diff --git a/src/plugins/dnf/subscription_manager.py b/src/plugins/dnf/subscription_manager.py
index 38d213abf2..199bb1db05 100644
--- a/src/plugins/dnf/subscription_manager.py
+++ b/src/plugins/dnf/subscription_manager.py
@@ -32,6 +32,13 @@
 
 from configparser import ConfigParser
 
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from subscription_manager.certdirectory import EntitlementDirectory
+    from subscription_manager.identity import Identity
+
+
 expired_warning = _(
     """
 *** WARNING ***
@@ -137,12 +144,15 @@ def _update(cache_only):
         Update entitlement certificates and redhat.repo
         :param cache_only: is True, when rhsm.full_refresh_on_yum is set to 0 in rhsm.conf
         """
-
         logger.info(_("Updating Subscription Management repositories."))
-
-        identity = inj.require(inj.IDENTITY)
-
-        if not identity.is_valid():
+        identity: Identity = inj.require(inj.IDENTITY)
+        ent_dir: EntitlementDirectory = inj.require(inj.ENT_DIR)
+
+        # During first phase of anonymous cloud registration the system has
+        # valid entitlement certificates, but does not yet have any identity.
+        # We have access to the content, so we shouldn't be reporting missing
+        # identity certificate.
+        if not identity.is_valid() and len(ent_dir.list_valid()) == 0:
             logger.info(_("Unable to read consumer identity"))
 
         if config.in_container():