> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/human-access/connections-and-integrations/integration-guides/tableau.md).
# Tableau
Connect Tableau to Cakewalk for auto-provisioning with a site administrator account, including your subdomain, account ID and MFA setup.
### :sparkles: Auto Provisioning
| **Authentication method** | Username & password |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Required permissions** | `Site Administrator Creator` or `Site Administrator Explorer` |
| **Required metadata** | `Subdomain`, `Account ID` and `Default Authentication Type for the new users`. See details [here](#where-can-i-find-my-subdomain-and-account-id). |
| **MFA** | Supported, authenticator app only. See details [here](#how-do-i-set-up-mfa). |
Where can I find my Subdomain and Account ID?
Both values are in your browser's address bar once you are signed in to Tableau Cloud. The URL looks like `https://dub01.online.tableau.com/#/site/acme-7d4a2aa394/home`.
1. Sign in to Tableau Cloud.
2. The `Subdomain` is the part before `.online.tableau.com`, so `dub01` in the example above. The field in Cakewalk already supplies `https://` and `.online.tableau.com`, so enter only that middle part.
3. The `Account ID` is the part after `/#/site/`, so `acme-7d4a2aa394` in the example above. This is your Tableau Cloud site ID.
What does Default Authentication Type for the new users do?
This is the sign-in method Tableau assigns to every user Agent Cake provisions. It does not affect how the service account itself signs in.
Choose the option your site already uses for people:
* `Tableau` for TableauID credentials without MFA
* `Tableau with MFA` for TableauID credentials plus a verification method
* `Google OpenID` if your site is configured for Google authentication
Only pick an option your site actually has enabled. Selecting `Google OpenID` on a site without Google configured makes the invite fail.
How do I set up MFA?
Agent Cake generates time-based codes from a shared secret. It cannot approve a Salesforce Authenticator push notification, tap a security key, or use Touch ID, Face ID or Windows Hello. If the service account has MFA, its verification method must be a third-party authenticator app such as Google Authenticator, Microsoft Authenticator or Authy.
**Step 1: set the service account's authentication type**
1. Sign in to Tableau Cloud as a site administrator and go to `Users`.
2. Select the service account.
3. On the `Actions` menu, select `Authentication`, then `Tableau with MFA`.
4. Click `Update`.
**Step 2: register the authenticator app and copy the secret**
1. Sign in to Tableau Cloud as the service account. Tableau prompts you to register a verification method.
2. Choose the third-party authenticator app option. Tableau shows a QR code for scanning.
3. Use the option to display the code as text instead of scanning it, and copy that setup key.
4. Paste the setup key into the `MFA Secret` field in Cakewalk. Scanning the QR code with a phone is not enough, because Cakewalk needs the key itself.
5. Cakewalk now shows a `One-Time Password` under `Verification step (optional)`, along with a countdown to the next code. Copy that code.
6. Go back to Tableau and enter it to complete the registration. This is what pairs the two. Tableau accepts the code only if Cakewalk holds exactly the right secret.
Do not skip step 6, even though Cakewalk labels the verification step optional. It is your only check that the secret arrived intact. A mistyped secret otherwise stays invisible until a provisioning run fails on sign-in.
Once paired, Agent Cake generates valid codes on its own at every sign-in. See [Multi-Factor Authentication](/docs/human-access/how-to-guides/auto-provisioning/how-it-works/multi-factor-authentication.md) for how this works across apps.
{% hint style="warning" %}
**Keep a second way in.** The service account is a site administrator, and Tableau recommends registering at least two verification methods plus recovery codes on administrator accounts. If the service account is your only site administrator and its verification method is lost, only your Tableau account manager can reset it.
{% endhint %}
#### Learn more
* [Tableau: Multi-Factor Authentication and Tableau Cloud](https://help.tableau.com/current/online/en-us/to_security_mfa.htm)
* [Tableau: Set the User Authentication Type](https://help.tableau.com/current/online/en-us/users_set_auth_type.htm)
* [Tableau: Set Users' Site Roles](https://help.tableau.com/current/online/en-us/users_site_roles.htm)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://www.cakewalk.security/docs/human-access/connections-and-integrations/integration-guides/tableau.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.