diff --git a/controllers/openstackmachine_controller.go b/controllers/openstackmachine_controller.go
index 10a8a92d19..91fd4062b6 100644
--- a/controllers/openstackmachine_controller.go
+++ b/controllers/openstackmachine_controller.go
@@ -391,9 +391,9 @@ func (r *OpenStackMachineReconciler) reconcileNormal(ctx context.Context, scope
 		Address: instanceStatus.Name(),
 	})
 	openStackMachine.Status.Addresses = addresses
-	if openStackMachine.Spec.IdentityRef == nil {
-		openStackMachine.Spec.IdentityRef = &openStackCluster.Spec.IdentityRef
-	}
+
+	_, identityRef := r.ScopeFactory.GetIdentityRefFromObjects(openStackMachine, openStackCluster)
+	openStackMachine.Spec.IdentityRef = identityRef
 
 	result := r.reconcileMachineState(scope, openStackMachine, machine, machineServer)
 	if result != nil {
@@ -576,13 +576,11 @@ func (r *OpenStackMachineReconciler) getOrCreateMachineServer(ctx context.Contex
 	}
 	if apierrors.IsNotFound(err) {
 		// Use credentials from the machine object by default, falling back to cluster credentials.
-		identityRef := func() infrav1.OpenStackIdentityReference {
-			if openStackMachine.Spec.IdentityRef != nil {
-				return *openStackMachine.Spec.IdentityRef
-			}
-			return openStackCluster.Spec.IdentityRef
-		}()
-		machineServerSpec := openStackMachineSpecToOpenStackServerSpec(&openStackMachine.Spec, identityRef, compute.InstanceTags(&openStackMachine.Spec, openStackCluster), failureDomain, userDataRef, getManagedSecurityGroup(openStackCluster, machine), openStackCluster.Status.Network.ID)
+		_, identityRef := r.ScopeFactory.GetIdentityRefFromObjects(openStackMachine, openStackCluster)
+		if identityRef == nil {
+			return nil, fmt.Errorf("unable to get identityRef from provided objects")
+		}
+		machineServerSpec := openStackMachineSpecToOpenStackServerSpec(&openStackMachine.Spec, *identityRef, compute.InstanceTags(&openStackMachine.Spec, openStackCluster), failureDomain, userDataRef, getManagedSecurityGroup(openStackCluster, machine), openStackCluster.Status.Network.ID)
 		machineServer = &infrav1alpha1.OpenStackServer{
 			ObjectMeta: metav1.ObjectMeta{
 				Labels: map[string]string{
diff --git a/pkg/scope/mock.go b/pkg/scope/mock.go
index d9568d6446..235c0aa6af 100644
--- a/pkg/scope/mock.go
+++ b/pkg/scope/mock.go
@@ -33,6 +33,7 @@ import (
 // MockScopeFactory implements both the ScopeFactory and ClientScope interfaces. It can be used in place of the default ProviderScopeFactory
 // when we want to use mocked service clients which do not attempt to connect to a running OpenStack cloud.
 type MockScopeFactory struct {
+	*defaultScopeFactory
 	ComputeClient *mock.MockComputeClient
 	NetworkClient *mock.MockNetworkClient
 	VolumeClient  *mock.MockVolumeClient
diff --git a/pkg/scope/provider.go b/pkg/scope/provider.go
index d23e3323a4..9f5c102acc 100644
--- a/pkg/scope/provider.go
+++ b/pkg/scope/provider.go
@@ -48,19 +48,12 @@ const (
 )
 
 type providerScopeFactory struct {
+	*defaultScopeFactory
 	clientCache *cache.LRUExpireCache
 }
 
 func (f *providerScopeFactory) NewClientScopeFromObject(ctx context.Context, ctrlClient client.Client, defaultCACert []byte, logger logr.Logger, objects ...infrav1.IdentityRefProvider) (Scope, error) {
-	var namespace *string
-	var identityRef *infrav1.OpenStackIdentityReference
-
-	for _, o := range objects {
-		namespace, identityRef = o.GetIdentityRef()
-		if namespace != nil || identityRef != nil {
-			break
-		}
-	}
+	namespace, identityRef := f.GetIdentityRefFromObjects(objects...)
 
 	if namespace == nil || identityRef == nil {
 		return nil, fmt.Errorf("unable to get identityRef from provided objects")
diff --git a/pkg/scope/scope.go b/pkg/scope/scope.go
index 93f070fe73..8ccdada229 100644
--- a/pkg/scope/scope.go
+++ b/pkg/scope/scope.go
@@ -43,6 +43,21 @@ func NewFactory(maxCacheSize int) Factory {
 type Factory interface {
 	// NewClientScopeFromObject creates a new scope from the first object which returns an OpenStackIdentityRef
 	NewClientScopeFromObject(ctx context.Context, ctrlClient client.Client, defaultCACert []byte, logger logr.Logger, objects ...infrav1.IdentityRefProvider) (Scope, error)
+	GetIdentityRefFromObjects(objects ...infrav1.IdentityRefProvider) (*string, *infrav1.OpenStackIdentityReference)
+}
+
+type defaultScopeFactory struct{}
+
+func (f *defaultScopeFactory) GetIdentityRefFromObjects(objects ...infrav1.IdentityRefProvider) (*string, *infrav1.OpenStackIdentityReference) {
+	var namespace *string
+	var identityRef *infrav1.OpenStackIdentityReference
+	for _, o := range objects {
+		namespace, identityRef = o.GetIdentityRef()
+		if identityRef != nil {
+			break
+		}
+	}
+	return namespace, identityRef
 }
 
 // Scope contains arguments common to most operations.