diff --git a/pkg/services/org/model.go b/pkg/services/org/model.go
index ce73e8fd5e8..596dcc3101c 100644
--- a/pkg/services/org/model.go
+++ b/pkg/services/org/model.go
@@ -115,6 +115,47 @@ type DeleteOrgCommand struct {
 	ID int64 `xorm:"id"`
 }
 
+type AddOrgUserCommand struct {
+	LoginOrEmail string   `json:"loginOrEmail" binding:"Required"`
+	Role         RoleType `json:"role" binding:"Required"`
+
+	OrgID  int64 `json:"-"`
+	UserID int64 `json:"-"`
+
+	// internal use: avoid adding service accounts to orgs via user routes
+	AllowAddingServiceAccount bool `json:"-"`
+}
+
+type UpdateOrgUserCommand struct {
+	Role RoleType `json:"role" binding:"Required"`
+
+	OrgID  int64 `json:"-"`
+	UserID int64 `json:"-"`
+}
+
+type OrgUserDTO struct {
+	OrgID         int64           `json:"orgId"`
+	UserID        int64           `json:"userId"`
+	Email         string          `json:"email"`
+	Name          string          `json:"name"`
+	AvatarURL     string          `json:"avatarUrl"`
+	Login         string          `json:"login"`
+	Role          string          `json:"role"`
+	LastSeenAt    time.Time       `json:"lastSeenAt"`
+	Updated       time.Time       `json:"-"`
+	Created       time.Time       `json:"-"`
+	LastSeenAtAge string          `json:"lastSeenAtAge"`
+	AccessControl map[string]bool `json:"accessControl,omitempty"`
+	IsDisabled    bool            `json:"isDisabled"`
+}
+
+type RemoveOrgUserCommand struct {
+	UserID                   int64
+	OrgID                    int64
+	ShouldDeleteOrphanedUser bool
+	UserWasDeleted           bool
+}
+
 func (r RoleType) IsValid() bool {
 	return r == RoleViewer || r == RoleAdmin || r == RoleEditor
 }
diff --git a/pkg/services/org/org.go b/pkg/services/org/org.go
index af4299f610f..773fb5b8711 100644
--- a/pkg/services/org/org.go
+++ b/pkg/services/org/org.go
@@ -18,4 +18,7 @@ type Service interface {
 	UpdateAddress(context.Context, *UpdateOrgAddressCommand) error
 	Delete(context.Context, *DeleteOrgCommand) error
 	GetOrCreate(context.Context, string) (int64, error)
+	AddOrgUser(context.Context, *AddOrgUserCommand) error
+	UpdateOrgUser(context.Context, *UpdateOrgUserCommand) error
+	RemoveOrgUser(context.Context, *RemoveOrgUserCommand) error
 }
diff --git a/pkg/services/org/orgimpl/org.go b/pkg/services/org/orgimpl/org.go
index da5d658a58a..d92af889f83 100644
--- a/pkg/services/org/orgimpl/org.go
+++ b/pkg/services/org/orgimpl/org.go
@@ -211,3 +211,36 @@ func (s *Service) GetOrCreate(ctx context.Context, orgName string) (int64, error
 	}
 	return orga.ID, nil
 }
+
+// TODO: remove wrapper around sqlstore
+func (s *Service) AddOrgUser(ctx context.Context, cmd *org.AddOrgUserCommand) error {
+	c := &models.AddOrgUserCommand{
+		LoginOrEmail:              cmd.LoginOrEmail,
+		OrgId:                     cmd.OrgID,
+		UserId:                    cmd.UserID,
+		Role:                      cmd.Role,
+		AllowAddingServiceAccount: cmd.AllowAddingServiceAccount,
+	}
+	return s.sqlStore.AddOrgUser(ctx, c)
+}
+
+// TODO: remove wrapper around sqlstore
+func (s *Service) UpdateOrgUser(ctx context.Context, cmd *org.UpdateOrgUserCommand) error {
+	c := &models.UpdateOrgUserCommand{
+		UserId: cmd.UserID,
+		OrgId:  cmd.OrgID,
+		Role:   cmd.Role,
+	}
+	return s.sqlStore.UpdateOrgUser(ctx, c)
+}
+
+// TODO: remove wrapper around sqlstore
+func (s *Service) RemoveOrgUser(ctx context.Context, cmd *org.RemoveOrgUserCommand) error {
+	c := &models.RemoveOrgUserCommand{
+		UserId:                   cmd.UserID,
+		OrgId:                    cmd.OrgID,
+		ShouldDeleteOrphanedUser: cmd.ShouldDeleteOrphanedUser,
+		UserWasDeleted:           cmd.UserWasDeleted,
+	}
+	return s.sqlStore.RemoveOrgUser(ctx, c)
+}
diff --git a/pkg/services/org/orgtest/fake.go b/pkg/services/org/orgtest/fake.go
index fe910095b7f..e4c86b8b3df 100644
--- a/pkg/services/org/orgtest/fake.go
+++ b/pkg/services/org/orgtest/fake.go
@@ -3,6 +3,7 @@ package orgtest
 import (
 	"context"
 
+	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/services/org"
 )
 
@@ -12,6 +13,7 @@ type FakeOrgService struct {
 	ExpectedUserOrgDTO []*org.UserOrgDTO
 	ExpectedOrgs       []*org.OrgDTO
 	ExpectedOrg        *org.Org
+	ExpectedOrgUsers   []*org.OrgUserDTO
 }
 
 func NewOrgServiceFake() *FakeOrgService {
@@ -73,3 +75,19 @@ func (f *FakeOrgService) Delete(ctx context.Context, cmd *org.DeleteOrgCommand)
 func (f *FakeOrgService) GetOrCreate(ctx context.Context, orgName string) (int64, error) {
 	return 0, f.ExpectedError
 }
+
+func (f *FakeOrgService) AddOrgUser(ctx context.Context, cmd *org.AddOrgUserCommand) error {
+	return f.ExpectedError
+}
+
+func (f *FakeOrgService) UpdateOrgUser(ctx context.Context, cmd *org.UpdateOrgUserCommand) error {
+	return f.ExpectedError
+}
+
+func (f *FakeOrgService) GetOrgUsers(ctx context.Context, query *models.GetOrgUsersQuery) ([]*org.OrgUserDTO, error) {
+	return f.ExpectedOrgUsers, f.ExpectedError
+}
+
+func (f *FakeOrgService) RemoveOrgUser(ctx context.Context, cmd *org.RemoveOrgUserCommand) error {
+	return f.ExpectedError
+}