diff --git a/os_client_config/config.py b/os_client_config/config.py
index f1df797..0f19dd1 100644
--- a/os_client_config/config.py
+++ b/os_client_config/config.py
@@ -885,14 +885,14 @@ class OpenStackConfig(object):
         plugin_options = loader.get_options()
 
         for p_opt in plugin_options:
-            # if it's in config.auth, win, kill it from config dict
-            # if it's in config and not in config.auth, move it
+            # if it's in config, win, move it and kill it from config dict
+            # if it's in config.auth but not in config we're good
             # deprecated loses to current
             # provided beats default, deprecated or not
-            winning_value = self._find_winning_auth_value(
-                p_opt, config['auth'])
+            winning_value = self._find_winning_auth_value(p_opt, config)
             if not winning_value:
-                winning_value = self._find_winning_auth_value(p_opt, config)
+                winning_value = self._find_winning_auth_value(
+                    p_opt, config['auth'])
 
             # Clean up after ourselves
             for opt in [p_opt.name] + [o.name for o in p_opt.deprecated]: