diff --git a/changelog/unreleased/add-debug-to-idm.md b/changelog/unreleased/add-debug-to-idm.md
new file mode 100644
index 00000000000..c0213554f11
--- /dev/null
+++ b/changelog/unreleased/add-debug-to-idm.md
@@ -0,0 +1,6 @@
+Enhancement: Add debug server to idm
+
+We added a debug server to idm.
+
+https://github.com/owncloud/ocis/pull/6153
+https://github.com/owncloud/ocis/issues/5003
\ No newline at end of file
diff --git a/services/idm/pkg/command/server.go b/services/idm/pkg/command/server.go
index 9982847ba7c..4ba21b2a8ed 100644
--- a/services/idm/pkg/command/server.go
+++ b/services/idm/pkg/command/server.go
@@ -13,9 +13,13 @@ import (
 	"github.com/libregraph/idm/pkg/ldappassword"
 	"github.com/libregraph/idm/pkg/ldbbolt"
 	"github.com/libregraph/idm/server"
+	"github.com/oklog/run"
 	"github.com/owncloud/ocis/v2/ocis-pkg/config/configlog"
 	pkgcrypto "github.com/owncloud/ocis/v2/ocis-pkg/crypto"
+	"github.com/owncloud/ocis/v2/ocis-pkg/handlers"
 	"github.com/owncloud/ocis/v2/ocis-pkg/log"
+	"github.com/owncloud/ocis/v2/ocis-pkg/service/debug"
+	"github.com/owncloud/ocis/v2/ocis-pkg/version"
 	"github.com/owncloud/ocis/v2/services/idm"
 	"github.com/owncloud/ocis/v2/services/idm/pkg/config"
 	"github.com/owncloud/ocis/v2/services/idm/pkg/config/parser"
@@ -33,51 +37,90 @@ func Server(cfg *config.Config) *cli.Command {
 			return configlog.ReturnFatal(parser.ParseConfig(cfg))
 		},
 		Action: func(c *cli.Context) error {
-			logger := logging.Configure(cfg.Service.Name, cfg.Log)
-			ctx, cancel := func() (context.Context, context.CancelFunc) {
-				if cfg.Context == nil {
-					return context.WithCancel(context.Background())
-				}
-				return context.WithCancel(cfg.Context)
-			}()
+			var (
+				gr          = run.Group{}
+				logger      = logging.Configure(cfg.Service.Name, cfg.Log)
+				ctx, cancel = func() (context.Context, context.CancelFunc) {
+					if cfg.Context == nil {
+						return context.WithCancel(context.Background())
+					}
+					return context.WithCancel(cfg.Context)
+				}()
+			)
 
 			defer cancel()
-			return start(ctx, logger, cfg)
-		},
-	}
-}
 
-func start(ctx context.Context, logger log.Logger, cfg *config.Config) error {
-	servercfg := server.Config{
-		Logger:          log.LogrusWrap(logger.Logger),
-		LDAPHandler:     "boltdb",
-		LDAPSListenAddr: cfg.IDM.LDAPSAddr,
-		TLSCertFile:     cfg.IDM.Cert,
-		TLSKeyFile:      cfg.IDM.Key,
-		LDAPBaseDN:      "o=libregraph-idm",
-		LDAPAdminDN:     "uid=libregraph,ou=sysusers,o=libregraph-idm",
-
-		BoltDBFile: cfg.IDM.DatabasePath,
-	}
+			{
+				servercfg := server.Config{
+					Logger:          log.LogrusWrap(logger.Logger),
+					LDAPHandler:     "boltdb",
+					LDAPSListenAddr: cfg.IDM.LDAPSAddr,
+					TLSCertFile:     cfg.IDM.Cert,
+					TLSKeyFile:      cfg.IDM.Key,
+					LDAPBaseDN:      "o=libregraph-idm",
+					LDAPAdminDN:     "uid=libregraph,ou=sysusers,o=libregraph-idm",
+
+					BoltDBFile: cfg.IDM.DatabasePath,
+				}
 
-	if cfg.IDM.LDAPSAddr != "" {
-		// Generate a self-signing cert if no certificate is present
-		if err := pkgcrypto.GenCert(cfg.IDM.Cert, cfg.IDM.Key, logger); err != nil {
-			logger.Fatal().Err(err).Msgf("Could not generate test-certificate")
-		}
-	}
-	if _, err := os.Stat(servercfg.BoltDBFile); errors.Is(err, os.ErrNotExist) {
-		logger.Debug().Msg("Bootstrapping IDM database")
-		if err = bootstrap(logger, cfg, servercfg); err != nil {
-			logger.Error().Err(err).Msg("failed to bootstrap idm database")
-		}
-	}
+				if cfg.IDM.LDAPSAddr != "" {
+					// Generate a self-signing cert if no certificate is present
+					if err := pkgcrypto.GenCert(cfg.IDM.Cert, cfg.IDM.Key, logger); err != nil {
+						logger.Fatal().Err(err).Msgf("Could not generate test-certificate")
+					}
+				}
+				if _, err := os.Stat(servercfg.BoltDBFile); errors.Is(err, os.ErrNotExist) {
+					logger.Debug().Msg("Bootstrapping IDM database")
+					if err = bootstrap(logger, cfg, servercfg); err != nil {
+						logger.Error().Err(err).Msg("failed to bootstrap idm database")
+					}
+				}
 
-	svc, err := server.NewServer(&servercfg)
-	if err != nil {
-		return err
+				svc, err := server.NewServer(&servercfg)
+				if err != nil {
+					return err
+				}
+
+				gr.Add(func() error {
+					err := make(chan error)
+					select {
+					case <-ctx.Done():
+						return nil
+
+					case err <- svc.Serve(ctx):
+						return <-err
+					}
+				}, func(err error) {
+					logger.Error().
+						Err(err).
+						Msg("Shutting down server")
+					cancel()
+				})
+			}
+
+			{
+				server := debug.NewService(
+					debug.Logger(logger),
+					debug.Name(cfg.Service.Name),
+					debug.Version(version.GetString()),
+					debug.Address(cfg.Debug.Addr),
+					debug.Token(cfg.Debug.Token),
+					debug.Pprof(cfg.Debug.Pprof),
+					debug.Zpages(cfg.Debug.Zpages),
+					debug.Health(handlers.Health),
+					debug.Ready(handlers.Ready),
+				)
+
+				gr.Add(server.ListenAndServe, func(_ error) {
+					_ = server.Shutdown(ctx)
+					cancel()
+				})
+			}
+
+			return gr.Run()
+			//return start(ctx, logger, cfg)
+		},
 	}
-	return svc.Serve(ctx)
 }
 
 func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) error {
diff --git a/services/idm/pkg/config/defaults/defaultconfig.go b/services/idm/pkg/config/defaults/defaultconfig.go
index 2a977b354e2..93e77da153f 100644
--- a/services/idm/pkg/config/defaults/defaultconfig.go
+++ b/services/idm/pkg/config/defaults/defaultconfig.go
@@ -19,7 +19,10 @@ func FullDefaultConfig() *config.Config {
 func DefaultConfig() *config.Config {
 	return &config.Config{
 		Debug: config.Debug{
-			Addr: "127.0.0.1:9239",
+			Addr:   "127.0.0.1:9239",
+			Token:  "",
+			Pprof:  false,
+			Zpages: false,
 		},
 		Service: config.Service{
 			Name: "idm",