How to Implement RLS in Tableau

Implementing row-level security (RLS) in Tableau lets you show specific, filtered data to different people using the same dashboard. Getting this right is critical for data governance and ensuring your team sees only the information relevant to them. This article will walk you through two effective methods for setting up RLS in Tableau, from a simple, direct approach to a more robust, scalable solution.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

What is Row-Level Security (RLS)?

Row-Level Security is a data governance feature that restricts which rows of data a user is allowed to see in a table based on their identity or role. Think of a national sales dashboard. With RLS, the sales manager for the West Coast logs in and sees only sales data for California, Oregon, and Washington. Their counterpart on the East Coast logs into that exact same dashboard but sees data strictly for New York, Florida, and Massachusetts.

They are both looking at the same workbook, the same charts, and the same metrics. The only difference is the underlying data they're permitted to view, which is filtered automatically and securely behind the scenes.

This is incredibly useful for several reasons:

• Security and Confidentiality: It ensures that sensitive information is only accessible to authorized personnel. You wouldn't want a regional manager seeing the performance reviews or sales numbers of a colleague in another territory.
• Simpler Reporting: Instead of building and maintaining a dozen different dashboard versions for a dozen different teams, you build just one. This dramatically reduces development overhead and ensures consistency across the organization.
• Improved User Experience: RLS declutters the view for your users. A team lead in the marketing department doesn’t need to wade through finance or HR data to find campaign performance metrics. They get a clean, tailored view focused on what matters to them.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Method 1: The Manual User Filter (For Small Teams)

The simplest way to apply RLS is by creating a user filter directly in Tableau Desktop. This method involves manually mapping specific users or groups to the dimension values they're allowed to see.

When to use this method: It’s ideal for situations with a small, static number of users, where you don't expect frequent changes. If you just need to set permissions for a handful of managers, this approach is fast and straightforward.

Step-by-Step Guide to Manual User Filters

1. Connect to Your Data: Open Tableau Desktop and connect to your data source. For this example, let’s assume we're using a simple sales dataset that includes a [Region] column.
2. Create Your Visualization: Build a simple view, like a bar chart showing SUM([Sales]) by [City].
3. Create the User Filter:
4. Map Users to Data Values:
5. Apply the Filter: Tableau automatically creates a new Set in your Data pane called [Region User Filter]. Drag this newly created set from the Sets panel onto the Filters shelf. The data in your view will be filtered immediately based on the user you are currently signed in as in Tableau Desktop.
6. Test Your Filter:
7. Publish to Tableau Server/Cloud: Once you publish the workbook, Tableau automatically applies the filter based on whoever is logged in. There's nothing more you need to do.

While this method is quick, maintaining it becomes a nightmare as your team grows. If a manager's territory changes or a new team member joins, you have to open the workbook in Tableau Desktop, edit the filter, and republish it. For anything beyond a handful of users, you should use the more scalable method below.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Method 2: Using a Master Security Table (The Scalable Approach)

A much more robust and manageable way to implement RLS involves creating a separate "security" or "mapping" table. This table explicitly defines which users can see which data points.

When to use this method: This is the recommended approach for almost all real-world business scenarios. It's scalable, easier to update, and keeps your security logic separate from your Tableau workbooks.

Your setup will involve two data tables:

• Fact Table: Your main data, such as sales transactions, leads, or web traffic. It contains the metric you want to measure and the dimension you want to filter by (e.g., Region).
• Security Table: A simple table that maps users to those dimension values. It needs at least two columns: one for usernames and another for the dimension value.

Example Security Table:

Here’s what a simple security table might look like in a spreadsheet or database:

Notice that 'chandra.patel' is mapped to two regions. This setup grants her access to data from both 'Central' and 'South' regions.

Step-by-Step Guide with a Security Table

1. Prepare and Connect to Data: Make sure your security table is created, whether in an Excel file, a Google Sheet, or a database table. In Tableau Desktop, connect to both your main data source and your new security table.
2. Join or Relate Your Tables:
3. Create the RLS Calculated Field:
4. Apply it as a Data Source Filter:
5. Test and Publish: Just as before, use the Filter as User dropdown to test various users and ensure the logic works as expected. Once you're confident it's secure, publish the data source and any accompanying dashboards to your Tableau Server/Cloud.

The beauty of this method is its manageability. If Chandra gets promoted and needs access to the 'West' region, you simply add a new row to your security table spreadsheet. The next time she opens the dashboard, her permissions are automatically updated without you ever needing to touch the Tableau workbook.

Graphed

Still Building Reports Manually?

Watch how growth teams are getting answers in seconds — not days.

Watch the Demo

Best Practices and Common Mistakes

Implementing RLS is powerful, but a small mistake can compromise your data. Keep these tips in mind:

Best Practices

• Use Groups: Instead of mapping individual usernames, map Tableau Groups (e.g., 'East Coast Managers') in your security table. This is far easier to manage. Simply add or remove users from the group in Tableau, and their permissions update automatically.
• Keep Security Tables Centralized: Have one central, well-managed location for your security mapping tables. Don't let them scatter across various Excel files on personal drives.
• Document Everything: Leave comments in your Tableau calculated fields and notes in your security tables explaining the RLS logic. It helps others (and your future self) understand the setup.
• Test, Test, Test: Always test with user accounts that should have access, user accounts that should have limited access, and accounts that should have no access at all.

Common Pitfalls to Avoid

• Incorrect Joins/Relationships: An INNER JOIN between your data and security tables might accidentally drop data for any regions not defined in your security table. Usually, a relationship or a LEFT JOIN from your fact table to the security table is safer.
• Performance Issues: A very complex RLS calculation on a massive dataset can slow down dashboard loading times. Keep the logic as simple as possible.
• Applying the Filter on a Worksheet: Always apply your calculated RLS filter as a <em>Data Source Filter</em>. Placing it on a worksheet's filter shelf means a user with edit permissions on Tableau Server could potentially remove it.

Final Thoughts

Effectively implementing row-level security is a cornerstone of building a scalable and secure self-service analytics culture with Tableau. While the manual method is quick for simple cases, mastering the security table approach will allow you to confidently manage data access for any audience, no matter how large or complex.

Of course, setting up RLS, managing security tables, and learning the nuances of tools like Tableau require some technical know-how. This is why we created Graphed. We wanted to make powerful data analysis accessible without the steep learning curve. By connecting your tools and using simple, natural language, you can create real-time dashboards and reports in seconds. Handling user permissions and secure data integration happens behind the scenes, so you can focus on getting insights from your data, not on configuring complex security rules.