Administration36% of the exam
Personal access tokens and self-service account settings
How Tableau Server personal access tokens work for REST automation (who creates and revokes them, one session per token, owner privileges, expiry, server administrator impersonation) and which account changes users make themselves in My Account Settings, including passwords and saved credentials.
3.3 Contrast end-user with System-administrator capabilities
~7 min read · 8 practice questions
What the exam expects
- Explain who creates, manages and revokes a personal access token, and what an administrator can and cannot do with another user's token.
- Predict what happens when one token signs in twice, and what privileges a token-based session carries.
- List the prerequisites for server administrator PAT impersonation on Tableau Server 2022.3.
- Decide which account changes a user makes in My Account Settings (password, saved credentials, connected clients) and which belong to the directory or an administrator.
Key terms:
- Personal access token (PAT): a long-lived token, made of a name and a secret, used to sign in to the Tableau REST API without a username and password.
- PAT impersonation: using a server administrator's PAT to sign in to the REST API as another user.
- My Account Settings: the page each user opens from their profile image to manage their own credentials and preferences.
- Saved credentials: passwords and OAuth access tokens Tableau stores for a user's data connections.
- Connected client: a refresh token stored when a user first signs in from Tableau Desktop, Prep Builder or Mobile.
Key facts
PAT creation
- Detail
- Users create their own; administrators cannot create PATs for users
Secret visibility
- Detail
- Shown once, then inaccessible after the dialog is dismissed
Concurrent sign-in
- Detail
- Reusing a PAT ends its previous session, on any site
Session privileges
- Detail
- Same access and privileges as the PAT owner
Not for
- Detail
- Generic client access to the web UI or TSM
Admin revocation
- Detail
- Server or site admin, user profile > Settings tab > Revoke
Password resets
- Detail
- Don't disrupt PAT-based automation
Impersonation
- Detail
- 2021.1 and later; server admin PATs;
tsm authentication pat-impersonation enablethen apply
Change Password in account settings
- Detail
- Local Authentication only, not Active Directory
Deleting an embedded OAuth token
- Detail
- Scheduled extract refreshes fail until new credentials are embedded
TSM sign-in
- Detail
- Needs administrative rights on the computer running TSM
- How many PATs can one Tableau Server user hold by default?
- When can Tableau Server users on a site with site-specific SAML change their own email address?
- Why must users recreate notification settings after upgrading from 2020.4 or earlier to 2021.1 or later?
- What happens to an expired PAT on the My Account Settings page?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Tableau Server Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 34 lessons of the Tableau Server Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (8 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both