For IWA authentication, Active Directory users are not automatically added to the ArcGIS Enterprise portal. They must either be:

Manually added as members, or

Automatically created at first login if auto-creation is enabled.

Since the new users are assigned to the gisusers group but cannot sign in or create content, it's clear that their accounts have not yet been added to the portal.

From ArcGIS Enterprise documentation:

“Integrated Windows Authentication (IWA) allows users to sign in with their Windows credentials. However, users must still be members of the portal. You can manually add users or enable automatic account creation during login.”

Option B is invalid since default user type settings do not prevent login.

Option C is incorrect because synchronization is not time-based—it’s account-creation dependent.