diff --git a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/controller/EntityDescriptorController.java b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/controller/EntityDescriptorController.java
index ba3188daa..80213f5cd 100644
--- a/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/controller/EntityDescriptorController.java
+++ b/backend/src/main/java/edu/internet2/tier/shibboleth/admin/ui/controller/EntityDescriptorController.java
@@ -122,9 +122,11 @@ public ResponseEntity<?> update(@RequestBody EntityDescriptorRepresentation edRe
             return ResponseEntity.notFound().build();
         } else {
             if (currentUser != null && (currentUser.getRole().equals("ROLE_ADMIN") || currentUser.getUsername().equals(existingEd.getCreatedBy()))) {
-                ResponseEntity<?> entityDescriptorEnablingDeniedResponse = entityDescriptorEnablePermissionsCheck(edRepresentation.isServiceEnabled());
-                if (entityDescriptorEnablingDeniedResponse != null) {
-                    return entityDescriptorEnablingDeniedResponse;
+                if (!existingEd.isServiceEnabled()) {
+                    ResponseEntity<?> entityDescriptorEnablingDeniedResponse = entityDescriptorEnablePermissionsCheck(edRepresentation.isServiceEnabled());
+                    if (entityDescriptorEnablingDeniedResponse != null) {
+                        return entityDescriptorEnablingDeniedResponse;
+                    }
                 }
 
                 // Verify we're the only one attempting to update the EntityDescriptor