Microsoft has issued a final reminder that the MemberOf rule operator in Microsoft Entra ID will be retired on November 3, 2026. Dynamic groups, dynamic administrative units and entitlement-management auto-assignment policies that rely on the operator will stop processing membership or assignment changes. Organizations that do not update their configurations may leave users without required access or licenses, while former employees could retain permissions that should have been removed.
Microsoft’s Message Center notice says the public-preview MemberOf operator will be retired on November 3. The company said it had observed that the feature could affect the scale and reliability of dynamic membership processing across a tenant, even when only one MemberOf rule was present. Microsoft therefore decided to end the preview rather than recommend the functionality for production use.
The deadline applies to configurations that use the operator in the supported Entra ID features identified by Microsoft. Administrators should not assume that existing rules will continue to update after the retirement date.
Microsoft said dynamic groups using MemberOf will stop processing membership changes. Dynamic administrative units that rely on the operator will stop updating membership and administrative scope. Entitlement Management auto-assignment policies using MemberOf will also stop processing assignment updates.
Existing membership and assignment data will remain in its last known state. That means the data will not necessarily disappear, but it may become outdated as employees join, leave or change roles within an organization.
If dynamic membership stops updating, new employees may not receive the access or licenses they need. Former employees may retain access or licenses that should have been removed. Conditional Access policies that rely on affected groups may evaluate outdated membership information. Microsoft also warned that Teams, SharePoint and other applications depending on dynamic groups could receive stale membership data.
These risks make the retirement more than a technical change to a rule operator. The affected configurations can influence identity management, application access and licensing decisions across an organization.
Microsoft recommends exporting dynamic membership groups from the Entra admin center and identifying rules that contain MemberOf. Where possible, administrators should replace the operator with supported rule operators. If no supported dynamic alternative exists, Microsoft recommends converting the group to assigned membership.
The company also advises administrators to review dynamic administrative units and entitlement-management auto-assignment policies. After making changes, they should validate membership results, administrative scope and access-package assignments. Groups or administrative units that are no longer needed should be removed.
MemberOf rules can be used in configurations that affect access control, licensing and administrative scope. Organizations should review Conditional Access policies and other systems that rely on dynamic group membership. They should also verify that new employees receive the correct permissions and that former employees lose access when required.
Microsoft’s documentation separately notes that dynamic membership groups have licensing requirements and that the security of membership depends on who can modify the attributes used in rules. Those considerations remain relevant when organizations redesign their configurations.
The retirement date is fixed, but replacing a rule does not automatically guarantee that the resulting access configuration is correct. Administrators need to verify that the new rule or assigned-membership process preserves the organization’s intended business logic.
If a company has not completed the migration by November 3, affected membership and assignment information may remain frozen at its last known state. The practical risk is that identity, access and licensing systems may no longer reflect employees’ current roles. Microsoft’s final reminder is therefore a deadline for both technical replacement and validation.