diff --git a/pkg/services/accesscontrol/database/database.go b/pkg/services/accesscontrol/database/database.go
index 85f025cfbd4..ec5ef5dbe1c 100644
--- a/pkg/services/accesscontrol/database/database.go
+++ b/pkg/services/accesscontrol/database/database.go
@@ -48,6 +48,10 @@ func (s *AccessControlStore) GetUserPermissions(ctx context.Context, query acces
 			}
 		}
 
+		q += `
+			ORDER BY permission.scope
+		`
+
 		if err := sess.SQL(q, params...).Find(&result); err != nil {
 			return err
 		}