diff --git a/recodex-web.spec b/recodex-web.spec
index b941b054e..340388d9f 100644
--- a/recodex-web.spec
+++ b/recodex-web.spec
@@ -1,8 +1,8 @@
 %define name recodex-web
 %define short_name web-app
 %define version 2.17.0
-%define unmangled_version c06ba1029a7411a1f7ab431437595344db2fc721
-%define release 2
+%define unmangled_version aa71037311d5cfb75b8e88882cd24372a6b8638a
+%define release 3
 
 Summary: ReCodEx web-app component
 Name: %{name}
diff --git a/src/components/forms/GenerateTokenForm/GenerateTokenForm.js b/src/components/forms/GenerateTokenForm/GenerateTokenForm.js
index 843a5cb81..395143f2a 100644
--- a/src/components/forms/GenerateTokenForm/GenerateTokenForm.js
+++ b/src/components/forms/GenerateTokenForm/GenerateTokenForm.js
@@ -34,6 +34,16 @@ const scopes = [
   },
 ];
 
+const superAdminScopes = [
+  ...scopes,
+  {
+    name: (
+      <FormattedMessage id="app.generateTokenForm.scope.group-external" defaultMessage="External groups management" />
+    ),
+    key: 'group-external',
+  },
+];
+
 const HOUR_SEC = 3600;
 const DAY_SEC = 24 * HOUR_SEC;
 const WEEK_SEC = 7 * DAY_SEC;
@@ -70,6 +80,7 @@ export const initialValues = {
 };
 
 const GenerateTokenForm = ({
+  isSuperAdmin = false,
   error,
   submitting,
   handleSubmit,
@@ -135,7 +146,7 @@ const GenerateTokenForm = ({
           <Field
             name="scope"
             component={SelectField}
-            options={scopes}
+            options={isSuperAdmin ? superAdminScopes : scopes}
             label={<FormattedMessage id="app.generateTokenForm.scope" defaultMessage="Scope:" />}
             ignoreDirty
           />
@@ -196,6 +207,7 @@ const GenerateTokenForm = ({
 };
 
 GenerateTokenForm.propTypes = {
+  isSuperAdmin: PropTypes.bool,
   error: PropTypes.any,
   handleSubmit: PropTypes.func.isRequired,
   onSubmit: PropTypes.func.isRequired,
diff --git a/src/locales/cs.json b/src/locales/cs.json
index c414823d2..c47cc65ff 100644
--- a/src/locales/cs.json
+++ b/src/locales/cs.json
@@ -1047,6 +1047,7 @@
   "app.generateTokenForm.lastToken": "Poslední token:",
   "app.generateTokenForm.month": "1 Měsíc",
   "app.generateTokenForm.scope": "Rozsah platnosti:",
+  "app.generateTokenForm.scope.group-external": "Externí správa skupin",
   "app.generateTokenForm.scope.master": "Master (všechny operace, výchozí)",
   "app.generateTokenForm.scope.plagiarism": "Detekce podobných řešení",
   "app.generateTokenForm.scope.readAll": "Pouze čtení",
diff --git a/src/locales/en.json b/src/locales/en.json
index 5408db62b..8efdff02a 100644
--- a/src/locales/en.json
+++ b/src/locales/en.json
@@ -1047,6 +1047,7 @@
   "app.generateTokenForm.lastToken": "Last Token:",
   "app.generateTokenForm.month": "1 Month",
   "app.generateTokenForm.scope": "Scope:",
+  "app.generateTokenForm.scope.group-external": "External groups management",
   "app.generateTokenForm.scope.master": "Master (all operations, default)",
   "app.generateTokenForm.scope.plagiarism": "Plagiarism detection",
   "app.generateTokenForm.scope.readAll": "Read-only",
diff --git a/src/pages/EditUser/EditUser.js b/src/pages/EditUser/EditUser.js
index f4ee783d7..8185766b1 100644
--- a/src/pages/EditUser/EditUser.js
+++ b/src/pages/EditUser/EditUser.js
@@ -234,7 +234,12 @@ class EditUser extends Component {
 
                 <Row>
                   <Col lg={12}>
-                    <GenerateTokenForm onSubmit={generateToken} initialValues={initialValues} lastToken={lastToken} />
+                    <GenerateTokenForm
+                      onSubmit={generateToken}
+                      initialValues={initialValues}
+                      lastToken={lastToken}
+                      isSuperAdmin={isSuperAdmin}
+                    />
                   </Col>
                 </Row>
               </>