# Content security from site to workbook level

*Tableau Server Administrator Study Guide · Install & Configure · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-server-administrator/install-and-configure/content-security-from-site-to-workbook-level*

Where each security control lives on Tableau Server: site switches for web authoring and Explain Data, project locking and project leaders, ownership and moves, effective permissions for users and groups, published data source access and database authentication modes, and workbook, view, collection and external asset permissions.

- Certification: Salesforce Tableau Server Administrator
- Exam section: Install & Configure
- Study guide: https://www.certifyforce.com/study-guide/tableau-server-administrator

**Official exam objective:**

> 2.4 Security: 2.4.1 Describe the security configuration for: 2.4.1.1 Site level, 2.4.1.2 Project level, 2.4.1.3 Group level, 2.4.1.4 User level, 2.4.1.5 Data source level, 2.4.1.6 Workbook level.

## What the exam expects

- Identify the site settings (Web Authoring, Explain Data availability) that gate a feature before any permission rule matters.
- Choose a project's asset-permissions setting and predict how Default, project leaders, ownership and moves behave.
- Read effective permissions for a user who belongs to several groups or owns the content.
- Decide how a workbook reaches a published data source and which database authentication mode gives per-user security.
- Configure workbook, view, collection and external-asset permissions.

Key terms: **asset permissions** (a project's Locked or Customizable setting); **project leader** (a user or group with administrator-like access to one project hierarchy); **managing project** (the project whose rules govern a locked hierarchy); **effective permissions** (what a user can actually do after site role, ownership and every rule are evaluated); **Connect** (the data-source capability to query a published data source).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Web Authoring site setting | Off means no browser editing, whatever Web Edit says | [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm) |
| Run Explain Data | Unspecified by default; reset to Allowed for 2022.1 workbooks | [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm) |
| New top-level project | Copies Default's rules, not its lock; starts Customizable | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |
| Removing a project leader | Only where assigned; rule becomes all Unspecified | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |
| Project owner change | By the owner or an administrator, even when locked | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |
| Moved out of a nested-locked parent | Becomes Locked (including nested) and the managing project | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |
| Group conflict | A group Deny beats a group Allow | [Effective permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm) |
| Prompt users | The viewer's own Connect is checked | [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm) |
| Web editing | Needs the editor's own Connect | [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm) |
| Move capability | Alternative to ownership for workbooks and flows only | [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm) |
| Impersonation modes | Per-user database security; avoid user filters | [Data Security](https://help.tableau.com/current/server/en-us/security_data.htm) |
| Collections | Their permissions grant nothing on linked content | [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm) |

## Check yourself

- How many owners and project leaders can one project have?
- Why can't the capabilities in a project leader's rule be edited?
- When does a nested project's permissions dialog lack the Asset permissions Edit link?

## Sources

- [Permissions](https://help.tableau.com/current/server/en-us/permissions.htm)
- [Manage Permissions with Projects](https://help.tableau.com/current/server/en-us/permissions_projects.htm)
- [Permission Capabilities and Templates](https://help.tableau.com/current/server/en-us/permissions_capabilities.htm)
- [Effective permissions](https://help.tableau.com/current/server/en-us/permission_effective.htm)
- [Data Security](https://help.tableau.com/current/server/en-us/security_data.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 21 linked practice questions, and unlimited timed mock exams are included with the Tableau Server Administrator pack (USD $19): https://www.certifyforce.com/practice-exams