LDAP MDM payload settings for Apple devices
You can configure LDAP settings to enable corporate directory services for users of an iPhone, iPad, Shared iPad, Mac or Apple Vision Pro enrolled in a mobile device management (MDM) solution. Use the LDAP payload to enter settings for connecting to an LDAPv3 directory.
Note: LDAP connections don’t initiate a VPN connection; if the VPN hasn’t been established by another app, such as Safari, the LDAP lookup fails.
The LDAP payload supports the following. For more information, see Payload information.
Supported payload identifier: com.apple.ldap.account
Supported operating systems and channels: iOS, iPadOS, Shared iPad user, macOS user, visionOS 1.1.
Supported enrolment methods: User Enrolment, Device Enrolment, Automated Device Enrolment.
Duplicates allowed: True — more than one LDAP payload can be delivered to a user or device.
You can use the settings in the table below with the LDAP payload.
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Account description | The display name for the account. | No | |||||||||
Hostname | The IP address or fully qualified domain name (FQDN) of the LDAP server. | Yes | |||||||||
Account username | The username for the LDAP account. | No | |||||||||
Account password | The password of the LDAP account. If you leave this field empty, users must enter their password after the payload is installed on the device. | No | |||||||||
Use SSL | When the Use SSL option is selected and the server’s SSL certificate isn’t issued by a trusted certificate authority known to the devices, use the Certificates payload to add any root or intermediate certificates that are necessary to validate the server’s SSL certificate. | No | |||||||||
Search settings | Define the scope and search base for your LDAP server. | No | |||||||||
Note: Each MDM vendor implements these settings differently. To learn how various LDAP settings are applied to your devices and users, consult your MDM vendor’s documentation.