diff --git a/addons/mail/models/res_users.py b/addons/mail/models/res_users.py
index 893f2dc720e..5c1b43c120b 100644
--- a/addons/mail/models/res_users.py
+++ b/addons/mail/models/res_users.py
@@ -50,10 +50,11 @@ class Users(models.Model):
         users = super(Users, self).create(vals_list)
 
         # log a portal status change (manual tracking)
-        if not self._context.get('mail_create_nolog') and not self._context.get('mail_notrack'):
+        log_portal_access = not self._context.get('mail_create_nolog') and not self._context.get('mail_notrack')
+        if log_portal_access:
             for user in users:
                 if user.has_group('base.group_portal'):
-                    body = user._get_portal_access_update(True)
+                    body = user._get_portal_access_update_body(True)
                     user.partner_id.message_post(
                         body=body,
                         message_type='notification',
@@ -65,19 +66,21 @@ class Users(models.Model):
         return users
 
     def write(self, vals):
+        log_portal_access = 'groups_id' in vals and not self._context.get('mail_create_nolog') and not self._context.get('mail_notrack')
         user_portal_access_dict = {
             user.id: user.has_group('base.group_portal')
             for user in self
-        }
+        } if log_portal_access else {}
+
         write_res = super(Users, self).write(vals)
 
         # log a portal status change (manual tracking)
-        if not self._context.get('mail_create_nolog') and not self._context.get('mail_notrack'):
+        if log_portal_access:
             for user in self:
                 user_has_group = user.has_group('base.group_portal')
                 portal_access_changed = user_has_group != user_portal_access_dict[user.id]
                 if portal_access_changed:
-                    body = user._get_portal_access_update(user_has_group)
+                    body = user._get_portal_access_update_body(user_has_group)
                     user.partner_id.message_post(
                         body=body,
                         message_type='notification',
@@ -114,7 +117,7 @@ class Users(models.Model):
             lambda cp: cp.channel_id.public != 'public' and cp.channel_id.channel_type == 'channel'
         ).unlink()
 
-    def _get_portal_access_update(self, access_granted):
+    def _get_portal_access_update_body(self, access_granted):
         body = _('Portal Access Granted') if access_granted else _('Portal Access Revoked')
         if self.partner_id.email:
             return '%s (%s)' % (body, self.partner_id.email)
diff --git a/addons/mail/tests/test_res_partner.py b/addons/mail/tests/test_res_partner.py
index d2dffc92d2d..8032b9d9714 100644
--- a/addons/mail/tests/test_res_partner.py
+++ b/addons/mail/tests/test_res_partner.py
@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
-from odoo.tests.common import TransactionCase
+from odoo.addons.mail.tests.common import MailCommon
 
 # samples use effective TLDs from the Mozilla public suffix
 # list at http://publicsuffix.org
@@ -18,7 +18,7 @@ SAMPLES = [
 
 ]
 
-class TestPartner(TransactionCase):
+class TestPartner(MailCommon):
 
     def _check_find_or_create(self, test_string, expected_name, expected_email, expected_email_normalized=False, check_partner=False, should_create=False):
         expected_email_normalized = expected_email_normalized or expected_email
@@ -90,3 +90,36 @@ class TestPartner(TransactionCase):
             SAMPLES[8][0], SAMPLES[8][1], SAMPLES[8][2],
             check_partner=new6, should_create=True
         )
+
+    def test_res_partner_log_portal_group(self):
+        Users = self.env['res.users']
+        subtype_note = self.env.ref('mail.mt_note')
+        group_portal, group_user = self.env.ref('base.group_portal'), self.env.ref('base.group_user')
+
+        # check at update
+        new_user = Users.create({
+            'email': 'micheline@test.example.com',
+            'login': 'michmich',
+            'name': 'Micheline Employee',
+        })
+        self.assertEqual(len(new_user.message_ids), 1, 'Should contain Contact created log message')
+        new_msg = new_user.message_ids
+        self.assertNotIn('Portal Access Granted', new_msg.body)
+        self.assertIn('Contact created', new_msg.body)
+
+        new_user.write({'groups_id': [(4, group_portal.id), (3, group_user.id)]})
+        new_msg = new_user.message_ids[0]
+        self.assertIn('Portal Access Granted', new_msg.body)
+        self.assertEqual(new_msg.subtype_id, subtype_note)
+
+        # check at create
+        new_user = Users.create({
+            'email': 'micheline.2@test.example.com',
+            'groups_id': [(4, group_portal.id)],
+            'login': 'michmich.2',
+            'name': 'Micheline Portal',
+        })
+        self.assertEqual(len(new_user.message_ids), 2, 'Should contain Contact created + Portal access log messages')
+        new_msg = new_user.message_ids[0]
+        self.assertIn('Portal Access Granted', new_msg.body)
+        self.assertEqual(new_msg.subtype_id, subtype_note)