diff --git a/modules/services/nextcloud-server.nix b/modules/services/nextcloud-server.nix
index 1a9d9c3..0196c49 100644
--- a/modules/services/nextcloud-server.nix
+++ b/modules/services/nextcloud-server.nix
@@ -498,7 +498,12 @@ in
 
                 adminGroup = lib.mkOption {
                   type = lib.types.str;
-                  description = "Group admins must belong to to be able to login to Nextcloud.";
+                  description = ''
+                    Group admins must belong to to be able to login to Nextcloud.
+
+                    This option is purposely not inside the LDAP app because only SSO allows
+                    distinguising between users and admins.
+                  '';
                   default = "nextcloud_admin";
                 };
 
@@ -1167,7 +1172,10 @@ in
               groups = "groups";
               is_admin = "is_nextcloud_admin";
             };
-            oidc_login_allowed_groups = [ cfg.apps.ldap.userGroup ];
+            oidc_login_allowed_groups = [
+              cfg.apps.ldap.userGroup
+              cfg.apps.sso.adminGroup
+            ];
             oidc_login_default_group = "oidc";
             oidc_login_use_external_storage = false;
             oidc_login_scope = lib.concatStringsSep " " scopes;
diff --git a/modules/services/nextcloud-server/docs/default.md b/modules/services/nextcloud-server/docs/default.md
index 57760e9..eae2c71 100644
--- a/modules/services/nextcloud-server/docs/default.md
+++ b/modules/services/nextcloud-server/docs/default.md
@@ -11,8 +11,10 @@ It is based on the nixpkgs Nextcloud server and provides opinionated defaults.
   to configure those with the UI.
   - [LDAP](#services-nextcloudserver-usage-ldap) app:
     enables app and sets up integration with an existing LDAP server, in this case LLDAP.
+    Note that the LDAP app cannot distinguish between normal users and admin users.
   - [SSO](#services-nextcloudserver-usage-oidc) app:
     enables app and sets up integration with an existing SSO server, in this case Authelia.
+    The SSO app can distinguish between normal users and admin users.
   - [Preview Generator](#services-nextcloudserver-usage-previewgenerator) app:
     enables app and sets up required cron job.
   - [External Storage](#services-nextcloudserver-usage-externalstorage) app:
diff --git a/test/services/nextcloud.nix b/test/services/nextcloud.nix
index e13b51f..8fbb3c3 100644
--- a/test/services/nextcloud.nix
+++ b/test/services/nextcloud.nix
@@ -212,22 +212,6 @@ let
               "expect(page.get_by_text('Wrong login or password')).to_be_visible()"
             ];
           }
-          {
-            username = "bob";
-            password = "BobPassword";
-            nextPageExpect = [
-              "expect(page.get_by_text('Wrong login or password')).not_to_be_visible()"
-              "expect(page.get_by_role('button', name=re.compile('[Ll]og [Ii]n'))).not_to_be_visible()"
-              "expect(page).to_have_title(re.compile('Dashboard'))"
-            ];
-          }
-          {
-            username = "bob";
-            password = "NotBobPassword";
-            nextPageExpect = [
-              "expect(page.get_by_text('Wrong login or password')).to_be_visible()"
-            ];
-          }
         ];
       };
     };