TL;DR: Microsoft’s MemberOf operator retirement will freeze any dynamic groups, administrative units, or entitlement policies that still depend on it, which can leave access, licensing, and policy assignments out of sync without obvious errors. Entra ID admins should audit for MemberOf-based rules, replace them with supported attribute-based logic where possible, move unsupported scenarios to assigned membership or another approach, and validate affected access workflows before the November 3, 2026 cutoff.
Microsoft is retiring MemberOf in Entra ID. November 3, 2026 is your deadline.
Winter is coming, or at least November 3 is.
Microsoft dropped a Message Center notification on August 5, 2026 (MC1448379) that a lot of Entra ID admins are going to miss until all their IAM is in shambles. The MemberOf rule operator, which has been sitting in public preview for four years, is being retired on November 3, 2026. If you have been using it, your dynamic groups are going to stop updating and you won’t know until someone's access is wrong.
What MemberOf actually does
The MemberOf operator lets you write dynamic membership rules based on group membership rather than individual user or device attributes. Instead of filtering on user.department -eq "Technology", you could write a rule that says "give me every member of Group A and Group B, then filter those users by country." It was a way to chain group logic together for dynamic groups, dynamic administrative units, and entitlement management auto-assignment policies.
Unfortunately, it was never stable enough to fully ship. Microsoft's explanation in MC1448379 is that even a single MemberOf rule in a tenant can affect dynamic membership processing across the entire tenant. Four years in preview is Microsoft's way of saying this architecture doesn't work at scale. Its solution: Retire it completely.
What breaks if you don't act
Pay close attention here: The failure mode is silent. When retirement hits, Entra ID does not delete your MemberOf-based rules. They are there, but processing comes to a halt. Your groups, admin units, and entitlement policies freeze.
That means new users don't get added. Users who should have been removed stay put. Group-based license assignments stop updating, so you end up with either unlicensed users or users holding licenses they shouldn't have. Conditional Access policies that target dynamic groups stop reflecting who actually belongs in them. Teams and SharePoint sites connected to Microsoft 365 groups become an access nightmare, with old members retaining access and new members left out.
Dynamic administrative units are particularly messy here. If your admin scoping relies on a MemberOf-based dynamic AU, your helpdesk or delegated admins may lose rights without warning.
None of this throws an error. It just stops processing.
How to find out if you're affected
Microsoft recommends using Microsoft Graph PowerShell to identify affected objects. For dynamic groups, you need the GroupMember.Read.All permission at minimum:
1
2
3
4
5
Connect-MgGraph -Scopes GroupMember.Read.All
[array]$Groups = Get-MgGroup -Filter "groupTypes/any(c:c eq 'dynamicmembership') and (startsWith(membershipRule,'user.memberOf') or startsWith(membershipRule,'device.memberOf'))" -All
$GroupsFor dynamic administrative units:
powershell
[array]$DynamicAdminUnits = Get-MgDirectoryAdministrativeUnit -Filter "membershipType eq 'Dynamic' and (startsWith(membershipRule,'user.memberOf') or startsWith(membershipRule,'device.memberOf'))" -All
$DynamicAdminUnitsConnect-MgGraph -Scopes AdministrativeUnit.Read.All
You can also export dynamic membership groups from the Entra admin center and filter for rules containing MemberOf if you prefer reports over scripting. Either way, do this now. Do not wait a access control mess.
What you have to do before November 3
Once you've identified what's using MemberOf, you have a few paths depending on what the rule is doing. If you can express the same logic using direct attribute filters (department, job title, extension attributes, and so on), that's your cleanest move. Replace the MemberOf logic with a supported operator and validate the membership after. If the group or admin unit is no longer actively needed, this is also the perfect time to clean it up.
Where it gets harder is entitlement management auto-assignment policies. If the policy was relying on nested group logic that can't be replicated with attribute filters, you may need to rethink the assignment approach entirely before the deadline. There is no equivalent substitute baked into entitlement management, so if you're in that situation, plan accordingly.
The short version: Audit now, replace what you can with direct attribute rules, convert what you can't to assigned membership, and validate everything before early November. November 3 is a hard deadline. After that date, nothing with MemberOf processes anymore.
The bigger takeaway
Microsoft kept MemberOf in preview for four years without shipping it and pulled the plug with roughly 90 days notice. That's not a lot of runway for organizations running complex IAM setups, especially hybrid tenants where dynamic groups are doing real access control work.
This kind of thing happens more often than it should in the Microsoft ecosystem, and it's a good reminder to review what you're building on top of preview features and to actually read your Message Center notifications. (We know. You have 400 of them. Still. We do too.)
If you're running PDQ to manage devices, check whether any of your targeting logic downstream depends on Entra group membership that could be affected here. A frozen dynamic group that was previously driving device scope or access policies is going to cause headaches that extend well beyond the identity layer.
As always, you can run your PowerShell scripts through PDQ, but for this one you’ll want to be logged in as yourself or your administrator in Powershell.
MC1448379 was published August 5, 2026. The retirement deadline is November 3, 2026. Full details are available in the Microsoft 365 Message Center and on the Microsoft Learn documentation for dynamic membership rules.
