diff --git a/app/vmauth/auth_config.go b/app/vmauth/auth_config.go
index 2b3a7a31b..8e9dad467 100644
--- a/app/vmauth/auth_config.go
+++ b/app/vmauth/auth_config.go
@@ -392,8 +392,8 @@ func parseAuthConfig(data []byte) (*AuthConfig, error) {
 
 func parseAuthConfigUsers(ac *AuthConfig) (map[string]*UserInfo, error) {
 	uis := ac.Users
-	if len(uis) == 0 {
-		return nil, fmt.Errorf("`users` section cannot be empty in AuthConfig")
+	if len(uis) == 0 && ac.UnauthorizedUser == nil {
+		return nil, fmt.Errorf("Missing `users` or `unauthorized_user` sections")
 	}
 	byAuthToken := make(map[string]*UserInfo, len(uis))
 	for i := range uis {