Microsoft ends Entra memberOf operator

Microsoft has put a hard end date on one of the more specialized shortcuts in Entra ID: the `memberOf` rule operator for dynamic memberships. The company says the public preview is ending, and any dynamic membership groups, dynamic administrative units or entitlement management auto-assignment policies that still rely on `memberOf` will stop updating after November 3, 2026. That matters because `memberOf` was used to build dynamic logic from existing group membership rather than from user or device attributes. In practice, that let administrators create one group based on the direct members of as many as 50 source groups, according to Microsoft’s documentation and a write-up by Daniel Bradley of Our Cloud Network. The operational risk is not that those objects disappear on November 3. Microsoft says they will remain in their last known state, which means memberships can become stale rather than fail visibly. (learn.microsoft.com) ### Which Entra objects are actually affected by the shutdown? Microsoft’s Learn documentation names three affected areas: dynamic membership groups, dynamic administrative units and entitlement management auto-assignment policies that use the `memberOf` operator. (learn.microsoft.com) Automatic assignment policies that do not use `memberOf` are not affected, Microsoft says. That scope is broader than many administrators may expect. A tenant could have used `memberOf` not just for group nesting workarounds, but also for access package assignment and administrative scoping inside Entra. (learn.microsoft.com) ### What exactly stops working on November 3, 2026? Microsoft says affected configurations “stop updating” after November 3, 2026. The company adds that they will remain in their last known state, creating the possibility that access, licensing and targeting decisions continue to reflect old memberships instead of current ones. (learn.microsoft.com) Microsoft’s examples of downstream impact include outdated Teams and SharePoint access, Conditional Access targeting, group-based licensing and access package assignments. (learn.microsoft.com) Those examples are in Microsoft’s own notice, not third-party interpretation. ### Why is Microsoft ending the operator? Daniel Bradley wrote on August 5 that Microsoft said `memberOf` rules can slow dynamic membership processing for every group in a tenant, and he described scalability and reliability as the reason for ending the preview. (learn.microsoft.com) Bradley cited customer notices and Microsoft Learn pages in that assessment. Microsoft’s broader guidance on dynamic groups points in the same direction. (learn.microsoft.com) The company recommends simpler, faster rules and says tenants should review and delete inactive or outdated dynamic groups to improve processing performance. Microsoft’s dynamic group processing guidance also says existing `memberOf` groups should be deleted. ### Why are some administrators focusing on late October instead of November 3? Our Cloud Network reported that customer notices and the entitlement management page indicate auto-assignment policies using `memberOf` will be quarantined from October 27, 2026, even though the main Learn page says updates stop after November 3, 2026. (ourcloudnetwork.com) Bradley said he would treat October 27 as the working deadline. Microsoft’s public Learn page for the `memberOf` operator uses November 3, 2026 as the stop-update date. (learn.microsoft.com) Based on the documents now published, organizations with affected entitlement management policies may want to verify both dates in their own tenant notices and plan against the earlier one. That is an inference from the published Microsoft and third-party material. ### What should tenants do now? Microsoft says tenants should review all uses of the `memberOf` operator and remove or replace those configurations before the deadline. (ourcloudnetwork.com) Bradley said PowerShell is the faster way to audit affected dynamic groups, compared with checking each group one by one in the Entra admin center. Microsoft also provides rule-validation guidance for dynamic groups, which can be used to test replacement logic against sample users or devices before changes are put into production. (learn.microsoft.com) November 3, 2026 is the date on Microsoft’s primary Learn notice, while October 27, 2026 appears in notices tied to some entitlement management policies, according to Bradley’s report. Tenants that use `memberOf` in groups, administrative units or access package policies have until then to replace the logic and confirm the new rules behave as intended. (learn.microsoft.com 1) (learn.microsoft.com 2)