My previous post shared one recommended setup to segment all external users to one Limited Visibility site that is a great balance between security and on-going maintenance.
For some organizations that do not allow mixed internal and external users in one Tableau server at all, there is option to setup dedicated External Server:
Two separated Tableau servers: Internal and External
You can have both External Site and External Server solutions if your org has different type of external users.
My setup has the External Server sitting outside company firewall in DMZ zone. For additional security considerations, we even did not open any network connectivity from External Server to any internal database. The External Server is more like an island. Extracts and workbooks can only be pushed to External Server via API on behalf of publishers.
Here is how it works:
- Workbook is published to specific project on your internal Tableau server
- Extract refresh happens on your internal Tableau server only
- Updated workbook and/or extracts are published to External Server via API only
- There is no Creator or Explorer (can publish) site role on External Server site
- No extract refresh schedule either on External Server
Notes:
- This setup has the maximum security and it comes with on-going extract works for content owners.
- Since API is not good enough for users/groups and permissions, there are some admin work to set permission correctly on External Server