diff --git a/src/main/java/net/gepafin/tendermanagement/dao/UserDao.java b/src/main/java/net/gepafin/tendermanagement/dao/UserDao.java
index 7e35957b..e37873f3 100644
--- a/src/main/java/net/gepafin/tendermanagement/dao/UserDao.java
+++ b/src/main/java/net/gepafin/tendermanagement/dao/UserDao.java
@@ -219,7 +219,7 @@ public class UserDao {
         log.info("Current user details: {}", userEntity);
         log.info("New user details: {}", userReq);
         String newStatus = userReq.getStatus() != null ? userReq.getStatus().getValue() : null;
-        if (Boolean.FALSE.equals(userEntity.getStatus().equals(newStatus))) {
+        if (newStatus!=null && Boolean.FALSE.equals(userEntity.getStatus().equals(newStatus))) {
             userEntity.setStatus(newStatus);
         }
         setIfUpdated(userEntity::getFirstName, userEntity::setFirstName, userReq.getFirstName());
@@ -228,15 +228,19 @@ public class UserDao {
         setIfUpdated(userEntity::getAddress, userEntity::setAddress, userReq.getAddress());
         setIfUpdated(userEntity::getPhoneNumber, userEntity::setPhoneNumber, userReq.getPhoneNumber());
         setIfUpdated(userEntity::getDateOfBirth, userEntity::setDateOfBirth, userReq.getDateOfBirth());
-        setIfUpdated(userEntity.getBeneficiary()::getCodiceFiscale, userEntity.getBeneficiary()::setCodiceFiscale, userReq.getCodiceFiscale());
-          setIfUpdated(userEntity.getBeneficiary()::getMarketing, userEntity.getBeneficiary()::setMarketing, userReq.getMarketing());
-        setIfUpdated(userEntity.getBeneficiary()::getOffers, userEntity.getBeneficiary()::setOffers, userReq.getOffers());
-        setIfUpdated(userEntity.getBeneficiary()::getThirdParty, userEntity.getBeneficiary()::setThirdParty, userReq.getThirdParty());
         if (userReq.getRoleId() != null) {
             RoleEntity roleEntity = roleDao.validateRole(userReq.getRoleId());
-            setIfUpdated(userEntity::getRoleEntity, userEntity::setRoleEntity, roleEntity);
+            if((userEntity.getRoleEntity().getRoleType().equals(RoleStatusEnum.ROLE_INSTRUCTOR_MANAGER.getValue()) && roleEntity.getRoleType().equals(RoleStatusEnum.ROLE_PRE_INSTRUCTOR.getValue())) || (userEntity.getRoleEntity().getRoleType().equals(RoleStatusEnum.ROLE_PRE_INSTRUCTOR.getValue()) && roleEntity.getRoleType().equals(RoleStatusEnum.ROLE_INSTRUCTOR_MANAGER.getValue()))) {
+                setIfUpdated(userEntity::getRoleEntity, userEntity::setRoleEntity, roleEntity);
+            }
+        }
+        if(userEntity.getBeneficiary()!=null) {
+            setIfUpdated(userEntity.getBeneficiary()::getCodiceFiscale, userEntity.getBeneficiary()::setCodiceFiscale, userReq.getCodiceFiscale());
+            setIfUpdated(userEntity.getBeneficiary()::getMarketing, userEntity.getBeneficiary()::setMarketing, userReq.getMarketing());
+            setIfUpdated(userEntity.getBeneficiary()::getOffers, userEntity.getBeneficiary()::setOffers, userReq.getOffers());
+            setIfUpdated(userEntity.getBeneficiary()::getThirdParty, userEntity.getBeneficiary()::setThirdParty, userReq.getThirdParty());
+            setIfUpdated(userEntity.getBeneficiary()::getEmailPec, userEntity.getBeneficiary()::setEmailPec, userReq.getEmailPec());
         }
-        setIfUpdated(userEntity.getBeneficiary()::getEmailPec, userEntity.getBeneficiary()::setEmailPec, userReq.getEmailPec());
         userEntity = userRepository.save(userEntity);
 
         /** This code is responsible for adding a version history log for the "Update user details" operation **/
diff --git a/src/main/java/net/gepafin/tendermanagement/web/rest/api/UserApi.java b/src/main/java/net/gepafin/tendermanagement/web/rest/api/UserApi.java
index 86122344..f2010e90 100644
--- a/src/main/java/net/gepafin/tendermanagement/web/rest/api/UserApi.java
+++ b/src/main/java/net/gepafin/tendermanagement/web/rest/api/UserApi.java
@@ -59,6 +59,7 @@ public interface UserApi {
     @RequestMapping(value = "/{userId}",
             produces = {"application/json"},
             method = RequestMethod.PUT)
+        @PreAuthorize("hasRole('ROLE_SUPER_ADMIN')")
     default ResponseEntity<Response<UserResponseBean>> updateUser(HttpServletRequest request,
             @Parameter(description = "The user id", required = true) @PathVariable("userId") Long userId,
             @Parameter(description = "User request object", required = true) @Valid @RequestBody UpdateUserReq userReq) {