Microsoft Entra ID to Retire the memberOf Operator for Dynamic Groups on November 3, 2026

On November 3, 2026, Microsoft Entra ID will stop processing dynamic membership rules that rely on the memberOf operator. After more than four years in public preview, Microsoft has made the surprising decision to retire this feature before it ever reaches general availability. Here is what you need to know.

Four years in preview, but never GA

This Microsoft announcement was published in the Microsoft 365 Message Center under reference MC1448379. The information has also been added to the Microsoft Learn documentation, which now displays a warning. Microsoft considers this a major change, because even though the feature has been in public preview for 4 years, it was widely used.

As a reminder, memberOf was introduced in public preview on June 6, 2022. At the time, it was the long-awaited answer to the lack of nested groups in the cloud. A rule based on this criterion made it possible to build a dynamic group from the direct members of other groups, including groups synchronized from an on-premises Active Directory. In practice, unlike classic nested security groups, a memberOf group returns a flat list of members that can be used for license assignment and application targeting.

It is practical, and it is the solution many companies chose in production: everyone assumed this feature would eventually become generally available. Yet it never left preview... Microsoft explains: "During preview, Microsoft observed that using MemberOf can affect dynamic membership processing at tenant scale, even if you only have one MemberOf rule operator in your tenant. Due to this limitation, it is not recommended for production use and will be retired."

What Microsoft is telling us is that a single rule of this type was enough to slow down the evaluation of all dynamic groups in the Microsoft 365 tenant. That did not stop Microsoft from setting a fairly high limit: up to 500 memberOf groups per tenant.

Everything will freeze

What will happen starting November 3, 2026? First, know that the objects will not be deleted. The rules will remain in place, but background processing will stop. However, as Microsoft explains, this will not be without consequences:

• Access to Teams and SharePoint associated with Microsoft 365 groups becomes stale: new members do not receive their rights, and removed members keep theirs. This makes sense since the groups are no longer synchronized... They become static and effectively frozen.
• Conditional Access policies no longer reflect the actual membership of users and devices.
• Group-based license assignment stops working properly, resulting in users without licenses or with too many licenses assigned.
• Membership and scope for dynamic administrative units become stale.

"If no action is taken, configurations using the MemberOf operator will stop updating after November 3, 2026. Membership and assignment data will remain in their last known state, which can lead to stale access and enforcement gaps.", Microsoft notes. In short, it is broken, and you will have no choice but to do it differently.

Audit your tenant before November 3

There is no equivalent replacement. Microsoft says it wants to provide an alternative solution "with the appropriate level of scalability and reliability", but there is no indication of when that might be available. So, you will have to live without it... unless Microsoft pulls something out of the hat before November 3, 2026.

In its message, Microsoft recommends the following audit:

• For dynamic groups: export the list from the Entra admin center, identify rules containing memberOf, then replace them with supported operators or switch the group to assigned membership.
• For dynamic administrative units: identify them using Microsoft Graph (in PowerShell), then replace the logic or convert the unit to assigned membership.
• For Entitlement Management: Microsoft provides a read-only script that scans automatic assignment policies and exports to CSV those whose rule contains memberOf.

In all cases, action is required. If you leave the configuration as it is, the real risk is keeping a rule in place and discovering six months later that a former contractor never lost access....

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio