diff --git a/webadmin/src/views/apps.html b/webadmin/src/views/apps.html
index 4ae37a28e..bd232d0af 100644
--- a/webadmin/src/views/apps.html
+++ b/webadmin/src/views/apps.html
@@ -89,17 +89,25 @@
                             <div class="radio">
                                 <label>
                                     <input type="radio" ng-model="appConfigure.accessRestrictionOption" value="groups" ng-disabled="groups.length <= 1">
-                                    Only allow the following user groups <span class="label label-danger" ng-show="appConfigure.accessRestrictionOption === 'groups' && !appConfigure.isAccessRestrictionValid()">Select at least one group</span>
+                                    Only allow the following users and groups <span class="label label-danger" ng-show="appConfigure.accessRestrictionOption === 'groups' && !appConfigure.isAccessRestrictionValid()">Select at least one user or group</span>
                                 </label>
                             </div>
-                            <div ng-show="groups.length <= 1" style="margin-left: 20px;">No groups available. <a href="#/users">Create groups</a></div>
                             <div>
                                 <div style="margin-left: 20px;">
-                                    <span ng-repeat="group in groups | ignoreAdminGroup">
-                                        <button class="btn btn-default" type="button" ng-disabled="appConfigure.accessRestrictionOption !== 'groups'" ng-click="appConfigureToggleGroup(group);" ng-class="{ 'btn-primary': (appConfigure.accessRestriction.groups && appConfigure.accessRestriction.groups.indexOf(group.id) !== -1) }">{{ group.name }}</button>
-                                    </span>
+                                    <div class="col-md-5">
+                                        <b>Users: &nbsp;</b>
+                                        <multiselect ng-model="appConfigure.accessRestriction.users" ng-disabled="appConfigure.accessRestrictionOption !== 'groups'" options="user.username for user in users" data-multiple="true"></multiselect>
+                                    </div>
+
+                                    <div class="col-md-5">
+                                        <b>Groups: &nbsp;</b>
+                                        <multiselect ng-model="appConfigure.accessRestriction.groups" ng-disabled="appConfigure.accessRestrictionOption !== 'groups'" options="group.name for group in (groups | ignoreAdminGroup)" data-multiple="true"></multiselect>
+                                    </div>
                                 </div>
                             </div>
+
+                            <br/>
+                            <br/>
                         </div>
 
                         <p ng-show="!mailConfig.enabled && appConfigure.app.manifest.addons.email" class="text-danger">
diff --git a/webadmin/src/views/apps.js b/webadmin/src/views/apps.js
index d799a4b27..de4a2d717 100644
--- a/webadmin/src/views/apps.js
+++ b/webadmin/src/views/apps.js
@@ -218,14 +218,6 @@ angular.module('Application').controller('AppsController', ['$scope', '$location
         });
     };
 
-    $scope.appConfigureToggleGroup = function (group) {
-        var groups = $scope.appConfigure.accessRestriction.groups;
-        var pos = groups.indexOf(group.id);
-
-        if (pos === -1) groups.push(group.id);
-        else groups.splice(pos, 1);
-    };
-
     $scope.useAltDomain = function (use) {
         $scope.appConfigure.usingAltDomain = use;
 
@@ -244,8 +236,7 @@ angular.module('Application').controller('AppsController', ['$scope', '$location
         $scope.appConfigure.location = app.altDomain || app.location;
         $scope.appConfigure.usingAltDomain = !!app.altDomain;
         $scope.appConfigure.portBindingsInfo = app.manifest.tcpPorts || {}; // Portbinding map only for information
-        $scope.appConfigure.accessRestrictionOption = app.accessRestriction ? 'groups' : 'any';
-        $scope.appConfigure.accessRestriction = app.accessRestriction || { users: [], groups: [] };
+        $scope. Option = app.accessRestriction ? 'groups' : 'any';
         $scope.appConfigure.memoryLimit = app.memoryLimit || app.manifest.memoryLimit || (256 * 1024 * 1024);
         $scope.appConfigure.xFrameOptions = app.xFrameOptions.indexOf('ALLOW-FROM') === 0 ? app.xFrameOptions.split(' ')[1] : '';
         $scope.appConfigure.customAuth = !(app.manifest.addons['ldap'] || app.manifest.addons['oauth']);
@@ -264,6 +255,17 @@ angular.module('Application').controller('AppsController', ['$scope', '$location
         }
 
         $scope.appConfigure.accessRestrictionOption = app.accessRestriction ? 'groups' : 'any';
+        $scope.appConfigure.accessRestriction = { users: [], groups: [] };
+
+        if (app.accessRestriction) {
+            var userSet = { };
+            app.accessRestriction.users.forEach(function (uid) { userSet[uid] = true; });
+            $scope.users.forEach(function (u) { if (userSet[u.id] === true) $scope.appConfigure.accessRestriction.users.push(u); });
+
+            var groupSet = { };
+            app.accessRestriction.groups.forEach(function (gid) { groupSet[gid] = true; });
+            $scope.groups.forEach(function (g) { if (groupSet[g.id] === true) $scope.appConfigure.accessRestriction.groups.push(g); });
+        }
 
         // fill the portBinding structures. There might be holes in the app.portBindings, which signalizes a disabled port
         for (var env in $scope.appConfigure.portBindingsInfo) {
@@ -293,11 +295,18 @@ angular.module('Application').controller('AppsController', ['$scope', '$location
             }
         }
 
+        var finalAccessRestriction = null;
+        if ($scope.appConfigure.accessRestrictionOption === 'groups') {
+            finalAccessRestriction = { users: [], groups: [] };
+            finalAccessRestriction.users = $scope.appConfigure.accessRestriction.users.map(function (u) { return u.id; });
+            finalAccessRestriction.groups = $scope.appConfigure.accessRestriction.groups.map(function (g) { return g.id; });
+        }
+
         var data = {
             location:  $scope.appConfigure.usingAltDomain ? $scope.appConfigure.app.location : $scope.appConfigure.location,
             altDomain: $scope.appConfigure.usingAltDomain ? $scope.appConfigure.location : null,
             portBindings: finalPortBindings,
-            accessRestriction: $scope.appConfigure.accessRestrictionOption === 'groups' ? $scope.appConfigure.accessRestriction : null,
+            accessRestriction: finalAccessRestriction,
             cert: $scope.appConfigure.certificateFile,
             key: $scope.appConfigure.keyFile,
             xFrameOptions: $scope.appConfigure.xFrameOptions ? ('ALLOW-FROM ' + $scope.appConfigure.xFrameOptions) : 'SAMEORIGIN',
diff --git a/webadmin/src/views/appstore.html b/webadmin/src/views/appstore.html
index 282558eff..8c3888a65 100644
--- a/webadmin/src/views/appstore.html
+++ b/webadmin/src/views/appstore.html
@@ -73,17 +73,25 @@
                             <div class="radio">
                                 <label>
                                     <input type="radio" ng-model="appInstall.accessRestrictionOption" value="groups" ng-disabled="groups.length <= 1">
-                                    Only allow the following user groups <span class="label label-danger" ng-show="appInstall.accessRestrictionOption === 'groups' && !appInstall.isAccessRestrictionValid()">Select at least one group</span>
+                                    Only allow the following users and groups <span class="label label-danger" ng-show="appInstall.accessRestrictionOption === 'groups' && !appInstall.isAccessRestrictionValid()">Select at least one user or group</span>
                                 </label>
                             </div>
-                            <div ng-show="groups.length <= 1" style="margin-left: 20px;">No groups available. <a href="" ng-click="showView('/users')">Create groups</a></div>
                             <div>
                                 <div style="margin-left: 20px;">
-                                    <span ng-repeat="group in groups | ignoreAdminGroup">
-                                        <button class="btn btn-default" type="button" ng-disabled="appInstall.accessRestrictionOption !== 'groups'" ng-click="appInstall.toggleGroup(group);" ng-class="{ 'btn-primary': (appInstall.accessRestriction.groups && appInstall.accessRestriction.groups.indexOf(group.id) !== -1) }">{{ group.name }}</button>
-                                    </span>
+                                    <div class="col-md-5">
+                                        <b>Users: &nbsp;</b>
+                                        <multiselect ng-model="appInstall.accessRestriction.users" ng-disabled="appInstall.accessRestrictionOption !== 'groups'" options="user.username for user in users" data-multiple="true"></multiselect>
+                                    </div>
+
+                                    <div class="col-md-5">
+                                        <b>Groups: &nbsp;</b>
+                                        <multiselect ng-model="appInstall.accessRestriction.groups" ng-disabled="appInstall.accessRestrictionOption !== 'groups'" options="group.name for group in (groups | ignoreAdminGroup)" data-multiple="true"></multiselect>
+                                    </div>
                                 </div>
                             </div>
+
+                            <br/>
+                            <br/>
                         </div>
 
                         <p ng-show="!mailConfig.enabled && appInstall.app.manifest.addons.email" class="text-danger">
diff --git a/webadmin/src/views/appstore.js b/webadmin/src/views/appstore.js
index 88bf02215..fae104b59 100644
--- a/webadmin/src/views/appstore.js
+++ b/webadmin/src/views/appstore.js
@@ -53,14 +53,6 @@ angular.module('Application').controller('AppStoreController', ['$scope', '$loca
             return !!(tmp.users.length || tmp.groups.length);
         },
 
-        toggleGroup: function (group) {
-            var groups = $scope.appInstall.accessRestriction.groups;
-            var pos = groups.indexOf(group.id);
-
-            if (pos === -1) groups.push(group.id);
-            else groups.splice(pos, 1);
-        },
-
         reset: function () {
             $scope.appInstall.app = {};
             $scope.appInstall.error = {};
@@ -144,13 +136,17 @@ angular.module('Application').controller('AppStoreController', ['$scope', '$loca
                 }
             }
 
-            // translate to accessRestriction object
-            var accessRestriction = $scope.appInstall.accessRestrictionOption === 'groups' ? $scope.appInstall.accessRestriction : null;
+            var finalAccessRestriction = null;
+            if ($scope.appInstall.accessRestrictionOption === 'groups') {
+                finalAccessRestriction = { users: [], groups: [] };
+                finalAccessRestriction.users = $scope.appInstall.accessRestriction.users.map(function (u) { return u.id; });
+                finalAccessRestriction.groups = $scope.appInstall.accessRestriction.groups.map(function (g) { return g.id; });
+            }
 
             var data = {
                 location: $scope.appInstall.location || '',
                 portBindings: finalPortBindings,
-                accessRestriction: accessRestriction,
+                accessRestriction: finalAccessRestriction,
                 cert: $scope.appInstall.certificateFile,
                 key: $scope.appInstall.keyFile,
                 sso: !$scope.appInstall.optionalSso ? undefined : ($scope.appInstall.accessRestrictionOption !== 'nosso')