diff --git a/atst/domain/environment_roles.py b/atst/domain/environment_roles.py
index add92091..9c722828 100644
--- a/atst/domain/environment_roles.py
+++ b/atst/domain/environment_roles.py
@@ -105,8 +105,9 @@ class EnvironmentRoles(object):
     def disable(cls, environment_role_id):
         environment_role = EnvironmentRoles.get_by_id(environment_role_id)
 
-        credentials = environment_role.environment.csp_credentials
-        app.csp.cloud.disable_user(credentials, environment_role.csp_user_id)
+        if not environment_role.environment.is_pending:
+            credentials = environment_role.environment.csp_credentials
+            app.csp.cloud.disable_user(credentials, environment_role.csp_user_id)
 
         environment_role.status = EnvironmentRole.Status.DISABLED
         db.session.add(environment_role)
diff --git a/tests/domain/test_environment_roles.py b/tests/domain/test_environment_roles.py
index 486da70a..7c7fda08 100644
--- a/tests/domain/test_environment_roles.py
+++ b/tests/domain/test_environment_roles.py
@@ -91,6 +91,25 @@ def test_disable_completed(application_role, environment):
     assert environment_role.disabled
 
 
+def test_disable_checks_env_provisioning_status(session):
+    environment = EnvironmentFactory.create()
+    assert environment.is_pending
+    env_role1 = EnvironmentRoleFactory.create(environment=environment)
+    env_role1 = EnvironmentRoles.disable(env_role1.id)
+    assert env_role1.disabled
+
+    environment.cloud_id = "cloud-id"
+    environment.root_user_info = {"credentials": "credentials"}
+    session.add(environment)
+    session.commit()
+    session.refresh(environment)
+
+    assert not environment.is_pending
+    env_role2 = EnvironmentRoleFactory.create(environment=environment)
+    env_role2 = EnvironmentRoles.disable(env_role2.id)
+    assert env_role2.disabled
+
+
 def test_get_for_update(application_role, environment):
     EnvironmentRoleFactory.create(
         application_role=application_role, environment=environment, deleted=True