diff --git a/packages/user-management/__tests__/permissions.test.ts b/packages/user-management/__tests__/permissions.test.ts
index 0642aa8..6c7d395 100644
--- a/packages/user-management/__tests__/permissions.test.ts
+++ b/packages/user-management/__tests__/permissions.test.ts
@@ -82,6 +82,22 @@ describe('Permissions', () => {
     assert.equal(isPrincipal(testCaseUser, { schoolId: user.schools[1].schoolId }), false)
   })
 
+  test('check if principal with undefined school', () => {
+    const invalidTestCaseUser1 = { ...modifyUser(user, 0, [], true), schools: [...user.schools, undefined] }
+    // @ts-expect-error testing with invalid data in user schools
+    assert.equal(isPrincipal(invalidTestCaseUser1, { schoolId: user.schools[0].schoolId }), false)
+
+    const invalidTestCaseUser2 = { ...modifyUser(user, 0, [], true), schools: [...user.schools, undefined] }
+    // @ts-expect-error testing with invalid data in user schools
+    assert.equal(isPrincipal(invalidTestCaseUser2, { schoolId: undefined }), false)
+  })
+
+  test.only('check if principal with undefined schools', () => {
+    const invalidTestCaseUser1 = { ...modifyUser(user, 0, [], true), schools: undefined }
+    // @ts-expect-error testing with invalid data in user schools
+    assert.equal(isPrincipal(invalidTestCaseUser1, { schoolId: user.schools[0].schoolId }), false)
+  })
+
   test('check if a user has a permission in given school', () => {
     const testCaseUser = modifyUser(user, 0, ['observations'])
     assert.equal(hasPermission(testCaseUser, 'observations', { schoolId: testCaseUser.schools[0].schoolId }), true)
diff --git a/packages/user-management/src/user-checks.ts b/packages/user-management/src/user-checks.ts
index 6b7a315..42f783b 100644
--- a/packages/user-management/src/user-checks.ts
+++ b/packages/user-management/src/user-checks.ts
@@ -1,11 +1,15 @@
 import { applicationPermissions, AppPerm, Perm, PermissionGrant, PermissionOptions, User, UserSchool } from './index'
 
 function userSchools(user: User, options?: PermissionOptions): UserSchool[] {
-  return options?.schoolId ? user.schools.filter(school => school.schoolId === options.schoolId) : user.schools
+  return user.schools
+    ? options?.schoolId
+      ? user.schools.filter(school => school?.schoolId === options.schoolId)
+      : user.schools
+    : []
 }
 
 export function userPermissionGrants(user: User, options?: PermissionOptions): PermissionGrant[] {
-  return userSchools(user, options).flatMap(school => school.permissions)
+  return userSchools(user, options).flatMap(school => school?.permissions ?? [])
 }
 
 export function userPermissions(user: User, options?: PermissionOptions): Perm[] {
@@ -13,7 +17,7 @@ export function userPermissions(user: User, options?: PermissionOptions): Perm[]
 }
 
 export function isPrincipal(user: User, options?: PermissionOptions): boolean {
-  return userSchools(user, options).find(school => school.principal) !== undefined
+  return userSchools(user, options).find(school => school?.principal) !== undefined
 }
 
 export function hasPermission(user: User, requiredPermission: Perm | '*', options?: PermissionOptions): boolean {