diff --git a/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/IdentityUserManager.cs b/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/IdentityUserManager.cs
index 644c21df5c..242ca6a908 100644
--- a/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/IdentityUserManager.cs
+++ b/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/IdentityUserManager.cs
@@ -117,7 +117,7 @@ namespace Volo.Abp.Identity
             
             var currentOus = user.OrganizationUnits;
 
-            if (currentOus.Any(cou => cou.Id == ou.Id))
+            if (currentOus.Any(cou => cou.OrganizationUnitId == ou.Id && cou.UserId == user.Id))
             {
                 return;
             }
diff --git a/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/IdentityUserOrganizationUnit.cs b/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/IdentityUserOrganizationUnit.cs
index 3721210bd6..12bf8860c8 100644
--- a/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/IdentityUserOrganizationUnit.cs
+++ b/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/IdentityUserOrganizationUnit.cs
@@ -7,7 +7,7 @@ namespace Volo.Abp.Identity
     /// <summary>
     /// Represents membership of a User to an OU.
     /// </summary>
-    public class IdentityUserOrganizationUnit : CreationAuditedEntity<Guid>, IMultiTenant, ISoftDelete
+    public class IdentityUserOrganizationUnit : CreationAuditedEntity, IMultiTenant, ISoftDelete
     {
 
         /// <summary>
@@ -50,5 +50,10 @@ namespace Volo.Abp.Identity
             UserId = userId;
             OrganizationUnitId = organizationUnitId;
         }
+
+        public override object[] GetKeys()
+        {
+            return new object[] { UserId, OrganizationUnitId };
+        }
     }
 }
diff --git a/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/Organizations/OrganizationUnitManager.cs b/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/Organizations/OrganizationUnitManager.cs
index 9ed2a54697..fac2ef743a 100644
--- a/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/Organizations/OrganizationUnitManager.cs
+++ b/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/Organizations/OrganizationUnitManager.cs
@@ -160,7 +160,7 @@ namespace Volo.Abp.Identity.Organizations
         {
             var currentRoles = ou.Roles;
 
-            if (currentRoles.Any(r => r.Id == role.Id))
+            if (currentRoles.Any(r => r.OrganizationUnitId == ou.Id && r.RoleId == role.Id))
             {
                 return Task.FromResult(0);
             }
diff --git a/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/Organizations/OrganizationUnitRole.cs b/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/Organizations/OrganizationUnitRole.cs
index cd9d9d3ac4..de43e8bec4 100644
--- a/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/Organizations/OrganizationUnitRole.cs
+++ b/modules/identity/src/Volo.Abp.Identity.Domain/Volo/Abp/Identity/Organizations/OrganizationUnitRole.cs
@@ -7,7 +7,7 @@ namespace Volo.Abp.Identity.Organizations
     /// <summary>
     /// Represents membership of a User to an OU.
     /// </summary>
-    public class OrganizationUnitRole : CreationAuditedEntity<Guid>, IMultiTenant, ISoftDelete
+    public class OrganizationUnitRole : CreationAuditedEntity, IMultiTenant, ISoftDelete
     {
         /// <summary>
         /// TenantId of this entity.
@@ -50,5 +50,9 @@ namespace Volo.Abp.Identity.Organizations
             OrganizationUnitId = organizationUnitId;
         }
 
+        public override object[] GetKeys()
+        {
+            return new object[] { OrganizationUnitId, RoleId };
+        }
     }
 }
diff --git a/modules/identity/src/Volo.Abp.Identity.MongoDB/Volo/Abp/Identity/MongoDB/MongoIdentityUserRepository.cs b/modules/identity/src/Volo.Abp.Identity.MongoDB/Volo/Abp/Identity/MongoDB/MongoIdentityUserRepository.cs
index 8da8bd9cf0..fc198c7883 100644
--- a/modules/identity/src/Volo.Abp.Identity.MongoDB/Volo/Abp/Identity/MongoDB/MongoIdentityUserRepository.cs
+++ b/modules/identity/src/Volo.Abp.Identity.MongoDB/Volo/Abp/Identity/MongoDB/MongoIdentityUserRepository.cs
@@ -52,7 +52,7 @@ namespace Volo.Abp.Identity.MongoDB
             var user = await GetAsync(id, cancellationToken: GetCancellationToken(cancellationToken)).ConfigureAwait(false);
             var organizationUnitIds = user.OrganizationUnits.Select(r => r.OrganizationUnitId);
             var organizationUnits = DbContext.OrganizationUnits.AsQueryable().Where(ou => organizationUnitIds.Contains(ou.Id));
-            var roleIds = organizationUnits.SelectMany(x => x.Roles.Select(r => r.Id));
+            var roleIds = organizationUnits.SelectMany(x => x.Roles.Select(r => r.RoleId));
             return await DbContext.Roles.AsQueryable().Where(r => roleIds.Contains(r.Id)).Select(r => r.Name).ToListAsync(GetCancellationToken(cancellationToken)).ConfigureAwait(false);
         }
 
@@ -164,17 +164,11 @@ namespace Volo.Abp.Identity.MongoDB
             Guid organizationUnitId,
             CancellationToken cancellationToken = default)
         {
-            var organizationUnitUserIds = await DbContext.Users.AsQueryable()
-                .SelectMany(u => u.OrganizationUnits)
-                .Where(ou => ou.OrganizationUnitId == organizationUnitId)
-                .Select(ouu => ouu.Id)
-                .ToListAsync(GetCancellationToken(cancellationToken))
-                .ConfigureAwait(false);
-
-            return await GetMongoQueryable()
-                     .Where(u => u.OrganizationUnits.Any(uou => organizationUnitUserIds.Contains(uou.Id)))
-                     .ToListAsync(GetCancellationToken(cancellationToken))
-                     .ConfigureAwait(false);
+            var result = await GetMongoQueryable()
+                    .Where(u => u.OrganizationUnits.Any(uou => uou.OrganizationUnitId == organizationUnitId))
+                    .ToListAsync(GetCancellationToken(cancellationToken))
+                    .ConfigureAwait(false);
+            return result;
         }
 
         public async Task<List<IdentityUser>> GetUsersInOrganizationUnitWithChildrenAsync(
diff --git a/modules/identity/test/Volo.Abp.Identity.Domain.Tests/Volo/Abp/Identity/OrganizationUnitManager_Tests.cs b/modules/identity/test/Volo.Abp.Identity.Domain.Tests/Volo/Abp/Identity/OrganizationUnitManager_Tests.cs
index 539af5d1a1..7c6c2582ad 100644
--- a/modules/identity/test/Volo.Abp.Identity.Domain.Tests/Volo/Abp/Identity/OrganizationUnitManager_Tests.cs
+++ b/modules/identity/test/Volo.Abp.Identity.Domain.Tests/Volo/Abp/Identity/OrganizationUnitManager_Tests.cs
@@ -93,7 +93,7 @@ namespace Volo.Abp.Identity
             
             //TODO: This method has a bug: add role not work
             ou = await _organizationUnitRepository.GetOrganizationUnitAsync("OU1", includeDetails: true).ConfigureAwait(false);
-            ou.Roles.FirstOrDefault().Id.ShouldBe(adminRole.Id);
+            ou.Roles.FirstOrDefault().RoleId.ShouldBe(adminRole.Id);
         }
 
         [Fact]