diff --git a/charts/capsule/README.md b/charts/capsule/README.md
index d14c7ead..7f97b499 100644
--- a/charts/capsule/README.md
+++ b/charts/capsule/README.md
@@ -165,6 +165,7 @@ Here the values you can override:
 | manager.options.capsuleUserGroups | list | `["projectcapsule.dev"]` | Override the Capsule user groups |
 | manager.options.forceTenantPrefix | bool | `false` | Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash |
 | manager.options.generateCertificates | bool | `true` | Specifies whether capsule webhooks certificates should be generated by capsule operator |
+| manager.options.ignoreUserWithGroups | list | `[]` | Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups. |
 | manager.options.logLevel | string | `"4"` | Set the log verbosity of the capsule with a value from 1 to 10 |
 | manager.options.nodeMetadata | object | `{"forbiddenAnnotations":{"denied":[],"deniedRegex":""},"forbiddenLabels":{"denied":[],"deniedRegex":""}}` | Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant |
 | manager.options.protectedNamespaceRegex | string | `""` | If specified, disallows creation of namespaces matching the passed regexp |
diff --git a/charts/capsule/templates/configuration-default.yaml b/charts/capsule/templates/configuration-default.yaml
index 3cc5422c..30f060d3 100644
--- a/charts/capsule/templates/configuration-default.yaml
+++ b/charts/capsule/templates/configuration-default.yaml
@@ -17,9 +17,13 @@ spec:
     validatingWebhookConfigurationName: {{ include "capsule.fullname" . }}-validating-webhook-configuration
   forceTenantPrefix: {{ .Values.manager.options.forceTenantPrefix }}
   userGroups:
-{{- range .Values.manager.options.capsuleUserGroups }}
+  {{- range .Values.manager.options.capsuleUserGroups }}
     - {{ . }}
-{{- end}}
+  {{- end }}
+  ignoreUserWithGroups:
+  {{- range .Values.manager.options.ignoreUserWithGroups }}
+    - {{ . }}
+  {{- end }}
   protectedNamespaceRegex: {{ .Values.manager.options.protectedNamespaceRegex | quote }}
   {{- with .Values.manager.options.nodeMetadata }}
   nodeMetadata:
diff --git a/charts/capsule/values.schema.json b/charts/capsule/values.schema.json
index e6670541..39626480 100644
--- a/charts/capsule/values.schema.json
+++ b/charts/capsule/values.schema.json
@@ -263,6 +263,10 @@
                             "description": "Specifies whether capsule webhooks certificates should be generated by capsule operator",
                             "type": "boolean"
                         },
+                        "ignoreUserWithGroups": {
+                            "description": "Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups.",
+                            "type": "array"
+                        },
                         "logLevel": {
                             "description": "Set the log verbosity of the capsule with a value from 1 to 10",
                             "type": "string"
diff --git a/charts/capsule/values.yaml b/charts/capsule/values.yaml
index a768d549..146d6fa1 100644
--- a/charts/capsule/values.yaml
+++ b/charts/capsule/values.yaml
@@ -143,6 +143,9 @@ manager:
     forceTenantPrefix: false
     # -- Override the Capsule user groups
     capsuleUserGroups: ["projectcapsule.dev"]
+    # -- Define groups which when found in the request of a user will be ignored by the Capsule
+    # this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups.
+    ignoreUserWithGroups: []
     # -- If specified, disallows creation of namespaces matching the passed regexp
     protectedNamespaceRegex: ""
     # -- Specifies whether capsule webhooks certificates should be generated by capsule operator