diff --git a/bayer/templates/modals/collections/new_package_modal.html b/bayer/templates/modals/collections/new_package_modal.html
index 54e03fae..924f7939 100644
--- a/bayer/templates/modals/collections/new_package_modal.html
+++ b/bayer/templates/modals/collections/new_package_modal.html
@@ -131,8 +131,9 @@
             id="package-data-pool"
             name="package-data-pool"
             class="select select-bordered w-full"
+            :required="isSecret"
           >
-            <option value="" disabled selected>Select Data Pool</option>
+            <option value="" disabled>Select Data Pool</option>
               {% for obj in meta.secret_groups %}
                 <option value="{{ obj.url }}">{{ obj.name|safe }}</option>
               {% endfor %}
diff --git a/epauth/views.py b/epauth/views.py
index 5a5746a4..e1fbd7d5 100644
--- a/epauth/views.py
+++ b/epauth/views.py
@@ -83,6 +83,7 @@ def entra_callback(request):
     # Get implementing class
     User = get_user_model()
 
+    registered = False
     if User.objects.filter(uuid=user_oid).exists():
         u = User.objects.get(uuid=user_oid)
 
@@ -93,6 +94,7 @@ def entra_callback(request):
     else:
         auth_log.info(f"Registering {user_name} with OID {user_oid}")
         u = UserManager.create_user(user_name, user_email, None, uuid=user_oid, is_active=True)
+        registered = True
 
     auth_log.info(f"User {user_name} {'(admin) ' if u.is_superuser else ''}with OID {user_oid} successfully logged in as {u.username} from {get_remote_address(request)}")
     login(request, u)
@@ -132,6 +134,17 @@ def entra_callback(request):
                 g.user_member.remove(u)
                 auth_log.info(f"Login Group Sync: Removing {u.username} from Group {g.name} ({ uuid })")
 
+    if registered:
+        # #72 make package secret if user is part of a secret group
+        for id, name in s.ENTRA_SECRET_GROUPS.items():
+            group = Group.objects.get(uuid=id)
+            if group.user_member.contains(u):
+                # User is eligible for secrete
+                pack = u.default_package
+                u.data_pool = group
+                u.classification_level = u.Classification.SECRET
+                u.save()
+
     # EDIT END
 
     return redirect(s.SERVER_URL)  # Handle errors
diff --git a/epdb/legacy_api.py b/epdb/legacy_api.py
index c6228e7a..1c24f538 100644
--- a/epdb/legacy_api.py
+++ b/epdb/legacy_api.py
@@ -49,7 +49,7 @@ from .views import get_remote_address
 
 Package = s.GET_PACKAGE_MODEL()
 
-auth_log = logging.get_logger("auth")
+auth_log = logging.getLogger("auth")
 
 
 def get_cached_jwks(tenant_id: str, force=False) -> Dict:
diff --git a/epdb/views.py b/epdb/views.py
index ac232490..90e2aa09 100644
--- a/epdb/views.py
+++ b/epdb/views.py
@@ -423,7 +423,7 @@ def get_base_context(request, for_user=None) -> Dict[str, Any]:
             "external_databases": ExternalDatabase.get_databases(),
             "site_id": s.MATOMO_SITE_ID,
             # EDIT START
-            "secret_groups": Group.objects.filter(secret=True),
+            "secret_groups": Group.objects.filter(secret=True, user_member=current_user),
             # EDIT END
         },
     }
diff --git a/templates/components/navbar.html b/templates/components/navbar.html
index 05dab6a8..36fd9fe2 100644
--- a/templates/components/navbar.html
+++ b/templates/components/navbar.html
@@ -105,6 +105,11 @@
           <img src="{% static 'images/restricted_mid.png' %}" width="200">
         {% elif meta.url_contains_package and meta.current_package.get_classification_level_display == "Secret" %}
           <img src="{% static 'images/secret_mid.png' %}" width="120">
+        {% elif not meta.url_contains_package and meta.user.default_package.get_classification_level_display == "Restricted" %}
+          <img src="{% static 'images/restricted_mid.png' %}" width="200">
+        {% elif not meta.url_contains_package and meta.user.default_package.get_classification_level_display == "Secret" %}
+          <img src="{% static 'images/secret_mid.png' %}" width="200">
+
         {% endif %}
         {% if not public_mode %}
           <a id="search-trigger" role="button" class="cursor-pointer">