Microsoft Entra to retire ‘memberOf’ operator in 2026

Microsoft has announced the retirement of the ‘memberOf’ rule operator in Microsoft Entra, scheduled for November 3, 2026. When this operator is retired, dynamic groups, dynamic administrative units, and entitlement management auto-assignment policies will stop recalculating. This will cause memberships to freeze in their last known state, meaning new members will not be added and departing members will not be removed, despite the portal showing no errors.

Administrators face several risks, including stale access and licensing drift. Because Entra does not handle nested memberships consistently across all services, failures may occur without warnings. For example, while Conditional Access can evaluate nested groups, group-based licensing only applies to direct members, and Global Secure Access traffic-forwarding assignments do not follow nested membership.

To mitigate these risks, experts recommend that administrators inventory all dynamic rules using the operator and replace them with attribute-based dynamic rules, assigned membership managed by automation, or scripted provisioning via Microsoft Graph. It is critical to test replacements against licensing, access policies, and entitlement assignments to ensure security boundaries remain intact.