Entra ID memberOf retirement: dynamic groups that use it freeze on November 3
Microsoft ends the public preview of the memberOf rule operator in Entra ID on Tuesday, November 3, and dynamic groups that still rely on it will stop updating. Nothing gets deleted, but membership freezes in place, so people who join or leave a team can end up with the wrong access, licenses and policies until an admin fixes the rule.
What memberOf did
The memberOf operator let admins build a dynamic group from the members of other groups. A rule such as user.memberof -any (group.objectId -in ['groupId']) pulled in the direct members of the listed source groups. Microsoft pitched it as a way for apps that couldn't read group-based membership to see the full list, and admins could also use these groups for license assignment.
It never left preview. Microsoft's documentation says the feature should be used only in test environments, and it requires a Microsoft Entra ID P1 or P2 license.
What happens after November 3
Microsoft says three kinds of configuration are affected:
- dynamic membership groups;
- dynamic administrative units;
- entitlement management auto-assignment policies.
After the deadline, any of these that still use memberOf "stop updating and remain in their last known state," according to Microsoft. The company warns this can cause stale access and enforcement gaps, and it lists outdated Teams and SharePoint access, Conditional Access targeting, group-based licensing and access package assignments as examples.
The risk is that nothing visibly breaks. A new hire may never get the license or access the group was meant to grant, and someone who left a team may keep access they should have lost.
Why Microsoft is pulling it
Microsoft says it saw memberOf slow down dynamic membership processing for all groups in a tenant during the preview. It says it is still working on an alternative that can scale but hasn't given a date for it.
Microsoft first announced the retirement in a Message Center post in August, and Microsoft sent a final reminder on October 28. Office 365 for IT Pros reported on October 30 that another notice, MC1488839, extends the retirement deadline to March 31, 2027, for tenants with Microsoft Entra ID Governance licenses. If your tenant doesn't have that notice in its Message Center, plan for November 3.
What it means for you
This matters to anyone who manages a Microsoft 365 or Entra tenant, including small businesses with a single part-time admin. If your tenant has no memberOf rules, you have nothing to do. If you're not sure, check today.
Microsoft's migration steps are:
- Dynamic groups: export them from the Microsoft Entra admin center and look for rules that contain memberOf. Replace memberOf with supported rule operators, or convert the group to assigned membership, then confirm the membership looks right.
- Dynamic administrative units: use Microsoft Graph PowerShell to find the ones with memberOf rules. Replace the rule or switch to assigned membership, then check both membership and admin scope.
- Auto-assignment policies: use Microsoft Graph PowerShell to find policies that use memberOf. Switch to attribute-based rules where possible, or plan another way to assign access.
Microsoft says groups that are no longer needed can be paused or deleted, and administrative units that are no longer needed can be deleted. Converting a group to assigned membership is the quickest fix, but someone then has to add and remove members by hand, so a rule based on user attributes such as department is the better long-term replacement where one fits.