# 2025-09-16: IAM Service – validation of predefined group assignments

## Overview

The IAM Service was updated with validation for assigning customers to predefined groups.\
This ensures consistent role management within a company (Legal Entity) and provides clearer error handling for invalid assignments.

New validation rules:

* A customer can only be assigned to one predefined group (for example *Admin*, *Buyer*, *Requester*) within the same Legal Entity.
* Customers may still be assigned to different groups in different companies (Legal Entities).
* The *Contact* group can always be assigned.

## Modified endpoints

| Endpoint                                                                                                                                                                                             | Description                                                                                     |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| [Adding a user to a group](https://developer.emporix.io/api-references/api-guides/users-and-permissions/iam/api-reference/group-assignments#post-iam-tenant-groups-groupid-users)                    | Validation added - a customer can only be assigned to one predefined group in one Legal Entity. |
| [Upserting a group assignment](https://developer.emporix.io/api-references/api-guides/users-and-permissions/iam/api-reference/group-assignments#put-iam-tenant-groups-groupid-users-usertype-userid) | Validation added - a customer can only be assigned to one predefined group in one Legal Entity. |

## Known problems

There are no known problems.