Microsoft is retiring the Entra memberOf rule operator on November 3, 2026. The objects do not get deleted and they do not throw an error. Membership processing just stops, and the group, administrative unit, or entitlement policy keeps whoever was in it that day. Message Center notice MC1448379 (published August 5) is the official write-up.
Why this one is easy to miss
memberOf has been in public preview since 2022 and never left preview. It lets a dynamic group pull the direct members of up to 50 other groups: user.memberof -any (group.objectId -in ['groupId']). Useful for nesting security groups into a licensing or Intune assignment group when a plain attribute rule would not do it.
Microsoft is ending the preview because even one memberOf rule can slow dynamic membership processing for the whole tenant. That is also why Learn still says it is not intended for production. Plenty of tenants used it anyway.
What actually happens on November 3
After the date, Entra stops recalculating any rule that uses memberOf. Last known members stay. New joiners to a source group never appear. People who leave a source group never drop off. Tony Redmond’s write-up called this stasis, and that is the right word.
MC1448379 lists the fallout: Teams and SharePoint access on Microsoft 365 groups goes stale, Conditional Access targeting drifts, group-based licensing stops adding and removing licenses, entitlement-management auto-assignment freezes, and dynamic administrative units keep an outdated scope. If you pointed Intune apps, profiles, or compliance at one of those groups, joiners and leavers stop reflecting there too. The Intune blade will still look fine.
This is an Entra ID operator. It does not change Exchange Online dynamic distribution groups that use memberof. Those are a different directory object.
Find every rule before it freezes
Microsoft’s first suggestion is to export dynamic membership groups from the Entra admin center and search the rule text for memberOf. Graph is faster if you have more than a handful. Tony Redmond published the filters:
Connect-MgGraph -Scopes GroupMember.Read.All
[array]$Groups = Get-MgGroup -Filter "groupTypes/any(c:c eq 'dynamicmembership') and (startsWith(membershipRule,'user.memberOf') or startsWith(membershipRule,'device.memberOf'))" -All
$Groups | Select-Object DisplayName, Id, MembershipRuleConnect-MgGraph -Scopes AdministrativeUnit.Read.All
[array]$DynamicAdminUnits = Get-MgDirectoryAdministrativeUnit -Filter "membershipType eq 'Dynamic' and (startsWith(membershipRule,'user.memberOf') or startsWith(membershipRule,'device.memberOf'))" -AllFor entitlement-management auto-assignment, walk /identityGovernance/entitlementManagement/assignmentPolicies and inspect any policy with automatic request settings. Learn says memberOf cannot be combined with other operators, so a startsWith filter is enough. You will not have a mixed rule hiding it.
What to replace it with
There is no drop-in successor. Microsoft says they are working on an alternative that can scale; it is not here yet. Until then the options are:
Rebuild the rule with supported attribute operators (department, extension attributes, device ownership, and the rest of the documented set). If the only reason you used memberOf was to nest groups, convert the dynamic group to assigned membership and maintain the nest yourself, or flatten the source groups into one assigned group. Validate membership after the change, then decide whether the object is still needed.
Do this before November 3. After that date the frozen membership is what you have until someone edits the rule.
