diff --git a/roles/ceph-mon/tasks/ceph_keys.yml b/roles/ceph-mon/tasks/ceph_keys.yml
index 4aeb22923..580b7d8cd 100644
--- a/roles/ceph-mon/tasks/ceph_keys.yml
+++ b/roles/ceph-mon/tasks/ceph_keys.yml
@@ -19,7 +19,9 @@
   changed_when: false
   always_run: true
   run_once: true
-  when: is_initial_mon_keyring_in_kv.rc != 0
+  when:
+    - is_initial_mon_keyring_in_kv.rc != 0
+    - cephx
 
 - name: create ceph rest api keyring when mon is not containerized
   command: ceph --cluster {{ cluster }} auth get-or-create client.restapi osd 'allow *' mon 'allow *' -o /etc/ceph/{{ cluster }}.client.restapi.keyring