diff --git a/plugins/modules/env.py b/plugins/modules/env.py
index 0bb9bab5..4ab858c8 100644
--- a/plugins/modules/env.py
+++ b/plugins/modules/env.py
@@ -842,7 +842,7 @@ def _configure_payload(self):
                 payload['authentication'] = dict(publicKey=self.public_key_text)
 
             if self.freeipa is not None:
-                payload['freeIpa'] = dict(instanceCountByGroup=self.freeipa)
+                payload['freeIpa'] = dict(instanceCountByGroup=self.freeipa['instanceCountByGroup'])
 
             if self.vpc_id is not None:
                 payload['vpcId'] = self.vpc_id
@@ -875,6 +875,8 @@ def _configure_payload(self):
             )
             payload['usePublicIp'] = self.public_ip
             payload['logStorage'] = dict(serviceAccountEmail=self.log_identity, storageLocationBase=self.log_location)
+            if self.freeipa is not None:
+                payload['freeIpa'] = dict(instanceCountByGroup=self.freeipa['instanceCountByGroup'])
         else:
             # For Azure
             payload['securityAccess'] = dict(defaultSecurityGroupId=self.default_sg,
@@ -886,6 +888,8 @@ def _configure_payload(self):
                 payload['existingNetworkParams'] = dict(
                     networkId=self.vpc_id, resourceGroupName=self.resource_gp, subnetIds=self.subnet_ids
                 )
+            if self.freeipa is not None:
+                payload['freeIpa'] = dict(instanceCountByGroup=self.freeipa['instanceCountByGroup'])
 
         return payload
 
@@ -928,7 +932,7 @@ def _reconcile_existing_state(self, existing):
             if self.description is not None and existing['description'] != self.description:
                 mismatch.append(['description', existing['description']])
 
-            if self.freeipa is not None and len(existing['freeipa']['serverIP']) != self.freeipa:
+            if self.freeipa is not None and len(existing['freeipa']['serverIP']) != self.freeipa['instanceCountByGroup']:
                 mismatch.append(['freeipa', len(existing['freeipa']['serverIP'])])
 
             if self.vpc_id is not None and existing['network']['aws']['vpcId'] != self.vpc_id: