Tableau Security Model

Projects and Groups

Projects and groups associated to those projects are another way that access and security on the Tableau published content will be controlled.

Submit an ITS Service Center request to have a new Tableau Project or Group created or updated. The BI team will review all requests to ensure that naming standards are being used and no project is named in a way that will confuse who owns it, or what its content holds.

MCommunity groups can be used as the source of the initial load to an Active Directory group and then to a Tableau group.

For additional information on security and permissions, please see the following documentation.

Data Governance

University standard practices related to data and information security also apply to Tableau data visualizations.

• Data Sources
  ERP data sources (Financial, eResearch, Planview, etc.): same security applies
• Accountability
  Each publisher needs to share the content that they publish with the appropriate audience(s). It is the publisher’s responsibility to determine the scope of visibility to the data visualization and to whether to the underlying data is visible.
• Access and Compliance
  All users of Tableau Web server content will be prompted to read and comply with the university Information Security Policy (SPG 601.27)
• HIPAA
  Tableau server is HIPAA compliant. This means that the server has been configured in such a way as to fulfill the requirements of HIPAA; however, you must publish to a site specifically configured for HIPAA (the default site 'UM' is NOT configured for HIPAA). In addition, HIPAA compliance relies on the data governance of the report creator. It is recommended to hide unnecessary data in data extracts, turn off command buttons on all tooltips and restrict both data downloading and workbook downloading. If there are questions about publishing HIPAA data to the Tableau server please contact the Tableau team by submitting a ticket to the ITS Service Center.