Row level Security in Tableau

In this tutorial, I'll explain row-level security in Tableau using the "Sample - Superstore" dataset, which is included with Tableau. Row-level security allows you to control data access for different users or groups within your organization. We'll cover four examples of row-level security using this dataset.

Example 1: Restricting Data by Region

Suppose you want to restrict data access based on the region assigned to each user. Users should only see data for their designated region.

Step 1: Data Preparation

Ensure your dataset includes a field that represents the region for each order, such as "Region."

Step 2: Create User Groups

In your Tableau Server or Tableau Online, create user groups corresponding to different regions (e.g., "West," "East," "Central," "South").

Step 3: Define Data Roles

Go to "Data" in the top menu and select "Data Roles."

Create a new data role, e.g., "Region Access."

Assign the data role to the relevant user groups (e.g., "West" group).

Define a filter condition in the data role by selecting "Region" and adding a condition like [Region] = USERGROUP().

Step 4: Apply Data Roles to Worksheets

In your Tableau workbook, apply the "Region Access" data role to the worksheets containing regional data. When a user from the "West" group logs in, they will only see data for the "West" region.

Example 2: Dynamic Row-Level Security with Parameters

Let's expand on the previous example by allowing users to choose a specific region using a parameter.

Step 1: Create a Parameter

Create a parameter named "Select Region" that allows users to choose a region.

Set the parameter data type to match the "Region" field in your dataset.

Step 2: Modify Data Roles

In the data role definition ("Region Access"), modify the filter condition to use the parameter value. For example, [Region] = [Select Region].

Step 3: Apply Data Roles with Parameters

In your worksheets, apply the "Region Access" data role with parameters. Users can choose a region from a parameter control, and the data displayed will be filtered accordingly.

Example 3: Manager-Subordinate Hierarchy

Imagine you have an organizational hierarchy in your company, and you want managers to access data for their team and subordinates.

Step 1: Data Preparation

Include a field in your dataset that represents the manager-subordinate relationship, such as "Manager ID."

Step 2: Create User Groups

Create user groups in Tableau corresponding to different managers or team leads.

Step 3: Define Data Roles

Create a data role, e.g., "Hierarchy Access."

Assign the data role to the relevant user groups (e.g., "Manager A" group).

Define a filter condition in the data role by selecting "Manager ID" and adding a condition like [Manager ID] = USERID() OR [Employee ID] = USERID().

Step 4: Apply Data Roles Hierarchically

In your worksheets, apply the "Hierarchy Access" data role. Managers will see data for their team and subordinates.

Example 4: Custom Row-Level Security with Database Integration

Suppose you want to integrate Tableau's row-level security with your database's security mechanisms.

Step 1: Database Integration

Integrate Tableau with your database's security features, such as database roles, views, or stored procedures that apply row-level security rules.

Step 2: Create User Groups

Create user groups in Tableau that align with the database security roles.

Step 3: Define Data Roles

Create a data role, e.g., "Custom Security."

Assign the data role to the relevant user groups.

In your database, implement the necessary logic to restrict data access based on the user's role or permissions.

Step 4: Apply Data Roles

In your Tableau worksheets, apply the "Custom Security" data role. Tableau will pass the user's credentials to the database, and the database will enforce row-level security based on the user's role.

By following these four examples using the "Sample - Superstore" dataset, you can understand how to implement row-level security in Tableau for various scenarios. Row-level security is a powerful feature that ensures data access control and protection while allowing users to view only the relevant information based on their roles or parameters.