Login-based License Management


Login-based license management helps you manage licensing for users with Creator roles on Tableau Server and Tableau Cloud. Users with Explorer or Viewer roles cannot use this feature. If you’re using Role Based Subscriptions with Tableau Server or Tableau Cloud, you can simplify your license management using login-based license management to eliminate separate Tableau Desktop and Tableau Prep Builder product keys. You only need to manage one or more product keys for on-premises Tableau Server, or in the case of Tableau Cloud, you don’t need to manage any product keys at all.

You only need one Tableau Server or Tableau Cloud site to authorize an individual Tableau Desktop or Tableau Prep Builder. Login-based license management is enabled per production instance of your Tableau Server deployment. You can assign Creator roles to users who use Tableau Server, Tableau Desktop, and Tableau Prep Builder for license activation and centralized license management. In addition, login-based license management gives you more visibility into license usage.

You can use administrative views on Tableau Server and Tableau Cloud to see the assignment and use of Creator seats in one place. Administrative views provide information about who is using your Creator licenses, and shows the most recent license lease and version of both Tableau Desktop and Tableau Prep Builder, which helps you to monitor your Tableau deployments.

The following Tableau products support login-based license management:

  • Tableau Cloud

  • Tableau Server 2020.1+

  • Tableau Desktop 2020.1+

  • Tableau Prep Builder 2020.1.3+

If your Tableau Server is not enabled for login-based license management, contact your Tableau sales representative to obtain a special login-based license management-enabled product key.

How login-based license management works

When login-based license management is in use, Tableau Desktop or Tableau Prep Builder periodically contacts Tableau Server or Tableau Cloud in order to verify that the user is a Creator and to obtain an authorization to run. Tableau Server or Tableau Cloud contacts the Tableau-hosted authorization-to-run (ATR) service to verify that the Tableau Desktop client is allowed activation. The ATR service, hosted on AWS, verifies and manages the license and the length of the authorization window. The diagrams below show the communication process between the client, Tableau Server or Tableau Cloud, and the licensing service.

Tableau uses common ports (80 and 443) to make internet requests. In most cases, the computer where Tableau Desktop or Tableau Prep Builder is installed and the network it is running on are already configured to allow the necessary access. For more information about the ports used by Tableau, see Tableau Services Manager Ports(Link opens in a new window).

Login-based license management with Tableau Cloud

Login-based license management with Tableau Server

  1. You install Tableau Desktop or Tableau Prep Builder and select Activate with your credentials. You sign into your Tableau Cloud or Tableau Server site.

  2. Tableau Cloud or Tableau Server verifies that you are a Creator. If not, you get an error. If yes, Tableau Cloud or Tableau Server communicates with the ATR service.

  3. The ATR service returns an ATR lease to Tableau Cloud or Tableau Server.

  4. Tableau Cloud or Tableau Server provides an ATR lease to Tableau Desktop or Tableau Prep Builder to finalize activation.

Use login-based license management

To use login-based license management, you either need to use Tableau Cloud or you need to install Tableau Server and activate it with a login-based license management enabled product key. The end user needs to be assigned the Creator role on either Tableau Cloud or Tableau Server and that user will need to install Tableau Desktop. Although the user can activate Tableau Desktop on up to two machines, only one Creator seat needs to be allocated.

Note: As of Tableau Server version 2023.1, LBLM is supported in offline deployments. To deploy Tableau Server with LBLM enabled, you must configure Tableau Server to use Authorization-To-Run (ATR) Service. For more information, see Activate Tableau Server Offline.

Step 1: Install Tableau Server

If you already have Tableau Server installed, skip to (Optional) Step 2: Change login-based license management settings. Otherwise, you'll need to install Tableau Server:

  1. Refer to the Deploy chapter to install Tableau Server.

  2. During activation, you must enter a Tableau Server product key that supports role-based subscription and login-based license management.

  3. Add users to your Tableau Server and set them to one of the three Creator roles: Server Administrator, Site Administrator Creator, or Creator. This assigns a Creator license to these users on Tableau Server. For more information, see Set User’s Site Roles(Link opens in a new window).

Important: If you're using connected clients and login-based license management, do not disable automatic client authentication(Link opens in a new window). In addition, do not sign out of Tableau Server using the connected desktop user interface after enabling login-based license management. Otherwise, login-based license management cannot automatically refresh the license activation or provide current data to the LBLM Usage report on Tableau Server or Tableau Cloud. For more information about connected desktop, see Automatically keep Tableau Desktop connected to Tableau Server or Online(Link opens in a new window).

(Optional) Step 2: Change login-based license management settings

Login-based license management is enabled by default for Tableau Cloud, Tableau Server, and Tableau Desktop starting with version 2020.1. You can, however, change some login-based license management settings.

Disable login-based license management on Tableau Server

Although login-based license management is the preferred method of activation for Tableau Desktop and Tableau Prep Builder, you may have Tableau Server installations in your organization used for testing that don't need to use login-based license management. On Tableau Server, you use the Tableau Services Manager (TSM) command line utility to turn off login-based license management.

To turn off login-based license management, at a command prompt, type:

tsm configuration set -k licensing.login_based_license_management.enabled -v false

tsm pending-changes apply

Change login-based license management settings on Tableau Desktop or Tableau Prep Builder at install

To change login-based license management settings at the command line, you can run the installer .exe file from your computer's command line as an administrator. If you need to extract the .msi files, follow the instructions to Extract and run the Windows (MSI) installer(Link opens in a new window).

To use a duration length other than the default of 14 days/1209600 seconds, include the ATRREQUESTEDDURATIONSECONDS switch. For example:

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 ATRREQUESTEDDURATIONSECONDS=43200

You must run the command from the directory where the .exe file is located or specify a full path to the location of the .exe file on the computer. Do not run the setup program from a shared directory on your network. Instead, download the .exe file to a directory on the computer where you're installing.

The following example shows the Windows installer command that disables login-based license management:

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 LBLM=disabled

or

tableauPrepBuilder-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 LBLM=disabled

To set the default URL for the Tableau Server you want users to use for activation when using login-based license management, add the ACTIVATIONSERVER or WorkGroupServer option.

To update the exe:

tableauDesktop-64bit-2021-4-0.exe /quiet /norestart ACCEPTEULA=1 ACTIVATIONSERVER=http://<tableau_server_url>

To update the registry:

reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\Tableau 2021.4\Settings /f /v WorkGroupServer /d https://<tableau_server_url>

Note: The ACTIVATIONSERVER option is only intended for first time activation. If you have previously signed-in to this version of Tableau, you use the WorkGroupServer (Windows) or WorkgroupServer (macOS) option. For example, if you are using Tableau Desktop version 2021.1 on Windows and have previously signed-in successfully, you would use the WorkGroupServer option to specify an activation server. On Tableau Desktop on macOS, you would use the WorkgroupServer option. On macOS, this option is case sensitive and uses a lowercase "g".

Change login-based license management settings on Tableau Desktop by editing the registry

If Tableau Desktop is already installed, you can change login-based license management settings by editing the Windows registry.

To turn off login-based license management:

reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR /f /v LBLM /d disabled

To make login-based license management the only login option:

reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR /f /v LBLM /d required

Or, you can enable, disable, or require login-based license management by editing the registry directly:

  1. As an administrator on the computer running Tableau Desktop, make a backup of the registry file before you make any changes to it.

  2. Edit the registry, and in HKEY_LOCAL_MACHINE\SOFTWARE\Tableau, find the hive named ATR and modify the LBLM value to reflect the desired setting:

    1. Name: LBLM.

    2. Data: enabled, disabled, or required.

  3. Restart Tableau so the changes take effect.
Change login-based license management settings on Tableau Desktop on macOS

To change login-based license management settings on macOS, run the following commands in a terminal window to update the preferences file, and then install or restart Tableau Desktop.

To turn off login-based license management:

sudo defaults write /Library/Preferences/com.tableau.ATR LBLM "disabled"

To make login-based license management the only login option:

sudo defaults write /Library/Preferences/com.tableau.ATR LBLM "required"

To set the default URL for the Tableau Server you want user to use for activation when using login-based license management on macOS.

First time activation:

sudo defaults write /Library/Preferences/com.tableau.ATR LBLM "required"

Subsequent activations:

sudo defaults write /Library/Preferences/com.tableau.Tableau-<version> Settings.WorkgroupServer "https://<tableau_server_url>"

Note: On Tableau Desktop on macOS, you would use the WorkgroupServer option. On macOS, this option is case sensitive and uses a lowercase "g".

Login-based license management settings

You use the following settings to change login-based license management, set the ATR duration, and set the activation server URL.

Setting Value Description
LBLM enabled, disabled, or required

Set to enabled (the default), the licensing screens will present the two options for activation (product key, or credentials).

Set to disabled, login-based license management will not appear on the licensing screens.

Set to required, login-based license management is the only way to activate the Tableau Desktop (when the licensing screen appears, it will offer only the credentials option for activation).

Note: When LBLM is set to enabled or required, reporting is also enabled.
ATRREQUESTEDDURATIONSECONDS 1209600

Sets the authorization to run (ATR) duration (in seconds), which is the length of time that an instance of Tableau Desktop and Tableau Prep Builder is authorized to run. The default is 1209600 seconds (14 days). Do not use commas as separators in the value.
ACTIVATIONSERVER

http://<tableau_server_url>

 For first time activation, sets the default URL for the Tableau Server you want users to use for activation.
WorkGroupServer (Windows) WorkgroupServer (macOS)

http://<tableau_server_url>

For updates to the Windows registry or macOS plist, sets the default URL for the Tableau Server you want users to use for activation.

Note: On Tableau Desktop on macOS, you would use the WorkgroupServer option. On macOS, this option is case sensitive and uses a lowercase "g".
REPORTINGFREQUENCYSECONDS 3600 Sets the default (in seconds) for how often the login-based license management report is sent to Tableau Server or Tableau Cloud. The minimum setting is 60 seconds, and the default is 3600 seconds (one hour). Change this setting to reduce the load on Tableau Server or to reduce network traffic. No matter what the authorization-to-run (ATR) lease duration is set to, REPORTINGFREQUENCYSECONDS sets the time interval that the Tableau Desktop or Tableau Prep Builder client report login-based license management activations back to Tableau Server or Tableau Cloud.
Additional configuration for virtual deployments

Tableau Desktop and Tableau Prep Builder periodically contact Tableau Cloud or Tableau Server to verify that Tableau is authorized to run, based on its license. Tableau Cloud or Tableau Server then contacts the ATR service to verify the license and the length of the authorization window.

When configuring a virtual (non-persistent) deployment of Tableau Desktop or Tableau Prep Builder, the duration time should be set to one of the lower values such as 4 or 8 hours in order to avoid an over-use activation error message. After the virtual machine (VM) is returned, the ATR service will handle the activation monitoring.

The following flags should be used on a source image prior to publishing Tableau Desktop to end users. Each end user will be activating the software by logging into Tableau Server or Tableau Cloud with each new VM delivered. No product keys need to be entered if the end user is a Tableau Creator on Tableau Server or Tableau Cloud.

If you are using login-based license management for Tableau Desktop or Tableau Prep Builder on a VM, you may get an error message that your license information has changed whenever you launch a new VM for Tableau Desktop or Tableau Prep Builder. This error forces a restart, which then asks you to register Tableau Desktop again. This error occurs because the ATR service sends a new token that doesn’t match the license cache.

Microsoft Windows

To prevent the error from occurring on Microsoft Windows, you can use the SYNCHRONOUSLICENSECHECK and SILENTLYREGISTERUSER options with the Windows installer. For example:

tableau-setup-std-tableau-2020 SYNCHRONOUSLICENSECHECK="true" SILENTLYREGISTERUSER="true" ATRREQUESTEDDURATIONSECONDS=14400

or

tableauDesktop-64bit-2020-1-0.exe /quiet /norestart ACCEPTEULA=1 ATRREQUESTEDDURATIONSECONDS=14400 ACTIVATIONSERVER=http://<tableau_server_url> SYNCHRONOUSLICENSECHECK="true" SILENTYLYREGISTERUSER="true"

If Tableau Prep Builder and Tableau Desktop are being delivered on one Virtual Desktop, ATRREQUESTEDDURATIONSECONDS only needs to be set during Tableau Desktop installation. However, if you plan to install Tableau Prep Builder as a stand-alone, you'll need to set ATRREQUESTEDDURATIONSECONDS during Tableau Prep Builder installation.

Or, you can edit the following registry keys on the source image:

Reg key path: HKLM\SOFTWARE\Tableau\<Tableau version>\Settings\

Reg key (String value, need to set to true to make that feature enabled)

SynchronousLicenseCheck

SilentlyRegisterUser

macOS

To prevent the error from occurring on macOS, run the following command to set the LicenseCache.Desktop flag to 'false'.

sudo defaults write ~/Library/Preferences/com.tableau.Tableau-<version>.plist LicenseCache.Desktop false

(Optional) Step 3: Change the authorization to run (ATR) duration

The login-based license management default settings for the authorization to run (ATR) duration are appropriate for most environments, but you can change these default settings if needed. Login-based license management uses the default authorization to run (ATR) duration of 1209600 seconds (14 days), which is the length of time that an instance of Tableau Desktop and Tableau Prep Builder is authorized to run. This means that after the initial authorization, you could use Tableau without any network connection for 14 days before the activation expired.

The default duration value for login-based license management is not appropriate for delivering a non-persistent VM delivery solution to end users. The ATR duration should be lowered to 4 or 12 hours depending on VM use. When a new VM is delivered to an end user, a new authority to run token will be created. When the VM is returned, this token is also returned and is able to be used on the new VM authorization to run request.

Note: Login-based license management uses the following hierarchy when determining ATR duration.

  1. ATR Service – Establishes the minimum (4 hours/14400 seconds) and maximum (90 days/7776000 seconds) ATR durations applicable to all users/installations. It specifies the default ATR duration (14 days/1209600 seconds) if nothing is specified by Tableau Server or Tableau Desktop.
  2. Tableau Server - Can optionally specify a maximum or default ATR duration (licensing.login_based_license_management.max_requested_duration_seconds or licensing.login_based_license_management.default_requested_duration_seconds) for all Tableau Desktop installations. Using these ATR duration settings, you can globally set the default ATR duration and maximum ATR duration for all Tableau Desktop clients, which eliminates the need to individually sign in to each Tableau Desktop client to set the ATR duration. The ATR Service maximum setting can be between the minimum of 4 hours (14400 seconds) and maximum of 90 days (7776000 seconds).
  3. Tableau Desktop – Can optionally specify the ATR duration (ATRREQUESTEDDURATIONSECONDS) for the computer on which it is installed. If necessary, you can change the default ATR duration (14 days/1209600 seconds) to a setting within the ATR Service minimum (4 hours/14400 seconds) and maximum (90 days/7776000 seconds). This local ATR duration overrides any durations set by the ATR Service or Tableau Server. However, this default ATR duration cannot be more than the maximum ATR duration set on Tableau Server.
Change the ATR duration for Tableau Desktop or Tableau Prep Builder using Tableau Server

On Tableau Server, you use the Tableau Services Manager (TSM) command line utility to set the ATR duration.

To set the ATR duration, at a command prompt, type:

tsm configuration set -k licensing.login_based_license_management.default_requested_duration_seconds -v <value in seconds>

tsm pending-changes apply

To set the ATR maximum duration, at a command prompt, type:

tsm configuration set -k licensing.login_based_license_management.max_requested_duration_seconds -v <value in seconds>

tsm pending-changes apply

Change the ATR duration on Tableau Desktop by editing the registry

To use a duration length other than the default of 14 days/1209600 seconds, update the ATRRequestedDurationSeconds registry setting. For example:

  1. As an administrator on the computer running Tableau Desktop, make a backup of the registry file before you make any changes to it.
  2. Edit the registry, and in HKEY_LOCAL_MACHINE\SOFTWARE\Tableau\ATR, update the ATRRequestedDurationSeconds as follows (0 uses the default setting):

    1. Name: Find the string value named ATRRequestedDurationSeconds.

    2. Data: Update the number of seconds the duration should last. For example, add 43200 to set a duration of 12 hours.

  3. Restart Tableau so that the changes take effect.
Change the ATR duration on Tableau Desktop on macOS

To use a duration length other than the default of 14 days/1209600 seconds, include the ATRRequestedDurationSeconds preferences setting. For example:

sudo defaults write /Library/Preferences/com.tableau.ATR ATRRequestedDurationSeconds -string "43200"

Step 4: Activate Tableau Desktop

The 2020.1 and later versions of both Tableau Desktop for Windows or macOS support login-based license management.

  1. Run Tableau Desktop setup.

  2. The Activate Tableau screen will include the Activate by signing in to a server option.

  3. Click Activate by signing in to a server and then do one of the following:

    • If you're using Tableau Cloud, click the Tableau Cloud link.

    • If you're using Tableau Server, enter the Tableau Server URL, and then click Connect.

    When prompted, enter valid credentials for a user with a Creator role subscription, and then click OK.

View login-based license usage

You can view login-based license usage for Tableau Cloud or Tableau Server. The report shows users, hosts, user role, product, version, activations, Creator seats in use, Creator seats not in use, and when a Creator seat was last used. You can view data for the past 30 days up to a maximum of 183 days.

To view the Login-based license management License Usage administrative view:

  1. In Tableau Cloud or Tableau Server, in the navigation pane, click Site Status.

  2. On the Site Status page, click Login-based License Usage.

  3. Optional. On the report screen, you can change the time window to show when seats were last used, filter on actions, filter on user name, and sort by columns.

Troubleshooting

You may encounter one of the following error messages while using login-based license management. Use the information below to resolve the issue.

Login-based license management is not enabled on Tableau Server

If login-based license management is available as an activation option on Tableau Desktop, but not enabled on Tableau Server, or if Tableau Server does not have a login-based license management capable license, the following error message may be displayed:

Login-based license management is not enabled on the server you connected to. Select a different server to connect to, use a product key to activate your license, or start a trial to begin working immediately.

Contact your administrator to ensure that you’re using a Tableau Server product key that’s enabled for login-based license management. To verify that you have activated the appropriate product key, in the TSM web UI click Configuration, and then click Licensing. For guidance on activating licenses, see tsm licenses activate. Login-based license management should be enabled by default unless it was previously turned off by the server administrator.

Login-based license management is not enabled on Tableau Desktop

If login-based license management is not enabled on Tableau Desktop, you will not have the option to activate Tableau using your credentials. Prior to version 2020.1, the ability to use login-based license management on Tableau Desktop is not turned on as a default. Check the Tableau Desktop version to ensure the correct version is being used.

If the login-based license management option has been turned off during installation or with an update, see Step 2: Enable login-based license management(Link opens in a new window).

Product key expiration date doesn't change after purchasing a year subscription

After purchasing a renewal of Tableau Server, and the new subscription term is reflected in Tableau Server, it may take up to 24 hours before the new expiration date appears in Manage Product Keys on Tableau Desktop.

You do not have a Creator license

When attempting to activate from Tableau Desktop, the following error message may be displayed:

You do not have a Creator license. Contact your administrator to obtain one.

This error is displayed if you have not been assigned a Creator role. If you belong to multiple sites on Tableau Cloud or Tableau Server, you need to sign in to the site where you have the Creator role when using login-based license management. Otherwise you'll get this error.

To verify that the product key you have activated on the server includes Creator licenses, open the TSM web UI and click Configuration, and then click Licensing.

You have activated the maximum number of computers

When attempting to activate from Tableau Desktop, the following error message may be displayed:

You have activated Tableau the maximum number of times allowed under your account. You must wait for the license activation on another computer to expire before you can activate Tableau again.

This error is displayed when you activated Tableau from multiple computers with the same Creator user credentials and exceeded the maximum number of activations. You must wait until the authorization-to-run (ATR) token expires on one of the existing computers before attempting to activate a new computer. If you are using non-persistent virtual machines (VMs), you can shorten the ATR duration to prevent this error from occurring again.

To shorten the ATR token duration for maximum activation

If you encounter this maximum use error when using a non-persistent virtual deployment, it is possible to shorten the ATR duration to 4 hours (14400) seconds to avoid the error in the future. Alternatively, instead of changing the duration on an individual desktop, you can set the default duration on Tableau Server to affect all users.

The following steps shorten the lease on a computer previously activated with login-based license management that will no longer be used, in order to free up a seat to be activated on a new computer:

  1. Open a Command Prompt as an administrator on a Tableau Desktop computer that will no longer be used.

  2. Navigate to the Tableau binaries (\bin) directory, using the following command.

    Windows: cd Program Files\Tableau\Tableau <version>\bin

    Mac: cd /Applications/Tableau\ Desktop\ <version>.app/Contents/MacOS

  3. Run the following command to set the duration to 4 hours, in seconds (e.g., 14400).

    Windows: atrdiag.exe -setDuration 14400

    Mac: sudo ./atrdiag -setDuration 14400

  4. Delete the previous ATR token using the following command:

    Windows: atrdiag.exe -deleteAllATRs

    Mac: ./atrdiag -deleteAllATRs

  5. Next, overwrite the existing ATR token. Open Tableau Desktop. Tableau displays the “License has Changed” message. Click Exit to automatically close and reopen Tableau Desktop.

  6. In the registration dialog box, click Activate, and then reactivate Tableau Desktop through Tableau Server using login-based license management, which will overwrite the existing token.

  7. Close Tableau Desktop and wait for the ATR duration to elapse (e.g., 4 hours) so that the ATR token expires and frees-up a user seat. Do not open Tableau Desktop before the ATR duration has elapsed. Check to make sure the ATR duration has elapsed. The ATR token TTL End should show a date and time in the future (e.g., 4 hours from now).

    Windows: atrdiag.exe

    Mac: ./atrdiag

  8. After the ATR token expires and you can successfully sign in to Tableau Server on a new computer.

To return your computer to an unlicensed state

  1. Open a Command Prompt as an administrator.

  2. Navigate to the Tableau binaries (\bin) directory, using the following command:

    cd Program Files\Tableau\Tableau <version>\bin

  3. Run the following command:

    Windows: atrdiag.exe –deleteAllATRs

    Mac: ./atrdiag.exe –deleteAllATRs

Note: This removes only the ATR token from the computer. It does not free-up any of the user seats. The user seat is only freed-up after the deleted ATR token expires.

Your Tableau credentials are invalid

When attempting to activate from Tableau Desktop, the following error message may be displayed:

Your Tableau credentials are invalid. Contact your administrator to reset your account.

This error is displayed when your Tableau license is not recognized. Contact your adminstrator..

Your computer’s clock is not synchronized to the current time

When attempting to activate from Tableau Desktop, the following error message may be displayed:

Your computer’s clock is not synchronized to the current time. Synchronize your computer’s clock to the current time and then try to activate Tableau.

This error is displayed when your computer's clock is not synchronized with the current time. Synchronize your computer’s clock with a time server on the internet or enable automatic time synchronization.

Unable to activate with your credentials

When attempting to activate Tableau, the following error message may be displayed:

Tableau Server cannot verify your licensing information over the internet. Contact your administrator to check your internet connection.

This error is displayed when the port atr.licensing.tableau.com:443 is not open on all Application Server (VizPortal) nodes, or you have a proxy that is not configured properly to forward traffic to Tableau's licensing server.

To diagnose connectivity to Tableau's licensing server, paste the following URL (https://atr.licensing.tableau.com/_status/healthz) into a browser or at a curl command prompt.

Back to top
Thanks for your feedback!Your feedback has been successfully submitted. Thank you!