Video |

Tableau | Tool strategy

Assign role on sign in

With grant role on sign in, a licensed user just breezes straight through instead of hitting a denial of access on their first login.

Tim Ngwena •12 August 2020 •1 min read •4 min watch •1.6K

Watch on YouTube

The grant-role-on-sign-in feature arrived in Tableau 2020.3 and requires the user to be a member of a group with the option enabled
Enable it via a group's Details page by ticking 'grant role on sign in' and choosing the role (e.g. viewer or admin)
An unlicensed user can sign in successfully but is denied access until assigned to a configured group; the role is then granted on their next login
This removes the need for an admin to manually change roles through a support-desk process
It works with Active Directory group syncing, so users can be assigned roles automatically on a schedule

0:00Hey, it's Tim here. And in 2020.3 Tableau

0:05have added the ability to have roles

0:07granted

0:08to users when they sign in. Now, in order

0:11to do this, they have to first be part of

0:13a group with this feature enabled. So I'm

0:15going to show you how to do that. You can

0:17see here I have two users on my test

0:19instance of Tableau online. What I'm going

0:21to do is

0:22I'm going to head to groups and you can see

0:23here that I have a new group coincidentally

0:25called new group. And if I click on that

0:27option, you'll see there's no member in the

0:30group

0:30at the moment. If I go to details, you'll

0:33see that I have this option here ticked for

0:35grant role and sign in for viewers. Okay,

0:38so you'll see that when they sign in, it's

0:40going to grant them the role of viewer, you

0:42can actually set this to another group, for

0:44example. So you can say when you add

0:46someone to an admin group, they

0:48automatically get

0:49signed an admin group, which is kind of

0:51useful now because you don't have to wait

0:54to go and

0:54manually change someone's role inside of

0:57Tableau online through a typical sort of

0:59support desk

1:00system. So the other thing I need to do to

1:03show you this feature is show you what

1:04happens

1:04if I try and log in at the moment. If I go

1:07to my users, you'll see here that I just

1:09have

1:09the two users. One is unlicensed at the

1:12moment. Okay, so if I try and log in as

1:14this user,

1:15let's just head over to my other tab here.

1:17I'm in an incognito window. I've already

1:20got

1:20my username and password signed up. If I

1:23try and sign in, it will work. The sign in

1:26will

1:27work, but you will see here that I'm unable

1:29to sign in. This isn't a failure. My

1:31password

1:31isn't correct. I just don't have a license.

1:34And so in order to fix this, we need to go

1:36back and assign me to a group. Now,

1:38previously, the admin would have to assign

1:41me a role.

1:42But all I'm going to do is I'm going to

1:44assign this user to a specific group. So I

1:47'm going

1:47to add them to the new group. I'm going to

1:49hit save. And when I assign them to that,

1:52you'll see that this still says unlicensed.

1:56Okay. But now when I try and log in, this

1:58should change. So let's go back to the

2:00other tab. Let's try again. And we're just

2:03going

2:03to go ahead and type this out. So I'm going

2:08to type in my email. I missed the @ sign

2:12here.

2:13So let's just do that. And I use LastPass

2:15for my password. So I don't have to

2:17remember

2:18every single one of them. So let's just

2:20select the right one there. Sign in. And

2:23this time,

2:25what it's actually doing is assigning me a

2:28role. And then now I'm actually able to go

2:29through and sign in. And the cool thing

2:32here is if I then go back to my other

2:35window and

2:36refresh this page, you'll see that my site

2:38role over here has changed. So let me just

2:40refresh that. And let me highlight that

2:42change right here. So there you go. You can

2:45see I

2:45am now a viewer. So just by being assigned

2:48to the group and logging in, I'm

2:50automatically

2:50assigned a role and I'm able to breeze

2:52right through. And that means my first

2:54experience

2:55isn't some sort of denial of access, if

2:57that makes sense. If I have the rights to

3:00be on

3:00the server and I'm licensed up correctly, I

3:02should just breeze right through. So this

3:05is a really nice feature. It's a really

3:06nice thing to be aware of. If you're an

3:08admin,

3:08it can make your life a little bit easier.

3:10I can see lots of people creating lots of

3:12new groups now for these roles and then

3:14automatically assigning people to these

3:16roles. And of course,

3:17this works with things like Active

3:18Directory. So you can actually sync up

3:20users to Active

3:21Directory groups on a schedule. And then

3:23this can automatically assign them roles.

3:26So when

3:26you have, let's say, a server admin come

3:28into the organization, you add them through

3:31the

3:31necessary request process and they

3:33automatically get assigned a role based on

3:35that group, just

3:36making the life a little bit easier. That's

3:39pretty much the feature in 2020.3. If you

3:41've

3:41enjoyed this video, why not subscribe to

3:43the account? Check out some of the other

3:45features

3:45in this playlist. And by all means, let us

3:47know what kind of content you'd like to see

3:50in the comments below.

3:50Bye.

Rollup

Tableau can automatically grant a user's site role the moment they sign in, provided they're a member of a group configured for it — removing the need for an admin to manually assign roles via a support request.

Demonstrated on Tableau Online with a group set up to grant the viewer role on sign in, and an unlicensed user trying to log in for the first time.

The Breakdown

Create or open a group 0:22

Start from a group (new or existing) that you'll use to control role assignment.
Unlicensed user signs in but is denied access 1:00

A user not yet in a role-granting group can authenticate successfully but still gets denied access — this isn't a login failure, just a missing licence/role.
Add the user to the configured group 1:20

Assign the user to the group with the grant-role-on-sign-in setting. Their site role still shows as unlicensed immediately after this — the role isn't applied until their next sign in.
Role is granted on next sign in 2:01

When the user logs in again, Tableau assigns the configured role automatically and lets them straight through, with no denial-of-access step.
Works with Active Directory syncing 3:00

If you sync users to Active Directory groups on a schedule, this same mechanism can assign roles automatically as people join the relevant group — useful for onboarding, e.g. a new server admin gets the right role as soon as they're added and next sign in.

Worth Knowing

The role isn't applied the instant you add someone to the group — the user's site role still shows unlicensed until they actually sign in again.
This is one option among several ways to manage roles; you could still assign roles manually if you don't want automatic granting for a given group.

Use It When

Reach for this when you're onboarding new users regularly and want their first login to work smoothly instead of hitting an access denial that then requires a manual admin fix.

How this Rollup was made provenance & method

A Rollup is drafted by AI from the video's transcript, then reviewed and edited by Tim. Everything used to produce this one is listed below — the model, the exact prompt, and the source video — so the process is transparent and reproducible.

Transcription: On-device — NVIDIA Parakeet v3 for recent videos, OpenAI Whisper large-v3 for earlier ones. The transcript never leaves the machine or gets published.
Drafting: Claude Sonnet 5 in the cloud, from that transcript.
Prompt: The exact Rollup prompt (v2) — the full system prompt, unedited.
Source video: Watch on YouTube
Drafted: 5 July 2026 at 09:38
Reviewed & edited: 5 July 2026 at 09:41 · by Tim Ngwena

Model + prompt + video is everything you'd need to recreate a Rollup like this yourself. The one thing we don't share is the transcript.

Rights. The video and its transcript are the property of TN Media Ltd. Unauthorised use or download is prohibited. © TN Media Ltd.