Technology
Microsoft Is Retiring the memberOf Rule for Entra ID Dynamic Groups on November 3, 2026
Microsoft Entra ID dynamic groups, administrative units, and access package policies that use the preview memberOf rule stop updating after November 3, 2026, freezing membership in whatever state it was in. Here is who is affected and how to check.
Microsoft has set a November 3, 2026 deadline to end the public preview of the memberOf rule operator in Microsoft Entra ID, the feature that lets a dynamic group, dynamic administrative unit, or entitlement management access package automatically pull in members of other groups. According to Microsoft's own documentation, "the public preview of the memberOf rule operator is ending," and "after November 3, 2026, dynamic membership groups, dynamic administrative units, and entitlement management auto-assignment policies that use the memberOf operator stop updating and remain in their last known state." Microsoft warns this "can lead to stale access and enforcement gaps, including outdated Teams and SharePoint access, Conditional Access targeting, group-based licensing, and access package assignments."
What a memberOf Rule Actually Does
Most dynamic groups in Entra ID build their membership from a person's own attributes, department, job title, or office location, for example. The memberOf operator works differently: it lets a dynamic group pull in the members of other "source" groups, including security groups, Microsoft 365 groups, and groups synced from an on-premises Active Directory, using a rule such as `user.memberof -any (group.objectId -in ['groupId'])`. That makes it useful for consolidating membership across groups that already exist for other reasons, rather than rebuilding the same logic with attribute rules. Even before this retirement, the sync only ever ran one way: Microsoft's own preview-limitations notice states that "membership of a memberOf dynamic group doesn't automatically update when a child group is deleted or when members are removed from a child group," and that "the affected users or devices remain members of the memberOf dynamic group until the rule is modified." A new member added to a source group flows through automatically; someone removed from a source group has never been dropped automatically and requires editing the rule by hand.
Why Microsoft Is Ending It, Not Just Changing It
Microsoft's documentation is direct about the reason: "during preview, we observed that using memberOf can slow dynamic membership processing for all groups in a tenant," adding that "memberOf is a preview operator and isn't recommended for production use." In other words, even a single group in a tenant using this rule could affect how quickly every other dynamic group's membership updates, which is why Microsoft is pulling it back rather than shipping a fix. The company says it is "continuing to develop an alternative solution that meets these needs with the right level of scalability and reliability," but has not given a timeline for that replacement.
Who Is Affected
This reaches further than one feature. Microsoft names three places memberOf rules can appear: dynamic membership groups, dynamic administrative units, and entitlement management auto-assignment policies (the rules that automatically hand out access packages). Any of the three can quietly go stale after November 3. Because memberOf groups can be built from security groups, Microsoft 365 groups, or on-premises Active Directory groups, an organization does not need to have deliberately built an elaborate identity system to be exposed; a single dynamic group set up to combine membership from two or three existing groups, perhaps for a shared mailbox, a Teams channel, a software license assignment, or a security group feeding a Conditional Access policy, is enough.
What to Check Right Now
Microsoft's guidance gives a concrete starting point for each of the three affected areas. For dynamic groups, export the list from the Microsoft Entra admin center and search the membership rules for "memberOf." For dynamic administrative units and entitlement management auto-assignment policies, Microsoft recommends using Microsoft Graph PowerShell to identify any that reference the operator, since neither surface lists them as plainly in the admin center. Wherever a memberOf rule turns up, Microsoft's documentation directs admins to "replace memberOf with supported rule operators, or convert the group to assigned membership," and to validate membership again after the change. If no equivalent attribute-based rule exists for a given use case, Microsoft's guidance is to plan an alternative assignment method before the cutoff rather than leave the rule in place to freeze.
Why a Frozen Group Is Worse Than an Obviously Broken One
A membership rule that stops updating does not throw an error or send an alert. It simply stops changing, which is exactly what makes it risky: the group looks normal, and nothing in the user interface flags that its membership is now out of date. Removals from a source group already required a manual rule edit to take effect, as the preview limitation above describes, but additions have flowed through automatically until now; after November 3, even that stops, so a new hire added to a source group will not show up in the dependent memberOf group either. Because these groups are the kind organizations put behind Conditional Access policies, Microsoft 365 group-based licensing, and access package assignments, a frozen rule can leave a departed employee's access sitting untouched, or leave a new hire missing access that colleagues in the same role already have, exactly as it could before November 3, only now with no automatic update ever arriving to narrow that gap. For a business tracking its own identity and access controls, whether for a cyber insurance application, an FTC Safeguards Rule risk assessment, or a HIPAA security analysis, an access-control mechanism that has silently stopped reflecting reality is precisely the kind of gap those reviews are meant to catch before an auditor or an incident finds it first.
If your organization or IT provider has set up dynamic groups, administrative units, or access packages in Microsoft Entra ID, it is worth confirming before November 3 whether any of them rely on memberOf. Cyber One Solutions can review your Entra ID group and access configuration as part of our managed cloud service, which handles Microsoft 365 and Entra ID administration on an ongoing basis, or through a standalone IT assessment if you manage identity in-house and want a second set of eyes before the deadline. If you are already reviewing how identity changes flow into Microsoft 365, our recent coverage of the Entra Connect Sync upgrade deadline covers a related identity-pipeline risk worth checking at the same time.