diff --git a/apps/provisioning_api/lib/Controller/UsersController.php b/apps/provisioning_api/lib/Controller/UsersController.php
index ee8dcf9fb2934..77a356c0e2079 100644
--- a/apps/provisioning_api/lib/Controller/UsersController.php
+++ b/apps/provisioning_api/lib/Controller/UsersController.php
@@ -1382,7 +1382,10 @@ public function addToGroup(string $userId, string $groupid = ''): DataResponse {
 		// If they're not an admin, check they are a subadmin of the group in question
 		$loggedInUser = $this->userSession->getUser();
 		$subAdminManager = $this->groupManager->getSubAdmin();
-		if (!$this->groupManager->isAdmin($loggedInUser->getUID()) && !$subAdminManager->isSubAdminOfGroup($loggedInUser, $group)) {
+		if (
+			!$this->groupManager->isAdmin($loggedInUser->getUID())
+			&& !($subAdminManager->isSubAdminOfGroup($loggedInUser, $group) && $subAdminManager->isUserAccessible($loggedInUser, $targetUser))
+		) {
 			throw new OCSException('', 104);
 		}
 
diff --git a/apps/provisioning_api/tests/Controller/UsersControllerTest.php b/apps/provisioning_api/tests/Controller/UsersControllerTest.php
index cfb7f2d9543a3..41d5a7cd7a409 100644
--- a/apps/provisioning_api/tests/Controller/UsersControllerTest.php
+++ b/apps/provisioning_api/tests/Controller/UsersControllerTest.php
@@ -3096,6 +3096,11 @@ public function testAddToGroupSuccessAsSubadmin() {
 			->with($loggedInUser, $targetGroup)
 			->willReturn(true);
 
+		$subAdminManager->expects($this->once())
+			->method('isUserAccessible')
+			->with($loggedInUser, $targetUser)
+			->willReturn(true);
+
 		$this->groupManager->expects($this->once())
 			->method('getSubAdmin')
 			->willReturn($subAdminManager);