diff --git a/tests_multitenant/test_hobo_notify.py b/tests_multitenant/test_hobo_notify.py
index 7e0e1f6..2867af2 100644
--- a/tests_multitenant/test_hobo_notify.py
+++ b/tests_multitenant/test_hobo_notify.py
@@ -2,6 +2,8 @@
 
 import logging
 
+from django.db import connection
+from django.test.utils import CaptureQueriesContext
 import pytest
 
 pytestmark = pytest.mark.django_db
@@ -205,6 +207,143 @@ def test_hobo_notify_roles(caplog, tenants):
             assert caplog.records[-1].args == (u'Service petite enfance2', u'12345')
 
 
+def test_hobo_notify_roles_db_queries(caplog, tenants):
+    from django.contrib.auth.models import Group
+    from tenant_schemas.utils import tenant_context
+
+    from hobo.agent.common.management.commands.hobo_notify import Command
+    from hobo.agent.common.models import Role
+
+    # test provision
+    for tenant in tenants:
+        with tenant_context(tenant):
+            notification = {
+                '@type': 'provision',
+                'audience': ['%s/saml/metadata' % tenant.get_base_url()],
+                'objects': {
+                    '@type': 'role',
+                    'data': [
+                        {
+                            'uuid': '12345',
+                            'name': 'Service petite enfance',
+                            'slug': 'service-petite-enfance',
+                            'description': 'Role du service petite enfance %s' % tenant.domain_url,
+                            'details': 'Some details',
+                            'emails': ['foo@bar.com', 'test@entrouvert.org'],
+                            'emails_to_members': False,
+                        },
+                        {
+                            'uuid': '6789',
+                            'name': 'Autre service',
+                            'slug': 'autre service',
+                            'description': "Role d'un autre service petite enfance %s" % tenant.domain_url,
+                        },
+                    ],
+                },
+            }
+            with CaptureQueriesContext(connection) as ctx:
+                Command.process_notification(tenant, notification)
+                assert len(ctx.captured_queries) == 36
+            assert Group.objects.count() == 2
+            assert Role.objects.count() == 2
+
+    # test provision full
+    for tenant in tenants:
+        with tenant_context(tenant):
+            notification = {
+                '@type': 'provision',
+                'full': True,
+                'audience': ['%s/saml/metadata' % tenant.get_base_url()],
+                'objects': {
+                    '@type': 'role',
+                    'data': [
+                        {
+                            'uuid': '12sed45',
+                            'name': 'Le dernier service',
+                            'slug': 'le-dernier-service',
+                            'description': '',
+                        }
+                    ],
+                },
+            }
+            with CaptureQueriesContext(connection) as ctx:
+                Command.process_notification(tenant, notification)
+                assert len(ctx.captured_queries) == 45
+            assert Group.objects.count() == 1
+            assert Role.objects.count() == 1
+
+    # provision again
+    for tenant in tenants:
+        with tenant_context(tenant):
+            notification = {
+                '@type': 'provision',
+                'audience': ['%s/saml/metadata' % tenant.get_base_url()],
+                'objects': {
+                    '@type': 'role',
+                    'data': [
+                        {
+                            'uuid': '12345',
+                            'name': 'Service petite enfance',
+                            'slug': 'service-petite-enfance',
+                            'description': 'Role du service petite enfance %s' % tenant.domain_url,
+                            'details': 'Some details',
+                            'emails': ['foo@bar.com', 'test@entrouvert.org'],
+                            'emails_to_members': False,
+                        },
+                        {
+                            'uuid': '6789',
+                            'name': 'Autre service',
+                            'slug': 'autre service',
+                            'description': "Role d'un autre service petite enfance %s" % tenant.domain_url,
+                        },
+                    ],
+                },
+            }
+            Command.process_notification(tenant, notification)
+            assert Group.objects.count() == 3
+            assert Role.objects.count() == 3
+
+    # test deprovision
+    for tenant in tenants:
+        with tenant_context(tenant):
+            notification = {
+                '@type': 'deprovision',
+                'audience': ['%s/saml/metadata' % tenant.get_base_url()],
+                'objects': {
+                    '@type': 'role',
+                    'data': [
+                        {
+                            'uuid': '12sed45',
+                            'name': 'Le dernier service',
+                            'slug': 'le-dernier-service',
+                            'description': '',
+                        },
+                        {
+                            'uuid': '12345',
+                            'name': 'Service petite enfance',
+                            'slug': 'service-petite-enfance',
+                            'description': 'Role du service petite enfance %s' % tenant.domain_url,
+                            'details': 'Some details',
+                            'emails': ['foo@bar.com', 'test@entrouvert.org'],
+                            'emails_to_members': False,
+                        },
+                        {
+                            'uuid': '6789',
+                            'name': 'Autre service',
+                            'slug': 'autre service',
+                            'description': "Role d'un autre service petite enfance %s" % tenant.domain_url,
+                        },
+                    ],
+                },
+            }
+            with CaptureQueriesContext(connection) as ctx:
+                Command.process_notification(tenant, notification)
+                assert len(ctx.captured_queries) == 39
+
+            assert Group.objects.count() == 0
+            assert Role.objects.count() == 0
+
+
 def test_provision_users(tenants):
     from django.contrib.auth import get_user_model
     from django.contrib.auth.models import Group