Skip to main content

Connect Tableau Cloud

TL;DR

Connect Atlan to Tableau Cloud in four phases - service account and PAT, host and site, IP restrictions if enabled, configure and test.

Connect

Four phases from zero to a passing test connection, each labeled with who performs it. Total hands-on time: under an hour if no IP restrictions are in play.

New to the terms?

Read How Atlan connects to Tableau first (5 minutes). It explains PATs, sites, and the two APIs used below.

Four phases at glance​

PhaseWhat happensOwnerTypical time
1. Service account & PATCreate a dedicated Tableau user and issue its tokenTableau admin15 minutes
2. Identify host & siteRead the two values out of your browser URLAtlan User5 minutes
3. IP restrictions (only if enabled)Add Atlan's NAT IPs to Tableau Cloud's allowlistTableau admin + Atlan support1 ticket + 15 minutes
4. Configure & testEnter values in Atlan, test, run a first crawlAtlan User20 minutes

Phase 1 - Create service account and PAT​

Owner: Tableau admin

  1. Create a dedicated Tableau Cloud user for Atlan (e.g. svc-atlan) with site role Site Administrator Explorer. A lower role connects but silently misses field-level metadata; Atlan's preflight will warn.
  2. Sign in as that user, go to My Account Settings → Personal Access Tokens, and create a token. Record both parts:
    • Token name - case-sensitive, must match exactly in Atlan
    • Token secret - shown once; copy it immediately
One PAT per Atlan workflow - no sharing

A PAT supports one active session at a time. If two connections (or a colleague's script) sign in with the same PAT, the newer sign-in kills the older session and the running crawl fails mid-run with a 401. Multiple Tableau connections in Atlan → one dedicated PAT each.

PATs expire on a timer you don't see

Tableau expires a PAT that hasn't been used for 15 consecutive days, and every PAT has a maximum lifetime (up to 1 year). Put the expiry date in your team calendar the day you create it. Expired PATs are the #1 Tableau connectivity failure - often discovered only after weeks of silently failed scheduled crawls.

Phase 2 - Identify your host and site name​

Owner: Atlan User

Open Tableau Cloud in your browser and read the URL:

https://prod-useast-a.online.tableau.com/#/site/examplecorp/home
        └──────────── host ────────────┘        └─ site ─┘
  • Host: everything between https:// and the first / - here prod-useast-a.online.tableau.com. Enter it without https://: a pasted scheme breaks the URL Atlan builds and fails authentication with a confusing error.
  • Site: the segment after /site/ - here examplecorp. It is case-sensitive: ExampleCorp ≠ examplecorp.

Phase 3 - Only if Tableau Cloud IP restrictions are on​

Owner: Tableau admin + Atlan support

Tableau Cloud can restrict sign-ins to known IP ranges (Settings → Authentication). If your admin has enabled it, Atlan's sign-in is rejected until Atlan's IPs are added:

  1. Get your tenant's NAT IPs - see Atlan Network Details (one support ticket).
  2. Your Tableau admin adds each IP to the Tableau Cloud allowlist.

Not sure whether restrictions are on? Skip this phase - if Phase 4's test fails with an access/sign-in error while the PAT is confirmed good, come back here.

Phase 4 - Configure and test in Atlan​

Owner: Atlan User

  1. In Atlan: New workflow → Tableau Assets, extraction method Direct.
  2. Fill in: Host Name (from Phase 2), Port 443, Site (from Phase 2), Authentication → Personal Access Token → name + secret from Phase 1.
  3. Leave SSL enabled and the SSL certificate field empty - Tableau Cloud uses publicly trusted certificates. A stale pasted certificate here has caused intermittent failures for Cloud connections.
  4. Click Test Authentication, then run the preflight checks.
Save credentials as an Atlan admin - or they silently don't save

Updating a connection's credentials requires an Atlan Admin (or Workflow Admin) role. If a non-admin replaces an expired PAT, the UI can appear to accept it while the old token stays in place - and the workflow keeps failing with "invalid PAT". After any credential change, click Test Authentication again and confirm it passes after saving.

Success checklist​

  • Test Authentication passes
  • All preflight checks pass (REST API version, projects, Metadata API, site role)
  • A crawl scoped to one small project completes
  • A full crawl completes and lineage appears on a workbook

If any step fails, see Troubleshooting Tableau connectivity.

Next steps​

Crawl Tableau: Configure and run the crawler to extract metadata from Tableau