diff --git a/roles/ipa/client/tasks/hbac.yml b/roles/ipa/client/tasks/hbac.yml
index 2bcff80fec..a903e8f272 100644
--- a/roles/ipa/client/tasks/hbac.yml
+++ b/roles/ipa/client/tasks/hbac.yml
@@ -90,6 +90,7 @@
   fail:
     msg: "`{{ item }}` is not defined"
   ignore_errors: true
+  changed_when: false
   when: lookup('vars', item, default="<undefined-sentinel>") == "<undefined-sentinel>"
   loop:
     - ipa_host_group