TSA Exit Acceleration
Off the seller’s Tableau site. With the numbers intact.
Fixed-fee proposal in 48 hours. Senior team on day one. The first conversation is always free.
Tableau TSA separation is the work of standing up a Newco site or deployment, migrating the workbooks and data sources, repointing every connection at Newco data, and rebuilding security before the seller cuts access. The work sits inside the broader carve-out advisory program because the analytics layer is where executives and operators actually consume the numbers, and a broken dashboard on Day One is visible to everyone.
Tableau separation starts with an inventory of the seller environment. The buyer needs to know whether the seller runs Tableau Cloud or Tableau Server, the site structure, the project hierarchy, the published workbooks and data sources, the flows in Tableau Prep, and the license counts by role. It needs the data connection inventory: which workbooks connect to which warehouses, databases, and extracts, and which use live connections versus scheduled extract refreshes.
The seller typically runs Newco analytics inside a shared site or a shared server, with content organized by project. If the seller runs Tableau Cloud, a dedicated Newco site is the minimum and a separate Newco deployment is the clean end state. If the seller runs Tableau Server, Newco stands up its own server or moves to Tableau Cloud. A shared site is a bridge during the TSA only, because content, security, and refresh schedules stay under seller control otherwise.
Target strategy is shaped by where Newco wants the analytics platform to live and by the underlying data. The choice between Tableau Cloud and a self managed server affects who runs the infrastructure, how identity integrates, and the long term cost. The decision is made early because it drives the migration mechanism and the cutover plan.
A clean inventory and a settled site decision drive the downstream sequence: content migration, data source repointing, security rebuild, and consumer cutover. The pattern aligns with the broader Tableau and Power BI separation framework and the carve-out data plan.
Tableau is sold by Salesforce as role based subscriptions covering Creator, Explorer, and Viewer licenses. The seller agreement does not transfer in a carve-out. Newco signs a direct subscription sized to its real user population by role. The buyer counts active users by role from the seller environment rather than the licensed seats, because carve-outs routinely carry more licenses than active users and Newco should not inherit that waste.
Salesforce reads a carve-out as a buyer with a deadline. Leverage comes from a credible alternative, including the sibling platforms Newco might consolidate onto, and from term length, price holds, and ramp structure. Where Newco runs multiple BI tools across the inherited estate, the separation is the moment to decide whether to standardize, and that decision strengthens the negotiating position with each vendor.
Where the seller hosts Newco analytics through a TSA period, the pricing is cost-plus or fixed-fee with a defined exit ramp. The seller cannot mark up subscription costs it does not incur, and the TSA defines how shared infrastructure, if any, is allocated so Newco does not absorb seller overhead.
Where a partner is engaged for the migration, the contract is fixed fee for defined deliverables with disciplined change control. The audit discipline runs through the broader TSA license consolidation work so Newco rationalizes its BI spend at exit.
Content migration moves workbooks, published data sources, and Prep flows from the seller environment to the Newco environment. The mechanisms include direct export and republish, the Content Migration Tool for Server, and the REST API for scripted bulk moves. The buyer prioritizes the content that matters: the executive dashboards, the operational reports, and the certified data sources, rather than treating every abandoned workbook as worth migrating.
Data source repointing is the heart of the work. Every workbook and published data source connects to underlying data, and those connections point at the seller's warehouses, databases, and extracts. Each connection is repointed at the Newco data source with Newco credentials. Where the underlying warehouse is itself under separation, the Tableau repointing waits on that data platform exit, which is why the analytics layer cannot finish ahead of the data it reads.
Embedded credentials and service accounts are reissued rather than copied. A workbook that authenticates to the seller's warehouse with a seller service account breaks the moment that account is revoked, so the buyer inventories every embedded credential and replaces it with a Newco credential before cutover.
Extract refresh schedules and subscriptions are recreated in the Newco environment. Scheduled extracts, alert driven subscriptions, and data driven alerts are rebuilt so the cadence of reporting matches what users expect. The discipline mirrors the broader TSA exit data migration strategy.
The security model is rebuilt rather than copied. Tableau permissions operate at the project, workbook, and data source level, and they are reconstructed in the Newco environment to match a standalone governance posture. Group membership is rebuilt from Newco's directory rather than carried over from the seller's groups, because seller groups carry seller users who should not exist in the Newco site.
Row level security is the most consequential piece. Where the seller used user filters or row level security to limit what each user sees, that logic is rebuilt against Newco's user attributes and entitlement tables. A row level security error exposes data to the wrong audience, so this is validated explicitly before any dashboard is opened to its full audience.
Governance content carries over deliberately. Certified data sources, data source descriptions, and the curated project structure are recreated so users can still find trusted content. Where the seller maintained a data catalog or governance layer, the equivalent is established in the Newco environment so analysts are not left guessing which data source is authoritative.
Identity is the final piece. Single sign on and provisioning are configured against Newco's identity provider so users authenticate cleanly and licenses map to the right roles from the first login.
Cutover moves users from the seller environment to the Newco environment. The runbook covers the final content sync, the freeze on changes in the seller site, the repointing of any remaining connections, the user notification, and the validation gate. Because analytics is read only consumption rather than transaction processing, the cutover often runs as a controlled switch with a short overlap where both environments are available for verification.
Validation confirms parity. Key dashboards are compared side by side between the seller and Newco environments for the same period to confirm the numbers match. Extract refreshes are confirmed to run on schedule and to produce current data. A report that drives executive decisions cannot be declared migrated until its numbers reconcile against the source.
Stabilization runs thirty to forty five days. Failed refreshes, broken connections, and permission gaps are triaged within agreed service-level commitments. User adoption is supported with quick reference guidance during the first weeks. Only after a clean reporting cycle does the buyer certify the analytics platform for TSA exit.
Decommissioning is explicit. Once the Newco environment is validated and the TSA tail closes, the seller removes Newco content and revokes access so Newco workbooks and data no longer persist in the seller site.
Tableau separation cost is driven by content volume, the number of data connections to repoint, and the row level security complexity. The discipline is to migrate the content that matters rather than every dormant workbook, and to right size the license count to active users by role. Carrying forward unused Viewer and Explorer seats is a recurring cost that the separation should eliminate, not preserve.
The common failure mode is sequencing Tableau ahead of its data. The analytics layer reads from warehouses and databases, and if those are repointed after Tableau, the migrated workbooks point at nothing. Buyers that sequence the BI exit after the underlying data platforms avoid the broken dashboard that greets users on Day One.
The second failure mode is treating row level security as an afterthought. A migration that copies workbooks but rebuilds security loosely can expose data to the wrong audience. The fix is to validate row level security against named users before opening any dashboard broadly. A PMO maintains the dependency map across the BI tools and the data sources, escalating blocks inside forty eight hours.
A clean Tableau separation produces a Newco that owns its own analytics environment, its own security model, and its own license footprint, with the optionality to consolidate BI tools on its own timeline. The discipline runs through the TSA exit acceleration program under a Fixed Fee plus Portfolio Retainer engagement model.
If the seller runs Tableau Cloud, a dedicated Newco site is the minimum and a separate Newco deployment is the clean end state. If the seller runs Tableau Server, Newco stands up its own server or moves to Tableau Cloud. A shared site is a bridge only, not a steady state.
Workbooks, data sources, and flows are exported and republished, or moved through the Content Migration Tool and the REST API. The harder work is repointing every data connection at Newco data sources and rebuilding row level security and permissions in the new environment.
Data connections and embedded credentials. A workbook that still points at the seller's warehouse or uses a seller service account fails the moment those are revoked. Every connection is inventoried and repointed before the seller access is cut.
Tableau usually exits in two to five months, but the timeline is set by the underlying data sources. Tableau cannot finish its exit before the warehouses and databases it reads from have been separated and repointed.
Tenant and workspace strategy, dataset repointing, and the RLS rebuild.
Read the article →Instance strategy, the LookML model move, and connection repointing.
Read the article →The combined BI separation framework and how to sequence behind the data.
Read the article →The 90-day governance, IT, finance, HR and procurement separation plan we run on live carve-outs. Get the playbook plus the bi-weekly Day One Letter — short, signal-heavy, buyer-side.
No spam. Unsubscribe in one click. · Read the overview first →
Fixed-fee proposal in 48 hours. Senior team on day one. The first conversation is always free.
Seven buyer-side moves to exit a Transition Services Agreement on time and below budget. The mark-up, the extension-fee curve, exit sequencing, and the 11-month calendar.
One tactic, one benchmark, or one pattern from a recent buyer-side engagement. Short. Signal heavy. Free.
Subscribe to The Day One Letter →Scope the data split tightly. Every table you over-migrate and every pipeline you leave on the seller is a line on next year's TSA invoice.