Using MemberOf in Entra ID? Start planning your replacement now

Microsoft has confirmed that it will retire the MemberOf rule operator in Microsoft Entra ID. For organisations using it across identity and access management, any configuration that relies on it needs to be replaced before 3 November 2026.

The change surrounds these three areas:

• Dynamic membership groups.
• Dynamic Administrative Units.
• Entitlement Management auto-assignment policies.

Microsoft points to scale and reliability issues seen during the preview period as the reason for the withdrawal, and recommendations point towards removing or replacing affected configurations ahead of the deadline.

A preview feature doesn’t stay experimental forever

MemberOf has been in public preview for more than four years. It was never recommended for production use but that doesn’t matter much to a team that needed it to do a job.

Some organisations will have built it into their day-to-day cloud administration, in areas such as access models, operational processes and governance practices, simply because it worked and it was there.

The impact centres on how it’s been used

However, not every organisation will feel this the same way. For some, the change will have little or no practical impact. Others will find MemberOf built into access, licensing, governance processes and more.

For those organisations, the impact depends on what each configuration is doing, how business-critical the outcome is, and how easily it can be replaced.

There’s no single feature that replaces it

Microsoft’s guidance is about replacing MemberOf-based configurations. It isn’t a migration guide, because there isn’t a like-for-like successor that carries every existing use case across cleanly.

Instead, organisations are left choosing between a handful of approaches depending on the scenario in front of them:

• Redesign dynamic group rules around other supported attributes.
• Use automation, such as Logic Apps or Automation Accounts, to populate assigned groups instead.
• Rework the underlying business process where the fix sits outside the technical configuration entirely.
• Combine more than one of these, since a single tenant rarely has just one use case to solve for.

The right route depends on what MemberOf was being asked to do, how critical that outcome is, and whether the dependency sits in the configuration, the process, or both.

Planning ahead of November

The deadline may look manageable on paper, but capacity is often the real constraint. Identity teams need to assess affected configurations and decide how best to replace them alongside other priorities.

A phased approach may help. Some organisations can use automation as an interim measure to keep key outcomes working, while reserving broader process changes for a more considered follow-up.

The aim should be to reduce risk, not simply recreate the same dependency elsewhere. AI-assisted tooling can also speed up rule conversion or script development, provided outputs are reviewed and tested.

If you need help assessing your exposure or choosing the right replacement approach, speak to our identity team.