diff --git a/site-modules/profile/manifests/icinga2.pp b/site-modules/profile/manifests/icinga2.pp
--- a/site-modules/profile/manifests/icinga2.pp
+++ b/site-modules/profile/manifests/icinga2.pp
@@ -4,6 +4,23 @@
 
   include profile::icinga2::apt_config
 
+  $user = 'nagios'
+  $group = 'nagios'
+  $additional_groups = [
+    'puppet',  # needed to grant access to puppet directories to check its status
+  ]
+
+  group {$group:
+    system => true,
+  }
+  -> user {$user:
+    system => true,
+    gid    => $group,
+    shell  => '/usr/sbin/nologin',
+    home   => '/var/lib/nagios',
+    groups => $additional_groups
+  }
+
   case $icinga2_role {
     'agent':  { include profile::icinga2::agent }
     'master': { include profile::icinga2::master }
diff --git a/site-modules/profile/manifests/icinga2/agent.pp b/site-modules/profile/manifests/icinga2/agent.pp
--- a/site-modules/profile/manifests/icinga2/agent.pp
+++ b/site-modules/profile/manifests/icinga2/agent.pp
@@ -11,7 +11,6 @@
 
   include profile::icinga2::objects::agent_checks
 
-
   $check_mounts = $::mounts.filter |$mount| {
     $mount_excludes.all |$exclude| { !$mount.match($exclude) }
   }