diff --git a/changelog/unreleased/default-role-assignments.md b/changelog/unreleased/default-role-assignments.md
new file mode 100644
index 0000000000..a966741046
--- /dev/null
+++ b/changelog/unreleased/default-role-assignments.md
@@ -0,0 +1,6 @@
+Enhancement: Don't setup demo role assignments on default 
+
+Added a configuration option to explicitly tell the settings service to generate the default role assignments.
+
+https://github.com/owncloud/ocis/issues/3661
+https://github.com/owncloud/ocis/pull/3956
diff --git a/extensions/settings/pkg/config/config.go b/extensions/settings/pkg/config/config.go
index 9cd5329cad..4deda52a8d 100644
--- a/extensions/settings/pkg/config/config.go
+++ b/extensions/settings/pkg/config/config.go
@@ -28,6 +28,8 @@ type Config struct {
 	Asset        Asset         `yaml:"asset"`
 	TokenManager *TokenManager `yaml:"token_manager"`
 
+	SetupDefaultAssignments bool `yaml:"set_default_assignments" env:"SETTINGS_SETUP_DEFAULT_ASSIGNMENTS;ACCOUNTS_DEMO_USERS_AND_GROUPS" desc:"If the default role assignments for the demo users should be setup."`
+
 	Context context.Context `yaml:"-"`
 }
 
diff --git a/extensions/settings/pkg/config/defaults/defaultconfig.go b/extensions/settings/pkg/config/defaults/defaultconfig.go
index 6bffa9819e..66ec6ceb3c 100644
--- a/extensions/settings/pkg/config/defaults/defaultconfig.go
+++ b/extensions/settings/pkg/config/defaults/defaultconfig.go
@@ -48,7 +48,7 @@ func DefaultConfig() *config.Config {
 		Asset: config.Asset{
 			Path: "",
 		},
-
+		SetupDefaultAssignments: false,
 		Metadata: config.Metadata{
 			GatewayAddress: "127.0.0.1:9215", // system storage
 			StorageAddress: "127.0.0.1:9215",
diff --git a/extensions/settings/pkg/service/v0/service.go b/extensions/settings/pkg/service/v0/service.go
index ae3cce17ac..7142ebc096 100644
--- a/extensions/settings/pkg/service/v0/service.go
+++ b/extensions/settings/pkg/service/v0/service.go
@@ -126,9 +126,11 @@ func (g Service) RegisterDefaultRoles() {
 		}
 	}
 
-	for _, req := range g.defaultRoleAssignments() {
-		if _, err := g.manager.WriteRoleAssignment(req.AccountUuid, req.RoleId); err != nil {
-			g.logger.Error().Err(err).Msg("failed to register role assignment")
+	if g.config.SetupDefaultAssignments {
+		for _, req := range g.defaultRoleAssignments() {
+			if _, err := g.manager.WriteRoleAssignment(req.AccountUuid, req.RoleId); err != nil {
+				g.logger.Error().Err(err).Msg("failed to register role assignment")
+			}
 		}
 	}
 }
diff --git a/extensions/settings/pkg/service/v0/settings.go b/extensions/settings/pkg/service/v0/settings.go
index 825fc47f5e..8f810c952b 100644
--- a/extensions/settings/pkg/service/v0/settings.go
+++ b/extensions/settings/pkg/service/v0/settings.go
@@ -544,15 +544,15 @@ func (g Service) defaultRoleAssignments() []*settingsmsg.UserRoleAssignment {
 		},
 		// default users with role "user"
 		{
-			AccountUuid: "4c510ada-c86b-4815-8820-42cdf82c3d51",
+			AccountUuid: "4c510ada-c86b-4815-8820-42cdf82c3d51", // demo user "einstein"
 			RoleId:      BundleUUIDRoleUser,
 		}, {
-			AccountUuid: "f7fbf8c8-139b-4376-b307-cf0a8c2d0d9c",
+			AccountUuid: "f7fbf8c8-139b-4376-b307-cf0a8c2d0d9c", // demo user "marie"
 			RoleId:      BundleUUIDRoleUser,
 		},
 		// default users with role "spaceadmin"
 		{
-			AccountUuid: "534bb038-6f9d-4093-946f-133be61fa4e7",
+			AccountUuid: "534bb038-6f9d-4093-946f-133be61fa4e7", // demo user "katherine"
 			RoleId:      BundleUUIDRoleSpaceAdmin,
 		},
 	}