## Connect Tableau Cloud

URL: https://docs.atlan.com/apps/connectors/business-intelligence/tableau/how-tos/connect-tableau-cloud

> Connect Atlan to Tableau Cloud in four phases - service account and PAT, host and site, IP restrictions if enabled, configure and test.

Four phases from zero to a passing test connection, each labeled with who performs it. Total hands-on time: under an hour if no IP restrictions are in play.

:::note New to the terms?

Read [How Atlan connects to Tableau](https://docs.atlan.com/llms/connectors/tableau/how-atlan-connects-to-tableau/llms.txt) first (5 minutes). It explains PATs, sites, and the two APIs used below.

:::

## Four phases at glance

| Phase | What happens | Owner | Typical time |
|---|---|---|---|
| 1. Service account & PAT | Create a dedicated Tableau user and issue its token | Tableau admin | 15 minutes |
| 2. Identify host & site | Read the two values out of your browser URL | Atlan User | 5 minutes |
| 3. IP restrictions (only if enabled) | Add Atlan's NAT IPs to Tableau Cloud's allowlist | Tableau admin + Atlan support | 1 ticket + 15 minutes |
| 4. Configure & test | Enter values in Atlan, test, run a first crawl | Atlan User | 20 minutes |

## Phase 1 - Create service account and PAT

**Owner:** Tableau admin

1. Create a dedicated Tableau Cloud user for Atlan (e.g. `svc-atlan`) with site role **Site Administrator Explorer**. A lower role connects but silently misses field-level metadata; Atlan's preflight will warn.
2. Sign in *as that user*, go to **My Account Settings → Personal Access Tokens**, and create a token. Record both parts:
 - **Token name** - case-sensitive, must match exactly in Atlan
 - **Token secret** - shown once; copy it immediately

:::danger One PAT per Atlan workflow - no sharing

A PAT supports **one active session at a time**. If two connections (or a colleague's script) sign in with the same PAT, the newer sign-in kills the older session and the running crawl fails mid-run with a 401. Multiple Tableau connections in Atlan → one dedicated PAT each.

:::

:::caution PATs expire on a timer you don't see

Tableau expires a PAT that hasn't been used for **15 consecutive days**, and every PAT has a maximum lifetime (up to 1 year). Put the expiry date in your team calendar the day you create it. Expired PATs are the #1 Tableau connectivity failure - often discovered only after weeks of silently failed scheduled crawls.

:::

## Phase 2 - Identify your host and site name

**Owner:** Atlan User

Open Tableau Cloud in your browser and read the URL:

```
https://prod-useast-a.online.tableau.com/#/site/examplecorp/home
 └──────────── host ────────────┘ └─ site ─┘
```

- **Host**: everything between `https://` and the first `/` - here `prod-useast-a.online.tableau.com`. Enter it **without** `https://`: a pasted scheme breaks the URL Atlan builds and fails authentication with a confusing error.
- **Site**: the segment after `/site/` - here `examplecorp`. It is **case-sensitive**: `ExampleCorp` ≠ `examplecorp`.

## Phase 3 - Only if Tableau Cloud IP restrictions are on

**Owner:** Tableau admin + Atlan support

Tableau Cloud can restrict sign-ins to known IP ranges (**Settings → Authentication**). If your admin has enabled it, Atlan's sign-in is rejected until Atlan's IPs are added:

1. Get your tenant's NAT IPs - see [Atlan Network Details](https://docs.atlan.com/llms/governance/administration/atlan-network-details/llms.txt) (one support ticket).
2. Your Tableau admin adds each IP to the Tableau Cloud allowlist.

Not sure whether restrictions are on? Skip this phase - if Phase 4's test fails with an access/sign-in error while the PAT is confirmed good, come back here.

## Phase 4 - Configure and test in Atlan

**Owner:** Atlan User

1. In Atlan: **New workflow → Tableau Assets**, extraction method **Direct**.
2. Fill in: **Host Name** (from Phase 2), **Port** `443`, **Site** (from Phase 2), **Authentication** → Personal Access Token → name + secret from Phase 1.
3. Leave **SSL** enabled and the **SSL certificate** field **empty** - Tableau Cloud uses publicly trusted certificates. A stale pasted certificate here has caused intermittent failures for Cloud connections.
4. Click **Test Authentication**, then run the preflight checks.

:::danger Save credentials as an Atlan admin - or they silently don't save

Updating a connection's credentials requires an Atlan **Admin** (or Workflow Admin) role. If a non-admin replaces an expired PAT, the UI can appear to accept it while the old token stays in place - and the workflow keeps failing with "invalid PAT". After any credential change, click **Test Authentication** again and confirm it passes *after saving*.

:::

### Success checklist

- **Test Authentication** passes
- All preflight checks pass (REST API version, projects, Metadata API, site role)
- A crawl scoped to one small project completes
- A full crawl completes and lineage appears on a workbook

If any step fails, see [Troubleshooting Tableau connectivity](https://docs.atlan.com/llms/connectors/tableau/troubleshooting-tableau-connectivity/llms.txt).

## Next steps

[Crawl Tableau](https://docs.atlan.com/llms/connectors/tableau/crawl-tableau/llms.txt): Configure and run the crawler to extract metadata from Tableau

---