Can APM ActiveDirectory AAA server use port 636, or StartTLS on 389?

I've noticed that when I set up management/administration of an F5, and I can allow remote active directory users to log in, and I can select whether they use port 389 (cleartext LDAP), port 636 (LDAP with SSL encryption), or port 389 with StartTLS (LDAP with TLS encryption).

When it comes to APM though, I don't see that option when configuring an Active Directory AAA server. When I take network captures, I see port 389 being used for the AD Query objects in my VPE. Now I'm not an expert in the LDAP protocol, and maybe within port 389 APM is using the StartTLS command (does anyone know if that is the case?), but if not, does anyone know how to set up the ActiveDirectory AAA server in APM to use encryption when communicating with Active Directory?

Note: When it comes to encryption I would prefer port 389 with the StartTLS command, since TLS is more secure than SSL on port 636. But either would be preferable to 389 plaintext.

F5 Version: 12.1.2