The memberOf rule operator is ending for dynamic Groups in Entra

Microsoft has announced the retirement of the memberOf rule operator for dynamic groups in Entra (formerly Azure AD). This operator, which allowed dynamic groups to include direct members of other groups, has been in public preview but is being discontinued due to scalability and reliability concerns. Affected groups will stop updating after the deadline (October 27, 2026), leaving stale memberships that could impact access, licensing, and Conditional Access. The article provides guidance on identifying affected groups using PowerShell and suggests replacing rules with supported attributes or converting to assigned membership. It emphasizes the importance of auditing and updating configurations before the deadline to avoid unintended access issues.