diff --git a/lib/Controller/RoomController.php b/lib/Controller/RoomController.php
index c64966023a5..187b5657e41 100644
--- a/lib/Controller/RoomController.php
+++ b/lib/Controller/RoomController.php
@@ -794,6 +794,14 @@ public function createRoom(
 			$password = '';
 		}
 
+		// Enabling SIP dial-in is restricted to the configured groups, so requesting
+		// it at creation time requires the same permission as toggling it later on.
+		if ($sipEnabled !== Webinary::SIP_DISABLED
+			&& (!$this->talkConfig->isSIPConfigured()
+				|| !$this->talkConfig->canUserEnableSIP($user))) {
+			return new DataResponse(['error' => CreationException::REASON_SIP_ENABLED], Http::STATUS_FORBIDDEN);
+		}
+
 		$invitationList = $this->invitationService->validateInvitations($participants, $user);
 		if ($invitationList->hasInvalidInvitations() && !$invitationList->hasValidInvitations()) {
 			// FIXME add the list of failed invitations?
diff --git a/tests/integration/features/conversation-1/create.feature b/tests/integration/features/conversation-1/create.feature
index f379a4f23a8..ac0066ae7bd 100644
--- a/tests/integration/features/conversation-1/create.feature
+++ b/tests/integration/features/conversation-1/create.feature
@@ -65,10 +65,40 @@ Feature: conversation-1/create
         | room | 3    | 1               | 1          | GREATER_THAN_ZERO |
 
   Scenario: Enable SIP during creation
-    Given the following "spreed" app config is set
+    Given group "group1" exists
+    And user "participant1" is member of group "group1"
+    And the following "spreed" app config is set
+      | sip_bridge_dialin_info | +49-1234-567890 |
+      | sip_bridge_shared_secret | 1234567890abcdef |
+      | sip_bridge_groups | ["group1"] |
+    Given user "participant1" creates room "room" (v4)
+      | roomType | 3 |
+      | roomName | room |
+      | sipEnabled | 1 |
+    Then user "participant1" is participant of the following rooms (v4)
+      | id   | type | participantType | sipEnabled |
+      | room | 3    | 1               | 1          |
+
+  Scenario: Enable SIP during creation without being allowed to enable SIP
+    Given group "group1" exists
+    And the following "spreed" app config is set
       | sip_bridge_dialin_info | +49-1234-567890 |
       | sip_bridge_shared_secret | 1234567890abcdef |
       | sip_bridge_groups | ["group1"] |
+    When user "participant1" creates room "room" with 403 (v4)
+      | roomType | 3 |
+      | roomName | room |
+      | sipEnabled | 1 |
+    And user "participant1" creates room "room" with 403 (v4)
+      | roomType | 3 |
+      | roomName | room |
+      | sipEnabled | 2 |
+    Then user "participant1" is participant of the following rooms (v4)
+
+  Scenario: Enable SIP during creation while not being restricted by groups
+    Given the following "spreed" app config is set
+      | sip_bridge_dialin_info | +49-1234-567890 |
+      | sip_bridge_shared_secret | 1234567890abcdef |
     Given user "participant1" creates room "room" (v4)
       | roomType | 3 |
       | roomName | room |