Entra ID memberOf dynamic rules stop updating after November 3, 2026

The memberOf rule operator lets a dynamic group or a dynamic administrative unit take the members of other groups, with a rule such as user.memberof -any (group.objectId -in ['<group-id>']). It never left public preview, and Microsoft is now retiring it.

Microsoft announced the end in MC1448379 (August 5, 2026), then sent two reminders, MC1488834 and MC1529463. During the preview, Microsoft saw that a single memberOf rule can slow dynamic membership processing for the whole tenant.

What changes after November 3, 2026

Three kinds of objects that use memberOf stop updating and stay in their last known state:

• dynamic membership groups
• dynamic administrative units, membership and administrative scope included
• entitlement management auto-assignment policies

New users may not get the access or licenses they need. Users who left a source group may keep access, licenses or Conditional Access targeting they should have lost.

Tenants with Microsoft Entra ID Governance received a different message, MC1488839. For them, existing memberOf configurations keep working until March 31, 2027. Microsoft plans a replacement capability in Entra ID Governance for late 2026 and will migrate the remaining configurations automatically by that date.

Find the affected groups and administrative units

With PS365 (PowerShell 7 or later):

Install-PSResource PS365 -Scope CurrentUser
Import-Module PS365
Connect-MgGraph -NoWelcome -Scopes 'Group.Read.All', 'AdministrativeUnit.Read.All'
Get-DynamicGroup -DeprecatedMemberOfRuleOnly
Get-MgDynamicAdminUnit -DeprecatedMemberOfRuleOnly

Get-DynamicGroup returns the dynamic groups whose rule uses memberOf. Get-MgDynamicAdminUnit does the same for dynamic administrative units, and lists the IDs of the groups the rule reads in SourceGroupIds. Add -ExportToExcel to either command to get a workbook.

PS365 does not check access package auto-assignment policies. Review them in ID Governance > Entitlement management > Access packages, in the policies of each package.

In 365Boost

365Boost, my browser extension for Microsoft 365 admins, flags the dynamic groups that use memberOf in Hub > Dynamic Groups.

Its Deprecated features report lists the dynamic groups, the dynamic administrative units and the access package policies that still use memberOf in one table, with the source groups of each rule.

What to do with them

• Replace memberOf with supported rule operators where an attribute can carry the same logic. See Create simpler, more efficient rules for dynamic membership groups.
• Otherwise, convert the group or the administrative unit to assigned membership and add the members of the source groups. For administrative units, SourceGroupIds lists them.
• Check the membership afterwards. For an administrative unit, check the administrative scope too.

Sources: MC1448379, MC1488834, MC1529463, MC1488839, Microsoft Learn