diff --git a/internal/org/model/org.go b/internal/org/model/org.go
index 286a738eb..c38d25859 100644
--- a/internal/org/model/org.go
+++ b/internal/org/model/org.go
@@ -49,13 +49,13 @@ func (o *Org) IsValid() bool {
 	return o.Name != ""
 }
 
-func (o *Org) ContainsDomain(domain *OrgDomain) bool {
-	for _, d := range o.Domains {
+func (o *Org) GetDomain(domain *OrgDomain) (int, *OrgDomain) {
+	for i, d := range o.Domains {
 		if d.Domain == domain.Domain {
-			return true
+			return i, d
 		}
 	}
-	return false
+	return -1, nil
 }
 
 func (o *Org) GetPrimaryDomain() *OrgDomain {
diff --git a/internal/org/repository/eventsourcing/eventstore.go b/internal/org/repository/eventsourcing/eventstore.go
index 285b7854a..114352110 100644
--- a/internal/org/repository/eventsourcing/eventstore.go
+++ b/internal/org/repository/eventsourcing/eventstore.go
@@ -179,9 +179,13 @@ func (es *OrgEventstore) RemoveOrgDomain(ctx context.Context, domain *org_model.
 	if err != nil {
 		return err
 	}
-	if !existing.ContainsDomain(domain) {
+	_, d := existing.GetDomain(domain)
+	if d == nil {
 		return errors.ThrowPreconditionFailed(nil, "EVENT-Sjdi3", "Errors.Org.DomainNotOnOrg")
 	}
+	if d.Primary {
+		return errors.ThrowPreconditionFailed(nil, "EVENT-Sjdi3", "Errors.Org.PrimaryDomainNotDeletable")
+	}
 	repoOrg := model.OrgFromModel(existing)
 	repoDomain := model.OrgDomainFromModel(domain)
 	orgAggregates, err := OrgDomainRemovedAggregate(ctx, es.Eventstore.AggregateCreator(), repoOrg, repoDomain)
diff --git a/internal/static/i18n/de.yaml b/internal/static/i18n/de.yaml
index 378abbd86..cccb8660a 100644
--- a/internal/static/i18n/de.yaml
+++ b/internal/static/i18n/de.yaml
@@ -54,6 +54,7 @@ Errors:
     InvalidDomain: Domäne ist ungültig
     DomainMissing: Domäne fehlt
     DomainNotOnOrg: Domäne fehlt auf Organisation
+    PrimaryDomainNotDeletable: Primäre Domäne kann nicht gelöscht werden
     DomainNotFound: Domäne konnte nicht gefunden werden
     MemberIDMissing: Member ID fehlt
     MemberNotFound: Organisations Member konnte nicht gefunden werden
diff --git a/internal/static/i18n/en.yaml b/internal/static/i18n/en.yaml
index 7d80fb1a6..de84d1237 100644
--- a/internal/static/i18n/en.yaml
+++ b/internal/static/i18n/en.yaml
@@ -54,6 +54,7 @@ Errors:
     InvalidDomain: Invalid domain
     DomainMissing: Domain missing
     DomainNotOnOrg: Domain doesn't exist on organisation
+    PrimaryDomainNotDeletable: Primary domain must not be deleted
     DomainNotFound: Domain not found
     MemberIDMissing: Member ID missing
     MemberNotFound: Organisations member not found
@@ -113,4 +114,4 @@ Errors:
   Token:
     NotFound: Token not found
   UserSession:
-    NotFound: UserSession not found
\ No newline at end of file
+    NotFound: UserSession not found
diff --git a/migrations/cockroach/V1.27__adminapi_grants.sql b/migrations/cockroach/V1.27__adminapi_grants.sql
new file mode 100644
index 000000000..62beddff3
--- /dev/null
+++ b/migrations/cockroach/V1.27__adminapi_grants.sql
@@ -0,0 +1,2 @@
+GRANT DROP ON DATABASE admin_api TO admin_api;
+GRANT DROP ON TABLE admin_api.* TO admin_api;
\ No newline at end of file