Login-based Licence Management

Login-based licence management, helps you manage licensing for users with Creator roles on Tableau Server and Tableau Online. Users with Explorer or Viewer roles cannot use this feature. If you’re using Role Based Subscriptions with Tableau Server or Tableau Online, you can simplify your licence management using login-based licence management to eliminate separate Tableau Desktop and Tableau Prep Builder product keys. You only need to manage one or more product keys for on-premises Tableau Server, or in the case of Tableau Online, you don’t need to manage any product keys at all.

You only need one Tableau Server or Tableau Online site to authorise an individual Tableau Desktop or Tableau Prep Builder. Login-based licence management is enabled per production instance of your Tableau Server deployment. You can assign Creator roles to users who use Tableau Server, Tableau Desktop, and Tableau Prep Builder for licence activation and centralised licence management. In addition, login-based licence management gives you more visibility into licence usage.

You can use administrative views on Tableau Server and Tableau Online to see the assignment and use of Creator seats in one place. Administrative views provide information about who is using your Creator licences, and shows the most recent licence lease and version of both Tableau Desktop and Tableau Prep Builder, which helps you to monitor your Tableau deployments.

The following Tableau products support login-based licence management:

  • Tableau Online

  • Tableau Server 2020.1+

  • Tableau Desktop 2020.1+

  • Tableau Prep Builder 2020.1.3+

How login-based licence management works

When login-based licence management is in use, Tableau Desktop or Tableau Prep Builder periodically contacts Tableau Server or Tableau Online in order to verify that the user is a Creator and to obtain an authorisation to run. Tableau Server or Tableau Online contacts the Tableau-hosted authorization-to-run (ATR) service to verify that the Tableau Desktop client is allowed activation. The ATR service, hosted on AWS, verifies and manages the licence and the length of the authorisation window. The diagrams below show the communication process between the client, Tableau Server or Tableau Online, and the licensing service.

Login-based licence management with Tableau Online

Login-based licence management with Tableau Server

  1. You install Tableau Desktop or Tableau Prep Builder and select Activate with your credentials. You sign into your Tableau Online or Tableau Server site.

  2. Tableau Online or Tableau Server verifies that you are a Creator. If not, you get an error. If yes, Tableau Online or Tableau Server communicates with the ATR service.

  3. The ATR service returns an ATR lease to Tableau Online or Tableau Server.

  4. Tableau Online or Tableau Server provides an ATR lease to Tableau Desktop or Tableau Prep Builder to finalise activation.

Use login-based licence management

To use login-based licence management, you either need to use Tableau Online or you need to install Tableau Server and activate it with a login-based licence management enabled product key. You will also need to install Tableau Desktop.

Step 1: Install Tableau Server

If you already have Tableau Server installed, skip to (Optional) Step 2: Change login-based licence management settings. Otherwise, you'll need to install Tableau Server:

  1. Refer to the Deploy chapter to install Tableau Server.

  2. During activation, you must enter a Tableau Server product key that supports role-based subscription and login-based licence management.

  3. Add users to your Tableau Server and set them to one of the three Creator roles: Server Administrator, Site Administrator Creator or Creator. This assigns a Creator licence to these users on Tableau Server. For more information, see Set User’s Site Roles(Link opens in a new window).

(Optional) Step 2: Change login-based licence management settings

Login-based licence management is enabled by default for Tableau Online, Tableau Server, and Tableau Desktop starting with version 2020.1. You can, however, change some login-based licence management settings.

Change login-based licence management settings on Tableau Desktop or Tableau Prep Builder at install

To change login-based licence management settings at the command line, you can run the installer .exe file from your computer's command line as an administrator. If you need to extract the .msi files, follow the instructions to Extract and run the Windows (MSI) installer(Link opens in a new window).

To use a duration length other than the default of 14 days, include the ATRREQUESTEDDURATIONSECONDS switch. For example:

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 ATRREQUESTEDDURATIONSECONDS=43200

You must run the command from the directory where the .exe file is located or specify a full path to the location of the .exe file on the computer. Do not run the setup program from a shared directory on your network. Instead, download the .exe file to a directory on the computer where you're installing.

The following example shows the Windows installer command that disables login-based licence management:

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 LBLM=disabled

or

tableauPrepBuilder-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 LBLM=disabled

To set the default URL for the Tableau Server you want users to use for activation when using login-based licence management, add the ACTIVATIONSERVER option:

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 ACTIVATIONSERVER=http://<tableau_server_url>

Note: The ACTIVATIONSERVER option is only intended for first time activation. If you have previously signed-in to this version of Tableau, you cannot specify the activation server using this option. For example, if you are using Tableau Desktop version 2019.4 and have previously signed-in successfully, you cannot use the ACTIVATIONSERVER option to specify an activation server. However, if you install a different Tableau version or you are signing-in to Tableau for the first time on a new computer, you can use the ACTIVATIONSERVER option to specify the activation server.

Change login-based licence management settings on Tableau Desktop by editing the registry

If Tableau Desktop is already installed, you can change login-based licence management settings by editing the Windows registry.

To turn off login-based licence management:

reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR /f /v LBLM /d disabled

To make login-based licence management the only login option:

reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR /f /v LBLM /d required

Or, you can enable, disable or require login-based licence management by editing the registry directly:

  1. As an administrator on the computer running Tableau Desktop, make a backup of the registry file before you make any changes to it.

  2. Edit the registry, and in HKEY_LOCAL_MACHINE\SOFTWARE\Tableau, find the hive named ATR and modify the LBLM value to reflect the desired setting:

    1. Name: LBLM.

    2. Data: enabled, disabled or required.

  3. Restart Tableau so the changes take effect.
Change login-based licence management settings on Tableau Desktop on macOS

To change login-based licence management settings on macOS, run the following commands in a terminal window to update the preferences file, and then install or restart Tableau Desktop.

To turn off login-based licence management:

sudo defaults write /Library/Preferences/com.tableau.ATR LBLM "disabled"

To make login-based licence management the only login option:

sudo defaults write /Library/Preferences/com.tableau.ATR LBLM "required"

Login-based licence management settings

You use the following settings to change login-based licence management, set the ATR duration, and set the activation server URL.

Setting Value Description
LBLM enabled, disabled or required

Set to enabled (the default), the licensing screens will present the two options for activation (product key, or credentials).

Set to disabled, login-based licence management will not appear on the licensing screens.

Set to required, login-based licence management is the only way to activate the Tableau Desktop (when the licensing screen appears, it will offer only the credentials option for activation).

Note: When LBLM is set to enabled or required, reporting is also enabled.

ATRREQUESTEDDURATIONSECONDS 1209600

Sets the authorisation to run (ATR) duration (in seconds), which is the length of time that an instance of Tableau Desktop and Tableau Prep Builder is authorised to run. The default is 1209600 seconds (14 days). Do not use commas as separators in the value.

ACTIVATIONSERVER

http://<tableau_server_url>

Sets the default URL for the Tableau Server you want users to use for activation.
REPORTINGFREQUENCYSECONDS 3600 Sets the default (in seconds) for how often the login-based licence management report is sent to Tableau Server or Tableau Online. The minimum setting is 60 seconds, and the default is 3600 seconds (one hour). Change this setting to reduce the load on Tableau Server or to reduce network traffic. No matter what the authorisation-to-run (ATR) lease duration is set to, REPORTINGFREQUENCYSECONDS sets the time interval that the Tableau Desktop or Tableau Prep Builder client report login-based licence management activations back to Tableau Server or Tableau Online.

Note: If you need to reclaim your Tableau Desktop product key, you can use the RECLAIMLICENSES option when uninstalling Tableau Desktop. For more information, see Deactivate the product key(Link opens in a new window).

Additional configuration for virtual deployments

Tableau Desktop and Tableau Prep Builder periodically contact Tableau Online or Tableau Server to verify that Tableau is authorised to run, based on its licence. Tableau Online or Tableau Server then contacts the ATR service to verify the licence and the length of the authorisation window.

When configuring a virtual (non-persistent) deployment of Tableau Desktop or Tableau Prep Builder, the duration time should be set to one of the lower values such as 4 or 8 hours in order to avoid an over-use activation error message. After the virtual machine (VM) is returned, the ATR service will handle the activation monitoring.

The following flags should be used on a source image prior to publishing Tableau Desktop to end users. Each end user will be activating the software by logging into Tableau Server or Tableau Online with each new VM delivered. No product keys need to be entered if the end user is a Tableau Creator on Tableau Server or Tableau Online.

If you are using login-based licence management for Tableau Desktop or Tableau Prep Builder on a VM, you may get an error message that your licence information has changed whenever you launch a new VM for Tableau Desktop or Tableau Prep Builder. This error forces a restart, which then asks you to register Tableau Desktop again. This error occurs because the ATR service sends a new token that doesn’t match the licence cache.

To prevent this from occurring, you can use the SYNCHRONOUSLICENSECHECK and SILENTLYREGISTERUSER options with the Windows installer. For example:

tableau-setup-std-tableau-2020 SYNCHRONOUSLICENSECHECK="true" SILENTLYREGISTERUSER="true" ATRREQUESTEDDURATIONSECONDS=14400

or

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 ATRREQUESTEDDURATIONSECONDS=14400 ACTIVATIONSERVER=http://<tableau_server_url> SYNCHRONOUSLICENSECHECK="true" SILETYLYREGISTERUSER="true"

If Tableau Prep Builder and Tableau Desktop are being delivered on one Virtual Desktop, ATRREQUESTEDDURATIONSECONDS only needs to be set during Tableau Desktop installation. However, if you plan to install Tableau Prep Builder as a stand-alone, you'll need to set ATRREQUESTEDDURATIONSECONDS during Tableau Prep Builder installation.

Or, you can edit the following registry keys on the source image:

Reg key path: HKLM\SOFTWARE\Tableau\<Tableau version>\Settings\

Reg key (String value, need to set to true to make that feature enabled)

SynchronousLicenseCheck

SilentlyRegisterUser

(Optional) Step 3: Change the authorisation to run (ATR) duration

The login-based licence management default settings for the authorisation to run (ATR) duration are appropriate for most environments, but you can change these default settings if needed. Login-based licence management uses the default authorisation to run (ATR) duration of 1,209,600 seconds (14 days), which is the length of time that an instance of Tableau Desktop and Tableau Prep Builder is authorised to run. This means that after the initial authorisation, you could use Tableau without any network connection for 14 days before the activation expired.

The default duration value for login-based licence management is not appropriate for delivering a non-persistent VM delivery solution to end users. The ATR duration should be lowered to 4 or 12 hours depending on VM use. When a new VM is delivered to an end user, a new authority to run token will be created. When the VM is returned, this token is also returned and is able to be used on the new VM authorisation to run request.

Note: Login-based licence management uses the following hierarchy when determining ATR duration.

  1. ATR Service – Establishes the minimum (4 hours) and maximum (3 months) ATR durations applicable to all users/installations. It specifies the default ATR duration (2 weeks) if nothing is specified by Tableau Server or Tableau Desktop.
  2. Tableau Server - Can optionally specify a maximum ATR duration (licensing.login_based_license_management.max_requested_duration_seconds) for all Tableau Desktop installations. This ATR duration setting ensures that Tableau Desktop clients do not specify an ATR duration value greater than the maximum value set here. The ATR Service maximum setting can be between 4 hours (minimum) and 3 months (maximum).
  3. Tableau Desktop – Can optionally specify the ATR duration (ATRREQUESTEDDURATIONSECONDS) for the computer on which it is installed. This setting must be within the ATR Service minimum (4 hours) and maximum (3 months). This local ATR duration overrides any durations set by the ATR Service or Tableau Server. However, this default ATR duration cannot be more than the maximum ATR duration set on Tableau Server.
Change the ATR duration for Tableau Desktop or Tableau Prep Builder using Tableau Server

On Tableau Server, you use the Tableau Services Manager (TSM) command line utility to set the ATR duration.

To set the ATR duration, at a command prompt, type:

tsm configuration set -k licensing.login_based_license_management.default_requested_duration_seconds -v <value in seconds>

tsm pending-changes apply

To set the ATR maximum duration, at a command prompt, type:

tsm configuration set -k licensing.login_based_license_management.max_requested_duration_seconds -v <value in seconds>

tsm pending-changes apply

Change the ATR duration on Tableau Desktop by editing the registry

To use a duration length other than the default of 14 days, update the ATRRequestedDurationSeconds registry setting. For example:

  1. As an administrator on the computer running Tableau Desktop, make a backup of the registry file before you make any changes to it.
  2. Edit the registry, and in HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR, update the ATRRequestedDurationSeconds as follows (0 uses the default setting):
    1. Name: Find the string value named ATRRequestedDurationSeconds.

    2. Data: Update the number of seconds the duration should last. For example, add 43200 to set a duration of 12 hours.

  3. Restart Tableau so that the changes take effect.
Change the ATR duration on Tableau Desktop on macOS

To use a duration length other than the default of 14 days, include the ATRRequestedDurationSeconds preferences setting. For example:

sudo defaults write /Library/Preferences/com.tableau.ATR ATRRequestedDurationSeconds -string "43200"

Step 4: Activate Tableau Desktop

The 2021.3 version of both Tableau Desktop for Windows or macOS support login-based licence management.

  1. Run Tableau Desktop setup.

  2. The Activate Tableau screen will include the Activate by signing in to a server option.

  3. Click Activate by signing in to a server and then do one of the following:
    • If you're using Tableau Online, click the Tableau Online link.

    • If you're using Tableau Server, enter the Tableau Server URL, and then click Connect.

    When prompted, enter valid credentials for a user with a Creator role subscription, and then click OK.

View login-based licence usage

You can view login-based licence usage for Tableau Online or Tableau Server. The report shows users, hosts, user role, product, version, activations, Creator seats in use, Creator seats not in use and when a Creator seat was last used. You can view data for the past 30 days up to a maximum of 183 days.

To view the Login-based licence management Licence Usage administrative view:

  1. In Tableau Online or Tableau Server, in the navigation pane, click Site Status.

  2. On the Site Status page, click Login-based Licence Usage.

  3. Optional. On the report screen, you can change the time window to show when seats were last used, filter on actions, filter on user name and sort by columns.

Troubleshooting

You may encounter one of the following error messages while using login-based licence management. Use the information below to resolve the issue.

Login-based licence management is not enabled on Tableau Server

If login-based licence management is available as an activation option on Tableau Desktop, but not enabled on Tableau Server, or if Tableau Server does not have a login-based licence management capable licence, the following error message may be displayed:

Login-based licence management is not enabled on the server you connected to. Select a different server to connect to, use a product key to activate your licence or start a trial to begin working immediately.

Contact your administrator to ensure that you’re using a Tableau Server product key that’s enabled for login-based licence management. To verify that you have activated the appropriate product key, in the TSM web UI click Configuration, and then click Licensing. For guidance on activating licences, see tsm licences activate. Login-based licence management should be enabled by default unless it was previously turned off by the server administrator.

Login-based licence management is not enabled on Tableau Desktop

If login-based licence management is not enabled on Tableau Desktop, you will not have the option to activate Tableau using your credentials. Prior to version 2020.1, the ability to use login-based licence management on Tableau Desktop is not turned on as a default. Check the Tableau Desktop version to ensure the correct version is being used.

If the login-based licence management option has been turned off during installation or with an update, see Step 2: Enable login-based licence management(Link opens in a new window).

Product key expiry date doesn't change after purchasing a year subscription

After purchasing a renewal of Tableau Online, it might appear that your Tableau Desktop license is going to expire. This is not the case. In Manage Product Keys, the expiration date for new Tableau Online subscriptions is not updated until two weeks before the previous Site expiration date.

You do not have a Creator licence

When attempting to activate from Tableau Desktop, the following error message may be displayed:

You do not have a Creator licence. Contact your administrator to obtain one.

This error is displayed if you have not been assigned a Creator role. If you belong to multiple sites on Tableau Online or Tableau Server, you need to sign in to the site where you have the Creator role when using login-based licence management. Otherwise you'll get this error.

To verify that the product key you have activated on the server includes Creator licences, open the TSM web UI and click Configuration, and then click Licensing.

You have activated the maximum number of computers

When attempting to activate from Tableau Desktop, the following error message may be displayed:

You have activated Tableau the maximum number of times allowed under your account. You must wait for the licence activation on another computer to expire before you can activate Tableau again.

This error is displayed when you activated Tableau from multiple computers with the same Creator user credentials and exceeded the maximum number of activations. You must wait until the authorisation-to-run (ATR) token expires on one of the existing computers before attempting to activate a new computer. If you are using non-persistent virtual machines (VMs), you can shorten the ATR duration to prevent this error from occurring again.

To shorten the ATR token duration for maximum activation

If you encounter this maximum use error when using a non-persistent virtual deployment, it is possible to shorten the ATR duration to 4 hours (14400) seconds to avoid the error in the future. Alternatively, instead of changing the duration on an individual desktop, you can set the default duration on Tableau Server to affect all users.

The following steps shorten the lease on a computer previously activated with login-based licence management that will no longer be used, in order to free up a seat to be activated on a new computer:

  1. Open a Command Prompt as an administrator on a Tableau Desktop computer that will no longer be used.

  2. Navigate to the Tableau binaries (\bin) directory, using the following command.

    cd Program Files\Tableau\Tableau <version>\bin

  3. Run the following command to set the duration to 4 hours, in seconds (e.g. 14400).

    Windows: atrdiag.exe -setDuration 14400

    Mac: sudo ./atrdiag -setDuration 14400

  4. Delete the previous ATR token using the following command:

    Windows: atrdiag.exe -deleteAllATRs

    Mac: ./atrdiag -deleteAllATRs

  5. Next, overwrite the existing ATR token. Open Tableau Desktop. Tableau displays the “Licence has Changed” message. Click Exit to automatically close and reopen Tableau Desktop.

  6. In the registration dialog box, click Activate, and then reactivate Tableau Desktop through Tableau Server using login-based licence management, which will overwrite the existing token.

  7. Close Tableau Desktop and wait for the ATR duration to elapse (e.g. 4 hours) so that the ATR token expires and frees-up a user seat. Do not open Tableau Desktop before the ATR duration has elapsed. Check to make sure the ATR duration has elapsed. The ATR token TTL End should show a date and time in the future (e.g. 4 hours from now).

    Windows: atrdiag.exe

    Mac: ./atrdiag

  8. After the ATR token expires and you can successfully sign in to Tableau Server on a new computer.

To return your computer to an unlicensed state

  1. Open a Command Prompt as an administrator.

  2. Navigate to the Tableau binaries (\bin) directory, using the following command:

    cd Program Files\Tableau\Tableau <version>\bin

  3. Run the following command:

    Windows: atrdiag.exe –deleteAllATRs

    Mac: ./atrdiag.exe –deleteAllATRs

Note: This removes only the ATR token from the computer. It does not free-up any of the user seats. The user seat is only freed-up after the deleted ATR token expires.

Your Tableau credentials are invalid

When attempting to activate from Tableau Desktop, the following error message may be displayed:

Your Tableau credentials are invalid. Contact your administrator to reset your account.

This error is displayed when your Tableau licence is not recognised. Contact your administrator.

Your computer’s clock is not synchronised to the current time

When attempting to activate from Tableau Desktop, the following error message may be displayed:

Your computer’s clock is not synchronised to the current time. Synchronise your computer’s clock to the current time and then try to activate Tableau.

This error is displayed when your computer's clock is not synchronised with the current time. Synchronise your computer’s clock with a time server on the internet or enable automatic time synchronisation.

Unable to activate with your credentials

When attempting to activate Tableau, the following error message may be displayed:

Tableau Server cannot verify your licensing information over the internet. Contact your administrator to check your internet connection.

This error is displayed when the port atr.licensing.tableau.com:443 is not open on all Application Server (VizPortal) nodes, or you have a proxy that is not configured properly to forward traffic to Tableau's licensing server.

To diagnose connectivity to Tableau's licensing server, paste the following URL (https://atr.licensing.tableau.com/_status/healthz) into a browser or at a curl command prompt.

Thanks for your feedback!