When Tableau Server uses Active Directory (AD) for authentication, group synchronization imports AD groups and assigns aminimum site role(e.g., Viewer, Explorer) to users in that group. This ensures users meet a baseline access level. The behavior for existing users during sync is:
* If the user's current site role providesmore accessthan the minimum (e.g., Explorer vs. Viewer), their roleremains unchanged.
* If the user's current role providesless accessthan the minimum (e.g., Unlicensed vs. Viewer), their role isupgradedto the minimum.
This preserves higher privileges while enforcing a floor. "Reduces access" means the minimum role is lower than the current role (e.g., Viewer vs. Explorer), in which case the existing role stays.
* Option A (It will change to the minimum site role only if the minimum site role reduces access):
Correct. The user's role changes only if the minimum increases access (e.g., Unlicensed to Viewer); otherwise, it stays higher.
* Option B (It will change only if the minimum provides more access): Incorrect wording. This is the inverse of the actual behavior-change occurs when needed to meet the minimum, not to exceed it.
* Option C (It will always change): Incorrect. Existing higher roles are preserved.
* Option D (It will never change): Incorrect. It changes if the current role is below the minimum.