diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml
index 03bd909..23ba181 100644
--- a/apps/opencloud/opencloud-configmap.yaml
+++ b/apps/opencloud/opencloud-configmap.yaml
@@ -8,7 +8,19 @@ data:
   opencloud.yaml: |
     # OpenCloud Minimal Configuration
     # Only non-default settings - environment variables override these
-    # Using built-in IDM for user/group storage instead of external OpenLDAP
+    # Using built-in IDM for user/group storage (IDM provides internal LDAP on localhost:9125)
+
+    # Graph service - connect to IDM's internal LDAP server
+    graph:
+      identity:
+        ldap:
+          uri: ldap://localhost:9125
+          base_dn: o=libregraph-idm
+          insecure: true
+          bind_dn: uid=libregraph,ou=sysusers,o=libregraph-idm
+          bind_password: ${OC_IDM_IDM_PASSWORD}
+          user_base_dn: ou=users,o=libregraph-idm
+          group_base_dn: ou=groups,o=libregraph-idm
 
     # Proxy service - OIDC configuration (already in env vars, kept for reference)
     proxy:
@@ -19,6 +31,32 @@ data:
         user_oidc_claim: preferred_username
       enable_basic_auth: false
 
+    # Users service - connect to IDM's internal LDAP
+    users:
+      drivers:
+        ldap:
+          uri: ldap://localhost:9125
+          base_dn: o=libregraph-idm
+          insecure: true
+          bind_dn: uid=reva,ou=sysusers,o=libregraph-idm
+          bind_password: ${OC_IDM_REVA_PASSWORD}
+          user_base_dn: ou=users,o=libregraph-idm
+          user_filter: (objectClass=inetOrgPerson)
+          user_object_class: inetOrgPerson
+
+    # Groups service - connect to IDM's internal LDAP
+    groups:
+      drivers:
+        ldap:
+          uri: ldap://localhost:9125
+          base_dn: o=libregraph-idm
+          insecure: true
+          bind_dn: uid=reva,ou=sysusers,o=libregraph-idm
+          bind_password: ${OC_IDM_REVA_PASSWORD}
+          group_base_dn: ou=groups,o=libregraph-idm
+          group_filter: (objectClass=groupOfNames)
+          group_object_class: groupOfNames
+
     # IDM service user passwords (required when IDM is enabled and /etc/opencloud is read-only)
     idm:
       service_user_passwords: