# Licenses, permission sets and record-level security

*Tableau Next Consultant Study Guide · Basic Setup & Admin · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-next-consultant/basic-setup-and-admin/licenses-permission-sets-and-record-level-security*

How a Tableau Next user gets access: the license and permission set pairs (Unmetered and Legacy) with their Data 360 companions, how admins provision existing users, and how record-level security works through guided setup, Data 360 policies, zero-copy DLOs and Tableau published data sources.

- Certification: Salesforce Tableau Next Consultant
- Exam section: Basic Setup & Admin
- Study guide: https://www.certifyforce.com/study-guide/tableau-next-consultant

**Official exam objective:**

> Identify and apply appropriate access to enable users.

## What the exam expects

- Pick the Tableau Next license and permission set for a user's job, plus the Data 360 permission set that must accompany it (including companion orgs).
- Provision users correctly: who can assign sets, where users must be created, and how licenses are consumed.
- Configure default record visibility in guided setup's Secure Your Data step.
- Choose the record-level security route for a data source: Data 360 policies, zero-copy DLOs, entitlement tables or a Tableau published data source.

Key terms:
- **License:** controls a user's potential access to Tableau Next (similar to a Tableau site license).
- **Permission set:** controls baseline capabilities such as editing assets and Personal Orgs (similar to a Tableau site role).
- **Data 360 policy:** a deny, mask or allow rule in Data Governance that controls access to Data 360 objects, records and fields.
- **Zero-copy DLO:** a Data Lake Object that reads an external source through a connection instead of copying the data.
- **Entitlement table:** a table of record-user pairs used in an allow policy to grant record access.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Admin and Platform Analyst sets | Data Cloud Architect in the Data 360 org | [Permission Sets and Licenses](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_permsets_licenses.htm&type=5&language=en_US) |
| Self-Service and Consumer sets | Data Cloud User in the Data 360 org | [Permission Sets and Licenses](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_permsets_licenses.htm&type=5&language=en_US) |
| Companion org users | Data Cloud One User for every Tableau Next set | [Permission Sets and Licenses](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_permsets_licenses.htm&type=5&language=en_US) |
| Self-Service Analyst | Edit in a Personal Org; view only in production | [Permission Sets and Licenses](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_permsets_licenses.htm&type=5&language=en_US) |
| Limited Consumer | No Home or Studio; embedded assets in Tableau Next Apps for Salesforce only | [Permission Sets and Licenses](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_permsets_licenses.htm&type=5&language=en_US) |
| Assigning Tableau Next sets | Admin set plus Assign Permission Sets | [Assign a Permission Set](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_assign_tableau_permset_to_users.htm&type=5&language=en_US) |
| New users | Create in Setup first, then Provision Existing Users | [Assign a Permission Set](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_assign_tableau_permset_to_users.htm&type=5&language=en_US) |
| Objects without Owner Id | Choose the user-related field that defines ownership | [Guided Tableau Next Setup](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_guided_setup.htm&type=5&language=en_US) |
| View All Records with a deny policy | Metadata visible, restricted contents not | [Data Governance and Sharing](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&type=5&language=en_US) |
| Zero-copy DLO default | Records follow the connection's authentication user | [Data Governance and Sharing](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&type=5&language=en_US) |
| Tableau published data source | Not a DLO; RLS inherited from the PDS | [Data Governance and Sharing](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&type=5&language=en_US) |

## Check yourself

- Why does license planning matter each time a user is given Tableau Next access?
- Where can an admin inspect exactly which permissions each standard set includes?
- How must an entitlement table identify records and users?
- When no policy references record ownership, does Data 360 still show owners their own records?

## Sources

- [Tableau Next Permission Sets and Licenses](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_permsets_licenses.htm&type=5&language=en_US)
- [Assign a User a Tableau Next Permission Set](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_assign_tableau_permset_to_users.htm&type=5&language=en_US)
- [Assign Unmetered Tableau Next Licenses and Permission Sets](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_unmetered.htm&type=5&language=en_US)
- [Manage Tableau Next Users](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_user_setup.htm&type=5&language=en_US)
- [Data Governance and Sharing in Tableau Next](https://help.salesforce.com/s/articleView?id=analytics.tua_governance.htm&type=5&language=en_US)
- [Guided Tableau Next Setup](https://help.salesforce.com/s/articleView?id=analytics.tua_admin_guided_setup.htm&type=5&language=en_US)
- [Step 2: Configure Data Cloud and Enable Tableau Next](https://help.tableau.com/current/tableau-next/en-us/tableau_next_setup_guide_configure_data_cloud.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Tableau Next Consultant pack (USD $19): https://www.certifyforce.com/practice-exams