diff --git a/src/tools/auth0/handlers/roles.ts b/src/tools/auth0/handlers/roles.ts
index 12c78f9a6..6053243ea 100644
--- a/src/tools/auth0/handlers/roles.ts
+++ b/src/tools/auth0/handlers/roles.ts
@@ -44,6 +44,9 @@ export default class RolesHandler extends DefaultHandler {
   async createRole(data): Promise<Asset> {
     const role = { ...data };
     delete role.permissions;
+    // `type` is a read-only field returned by the roles GET endpoint but rejected
+    // by the roles create/update endpoints. Strip it to keep exports round-trippable.
+    delete role.type;
 
     const created = await this.client.roles.create(role);
 
@@ -110,6 +113,9 @@ export default class RolesHandler extends DefaultHandler {
 
     delete data.permissions;
     delete data.id;
+    // `type` is read-only on the roles GET endpoint and rejected by update; strip it
+    // so files that already contain it (from a prior export) can still be imported.
+    delete data.type;
 
     await this.client.roles.update(params.id, data);
 
@@ -201,6 +207,9 @@ export default class RolesHandler extends DefaultHandler {
         );
 
         (roles[index] as any).permissions = strippedPerms;
+        // `type` is a read-only field (e.g. 'tenant') that the roles create/update
+        // endpoints reject, so omit it from the export to keep the round-trip valid.
+        delete (roles[index] as any).type;
       }
       this.existing = roles;
       return this.existing;
diff --git a/test/tools/auth0/handlers/roles.tests.js b/test/tools/auth0/handlers/roles.tests.js
index c2a0d6335..e43f1076f 100644
--- a/test/tools/auth0/handlers/roles.tests.js
+++ b/test/tools/auth0/handlers/roles.tests.js
@@ -66,6 +66,7 @@ describe('#roles handler', () => {
             expect(data).to.be.an('object');
             expect(data.name).to.equal('myRole');
             expect(data.description).to.equal('myDescription');
+            expect(data).to.not.have.property('type');
             return Promise.resolve(data);
           },
           update: () => Promise.resolve([]),
@@ -97,6 +98,7 @@ describe('#roles handler', () => {
               name: 'myRole',
               id: 'myRoleId',
               description: 'myDescription',
+              type: 'tenant',
               permissions: [],
             },
           ],
@@ -118,6 +120,7 @@ describe('#roles handler', () => {
                 name: 'myRole',
                 id: 'myRoleId',
                 description: 'myDescription',
+                type: 'tenant',
               },
             ]),
           permissions: {
@@ -261,6 +264,7 @@ describe('#roles handler', () => {
             expect(data).to.be.an('object');
             expect(data.name).to.equal('myRole');
             expect(data.description).to.equal('myDescription');
+            expect(data).to.not.have.property('type');
 
             return Promise.resolve(data);
           },
@@ -306,6 +310,7 @@ describe('#roles handler', () => {
               name: 'myRole',
               id: 'myRoleId',
               description: 'myDescription',
+              type: 'tenant',
               permissions: [
                 {
                   permission_name: 'Create:cal_entry',