# Tableau Cloud Bridge, authentication, SCIM and Cloud Manager

*Tableau Architect Study Guide · Design a Tableau Infrastructure · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/tableau-architect/design-a-tableau-infrastructure/tableau-cloud-bridge-authentication-scim-and-cloud-manager*

Plan Tableau Cloud around four separate layers: Bridge pools and refresh schedules for private data, site sign-in and connected clients, SCIM provisioning pushed by the identity provider, and multi-site governance in Tableau Cloud Manager, then troubleshoot by isolating the layer that failed.

- Certification: Salesforce Tableau Architect
- Exam section: Design a Tableau Infrastructure
- Study guide: https://www.certifyforce.com/study-guide/tableau-architect

**Official exam objective:**

> 1.2 Plan and implement Tableau Cloud: 1.2.1 Plan and implement Tableau Bridge; 1.2.2 Plan and implement authentication; 1.2.3 Plan and implement automated user provisioning, including System for Cross-Domain Identity Management (SCIM); 1.2.4 Troubleshoot advanced configuration issues; 1.2.5 Plan and implement multi-sites using Tableau Cloud Manager.

## What the exam expects

- Plan Tableau Bridge pools and refresh schedules for private-network data, including version and pool prerequisites and who owns which task.
- Plan site authentication: per-user authentication type, MFA, connected clients, and the difference between signing in and reaching a data source.
- Plan automated provisioning with SCIM and its dependencies on single sign-on, the identity provider and the creating site administrator.
- Troubleshoot advanced configuration issues by isolating the layer (sign-in, provisioning, data access, connectivity) that failed.
- Plan multiple sites with Tableau Cloud Manager, separating cloud administrator and site administrator rights.

Key terms:
- **Tableau Bridge**: a client that refreshes or queries private-network data on behalf of Tableau Cloud.
- **Pool**: a set of Bridge clients that load-balances refresh work for the private network domains mapped to it.
- **Connected client**: a Tableau application that reaches a site through a stored refresh token.
- **SCIM**: the protocol an identity provider (IdP) uses to push user and group provisioning into Tableau Cloud.
- **Tableau Cloud Manager (TCM)**: the cloud administrator's console for the sites and users of a tenant.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Schedule owner | Data source owner, on the Extract Refreshes tab | [Private Network Refresh Schedule](https://help.tableau.com/current/online/en-us/to_sync_schedule.htm) |
| Pools per scheduled published extract | One; multiple pools not supported | [Private Network Refresh Schedule](https://help.tableau.com/current/online/en-us/to_sync_schedule.htm) |
| Embedded file-based refresh | Bridge 2024.2.1 or later client in a named pool | [Private Network Refresh Schedule](https://help.tableau.com/current/online/en-us/to_sync_schedule.htm) |
| Unattended Bridge | Requires the site's connected clients option | [Access Sites from Connected Clients](https://help.tableau.com/current/online/en-us/to_connected_clients.htm) |
| Unused refresh token | Expires after 14 days | [Access Sites from Connected Clients](https://help.tableau.com/current/online/en-us/to_connected_clients.htm) |
| Authentication per user | One type each: Tableau or a configured external provider | [Authentication](https://help.tableau.com/current/online/en-us/security_auth.htm) |
| Cloud account and data | No automatic access to external data sources | [Authentication](https://help.tableau.com/current/online/en-us/security_auth.htm) |
| SCIM call frequency | Controlled by the IdP | [SCIM](https://help.tableau.com/current/online/en-us/scim_config_online.htm) |
| Tableau-generated SCIM secret | Invalid when its creator's site role changes or the creator leaves | [SCIM](https://help.tableau.com/current/online/en-us/scim_config_online.htm) |
| Missing siteRoles | User created as Viewer | [SCIM](https://help.tableau.com/current/online/en-us/scim_config_online.htm) |
| Site rename | Updates the URI and invalidates references | [Add, Rename, Delete, or Activate Sites](https://help.tableau.com/current/online/en-us/cloud_manager_sites.htm) |
| Site deletion | Reactivation possible for 30 days | [Add, Rename, Delete, or Activate Sites](https://help.tableau.com/current/online/en-us/cloud_manager_sites.htm) |

## Check yourself

- How long can a connected client's refresh token go unused before a new sign-in is needed?
- Why does Tableau recommend a dedicated site administrator account on Tableau with MFA for a SAML site?
- Which Bridge version must at least one pooled client run before file-based published data sources can use Bridge refresh schedules?
- Why can a Bridge legacy schedule fail even though the client is connected?

## Sources

- [Set Up a Private Network Refresh Schedule](https://help.tableau.com/current/online/en-us/to_sync_schedule.htm)
- [Access Sites from Connected Clients](https://help.tableau.com/current/online/en-us/to_connected_clients.htm)
- [Authentication](https://help.tableau.com/current/online/en-us/security_auth.htm)
- [SCIM](https://help.tableau.com/current/online/en-us/scim_config_online.htm)
- [Add, Rename, Delete, or Activate Sites](https://help.tableau.com/current/online/en-us/cloud_manager_sites.htm)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the Tableau Architect pack (USD $19): https://www.certifyforce.com/practice-exams