diff --git a/pkg/service/v0/accounts.go b/pkg/service/v0/accounts.go
index 92cc2db22..e30349762 100644
--- a/pkg/service/v0/accounts.go
+++ b/pkg/service/v0/accounts.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	settings "github.com/owncloud/ocis-settings/pkg/proto/v0"
+	settings_svc "github.com/owncloud/ocis-settings/pkg/service/v0"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -20,8 +22,6 @@ import (
 	"github.com/owncloud/ocis-accounts/pkg/proto/v0"
 	"github.com/owncloud/ocis-accounts/pkg/provider"
 	"github.com/owncloud/ocis-pkg/v2/roles"
-	settings "github.com/owncloud/ocis-settings/pkg/proto/v0"
-	settings_svc "github.com/owncloud/ocis-settings/pkg/service/v0"
 	"github.com/rs/zerolog"
 	"github.com/tredoe/osutil/user/crypt"
 	"google.golang.org/genproto/protobuf/field_mask"
@@ -344,29 +344,16 @@ func (s Service) CreateAccount(ctx context.Context, in *proto.CreateAccountReque
 
 	// extract group id
 	// TODO groups should be ignored during create, use groups.AddMember? return error?
+
+	// write and index account - note: don't do anything else in between!
 	if err = s.writeAccount(acc); err != nil {
 		s.log.Error().Err(err).Str("id", id).Msg("could not persist new account")
 		s.debugLogAccount(acc).Msg("could not persist new account")
 		return
 	}
-
-	// TODO: assign user role to all new users for now, as create Account request does not have any role field
-	if s.RoleService == nil {
-		return merrors.InternalServerError(s.id, "could not assign role to account: roleService not configured")
-	}
-	_, err = s.RoleService.AssignRoleToUser(ctx, &settings.AssignRoleToUserRequest{
-		AccountUuid: acc.Id,
-		RoleId:      settings_svc.BundleUUIDRoleUser,
-	})
-
-	if err != nil {
-		return merrors.InternalServerError(s.id, "could not assign role to account: %v", err.Error())
-	}
-
 	if err = s.indexAccount(acc.Id); err != nil {
 		return merrors.InternalServerError(s.id, "could not index new account: %v", err.Error())
 	}
-
 	s.log.Debug().Interface("account", acc).Msg("account after indexing")
 
 	if acc.PasswordProfile != nil {
@@ -382,6 +369,17 @@ func (s Service) CreateAccount(ctx context.Context, in *proto.CreateAccountReque
 		out.OnPremisesSamAccountName = acc.OnPremisesSamAccountName
 	}
 
+	// TODO: assign user role to all new users for now, as create Account request does not have any role field
+	if s.RoleService == nil {
+		return merrors.InternalServerError(s.id, "could not assign role to account: roleService not configured")
+	}
+	if _, err = s.RoleService.AssignRoleToUser(ctx, &settings.AssignRoleToUserRequest{
+		AccountUuid: acc.Id,
+		RoleId:      settings_svc.BundleUUIDRoleUser,
+	}); err != nil {
+		return merrors.InternalServerError(s.id, "could not assign role to account: %v", err.Error())
+	}
+
 	return
 }