# Stop keycloak from assigned default roles to users

**URL:** <https://forum.keycloak.org/t/stop-keycloak-from-assigned-default-roles-to-users/13570>\
**Category:** Getting advice\
**Created:** [February 13, 2022, 4:18am UTC](https://forum.keycloak.org/t/stop-keycloak-from-assigned-default-roles-to-users/13570 "2022-02-13T04:18:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![qiksar](https://avatars.discourse-cdn.com/v4/letter/q/a6a055/32.png) [@qiksar](https://forum.keycloak.org/u/qiksar)\
**Post date:** [February 13, 2022, 4:18am UTC](https://forum.keycloak.org/t/stop-keycloak-from-assigned-default-roles-to-users/13570/1 "2022-02-13T04:18:40Z")

</div>

I require each user in my realm to have only one role. But I can’t get to this state because, when a new user is created Keycloak adds the default-roles-(realmname) to the user’s roles. So my app role is appended to the list so to speak. I don’t want Keycloak to assign any roles to my users other than those that I specify.

A default answer to this question might be “delete the role after the user is created” but that would require admin level access, and I don’t want to give my API which creates the user that level of access.

I’d prefer Keycloak didn’t assign any roles, as why would you want some other system controlling the access and permissions that your users are assigned?

Any tips on this one?

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![c-campos\_oribi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/c-campos_oribi/32/12432_2.png) [@c-campos\_oribi](https://forum.keycloak.org/u/c-campos_oribi)\
**Post date:** [January 7, 2026, 9:29am UTC](https://forum.keycloak.org/t/stop-keycloak-from-assigned-default-roles-to-users/13570/2 "2026-01-07T09:29:32Z")

</div>

did you solve this?  
I’m facing the same issue.

Thanks!

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [January 7, 2026, 12:16pm UTC](https://forum.keycloak.org/t/stop-keycloak-from-assigned-default-roles-to-users/13570/3 "2026-01-07T12:16:15Z")

</div>

It’s not possible to prevent the auto-assignment of the `default-roles-<realm>`.  
If you don’t assign any roles to the default-roles-…, then the user as actually no role and thus no permissions to anything.  
Of course you can delete the role assignment right after the user has been created. If you create the user through the API, like the OP mentioned, your API already has the right to modify the user and thus to unassign the default-roles.

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [February 1, 2026, 7:00am UTC](https://forum.keycloak.org/t/stop-keycloak-from-assigned-default-roles-to-users/13570/4 "2026-02-01T07:00:10Z")

</div>

Closed on February 1, 2026, 7:00am UTC

This topic was automatically closed after 24 days. New replies are no longer allowed.