diff --git a/Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 b/Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1
index 531641db57914..5b32ff2f1124a 100644
--- a/Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1
+++ b/Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1
@@ -328,6 +328,23 @@ function Test-CIPPAccess {
             $Tenants = Get-Tenants -IncludeErrors
             $swTenantsLoad.Stop()
             $AccessTimings['LoadTenants'] = $swTenantsLoad.Elapsed.TotalMilliseconds
+
+            $OwnTenantIds = @()
+            if ($Type -eq 'User' -and $User.userDetails -match '^[^@]+@(?<domain>[^@]+)$') {
+                $UserDomain = $Matches.domain
+                $MatchingOwnTenants = @(
+                    $Tenants | Where-Object {
+                        $_.defaultDomainName -eq $UserDomain -or $_.initialDomainName -eq $UserDomain
+                    }
+                )
+
+                if ($MatchingOwnTenants.Count -eq 1) {
+                    $OwnTenantIds = @($MatchingOwnTenants.customerId)
+                } elseif ($MatchingOwnTenants.Count -gt 1) {
+                    Write-Warning "Could not resolve own tenant for '$($User.userDetails)' because '$UserDomain' matches multiple tenants."
+                }
+            }
+
             $PermissionsFound = $false
             $swRolePerms = [System.Diagnostics.Stopwatch]::StartNew()
             $PermissionSet = foreach ($CustomRole in $CustomRoles) {
@@ -358,6 +375,8 @@ function Test-CIPPAccess {
                                         Write-Warning "Failed to expand tenant group '$($AllowedItem.label)': $($_.Exception.Message)"
                                         @()
                                     }
+                                } elseif ($AllowedItem -eq 'OwnTenant') {
+                                    $OwnTenantIds
                                 } else {
                                     $AllowedItem
                                 }
@@ -424,12 +443,20 @@ function Test-CIPPAccess {
                         # Check tenant level access
                         if (($Role.BlockedTenants | Measure-Object).Count -eq 0 -and $Role.AllowedTenants -contains 'AllTenants') {
                             $TenantAllowed = $true
+                        } elseif ($TenantFilter -eq 'AllTenants' -and $Role.AllowedTenants -contains 'OwnTenant' -and $Role.AllowedTenants -notcontains 'AllTenants') {
+                            $TenantAllowed = $false
                         } elseif ($TenantFilter -eq 'AllTenants' -and $ApiRole -match 'Write$') {
                             $TenantAllowed = $false
                         } elseif ($TenantFilter -eq 'AllTenants' -and $ApiRole -match 'Read$') {
                             $TenantAllowed = $true
                         } else {
-                            $Tenant = ($Tenants | Where-Object { $TenantFilter -eq $_.customerId -or $TenantFilter -eq $_.defaultDomainName }).customerId
+                            $Tenant = (
+                                $Tenants | Where-Object {
+                                    $TenantFilter -eq $_.customerId -or
+                                    $TenantFilter -eq $_.defaultDomainName -or
+                                    $TenantFilter -eq $_.initialDomainName
+                                }
+                            ).customerId
 
                             # Expand allowed tenant groups to individual tenant IDs
                             $ExpandedAllowedTenants = foreach ($AllowedItem in $Role.AllowedTenants) {
@@ -441,6 +468,8 @@ function Test-CIPPAccess {
                                         Write-Warning "Failed to expand allowed tenant group '$($AllowedItem.label)': $($_.Exception.Message)"
                                         @()
                                     }
+                                } elseif ($AllowedItem -eq 'OwnTenant') {
+                                    $OwnTenantIds
                                 } else {
                                     $AllowedItem
                                 }
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1
index 7479dedda3be3..655b2c5908a55 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1	
@@ -36,6 +36,7 @@ function Invoke-ListCustomRole {
             $IPRanges = @()
         }
 
+
         $RoleList.Add([pscustomobject]@{
                 RoleName       = $Role
                 Type           = 'Built-In'
@@ -61,7 +62,13 @@ function Invoke-ListCustomRole {
         if ($Role.AllowedTenants) {
             try {
                 $AllowedTenants = $Role.AllowedTenants | ConvertFrom-Json -ErrorAction Stop | ForEach-Object {
-                    if ($_ -is [PSCustomObject] -and $_.type -eq 'Group') {
+                    if ($_ -eq 'OwnTenant') {
+                        [PSCustomObject]@{
+                            type  = 'OwnTenant'
+                            value = 'OwnTenant'
+                            label = 'Own Tenant'
+                        }
+                    } elseif ($_ -is [PSCustomObject] -and $_.type -eq 'Group') {
                         # Return group objects as-is for frontend display
                         [PSCustomObject]@{
                             type  = 'Group'
@@ -146,4 +153,3 @@ function Invoke-ListCustomRole {
             Body       = ConvertTo-Json -InputObject $Body -Depth 5
         })
 }
-