Loading

Tableau Mobile SAML Authentication Selects Wrong Site When Server Has a Large Number of Sites — AppConfig Workaround

Publish Date: May 27, 2026
Description

On Tableau Server deployments with a large number of sites (for example, 199 sites), the LoginFirstSiteService is responsible for resolving which site to authenticate a mobile SAML user into when no explicit site context is provided in the SAML assertion. With a large site list, this resolution process can take too long to complete, resulting in an authentication failure in Tableau Mobile with an error such as:

 

   "Failed to verify authentication (SiteNames) with [server URL]. error = Unauthorized with Tableau Server"

 

This behavior is not observed on Tableau Server deployments with a small number of sites (e.g., 3 sites), where the site list loads quickly enough for the resolution to succeed.

Resolution

Workaround (Recommended): Configure the default sign-in site explicitly using Intune AppConfig (or the MDM AppConfig equivalent). Set the serverURL key to point directly to the intended first/default site URL. This bypasses the LoginFirstSiteService enumeration entirely and directs Tableau Mobile to the correct site immediately upon authentication.

Example AppConfig key:
Key: AppServiceHosts 
Value: https://[tableau-server-url]/#/site/[default-site-name]

Once the user is authenticated into the configured default site (e.g., <First site name>), they can switch to other sites afterward normally.
No fix is currently planned. This is considered expected behavior, not a defect.

Knowledge Article Number

005384629

 
Loading
Salesforce Help | Article