diff --git a/backend/.sqlx/query-53210d19693ba46d97352b0ee321af59db453243c0cd17928ee942723d9cdc5c.json b/backend/.sqlx/query-53210d19693ba46d97352b0ee321af59db453243c0cd17928ee942723d9cdc5c.json
new file mode 100644
index 0000000000..dfb445ed36
--- /dev/null
+++ b/backend/.sqlx/query-53210d19693ba46d97352b0ee321af59db453243c0cd17928ee942723d9cdc5c.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT workspace_id, auto_add_instance_groups_roles FROM workspace_settings WHERE $1 = ANY(COALESCE(auto_add_instance_groups, '{}'))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "auto_add_instance_groups_roles",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "53210d19693ba46d97352b0ee321af59db453243c0cd17928ee942723d9cdc5c"
+}
diff --git a/backend/windmill-api/src/groups.rs b/backend/windmill-api/src/groups.rs
index afe73f3bc8..4325a7c9c5 100644
--- a/backend/windmill-api/src/groups.rs
+++ b/backend/windmill-api/src/groups.rs
@@ -633,6 +633,20 @@ async fn add_user_igroup(
         Some([("email", email.as_str())].into()),
     )
     .await?;
+
+    // Sync user to workspaces configured with this instance group
+    #[cfg(all(feature = "private", feature = "enterprise"))]
+    {
+        use crate::workspaces_ee::auto_add_user;
+        let workspaces = sqlx::query!("SELECT workspace_id, auto_add_instance_groups_roles FROM workspace_settings WHERE $1 = ANY(COALESCE(auto_add_instance_groups, '{}'))", &name).fetch_all(&mut *tx).await?;
+        for ws in workspaces {
+            let role = ws.auto_add_instance_groups_roles.and_then(|r| r.get(&name).and_then(|v| v.as_str().map(String::from))).unwrap_or_else(|| "developer".to_string());
+            let (is_admin, is_operator) = match role.as_str() { "admin" => (true, false), "operator" => (false, true), _ => (false, false) };
+            auto_add_user(&email, &ws.workspace_id, &is_operator, &mut tx, &authed, Some(serde_json::json!({"source": "instance_group", "group": &name}))).await?;
+            if is_admin { sqlx::query!("UPDATE usr SET is_admin = true WHERE workspace_id = $1 AND email = $2", &ws.workspace_id, &email).execute(&mut *tx).await?; }
+        }
+    }
+
     tx.commit().await?;
     Ok(format!("Added {} to igroup {}", email, name))
 }
@@ -781,8 +795,16 @@ async fn remove_user_igroup(
         Some([("email", email.as_str())].into()),
     )
     .await?;
+
+    // Remove user from workspaces where they were added via this instance group
+    #[cfg(all(feature = "private", feature = "enterprise"))]
+    {
+        use crate::workspaces_ee::remove_users_from_instance_group_workspaces;
+        remove_users_from_instance_group_workspaces(&email, &name, &mut tx).await?;
+    }
+
     tx.commit().await?;
-    Ok(format!("Added {} to igroup {}", email, name))
+    Ok(format!("Removed {} from igroup {}", email, name))
 }
 
 async fn remove_user(