LDAP device management payload settings for Apple devices
You can configure LDAP settings to enable corporate directory services for users of an iPhone, iPad, Shared iPad, Mac, or Apple Vision Pro that enrolls in a device management service. Use the LDAP payload to enter settings for connecting to an LDAPv3 directory.
Note: LDAP connections don’t initiate a VPN connection; if the VPN hasn’t been established by another app, such as Safari, the LDAP lookup fails.
The LDAP payload supports the following. For more information, see Payload information.
Supported payload identifier: com.apple.ldap.account
Supported operating systems and channels: iOS, iPadOS, Shared iPad user, macOS user, visionOS 1.1.
Supported enrollment methods: User Enrollment, Device Enrollment, Automated Device Enrollment.
Duplicates allowed: True—more than one LDAP payload can be delivered to a user or device.
You can use the settings in the table below with the LDAP payload.
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Account description | The display name for the account. | No | |||||||||
Hostname | The IP address or fully qualified domain name (FQDN) of the LDAP server. | Yes | |||||||||
Account user name | The user name for the LDAP account. | No | |||||||||
Account password | The password of the LDAP account. If you leave this field empty, users need to enter their password after the payload is installed on the device. | No | |||||||||
Use SSL | When the Use SSL option is selected and the server’s SSL certificate isn’t issued by a trusted certificate authority known to the devices, use the Certificates payload to add any root or intermediate certificates that are necessary to validate the server’s SSL certificate. | No | |||||||||
Search settings | Define the scope and search base for your LDAP server. | No | |||||||||
Note: Each device management service developer implements these settings differently. To learn how various LDAP settings are applied to your devices and users, consult your developer’s device management service documentation.