diff --git a/pkg/actions/accessentry/migrator.go b/pkg/actions/accessentry/migrator.go
index 2be1d1993a..b3a52c2ad8 100644
--- a/pkg/actions/accessentry/migrator.go
+++ b/pkg/actions/accessentry/migrator.go
@@ -64,7 +64,7 @@ func NewMigrator(
 }
 
 func (m *Migrator) MigrateToAccessEntry(ctx context.Context, options MigrationOptions) error {
-	if m.tgAuthMode == ekstypes.AuthenticationModeConfigMap {
+	if m.tgAuthMode != ekstypes.AuthenticationModeApi && m.tgAuthMode != ekstypes.AuthenticationModeApiAndConfigMap {
 		return fmt.Errorf("target authentication mode is invalid, must be either %s or %s", ekstypes.AuthenticationModeApi, ekstypes.AuthenticationModeApiAndConfigMap)
 	}
 	if m.curAuthMode == ekstypes.AuthenticationModeApi {
diff --git a/pkg/actions/accessentry/migrator_test.go b/pkg/actions/accessentry/migrator_test.go
index 0464506635..0a8cb5c888 100644
--- a/pkg/actions/accessentry/migrator_test.go
+++ b/pkg/actions/accessentry/migrator_test.go
@@ -126,6 +126,7 @@ var _ = Describe("Migrate Access Entry", func() {
 
 		Entry("[Validation Error] current authentication mode is API", migrateToAccessEntryEntry{
 			curAuthMode: ekstypes.AuthenticationModeApi,
+			tgAuthMode:  ekstypes.AuthenticationModeApi,
 			validateCustomLoggerOutput: func(output string) {
 				Expect(output).To(ContainSubstring(fmt.Sprintf("cluster authentication mode is already %s; there is no need to migrate to access entries", ekstypes.AuthenticationModeApi)))
 			},
@@ -133,6 +134,7 @@ var _ = Describe("Migrate Access Entry", func() {
 
 		Entry("[API Error] getting access entries fails", migrateToAccessEntryEntry{
 			curAuthMode: ekstypes.AuthenticationModeApiAndConfigMap,
+			tgAuthMode:  ekstypes.AuthenticationModeApi,
 			mockAccessEntries: func(getter *fakes.FakeGetterInterface) {
 				getter.GetReturns(nil, genericErr)
 			},