs](https://docs.atlan.com/llms/connectors/tableau/allowlists-firewalls-and-wafs/llms.txt).
- **Tableau Server reachable from the internet** → Direct. If it sits behind a firewall or WAF, also do the [allowlist step](https://docs.atlan.com/llms/connectors/tableau/allowlists-firewalls-and-wafs/llms.txt). Have an SSL certificate question ready - it's the #2 cause of failed Server connections (see the [Server guide](https://docs.atlan.com/llms/connectors/tableau/connect-tableau-server/llms.txt)).
- **Tableau Server on AWS, not publicly reachable** → AWS PrivateLink. Your cloud team builds a private "front door"; see [Special cases](https://docs.atlan.com/llms/connectors/tableau/special-cases/llms.txt).
- **Tableau Server on-premises, no inbound access possible** → Self-deployed agent.

:::tip Whatever you pick, use a service account

Create the connection with a dedicated Tableau **service account** (with the *Site Administrator Explorer* role), never a person's own login. When that person changes their password, loses the role, or leaves the company, the connection breaks.

:::

## See also

- [How Atlan connects to Tableau](https://docs.atlan.com/llms/connectors/tableau/how-atlan-connects-to-tableau/llms.txt): The 5-minute explainer - the two Tableau APIs, what a PAT is, and the traffic path. Read this if "Metadata API" or "certificate chain" are new terms.
- [Atlan Network Details](https://docs.atlan.com/llms/governance/administration/atlan-network-details/llms.txt): How to get your tenant's outbound IPs and what to ask support for - all in one ticket.
- [Connect Tableau Cloud](https://docs.atlan.com/llms/connectors/tableau/connect-tableau-cloud/llms.txt): Four phases, each labeled with who performs it and how long it takes.
- [Connect Tableau Server](https://docs.atlan.com/llms/connectors/tableau/connect-tableau-server/llms.txt): Adds the two Server-only steps: enabling the Metadata API and getting SSL certificates right.

---