diff --git a/Server/Areas/Identity/Pages/Account/Manage/Organization.cshtml b/Server/Areas/Identity/Pages/Account/Manage/Organization.cshtml
index 683410b31..462a5c1b2 100644
--- a/Server/Areas/Identity/Pages/Account/Manage/Organization.cshtml
+++ b/Server/Areas/Identity/Pages/Account/Manage/Organization.cshtml
@@ -193,11 +193,11 @@
                             If no users are added, everyone will have access.
                         </div>
                         <select multiple class="form-control device-group-user-list mb-1">
-                            @if (Model.DeviceGroups[i]?.PermissionLinks?.Any() == true)
+                            @if (Model.DeviceGroups[i]?.Users?.Any() == true)
                             {
-                                foreach (var link in Model.DeviceGroups[i].PermissionLinks)
+                                foreach (var user in Model.DeviceGroups[i].Users)
                                 {
-                                    <option value="@link.UserID">@link.User.UserName</option>
+                                    <option value="@user.Id">@user.UserName</option>
                                 }
                             }
                         </select>
diff --git a/Server/Areas/Identity/Pages/Account/Register.cshtml.cs b/Server/Areas/Identity/Pages/Account/Register.cshtml.cs
index 54ae01f56..9f33c1561 100644
--- a/Server/Areas/Identity/Pages/Account/Register.cshtml.cs
+++ b/Server/Areas/Identity/Pages/Account/Register.cshtml.cs
@@ -91,7 +91,8 @@ public async Task<IActionResult> OnPostAsync(string returnUrl = null)
                     Email = Input.Email,
                     IsServerAdmin = organizationCount == 0,
                     Organization = new Organization(),
-                    UserOptions = new RemotelyUserOptions()
+                    UserOptions = new RemotelyUserOptions(),
+                    IsAdministrator = true
                 };
                 var result = await _userManager.CreateAsync(user, Input.Password);
 
diff --git a/Server/Data/ApplicationDbContext.cs b/Server/Data/ApplicationDbContext.cs
index fc1bc8552..08822968d 100644
--- a/Server/Data/ApplicationDbContext.cs
+++ b/Server/Data/ApplicationDbContext.cs
@@ -38,8 +38,6 @@ public ApplicationDbContext(DbContextOptions context)
 
         public DbSet<DeviceGroup> DeviceGroups { get; set; }
 
-        public DbSet<UserDevicePermission> PermissionLinks { get; set; }
-
         protected override void OnModelCreating(ModelBuilder builder)
         {
 
@@ -62,8 +60,6 @@ protected override void OnModelCreating(ModelBuilder builder)
             builder.Entity<DeviceGroup>()
                 .HasMany(x => x.Devices)
                 .WithOne(x => x.DeviceGroup);
-            builder.Entity<DeviceGroup>()
-                .HasMany(x => x.PermissionLinks);
             builder.Entity<Organization>()
                 .HasMany(x => x.DeviceGroups)
                 .WithOne(x => x.Organization);
@@ -109,18 +105,13 @@ protected override void OnModelCreating(ModelBuilder builder)
                 .Property(x => x.CommandResults)
                 .Metadata.SetValueComparer(new ValueComparer<ICollection<GenericCommandResult>>(true));
 
-            //builder.Entity<GenericCommandResult>()
-            //    .HasNoKey();
-
-            //builder.Entity<PSCoreCommandResult>()
-            //   .HasNoKey();
-
             builder.Entity<RemotelyUser>()
                .HasOne(x => x.Organization)
                .WithMany(x => x.RemotelyUsers);
 
             builder.Entity<RemotelyUser>()
-                .HasMany(x => x.PermissionLinks);
+                .HasMany(x => x.DeviceGroups)
+                .WithMany(x => x.Users);
             builder.Entity<RemotelyUser>()
                 .HasMany(x => x.Alerts)
                 .WithOne(x => x.User);
@@ -142,7 +133,6 @@ protected override void OnModelCreating(ModelBuilder builder)
             builder.Entity<Device>()
                .Property(x => x.Drives)
                .Metadata.SetValueComparer(new ValueComparer<List<Drive>>(true));
-
             builder.Entity<Device>()
                 .HasIndex(x => x.DeviceName);
             builder.Entity<Device>()
diff --git a/Server/Services/DataService.cs b/Server/Services/DataService.cs
index fcedb9054..a9353fbfd 100644
--- a/Server/Services/DataService.cs
+++ b/Server/Services/DataService.cs
@@ -309,7 +309,7 @@ public bool AddUserToDeviceGroup(string orgID, string groupID, string userName,
             resultMessage = string.Empty;
 
             var deviceGroup = RemotelyContext.DeviceGroups
-                .Include(x => x.PermissionLinks)
+                .Include(x => x.Users)
                 .FirstOrDefault(x =>
                     x.ID == groupID &&
                     x.OrganizationID == orgID);
@@ -323,7 +323,7 @@ public bool AddUserToDeviceGroup(string orgID, string groupID, string userName,
             userName = userName.Trim().ToLower();
 
             var user = RemotelyContext.Users
-                .Include(x => x.PermissionLinks)
+                .Include(x => x.DeviceGroups)
                 .FirstOrDefault(x =>
                     x.UserName.ToLower() == userName &&
                     x.OrganizationID == orgID);
@@ -334,25 +334,17 @@ public bool AddUserToDeviceGroup(string orgID, string groupID, string userName,
                 return false;
             }
 
-            deviceGroup.PermissionLinks ??= new List<UserDevicePermission>();
-            user.PermissionLinks ??= new List<UserDevicePermission>();
+            deviceGroup.Devices ??= new List<Device>();
+            user.DeviceGroups ??= new List<DeviceGroup>();
 
-            if (deviceGroup.PermissionLinks.Any(x => x.UserID == user.Id))
+            if (deviceGroup.Users.Any(x => x.Id == user.Id))
             {
                 resultMessage = "User already in group.";
                 return false;
             }
 
-            var link = new UserDevicePermission()
-            {
-                DeviceGroup = deviceGroup,
-                DeviceGroupID = deviceGroup.ID,
-                User = user,
-                UserID = user.Id
-            };
-
-            deviceGroup.PermissionLinks.Add(link);
-            user.PermissionLinks.Add(link);
+            deviceGroup.Users.Add(user);
+            user.DeviceGroups.Add(deviceGroup);
             RemotelyContext.SaveChanges();
             resultMessage = user.Id;
             return true;
@@ -506,25 +498,25 @@ public void DeleteDeviceGroup(string orgID, string deviceGroupID)
         {
             var deviceGroup = RemotelyContext.DeviceGroups
                 .Include(x => x.Devices)
-                .Include(x => x.PermissionLinks)
-                .ThenInclude(x => x.User)
-                    .FirstOrDefault(x =>
-                        x.ID == deviceGroupID &&
-                        x.OrganizationID == orgID);
+                .Include(x => x.Users)
+                .ThenInclude(x => x.DeviceGroups)
+                .FirstOrDefault(x =>
+                    x.ID == deviceGroupID &&
+                    x.OrganizationID == orgID);
 
             deviceGroup.Devices?.ForEach(x =>
             {
                 x.DeviceGroup = null;
             });
 
-            deviceGroup.PermissionLinks?.ToList()?.ForEach(x =>
+            deviceGroup.Users?.ForEach(x =>
             {
-                x.User = null;
-                x.DeviceGroup = null;
-
-                RemotelyContext.PermissionLinks.Remove(x);
+                x.DeviceGroups.Remove(deviceGroup);
             });
 
+            deviceGroup.Devices.Clear();
+            deviceGroup.Users.Clear();
+
             RemotelyContext.DeviceGroups.Remove(deviceGroup);
 
             RemotelyContext.SaveChanges();
@@ -575,13 +567,13 @@ public bool DoesUserHaveAccessToDevice(string deviceID, RemotelyUser remotelyUse
         {
             return RemotelyContext.Devices
                 .Include(x => x.DeviceGroup)
-                .ThenInclude(x => x.PermissionLinks)
+                .ThenInclude(x => x.Users)
                 .Any(device => device.OrganizationID == remotelyUser.OrganizationID &&
                     device.ID == deviceID &&
                     (
                         remotelyUser.IsAdministrator ||
                         string.IsNullOrWhiteSpace(device.DeviceGroupID) ||
-                        device.DeviceGroup.PermissionLinks.Any(permission => permission.UserID == remotelyUser.Id
+                        device.DeviceGroup.Users.Any(user => user.Id == remotelyUser.Id
                     )));
         }
 
@@ -596,14 +588,14 @@ public string[] FilterDeviceIDsByUserPermission(string[] deviceIDs, RemotelyUser
         {
             return RemotelyContext.Devices
                 .Include(x => x.DeviceGroup)
-                .ThenInclude(x => x.PermissionLinks)
+                .ThenInclude(x => x.Users)
                 .Where(device =>
                     device.OrganizationID == remotelyUser.OrganizationID &&
                     deviceIDs.Contains(device.ID) &&
                     (
                         remotelyUser.IsAdministrator ||
-                        device.DeviceGroup.PermissionLinks.Count == 0 ||
-                        device.DeviceGroup.PermissionLinks.Any(permission => permission.UserID == remotelyUser.Id
+                        device.DeviceGroup.Users.Count == 0 ||
+                        device.DeviceGroup.Users.Any(user => user.Id == remotelyUser.Id
                     )))
                 .Select(x => x.ID)
                 .ToArray();
@@ -613,7 +605,7 @@ public string[] FilterUsersByDevicePermission(IEnumerable<string> userIDs, strin
         {
             var device = RemotelyContext.Devices
                 .Include(x => x.DeviceGroup)
-                .ThenInclude(x => x.PermissionLinks)
+                .ThenInclude(x => x.Users)
                 .FirstOrDefault(x => x.ID == deviceID);
 
             var orgUsers = RemotelyContext.Users
@@ -628,7 +620,7 @@ public string[] FilterUsersByDevicePermission(IEnumerable<string> userIDs, strin
                     .ToArray();
             }
 
-            var allowedUsers = device?.DeviceGroup?.PermissionLinks?.Select(x => x.UserID) ?? Array.Empty<string>();
+            var allowedUsers = device?.DeviceGroup?.Users?.Select(x => x.Id) ?? Array.Empty<string>();
 
             return orgUsers
                 .Where(user =>
@@ -757,14 +749,14 @@ public IEnumerable<DeviceGroup> GetDeviceGroups(string username)
             var userId = user.Id;
 
             return RemotelyContext.DeviceGroups
-                .Include(x => x.PermissionLinks)
-                .ThenInclude(x => x.User)
+                .Include(x => x.Users)
+                .ThenInclude(x => x.DeviceGroups)
                 .Where(x =>
                     x.OrganizationID == user.OrganizationID &&
                     (
                         user.IsAdministrator ||
-                        x.PermissionLinks.Count == 0 ||
-                        x.PermissionLinks.Any(x => x.UserID == userId)
+                        x.Users.Count == 0 ||
+                        x.Users.Any(x => x.Id == userId)
                     )
                 )
                 .OrderBy(x => x.Name) ?? Enumerable.Empty<DeviceGroup>();
@@ -777,13 +769,13 @@ public IEnumerable<Device> GetDevicesForUser(string userName)
 
             return RemotelyContext.Devices
                 .Include(x => x.DeviceGroup)
-                .ThenInclude(x => x.PermissionLinks)
+                .ThenInclude(x => x.Users)
                 .Where(x =>
                     x.OrganizationID == user.OrganizationID &&
                     (
                         user.IsAdministrator ||
                         string.IsNullOrWhiteSpace(x.DeviceGroupID)||
-                        x.DeviceGroup.PermissionLinks.Any(permission => permission.UserID == userID)
+                        x.DeviceGroup.Users.Any(user => user.Id == userID)
                     ));
         }
 
@@ -923,20 +915,18 @@ public void RemoveDevices(string[] deviceIDs)
         public async Task<bool> RemoveUserFromDeviceGroup(string orgID, string groupID, string userID)
         {
             var deviceGroup = RemotelyContext.DeviceGroups
-                .Include(x => x.PermissionLinks)
-                .ThenInclude(x => x.User)
+                .Include(x => x.Users)
+                .ThenInclude(x => x.DeviceGroups)
                 .FirstOrDefault(x =>
                     x.ID == groupID &&
                     x.OrganizationID == orgID);
 
-            if (deviceGroup?.PermissionLinks?.Any(x => x.UserID == userID) == true)
+            if (deviceGroup?.Users?.Any(x => x.Id == userID) == true)
             {
-                var link = deviceGroup.PermissionLinks.FirstOrDefault(x => x.UserID == userID);
+                var user = deviceGroup.Users.FirstOrDefault(x => x.Id == userID);
 
-                link.User = null;
-                link.DeviceGroup = null;
-
-                RemotelyContext.PermissionLinks.Remove(link);
+                user.DeviceGroups.Remove(deviceGroup);
+                deviceGroup.Users.Remove(user);
 
                 await RemotelyContext.SaveChangesAsync();
                 return true;
@@ -947,22 +937,19 @@ public async Task<bool> RemoveUserFromDeviceGroup(string orgID, string groupID,
         public async Task RemoveUserFromOrganization(string orgID, string targetUserID)
         {
             var target = RemotelyContext.Users
-                .Include(x => x.PermissionLinks)
-                .ThenInclude(x => x.DeviceGroup)
+                .Include(x => x.DeviceGroups)
+                .ThenInclude(x => x.Devices)
                 .Include(x => x.Organization)
                 .Include(x => x.Alerts)
                 .FirstOrDefault(x =>
                     x.Id == targetUserID &&
                     x.OrganizationID == orgID);
 
-            if (target?.PermissionLinks?.Any() == true)
+            if (target?.DeviceGroups?.Any() == true)
             {
-                foreach (var link in target.PermissionLinks.ToList())
+                foreach (var deviceGroup in target.DeviceGroups.ToList())
                 {
-                    link.DeviceGroup = null;
-                    link.User = null;
-
-                    RemotelyContext.PermissionLinks.Remove(link);
+                    deviceGroup.Users.Remove(target);
                 }
             }
 
diff --git a/Shared/Models/DeviceGroup.cs b/Shared/Models/DeviceGroup.cs
index 7ff1fded2..9ef8770e1 100644
--- a/Shared/Models/DeviceGroup.cs
+++ b/Shared/Models/DeviceGroup.cs
@@ -21,6 +21,6 @@ public class DeviceGroup
 
         public string OrganizationID { get; set; }
 
-        public List<UserDevicePermission> PermissionLinks { get; set; }
+        public List<RemotelyUser> Users { get; set; }
     }
 }
diff --git a/Shared/Models/RemotelyUser.cs b/Shared/Models/RemotelyUser.cs
index 8430dda87..2a1f17167 100644
--- a/Shared/Models/RemotelyUser.cs
+++ b/Shared/Models/RemotelyUser.cs
@@ -12,14 +12,14 @@ public class RemotelyUser : IdentityUser
         [StringLength(100)]
         public string DisplayName { get; set; }
 
-        public bool IsAdministrator { get; set; } = true;
+        public bool IsAdministrator { get; set; }
         public bool IsServerAdmin { get; set; }
 
         [JsonIgnore]
         public Organization Organization { get; set; }
         public string OrganizationID { get; set; }
 
-        public List<UserDevicePermission> PermissionLinks { get; set; }
+        public List<DeviceGroup> DeviceGroups { get; set; }
 
         public string TempPassword { get; set; }
 
diff --git a/Shared/Models/UserDevicePermission.cs b/Shared/Models/UserDevicePermission.cs
deleted file mode 100644
index 8e4bc7daf..000000000
--- a/Shared/Models/UserDevicePermission.cs
+++ /dev/null
@@ -1,22 +0,0 @@
-using System;
-using System.ComponentModel.DataAnnotations;
-using System.Text.Json.Serialization;
-
-namespace Remotely.Shared.Models
-{
-    public class UserDevicePermission
-    {
-        [Key]
-        public string ID { get; set; } = Guid.NewGuid().ToString();
-
-        public string UserID { get; set; }
-
-        [JsonIgnore]
-        public RemotelyUser User { get; set; }
-
-        public string DeviceGroupID { get; set; }
-
-        [JsonIgnore]
-        public DeviceGroup DeviceGroup { get; set; }
-    }
-}