diff --git a/loops/organize/member.py b/loops/organize/member.py
index 75fc76f..8d1cd06 100644
--- a/loops/organize/member.py
+++ b/loops/organize/member.py
@@ -25,6 +25,7 @@ from loops.concept import Concept
 from loops.interfaces import ILoops
 from loops.organize.auth import IPersonBasedAuthenticator
 from loops.organize.interfaces import IMemberRegistrationManager
+from loops.organize.party import getPersonForUser
 from loops.organize.util import getPrincipalFolder, getGroupsFolder
 from loops.organize.util import getInternalPrincipal, getPrincipalForUserId
 from loops.type import getOptionsDict
@@ -68,8 +69,10 @@ class MemberRegistrationManager(object):
         if not groups:
             groups = options(self.groups_key, ())
         self.setGroupsForPrincipal(pfName, userId,  groups=groups)
-        return self.createPersonForPrincipal(pfName, userId, lastName, firstName,
-                                      useExisting, **kw)
+        person = self.createPersonForPrincipal(
+                    pfName, userId, lastName, firstName, useExisting, **kw)
+        createExtUser(person)
+        return person
 
     def createPrincipal(self, pfName, userId, password, lastName,
                               firstName=u'', groups=[], useExisting=False,
@@ -156,3 +159,26 @@ class MemberRegistrationManager(object):
         principal.setPassword(newPw)
         return True
 
+
+def createExtUser(person, principal=None, updateIfExists=False):
+    import config
+    params = getattr(config, 'oidc_params', None)
+    if params is None:
+        return
+    if principal is None:
+        principal = getInternalPrincipal(person.userId, person.context)
+    from scopes.org import user
+    u = user.User(principal.login, person.email, #principal.password,
+                  firstName=person.firstName or '', 
+                  lastName=person.lastName or '')
+    xu = user.ExtUser(u, principal.__parent__.prefix)
+    res = xu.create(updateIfExists)
+    #print('*** Person.createExtUser', principal.login, res)
+
+
+def syncExtUsers(context, pfolderName):
+    pf = getPrincipalFolder(context, pFolderName)
+    for id, prc in pf.items():
+        userId = pf.prefix + id
+        person = getPersonForUser(context, getPrincipalForUserId(userId, context))
+        createExtUser(person, principal, True)
diff --git a/loops/organize/party.py b/loops/organize/party.py
index e9e72a0..335c856 100644
--- a/loops/organize/party.py
+++ b/loops/organize/party.py
@@ -80,24 +80,6 @@ class Person(AdapterBase, BasePerson):
     _adapterAttributes = ('context', '__parent__', 'userId', 'phoneNumbers')
     _contextAttributes = list(IPerson) + list(IConcept)
 
-    def createExtUser(self, userId):
-        import config
-        params = getattr(config, 'oidc_params', None)
-        if params is None:
-            return
-        #print('*** Person.createExtUser', userId)
-        from scopes.org import user
-        try:
-            prc = getInternalPrincipal(userId, self.context)
-        except ValueError: # may happen during testing
-            #print('*** PAU not available, userId:', userId)
-            return
-        u = user.User(prc.login, self.email, #prc.password,
-                      firstName=self.firstName or '', 
-                      lastName=self.lastName or '')
-        xu = user.ExtUser(u, prc.__parent__.prefix)
-        xu.create(True)
-
     def getUserId(self):
         return getattr(self.context, '_userId', None)
     def setUserId(self, userId):
@@ -129,9 +111,6 @@ class Person(AdapterBase, BasePerson):
         self.context._userId = userId
         setter.propagateSecurity()
         allowEditingForOwner(self.context, revert=not userId)  # why this?
-        if not oldUserId:
-            pass
-            self.createExtUser(userId)
     userId = property(getUserId, setUserId)
 
     def removeReferenceFromPrincipal(self, userId):