diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml
index 48b0883..03bd909 100644
--- a/apps/opencloud/opencloud-configmap.yaml
+++ b/apps/opencloud/opencloud-configmap.yaml
@@ -8,18 +8,7 @@ data:
   opencloud.yaml: |
     # OpenCloud Minimal Configuration
     # Only non-default settings - environment variables override these
-
-    # Graph service - external OpenLDAP configuration
-    graph:
-      identity:
-        ldap:
-          uri: ldap://openldap.opencloud.svc.cluster.local:389
-          base_dn: dc=basicstack,dc=de
-          bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
-          user_base_dn: ou=users,dc=basicstack,dc=de
-          group_base_dn: ou=groups,dc=basicstack,dc=de
-          insecure: true
+    # Using built-in IDM for user/group storage instead of external OpenLDAP
 
     # Proxy service - OIDC configuration (already in env vars, kept for reference)
     proxy:
@@ -30,32 +19,6 @@ data:
         user_oidc_claim: preferred_username
       enable_basic_auth: false
 
-    # Users service - external LDAP
-    users:
-      drivers:
-        ldap:
-          uri: ldap://openldap.opencloud.svc.cluster.local:389
-          base_dn: dc=basicstack,dc=de
-          bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
-          user_base_dn: ou=users,dc=basicstack,dc=de
-          user_filter: (objectClass=inetOrgPerson)
-          user_object_class: inetOrgPerson
-          insecure: true
-
-    # Groups service - external LDAP
-    groups:
-      drivers:
-        ldap:
-          uri: ldap://openldap.opencloud.svc.cluster.local:389
-          base_dn: dc=basicstack,dc=de
-          bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
-          group_base_dn: ou=groups,dc=basicstack,dc=de
-          group_filter: (objectClass=groupOfNames)
-          group_object_class: groupOfNames
-          insecure: true
-
     # IDM service user passwords (required when IDM is enabled and /etc/opencloud is read-only)
     idm:
       service_user_passwords:
diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml
index ff17801..54baa9b 100644
--- a/apps/opencloud/opencloud-deployment.yaml
+++ b/apps/opencloud/opencloud-deployment.yaml
@@ -99,9 +99,10 @@ spec:
         - name: PROXY_TLS
           value: "false"
 
-        # Exclude: search (broken), idp (using Pocket ID), idm (using external OpenLDAP), auth-basic (OIDC-only)
+        # Exclude: search (broken), idp (using Pocket ID), auth-basic (OIDC-only)
+        # IDM is now enabled to use built-in user/group storage instead of external OpenLDAP
         - name: OC_EXCLUDE_RUN_SERVICES
-          value: "search,idp,idm,auth-basic"
+          value: "search,idp,auth-basic"
 
         # Data paths
         - name: OPENCLOUD_BASE_DATA_PATH