Entra ID Drops the memberOf Rule Operator for Dynamic Groups and Dynamic Admin Units

Today is the cutoff. MC1529463 (the final reminder after MC1448379) confirms that from November 3, 2026, memberOf rules stop processing. The objects aren't deleted. Membership freezes at its last calculated state.

That is the dangerous part. Nothing errors and the group looks healthy, but Joiner/Mover/Leaver is broken. New hires don't get licences or access, leavers keep them, and Conditional Access targets stale membership. Tenants with Entra ID Governance should check for MC1488839, which extends existing configurations to March 31, 2027. That is time to migrate, not a reason to wait.

Inventory (Microsoft Graph PowerShell). I filter on the client side because rules don't always start with "user.memberOf":

Connect-MgGraph -Scopes "Group.Read.All","AdministrativeUnit.Read.All","EntitlementManagement.Read.All"

Get-MgGroup -All -Filter "groupTypes/any(c:c eq 'DynamicMembership')" -Property Id,DisplayName,MembershipRule,MembershipRuleProcessingState | Where-Object MembershipRule -match 'memberof' | Select-Object DisplayName,Id,MembershipRuleProcessingState

Get-MgDirectoryAdministrativeUnit -All -Property Id,DisplayName,MembershipType,MembershipRule | Where-Object { $.MembershipType -eq 'Dynamic' -and $.MembershipRule -match 'memberof' }

$p = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentPolicies" -OutputType PSObject

$p.value | Where-Object { ($_ | ConvertTo-Json -Depth 10) -match 'memberof' } | Select-Object displayName,id

Migration patterns that work:

Today is the cutoff. MC1529463 (the final reminder after MC1448379) confirms that from November 3, 2026, memberOf rules stop processing. The objects aren't deleted. Membership freezes at its last calculated state.

That is the dangerous part. Nothing errors and the group looks healthy, but Joiner/Mover/Leaver is broken. New hires don't get licences or access, leavers keep them, and Conditional Access targets stale membership. Tenants with Entra ID Governance should check for MC1488839, which extends existing configurations to March 31, 2027. That is time to migrate, not a reason to wait.

Inventory (Microsoft Graph PowerShell). I filter on the client side because rules don't always start with "user.memberOf":

Connect-MgGraph -Scopes "Group.Read.All","AdministrativeUnit.Read.All","EntitlementManagement.Read.All"

Get-MgGroup -All -Filter "groupTypes/any(c:c eq 'DynamicMembership')" -Property Id,DisplayName,MembershipRule,MembershipRuleProcessingState | Where-Object MembershipRule -match 'memberof' | Select-Object DisplayName,Id,MembershipRuleProcessingState

Get-MgDirectoryAdministrativeUnit -All -Property Id,DisplayName,MembershipType,MembershipRule | Where-Object { $_.MembershipType -eq 'Dynamic' -and $_.MembershipRule -match 'memberof' }

$p = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentPolicies" -OutputType PSObject

$p.value | Where-Object { ($_ | ConvertTo-Json -Depth 10) -match 'memberof' } | Select-Object displayName,id

Migration patterns that work:

- Attribute rules. If the source group is a synced AD group, stamp an attribute in AD (department, extensionAttributeX) and use a supported rule such as user.extensionAttribute5 -eq "Finance". This is the most robust option.

- Access packages with auto-assignment based on attributes (Governance), which gives you an audit trail.

- Assigned group plus automation: a Logic App or Azure Automation runbook that syncs members from the source groups. Decide whether you want direct or transitive members, because memberOf only ever used direct members.

- Plain nesting where the target supports it. Conditional Access handles nested groups; group-based licensing and Microsoft 365 groups don't.

Converting a group from dynamic to assigned keeps the current members. Before you switch, compare the frozen membership with the source groups.

Exchange Online dynamic distribution groups aren't affected.

Docs: https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-rule-member-of

• Attribute rules. If the source group is a synced AD group, stamp an attribute in AD (department, extensionAttributeX) and use a supported rule such as user.extensionAttribute5 -eq "Finance". This is the most robust option.
• - Access packages with auto-assignment based on attributes (Governance), which gives you an audit trail.
• - Assigned group plus automation: a Logic App or Azure Automation runbook that syncs members from the source groups. Decide whether you want direct or transitive members, because memberOf only ever used direct members.
• - Plain nesting where the target supports it. Conditional Access handles nested groups; group-based licensing and Microsoft 365 groups don't.

Converting a group from dynamic to assigned keeps the current members. Before you switch, compare the frozen membership with the source groups.

Exchange Online dynamic distribution groups aren't affected.

Docs: https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-rule-member-of