Entra MemberOf operator retires November 3, 2026: what frozen dynamic groups mean for your access management

On November 3, 2026, Microsoft permanently retires the MemberOf operator from Entra ID. There is no graceful transition, no automatic migration. Every dynamic group, dynamic administrative unit, or entitlement management policy that contains a MemberOf rule freezes at its current state on that date. Members who should subsequently be added or removed will not be. For organisations using MemberOf in their Conditional Access policies, licence assignment, or Teams access management, this is a deadline that requires concrete action before that date.

What is the MemberOf operator and what is it used for?

A standard dynamic group in Entra ID works on user attributes. You write a rule such as 'user.department -eq "Sales"' and everyone with that attribute falls into the group automatically. That works well for straightforward, attribute-based segmentation.

The MemberOf operator did something structurally different. It made it possible to use group membership itself as a condition: if a user is a member of Group A, automatically add them to Group B. This allowed IT administrators to build layered group logic without manually tracking memberships.

In practice, the operator was used in three places: in dynamic security groups with combined or nested access logic, in dynamic administrative units to assemble subsets of users based on existing group membership, and in auto-assignment policies within Entitlement Management to automatically grant access packages to users already belonging to a specific group.

Why is Microsoft retiring it?

Microsoft's own explanation is straightforward: the operator was too resource-intensive. To determine whether a user belongs in a MemberOf-based group, Entra ID must evaluate not just the user profile but the entire group membership structure. That computation does not scale well and had tenant-wide impact on dynamic group processing speed, even in tenants with only one or two MemberOf rules.

The response from the IT community has been critical. Many administrators point out that the feature never progressed beyond public preview, that no direct replacement is available, and that the deadline is short given the complexity of some environments. Microsoft acknowledges that the scenarios MemberOf addressed have value and says it is working on a replacement, but no concrete alternative has been made available at this time.

What breaks if you do nothing?

After November 3, 2026, Entra ID stops recalculating membership for groups that contain a MemberOf rule. The group freezes at its current state and is no longer updated.

This has cascading effects on everything built on top of that group. In Conditional Access, a frozen group means new employees who would normally be added automatically are not. They either miss the required access, or they receive more access than intended if the group was designed to restrict. Both outcomes represent a security risk.

For licence assignment via group-based licensing, new employees will not receive licences. Departed employees remain in the group and continue consuming licence seats. This leads to unnecessary costs and users without working Microsoft 365 services.

For Teams channels and SharePoint sites based on a MemberOf group, the same principle applies: incoming colleagues are not added, outgoing employees remain visible and retain access to content they should no longer see.

How do you find affected configurations?

The first step is a complete inventory. In the Microsoft Entra portal, navigate to Groups and filter by membership type 'Dynamic user'. Open each group's membership rule and search for the word 'memberOf'. Any group containing this must be addressed before the deadline.

Via Microsoft Graph or PowerShell with the Microsoft.Graph module, you can automate this. Retrieve all dynamic groups and filter for membership rules containing 'memberOf' — this produces a complete overview without clicking through hundreds of groups manually.

Do not forget dynamic administrative units. These are found in the Entra portal under Identity Governance > Administrative Units. Also check the auto-assignment policies in Entitlement Management, located under Identity Governance > Access Packages > policies per package.

What alternatives are available?

Because Microsoft has not yet released a direct replacement, all available alternatives involve rebuilding the underlying logic.

The first and most scalable option is rewriting to attribute-based rules. In most cases, MemberOf logic can be translated into an attribute rule. If MemberOf was used to combine members of two departments, that can be rewritten as 'user.department -eq "Sales" -or user.department -eq "Marketing"'. This does require that HR systems keep user attributes consistently maintained.

For small, stable user sets, a static group with manual or lifecycle-managed membership is sometimes simpler than a complex dynamic rule. Entra Lifecycle Workflows can take over certain onboarding and offboarding scenarios that were previously handled via MemberOf.

If the MemberOf logic was intended for granting access based on team membership, access packages in Entitlement Management provide a structured alternative. You define access packages with automatic assignment based on user attributes rather than group membership.

What should you do this week?

Three steps to make the deadline manageable. First: inventory. Run an inventory of all dynamic groups, dynamic administrative units, and entitlement management policies in your tenant. Find everything that contains 'memberOf' in the membership rule. Use the portal or PowerShell for a systematic overview.

Second: classify the impact of each item found. What does this group underpin in your access management? Conditional Access? Licence assignment? Teams access? SharePoint? How critical is it if this freezes? The answers determine the order in which you approach the rebuild.

Third: start rebuilding the most critical configurations. Do not wait until October. You have until November 3, 2026, but every MemberOf configuration you replace before that date is a risk you have addressed. After the deadline, you no longer have control over who ends up in the group.

Want support with inventorying MemberOf configurations in your Entra environment, rewriting dynamic group rules, or setting up an Entitlement Management structure as an alternative? Contact Zarioh for a practical, no-obligation conversation.