diff --git a/src/Squidex.Domain.Users.MongoDb/MongoUserStore.cs b/src/Squidex.Domain.Users.MongoDb/MongoUserStore.cs
index 62604760d..8ce972c1f 100644
--- a/src/Squidex.Domain.Users.MongoDb/MongoUserStore.cs
+++ b/src/Squidex.Domain.Users.MongoDb/MongoUserStore.cs
@@ -32,6 +32,7 @@ namespace Squidex.Domain.Users.MongoDb
         IUserLoginStore<IdentityUser>,
         IUserPasswordStore<IdentityUser>,
         IUserPhoneNumberStore<IdentityUser>,
+        IUserRoleStore<IdentityUser>,
         IUserSecurityStampStore<IdentityUser>,
         IUserTwoFactorStore<IdentityUser>,
         IUserTwoFactorRecoveryCodeStore<IdentityUser>,
diff --git a/src/Squidex.Domain.Users/UserClaimsPrincipalFactoryWithEmail.cs b/src/Squidex.Domain.Users/UserClaimsPrincipalFactoryWithEmail.cs
index f0efcdfd9..1d6c0f4e5 100644
--- a/src/Squidex.Domain.Users/UserClaimsPrincipalFactoryWithEmail.cs
+++ b/src/Squidex.Domain.Users/UserClaimsPrincipalFactoryWithEmail.cs
@@ -11,11 +11,15 @@ using System.Threading.Tasks;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.Extensions.Options;
 using Squidex.Infrastructure.Security;
+using Squidex.Shared;
+using Squidex.Shared.Identity;
 
 namespace Squidex.Domain.Users
 {
     public sealed class UserClaimsPrincipalFactoryWithEmail : UserClaimsPrincipalFactory<IdentityUser, IdentityRole>
     {
+        private const string AdministratorRole = "ADMINISTRATOR";
+
         public UserClaimsPrincipalFactoryWithEmail(UserManager<IdentityUser> userManager, RoleManager<IdentityRole> roleManager, IOptions<IdentityOptions> optionsAccessor)
             : base(userManager, roleManager, optionsAccessor)
         {
@@ -25,7 +29,14 @@ namespace Squidex.Domain.Users
         {
             var principal = await base.CreateAsync(user);
 
-            principal.Identities.First().AddClaim(new Claim(OpenIdClaims.Email, await UserManager.GetEmailAsync(user)));
+            var identity = principal.Identities.First();
+
+            identity.AddClaim(new Claim(OpenIdClaims.Email, await UserManager.GetEmailAsync(user)));
+
+            if (await UserManager.IsInRoleAsync(user, AdministratorRole))
+            {
+                identity.AddClaim(new Claim(SquidexClaimTypes.Permissions, Permissions.Admin));
+            }
 
             return principal;
         }
diff --git a/src/Squidex/Areas/OrleansDashboard/Middlewares/OrleansDashboardAuthenticationMiddleware.cs b/src/Squidex/Areas/OrleansDashboard/Middlewares/OrleansDashboardAuthenticationMiddleware.cs
index 08da9330f..a93e679d4 100644
--- a/src/Squidex/Areas/OrleansDashboard/Middlewares/OrleansDashboardAuthenticationMiddleware.cs
+++ b/src/Squidex/Areas/OrleansDashboard/Middlewares/OrleansDashboardAuthenticationMiddleware.cs
@@ -31,16 +31,23 @@ namespace Squidex.Areas.OrleansDashboard.Middlewares
         {
             var authentication = await context.AuthenticateAsync(CookieAuthenticationDefaults.AuthenticationScheme);
 
-            if (!authentication.Succeeded || !authentication.Principal.Permissions().Allows(OrleansPermissions))
+            if (authentication.Succeeded)
             {
-                await context.ChallengeAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties
+                if (authentication.Principal.Permissions().Allows(OrleansPermissions))
                 {
-                    RedirectUri = context.Request.PathBase + context.Request.Path
-                });
+                    await next(context);
+                }
+                else
+                {
+                    context.Response.StatusCode = 403;
+                }
             }
             else
             {
-                await next(context);
+                await context.ChallengeAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties
+                {
+                    RedirectUri = context.Request.PathBase + context.Request.Path
+                });
             }
         }
     }