--- schema_version: "1" id: 02948cd30325b0ee14ad932f696d73129284705ad58ac4287d09b224a760f902 title: Grant Role on Sign-in (Grant Licence on Sign-in) collection: tableau version: next locale: en-gb portal_url: https://docs.salesforce.com/tableau/next/en-gb/online/grant_role.md canonical_url: https://help.tableau.com/v0.0/online/en-gb/grant_role.htm source_site: help.tableau.com content_type: documentation content_hash: 6f1f840783bc978bad00ecc434bb6c9dae42f4b78a289bff0c23ff62d9ed3644 description: Use Grant role on sign in to license users in groups when they sign in to a site. --- [Skip to main content](#main-content) # Grant Licence on Sign-in Grant licence on sign in (Grant role on sign in) lets unlicensed users in specific groups become licensed when they sign into a Tableau site. This streamlines licence provisioning for administrators and removes the user’s need to request a licence before using Tableau. For more information about site role capabilities and minimum site roles, see [Set Users’ Site Roles](https://help.tableau.com/v0.0/online/en-gb/users_site_roles.htm). For example, imagine that your company has 100 people in the Marketing group, but only 25 members need to access Tableau Cloud. The Tableau Cloud site administrator isn't sure which 25 need Tableau. That administrator can create a Marketing user group with an Explorer minimum site role, select Grant role on sign in, and add all 100 Marketing members to the group. Instead of provisioning licences to the entire group, the 25 Tableau users in Marketing are provisioned Explorer licences when they sign in to their Tableau Cloud site. Those who don't need Tableau Cloud remain unlicensed unless they sign in. **Note**: For more information about benefits and best practices, see [Grant Role on Sign In](https://help.tableau.com/current/blueprint/en-gb/bp_license_management.htm#grant-role-on-sign-in) in Tableau Blueprint, Tableau's planning tool for data-driven organisations. ## Activate Grant role on sign in You can enable Grant role on sign in on new or existing groups. The following steps walk through how to use Grant role on sign in to add new users that are eligible for a licence but may not consume one. This may be the case when your company has a lot of eligible users, but limited Tableau licences. 1. On a site, add a new group: 1. From the left navigation pane, click **Groups**, and then click New Group. 2. Enter a group name. ![New Group form with options for group name, on-demand access and licensed users.](/tableau/next/en-gb/online/en-gb/Img/online_new_group.png) 3. Optionally and if your site is licensed with [usage-based model](https://help.tableau.com/v0.0/online/en-gb/license_product_keys.htm#embedded-analytics-usagebased-license-model), select the Allow on-demand access check box. For more information, see one of the following: [On-demand access using connected apps with direct trust](https://help.tableau.com/v0.0/online/en-gb/connected_apps_direct.htm) or [On-demand access using connected apps with OAuth 2.0 trust](https://help.tableau.com/v0.0/online/en-gb/connected_apps_eas.htm). 4. Select Grant role on sign in and select a minimum site role for the group. This setting means licences and site roles will only be provisioned to group users who sign into this Tableau Cloud site. 5. Click Create. 2. Add users to a site by entering users’ usernames (in email address format) individually or bulk import users using a CSV file. If bulk adding users, follow the steps described in [Import Users](https://help.tableau.com/v0.0/online/en-gb/users_import.htm) via a CSV file that you create using the [CSV Import File Guidelines](https://help.tableau.com/v0.0/online/en-gb/csvguidelines.htm). ![A Site Admin can add users by email or import from a file.](/tableau/next/en-gb/online/en-gb/Img/users_add_online.png) If adding users by username, do the following 1. On the Users page, click the Add Users button. 2. Enter usernames (in email address format). For information on assigning Google, OIDC, SAML or Salesforce authentication when adding users, see [Add Users to a Site](https://help.tableau.com/v0.0/online/en-gb/sites_addusers.htm). If you add more than one user, separate usernames with a semicolon (;). For example, _tdavis@example.com; jjohnson@example.com; hwilson@example.com_ 3. Set the site role for those users to Unlicensed. 4. Click Add Users. 3. Add those new unlicensed users to the new group. - From the left navigation pane, click **Groups**, and then click the name of the group. - On the Group's page, click **Add Users**. ![Group page showing the Add Users button.](/tableau/next/en-gb/online/en-gb/Img/groups_addusers.png) - Select the users to be added, and then click **Add Users**. For more information, see [Create a Group and Add Users to It](https://help.tableau.com/v0.0/online/en-gb/to_add_users_groups.htm). ## Modifying user roles with Grant role on sign-in If a user is part of a group using Grant role on sign in, then that user role can’t be set to unlicensed or downgraded to a role lower than the minimum site role set for the group, whether or not they sign in. Administrators can upgrade a user’s site role manually, however. To downgrade a user’s site role, or unlicense the user from the site, remove the user from the group(s) that have Grant role on sign-in enabled. In accordance with the terms of the [End User Licence Agreement](https://mkt.tableau.com/legal/tableau_eula.pdf), licences granted on an Authorised User basis may be permanently reassigned to new users. Users may only be downgraded to a lower site role (including Unlicensed) when they will permanently discontinue access to Server Software at the higher role. ## Removing users affected by Grant role on sign-in You can remove a user from a site only if the user does not own content. If you attempt to remove a user who owns content, the user site role will be set to Unlicensed and removed from all groups, but the user will not be removed from the site. To remove content owners, remove owners from group with Grant site role enabled, or reassign content ownership to another user. For more information, see Remove users from a site in the [View, Manage or Remove Users](https://help.tableau.com/v0.0/online/en-gb/users_view.htm) Help topic. If the default All Users group has Grant site role enabled, users who own content can't be removed from the site or unlicensed. To remove or unlicense these users, reassign content ownership to another user, then remove or unlicense the user. Tableau REST API can be used to reassign content ownership of a workbook. For more information, see [Update Workbook](https://help.tableau.com/current/api/rest_api/en-gb/REST/rest_api_ref_workbooks_and_views.htm#update_workbook) method in the REST API Help. REST API can also be used to remove users from the site and transfer content ownership to another user. For more information, see [Remove User from Site](https://help.tableau.com/current/api/rest_api/en-gb/REST/rest_api_ref_users_and_groups.htm#remove_user_from_site) method in the REST API Help. For more information on reassigning content ownership in Tableau Cloud, see [Manage Content Ownership](https://help.tableau.com/v0.0/online/en-gb/owner.htm#change-the-owner-of-a-content-resource).