diff --git a/x-pack/test/functional/apps/security/users.ts b/x-pack/test/functional/apps/security/users.ts
index 444cf42752607..b2bef848b18e2 100644
--- a/x-pack/test/functional/apps/security/users.ts
+++ b/x-pack/test/functional/apps/security/users.ts
@@ -19,6 +19,10 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
   const toasts = getService('toasts');
   const browser = getService('browser');
 
+  function isCloudEnvironment() {
+    return config.get('servers.elasticsearch.hostname') !== 'localhost';
+  }
+
   describe('users', function () {
     const optionalUser: UserFormValues = {
       username: 'OptionalUser',
@@ -37,7 +41,11 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
       const users = keyBy(await PageObjects.security.getElasticsearchUsers(), 'username');
       log.info('actualUsers = %j', users);
       log.info('config = %j', config.get('servers.elasticsearch.hostname'));
-      if (config.get('servers.elasticsearch.hostname') === 'localhost') {
+
+      // In Cloud default users are defined in file realm, such users aren't exposed through the Users API.
+      if (isCloudEnvironment()) {
+        expect(Object.keys(users)).to.eql(['test_user']);
+      } else {
         expect(users.elastic.roles).to.eql(['superuser']);
         expect(users.elastic.reserved).to.be(true);
         expect(users.elastic.deprecated).to.be(false);
@@ -49,9 +57,6 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
         expect(users.kibana.roles).to.eql(['kibana_system']);
         expect(users.kibana.reserved).to.be(true);
         expect(users.kibana.deprecated).to.be(true);
-      } else {
-        expect(users.anonymous.roles).to.eql(['anonymous']);
-        expect(users.anonymous.reserved).to.be(true);
       }
     });