diff --git a/CHANGELOG.md b/CHANGELOG.md
index 70f1186..e0b7cf0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,6 @@
 ## 0.1.2 (unreleased)
 
+- Fix active directory group optional
 - Added endpoints resource support
 - Added support for default user identity groups assignment under internal users
 - Fix description attribute of `network_device_groups_children_children`
diff --git a/ise_identity_management.tf b/ise_identity_management.tf
index fe65a50..3ec7b16 100644
--- a/ise_identity_management.tf
+++ b/ise_identity_management.tf
@@ -186,7 +186,7 @@ locals {
 
   active_directory_groups = {
     for ad in try(local.ise.identity_management.active_directories, []) : ad.name => [
-      for group in ad.groups : {
+      for group in try(ad.groups, []) : {
         name = group
         type = try(local.active_directory_groups_all[ad.name][group].type, null)
         sid  = try(local.active_directory_groups_all[ad.name][group].sid, null)