Tableau Enterprise

Tableau RESOLVED Metrics Cascading Permission

Leave a comment

Updated after V2021.3 release that completely resolved Tableau Metrics potential permission cascading issue.

My previous blog Tableau Metrics Deep Dive talked about how Tableau 2020.2 new feature Metrics work. I highlighted its permission potential issue. The good news is that the issue is fixed with v2021.3 release.

  • If your server is v2021.3 or newer, you can rollout Metrics with peace of mind.
  • If your server is v2020.2 – 2021.2, you will have the potential permission cascading issue. Read below for my recommendation. 

What is the Tableau’s solution? The workbook ‘Create/Refresh Metrics’ permission control introduced from 2021.3

If you are using v2020.2 – 2021.2 server,  Metrics can cascade your data permissions and read alone……

screenshot_2637

What is Metrics Permission Cascading Behavior v2020.2 – 2021.2?

  • Potentially Metics can cascade your data to a lot of more users ‘unexpectedly’.

What is the fix or workaround v2020.2 – 2021.2?

  • As data owner or workbook owner, if you are concerned your data cascading to too many audiences w/o your control, you should remove ‘Download Full Data’ permission to your users.

How to access your ‘Download Full Data’ permission situation before turn on Metrics for your server v2020.2 – 2021.2?

  • Please use this workbook ( Download Full Data workbook list_v2018.1 ) to understand the % of workbooks/views have ‘Download Full Data’ permission. Please rename the workbook to .twb before open it from Desktop
  • You may be surprised that most of your workbooks have  ‘Download Full Data’ permission on. My server has 90%+. Why? It is mainly due to the filter was part of the Interactor permission set till v2019.4. Tableau changed it from v2020.1screenshot_2670

What would be the recommendation to chose permission template v2020.2 – 2021.2?

  • Choose ‘View’ by default and add ‘Download Full Data’ permission  for the workbooks that you really want to enable Metrics knowing Metrics cascading permission behavior.

Is there a way to massive delete ‘Download Full Data’ permission for all workbooks before turn on Metrics v2020.2 – 2021.2?

  • Good thought process, That is what we did for our server although Tableau does not have a way to get it done easier. You can write a scripts to call Rest API to do it. Likely more work is to communicate to your publishers as some people are using ‘Download Full Data’ permissions intentionally although most don’t.
  • The communication should be done before deletion and after deletion. Give publishers a list of workbooks & projects permissions changed, and tell them that they can of course change back.

Re-cap: Tableau Metrics is beautiful, simple and easy. The v 2020.2-2021.2 has potential permission cascading behavior that is resolved from 2021.3 release by introducing separate Metrics permission control as it used to use Download Full Data permission to control Metrics creation.

If you use v2020.2-v2021.2, this blog recommends to clean all ‘Download Full Data’ permissions before implement Metrics to have a peace of mind and avoid potential chaos – this is what I did for my implementation. 

screenshot_2672

Leave a Reply