Entra ID MemberOf Dynamic Group Rule Operator Retirement: What Breaks on November 3

Entra ID MemberOf Dynamic Group Rule Operator Retirement: What It Is

Microsoft's Entra ID memberOf dynamic group rule operator retirement lands on November 3, 2026 — after that date, any configuration still using it stops updating. memberOf is a dynamic-membership rule operator, shipped in public preview, that lets a dynamic group, dynamic administrative unit, or entitlement management auto-assignment policy populate itself from the members of other groups. Instead of writing per-attribute rules (department, job title, extension attributes), an admin could point a dynamic group at up to 50 "source" security groups, Microsoft 365 groups, or on-premises-synced groups and have Entra ID pull in their direct members automatically.

On August 5, 2026, Microsoft published Message Center post MC1448379, announcing that the memberOf preview is ending. According to the official Microsoft Learn documentation, after November 3, 2026, any dynamic membership group, dynamic administrative unit, or entitlement management auto-assignment policy that still uses memberOf stops updating and freezes in its last known state. Microsoft has framed this as a scale and reliability limitation, not a security fix — but the operational fallout hits identity teams the same way a bug would: silently and on a deadline. It's the same "quiet on the surface, broken underneath" pattern we covered when an expired Entra SAML signing certificate broke federated sign-in tenant-wide: the trigger is a Microsoft-side change, but the blast radius depends entirely on whether you tracked your own configuration.

How It Works — and Why Microsoft Is Retiring It

A memberOf rule is written in the Entra dynamic-group advanced rule syntax (it isn't supported in the rule-builder UI — only the raw rule editor):

user.memberof -any (group.objectId -in ['<sourceGroupObjectId>'])

or for device-based dynamic groups:

device.memberof -any (group.objectId -in ['<sourceGroupObjectId>'])

Multiple source groups can be listed in the same rule (-in ['<groupId1>', '<groupId2>']), and the resulting dynamic group can be used for app assignment, Conditional Access targeting, or group-based licensing — anywhere a regular group works.

Per Microsoft's own preview limitations, the feature was always scoped tightly: a tenant-wide cap of 500 dynamic groups using memberOf (counted against the overall 15,000 dynamic-group quota), a 50-source-group limit per rule, direct members only (no transitive nesting — members of a group nested inside a source group don't get pulled in), no chaining one memberOf dynamic group into another, and no combining memberOf with any other rule clause. Microsoft Entra ID Premium P1 or P2 licensing and at least User Administrator were required just to configure it.

The retirement reason, per Microsoft's migration guidance, is scale: using memberOf "can affect dynamic membership processing across a tenant even if you have one memberOf rule operator in your tenant." A single rule could slow down unrelated dynamic-group evaluation tenant-wide — which is why Microsoft explicitly says the operator "isn't recommended for production use," despite real tenants having adopted it in production during the preview.

Microsoft says it is "continuing to develop an alternative solution" with proper scalability, but has not committed to a replacement feature or date — migration guidance right now points to existing rule operators or assigned (static) membership, not a drop-in successor.

Detection: Find Every memberOf Rule Before It Freezes

The risk isn't the retirement itself — it's not knowing which dynamic groups, admin units, and access packages quietly depend on memberOf today. Because the operator was preview-only and never exposed in the rule-builder UI, affected objects can be easy to miss in a routine console review; the reliable way to find them is a targeted Microsoft Graph query. If you don't already run a structured pass over Entra ID configuration, our guide to auditing Microsoft Entra ID security covers the broader review process this detection step fits into.

Example Graph PowerShell, adapted from the migration guidance summarized by office365itpros.com:

Connect-MgGraph -Scopes GroupMember.Read.All

[array]$Groups = Get-MgGroup -Filter "groupTypes/any(c:c eq 'dynamicmembership') and (startsWith(membershipRule,'user.memberOf') or startsWith(membershipRule,'device.memberOf'))" -All

Connect-MgGraph -Scopes AdministrativeUnit.Read.All

[array]$DynamicAdminUnits = Get-MgDirectoryAdministrativeUnit -Filter "membershipType eq 'Dynamic' and (startsWith(membershipRule,'user.memberOf') or startsWith(membershipRule,'device.memberOf'))" -All

$Uri = "https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentPolicies"
$Data = Invoke-MgGraphRequest -Uri $Uri -Method Get -OutputType PsObject | Select-Object -ExpandProperty Value
$Data | Where-Object {$_.automaticRequestSettings}

The last query returns every auto-assignment policy; each result then needs a manual check of its automaticRequestSettings criteria for memberOf-based logic, since the API doesn't expose a direct filter for it.

Remediation: Migrate Before November 3, 2026

Microsoft's own migration guidance breaks this into three tracks:

1. Dynamic membership groups — Export the dynamic groups identified above, replace memberOf with a supported rule operator (attribute-based rules against user or device properties) where the same population can be expressed that way, or convert the group to assigned (static) membership. Validate the resulting group membership matches expectations before removing the old rule.
2. Dynamic administrative units — Same pattern: replace the memberOf-based rule with supported logic, or convert to assigned membership. Because admin units scope delegated administrative permissions, validate both the resulting membership and the administrative scope — a broadened admin unit is a privilege escalation risk in the same family as the standing-Global-Admin exposure we cover in Azure Privileged Access, not just a stale group.
3. Entitlement management auto-assignment policies — Replace memberOf-based criteria with supported attribute-based operators where an equivalent exists. Where it doesn't, Microsoft's guidance is explicit that teams need to plan an alternative assignment method before the cutoff — there's no guaranteed like-for-like replacement.

For every object you touch, validate downstream effects before the deadline, not after: group-based license assignment, Conditional Access targeting, and Teams/SharePoint access via Microsoft 365 groups all read from the same membership that freezes on November 3, 2026. An unlicensed or over-licensed user, or a Conditional Access policy silently excluding a team that grew after the freeze, is the kind of gap that surfaces weeks later during an access review — not on day one.

How EtcSec Detects This

EtcSec flags dynamic groups with overly broad or high-risk membership rules through the AZ_GROUP_DYNAMIC_RULE_BROAD check, which surfaces dynamic-membership configurations — including memberOf-based rules — worth reviewing before they drift out of scope or, as here, stop updating entirely. EtcSec also verifies Entra ID P1/P2 licensing coverage (AZ_NO_P2_LICENSE), since memberOf and most of its supported successors require Premium licensing to configure and maintain.