diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml
index eb820e3..3b8888f 100644
--- a/apps/opencloud/opencloud-configmap.yaml
+++ b/apps/opencloud/opencloud-configmap.yaml
@@ -20,7 +20,7 @@ data:
     system_user_id: ${OC_SYSTEM_USER_ID}
     admin_user_id: ${OC_ADMIN_USER_ID}
 
-    # Graph service (using owncloudsql for OIDC-based user management)
+    # Graph service (using internal IDM LDAP for user storage)
     graph:
       application:
         id: ${OC_GRAPH_APPLICATION_ID:-025a50d1-5f8d-4309-a201-dd938e7b0b2f}
@@ -28,21 +28,25 @@ data:
         tls_insecure: true
       spaces:
         insecure: true
+      identity:
+        ldap:
+          bind_password: ${OC_GRAPH_LDAP_BIND_PASSWORD}
       service_account:
         service_account_id: ${OC_SERVICE_ACCOUNT_ID}
         service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
 
-    # IDP and IDM services excluded (using external OIDC via Pocket ID)
+    # IDP service excluded (using external OIDC via Pocket ID for authentication)
     # idp:
     #   ldap:
     #     bind_password: ${OC_IDP_LDAP_BIND_PASSWORD}
 
-    # idm:
-    #   service_user_passwords:
-    #     admin_password: ${OC_IDM_ADMIN_PASSWORD}
-    #     idm_password: ${OC_IDM_IDM_PASSWORD}
-    #     reva_password: ${OC_IDM_REVA_PASSWORD}
-    #     idp_password: ${OC_IDM_IDP_PASSWORD}
+    # IDM service (needed for user storage even with external OIDC)
+    idm:
+      service_user_passwords:
+        admin_password: ${OC_IDM_ADMIN_PASSWORD}
+        idm_password: ${OC_IDM_IDM_PASSWORD}
+        reva_password: ${OC_IDM_REVA_PASSWORD}
+        idp_password: ${OC_IDM_IDP_PASSWORD}
 
     # Collaboration services
     collaboration:
@@ -95,14 +99,16 @@ data:
         oidc:
           insecure: false
 
-    # User/Group services (using owncloudsql for OIDC-based provisioning)
+    # User/Group services (using LDAP driver connected to internal IDM)
     users:
       drivers:
-        owncloudsql: {}
+        ldap:
+          bind_password: ${OC_USERS_LDAP_BIND_PASSWORD}
 
     groups:
       drivers:
-        owncloudsql: {}
+        ldap:
+          bind_password: ${OC_GROUPS_LDAP_BIND_PASSWORD}
 
     # OCM (Open Cloud Mesh)
     ocm:
diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml
index a6053e9..d45bd3e 100644
--- a/apps/opencloud/opencloud-deployment.yaml
+++ b/apps/opencloud/opencloud-deployment.yaml
@@ -91,9 +91,9 @@ spec:
         - name: PROXY_TLS
           value: "false"
 
-        # Exclude broken search service and internal IDP/IDM (using external OIDC via Pocket ID)
+        # Exclude broken search service and internal IDP only (IDM needed for user storage, using external OIDC via Pocket ID for auth)
         - name: OC_EXCLUDE_RUN_SERVICES
-          value: "search,idp,idm"
+          value: "search,idp"
 
         # Data paths
         - name: OPENCLOUD_BASE_DATA_PATH