Entra ID Drops the memberOf Rule Operator for Dynamic Groups and Dynamic Admin Units

Using MemberOf in Dynamic Membership Rules

In June 2022, I covered the introduction of the MemberOf rule operator for Entra ID dynamic groups (or Azure AD groups as they were at the time). As I said at the time, “memberOf instructs Azure AD to extract the membership of between one to 50 groups and include the individual members of those groups in the dynamic membership.” Figure 1 shows an example where the membership rule extracts members from three groups and filters those members to select those whose country is set to be Ireland.

When I checked the membership rule, I discovered that two of the referenced groups no longer existed. The rule continued to function based on the remaining group, and Entra ID provided no indication that part of the rule was invalid.

Microsoft Retires MemberOf After Four Years

Microsoft launched the MemberOf feature in preview and never moved it into production. Now message center notification MC1448379 (5 August 2026) informs us that Microsoft is ending the preview and will retire the MemberOf rule operator in early November 2026. The retirement affects dynamic groups, dynamic administrative units, and entitlement management auto-assignment policies.

Currently, Entra ID supports MemberOf in membership rules for dynamic groups, dynamic administrative units, and entitlement management auto-assignment policies. The retirement of the rule operator doesn’t mean that the objects using the operator to determine membership stop working.

Microsoft says that policies using MemberOf will not be removed, but membership processing will stop after retirement, leaving the affected objects in their last calculated state. Once the operator is retired, Entra ID will be unable to recalculate membership on an ongoing basis as it does today. Features that depend on membership, like granting access to resources connected to a dynamic Microsoft 365 group or assigning licenses to user accounts using group-based license allocation will enter a period of stasis. Membership will be frozen in time with the potential to become increasingly inaccurate until an administrator updates the affected rules to replace MemberOf with “supported rule operators”, if that’s possible.

Finding Affected Objects

In MC1448379, Microsoft suggests using Microsoft Graph PowerShell to identify objects affected by the retirement. Here’s the code to find dynamic groups which include MemberOf in their membership rules. An app with the GroupMember.Read.All permission can search for groups. Alternatively, use an interactive session with a signed in user holding at least the Group administrator role. It’s worth emphasizing that you do not need the Group.Read.All permission to fetch details of groups:

Connect-MgGraph -Scopes GroupMember.Read.All

[array]$Groups = Get-MgGroup -Filter "groupTypes/any(c:c eq 'dynamicmembership') and (startsWith(membershipRule,'user.memberOf') or startsWith(membershipRule,'device.memberOf'))" -All

$Groups

The code to find dynamic administrative units with MemberOf in their membership rules follows similar lines:

Connect-MgGraph -Scopes AdministrativeUnit.Read.All 

[array]$DynamicAdminUnits = Get-MgDirectoryAdministrativeUnit -Filter "membershipType eq 'Dynamic' and (startsWith(membershipRule,'user.memberOf') or startsWith(membershipRule,'device.memberOf'))" -All

$DynamicAdminUnits

Auto-assignment entitlement management packages are possibly the least common usage for the rule operator. I don’t have the necessary Identity Governance licenses to set a policy up, but the API documentation describes how to retrieve policies. Something like the code below should find auto-assignment policies which deserve closer examination:

$Uri = "https://graph.microsoft.com/v1.0/identityGovernance/entitlementManagement/assignmentPolicies"
$Data = Invoke-MgGraphRequest -Uri $Uri -Method Get -OutputType PsObject | Select-Object -ExpandProperty Value
$Data | Where-Object {$_.automaticRequestSettings}

The Logic for Retirement

At first sight, MemberOf seems like a useful feature to have that’s used in three areas of Entra ID, so why has Microsoft decided to retire it? According to MC1448379, “use of MemberOf can affect dynamic membership processing across a tenant even if you have one MemberOf rule operator in your tenant. Because of this limitation, it is not recommended for production use and will be retired.”

We can all attempt to read between the lines. My take is that Microsoft has been unable to make the current implementation sufficiently scalable and robust and has concluded that the current implementation will never satisfy the requirements to move out of preview. Perhaps they’ll revisit the idea again using a different approach. In any case, retirement is happening and you should check if any Entra ID objects are affected. If any objects requiring updates are found, the challenge is to find an equivalent rule that delivers the same outcome without relying on MemberOf.

---

The nice thing about generative AI tools is that they can generate information based on what’s gone before. The bad thing about generative AI tools is that they can’t create new thinking or insights about how technology works (or doesn’t). When we write the Microsoft 365 for IT Pros eBooks, we depend on hundreds of years of real-world experience, knowledge, and intuition to analyze and explain how Microsoft 365 really works. If you understand the basic principles about Entra ID, Exchange Online, SharePoint Online, Teams, the Microsoft Graph, and more, you’ll be able to figure out the value of new features as Microsoft adds them to the platform. All for less than ten copies of black coffee.