Member Groups and Roles in Umbraco

Note

Version scope: this guide targets Umbraco 8 on the classic ASP.NET / .NET Framework membership stack. Current Umbraco versions use ASP.NET Core Identity and a different API.

Suppose an Umbraco 8 site has a member registered as umbraco-member@example.com and two Member Groups:

  1. Customers

  2. Partners

The goal is to assign both groups from code. In the back office, these are called Member Groups - in Umbraco's service APIs, they are also represented as roles.

This is useful when group membership is determined by business rules such as registration type, subscription status, partner onboarding, or external system integration.

Recommended Umbraco 8 Approach: IMemberService

When you are already inside an Umbraco application, using IMemberService keeps the operation within Umbraco's service layer and avoids coupling your application code directly to the static ASP.NET roles API.

using System;
using Umbraco.Core.Services;

public sealed class MemberGroupAssigner
{
    private readonly IMemberService _memberService;

    public MemberGroupAssigner(IMemberService memberService)
    {
        _memberService = memberService;
    }

    public void AssignGroups(string memberEmail, params string[] groupNames)
    {
        var member = _memberService.GetByEmail(memberEmail);

        if (member == null)
            throw new InvalidOperationException($"Member '{memberEmail}' was not found.");

        foreach (var groupName in groupNames)
        {
            if (string.IsNullOrWhiteSpace(groupName))
                continue;

            _memberService.AssignRole(member.Id, groupName);
        }
    }
}

Use it like this:

memberGroupAssigner.AssignGroups(
    "umbraco-member@example.com",
    "Customers",
    "Partners");

Note

Keep group names intentional. The role names passed to AssignRole should match the Member Groups used by your Umbraco installation. Treat them as application configuration or clearly named constants when they are part of business logic.

Alternative: ASP.NET Roles API

Umbraco 8 runs on the classic ASP.NET membership stack, so the System.Web.Security.Roles API can also assign several roles in a single call:

using System.Web.Security;

Roles.AddUserToRoles(
    "umbraco-member@example.com",
    new[] { "Customers", "Partners" });

AddUserToRoles takes the member name used by the configured membership provider and an array of roles. This concise approach is useful in legacy code that already relies on the ASP.NET membership and role providers.

For new Umbraco 8 application code, prefer the Umbraco service layer when it fits the surrounding architecture.

Validate the Role Assignment

After running the code, open the Members section in the Umbraco backoffice, select the member, and verify that both Customers and Partners are assigned.

Umbraco back-office – two member roles were assigned

Umbraco back-office – two member roles were assigned

If your authorization logic depends on those groups, test the protected functionality as well. Verifying only the database or back-office state does not confirm that the complete authorization flow behaves as expected.

Production Considerations

  • Validate the member first: do not assume an email or username resolves to an existing member.

  • Use known group names: avoid accepting arbitrary role names from an untrusted request.

  • Keep authorization server-side: group assignment is security-sensitive application state and should be driven by trusted business rules.

  • Make repeated operations safe: assignment code may be called more than once during registration or synchronization workflows, so test repeat execution in your exact Umbraco 8 setup.

  • Log meaningful failures: failed member lookup or role assignment should be diagnosable without logging sensitive credentials or unnecessary personal data.

References

  • Umbraco Members documentation — explains Member Groups and their role in member authorization. The current implementation differs from Umbraco 8, but the Member Group concept remains relevant.

  • Roles.AddUserToRoles API — Microsoft reference for the classic ASP.NET roles API used by the alternative example.

Conclusion

Programmatic Member Group assignment is useful when membership is determined by application rules rather than manual back-office administration. In Umbraco 8, IMemberService.AssignRole provides an Umbraco-specific way to assign a member to groups, while Roles.AddUserToRoles remains a concise option for code built directly on the classic ASP.NET membership providers.

Whichever approach you use, validate the member, keep group names under application control, and verify the resulting authorization behavior after the assignment.