The End of the memberOf Operator in Entra ID Dynamic Groups: Find and Remediate Impacted Objects

Microsoft has announced the retirement of the memberOf rule operator for dynamic groups in Microsoft Entra ID. Organizations using this feature should begin assessing their environment immediately and identify all dependent configurations across Entra ID, Microsoft Intune, and related services.

What is changing?

The memberOf operator was introduced as a public preview feature that allowed administrators to create dynamic user or device groups based on the direct membership of other groups.

user.memberOf -any (group.objectId -in ['GroupID'])

This enabled scenarios such as:

Microsoft has now confirmed that the public preview is ending. After 3 November 2026, dynamic groups, dynamic administrative units, and entitlement management auto-assignment policies using the memberOf operator will stop updating and remain in their last known state. This can result in stale memberships, outdated access permissions, licensing inconsistencies, and incorrect policy targeting.

According to Microsoft, the underlying reason is that the memberOf operator can negatively affect the scalability and performance of dynamic membership processing across a tenant.

Why this matters

Many organizations use Entra ID groups as the foundation for:

Once memberOf processing stops, memberships will no longer reflect changes in the source groups. Users may retain access they should have lost, while new users may never receive the access, licenses, or policies they require.