diff --git a/auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java b/auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java
index 39620ca8d25..df33ca7758e 100644
--- a/auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java
+++ b/auth/src/main/java/org/apache/rocketmq/auth/authentication/manager/AuthenticationMetadataManagerImpl.java
@@ -38,9 +38,14 @@ public class AuthenticationMetadataManagerImpl implements AuthenticationMetadata
 
     private final AuthorizationMetadataProvider authorizationMetadataProvider;
 
+    private boolean authorizationEnabled;
+
     public AuthenticationMetadataManagerImpl(AuthConfig authConfig) {
         this.authenticationMetadataProvider = AuthenticationFactory.getMetadataProvider(authConfig);
         this.authorizationMetadataProvider = AuthorizationFactory.getMetadataProvider(authConfig);
+        if (authConfig != null) {
+            this.authorizationEnabled = authConfig.isAuthorizationEnabled();
+        }
         this.initUser(authConfig);
     }
 
@@ -146,7 +151,10 @@ public CompletableFuture<Void> deleteUser(String username) {
                 throw new AuthenticationException("username can not be blank");
             }
             CompletableFuture<Void> deleteUser = this.getAuthenticationMetadataProvider().deleteUser(username);
-            CompletableFuture<Void> deleteAcl = this.getAuthorizationMetadataProvider().deleteAcl(User.of(username));
+            CompletableFuture<Void> deleteAcl = null;
+            if (authorizationEnabled) {
+                deleteAcl = this.getAuthorizationMetadataProvider().deleteAcl(User.of(username));
+            }
             return CompletableFuture.allOf(deleteUser, deleteAcl);
         } catch (Exception e) {
             this.handleException(e, result);