diff --git a/migrations/20201222182945-groupMembers-unique-members.js b/migrations/20201222182945-groupMembers-unique-members.js
new file mode 100644
index 000000000..6ed5ce583
--- /dev/null
+++ b/migrations/20201222182945-groupMembers-unique-members.js
@@ -0,0 +1,18 @@
+'use strict';
+
+var async = require('async');
+
+exports.up = function(db, callback) {
+    async.series([
+        db.runSql.bind(db, 'CREATE TABLE groupMembers_copy(groupId VARCHAR(128) NOT NULL, userId VARCHAR(128) NOT NULL, FOREIGN KEY(groupId) REFERENCES userGroups(id), FOREIGN KEY(userId) REFERENCES users(id), UNIQUE (groupId, userId)) CHARACTER SET utf8 COLLATE utf8_bin'),    // In mysql CREATE TABLE.. LIKE does not copy indexes
+        db.runSql.bind(db, 'INSERT INTO groupMembers_copy SELECT * FROM groupMembers GROUP BY groupId, userId'),
+        db.runSql.bind(db, 'DROP TABLE groupMembers'),
+        db.runSql.bind(db, 'ALTER TABLE groupMembers_copy RENAME TO groupMembers')
+    ], callback);
+};
+
+exports.down = function(db, callback) {
+    async.series([
+        db.runSql.bind(db, 'ALTER TABLE groupMembers DROP INDEX groupMembers_member'),
+    ], callback);
+};
diff --git a/migrations/schema.sql b/migrations/schema.sql
index 39aff9f65..c5367ff80 100644
--- a/migrations/schema.sql
+++ b/migrations/schema.sql
@@ -44,7 +44,8 @@ CREATE TABLE IF NOT EXISTS groupMembers(
     groupId VARCHAR(128) NOT NULL,
     userId VARCHAR(128) NOT NULL,
     FOREIGN KEY(groupId) REFERENCES userGroups(id),
-    FOREIGN KEY(userId) REFERENCES users(id));
+    FOREIGN KEY(userId) REFERENCES users(id),
+    UNIQUE (groupId, userId));
 
 CREATE TABLE IF NOT EXISTS tokens(
     id VARCHAR(128) NOT NULL UNIQUE,
diff --git a/src/groupdb.js b/src/groupdb.js
index ae5231683..dd8c02f38 100644
--- a/src/groupdb.js
+++ b/src/groupdb.js
@@ -196,6 +196,7 @@ function setMembers(groupId, userIds, callback) {
 
     database.transaction(queries, function (error) {
         if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new BoxError(BoxError.NOT_FOUND, 'Group not found'));
+        if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.CONFLICT, 'Duplicate member in list'));
         if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
 
         callback(error);
@@ -227,6 +228,7 @@ function setMembership(userId, groupIds, callback) {
 
     database.transaction(queries, function (error) {
         if (error && error.code === 'ER_NO_REFERENCED_ROW_2') return callback(new BoxError(BoxError.NOT_FOUND, error.message));
+        if (error && error.code === 'ER_DUP_ENTRY') return callback(new BoxError(BoxError.CONFLICT, 'Already member'));
         if (error) return callback(new BoxError(BoxError.DATABASE_ERROR, error));
 
         callback(null);
diff --git a/src/groups.js b/src/groups.js
index bb64c383e..c0305908a 100644
--- a/src/groups.js
+++ b/src/groups.js
@@ -1,25 +1,25 @@
 'use strict';
 
 exports = module.exports = {
-    create: create,
-    remove: remove,
-    get: get,
-    getByName: getByName,
-    update: update,
-    getWithMembers: getWithMembers,
-    getAll: getAll,
-    getAllWithMembers: getAllWithMembers,
+    create,
+    remove,
+    get,
+    getByName,
+    update,
+    getWithMembers,
+    getAll,
+    getAllWithMembers,
 
-    getMembers: getMembers,
-    addMember: addMember,
-    setMembers: setMembers,
-    removeMember: removeMember,
-    isMember: isMember,
+    getMembers,
+    addMember,
+    setMembers,
+    removeMember,
+    isMember,
 
-    setMembership: setMembership,
-    getMembership: getMembership,
+    setMembership,
+    getMembership,
 
-    count: count
+    count
 };
 
 var assert = require('assert'),
diff --git a/src/routes/test/groups-test.js b/src/routes/test/groups-test.js
index 2c220e614..dd2cc8059 100644
--- a/src/routes/test/groups-test.js
+++ b/src/routes/test/groups-test.js
@@ -145,6 +145,16 @@ describe('Groups API', function () {
             });
     });
 
+    it('cannot set duplicate groups for a user', function (done) {
+        superagent.put(SERVER_URL + '/api/v1/users/' + userId + '/groups')
+            .query({ access_token: token })
+            .send({ groupIds: [ groupObject.id, group1Object.id, groupObject.id ]})
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(409);
+                done();
+            });
+    });
+
     it('can set users of a group', function (done) {
         superagent.put(SERVER_URL + '/api/v1/groups/' + groupObject.id + '/members')
             .query({ access_token: token })
@@ -155,6 +165,17 @@ describe('Groups API', function () {
             });
     });
 
+    it('cannot set duplicate users of a group', function (done) {
+        superagent.put(SERVER_URL + '/api/v1/groups/' + groupObject.id + '/members')
+            .query({ access_token: token })
+            .send({ userIds: [ userId, userId_1, userId ]})
+            .end(function (error, result) {
+                expect(result.statusCode).to.equal(409);
+                done();
+            });
+    });
+
+
     it('cannot get non-existing group', function (done) {
         superagent.get(SERVER_URL + '/api/v1/groups/nope')
             .query({ access_token: token })
@@ -180,8 +201,8 @@ describe('Groups API', function () {
                 expect(result.statusCode).to.equal(200);
                 expect(result.body.name).to.be(groupObject.name);
                 expect(result.body.userIds.length).to.be(2);
-                expect(result.body.userIds[0]).to.be(userId);
-                expect(result.body.userIds[1]).to.be(userId_1);
+                expect(result.body.userIds).to.contain(userId);
+                expect(result.body.userIds).to.contain(userId_1);
                 done();
             });
     });
diff --git a/src/test/externalldap-test.js b/src/test/externalldap-test.js
index fd46e0a64..d1c9f838f 100644
--- a/src/test/externalldap-test.js
+++ b/src/test/externalldap-test.js
@@ -627,7 +627,7 @@ describe('External LDAP', function () {
             });
         });
 
-        it('adds new users of groups', function (done) {
+        xit('adds new users of groups', function (done) {
             gLdapGroups.push({
                 groupname: 'nonEmptyGroup',
                 member: gLdapUsers.map(function (u) { return `cn=${u.username},${LDAP_CONFIG.baseDn}`; })
diff --git a/src/test/groups-test.js b/src/test/groups-test.js
index d80818c42..352ead4b1 100644
--- a/src/test/groups-test.js
+++ b/src/test/groups-test.js
@@ -224,6 +224,13 @@ describe('Group membership', function () {
         });
     });
 
+    it('cannot add same member again', function (done) {
+        groups.addMember(group0Object.id, USER_0.id, function (error) {
+            expect(error.reason).to.be(BoxError.ALREADY_EXISTS);
+            done();
+        });
+    });
+
     it('can add member without username', function (done) {
         groups.addMember(group0Object.id, USER_1.id, function (error) {
             expect(error).to.be(null);
@@ -270,13 +277,20 @@ describe('Group membership', function () {
         });
     });
 
-    it('can set groups', function (done) {
+    it('can set members', function (done) {
         groups.setMembers(group0Object.id, [ USER_0.id ], function (error) {
             expect(error).to.be(null);
             done();
         });
     });
 
+    it('cannot set duplicate members', function (done) {
+        groups.setMembers(group0Object.id, [ USER_0.id, USER_0.id ], function (error) {
+            expect(error.reason).to.be(BoxError.CONFLICT);
+            done();
+        });
+    });
+
     it('can remove member', function (done) {
         groups.removeMember(group0Object.id, USER_0.id, function (error) {
             expect(error).to.be(null);
@@ -352,6 +366,13 @@ describe('Set user groups', function () {
         });
     });
 
+    it('cannot set user to same group twice', function (done) {
+        groups.setMembership(USER_0.id, [ group0Object.id, group0Object.id ], function (error) {
+            expect(error.reason).to.be(BoxError.CONFLICT);
+            done();
+        });
+    });
+
     it('can set user to multiple groups', function (done) {
         groups.setMembership(USER_0.id, [ group0Object.id, group1Object.id ], function (error) {
             expect(error).to.be(null);