Microsoft sets a hard deadline of November 3, 2026, to retire the Entra ID MemberOf rule operator and related API dependencies due to tenant-wide scale issues. Organizations must audit dynamic groups, administrative units, and entitlement policies, migrating to Microsoft Graph queries before configurations freeze in their last known state.
Organizations managing enterprise directory services face an immediate operational deadline. On November 3, 2026, Microsoft officially ends the public preview of the MemberOf rule operator in Microsoft Entra ID, halting its processing worldwide. The sunsetting process concludes a multi-phase deprecation timeline that began with initial announcements in August 2026 and follow-up notices through Microsoft 365 Message Center communications. While everyday users will not notice interface alterations, IT administrators and developers who built automation scripts, access policies, and group structures around the feature must act quickly to prevent system disruptions.
Why Microsoft is Retiring the MemberOf Rule Operator
The MemberOf operator allowed administrators to construct dynamic groups using the membership of existing security groups, Microsoft 365 groups, or on-premises synchronized directories. The feature never moved to general availability.
The primary catalyst for the shutdown involves severe scalability and reliability constraints. Microsoft observed that utilizing the operator creates measurable processing bottlenecks across entire directories. Microsoft observed that using MemberOf can affect dynamic membership processing at tenant scale, even if you only have one MemberOf rule operator in your tenant,
the company stated in documentation.
Because even a single rule can degrade performance for all directory operations, Microsoft chose to retire the functionality permanently rather than pursue partial optimizations.
Operational Impacts on Unmigrated Directory Configurations
When the November 3 deadline passes, unmigrated assets do not vanish or delete themselves. Instead, Entra ID freezes dynamic membership groups, dynamic administrative units (AUs), and entitlement management auto-assignment policies in their last known operational state.
- New employees or external collaborators may fail to receive required licenses and access permissions.
- Departing personnel or people changing roles can retain access they should have lost.
- Conditional Access policies that rely on dynamic groups may enforce rules based on stale membership data.
- Dependent platforms can serve outdated authorization lists.
While everyday users will experience no direct interface changes, applications and custom scripts querying the MemberOf API will return outdated data or fail entirely.
Migration Guidance and PowerShell Inventory Tools
Engineering teams must execute comprehensive inventory audits to locate every application, custom script, and dynamic group leveraging the retiring rule operator. For dynamic groups, administrators should export configurations from the Entra admin center, replace MemberOf references with supported alternative rule operators, or manually convert groups to assigned membership according to Microsoft guidance.
To scan tenants for active instances, technical teams can utilize Microsoft Graph PowerShell commands.
Get-MgGroup -filter startsWith(membershipRule,'user.memberOf') or startsWith(membershipRule,'device.memberOf')
| Select-Object DisplayName, Id, MembershipRule, MembershipRuleProcessingState | ft -AutoSize
For custom applications and developer workflows, Microsoft points toward the Microsoft Graph API as the long-term replacement. Modern Graph queries support direct and transitive membership checks, allowing applications to answer questions such as is this person a member of the Finance group?
without risking tenant-wide performance.
Exceptions and Governance Deadlines
While the worldwide retirement date is set for November 3, 2026, an exception exists for specific enterprise licensing tiers. Tenants licensed for Entra ID Governance receive an extended deadline of March 31, 2027, under Microsoft notice MC1488839.