diff --git a/os_client_config/config.py b/os_client_config/config.py
index d1b3144..beea4c4 100644
--- a/os_client_config/config.py
+++ b/os_client_config/config.py
@@ -888,14 +888,14 @@ class OpenStackConfig(object):
         plugin_options = loader.get_options()
 
         for p_opt in plugin_options:
-            # if it's in config, win, move it and kill it from config dict
-            # if it's in config.auth but not in config we're good
+            # if it's in config.auth, win, kill it from config dict
+            # if it's in config and not in config.auth, move it
             # deprecated loses to current
             # provided beats default, deprecated or not
-            winning_value = self._find_winning_auth_value(p_opt, config)
+            winning_value = self._find_winning_auth_value(
+                p_opt, config['auth'])
             if not winning_value:
-                winning_value = self._find_winning_auth_value(
-                    p_opt, config['auth'])
+                winning_value = self._find_winning_auth_value(p_opt, config)
 
             # Clean up after ourselves
             for opt in [p_opt.name] + [o.name for o in p_opt.deprecated]: