Lock project permission is a great Tableau server feature. This blog cover the followings:

• What is lock permission
• Why lock permission
• Who can lock/unlock
• How it works for nested project

1. What is Lock Permission?

Locked project permission means that all workbooks and data sources in this project always use the default permission from project level. Permissions for individual workbook or data source can’t be modified anymore by anyone (include publishers).

When a new workbook is published to the locked project, the workbook permission gets the default permission. When a workbook is moved to the locked project, the workbook permission gets the default permission no matter what permissions it had before.

If the project permission is managed by the owner (unlocked), and when it is locked, no matter what permissions each content had before, all content permission will be changed to the same as default from project level.

Project lock/unlock doesn’t change content’s ownership.

When the project changed from locked to unlocked, all workbooks and data source permissions remain the same, then permissions can be changed by owner/project lead/admin.

2. Why Lock Permission?

I am sure that everyone can add a few more use cases. The more common use cases are:

• For more sensitive data – you want to make sure that all content permissions are setup correctly
• To simplify permission process
• Other cases. For example, if you have one project, the workbook permissions are so messed up and you want to re-do it. One way is to lock the permission, so all workbook/data source permissions will be cleaned up with one simple click. Then you can unlock it to make some additional changes from there.
• You can’t undo the permissions when you change from ‘managed by the owner’ to locked. Pls take screenshots before change.

Lock project permission vs managed by the owner:  The key difference is if you want each publisher to change their  workbook permission or not in your project.  When it is locked, those who have publisher site role and publisher permission to your project can still publish, but they can’t change any workbook permission. All the workbook permissions will default from project level permissions you set for workbooks. So all the workbooks within the project will have exactly the same permission. If you change workbook permissions at project level, it will be applied automatically to all the workbooks/data sources in the project.

3. Who Can Lock/Unlock

Only project owner or project leader or admin can lock and unlock the project permission.

4. How It Works for Nested Project

Tableau’s first release for nested project is 10.5. I anticipate more nested project features are coming in future releases. Here is how it works for nested project as of V10.5:

• Only top parent project can be locked
• If parent is unlocked, child can’t be locked
• For locked project:
  • All child projects are locked
  • All child projects have same permissions as parent project has.
  • All permission changes apply to all child projects automatically
  • Child projects can still have different owner
  • Child projects can’t have different project leaders

One big feature gap is that child project can’t be locked when parent project is unlocked. Please vote for this feature IDEA @ https://community.tableau.com/ideas/8455

Learn more? Download Understanding Tableau Server Permission Slides and watch  webinar recordings(from 11:30 mins).