SaaS Security Administrator's Guide
    : Onboard a Tableau Cloud App to SSPM
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. SaaS Security Administrator's Guide
    4. SaaS Security Posture Management
    5. Onboard SaaS Apps Supported by SSPM
    6. Onboard a Tableau Cloud App to SSPM
    Download PDF

    SaaS Security Administrator's Guide

    Onboard a Tableau Cloud App to SSPM

    Table of Contents

    Onboard a Tableau Cloud App to SSPM

    Connect a Tableau Cloud instance to SSPM to detect posture risks.
    For SSPM to detect posture risks in your Tableau Cloud instance, you must onboard your Tableau Cloud instance to SSPM. Through the onboarding process, SSPM logs in to a Tableau Cloud administrator account. SSPM uses this account to scan your Tableau Cloud instance for misconfigured settings. If there are misconfigured settings, SSPM suggests a remediation action based on best practices.
    During the onboarding process, you will supply Tableau Cloud account credentials to SSPM. SSPM can access the account directly, or through the Okta or Microsoft Azure identity providers. Tableau Cloud requires multi-factor authentication (MFA) to add an extra layer of security to the administrator account.
    To onboard your Tableau Cloud instance, you complete the following actions:

    Collect Information for Connecting to Your Tableau Cloud Instance

    To access your Tableau Cloud instance, SSPM requires the following information, which you will specify during the onboarding process.
    ItemDescription
    UserThe username or email address of the administrator account. The format that you use can depend on whether SSPM will be logging in directly to your account or through an identity provider.
    Required Permissions: The user must be assigned to the Site Administrator Creator role in Tableau Cloud.
    PasswordThe password for the administrator account.
    Site URIYour site URI, which is a unique identifier for your Tableau Cloud site. After you log in to Tableau Cloud, this URI is included as part of the full URL, which has the format <app_subdomain>.online.tableau.com/#/site/<site-URI>/home.
    If you are logging in to Tableau Cloud directly instead of using an identity provider, you will use Tableau Cloud's built-in MFA capability to verify your account by using one-time passcodes. To enable SSPM to generate these one-time passcodes, and you must provide the following additional information:
    ItemDescription
    Tableau 2FA secretA key that is used to generate one-time passcodes for MFA.
    If you are using Okta as your identity provider, you must provide SSPM with the following additional information:
    ItemDescription
    Okta subdomainThe Okta subdomain for your organization. The subdomain was included in the login URL that Okta assigned to your organization.
    Okta 2FA secretA key that is used to generate one-time passcodes for MFA.
    If you are using Azure Active Directory (AD) as your identity provider, you must provide SSPM with the following additional information:
    ItemDescription
    Azure 2FA secretA key that is used to generate one-time passcodes for MFA.
    As you complete the following steps, make note of the values of the items described in the preceding tables. You will need to enter these values during onboarding to access your Tableau Cloud instance from SSPM.
    1. Identify the administrator account that SSPM will use to access your Tableau Cloud instance. The administrator must be assigned to the Site Administrator Creator role in Tableau Cloud. SSPM needs this administrator access to monitor your Tableau Cloud instance.
    2. Determine whether you want SSPM to log in to the administrator account directly by using Tableau Cloud account credentials, or through an identity provider (Okta or Microsoft Azure).
      • For direct login using Tableau Cloud account credentials, complete the following steps:
        Tableau Cloud requires multi-factor authentication (MFA) to add an extra layer of security to the administrator account. If you are logging in to Tableau Cloud directly instead of using an identity provider, complete the following steps to generate an MFA secret key by using Tableau Cloud's built-in MFA capability. Do not complete these steps if you will be accessing the administrator account through an identity provider.
        1. Decide which authenticator app you will use and download it to your cellphone.
          You can use any authenticator app that supports time-based one-time passcode (TOTP) generation. TOTPs are generated from authenticator apps such as Microsoft Authenticator by using an MFA secret key. The key is a shared secret between Tableau Cloud and the authenticator app for generating matching passcodes for verification. Like an authenticator app, SSPM will use the MFA secret key for passcode generation.
        2. Log in to the Tableau Cloud administrator account that you will use for onboarding.
        3. Navigate to your profile settings. To navigate to your profile settings, locate your profile icon in the upper-right corner of the page and select <profile-icon> My Account Settings.
        4. On the Account Settings page, follow the link to Manage MFA Verification Methods.
        5. On the Register a Verification Method page, select One-Time Password Generator.
        6. The Connect an Authenticator App page displays your MFA secret key as a QR code, but do not scan the QR code. Instead, click I Can't Scan the QR Code to display a text version of the MFA secret key.
        7. Copy and paste the text version of the MFA secret key into a text file.
          Do not continue to the next step unless you have copied the MFA secret key. You will provide this key to SSPM during the onboarding process.
        8. Continue configuring your authentication app by scanning the QR code or by manually entering the MFA secret key.
        9. Use your authenticator app to generate a passcode. On the Connect an Authenticator App page, enter the passcode in the Verification Code field and Connect.
      • For Okta log in, complete the following steps to access the administrator account through Okta:
        1. Identify your Okta subdomain.
        2. Generate and copy an MFA secret key.
      • For Microsoft Azure log in, complete the following steps to access the administrator account through Microsoft Azure:
        1. Enable third-party software OATH tokens for the administrator account.
        2. Configure the account for MFA and copy the MFA secret key.
    3. Make note of your Tableau site URI, which is included as part of the full Tableau URL after you log in.
      The URL format is <app_subdomain>.online.tableau.com/#/site/<site-URI>/home. Make note of the <site-URI> portion of the full URL. You will provide this URI to SSPM during the onboarding process.

    Connect SSPM to Your Tableau Cloud Instance

    By adding a Tableau Cloud app in SSPM, you enable SSPM to connect to your Tableau Cloud instance.
    1. From the Add Application page (Posture SecurityApplicationsAdd Application ), click the Tableau tile.
    2. On the Posture Security tab, Add New instance.
    3. Specify how you want SSPM to connect to your Tableau Cloud instance. SSPM can Log in with Credentials, Log in with Okta, or Log in with Azure.
    4. When prompted, provide SSPM with the administrator credentials, the MFA secret key, and the site URI.
    5. Connect.

    © 2024 Palo Alto Networks, Inc. All rights reserved.