# Configuration keys, identity pools and recovery design

*Tableau Architect Study Guide · Design a Tableau Infrastructure · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-architect/design-a-tableau-infrastructure/configuration-keys-identity-pools-and-recovery-design*

Recommend a Tableau Server configuration: identity stores and identity pools, the TSM keys that govern sessions, schedules, spooling, failing jobs, query time and ports, security choices for traffic and extracts, hardware and network specifications, and a disaster recovery strategy covering snapshot backups, settings export gaps and backup file paths.

- Certification: Salesforce Tableau Architect
- Exam section: Design a Tableau Infrastructure
- Study guide: https://www.certifyforce.com/study-guide/tableau-architect

**Official exam objective:**

> 1.5 Recommend a Tableau Server configuration: 1.5.1 Recommend an appropriate identity store and authentication configuration; 1.5.2 Recommend specific configuration keys and values to suit a given use case; 1.5.3 Recommend a configuration to address security requirements such as encryption at rest and encryption over the wire; 1.5.4 Recommend hardware and network specifications; 1.5.5 Create a disaster recovery strategy.

## What the exam expects

- Recommend an identity store and authentication configuration, adding identity pools when users cannot live in the initial store.
- Recommend configuration keys and values for sessions, serial schedules, Hyper spooling, failing jobs, view-update time and reserved ports.
- Recommend security settings for traffic over the wire (repository SSL) and extracts at rest, with their capacity cost.
- Recommend hardware and network specifications, including the documented exceptions for dedicated nodes.
- Create a disaster recovery strategy: snapshot backups, what settings export leaves out, and backup file locations.

Key terms:
- **Initial pool (TSM configured)**: the identity store and authentication chosen in TSM at setup; it cannot be modified.
- **Identity pool**: an optional, server-level group of users with its own identity store and OIDC authentication.
- **Repository SSL**: TLS between the PostgreSQL repository and other components, optionally for direct clients too.
- **Snapshot backup**: the External File Store backup that pairs a network-share snapshot with a repository backup file.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Identity pool authentication | OIDC only | [Identity Pools](https://help.tableau.com/current/server/en-us/identity_pools.htm) |
| Identity pool scope | Server-level; not site-scoped | [Identity Pools](https://help.tableau.com/current/server/en-us/identity_pools.htm) |
| Session lifetime | Needs `apply_lifetime_limit=true`; minutes | [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm) |
| Site-level serial schedules | `backgrounder.restrict_serial_collections_to_site_level=true` | [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm) |
| Total spooling cap | `hyper.global_file_partition_size_limit`; 0 = unlimited | [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm) |
| View-update limit | `vizqlserver.querylimit`, seconds, default 1800 | [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm) |
| Repository SSL default | Off for all connections | [Repository SSL](https://help.tableau.com/current/server/en-us/ssl_config_postgres.htm) |
| Enforce mode | Encrypts existing extracts through Backgrounder jobs | [Extract Encryption at Rest](https://help.tableau.com/current/server/en-us/security_ear.htm) |
| Dedicated Backgrounder hardware | 4 cores may suffice for up to two instances | [Minimum Hardware](https://help.tableau.com/current/server/en-us/server_hardware_min.htm) |
| Dynamic port range | 8000-9000 by default | [TSM Ports](https://help.tableau.com/current/server/en-us/ports.htm) |
| Not in settings export | Mutual SSL certificate and key; repository-access passwords | [Full Backup and Restore](https://help.tableau.com/current/server/en-us/backup_restore.htm) |
| External File Store backup | Snapshot backup, not `tsm maintenance backup` | [Snapshot backups](https://help.tableau.com/current/server/en-us/server_external_filestore_storage_backup_restore.htm) |
| Changing a basefilepath | Existing files are not moved | [tsm File Paths](https://help.tableau.com/current/server/en-us/cli_default_filepaths_tsm.htm) |

## Check yourself

- When does Tableau Server install only one instance of every process by default?
- Why should an absolute browser-session limit leave room for the longest extract uploads?
- What does Tableau advise about running other resource-intensive applications on a Tableau Server host?
- When you choose a new `basefilepath.backuprestore` location, which kind of location is not allowed?

## Sources

- [Identity Store](https://help.tableau.com/current/server/en-us/plan_identity_store.htm)
- [Provision and Authenticate Users Using Identity Pools](https://help.tableau.com/current/server/en-us/identity_pools.htm)
- [tsm configuration set Options](https://help.tableau.com/current/server/en-us/cli_configuration-set_tsm.htm)
- [Security Hardening Checklist](https://help.tableau.com/current/server/en-us/security_harden.htm)
- [Configure SSL for Internal Postgres Communication](https://help.tableau.com/current/server/en-us/ssl_config_postgres.htm)
- [Extract Encryption at Rest](https://help.tableau.com/current/server/en-us/security_ear.htm)
- [Minimum Hardware Requirements and Recommendations for Tableau Server](https://help.tableau.com/current/server/en-us/server_hardware_min.htm)
- [Tableau Services Manager Ports](https://help.tableau.com/current/server/en-us/ports.htm)
- [Perform a Full Backup and Restore of Tableau Server](https://help.tableau.com/current/server/en-us/backup_restore.htm)
- [Backup and Restore with External File Store](https://help.tableau.com/current/server/en-us/server_external_filestore_storage_backup_restore.htm)
- [tsm File Paths](https://help.tableau.com/current/server/en-us/cli_default_filepaths_tsm.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Tableau Architect pack (USD $19): https://www.certifyforce.com/practice-exams