Entra dynamic groups built on memberOf freeze after 3 November

Entra dynamic groups built on memberOf freeze after 3 November

2 November 2026: Any Microsoft Entra ID dynamic group that builds its membership from other groups with the memberOf operator stops updating after 3 November 2026, when Microsoft ends the operator's public preview. The same applies to dynamic administrative units and to entitlement management auto-assignment policies that use it. They will "stop updating and remain in their last known state", Microsoft says, so a leaver stays in and a new starter never arrives.

Not yet independently verified. Microsoft's page carries the notice but no date for when it was added, and we found no message centre post to confirm it independently. We will update this when it can be confirmed, and remove this note.

What freezes, and where it shows

memberOf let an administrator define a group as the members of other groups, for example one group holding everyone in Security-Group-X and Security-Group-Y. Microsoft pitched it at apps that cannot read group-based membership, which can read a memberOf group's whole list, and at group-based licensing.

Microsoft lists the knock-on effects itself: outdated Teams and SharePoint access, Conditional Access policies aimed at the wrong people, group-based licences that no longer follow staff, and access package assignments that stop changing. Nothing breaks loudly on 4 November. Access simply stops tracking the organisation, which is harder to spot than an outage.

Microsoft's reason is performance. Its page warns that memberOf groups "might cause a slower processing time for your tenant" and that the preview "can affect dynamic group processing in the tenant". It says an alternative is being developed but gives no date for it.

Finding memberOf rules before Tuesday

Microsoft's migration steps are to export dynamic groups and search their rules for memberOf, then replace each rule with supported operators or convert the group to assigned membership, and check the membership afterwards. Dynamic administrative units and auto-assignment policies are found with Microsoft Graph PowerShell and handled the same way, with administrative unit scope checked as well as membership.

Two shortcuts follow from the preview's own limits. A tenant could hold at most 500 memberOf groups, and a memberOf rule could not be combined with any other condition, so every affected rule is a pure memberOf rule. Converting one to assigned membership at its current list is the quickest fix, at the cost of maintaining it by hand until a rule-based replacement exists.

Where the fallback falls short

Rewriting memberOf as an attribute rule, such as department or job title, only works where those attributes are kept accurate in Entra or synced cleanly from on-premises Active Directory. Groups that existed to merge teams with nothing else in common have no attribute to fall back on, and those are the ones to convert to assigned membership first. The feature needed Entra ID P1 or P2 and was only ever available in the public cloud, so government cloud tenants are not affected.

Our catalogue lists seven products in identity management software and 16 in privileged access management.

Sources

• Microsoft Learn: Create a dynamic membership group with the memberOf attribute (updated 2026-08-04), 4 August 2026
• Microsoft Learn: Dynamic membership rules for groups (updated 2026-08-13), 13 August 2026