diff --git a/pkg/services/apiserver/auth/authenticator/signedinuser.go b/pkg/services/apiserver/auth/authenticator/signedinuser.go
index 76dc5289bb6..fceecd02e8a 100644
--- a/pkg/services/apiserver/auth/authenticator/signedinuser.go
+++ b/pkg/services/apiserver/auth/authenticator/signedinuser.go
@@ -38,6 +38,9 @@ func signedInUserAuthenticator(req *http.Request) (*authenticator.Response, bool
 	if signedInUser.IDToken != "" {
 		userInfo.Extra["id-token"] = []string{signedInUser.IDToken}
 	}
+	if signedInUser.OrgRole.IsValid() {
+		userInfo.Extra["user-instance-role"] = []string{string(signedInUser.OrgRole)}
+	}
 
 	return &authenticator.Response{
 		User: userInfo,