diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProviderFactory.java
index 6f45011db4..38180601c8 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/group/GroupPolicyProviderFactory.java
@@ -171,8 +171,9 @@ public class GroupPolicyProviderFactory implements PolicyProviderFactory<GroupPo
                 group = authorization.getRealm().getGroupById(definition.getId());
             }
 
-            if (group == null) {
-                String path = definition.getPath();
+            String path = definition.getPath();
+            
+            if (group == null && path != null) {
                 String canonicalPath = path.startsWith("/") ? path.substring(1, path.length()) : path;
 
                 if (canonicalPath != null) {
diff --git a/testsuite/integration-arquillian/tests/other/console/src/test/java/org/keycloak/testsuite/console/authorization/GroupPolicyManagementTest.java b/testsuite/integration-arquillian/tests/other/console/src/test/java/org/keycloak/testsuite/console/authorization/GroupPolicyManagementTest.java
index 5b57dbbe3b..00d2f9715d 100644
--- a/testsuite/integration-arquillian/tests/other/console/src/test/java/org/keycloak/testsuite/console/authorization/GroupPolicyManagementTest.java
+++ b/testsuite/integration-arquillian/tests/other/console/src/test/java/org/keycloak/testsuite/console/authorization/GroupPolicyManagementTest.java
@@ -169,6 +169,20 @@ public class GroupPolicyManagementTest extends AbstractAuthorizationSettingsTest
         assertNull(authorizationPage.authorizationTabs().policies().policies().findByName(expected.getName()));
     }
 
+    @Test
+    public void testSaveWithInInvalidGroup() throws InterruptedException {
+        authorizationPage.navigateTo();
+        GroupPolicyRepresentation expected = new GroupPolicyRepresentation();
+
+        expected.setName("Test Invalid Group Policy");
+        expected.setDescription("description");
+        expected.addGroupPath("/Groups", true);
+
+        authorizationPage.authorizationTabs().policies().create(expected, false);
+        
+        alert.assertDanger("Error! You must choose a group");
+    }
+
     private GroupPolicyRepresentation createPolicy(GroupPolicyRepresentation expected) {
         GroupPolicy policy = authorizationPage.authorizationTabs().policies().create(expected);
         assertAlertSuccess();
diff --git a/themes/src/main/resources/theme/base/admin/resources/js/authz/authz-controller.js b/themes/src/main/resources/theme/base/admin/resources/js/authz/authz-controller.js
index 7f28d9f6e7..ca2a3aec18 100644
--- a/themes/src/main/resources/theme/base/admin/resources/js/authz/authz-controller.js
+++ b/themes/src/main/resources/theme/base/admin/resources/js/authz/authz-controller.js
@@ -1772,7 +1772,7 @@ module.controller('ResourceServerPolicyRoleDetailCtrl', function($scope, $route,
     }
 });
 
-module.controller('ResourceServerPolicyGroupDetailCtrl', function($scope, $route, realm, client, Client, Groups, Group, PolicyController) {
+module.controller('ResourceServerPolicyGroupDetailCtrl', function($scope, $route, realm, client, Client, Groups, Group, PolicyController, Notifications) {
     PolicyController.onInit({
         getPolicyType : function() {
             return "group";
@@ -1821,6 +1821,10 @@ module.controller('ResourceServerPolicyGroupDetailCtrl', function($scope, $route
                         return
                     }
                 }
+                if (group.id == "realm") {
+                    Notifications.error("You must choose a group");
+                    return;
+                }
                 $scope.selectedGroups.push({id: group.id, path: group.path});
                 $scope.changed = true;
             }