Configure a soft-delete policy and global configuration, as shown in Configuring Soft Deletes as a Global Configuration.
  1. Create a connection criteria using dsconfig and name it Internal Applications.

    In the following example the soft delete connection criteria is configured for a member of a line of business (LOB) applications group connecting from the 10.8.1.0 network.

    $ bin/dsconfig create-connection-criteria \             
  --criteria-name "Internal Applications" \             
  --type simple \             
  --set included-client-address:10.8.1.0/8 \  
  --set "all-included-user-group-dn:cn=LOB Applications,ou=Groups,dc=example,dc=com"
  2. Set the auto-soft-delete-connection-criteria property to the soft-delete connection criteria you created in step 1. 
    $ bin/dsconfig set-soft-delete-policy-prop \
  --policy-name default-soft-delete-policy \ 
  --set "auto-soft-delete-connection-criteria:Internal Applications"