Entra ID Dynamic Groups: memberOf Operator Removal

Introduction

Microsoft is preparing a significant change to Microsoft Entra ID dynamic groups: the removal of the memberOf operator in membership rules, scheduled for November. If your tenant uses this syntax to build nested groups, Conditional Access assignments, or administrative units, it's time to verify your exposure before the rule stops working.

This article explains how dynamic groups work (user and device), why Microsoft is removing this feature that remained in preview for years, and provides PowerShell commands to audit and correct your rules before the deadline.

Reminder: Assigned Groups vs Dynamic Groups

In the Entra Administration Center, creating a group presents two dimensions that should not be confused:

• Group type: Microsoft 365 (collaborative, with shared mailbox, SharePoint, etc.) or Security (dedicated to permissions, assignable to users or devices).
• Membership type: Assigned (manual addition) or Dynamic (rule-based on attributes, automatically evaluated by Entra ID).

A dynamic user group can, for example, automatically group all employees whose city attribute is Oslo. As soon as an HR administrator modifies a user's record, their membership in the group updates without any manual action.

Create a Dynamic User Group Step by Step

The configuration logic remains identical with or without the future deprecation of memberOf. Here is the standard process on the portal side.

Dynamic Device Groups and Intune Use Cases

The same mechanism applies to devices, with different attributes: manufacturer, category, OS version, or device identifier.

1(device.deviceManufacturer -eq "Dell") -and (device.deviceCategory -eq "Laptop")

This rule can be refined further, for example to target only a range of hardware with a startsWith operator on the device name (XPS). These dynamic device groups are particularly useful for:

• Targeting Intune policies by model or workstation category.
• Building Conditional Access rules restricting access to specific devices.
• Automating software deployments without manual maintenance of lists.

Why Microsoft is Removing the memberOf Operator

The memberOf operator allowed building a dynamic rule based on membership in another group — the equivalent of nested groups in Active Directory. Problem: this feature remained in public preview for several years, never getting a graphical interface. It was only accessible via PowerShell, by manually retrieving the object ID of the target group to inject into the rule:

1# Old rule using the memberOf operator (being removed)
2(user.memberOf -Any (group.objectId -in ['a1b2c3d4-e5f6-7890-abcd-ef1234567890']))

This model never really scaled on Entra ID as it did on Active Directory: unlike classical AD group nesting, rule updates based on memberOf generated disproportionate evaluation load at scale. Another sensitive point: this operator is not limited to groups, it is also found in rules associated with administrative units and certain application policies, which expands the impact scope well beyond just security groups.

Migrate to the New Simplified Syntax

Microsoft proposes replacing complex cascading rules with the -in operator, which accepts a comma-separated list of values — much more readable and faster to maintain than a string of -or conditions:

1# New simplified rule with the -in operator
2(user.department -in ["IT Support", "Helpdesk", "Service Desk"])

Audit Your Rules Before the November Cutoff

Before modifying anything, identify all dynamic groups that exploit memberOf. The following script uses the Microsoft.Graph module (PowerShell) and requires the Group.Read.All scope at minimum:

1# Connect with the minimum scope needed for reading
2Connect-MgGraph -Scopes "Group.Read.All"
3 
4# Retrieves all groups with dynamic membership and filters those using memberOf
5Get-MgGroup -All -Filter "groupTypes/any(c:c eq 'DynamicMembership')" |
6    Where-Object { $_.MembershipRule -match "memberOf" } |
7    Select-Object DisplayName, Id, MembershipRule |
8    Format-Table -AutoSize

Once the affected groups are identified, updating the rule is done with the Groups Administrator or Global Administrator role, via the Group.ReadWrite.All scope:

1# Update an existing dynamic rule
2Connect-MgGraph -Scopes "Group.ReadWrite.All"
3 
4Update-MgGroup -GroupId "<Group-Id>" `
5    -MembershipRule '(user.department -in ["IT Support", "Helpdesk"])' `
6    -MembershipRuleProcessingState "On"

Remember to repeat this verification on administrative units and objects linked to application policies, which do not appear in the groupTypes filter above.

Common Pitfalls and Troubleshooting

• The rule is saved but no members appear: first check that the targeted users have an Entra ID P1 license, the most frequent cause of silent failure.
• Syntax error in the rule editor: attribute names are case-sensitive in some contexts; favor the visual editor on the portal to avoid typos.
• Cannot combine assigned and dynamic membership: these two modes are mutually exclusive on the same group, you must choose one or the other at creation.
• The memberOf rule still works today but will stop abruptly: don't postpone migration to the last minute, rule evaluation is not retroactive once the operator is removed.

A Bonus Feature Not to Neglect: Group Expiration

Beyond dynamic rules, Entra ID offers a group expiration policy, particularly useful against the proliferation of self-service created Microsoft 365 groups never cleaned up:

• Set a duration (for example 180 days) beyond which an inactive group is flagged.
• An administrator contact receives a notification to confirm if the group is still in use.
• If no one renews it, the group is placed in the recycle bin (restoration possible for a limited period) before permanent deletion.

This feature applies group by group or across the entire tenant, and constitutes an excellent governance complement to put in place when you review your dynamic rules.

Key Points to Remember

• Microsoft is removing the memberOf operator from Entra ID dynamic group rules in November, a feature that remained in preview without a graphical interface for years.
• The impact goes beyond groups: administrative units and application policies can also be affected.
• The recommended new syntax relies on the -in operator, simpler to write and maintain than strings of -or conditions.
• Audit your rules now via Microsoft.Graph PowerShell to identify at-risk groups before the cutoff.
• Take this opportunity to enable automatic group expiration, an excellent governance tool often underutilized.

For more information, consult the official documentation on Entra ID dynamic membership rules and on group lifecycle management.