diff --git a/application/controllers/ServicegroupController.php b/application/controllers/ServicegroupController.php
index 05a75f7d..0f55bd2a 100644
--- a/application/controllers/ServicegroupController.php
+++ b/application/controllers/ServicegroupController.php
@@ -19,6 +19,8 @@ class ServicegroupController extends Controller
 
     public function init()
     {
+        $this->assertRouteAccess('servicegroups');
+
         $this->setTitle(t('Service Group'));
 
         $name = $this->params->shiftRequired('name');
diff --git a/application/controllers/ServicegroupsController.php b/application/controllers/ServicegroupsController.php
index e01a94ac..60fc4a3c 100644
--- a/application/controllers/ServicegroupsController.php
+++ b/application/controllers/ServicegroupsController.php
@@ -18,6 +18,13 @@ use ipl\Web\Url;
 
 class ServicegroupsController extends Controller
 {
+    public function init()
+    {
+        parent::init();
+
+        $this->assertRouteAccess();
+    }
+
     public function indexAction()
     {
         $this->setTitle(t('Service Groups'));
diff --git a/configuration.php b/configuration.php
index b6ec9015..629ce761 100644
--- a/configuration.php
+++ b/configuration.php
@@ -308,10 +308,13 @@ namespace Icinga\Module\Icingadb
         ]);
     }
 
-    $section->add(N_('Service Groups'), [
-        'url' => 'icingadb/servicegroups',
-        'priority' => 80
-    ]);
+    if (! array_key_exists('servicegroups', $routeBlacklist)) {
+        $section->add(N_('Service Groups'), [
+            'url' => 'icingadb/servicegroups',
+            'priority' => 80
+        ]);
+    }
+
     $section->add(N_('History'), [
         'url' => 'icingadb/history',
         'priority' => 90
diff --git a/library/Icingadb/Widget/Detail/ObjectDetail.php b/library/Icingadb/Widget/Detail/ObjectDetail.php
index 1e0914e4..24095de6 100644
--- a/library/Icingadb/Widget/Detail/ObjectDetail.php
+++ b/library/Icingadb/Widget/Detail/ObjectDetail.php
@@ -209,8 +209,11 @@ class ObjectDetail extends BaseHtmlElement
                     : new EmptyState(t('Not a member of any host group.'))
             );
         } else {
-            $servicegroups = $this->object->servicegroup;
-            $this->applyRestrictions($servicegroups);
+            $servicegroups = [];
+            if ($this->isPermittedRoute('servicegroups')) {
+                $servicegroups = $this->object->servicegroup;
+                $this->applyRestrictions($servicegroups);
+            }
 
             $servicegroupList = new TagList();
             foreach ($servicegroups as $servicegroup) {