Login-based License Management

Login-based license management, helps you manage licensing for users with Creator roles on Tableau Server and Tableau Online. Users with Explorer or Viewer roles cannot use this feature. If you’re using Role Based Subscriptions with Tableau Server or Tableau Online, you can simplify your license management using login-based license management to eliminate separate Tableau Desktop and Tableau Prep Builder product keys. You only need to manage one or more product keys for on-premises Tableau Server, or in the case of Tableau Online, you don’t need to manage any product keys at all.

You only need one Tableau Server or Tableau Online site to authorize an individual Tableau Desktop or Tableau Prep Builder. Login-based license management is enabled per production instance of your Tableau Server deployment. You can assign Creator roles to users who use Tableau Server, Tableau Desktop, and Tableau Prep Builder for license activation and centralized license management. In addition, login-based license management gives you more visibility into license usage.

You can use administrative views on Tableau Server and Tableau Online to see the assignment and use of Creator seats in one place. Administrative views provide information about who is using your Creator licenses, and shows the most recent license lease and version of both Tableau Desktop and Tableau Prep Builder, which helps you to monitor your Tableau deployments.

The following Tableau products support login-based license management:

  • Tableau Online

  • Tableau Server 2020.1+

  • Tableau Desktop 2020.1+

  • Tableau Prep Builder 2020.1.3+

How login-based license management works

When login-based license management is in use, Tableau Desktop or Tableau Prep Builder periodically contacts Tableau Server or Tableau Online in order to verify that the user is a Creator and to obtain an authorization to run. Tableau Server or Tableau Online contacts the Tableau-hosted authorization-to-run (ATR) service to verify that the Tableau Desktop client is allowed activation. The ATR service, hosted on AWS, verifies and manages the license and the length of the authorization window. The diagrams below show the communication process between the client, Tableau Server or Tableau Online, and the licensing service.

Login-based license management with Tableau Online

Login-based license management with Tableau Server

  1. You install Tableau Desktop or Tableau Prep Builder and select Activate with your credentials. You sign into your Tableau Online or Tableau Server site.

  2. Tableau Online or Tableau Server verifies that you are a Creator. If not, you get an error. If yes, Tableau Online or Tableau Server communicates with the ATR service.

  3. The ATR service returns an ATR lease to Tableau Online or Tableau Server.

  4. Tableau Online or Tableau Server provides an ATR lease to Tableau Desktop or Tableau Prep Builder to finalize activation.

Use login-based license management

To use login-based license management, you either need to use Tableau Online or you need to install Tableau Server and activate it with a login-based license management enabled product key. You will also need to install Tableau Desktop.

Step 1: Install Tableau Server

If you already have Tableau Server installed, skip to (Optional) Step 2: Change login-based license management settings. Otherwise, you'll need to install Tableau Server:

  1. Refer to the Deploy chapter to install Tableau Server.

  2. During activation, you must enter a Tableau Server product key that supports role-based subscription and login-based license management.

  3. Add users to your Tableau Server and set them to one of the three Creator roles: Server Administrator, Site Administrator Creator, or Creator. This assigns a Creator license to these users on Tableau Server. For more information, see Set User’s Site Roles(Link opens in a new window).

Important: If you're using connected clients and login-based license management, do not disable automatic client authentication(Link opens in a new window). In addition, do not sign out of Tableau Server using the connected desktop user interface after enabling login-based license management. Otherwise, login-based license management cannot automatically update licensing credentials. For more information about connected desktop, see Automatically keep Tableau Desktop connected to Tableau Server or Online(Link opens in a new window).

(Optional) Step 2: Change login-based license management settings

Login-based license management is enabled by default for Tableau Online, Tableau Server, and Tableau Desktop starting with version 2020.1. You can, however, change some login-based license management settings.

Disable login-based license management on Tableau Server

Although login-based license management is the preferred method of activation for Tableau Desktop and Tableau Prep Builder, you may have Tableau Server installations in your organization used for testing that don't need to use login-based license management. On Tableau Server, you use the Tableau Services Manager (TSM) command line utility to turn off login-based license management.

To turn off login-based license management, at a command prompt, type:

tsm configuration set -k licensing.login_based_license_management.enabled -v false

tsm pending-changes apply

Change login-based license management settings on Tableau Desktop or Tableau Prep Builder at install

To change login-based license management settings at the command line, you can run the installer .exe file from your computer's command line as an administrator. If you need to extract the .msi files, follow the instructions to Extract and run the Windows (MSI) installer(Link opens in a new window).

To use a duration length other than the default of 14 days, include the ATRREQUESTEDDURATIONSECONDS switch. For example:

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 ATRREQUESTEDDURATIONSECONDS=43200

You must run the command from the directory where the .exe file is located or specify a full path to the location of the .exe file on the computer. Do not run the setup program from a shared directory on your network. Instead, download the .exe file to a directory on the computer where you're installing.

The following example shows the Windows installer command that disables login-based license management:

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 LBLM=disabled

or

tableauPrepBuilder-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 LBLM=disabled

To set the default URL for the Tableau Server you want users to use for activation when using login-based license management, add the ACTIVATIONSERVER option:

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 ACTIVATIONSERVER=http://<tableau_server_url>

Note: The ACTIVATIONSERVER option is only intended for first time activation. If you have previously signed-in to this version of Tableau, you cannot specify the activation server using this option. For example, if you are using Tableau Desktop version 2019.4 and have previously signed-in successfully, you cannot use the ACTIVATIONSERVER option to specify an activation server. However, if you install a different Tableau version or you are signing-in to Tableau for the first time on a new computer, you can use the ACTIVATIONSERVER option to specify the activation server.

Change login-based license management settings on Tableau Desktop by editing the registry

If Tableau Desktop is already installed, you can change login-based license management settings by editing the Windows registry.

To turn off login-based license management:

reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR /f /v LBLM /d disabled

To make login-based license management the only login option:

reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR /f /v LBLM /d required

Or, you can enable, disable, or require login-based license management by editing the registry directly:

  1. As an administrator on the computer running Tableau Desktop, make a backup of the registry file before you make any changes to it.

  2. Edit the registry, and in HKEY_LOCAL_MACHINE\SOFTWARE\Tableau, find the hive named ATR and modify the LBLM value to reflect the desired setting:

    1. Name: LBLM.

    2. Data: enabled, disabled, or required.

  3. Restart Tableau so the changes take effect.
Change login-based license management settings on Tableau Desktop on macOS

To change login-based license management settings on macOS, run the following commands in a terminal window to update the preferences file, and then install or restart Tableau Desktop.

To turn off login-based license management:

sudo defaults write /Library/Preferences/com.tableau.ATR LBLM "disabled"

To make login-based license management the only login option:

sudo defaults write /Library/Preferences/com.tableau.ATR LBLM "required"

Login-based license management settings

You use the following settings to change login-based license management, set the ATR duration, and set the activation server URL.

Setting Value Description
LBLM enabled, disabled, or required

Set to enabled (the default), the licensing screens will present the two options for activation (product key, or credentials).

Set to disabled, login-based license management will not appear on the licensing screens.

Set to required, login-based license management is the only way to activate the Tableau Desktop (when the licensing screen appears, it will offer only the credentials option for activation).

Note: When LBLM is set to enabled or required, reporting is also enabled.

ATRREQUESTEDDURATIONSECONDS 1209600

Sets the authorization to run (ATR) duration (in seconds), which is the length of time that an instance of Tableau Desktop and Tableau Prep Builder is authorized to run. The default is 1209600 seconds (14 days). Do not use commas as separators in the value.

ACTIVATIONSERVER

http://<tableau_server_url>

Sets the default URL for the Tableau Server you want users to use for activation.
REPORTINGFREQUENCYSECONDS 3600 Sets the default (in seconds) for how often the login-based license management report is sent to Tableau Server or Tableau Online. The minimum setting is 60 seconds, and the default is 3600 seconds (one hour). Change this setting to reduce the load on Tableau Server or to reduce network traffic. No matter what the authorization-to-run (ATR) lease duration is set to, REPORTINGFREQUENCYSECONDS sets the time interval that the Tableau Desktop or Tableau Prep Builder client report login-based license management activations back to Tableau Server or Tableau Online.

Note: If you need to reclaim your Tableau Desktop product key, you can use the RECLAIMLICENSES option when uninstalling Tableau Desktop. For more information, see Deactivate the product key(Link opens in a new window).

Additional configuration for virtual deployments

Tableau Desktop and Tableau Prep Builder periodically contact Tableau Online or Tableau Server to verify that Tableau is authorized to run, based on its license. Tableau Online or Tableau Server then contacts the ATR service to verify the license and the length of the authorization window.

When configuring a virtual (non-persistent) deployment of Tableau Desktop or Tableau Prep Builder, the duration time should be set to one of the lower values such as 4 or 8 hours in order to avoid an over-use activation error message. After the virtual machine (VM) is returned, the ATR service will handle the activation monitoring.

The following flags should be used on a source image prior to publishing Tableau Desktop to end users. Each end user will be activating the software by logging into Tableau Server or Tableau Online with each new VM delivered. No product keys need to be entered if the end user is a Tableau Creator on Tableau Server or Tableau Online.

If you are using login-based license management for Tableau Desktop or Tableau Prep Builder on a VM, you may get an error message that your license information has changed whenever you launch a new VM for Tableau Desktop or Tableau Prep Builder. This error forces a restart, which then asks you to register Tableau Desktop again. This error occurs because the ATR service sends a new token that doesn’t match the license cache.

To prevent this from occurring, you can use the SYNCHRONOUSLICENSECHECK and SILENTLYREGISTERUSER options with the Windows installer. For example:

tableau-setup-std-tableau-2020 SYNCHRONOUSLICENSECHECK="true" SILENTLYREGISTERUSER="true" ATRREQUESTEDDURATIONSECONDS=14400

or

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 ATRREQUESTEDDURATIONSECONDS=14400 ACTIVATIONSERVER=http://<tableau_server_url> SYNCHRONOUSLICENSECHECK="true" SILENTYLYREGISTERUSER="true"

If Tableau Prep Builder and Tableau Desktop are being delivered on one Virtual Desktop, ATRREQUESTEDDURATIONSECONDS only needs to be set during Tableau Desktop installation. However, if you plan to install Tableau Prep Builder as a stand-alone, you'll need to set ATRREQUESTEDDURATIONSECONDS during Tableau Prep Builder installation.

Or, you can edit the following registry keys on the source image:

Reg key path: HKLM\SOFTWARE\Tableau\<Tableau version>\Settings\

Reg key (String value, need to set to true to make that feature enabled)

SynchronousLicenseCheck

SilentlyRegisterUser

(Optional) Step 3: Change the authorization to run (ATR) duration

The login-based license management default settings for the authorization to run (ATR) duration are appropriate for most environments, but you can change these default settings if needed. Login-based license management uses the default authorization to run (ATR) duration of 1,209,600 seconds (14 days), which is the length of time that an instance of Tableau Desktop and Tableau Prep Builder is authorized to run. This means that after the initial authorization, you could use Tableau without any network connection for 14 days before the activation expired.

The default duration value for login-based license management is not appropriate for delivering a non-persistent VM delivery solution to end users. The ATR duration should be lowered to 4 or 12 hours depending on VM use. When a new VM is delivered to an end user, a new authority to run token will be created. When the VM is returned, this token is also returned and is able to be used on the new VM authorization to run request.

Note: Login-based license management uses the following hierarchy when determining ATR duration.

  1. ATR Service – Establishes the minimum (4 hours) and maximum (3 months) ATR durations applicable to all users/installations. It specifies the default ATR duration (2 weeks) if nothing is specified by Tableau Server or Tableau Desktop.
  2. Tableau Server - Can optionally specify a maximum ATR duration (licensing.login_based_license_management.max_requested_duration_seconds) for all Tableau Desktop installations. This ATR duration setting ensures that Tableau Desktop clients do not specify an ATR duration value greater than the maximum value set here. The ATR Service maximum setting can be between 4 hours (minimum) and 3 months (maximum).
  3. Tableau Desktop – Can optionally specify the ATR duration (ATRREQUESTEDDURATIONSECONDS) for the computer on which it is installed. This setting must be within the ATR Service minimum (4 hours) and maximum (3 months). This local ATR duration overrides any durations set by the ATR Service or Tableau Server. However, this default ATR duration cannot be more than the maximum ATR duration set on Tableau Server.
Change the ATR duration for Tableau Desktop or Tableau Prep Builder using Tableau Server

On Tableau Server, you use the Tableau Services Manager (TSM) command line utility to set the ATR duration.

To set the ATR duration, at a command prompt, type:

tsm configuration set -k licensing.login_based_license_management.default_requested_duration_seconds -v <value in seconds>

tsm pending-changes apply

To set the ATR maximum duration, at a command prompt, type:

tsm configuration set -k licensing.login_based_license_management.max_requested_duration_seconds -v <value in seconds>

tsm pending-changes apply

Change the ATR duration on Tableau Desktop by editing the registry

To use a duration length other than the default of 14 days, update the ATRRequestedDurationSeconds registry setting. For example:

  1. As an administrator on the computer running Tableau Desktop, make a backup of the registry file before you make any changes to it.
  2. Edit the registry, and in HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR, update the ATRRequestedDurationSeconds as follows (0 uses the default setting):
    1. Name: Find the string value named ATRRequestedDurationSeconds.

    2. Data: Update the number of seconds the duration should last. For example, add 43200 to set a duration of 12 hours.

  3. Restart Tableau so that the changes take effect.
Change the ATR duration on Tableau Desktop on macOS

To use a duration length other than the default of 14 days, include the ATRRequestedDurationSeconds preferences setting. For example:

sudo defaults write /Library/Preferences/com.tableau.ATR ATRRequestedDurationSeconds -string "43200"

Step 4: Activate Tableau Desktop

The 2021.3 version of both Tableau Desktop for Windows or macOS support login-based license management.

  1. Run Tableau Desktop setup.

  2. The Activate Tableau screen will include the Activate by signing in to a server option.

  3. Click Activate by signing in to a server and then do one of the following:
    • If you're using Tableau Online, click the Tableau Online link.

    • If you're using Tableau Server, enter the Tableau Server URL, and then click Connect.

    When prompted, enter valid credentials for a user with a Creator role subscription, and then click OK.

View login-based license usage

You can view login-based license usage for Tableau Online or Tableau Server. The report shows users, hosts, user role, product, version, activations, Creator seats in use, Creator seats not in use, and when a Creator seat was last used. You can view data for the past 30 days up to a maximum of 183 days.

To view the Login-based license management License Usage administrative view:

  1. In Tableau Online or Tableau Server, in the navigation pane, click Site Status.

  2. On the Site Status page, click Login-based License Usage.

  3. Optional. On the report screen, you can change the time window to show when seats were last used, filter on actions, filter on user name, and sort by columns.

Troubleshooting

You may encounter one of the following error messages while using login-based license management. Use the information below to resolve the issue.

Login-based license management is not enabled on Tableau Server

If login-based license management is available as an activation option on Tableau Desktop, but not enabled on Tableau Server, or if Tableau Server does not have a login-based license management capable license, the following error message may be displayed:

Login-based license management is not enabled on the server you connected to. Select a different server to connect to, use a product key to activate your license, or start a trial to begin working immediately.

Contact your administrator to ensure that you’re using a Tableau Server product key that’s enabled for login-based license management. To verify that you have activated the appropriate product key, in the TSM web UI click Configuration, and then click Licensing. For guidance on activating licenses, see tsm licenses activate. Login-based license management should be enabled by default unless it was previously turned off by the server administrator.

Login-based license management is not enabled on Tableau Desktop

If login-based license management is not enabled on Tableau Desktop, you will not have the option to activate Tableau using your credentials. Prior to version 2020.1, the ability to use login-based license management on Tableau Desktop is not turned on as a default. Check the Tableau Desktop version to ensure the correct version is being used.

If the login-based license management option has been turned off during installation or with an update, see Step 2: Enable login-based license management(Link opens in a new window).

Product key expiration date doesn't change after purchasing a year subscription

After purchasing a renewal of Tableau Online, it might appear that your Tableau Desktop license is going to expire. This is not the case. In Manage Product Keys, the expiration date for new Tableau Online subscriptions is not updated until two weeks before the previous Site expiration date.

You do not have a Creator license

When attempting to activate from Tableau Desktop, the following error message may be displayed:

You do not have a Creator license. Contact your administrator to obtain one.

This error is displayed if you have not been assigned a Creator role. If you belong to multiple sites on Tableau Online or Tableau Server, you need to sign in to the site where you have the Creator role when using login-based license management. Otherwise you'll get this error.

To verify that the product key you have activated on the server includes Creator licenses, open the TSM web UI and click Configuration, and then click Licensing.

You have activated the maximum number of computers

When attempting to activate from Tableau Desktop, the following error message may be displayed:

You have activated Tableau the maximum number of times allowed under your account. You must wait for the license activation on another computer to expire before you can activate Tableau again.

This error is displayed when you activated Tableau from multiple computers with the same Creator user credentials and exceeded the maximum number of activations. You must wait until the authorization-to-run (ATR) token expires on one of the existing computers before attempting to activate a new computer. If you are using non-persistent virtual machines (VMs), you can shorten the ATR duration to prevent this error from occurring again.

To shorten the ATR token duration for maximum activation

If you encounter this maximum use error when using a non-persistent virtual deployment, it is possible to shorten the ATR duration to 4 hours (14400) seconds to avoid the error in the future. Alternatively, instead of changing the duration on an individual desktop, you can set the default duration on Tableau Server to affect all users.

The following steps shorten the lease on a computer previously activated with login-based license management that will no longer be used, in order to free up a seat to be activated on a new computer:

  1. Open a Command Prompt as an administrator on a Tableau Desktop computer that will no longer be used.

  2. Navigate to the Tableau binaries (\bin) directory, using the following command.

    Windows: cd Program Files\Tableau\Tableau <version>\bin

    Mac: cd /Applications/Tableau\ Desktop\ <version>.app/Contents/MacOS

  3. Run the following command to set the duration to 4 hours, in seconds (e.g., 14400).

    Windows: atrdiag.exe -setDuration 14400

    Mac: sudo ./atrdiag -setDuration 14400

  4. Delete the previous ATR token using the following command:

    Windows: atrdiag.exe -deleteAllATRs

    Mac: ./atrdiag -deleteAllATRs

  5. Next, overwrite the existing ATR token. Open Tableau Desktop. Tableau displays the “License has Changed” message. Click Exit to automatically close and reopen Tableau Desktop.

  6. In the registration dialog box, click Activate, and then reactivate Tableau Desktop through Tableau Server using login-based license management, which will overwrite the existing token.

  7. Close Tableau Desktop and wait for the ATR duration to elapse (e.g., 4 hours) so that the ATR token expires and frees-up a user seat. Do not open Tableau Desktop before the ATR duration has elapsed. Check to make sure the ATR duration has elapsed. The ATR token TTL End should show a date and time in the future (e.g., 4 hours from now).

    Windows: atrdiag.exe

    Mac: ./atrdiag

  8. After the ATR token expires and you can successfully sign in to Tableau Server on a new computer.

To return your computer to an unlicensed state

  1. Open a Command Prompt as an administrator.

  2. Navigate to the Tableau binaries (\bin) directory, using the following command:

    cd Program Files\Tableau\Tableau <version>\bin

  3. Run the following command:

    Windows: atrdiag.exe –deleteAllATRs

    Mac: ./atrdiag.exe –deleteAllATRs

Note: This removes only the ATR token from the computer. It does not free-up any of the user seats. The user seat is only freed-up after the deleted ATR token expires.

Your Tableau credentials are invalid

When attempting to activate from Tableau Desktop, the following error message may be displayed:

Your Tableau credentials are invalid. Contact your administrator to reset your account.

This error is displayed when your Tableau license is not recognized. Contact your adminstrator..

Your computer’s clock is not synchronized to the current time

When attempting to activate from Tableau Desktop, the following error message may be displayed:

Your computer’s clock is not synchronized to the current time. Synchronize your computer’s clock to the current time and then try to activate Tableau.

This error is displayed when your computer's clock is not synchronized with the current time. Synchronize your computer’s clock with a time server on the internet or enable automatic time synchronization.

Unable to activate with your credentials

When attempting to activate Tableau, the following error message may be displayed:

Tableau Server cannot verify your licensing information over the internet. Contact your administrator to check your internet connection.

This error is displayed when the port atr.licensing.tableau.com:443 is not open on all Application Server (VizPortal) nodes, or you have a proxy that is not configured properly to forward traffic to Tableau's licensing server.

To diagnose connectivity to Tableau's licensing server, paste the following URL (https://atr.licensing.tableau.com/_status/healthz) into a browser or at a curl command prompt.

Thanks for your feedback!