How to user’s site roles are assigned or maintained
When you import at the site level or on a single-site server, you can include site-role assignments in the .csv file. If a user already exists in the Tableau Server site, the site role assigned during the import process will be applied only if it gives the user more access. Importing users and groups will promote a user’s site role but not demote it.
For a multi-site server, when you import users in the Server Users page, you create server users with no site affiliation. Because these users do not belong to a site, they cannot have a site role. The only site role a user can have at the server level is Unlicensed or Server Administrator.
When you assign site membership to a user, you can specify the user’s site role for each site. For information.
Importing at the server level in multi-site environments
If the server is running multiple sites and you are a server administrator, you can import a CSV file from two locations. Where existing user accounts are concerned, each location has different capabilities.
The Server Users page appears in a multi-site environment. Only server administrators can access this page.
You can import the CSV file from here if you want to update existing user accounts in addition to adding new ones. For example, if you import a file that has a new password for each existing user, their passwords will be reset.
The Site Users page.
Server administrators can add new user accounts with CSV imports. If the CSV file includes existing users, the Password and Display Name fields must either match the existing or be left blank. If new passwords or full names are used, the import will fail.
Importing to a single-site environment
Server and site administrators on a single-site server perform CSV user imports from the Users page in a site..
Multi-site versus single-site import
Users can belong to more than one site on the same server, but they must use the same credentials for each site. This becomes important when you’re adding users to a site and those users might already be members of a different site. If you try to import a user who already exists, and if the user’s credentials in the CSV file don’t match the existing credentials, the import fails for that user.
Note: The issue of credentials mismatch during import doesn’t apply if the server is configured to use Active Directory for authentication. In that case, the CSV file should never contain a password, because user passwords are managed by Active Directory.
If you’re importing users to a site and think that the users might already exist on the server, you can try leaving the Password column in the CSV file blank. When you import the users, if a user who is defined in the CSV already exists in another site, the user is added to the site where you’re importing. However, if the user doesn’t already exist on the server, the user is created, and the CSV import window alerts you that the new user doesn’t have a password. You can then use the server administrator pages to assign a password to any user who doesn’t have one.