Special cases
Tableau special cases - AWS PrivateLink, fully on-premises servers, Server-to-Cloud migrations, multiple sites, and org changes that quietly break connections.
Private networks, on-premises servers, Server→Cloud migrations, multiple sites, and the org changes that quietly break connections.
Tableau Server on AWS - PrivateLink
If your Tableau Server runs on an AWS EC2 instance that isn't publicly reachable, your cloud team can expose it to Atlan privately - traffic never crosses the internet. Summarized from Set up a private network link to Tableau Server:
| Step | What happens | Owner |
|---|---|---|
| 1. Prep | Confirm Atlan is hosted in the same AWS region as Tableau; get Atlan's AWS account ID from support | Atlan User + Atlan support |
| 2. Security group | Open the Tableau EC2 instance's port (80, or 443 for TLS) to the subnet CIDR | Your network team |
| 3. Internal NLB | Create an internal Network Load Balancer + target group pointing at the Tableau instance; confirm the target shows healthy | Your network team |
| 4. Endpoint service | Create a VPC endpoint service on the NLB with "Acceptance required" on; copy its service name | Your network team |
| 5. Allow Atlan | Add Atlan's AWS account ID under Allow principals | Your network team |
| 6. Handshake | Send support the service name, Tableau port, and private DNS name (if using SSL); Atlan creates its endpoint; you accept the pending connection request | Atlan support + Your network team |
- NLB security policy - the load balancer (not just the EC2 instance) must accept traffic from the endpoint; a missing inbound rule produces "Unable to connect to tableau instance. Please verify server port…".
- Port truth - check what port Tableau actually listens on. Don't assume 443 when the server listens only on 80.
- Nothing accepts itself - with "Acceptance required" on, someone must click Accept endpoint connection request. Until then, connections time out.
Tableau Server on Azure or GCP private networks: no equivalent published guide exists today - raise a support ticket to discuss options (typically the self-deployed agent, or a reverse proxy with IP allowlisting).
Fully on-premises Tableau Server
If no inbound path can be opened at all, use the self-deployed agent: a component you run inside your network that reaches Tableau locally and ships only extracted metadata to Atlan. The old Docker "offline extraction" tool was deprecated on 2026-06-30 - don't start new setups on it. An intermediate option some customers use: a reverse proxy in a DMZ that only forwards Atlan's NAT IPs to the internal server.
Migrating Tableau Server → Tableau Cloud
Your host, site name, and credentials all change, so treat it as a new connection: set up Tableau Cloud alongside the old connection, verify a full crawl, then decommission the Server connection. Asset history/enrichment carry-over is a catalog operation (asset export/import), not a connectivity setting - ask support to plan it before the migration, not after.
Multiple sites and multiple connections
- One Atlan connection crawls one site. Several sites → several connections.
- Give each connection its own PAT (the one-session rule again) - one shared PAT across site connections causes each scheduled run to knock out the previous one.
- Stagger schedules if the connections hit the same Tableau Server, to avoid Metadata API contention on large estates.
Org changes that quietly break connections
| Event | What breaks | Prevention |
|---|---|---|
| The person who created the PAT leaves | Their account is disabled → PAT dies → all crawls fail with 401 | Service account from day one; rotate PATs on departure |
| Tableau Server upgraded (quarterly release) | Metadata API re-indexes ("backfill") for hours–days; behavior of lineage queries can change | Expect BACKFILL-RUNNING after upgrades; re-run Test Authentication + preflight after every upgrade |
| Certificate renewed / load balancer changed | SSL verification fails on the next run | Add Atlan to the cert-rotation runbook (Server guide Phase 4) |
| Service account demoted below Site Administrator Explorer | Crawls still "succeed" but silently lose field-level metadata | Watch preflight warnings; keep the role pinned |