diff --git a/keycloak/keycloak.go b/keycloak/keycloak.go
index 001838d..dd2c87d 100644
--- a/keycloak/keycloak.go
+++ b/keycloak/keycloak.go
@@ -143,6 +143,9 @@ func newAccessUser(kcuser *gocloak.User) *AccessUser {
 	if fobID == 0 {
 		return nil
 	}
+	if firstElOrZeroVal(attr["buildingAccessApprover"]) == "" {
+		return nil // no access for accounts that haven't explicitly been granted building access
+	}
 
 	return &AccessUser{
 		UUID:         *kcuser.ID,