diff --git a/plugins/modules/azure_rm_keyvaultkey.py b/plugins/modules/azure_rm_keyvaultkey.py
index 8a3e21c6e..985775b9a 100644
--- a/plugins/modules/azure_rm_keyvaultkey.py
+++ b/plugins/modules/azure_rm_keyvaultkey.py
@@ -222,7 +222,10 @@ def get_keyvault_client(self):
                 return KeyVaultClient(credentials)
             except Exception:
                 self.log("Get KeyVaultClient from service principal")
-        elif self.module.params['auth_source'] in ['auto', 'cli']:
+        elif (self.module.params['auth_source'] == 'cli'
+                or (self.module.params['auth_source'] == 'auto'
+                    and self.credentials['client_id'] is None
+                    and self.credentials['secret'] is None)):
             try:
                 profile = get_cli_profile()
                 credentials, subscription_id, tenant = profile.get_login_credentials(
diff --git a/plugins/modules/azure_rm_keyvaultkey_info.py b/plugins/modules/azure_rm_keyvaultkey_info.py
index 185384a32..7247ec4eb 100644
--- a/plugins/modules/azure_rm_keyvaultkey_info.py
+++ b/plugins/modules/azure_rm_keyvaultkey_info.py
@@ -321,7 +321,10 @@ def get_keyvault_client(self):
                 return KeyVaultClient(credentials)
             except Exception:
                 self.log("Get KeyVaultClient from service principal")
-        elif self.module.params['auth_source'] in ['auto', 'cli']:
+        elif (self.module.params['auth_source'] == 'cli'
+                or (self.module.params['auth_source'] == 'auto'
+                    and self.credentials['client_id'] is None
+                    and self.credentials['secret'] is None)):
             try:
                 profile = get_cli_profile()
                 credentials, subscription_id, tenant = profile.get_login_credentials(
diff --git a/plugins/modules/azure_rm_keyvaultsecret.py b/plugins/modules/azure_rm_keyvaultsecret.py
index a6c320845..0a5288abb 100644
--- a/plugins/modules/azure_rm_keyvaultsecret.py
+++ b/plugins/modules/azure_rm_keyvaultsecret.py
@@ -207,7 +207,10 @@ def get_keyvault_client(self):
                 return KeyVaultClient(credentials)
             except Exception:
                 self.log("Get KeyVaultClient from service principal")
-        elif self.module.params['auth_source'] in ['auto', 'cli']:
+        elif (self.module.params['auth_source'] == 'cli'
+                or (self.module.params['auth_source'] == 'auto'
+                    and self.credentials['client_id'] is None
+                    and self.credentials['secret'] is None)):
             try:
                 profile = get_cli_profile()
                 credentials, subscription_id, tenant = profile.get_login_credentials(
diff --git a/plugins/modules/azure_rm_keyvaultsecret_info.py b/plugins/modules/azure_rm_keyvaultsecret_info.py
index 8f495de75..a785b8ce7 100644
--- a/plugins/modules/azure_rm_keyvaultsecret_info.py
+++ b/plugins/modules/azure_rm_keyvaultsecret_info.py
@@ -275,7 +275,10 @@ def get_keyvault_client(self):
                 return KeyVaultClient(credentials)
             except Exception:
                 self.log("Get KeyVaultClient from service principal")
-        elif self.module.params['auth_source'] in ['auto', 'cli']:
+        elif (self.module.params['auth_source'] == 'cli'
+                or (self.module.params['auth_source'] == 'auto'
+                    and self.credentials['client_id'] is None
+                    and self.credentials['secret'] is None)):
             try:
                 profile = get_cli_profile()
                 credentials, subscription_id, tenant = profile.get_login_credentials(