diff --git a/roles/debian/ce_provision/tasks/main.yml b/roles/debian/ce_provision/tasks/main.yml
index 0ccd6e680..6d65d25f9 100644
--- a/roles/debian/ce_provision/tasks/main.yml
+++ b/roles/debian/ce_provision/tasks/main.yml
@@ -16,7 +16,7 @@
   with_items: "{{ ce_provision.groups }}"
   loop_control:
     loop_var: group
-  when: ce_provision.groups | length
+  when: ce_provision.groups is defined and ce_provision.groups | length > 0
 
 # User normally created already in the _init role.
 - name: Generate SSH key for the controller user for provisioning.