## Special cases

URL: https://docs.atlan.com/apps/connectors/business-intelligence/tableau/how-tos/special-cases

> Tableau special cases - AWS PrivateLink, fully on-premises servers, Server-to-Cloud migrations, multiple sites, and org changes that quietly break connections.

Private networks, on-premises servers, Server→Cloud migrations, multiple sites, and the org changes that quietly break connections.

## Tableau Server on AWS - PrivateLink

If your Tableau Server runs on an AWS EC2 instance that isn't publicly reachable, your cloud team can expose it to Atlan privately - traffic never crosses the internet. Summarized from [Set up a private network link to Tableau Server](https://docs.atlan.com/llms/connectors/tableau/set-up-a-private-network-link-to-tableau-server/llms.txt):

| Step | What happens | Owner |
|---|---|---|
| 1. Prep | Confirm Atlan is hosted in the **same AWS region** as Tableau; get Atlan's AWS account ID from support | Atlan User + Atlan support |
| 2. Security group | Open the Tableau EC2 instance's port (80, or 443 for TLS) to the subnet CIDR | Your network team |
| 3. Internal NLB | Create an internal Network Load Balancer + target group pointing at the Tableau instance; confirm the target shows **healthy** | Your network team |
| 4. Endpoint service | Create a VPC endpoint service on the NLB with **"Acceptance required"** on; copy its service name | Your network team |
| 5. Allow Atlan | Add Atlan's AWS account ID under **Allow principals** | Your network team |
| 6. Handshake | Send support the service name, Tableau port, and private DNS name (if using SSL); Atlan creates its endpoint; you **accept the pending connection request** | Atlan support + Your network team |

:::caution The three PrivateLink gotchas

- **NLB security policy** - the load balancer (not just the EC2 instance) must accept traffic from the endpoint; a missing inbound rule produces "Unable to connect to tableau instance. Please verify server port…".
- **Port truth** - check what port Tableau actually listens on. Don't assume 443 when the server listens only on 80.
- **Nothing accepts itself** - with "Acceptance required" on, someone must click **Accept endpoint connection request**. Until then, connections time out.

:::

Tableau Server on Azure or GCP private networks: no equivalent published guide exists today - [raise a support ticket](https://docs.atlan.com/support/submit-request) to discuss options (typically the self-deployed agent, or a reverse proxy with IP allowlisting).

## Fully on-premises Tableau Server

If no inbound path can be opened at all, use the [self-deployed agent](https://docs.atlan.com/llms/platform/self-deployed-runtime/llms.txt): a component you run inside your network that reaches Tableau locally and ships only extracted metadata to Atlan. The old Docker "offline extraction" tool **was deprecated on 2026-06-30** - don't start new setups on it. An intermediate option some customers use: a reverse proxy in a DMZ that only forwards Atlan's NAT IPs to the internal server.

## Migrating Tableau Server → Tableau Cloud

Your host, site name, and credentials all change, so treat it as a **new connection**: set up Tableau Cloud alongside the old connection, verify a full crawl, then decommission the Server connection. Asset history/enrichment carry-over is a catalog operation ([asset export/import](https://docs.atlan.com/llms/connectors/tableau/migrate-tableau-asset-enrichments/llms.txt)), not a connectivity setting - ask support to plan it *before* the migration, not after.

## Multiple sites and multiple connections

- One Atlan connection crawls **one site**. Several sites → several connections.
- Give each connection **its own PAT** (the one-session rule again) - one shared PAT across site connections causes each scheduled run to knock out the previous one.
- Stagger schedules if the connections hit the same Tableau Server, to avoid Metadata API contention on large estates.

## Org changes that quietly break connections

| Event | What breaks | Prevention |
|---|---|---|
| The person who created the PAT leaves | Their account is disabled → PAT dies → all crawls fail with 401 | Service account from day one; rotate PATs on departure |
| Tableau Server upgraded (quarterly release) | Metadata API re-indexes ("backfill") for hours–days; behavior of lineage queries can change | Expect `BACKFILL-RUNNING` after upgrades; re-run **Test Authentication** + preflight after every upgrade |
| Certificate renewed / load balancer changed | SSL verification fails on the next run | Add Atlan to the cert-rotation runbook ([Server guide Phase 4](https://docs.atlan.com/llms/connectors/tableau/connect-tableau-server/llms.txt)) |
| Service account demoted below Site Administrator Explorer | Crawls still "succeed" but silently lose field-level metadata | Watch preflight warnings; keep the role pinned |

---