diff --git a/config/config.php b/config/config.php
index ac439bd..b68f721 100644
--- a/config/config.php
+++ b/config/config.php
@@ -67,6 +67,8 @@ return [
         'script_dir' => __DIR__ . '/../scripts/powershell',
         // Execution policy to pass to the PowerShell invocation
         'execution_policy' => 'Bypass',
+        // Default OU. IIS only has write access there.
+        'default_ou' => 'OU=WebAppUsers,DC=ITFA-PROJ-DOM,DC=local',
         // For testing; if true, the scripts will run in dry-run mode (no real AD changes)
         'dry_run' => false,
     ],