Configure SCIM with Microsoft Entra ID


You can configure user management through Microsoft Entra ID (also known as Azure Active Directory (AD)), provision groups, and assign Tableau Cloud site roles.

While you complete the following steps, it will help to have the Entra ID documentation at hand. See the tutorial, Configure Tableau Cloud for automatic user provisioning(Link opens in a new window).

Note: If you have already enabled provisioning for your application and would like to update to use the Tableau SCIM 2.0 endpoint, see the Microsoft article Update a Tableau Cloud application(Link opens in a new window). If you are setting up provisioning for a new instance of the Tableau Cloud application, follow the steps below.

Step 1: Perform prerequisites

The SCIM functionality requires that you configure your site to support SAML single sign-on (SSO).

  1. Complete the section "Add Tableau Cloud to your Microsoft Entra ID applications" in Configure SAML with Microsoft Entra ID.

  2. After adding Tableau Cloud from the Azure Marketplace, remain signed in to both the Entra portal and Tableau Cloud, with the following pages displayed:

    • In Tableau Cloud, the Settings > Authentication page.
    • In the Entra portal, the Tableau Cloud application > Provisioning page.

Step 2: Enable SCIM support

Use the following steps to enable SCIM support with Microsoft Entra ID. See also Notes and limitations for SCIM support with Azure Active Directory section below.

Note: For the steps in the Entra portal, make sure you're using Tableau Cloud app from the gallery.

  1. Sign in to your Tableau Cloud site as a site administrator, and select Settings > Authentication.

  2. Do the following:

    1. On the Authentication page, under Automatic Provisioning and Group Synchronization (SCIM), select the Enable SCIM check box.

      This populates the Base URL and Secret boxes with values you will use in the IdP’s SCIM configuration.

      Important: The secret token is displayed only immediately after it is generated. If you lose it before you can apply it to your IdP, you can select Generate New Secret. In addition, the secret token is tied to the Tableau Cloud user account of the site administrator who enables SCIM support. If that user’s site role changes or the user is removed from the site, the secret token becomes invalid, and another site administrator must generate a new secret token and apply it to your IdP.

    2. Under Authentication for SCIM, select the SAML authentication configuration to associate with SCIM.

      Note: Only one SAML authentication configuration can support SCIM on a site.

  3. Copy the secret token value, and on the Provisioning page in your Entra portal, do the following:

    • For Provisioning Mode, select Automatic.

    • For Authentication Method, select Bearer Authentication.

    • For Tenant URL, copy and paste the Base URL shown in the Tableau Cloud SCIM settings.

    • For Secret Token, paste the Tableau Cloud SCIM secret token you copied earlier.

    A configuration screen with settings to provision Tableau Cloud.

  4. Click the Test Connection button to verify the credentials are working as expected, and then click Save.

  5. In the Mappings section, verify that Provision Microsoft Entra ID Groups and Provision Microsoft Entra ID Users are enabled.

    A settings page to define how data should flow between Microsoft Entra ID and Tableau Cloud SCIM.

  6. Select Provision Microsoft Entra ID Groups, and on the Attribute Mappings page, review the attributes synchronized from Entra ID to Tableau Cloud. To save any changes, click Save.

    Tableau Cloud SCIM attribute mappings to Microsoft Entra ID attribute.

  7. Select Provision Microsoft Entra ID Users, and on the Attribute Mapping page, review the attributes synchronized from Entra ID to Tableau Cloud. To save any changes, click Save.

    A table to show the attribute mappings that define synchronization.

Step 3: Assign groups to the Tableau Cloud app

Use the following steps to assign groups to the Tableau Cloud gallery app in Microsoft Entra ID.

  1. From the application page, select Enterprise Apps > Users and groups.

  2. Click Add user/group.

  3. On the Add Assignment page, select a group and assign one of the following site roles:

    • Creator

    • SiteAdministratorCreator

    • Explorer

    • SiteAdministratorExplorer

    • ExplorerCanPublish

    • Viewer

    • Unlicensed

    Note: You'll receive an error if you select a role that is not in the above list. For more information about site roles, see Set Users’ Site Roles.

  4. Click Assign.

Create groups for site roles

A user can be a member of multiple groups in Entra ID , but they will only receive the most permissive site role in Tableau Cloud. For example, if a user is a member of two groups with site roles Viewer and Creator, Tableau will assign the Creator site role.

To keep track of role assignments, we recommend creating role-specific groups in Entra ID, such as “Tableau - Creator”, “Tableau - Explorer”, etc. You can then use the groups to quickly provision new users for the correct role in Tableau Cloud.

Site roles are listed below in order from most permissive to least permissive:

  • Site Administrator Creator

  • Site Administrator Explorer

  • Creator

  • Explorer (Can Publish)

  • Explorer

  • Viewer

Note: Users and their attributes should be managed through Entra ID. Changes made within Tableau Cloud directly may result in unexpected behavior and overwritten values.

Step 4: Provision groups

After you have enabled SCIM support and assigned groups to the Tableau Cloud application in Entra ID, the next step is to provision users to your Tableau Cloud site.

  1. On the Provisioning page, expand the Settings section, and define the groups you want to provision to Tableau Cloud in Scope.

    A settings menu to opt in to email notifications on failures and to establish the parameters for syncing users and groups.

    Note: The Entra ID setting "Sync all users and groups" is not supported with Tableau Cloud.

  2. Toggle Provisioning Status to On.

  3. Click Save.

Saving starts the initial synchronization of the groups defined in Scope. Synchronization occurs approximately every 40 minutes as long as the Entra ID provisioning service runs. To manually provision users outside of the schedule, select Provision on demand. For more information about on demand provisioning, see the Microsoft article On-demand provisioning in Microsoft Entra ID(Link opens in a new window).

After provisioning is complete, you should see the groups from Entra ID on the Site Users page in Tableau Cloud.

Change user authentication in Tableau Cloud

Provisioned users are assigned the SAML authentication type by default. To change the authentication type for users, use the steps below.

  1. In Tableau Cloud, select Users.

  2. On the Site Users page, select the check boxes next to the users you want to assign an authentication type.

  3. On the Actions menu, select Authentication.

  4. In the Authentication dialog, select the preferred authentication type for the user.

For more information about the different authentication types in Tableau Cloud, see Authentication.

Notes for SCIM support with Azure Active Directory

  • You must add a separate Tableau Cloud app for each site you want to manage using SCIM.

  • When deprovisioning a user in the Tableau Cloud application in Azure AD or if a user is deleted from Azure AD entirely, the user is converted to an Unlicensed site role in Tableau Cloud. If the user owns any content, you must first reassign ownership of those content assets before you can manually delete the user in Tableau Cloud.

  • Beginning in February 2024 (Tableau 2023.3), the use of SCIM with Grant License on Sign In (GLSI) is supported. GLSI requires the following:

    1. Manually enabling the option for a group and selecting the minimum site role for the users who are members of the group directly in Tableau Cloud. It is not possible to set a group with the GLSI attribute in Azure AD, but you can set the attribute for the group you have provisioned from Azure AD in Tableau Cloud.
    2. The user must be provisioned as unlicensed from the IdP.

Back to top
Thanks for your feedback!Your feedback has been successfully submitted. Thank you!