If your Dynamic Groups, administrative units, or entitlement management policies use the memberOf operator, the clock is running out. Microsoft is retiring it on November 3, 2026, and rules built on it will stop recalculating membership entirely.
What memberOf Property Does in Dynamic Groups
memberOf lets a Dynamic Group pull its membership from another group, useful when your logic depends on nested group membership rather than direct user attributes. It never left preview, but plenty of tenants run it in production anyway.
What Breaks After memberOf Retirement in Entra?
A rule like “Add users who are members of Sales” simply stops updating. The group freezes at its last known state, silently.
- New hires don’t get added
- Role changes don’t reflect
- Departed employees retain access
- Conditional Access goes stale
- Group-based licensing stops reconciling
How to Migrate Dynamic Groups from memberOf Property?
- Audit tenant-wide
memberOfusage via Graph PowerShell or Entra Admin Center. - Rebuild rules using direct attributes like department or jobTitle.
- Validate every affected group before the deadline.