diff --git a/keystone/identity/core.py b/keystone/identity/core.py
index a0704f1216..db3ce31eae 100644
--- a/keystone/identity/core.py
+++ b/keystone/identity/core.py
@@ -436,6 +436,7 @@ def set_user_password(self, context, user_id, user):
 
     def update_user_tenant(self, context, user_id, user):
         """Update the default tenant."""
+        self.assert_admin(context)
         # ensure that we're a member of that tenant
         tenant_id = user.get('tenantId')
         self.identity_api.add_user_to_tenant(context, tenant_id, user_id)