diff --git a/services/graph/pkg/config/config.go b/services/graph/pkg/config/config.go
index 4e4998d26..fd0025ff4 100644
--- a/services/graph/pkg/config/config.go
+++ b/services/graph/pkg/config/config.go
@@ -99,6 +99,7 @@ type Identity struct {
 type API struct {
 	GroupMembersPatchLimit int    `yaml:"group_members_patch_limit" env:"GRAPH_GROUP_MEMBERS_PATCH_LIMIT" desc:"The amount of group members allowed to be added with a single patch request."`
 	UsernameMatch          string `yaml:"graph_username_match" env:"GRAPH_USERNAME_MATCH" desc:"Option to allow legacy usernames. Supported options are 'default' and 'none'."`
+	AssignDefaultUserRole  bool   `yaml:"graph_assign_default_user_role" env:"GRAPH_ASSIGN_DEFAULT_USER_ROLE" desc:"Whether to assign newly created users the default role 'User'. Set this to 'false' if you want to assign roles manually, or if the role assignment should happen at first login. Set this to 'true' (the default) to assign the role 'User' when creating a new user."`
 }
 
 // Events combines the configuration options for the event bus.
diff --git a/services/graph/pkg/config/defaults/defaultconfig.go b/services/graph/pkg/config/defaults/defaultconfig.go
index 1d313a378..7c17e7f4e 100644
--- a/services/graph/pkg/config/defaults/defaultconfig.go
+++ b/services/graph/pkg/config/defaults/defaultconfig.go
@@ -40,6 +40,7 @@ func DefaultConfig() *config.Config {
 		API: config.API{
 			GroupMembersPatchLimit: 20,
 			UsernameMatch:          "default",
+			AssignDefaultUserRole:  true,
 		},
 		Reva: shared.DefaultRevaConfig(),
 		Spaces: config.Spaces{
diff --git a/services/graph/pkg/service/v0/users.go b/services/graph/pkg/service/v0/users.go
index 87ce1136e..d27e4b37e 100644
--- a/services/graph/pkg/service/v0/users.go
+++ b/services/graph/pkg/service/v0/users.go
@@ -328,7 +328,7 @@ func (g Graph) PostUser(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// assign roles if possible
-	if g.roleService != nil {
+	if g.roleService != nil && g.config.API.AssignDefaultUserRole {
 		// All users get the user role by default currently.
 		// to all new users for now, as create Account request does not have any role field
 		if _, err = g.roleService.AssignRoleToUser(r.Context(), &settings.AssignRoleToUserRequest{