diff --git a/conf/defaults.ini b/conf/defaults.ini
index 9c720cff3f3..afa742fc4fc 100644
--- a/conf/defaults.ini
+++ b/conf/defaults.ini
@@ -363,6 +363,9 @@ enabled = false
 config_file = /etc/grafana/ldap.toml
 allow_sign_up = true
 
+# LDAP backround sync (Enterprise only)
+sync_cron = @hourly
+
 #################################### SMTP / Emailing #####################
 [smtp]
 enabled = false
diff --git a/devenv/docker/blocks/openldap/notes.md b/devenv/docker/blocks/openldap/notes.md
index d52e6bc6b6d..fb413085970 100644
--- a/devenv/docker/blocks/openldap/notes.md
+++ b/devenv/docker/blocks/openldap/notes.md
@@ -39,7 +39,5 @@ frontend
   ldap-daniel
 editors
   ldap-editors
-
-
 no groups
   ldap-viewer
diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go
index de3862cedc3..2aab0001182 100644
--- a/pkg/setting/setting.go
+++ b/pkg/setting/setting.go
@@ -166,6 +166,7 @@ var (
 	// LDAP
 	LdapEnabled     bool
 	LdapConfigFile  string
+	LdapSyncCron    string
 	LdapAllowSignup = true
 
 	// QUOTA
@@ -877,14 +878,6 @@ func (cfg *Cfg) Load(args *CommandLineArgs) error {
 		return err
 	}
 
-	ldapSec := iniFile.Section("auth.ldap")
-	LdapEnabled = ldapSec.Key("enabled").MustBool(false)
-	LdapConfigFile, err = valueAsString(ldapSec, "config_file", "")
-	if err != nil {
-		return err
-	}
-	LdapAllowSignup = ldapSec.Key("allow_sign_up").MustBool(true)
-
 	alerting := iniFile.Section("alerting")
 	AlertingEnabled = alerting.Key("enabled").MustBool(true)
 	ExecuteAlerts = alerting.Key("execute_alerts").MustBool(true)
@@ -917,6 +910,7 @@ func (cfg *Cfg) Load(args *CommandLineArgs) error {
 		cfg.PluginsEnableAlpha = true
 	}
 
+	cfg.readLDAPConfig()
 	cfg.readSessionConfig()
 	cfg.readSmtpSettings()
 	cfg.readQuotaSettings()
@@ -981,6 +975,14 @@ type RemoteCacheOptions struct {
 	ConnStr string
 }
 
+func (cfg *Cfg) readLDAPConfig() {
+	ldapSec := cfg.Raw.Section("auth.ldap")
+	LdapEnabled = ldapSec.Key("enabled").MustBool(false)
+	LdapConfigFile = ldapSec.Key("config_file").String()
+	LdapAllowSignup = ldapSec.Key("allow_sign_up").MustBool(true)
+	LdapSyncCron = ldapSec.Key("sync_cron").String()
+}
+
 func (cfg *Cfg) readSessionConfig() {
 	sec, _ := cfg.Raw.GetSection("session")