diff --git a/app/main/forms.py b/app/main/forms.py
index e56216c2b..0a1e36a5b 100644
--- a/app/main/forms.py
+++ b/app/main/forms.py
@@ -40,6 +40,7 @@ from app.main.validators import (
     ValidEmail,
     ValidGovEmail,
 )
+from app.notify_client.models import roles
 
 
 def get_time_value_and_label(future_time):
@@ -257,11 +258,13 @@ class RegisterUserFromOrgInviteForm(StripWhitespaceForm):
 
 
 class AbstractPermissionsForm(StripWhitespaceForm):
+
     view_activity = HiddenField("View activity")
     send_messages = BooleanField("Send messages from existing templates")
     manage_templates = BooleanField("Add and edit templates")
     manage_service = BooleanField("Modify this service and its team")
     manage_api_keys = BooleanField("Create and revoke API keys")
+
     login_authentication = RadioField(
         'Sign in using',
         choices=[
@@ -271,6 +274,10 @@ class AbstractPermissionsForm(StripWhitespaceForm):
         validators=[DataRequired()]
     )
 
+    @property
+    def permissions(self):
+        return {role for role in roles.keys() if self[role].data is True}
+
 
 class AdminPermissionsForm(AbstractPermissionsForm):
 
diff --git a/app/main/views/manage_users.py b/app/main/views/manage_users.py
index 57b2ae055..1f3afabd4 100644
--- a/app/main/views/manage_users.py
+++ b/app/main/views/manage_users.py
@@ -54,12 +54,11 @@ def invite_user(service_id):
 
     if form.validate_on_submit():
         email_address = form.email_address.data
-        permissions = get_permissions_from_form(form)
         invited_user = invite_api_client.create_invite(
             current_user.id,
             service_id,
             email_address,
-            permissions,
+            form.permissions,
             form.login_authentication.data
         )
 
@@ -90,7 +89,7 @@ def edit_user_permissions(service_id, user_id):
     if form.validate_on_submit():
         user_api_client.set_user_permissions(
             user_id, service_id,
-            permissions=set(get_permissions_from_form(form)),
+            permissions=form.permissions,
         )
         if service_has_email_auth:
             user_api_client.update_user_attribute(user_id, auth_type=form.login_authentication.data)
@@ -148,7 +147,3 @@ def cancel_invited_user(service_id, invited_user_id):
     invite_api_client.cancel_invited_user(service_id=service_id, invited_user_id=invited_user_id)
 
     return redirect(url_for('main.manage_users', service_id=service_id))
-
-
-def get_permissions_from_form(form):
-    return {role for role in roles.keys() if form[role].data is True}