diff --git a/apps/settings/src/components/Members.vue b/apps/settings/src/components/Members.vue
index 4a5e2848f9..cf650c4414 100644
--- a/apps/settings/src/components/Members.vue
+++ b/apps/settings/src/components/Members.vue
@@ -5,13 +5,7 @@
       <MessageError v-if="graphqlError">{{ graphqlError }}</MessageError>
       <MessageSuccess v-if="success">{{ success }}</MessageSuccess>
     </div>
-    <div
-      v-if="
-        session &&
-        (session.email == 'admin' ||
-          (session.roles && session.roles.length > 0))
-      "
-    >
+    <div v-if="session?.email === 'admin' || session?.roles?.length">
       <h5 class="card-title">Manage members</h5>
       <p>Use table below to add, edit or remove members</p>
       <form v-if="canEdit" class="form-inline">
@@ -109,13 +103,11 @@ export default {
       loading: false,
     };
   },
-
   computed: {
     canEdit() {
       return (
-        this.session != null &&
-        (this.session.email == "admin" ||
-          this.session.roles.includes("Manager"))
+        this.session?.email === "admin" ||
+        this.session?.roles.includes("Manager")
       );
     },
   },
@@ -130,7 +122,7 @@ export default {
         `mutation drop($member:[String]){drop(members:$member){message}}`,
         { member: name }
       )
-        .then((data) => {
+        .then(() => {
           this.loadMembers();
         })
         .catch((error) => {
diff --git a/apps/tailwind-components/components/Modal.vue b/apps/tailwind-components/components/Modal.vue
index b60cd7ebf8..c1c6d96937 100644
--- a/apps/tailwind-components/components/Modal.vue
+++ b/apps/tailwind-components/components/Modal.vue
@@ -10,7 +10,7 @@ function showModal() {
   visible.value = true;
 }
 
-const closeModal = (returnVal?: string) => {
+const closeModal = (_returnVal?: string) => {
   visible.value = false;
 };
 
@@ -20,6 +20,7 @@ defineExpose({
   visible,
 });
 </script>
+
 <template>
   <section
     v-show="visible"
diff --git a/apps/tailwind-components/components/Navigation.vue b/apps/tailwind-components/components/Navigation.vue
index 963bf05c36..9419678b6e 100644
--- a/apps/tailwind-components/components/Navigation.vue
+++ b/apps/tailwind-components/components/Navigation.vue
@@ -22,7 +22,6 @@ const mainButtons = computed(() =>
 const subButtons = computed(() =>
   props.navigation.slice(props.maximumButtonShown)
 );
-const active = "underline";
 </script>
 
 <template>
diff --git a/apps/tailwind-components/components/Table.vue b/apps/tailwind-components/components/Table.vue
index b583b15a28..89b55cc37f 100644
--- a/apps/tailwind-components/components/Table.vue
+++ b/apps/tailwind-components/components/Table.vue
@@ -1,4 +1,3 @@
-<!-- eslint-disable vue/multi-word-component-names -->
 <template>
   <table class="w-full table-auto">
     <thead>
diff --git a/apps/tailwind-components/components/TableCell.vue b/apps/tailwind-components/components/TableCell.vue
index d55e38147d..d170dffbf4 100644
--- a/apps/tailwind-components/components/TableCell.vue
+++ b/apps/tailwind-components/components/TableCell.vue
@@ -1,4 +1,3 @@
-<!-- eslint-disable vue/multi-word-component-names -->
 <script setup>
 defineProps({
   allowLineBreak: {
diff --git a/apps/tailwind-components/components/TableRow.vue b/apps/tailwind-components/components/TableRow.vue
index b9cedbe3a1..632768fd2b 100644
--- a/apps/tailwind-components/components/TableRow.vue
+++ b/apps/tailwind-components/components/TableRow.vue
@@ -1,4 +1,3 @@
-<!-- eslint-disable vue/multi-word-component-names -->
 <template>
   <tr class="sm:hover:bg-blue-50 sm:hover:cursor-pointer">
     <slot></slot>
diff --git a/apps/tailwind-components/components/input/Radio.vue b/apps/tailwind-components/components/input/Radio.vue
index d28cf4a0e7..95fd10a23b 100644
--- a/apps/tailwind-components/components/input/Radio.vue
+++ b/apps/tailwind-components/components/input/Radio.vue
@@ -9,8 +9,8 @@
 
 <script lang="ts" setup>
 defineProps<{
-  value: string;
+  value?: string | boolean;
 }>();
 
-const modelValue = defineModel<string>();
+const modelValue = defineModel<string | boolean>();
 </script>
diff --git a/apps/tailwind-components/components/input/RadioGroup.vue b/apps/tailwind-components/components/input/RadioGroup.vue
index 66f78a00a6..c6020cfba5 100644
--- a/apps/tailwind-components/components/input/RadioGroup.vue
+++ b/apps/tailwind-components/components/input/RadioGroup.vue
@@ -3,7 +3,7 @@
     <div
       class="flex justify-start align-center"
       v-for="option in radioOptions"
-      :key="option.value"
+      :key="JSON.stringify(option.value)"
     >
       <InputRadio
         :id="`${id}-radio-group-${option.value}`"
@@ -41,7 +41,7 @@
 
 <script lang="ts" setup>
 interface RadioOptionsDataIF {
-  value: string;
+  value: string | boolean;
   label?: string;
   checked?: boolean | undefined;
 }
@@ -57,9 +57,9 @@ withDefaults(
   }
 );
 
-const modelValue = defineModel<string>();
+const modelValue = defineModel<string | boolean>();
 
 function resetModelValue() {
-  modelValue.value = "";
+  modelValue.value = undefined;
 }
 </script>
diff --git a/apps/tailwind-components/components/input/Select.vue b/apps/tailwind-components/components/input/Select.vue
index e6e4b941f1..ef7869acbe 100644
--- a/apps/tailwind-components/components/input/Select.vue
+++ b/apps/tailwind-components/components/input/Select.vue
@@ -1,6 +1,4 @@
 <script setup lang="ts">
-import type { N } from "vitest/dist/reporters-MmQN-57K.js";
-
 withDefaults(
   defineProps<{
     id: string;
diff --git a/apps/tailwind-components/nuxt.config.ts b/apps/tailwind-components/nuxt.config.ts
index bfff722466..d2e4ebe3b0 100644
--- a/apps/tailwind-components/nuxt.config.ts
+++ b/apps/tailwind-components/nuxt.config.ts
@@ -1,32 +1,35 @@
 // https://nuxt.com/docs/api/configuration/nuxt-config
 export default defineNuxtConfig({
   devtools: { enabled: true },
-  modules: ['@nuxtjs/tailwindcss', '@nuxt/test-utils/module'],
+  modules: ["@nuxtjs/tailwindcss", "@nuxt/test-utils/module"],
   tailwindcss: {
-    cssPath: '~/assets/css/main.css',
-    configPath: '~/tailwind.config.js'
+    cssPath: "~/assets/css/main.css",
+    configPath: "~/tailwind.config.js",
   },
 
-  ssr: process.env.NUXT_PUBLIC_IS_SSR === 'false' ? false : true,
+  ssr: process.env.NUXT_PUBLIC_IS_SSR === "false" ? false : true,
 
   router: {
-    options: process.env.NUXT_PUBLIC_IS_SSR === 'false' ? {
-      hashMode: true
-    } : {}
+    options:
+      process.env.NUXT_PUBLIC_IS_SSR === "false"
+        ? {
+            hashMode: true,
+          }
+        : {},
   },
 
   nitro: {
     prerender: {
-      ignore: ['/_tailwind/']
-    }
+      ignore: ["/_tailwind/"],
+    },
   },
 
   app: {
     head: {
       htmlAttrs: {
-        'data-theme': ''
-      }
-    }
+        "data-theme": "",
+      },
+    },
   },
 
   components: [
@@ -36,16 +39,16 @@ export default defineNuxtConfig({
     },
     {
       path: "~/components/viz",
-      pathPrefix: false
+      pathPrefix: false,
     },
     "~/components",
   ],
 
   runtimeConfig: {
     public: {
-      apiBase: "https://emx2.dev.molgenis.org/", // "http://localhost:8080/",
+      apiBase: "http://localhost:8080/",
     },
   },
 
-  compatibilityDate: '2024-08-23',
-})
\ No newline at end of file
+  compatibilityDate: "2024-08-23",
+});
diff --git a/apps/tailwind-components/pages/Button.story.vue b/apps/tailwind-components/pages/Button.story.vue
index c573f9905b..fc0dabc47d 100644
--- a/apps/tailwind-components/pages/Button.story.vue
+++ b/apps/tailwind-components/pages/Button.story.vue
@@ -42,22 +42,23 @@
 
     <h2 class="text-2xl">Icons</h2>
     <div class="flex gap-4">
-      <Button type="primary" size="medium" icon="filter" iconPosition="left"
-        >Filter</Button
-      >
-      <Button type="primary" size="small" icon="filter" iconPosition="right"
-        >Filter</Button
-      >
-      <Button type="secondary" size="small" icon="star" iconPosition="left"
-        >Star</Button
-      >
+      <Button type="primary" size="medium" icon="filter" iconPosition="left">
+        Filter
+      </Button>
+      <Button type="primary" size="small" icon="filter" iconPosition="right">
+        Filter
+      </Button>
+      <Button type="secondary" size="small" icon="star" iconPosition="left">
+        Star
+      </Button>
       <Button
         type="secondary"
         size="small"
         icon="CaretDown"
         iconPosition="right"
-        >CaretDown</Button
       >
+        CaretDown
+      </Button>
     </div>
   </div>
 </template>
diff --git a/apps/tailwind-components/pages/Modal.story.vue b/apps/tailwind-components/pages/Modal.story.vue
index 353ac2b649..9a62eed6c7 100644
--- a/apps/tailwind-components/pages/Modal.story.vue
+++ b/apps/tailwind-components/pages/Modal.story.vue
@@ -8,6 +8,7 @@ function showModal() {
 
 let sectionCount = ref(0);
 </script>
+
 <template>
   <button
     @click="showModal"
diff --git a/apps/tailwind-components/server/routes/[schema]/graphql.ts b/apps/tailwind-components/server/routes/[schema]/graphql.ts
index 8f5941c8a8..c18f9ee51e 100644
--- a/apps/tailwind-components/server/routes/[schema]/graphql.ts
+++ b/apps/tailwind-components/server/routes/[schema]/graphql.ts
@@ -2,13 +2,13 @@ import { joinURL } from "ufo";
 import { createConsola } from "consola";
 
 export default defineEventHandler((event) => {
- const config = useRuntimeConfig(event); 
- const logger = createConsola({ level: config.logLevel?? 3 });
+  const config = useRuntimeConfig(event);
+  const logger = createConsola({ level: config.logLevel ?? 3 });
   logger.info("proxy schema gql request : ", event.path);
   if (event.method === "POST") {
     readBody(event).then((body) => {
       if (body.query) {
-        logger.debug( body.query);
+        logger.debug(body.query);
       }
       if (body.variables) {
         logger.debug(body.variables);
@@ -17,6 +17,6 @@ export default defineEventHandler((event) => {
   }
   const schema = getRouterParam(event, "schema") || "";
   logger.info("to : ", joinURL(config.public.apiBase, schema, "graphql"));
-  const target = joinURL(config.public.apiBase, schema,"graphql");
+  const target = joinURL(config.public.apiBase, schema, "graphql");
   return proxyRequest(event, target);
 });
diff --git a/apps/ui/components/editUserModal.vue b/apps/ui/components/editUserModal.vue
new file mode 100644
index 0000000000..db4fe18fc1
--- /dev/null
+++ b/apps/ui/components/editUserModal.vue
@@ -0,0 +1,169 @@
+<template>
+  <Modal ref="modal" :title="`Edit user: ${userName}`">
+    <div>
+      <b>New password</b>
+      <InputString id="New password" v-model="password" />
+    </div>
+
+    <div>
+      <b>Disable user</b>
+      <InputRadioGroup
+        id="disabledUserRadio"
+        :radioOptions="[
+          { value: true, label: 'Enabled' },
+          { value: false, label: 'Disabled' },
+        ]"
+        v-model="isEnabled"
+      />
+    </div>
+
+    <div>
+      <b>Roles</b>
+      <InputSelect id="select-schema" v-model="schema" :options="SchemaIds" />
+      <InputSelect id="select-role" v-model="role" :options="roles" />
+      <Button size="tiny" icon="plus" @click="addRole" />
+
+      <Table>
+        <template #head>
+          <TableHeadRow>
+            <TableHead></TableHead>
+            <TableHead>Schema</TableHead>
+            <TableHead>Role</TableHead>
+          </TableHeadRow>
+        </template>
+        <template #body>
+          <TableRow v-for="role in userRoles">
+            <TableCell>
+              <Button size="tiny" icon="trash" @click="removeRole(role)" />
+            </TableCell>
+            <TableCell>{{ role.schemaId }}</TableCell>
+            <TableCell>{{ role.role }}</TableCell>
+          </TableRow>
+        </template>
+      </Table>
+    </div>
+
+    <div v-if="userTokens.length">
+      <b>Tokens</b>
+      <Table>
+        <template #head>
+          <TableHeadRow>
+            <TableHead></TableHead>
+            <TableHead>Token</TableHead>
+          </TableHeadRow>
+        </template>
+        <template #body>
+          <TableRow v-for="token in userTokens">
+            <TableCell>
+              <Button size="tiny" icon="trash" @click="removeToken(token)" />
+            </TableCell>
+            <TableCell>{{ token }}</TableCell>
+          </TableRow>
+        </template>
+      </Table>
+    </div>
+
+    <template #footer>
+      <Button @click="saveUser()">Save</Button>
+      <Button @click="closeEditUserModal">Close</Button>
+    </template>
+  </Modal>
+</template>
+
+<script setup lang="ts">
+import { type Modal } from "#build/components";
+import type { IRole, ISchemaInfo, IUser } from "~/util/adminUtils";
+import { updateUser } from "~/util/adminUtils";
+import _ from "lodash";
+
+const modal = ref<InstanceType<typeof Modal>>();
+
+const { schemas, roles } = defineProps<{
+  schemas: ISchemaInfo[];
+  roles: string[];
+}>();
+
+const role = ref<string>("Viewer");
+const schema = ref<string>(schemas.length ? schemas[0].id : "");
+
+const userName = ref<string>("");
+const isEnabled = ref<boolean>(true);
+const userRoles = ref<Record<string, IRole>>({});
+const revokedRoles = ref<Record<string, IRole>>({});
+const userTokens = ref<string[]>([]);
+const password = ref<string>("");
+
+const SchemaIds = computed(() => {
+  return schemas.map((schema) => schema.id);
+});
+
+const emit = defineEmits(["userUpdated"]);
+
+function closeEditUserModal() {
+  modal.value?.close();
+}
+
+function addRole() {
+  if (schema.value && role.value) {
+    delete revokedRoles.value[schema.value];
+    userRoles.value[schema.value] = {
+      schemaId: schema.value,
+      role: role.value,
+    };
+  }
+}
+
+function removeRole(role: IRole) {
+  revokedRoles.value[role.schemaId] = role;
+  delete userRoles.value[role.schemaId];
+}
+
+function removeToken(token: string) {
+  userTokens.value = _.reject(userTokens.value, (tok) => tok === token);
+}
+
+function showModal(selectedUser: IUser) {
+  if (selectedUser) {
+    userName.value = selectedUser.email;
+    isEnabled.value = selectedUser.enabled;
+    userRoles.value = getRoles(selectedUser.roles || []);
+    userTokens.value = selectedUser.tokens || ([] as string[]);
+  }
+  modal.value?.show();
+}
+
+function getRoles(roles: IRole[]): Record<string, IRole> {
+  return roles.reduce((accum, role) => {
+    accum[role.schemaId] = role;
+    return accum;
+  }, {} as Record<string, IRole>);
+}
+
+async function saveUser() {
+  const edittedUser: IUser = {
+    email: userName.value,
+    settings: [],
+    enabled: isEnabled.value,
+    tokens: userTokens.value,
+    roles: Object.values(userRoles.value),
+    revokedRoles: Object.values(revokedRoles.value),
+  }; //TODO define update user object
+
+  if (password.value) {
+    edittedUser.password = password.value;
+  }
+
+  await updateUser(edittedUser);
+  emit("userUpdated");
+  modal.value?.close();
+}
+
+function closeModal() {
+  modal.value?.close();
+}
+
+defineExpose({
+  show: showModal,
+  close: closeModal,
+});
+</script>
diff --git a/apps/ui/layouts/default.vue b/apps/ui/layouts/default.vue
index 746acbb510..a922306417 100644
--- a/apps/ui/layouts/default.vue
+++ b/apps/ui/layouts/default.vue
@@ -2,7 +2,7 @@
 const config = useRuntimeConfig();
 const route = useRoute();
 const { data: session } = await useSession();
-console.log("session form defaiult layout: ", session.value);
+console.log("session form default layout: ", session.value);
 
 const faviconHref = config.public.emx2Theme
   ? `/_nuxt-styles/img/${config.public.emx2Theme}.ico`
@@ -21,8 +21,8 @@ useHead({
       return `${titleChunk} | ${config.public.siteTitle}`;
     } else if (titleChunk) {
       return titleChunk;
-    } else if (config.public.siteTitle) {
-      return config.public.siteTitle as string;
+      // } else if (config.public.siteTitle) {
+      //   return config.public.siteTitle as string;
     } else {
       return "Emx2";
     }
@@ -67,6 +67,11 @@ const navigation = computed(() => {
           <Navigation :navigation="navigation" />
         </template>
         <template #account>
+          <HeaderButton
+            label="Admin"
+            icon="Database"
+            @click="navigateTo({ path: '/admin/' })"
+          />
           <HeaderButton
             :label="isSignedIn ? 'Account' : 'Signin'"
             icon="user"
diff --git a/apps/ui/middleware/adminOnly.ts b/apps/ui/middleware/adminOnly.ts
index 0461252ba1..fe0c8e1b8c 100644
--- a/apps/ui/middleware/adminOnly.ts
+++ b/apps/ui/middleware/adminOnly.ts
@@ -1,7 +1,7 @@
-export default defineNuxtRouteMiddleware(async (to, from) => {
-    const {data: session} = await useSession();
-    const isAdmin = computed(() => session.value.email === "admin");
-    if (!isAdmin.value) {
-      return navigateTo('/login')
-    }
-  })
\ No newline at end of file
+export default defineNuxtRouteMiddleware(async (_to, _from) => {
+  const { data: session } = await useSession();
+  const isAdmin = computed(() => session.value.email === "admin");
+  if (!isAdmin.value) {
+    return navigateTo("/login");
+  }
+});
diff --git a/apps/ui/pages/account.vue b/apps/ui/pages/account.vue
index 1c987f5b84..13a9c3e77a 100644
--- a/apps/ui/pages/account.vue
+++ b/apps/ui/pages/account.vue
@@ -37,15 +37,17 @@ async function signout() {
           type="primary"
           size="medium"
           @click="signout"
-          >Sign out</Button
         >
+          Sign out
+        </Button>
         <Button
           v-else
           type="primary"
           size="medium"
           @click="navigateTo('/login')"
-          >Sign in</Button
         >
+          Sign in
+        </Button>
       </div>
 
       <div class="mt-3">{{ errorMsg }}</div>
diff --git a/apps/ui/pages/admin.vue b/apps/ui/pages/admin.vue
new file mode 100644
index 0000000000..6a9e641f26
--- /dev/null
+++ b/apps/ui/pages/admin.vue
@@ -0,0 +1,181 @@
+<template>
+  <PageHeader title="Admin Tools" />
+  <Container class="flex flex-col items-center">
+    <ContentBlock class="w-full mt-3" title="User management">
+      <Button icon="plus" @click="createUserModal?.show()">
+        Create User
+      </Button>
+
+      <h2>User List ({{ userCount }})</h2>
+      <Pagination
+        v-if="userCount > 100"
+        :currentPage="currentPage"
+        :totalPages="totalPages"
+        @update="updateCurrentPage"
+      />
+      <Table>
+        <template #head>
+          <TableHeadRow>
+            <TableHead>Control</TableHead>
+            <TableHead>Name / Email</TableHead>
+            <TableHead>Enabled</TableHead>
+            <TableHead>Roles</TableHead>
+            <TableHead>Tokens</TableHead>
+          </TableHeadRow>
+        </template>
+        <template #body>
+          <!-- Why is the first cell blue/link like? -->
+          <TableRow v-for="user in users">
+            <TableCell>
+              <Button
+                v-if="canDelete(user)"
+                size="tiny"
+                icon="trash"
+                @click="removeUser(user)"
+              />
+              <Button size="tiny" icon="user" @click="editUser(user)" />
+            </TableCell>
+            <TableCell>{{ user.email }}</TableCell>
+            <TableCell>{{ user.enabled }}</TableCell>
+            <TableCell>
+              <div v-for="role in user.roles">
+                {{ role.schemaId }} ({{ role.role }})
+              </div>
+            </TableCell>
+            <TableCell> Tokens: {{ user.tokens?.length }} </TableCell>
+          </TableRow>
+        </template>
+      </Table>
+
+      <Modal ref="createUserModal" title="Create User">
+        <InputString id="New user name" v-model="userName" />
+        <InputString id="New user password" v-model="password" />
+        <template #footer>
+          <Button @click="addUser(userName, password)">Add user</Button>
+          <Button @click="closeCreateUserModal">Close</Button>
+        </template>
+      </Modal>
+
+      <EditUserModal
+        ref="editUserModal"
+        :schemas="schemas"
+        :roles="roles"
+        @userUpdated="retrieveUsers"
+      />
+    </ContentBlock>
+  </Container>
+</template>
+
+<script setup lang="ts">
+import { type Modal } from "#build/components";
+import type EditUserModal from "~/components/editUserModal.vue";
+import {
+  createUser,
+  deleteUser,
+  getRoles,
+  getSchemas,
+  getUsers,
+  type ISchemaInfo,
+  type IUser,
+} from "~/util/adminUtils";
+
+/**
+ * Component wishlist:
+ *  Settings icon
+ *  Edit icon
+ *  Admin icon
+ *  Buttongroup
+ *  Icon button with tooltip
+ *  Wider modal
+ *  Modal without background scrolling
+ *  Generic table components
+ *  Password input
+ *  Select with more complex objects
+ *  RadioGroup with more complex objects
+ */
+
+/**
+ *  Todos (might be other stories)
+ *  Where to put enable/disable; behind edit or button toggle -> doesn't really matter, so modal
+ *  Do certain actions need confirmation dialog? -> yes
+ *  Does password creating/changing need a double input? -> yes
+ *  Do we want a modal for creation with more options or is create into edit fine? -> modal
+ *  Search bar for users (scale: 100s of users)
+ */
+
+/**
+ * Todo list
+ * make buttons double click safe
+ * put component in right place
+ * make stuff look better
+ * save user (needs backend)
+ */
+
+definePageMeta({
+  middleware: "admin-only",
+});
+
+const LIMIT = 100;
+const editUserModal = ref<InstanceType<typeof EditUserModal>>();
+const createUserModal = ref<InstanceType<typeof Modal>>();
+
+const currentPage = ref(1);
+const password = ref<string>("");
+const userName = ref<string>("");
+const users = ref<IUser[]>([]);
+const userCount = ref(0);
+const totalPages = ref(0);
+const schemas = ref<ISchemaInfo[]>([]);
+const roles = ref<string[]>([]);
+const schema = ref<string>("");
+
+const offset = computed(() => {
+  return currentPage.value > 1
+    ? `, offset: ${(currentPage.value - 1) * LIMIT}`
+    : "";
+});
+
+retrieveUsers();
+schemas.value = await getSchemas();
+schema.value = schemas.value.length ? schemas.value[0].id : "";
+roles.value = await getRoles(schemas.value);
+
+async function addUser(userName: string, password: string) {
+  await createUser(userName, password);
+  closeCreateUserModal();
+  retrieveUsers();
+}
+
+function updateCurrentPage(newPage: number) {
+  currentPage.value = newPage;
+  retrieveUsers();
+}
+
+async function retrieveUsers() {
+  const { newUsers, newUserCount } = await getUsers();
+  users.value = newUsers;
+  userCount.value = newUserCount;
+  const divided = userCount.value / LIMIT;
+  totalPages.value =
+    userCount.value % LIMIT > 0 ? Math.floor(divided) + 1 : divided;
+}
+
+async function removeUser(user: IUser) {
+  await deleteUser(user);
+  getUsers();
+}
+
+function closeCreateUserModal() {
+  createUserModal.value?.close();
+  userName.value = "";
+  password.value = "";
+}
+
+function editUser(user: IUser) {
+  editUserModal.value?.show(user);
+}
+
+function canDelete(user: IUser) {
+  return user.email !== "anonymous" && user.email !== "admin";
+}
+</script>
diff --git a/apps/ui/util/adminUtils.ts b/apps/ui/util/adminUtils.ts
new file mode 100644
index 0000000000..80c065c9a4
--- /dev/null
+++ b/apps/ui/util/adminUtils.ts
@@ -0,0 +1,167 @@
+import type { ISetting } from "../../metadata-utils/dist";
+const GRAPHQL = "/graphql";
+const API_GRAPHQL = "/api/graphql";
+
+export async function deleteUser(user: IUser) {
+  useFetch(API_GRAPHQL, {
+    method: "post",
+    body: {
+      query: `mutation{removeUser(email: "${user.email}"){status,message}}`,
+      member: user.email,
+    },
+  }).catch((error) => {
+    handleError("Error deleting user: ", error.value);
+  });
+}
+
+export async function updateUser(user: IUser) {
+  const updateUser = createUpdateUser(user);
+  return useFetch(GRAPHQL, {
+    method: "post",
+    body: {
+      query: `mutation updateUser($updateUser:InputUpdateUser) {updateUser(updateUser:$updateUser){status, message}}`,
+      variables: { updateUser },
+    },
+  }).catch((error) => {
+    handleError("Error updating user: ", error.value);
+  });
+}
+
+function createUpdateUser(user: IUser) {
+  let updateUser: IUpdateUser = {
+    email: user.email,
+    enabled: user.enabled,
+    revokedRoles: user.revokedRoles || [],
+  };
+  if (user.password) {
+    updateUser.password = user.password;
+  }
+  if (user.roles) {
+    updateUser.roles = user.roles;
+  }
+  return updateUser;
+}
+
+export function createUser(newUserName: string, newPassword: string) {
+  if (!newUserName || !newPassword) return;
+
+  return useFetch(GRAPHQL, {
+    method: "post",
+    body: {
+      query: `mutation{changePassword(email: "${newUserName}", password: "${newPassword}"){status,message}}`,
+    },
+  }).catch((error) => {
+    handleError("Error creating/updating user: ", error.value);
+  });
+}
+
+export async function getRoles(schemas: ISchemaInfo[]): Promise<string[]> {
+  if (!schemas.length) return [];
+
+  const { data, error } = await useFetch<{
+    data: { _schema: { roles: { name: string }[] } };
+  }>("../" + schemas[0].id + GRAPHQL, {
+    method: "post",
+    body: { query: "{_schema{roles{name}}}" },
+  });
+
+  if (error.value) {
+    handleError("Error getting roles: ", error);
+  }
+
+  return (
+    data.value?.data._schema.roles.map((role: { name: string }) => role.name) ||
+    []
+  );
+}
+
+export async function getSchemas() {
+  const { data } = await useFetch<{ data: { _schemas: ISchemaInfo[] } }>(
+    GRAPHQL,
+    {
+      method: "post",
+      body: {
+        query: "{_schemas{id,label}}",
+      },
+    }
+  );
+  return data.value?.data._schemas || [];
+}
+
+export async function getUsers() {
+  const { data, error } = await useFetch<IAdminResponse>(API_GRAPHQL, {
+    method: "post",
+    body: {
+      query: `{ _admin { users { email, settings, {key, value}, enabled, roles { schemaId, role } } userCount } }`,
+    },
+  });
+
+  if (error.value) {
+    handleError("Error loading users: ", error.value);
+  }
+
+  const newUsers = buildUsers(data.value?.data._admin.users || []);
+  const newUserCount = data.value?.data._admin.userCount ?? 0;
+  return { newUsers, newUserCount };
+}
+
+function buildUsers(dataUsers: IUser[]) {
+  return dataUsers.map((user) => {
+    return { ...user, tokens: getTokens(user) };
+  });
+}
+
+function getTokens(user: IUser) {
+  if (user.settings.length) {
+    const tokens = user.settings.find((setting) => {
+      return setting.key === "access-tokens";
+    });
+    if (tokens) {
+      return tokens.value.split(",");
+    }
+  }
+  return [];
+}
+
+function handleError(message: string, error: any) {
+  console.log(message, error);
+  //see nuxt catalogue on how to handle errors
+}
+
+export interface IUser {
+  //TODO split into communication and internal interface
+  email: string;
+  settings: ISetting[];
+  enabled: boolean;
+  tokens?: string[];
+  roles?: IRole[];
+  revokedRoles?: IRole[];
+  password?: string;
+}
+
+interface IAdminResponse {
+  data: {
+    _admin: {
+      users: IUser[];
+      userCount: number;
+    };
+  };
+}
+
+export interface ISchemaInfo {
+  id: string;
+  label: string;
+}
+
+export interface IRole {
+  schemaId: string;
+  role: string;
+}
+
+interface IUpdateUser {
+  email: string;
+  enabled: boolean;
+  password?: string;
+  roles?: IRole[];
+  revokedRoles: IRole[];
+}
diff --git a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphlAdminFieldFactory.java b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphlAdminFieldFactory.java
deleted file mode 100644
index 9f24bc5df9..0000000000
--- a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphlAdminFieldFactory.java
+++ /dev/null
@@ -1,144 +0,0 @@
-package org.molgenis.emx2.graphql;
-
-import static org.molgenis.emx2.Constants.MOLGENIS_JWT_SHARED_SECRET;
-import static org.molgenis.emx2.Constants.SETTINGS;
-import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.Status.SUCCESS;
-import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.typeForMutationResult;
-import static org.molgenis.emx2.graphql.GraphqlConstants.*;
-import static org.molgenis.emx2.graphql.GraphqlSchemaFieldFactory.outputSettingsType;
-
-import graphql.Scalars;
-import graphql.schema.*;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import org.molgenis.emx2.Database;
-import org.molgenis.emx2.User;
-
-public class GraphlAdminFieldFactory {
-  private GraphlAdminFieldFactory() {
-    // hide constructor
-  }
-
-  // Output types
-  private static GraphQLOutputType userType =
-      GraphQLObjectType.newObject()
-          .name("_AdminUserType")
-          .field(
-              GraphQLFieldDefinition.newFieldDefinition()
-                  .name(EMAIL)
-                  .type(Scalars.GraphQLString)
-                  .build())
-          .field(
-              GraphQLFieldDefinition.newFieldDefinition()
-                  .name(ENABLED)
-                  .type(Scalars.GraphQLBoolean)
-                  .build())
-          .field(
-              GraphQLFieldDefinition.newFieldDefinition()
-                  .name(SETTINGS)
-                  .type(GraphQLList.list(outputSettingsType))
-                  .build())
-          .build();
-
-  // retrieve user list, user count
-  public static GraphQLFieldDefinition queryAdminField(Database db) {
-    GraphQLOutputType adminType =
-        GraphQLObjectType.newObject()
-            .name("MolgenisAdmin")
-            .field(
-                GraphQLFieldDefinition.newFieldDefinition()
-                    .name(USERS)
-                    .argument(GraphQLArgument.newArgument().name(EMAIL).type(Scalars.GraphQLString))
-                    .argument(GraphQLArgument.newArgument().name(LIMIT).type(Scalars.GraphQLInt))
-                    .argument(GraphQLArgument.newArgument().name(OFFSET).type(Scalars.GraphQLInt))
-                    .type(GraphQLList.list(userType))
-                    .build())
-            .field(
-                GraphQLFieldDefinition.newFieldDefinition()
-                    .name("userCount")
-                    .type(Scalars.GraphQLInt)
-                    .build())
-            .build();
-
-    return GraphQLFieldDefinition.newFieldDefinition()
-        .name("_admin")
-        .dataFetcher(
-            dataFetchingEnvironment -> {
-              Map<String, Object> result = new LinkedHashMap<>();
-              // check for parameters
-              for (SelectedField selectedField :
-                  dataFetchingEnvironment.getSelectionSet().getImmediateFields()) {
-                if (selectedField.getName().equals(USERS)) {
-                  result.put(USERS, getUsers(selectedField, db));
-                }
-                if (selectedField.getName().equals("userCount")) {
-                  result.put("userCount", db.countUsers());
-                }
-              }
-              return result;
-            })
-        .type(adminType)
-        .build();
-  }
-
-  private static Object getUsers(SelectedField selectedField, Database db) {
-    Map<String, Object> args = selectedField.getArguments();
-    int limit = args.containsKey(LIMIT) ? (int) args.get(LIMIT) : 100;
-    int offset = args.containsKey(OFFSET) ? (int) args.get(OFFSET) : 0;
-    String email = args.containsKey(EMAIL) ? (String) args.get(EMAIL) : null;
-    if (email != null) {
-      return List.of(toGraphqlUser(db.getUser(email)));
-    } else {
-      return db.getUsers(limit, offset).stream()
-          .map(GraphlAdminFieldFactory::toGraphqlUser)
-          .toList();
-    }
-  }
-
-  public static GraphQLFieldDefinition removeUser(Database database) {
-    return GraphQLFieldDefinition.newFieldDefinition()
-        .name("removeUser")
-        .type(typeForMutationResult)
-        .argument(GraphQLArgument.newArgument().name(EMAIL).type(Scalars.GraphQLString))
-        .dataFetcher(
-            dataFetchingEnvironment -> {
-              String email = dataFetchingEnvironment.getArgument(EMAIL);
-              database.removeUser(email);
-              return new GraphqlApiMutationResult(SUCCESS, "User %s removed", email);
-            })
-        .build();
-  }
-
-  public static GraphQLFieldDefinition setEnabledUser(Database database) {
-    return GraphQLFieldDefinition.newFieldDefinition()
-        .name("setEnabledUser")
-        .type(typeForMutationResult)
-        .argument(GraphQLArgument.newArgument().name(EMAIL).type(Scalars.GraphQLString))
-        .argument(GraphQLArgument.newArgument().name(ENABLED).type(Scalars.GraphQLBoolean))
-        .dataFetcher(
-            dataFetchingEnvironment -> {
-              String email = dataFetchingEnvironment.getArgument(EMAIL);
-              Boolean enabled = dataFetchingEnvironment.getArgument(ENABLED);
-              database.setEnabledUser(email, enabled);
-              return new GraphqlApiMutationResult(
-                  SUCCESS, "User %s %s ", email, enabled ? "Enabled" : "Disabled");
-            })
-        .build();
-  }
-
-  private static Map<String, Object> toGraphqlUser(User user) {
-    Map<String, Object> result = new LinkedHashMap<>();
-    result.put(EMAIL, user.getUsername());
-    result.put(ENABLED, user.getEnabled());
-    result.put(SETTINGS, mapSettingsToGraphql(user.getSettings()));
-    return result;
-  }
-
-  public static Object mapSettingsToGraphql(Map<String, String> settings) {
-    return settings.entrySet().stream()
-        .filter(entry -> !MOLGENIS_JWT_SHARED_SECRET.equals(entry.getKey()))
-        .map(entry -> Map.of(KEY, entry.getKey(), VALUE, entry.getValue()))
-        .toList();
-  }
-}
diff --git a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlAdminFieldFactory.java b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlAdminFieldFactory.java
new file mode 100644
index 0000000000..ec26bc9e94
--- /dev/null
+++ b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlAdminFieldFactory.java
@@ -0,0 +1,248 @@
+package org.molgenis.emx2.graphql;
+
+import static org.molgenis.emx2.Constants.*;
+import static org.molgenis.emx2.Constants.KEY;
+import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.Status.SUCCESS;
+import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.typeForMutationResult;
+import static org.molgenis.emx2.graphql.GraphqlConstants.*;
+import static org.molgenis.emx2.graphql.GraphqlSchemaFieldFactory.*;
+
+import graphql.Scalars;
+import graphql.schema.*;
+import java.util.*;
+import org.jetbrains.annotations.NotNull;
+import org.molgenis.emx2.*;
+
+public class GraphqlAdminFieldFactory {
+  private GraphqlAdminFieldFactory() {
+    // hide constructor
+  }
+
+  private static final String UPDATE_USER = "updateUser";
+
+  // Output types
+  private static final GraphQLOutputType userType =
+      GraphQLObjectType.newObject()
+          .name("_AdminUserType")
+          .field(
+              GraphQLFieldDefinition.newFieldDefinition()
+                  .name(EMAIL)
+                  .type(Scalars.GraphQLString)
+                  .build())
+          .field(
+              GraphQLFieldDefinition.newFieldDefinition()
+                  .name(ENABLED)
+                  .type(Scalars.GraphQLBoolean)
+                  .build())
+          .field(
+              GraphQLFieldDefinition.newFieldDefinition()
+                  .name(SETTINGS)
+                  .type(GraphQLList.list(outputSettingsType))
+                  .build())
+          .field(
+              GraphQLFieldDefinition.newFieldDefinition()
+                  .name(ROLES)
+                  .type(GraphQLList.list(userRolesType))
+                  .build())
+          .build();
+
+  // retrieve user list, user count
+  public static GraphQLFieldDefinition queryAdminField(Database db) {
+    String userCount = "userCount";
+    GraphQLOutputType adminType =
+        GraphQLObjectType.newObject()
+            .name("MolgenisAdmin")
+            .field(
+                GraphQLFieldDefinition.newFieldDefinition()
+                    .name(USERS)
+                    .argument(GraphQLArgument.newArgument().name(EMAIL).type(Scalars.GraphQLString))
+                    .argument(GraphQLArgument.newArgument().name(LIMIT).type(Scalars.GraphQLInt))
+                    .argument(GraphQLArgument.newArgument().name(OFFSET).type(Scalars.GraphQLInt))
+                    .type(GraphQLList.list(userType))
+                    .build())
+            .field(
+                GraphQLFieldDefinition.newFieldDefinition()
+                    .name(userCount)
+                    .type(Scalars.GraphQLInt)
+                    .build())
+            .build();
+
+    return GraphQLFieldDefinition.newFieldDefinition()
+        .name("_admin")
+        .dataFetcher(
+            dataFetchingEnvironment -> {
+              Map<String, Object> result = new LinkedHashMap<>();
+              // check for parameters
+              for (SelectedField selectedField :
+                  dataFetchingEnvironment.getSelectionSet().getImmediateFields()) {
+                if (selectedField.getName().equals(USERS)) {
+                  result.put(USERS, getUsers(selectedField, db));
+                }
+                if (selectedField.getName().equals(userCount)) {
+                  result.put(userCount, db.countUsers());
+                }
+              }
+              return result;
+            })
+        .type(adminType)
+        .build();
+  }
+
+  private static Object getUsers(SelectedField selectedField, Database db) {
+    Map<String, Object> args = selectedField.getArguments();
+    int limit = args.containsKey(LIMIT) ? (int) args.get(LIMIT) : 100;
+    int offset = args.containsKey(OFFSET) ? (int) args.get(OFFSET) : 0;
+    String email = args.containsKey(EMAIL) ? (String) args.get(EMAIL) : null;
+    List<Member> members = db.loadUserRoles();
+
+    if (email != null) {
+      return List.of(toGraphqlUser(db.getUser(email), members));
+    } else {
+      return db.getUsers(limit, offset).stream().map(user -> toGraphqlUser(user, members)).toList();
+    }
+  }
+
+  public static GraphQLFieldDefinition removeUser(Database database) {
+    return GraphQLFieldDefinition.newFieldDefinition()
+        .name("removeUser")
+        .type(typeForMutationResult)
+        .argument(GraphQLArgument.newArgument().name(EMAIL).type(Scalars.GraphQLString))
+        .dataFetcher(
+            dataFetchingEnvironment -> {
+              String email = dataFetchingEnvironment.getArgument(EMAIL);
+              database.removeUser(email);
+              return new GraphqlApiMutationResult(SUCCESS, "User %s removed", email);
+            })
+        .build();
+  }
+
+  public static GraphQLFieldDefinition setEnabledUser(Database database) {
+    return GraphQLFieldDefinition.newFieldDefinition()
+        .name("setEnabledUser")
+        .type(typeForMutationResult)
+        .argument(GraphQLArgument.newArgument().name(EMAIL).type(Scalars.GraphQLString))
+        .argument(GraphQLArgument.newArgument().name(ENABLED).type(Scalars.GraphQLBoolean))
+        .dataFetcher(
+            dataFetchingEnvironment -> {
+              String email = dataFetchingEnvironment.getArgument(EMAIL);
+              boolean enabled = dataFetchingEnvironment.getArgument(ENABLED);
+              database.setEnabledUser(email, enabled);
+              return new GraphqlApiMutationResult(
+                  SUCCESS, "User %s %s ", email, enabled ? "Enabled" : "Disabled");
+            })
+        .build();
+  }
+
+  private static Map<String, Object> toGraphqlUser(User user, List<Member> members) {
+    Map<String, Object> result = new LinkedHashMap<>();
+    result.put(EMAIL, user.getUsername());
+    result.put(ENABLED, user.getEnabled());
+    result.put(SETTINGS, mapSettingsToGraphql(user.getSettings()));
+
+    List<Map<String, String>> roles = getRoles(user, members);
+    result.put(ROLES, roles);
+    return result;
+  }
+
+  private static List<Map<String, String>> getRoles(User user, List<Member> members) {
+    return members.stream()
+        .filter(member -> member.getUser().equals(user.getUsername()))
+        .map(GraphqlAdminFieldFactory::getUserRoleMap)
+        .toList();
+  }
+
+  private static Map<String, String> getUserRoleMap(Member member) {
+    String role = member.getRole();
+    String[] parts = role.split("/");
+    Map<String, String> roleMap = new HashMap<>();
+    roleMap.put(SCHEMA_ID, parts[0]);
+    roleMap.put(ROLE, parts[1]);
+    return roleMap;
+  }
+
+  public static Object mapSettingsToGraphql(Map<String, String> settings) {
+    return settings.entrySet().stream()
+        .filter(entry -> !MOLGENIS_JWT_SHARED_SECRET.equals(entry.getKey()))
+        .map(entry -> Map.of(KEY, entry.getKey(), VALUE, entry.getValue()))
+        .toList();
+  }
+
+  public static GraphQLFieldDefinition updateUser(Database database) {
+    return GraphQLFieldDefinition.newFieldDefinition()
+        .name(UPDATE_USER)
+        .type(typeForMutationResult)
+        .argument(GraphQLArgument.newArgument().name(UPDATE_USER).type(updateUserType))
+        .dataFetcher(
+            dataFetchingEnvironment -> executeUpdateUser(database, dataFetchingEnvironment))
+        .build();
+  }
+
+  @NotNull
+  private static GraphqlApiMutationResult executeUpdateUser(
+      Database database, DataFetchingEnvironment dataFetchingEnvironment) {
+    LinkedHashMap<String, Object> updatedUser = dataFetchingEnvironment.getArgument(UPDATE_USER);
+    String userName = (String) updatedUser.get(EMAIL);
+    if (userName != null) {
+      database.tx(
+          db -> {
+            String password = (String) updatedUser.get(PASSWORD);
+            if (password != null) {
+              db.setUserPassword(userName, password);
+            }
+
+            List<Map<String, String>> roles = (List<Map<String, String>>) updatedUser.get(ROLES);
+            if (roles != null && roles.iterator().hasNext()) {
+              db.updateRoles(userName, roles);
+            }
+
+            List<Map<String, String>> revokedRoles =
+                (List<Map<String, String>>) updatedUser.get("revokedRoles");
+            if (revokedRoles != null && revokedRoles.iterator().hasNext()) {
+              db.revokeRoles(userName, revokedRoles);
+            }
+
+            Boolean enabled = (Boolean) updatedUser.get(ENABLED);
+            if (enabled != null) {
+              db.setEnabledUser(userName, enabled);
+            }
+          });
+    }
+    return new GraphqlApiMutationResult(SUCCESS, "User %s updated", userName);
+  }
+
+  private static final GraphQLInputObjectType inputUserRolesType =
+      new GraphQLInputObjectType.Builder()
+          .name("InputUserRolesType")
+          .field(
+              GraphQLInputObjectField.newInputObjectField()
+                  .name(SCHEMA_ID)
+                  .type(Scalars.GraphQLString))
+          .field(
+              GraphQLInputObjectField.newInputObjectField().name(ROLE).type(Scalars.GraphQLString))
+          .field(
+              GraphQLInputObjectField.newInputObjectField().name(USER).type(Scalars.GraphQLString))
+          .build();
+
+  private static final GraphQLInputObjectType updateUserType =
+      new GraphQLInputObjectType.Builder()
+          .name("InputUpdateUser")
+          .field(
+              GraphQLInputObjectField.newInputObjectField().name(EMAIL).type(Scalars.GraphQLString))
+          .field(
+              GraphQLInputObjectField.newInputObjectField()
+                  .name(PASSWORD)
+                  .type(Scalars.GraphQLString))
+          .field(
+              GraphQLInputObjectField.newInputObjectField()
+                  .name(ENABLED)
+                  .type(Scalars.GraphQLBoolean))
+          .field(
+              GraphQLInputObjectField.newInputObjectField()
+                  .name(ROLES)
+                  .type(GraphQLList.list(inputUserRolesType)))
+          .field(
+              GraphQLInputObjectField.newInputObjectField()
+                  .name("revokedRoles")
+                  .type(GraphQLList.list(inputUserRolesType)))
+          .build();
+}
diff --git a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlApiFactory.java b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlApiFactory.java
index 6b5e2d011f..9c0ef0a7bf 100644
--- a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlApiFactory.java
+++ b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlApiFactory.java
@@ -60,9 +60,10 @@ public GraphQL createGraphqlForDatabase(Database database, TaskService taskServi
 
     // admin operations
     if (database.isAdmin()) {
-      queryBuilder.field(GraphlAdminFieldFactory.queryAdminField(database));
-      mutationBuilder.field(GraphlAdminFieldFactory.removeUser(database));
-      mutationBuilder.field(GraphlAdminFieldFactory.setEnabledUser(database));
+      queryBuilder.field(GraphqlAdminFieldFactory.queryAdminField(database));
+      mutationBuilder.field(GraphqlAdminFieldFactory.removeUser(database));
+      mutationBuilder.field(GraphqlAdminFieldFactory.setEnabledUser(database));
+      mutationBuilder.field(GraphqlAdminFieldFactory.updateUser(database));
     }
 
     // database operations
diff --git a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlApiMutationResult.java b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlApiMutationResult.java
index e1de90d523..511fcdef6f 100644
--- a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlApiMutationResult.java
+++ b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlApiMutationResult.java
@@ -21,7 +21,6 @@ public enum Status {
   private Status status;
   private String taskId;
   private Map<String, String> details = new LinkedHashMap<>();
-  private String code;
 
   public GraphqlApiMutationResult(Status status, String message, Object... formatValues) {
     this.status = status;
diff --git a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlDatabaseFieldFactory.java b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlDatabaseFieldFactory.java
index a81a3e223d..420ce729de 100644
--- a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlDatabaseFieldFactory.java
+++ b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlDatabaseFieldFactory.java
@@ -2,7 +2,7 @@
 
 import static org.molgenis.emx2.Constants.DESCRIPTION;
 import static org.molgenis.emx2.Constants.SETTINGS;
-import static org.molgenis.emx2.graphql.GraphlAdminFieldFactory.mapSettingsToGraphql;
+import static org.molgenis.emx2.graphql.GraphqlAdminFieldFactory.mapSettingsToGraphql;
 import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.Status.SUCCESS;
 import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.typeForMutationResult;
 import static org.molgenis.emx2.graphql.GraphqlConstants.*;
diff --git a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlSchemaFieldFactory.java b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlSchemaFieldFactory.java
index f0ae887663..1b703a6120 100644
--- a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlSchemaFieldFactory.java
+++ b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlSchemaFieldFactory.java
@@ -1,7 +1,7 @@
 package org.molgenis.emx2.graphql;
 
 import static org.molgenis.emx2.Constants.*;
-import static org.molgenis.emx2.graphql.GraphlAdminFieldFactory.mapSettingsToGraphql;
+import static org.molgenis.emx2.graphql.GraphqlAdminFieldFactory.mapSettingsToGraphql;
 import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.Status.SUCCESS;
 import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.typeForMutationResult;
 import static org.molgenis.emx2.graphql.GraphqlConstants.*;
@@ -27,7 +27,7 @@
 import org.slf4j.LoggerFactory;
 
 public class GraphqlSchemaFieldFactory {
-  private static Logger logger = LoggerFactory.getLogger(SqlDatabase.class);
+  private static final Logger logger = LoggerFactory.getLogger(SqlDatabase.class);
 
   public static final GraphQLInputObjectType inputSettingsMetadataType =
       new GraphQLInputObjectType.Builder()
@@ -124,6 +124,17 @@ public class GraphqlSchemaFieldFactory {
                   .name(GraphqlConstants.NAME)
                   .type(Scalars.GraphQLString))
           .build();
+
+  static final GraphQLType userRolesType =
+      new GraphQLObjectType.Builder()
+          .name("MolgenisUserRolesType")
+          .field(
+              GraphQLFieldDefinition.newFieldDefinition()
+                  .name(SCHEMA_ID)
+                  .type(Scalars.GraphQLString))
+          .field(GraphQLFieldDefinition.newFieldDefinition().name(ROLE).type(Scalars.GraphQLString))
+          .build();
+
   private static final GraphQLType outputMembersMetadataType =
       new GraphQLObjectType.Builder()
           .name("MolgenisMembersType")
diff --git a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlSessionFieldFactory.java b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlSessionFieldFactory.java
index fc2c59dfdc..4fb9ce3f4f 100644
--- a/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlSessionFieldFactory.java
+++ b/backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlSessionFieldFactory.java
@@ -1,7 +1,7 @@
 package org.molgenis.emx2.graphql;
 
 import static org.molgenis.emx2.Constants.SETTINGS;
-import static org.molgenis.emx2.graphql.GraphlAdminFieldFactory.mapSettingsToGraphql;
+import static org.molgenis.emx2.graphql.GraphqlAdminFieldFactory.mapSettingsToGraphql;
 import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.Status.FAILED;
 import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.Status.SUCCESS;
 import static org.molgenis.emx2.graphql.GraphqlApiMutationResult.typeForMutationResult;
diff --git a/backend/molgenis-emx2-graphql/src/test/java/org/molgenis/emx2/graphql/TestGraphqlAdminFields.java b/backend/molgenis-emx2-graphql/src/test/java/org/molgenis/emx2/graphql/TestGraphqlAdminFields.java
index 091a069f20..bfff6d39b8 100644
--- a/backend/molgenis-emx2-graphql/src/test/java/org/molgenis/emx2/graphql/TestGraphqlAdminFields.java
+++ b/backend/molgenis-emx2-graphql/src/test/java/org/molgenis/emx2/graphql/TestGraphqlAdminFields.java
@@ -1,19 +1,22 @@
 package org.molgenis.emx2.graphql;
 
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.*;
 import static org.molgenis.emx2.graphql.GraphqlApiFactory.convertExecutionResultToJson;
 import static org.molgenis.emx2.sql.SqlDatabase.ANONYMOUS;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import graphql.ExecutionInput;
 import graphql.GraphQL;
 import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import org.jetbrains.annotations.NotNull;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
-import org.molgenis.emx2.Database;
-import org.molgenis.emx2.MolgenisException;
-import org.molgenis.emx2.Schema;
+import org.molgenis.emx2.*;
 import org.molgenis.emx2.sql.TestDatabaseFactory;
 
 public class TestGraphqlAdminFields {
@@ -21,16 +24,16 @@ public class TestGraphqlAdminFields {
   private static GraphQL grapql;
   private static Database database;
   private static final String schemaName = TestGraphqlAdminFields.class.getSimpleName();
+  private static final String TEST_PERSOON = "testPersoon";
+  private static final String ANOTHER_SCHEMA_NAME = "anotherSchemaName";
 
   @BeforeAll
   public static void setup() {
     database = TestDatabaseFactory.getTestDatabase();
-    //    PetStoreExample.create(schema.getMetadata());
-    //    PetStoreExample.populate(schema);
   }
 
   @Test
-  public void testUsers() {
+  void testUsers() {
     // put in transaction so user count is not affected by other operations
     database.tx(
         tdb -> {
@@ -57,6 +60,83 @@ public void testUsers() {
         });
   }
 
+  @Test
+  void testUpdateUser() {
+    database.tx(
+        testDatabase -> {
+          testDatabase.becomeAdmin();
+          GraphQL graphql = new GraphqlApiFactory().createGraphqlForDatabase(testDatabase, null);
+
+          try {
+            // setup
+            testDatabase.dropCreateSchema(schemaName);
+            testDatabase.dropCreateSchema(ANOTHER_SCHEMA_NAME);
+            testDatabase.addUser(TEST_PERSOON);
+            testDatabase.setEnabledUser(TEST_PERSOON, true);
+            testDatabase.getSchema(schemaName).addMember(TEST_PERSOON, "Owner");
+            testDatabase.getSchema(ANOTHER_SCHEMA_NAME).addMember(TEST_PERSOON, "Viewer");
+
+            // test
+            String query =
+                "mutation updateUser($updateUser:InputUpdateUser) {updateUser(updateUser:$updateUser){status, message}}";
+            Map<String, Object> variables = createUpdateUserVar();
+            ExecutionInput build =
+                ExecutionInput.newExecutionInput().query(query).variables(variables).build();
+            String queryResult = convertExecutionResultToJson(graphql.execute(build));
+            JsonNode node = new ObjectMapper().readTree(queryResult);
+            if (node.get("errors") != null) {
+              throw new MolgenisException(node.get("errors").get(0).get("message").asText());
+            }
+
+            // assert results
+            User user = testDatabase.getUser(TEST_PERSOON);
+            assertEquals("testPersoon", user.getUsername());
+            assertFalse(user.getEnabled());
+
+            List<Member> members = testDatabase.getSchema(schemaName).getMembers();
+            assertTrue(members.isEmpty());
+
+            Member anotherSchemaMember =
+                testDatabase.getSchema(ANOTHER_SCHEMA_NAME).getMembers().stream().findFirst().get();
+            assertEquals("Owner", anotherSchemaMember.getRole());
+            assertEquals(TEST_PERSOON, anotherSchemaMember.getUser());
+
+            // clean up
+            testDatabase.removeUser(TEST_PERSOON);
+            testDatabase.dropSchema(ANOTHER_SCHEMA_NAME);
+            testDatabase.dropSchema(schemaName);
+          } catch (Exception e) {
+            throw new RuntimeException(e);
+          }
+        });
+  }
+
+  @NotNull
+  private static Map<String, Object> createUpdateUserVar() {
+    Map<String, Object> variables = new HashMap<>();
+    Map<String, Object> updateUser = new HashMap<>();
+    updateUser.put("email", TEST_PERSOON);
+    updateUser.put("password", "12345678");
+    updateUser.put("enabled", "false");
+
+    ArrayList<Map<String, String>> revokedRoles = new ArrayList<>();
+    Map<String, String> revokedRole = new HashMap<>();
+    revokedRole.put("schemaId", schemaName);
+    revokedRole.put("role", "Owner");
+    revokedRoles.add(revokedRole);
+    updateUser.put("revokedRoles", revokedRoles);
+
+    ArrayList<Map<String, String>> roles = new ArrayList<>();
+    Map<String, String> role = new HashMap<>();
+    role.put("schemaId", ANOTHER_SCHEMA_NAME);
+    role.put("role", "Owner");
+    roles.add(role);
+    updateUser.put("roles", roles);
+
+    variables.put("updateUser", updateUser);
+    return variables;
+  }
+
   private JsonNode execute(String query) throws IOException {
     String result = convertExecutionResultToJson(grapql.execute(query));
     JsonNode node = new ObjectMapper().readTree(result);
diff --git a/backend/molgenis-emx2-sql/src/main/java/org/molgenis/emx2/sql/MetadataUtils.java b/backend/molgenis-emx2-sql/src/main/java/org/molgenis/emx2/sql/MetadataUtils.java
index b04c9ac25a..069c3431bd 100644
--- a/backend/molgenis-emx2-sql/src/main/java/org/molgenis/emx2/sql/MetadataUtils.java
+++ b/backend/molgenis-emx2-sql/src/main/java/org/molgenis/emx2/sql/MetadataUtils.java
@@ -488,9 +488,9 @@ protected static void deleteTable(DSLContext jooq, TableMetadata table) {
   protected static void saveColumnMetadata(DSLContext jooq, Column column) {
     String refSchema =
         column.isReference()
-            ? column.getRefSchemaName().equals(column.getSchemaName())
+            ? (column.getRefSchemaName().equals(column.getSchemaName())
                 ? null
-                : column.getRefSchemaName()
+                : column.getRefSchemaName())
             : null;
     jooq.insertInto(COLUMN_METADATA)
         .columns(
diff --git a/backend/molgenis-emx2-sql/src/main/java/org/molgenis/emx2/sql/SqlDatabase.java b/backend/molgenis-emx2-sql/src/main/java/org/molgenis/emx2/sql/SqlDatabase.java
index 1e859d2f80..2660273b4e 100644
--- a/backend/molgenis-emx2-sql/src/main/java/org/molgenis/emx2/sql/SqlDatabase.java
+++ b/backend/molgenis-emx2-sql/src/main/java/org/molgenis/emx2/sql/SqlDatabase.java
@@ -2,8 +2,7 @@
 
 import static org.jooq.impl.DSL.name;
 import static org.molgenis.emx2.ColumnType.STRING;
-import static org.molgenis.emx2.Constants.MG_USER_PREFIX;
-import static org.molgenis.emx2.Constants.SYSTEM_SCHEMA;
+import static org.molgenis.emx2.Constants.*;
 import static org.molgenis.emx2.sql.MetadataUtils.*;
 import static org.molgenis.emx2.sql.SqlDatabaseExecutor.*;
 import static org.molgenis.emx2.sql.SqlSchemaMetadataExecutor.executeCreateSchema;
@@ -14,6 +13,7 @@
 import java.util.function.Supplier;
 import javax.sql.DataSource;
 import org.jooq.DSLContext;
+import org.jooq.Record;
 import org.jooq.SQLDialect;
 import org.jooq.conf.Settings;
 import org.jooq.exception.DataAccessException;
@@ -805,4 +805,68 @@ public TableListener getTableListener(String schemaName, String tableName) {
   public List<LastUpdate> getLastUpdated() {
     return ChangeLogExecutor.executeLastUpdates(jooq);
   }
+
+  public List<Member> loadUserRoles() {
+    List<Member> members = new ArrayList<>();
+    String roleFilter = Constants.MG_ROLE_PREFIX;
+    String userFilter = Constants.MG_USER_PREFIX;
+    List<Record> allRoles =
+        jooq.fetch(
+            "select distinct m.rolname as member, r.rolname as role"
+                + " from pg_catalog.pg_auth_members am "
+                + " join pg_catalog.pg_roles m on (m.oid = am.member)"
+                + "join pg_catalog.pg_roles r on (r.oid = am.roleid)"
+                + "where r.rolname LIKE {0} and m.rolname LIKE {1}",
+            roleFilter + "%", userFilter + "%");
+
+    for (Record userRecord : allRoles) {
+      String memberName =
+          userRecord.getValue("member", String.class).substring(userFilter.length());
+      String roleName = userRecord.getValue("role", String.class).substring(roleFilter.length());
+      members.add(new Member(memberName, roleName));
+    }
+    return members;
+  }
+
+  public void revokeRoles(String userName, List<Map<String, String>> members) {
+    try {
+      members.forEach(
+          member -> {
+            String prefixedRole =
+                Constants.MG_ROLE_PREFIX + member.get("schemaId") + "/" + member.get(ROLE);
+            jooq.execute(
+                "REVOKE {0} FROM {1}",
+                name(prefixedRole), name(Constants.MG_USER_PREFIX + userName));
+          });
+    } catch (DataAccessException dae) {
+      throw new SqlMolgenisException("Removal of role failed", dae);
+    }
+  }
+
+  public void updateRoles(String userName, List<Map<String, String>> members) {
+    try {
+      members.forEach(
+          member -> {
+            String schemaId = member.get("schemaId");
+            String role = member.get(ROLE);
+            String prefixedRole = MG_ROLE_PREFIX + schemaId + "/" + role;
+            String prefixedName = MG_USER_PREFIX + userName;
+
+            List<Member> existingUserRoles =
+                this.getSchema(schemaId).getMembers().stream()
+                    .filter(mem -> mem.getUser().equals(userName))
+                    .toList();
+            if (existingUserRoles.iterator().hasNext()) {
+              existingUserRoles.forEach(
+                  existingRole -> {
+                    String oldRole = MG_ROLE_PREFIX + schemaId + "/" + existingRole.getRole();
+                    jooq.execute("REVOKE {0} FROM {1}", name(oldRole), name(prefixedName));
+                  });
+            }
+            jooq.execute("GRANT {0} TO {1}", name(prefixedRole), name(prefixedName));
+          });
+    } catch (DataAccessException dae) {
+      throw new SqlMolgenisException("Updating of role failed", dae);
+    }
+  }
 }
diff --git a/backend/molgenis-emx2/src/main/java/org/molgenis/emx2/Database.java b/backend/molgenis-emx2/src/main/java/org/molgenis/emx2/Database.java
index 380cf673cf..9a87356956 100644
--- a/backend/molgenis-emx2/src/main/java/org/molgenis/emx2/Database.java
+++ b/backend/molgenis-emx2/src/main/java/org/molgenis/emx2/Database.java
@@ -101,4 +101,10 @@ public interface Database extends HasSettingsInterface<Database> {
   Map<String, Supplier<Object>> getJavaScriptBindings();
 
   List<LastUpdate> getLastUpdated();
+
+  List<Member> loadUserRoles();
+
+  void revokeRoles(String userName, List<Map<String, String>> revokedRoles);
+
+  void updateRoles(String userName, List<Map<String, String>> roles);
 }
diff --git a/backend/molgenis-emx2/src/main/java/org/molgenis/emx2/User.java b/backend/molgenis-emx2/src/main/java/org/molgenis/emx2/User.java
index b3f04215ff..98d70d91f1 100644
--- a/backend/molgenis-emx2/src/main/java/org/molgenis/emx2/User.java
+++ b/backend/molgenis-emx2/src/main/java/org/molgenis/emx2/User.java
@@ -2,10 +2,7 @@
 
 import static java.util.Objects.requireNonNull;
 
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
+import java.util.*;
 
 public class User extends HasSettings<User> {
   private static final String TOKENS = "access-tokens";