Tableau - Service Principal access

[yit337]

Can I access Tableau with Service Principal by OAuth, or I have to create Personal Access Token for the SP?
I can't find this in the docs..

[bianca_unifeye]

https://learn.microsoft.com/en-us/azure/databricks/partners/bi/tableau

You will need a token, please read best practices in the article above.

[yit337]

@bianca_unifeye 
I'm aware of the best practices. What confuses me is that when I open Tableau, I have two options to authenticate - OAuth and PAT. Currently I'm using the PAT generated from the Service Principal. But, when I try to login with the OAuth, it logs me with my user account, not the Service Principal. So, my question is: is it possible to login in Tableau with OAuth as Service Principal? Or do I have to create PAT for the SP, and login with it?

Best practices are to use OAuth to authenticate in Tableau - but how to do it for Service Principal?!

[bianca_unifeye]

• If your requirement is “Tableau refreshes and access should not depend on any person”, then PAT for the SP (with rotation + least privilege) is typically the right approach.

• If your requirement is “each Tableau user should access data as themselves”, then OAuth (user identity) is the right approach.

OAuth in Tableau generally cannot “log in as a Service Principal” because OAuth is tied to a user authorization step; Service Principals are meant for headless flows, and Tableau’s OAuth UX doesn’t target that scenario. PAT is the standard workaround for SP/non-user accounts.

[KartikBhatnagar · Accepted solution]

In Tableau’s Databricks connector, OAuth is user-based (U2M) — it always logs in as a person via SSO. It does not support logging in as a service principal through the interactive OAuth flow.
If you need a non-human identity (e.g., for scheduled refresh or to avoid dependency on a user account), you must use a PAT generated for the service principal/Headless (or a service principal–based token). OAuth in Tableau is not designed for SP login.