Microsoft is retiring memberOf operator in Entra ID Dynamic Groups. What should administrators do next?

Introduction

Microsoft is retiring the memberOf rule operator for Microsoft Entra ID dynamic membership on November 3, 2026. If you're using it today, you'll need to identify the affected groups and decide how their membership will be maintained before processing stops.

Microsoft's current memberOf guidance documents the feature's preview status and limitations.

memberOf has remained in public preview, but it solves a useful problem: deriving the membership of one dynamic group from the membership of another. That's useful for application assignment, licensing and other group-driven access models.

Microsoft has also highlighted concerns around scale and reliability, particularly in tenants with large numbers of groups or frequent membership changes.

So its retirement creates an obvious migration task, but it is also a good opportunity to reconsider how that membership is being determined in the first place.

For organizations using Netwrix Directory Manager (NDM), SmartGroups provide another approach. NDM calculates membership independently of Entra's dynamic membership engine and maintains the resulting membership directly in Entra ID.

For direct group membership scenarios currently handled using memberOf, that capability is available today.

What’s changing in Microsoft Entra ID?

The memberOf operator allows an Entra dynamic group to derive its membership from another group.

For example, an administrator might create a dynamic group with logic that effectively says: "Include users who are members of Group A."

Entra evaluates that rule and maintains the resulting dynamic group.

Once Microsoft retires the operator, organizations using this model will need another way to maintain those memberships.

But it's worth looking beyond the rule itself.

Groups are commonly used to control application access, licensing, policy assignment and other identity-driven processes. Before replacing a rule, it helps to understand what the group actually controls and, more importantly, who it is intended to contain.

A different approach with Netwrix Directory Manager

Netwrix Directory Manager SmartGroups take a different approach to dynamic membership.

Instead of asking Entra to evaluate a dynamic membership rule, NDM evaluates the membership criteria itself. It determines who should belong to the group, compares that with the current membership and makes the required changes in the directory.

The resulting Entra group can remain a standard Assigned group. There is no Entra dynamic membership rule for Microsoft to evaluate.

That removes the dependency on the retiring memberOf operator, but it also gives administrators more flexibility over how membership is defined. Group membership can be combined with directory attributes and explicit inclusion or exclusion criteria rather than relying on a single relationship.

Replacing direct memberOf rules with SmartGroups

Consider a simple example.

Suppose a Sales Employees group contains the users who should receive access to a sales application.

Today, an organization might use an Entra dynamic membership rule with memberOf to maintain a Sales Application Access group based on membership of Sales Employees.

With NDM, a SmartGroup can use membership of Sales Employees as one of its criteria. NDM resolves the direct members of the source group, calculates the required membership and maintains the Sales Application Access group in Entra.

Importantly, NDM isn't creating another Entra dynamic rule behind the scenes.

The resulting Entra group remains Assigned, with no dynamic membership rule attached. NDM calculates the membership and writes the required changes to Entra.

The same SmartGroup model can use direct group-derived membership from both Active Directory and Entra ID sources.

More than a one-for-one replacement

This is where the retirement of memberOf becomes more interesting than simply replacing one rule with another.

A SmartGroup doesn't have to reproduce an existing memberOf rule exactly.

Group membership can be combined with directory attributes and other criteria, together with explicit inclusions and exclusions. That gives you an opportunity to describe the population you actually want rather than simply recreating the mechanism you happen to use today.

For example, instead of: "Everyone who is a member of Sales Employees,” the real requirement might depend on group membership plus location, department or another identity attribute.

For each affected group, it's worth asking:

• What population is this group actually intended to represent?
• What applications, resources, licenses or policies depend on it?
• Is another group's membership still the best source of truth?
• Could directory attributes describe the intended population more accurately?
• Are there exceptions that should be explicitly included or excluded?

The goal doesn't have to be to reproduce a deprecated operator. This is an opportunity to improve the membership policy behind the group.

Direct and nested membership scenarios

There is one important distinction when assessing existing configurations: direct versus transitive membership.

For direct membership from an Entra source, NDM supports the scenario today.

In our Sales Employees example, NDM can use the direct members of that group as part of the criteria for maintaining the Sales Application Access group. SmartGroups can then extend that logic with additional attributes, inclusions and exclusions if required.

If membership needs to be derived transitively through multiple levels of nested Entra groups, that's different. NDM doesn't currently support native traversal of nested Entra group membership.

Where that's required, a custom attribute can instead be used to represent the required membership, allowing that attribute to be used as part of the SmartGroup criteria.

So the first question isn't simply, "Where are we using memberOf?"

It's "What did we intend this rule to do?"

Taking control of dynamic group membership

Microsoft's retirement of memberOf raises a broader question for identity teams: where should the logic that determines group membership live?

When that logic sits entirely within a cloud platform's native dynamic membership features, you're also dependent on the capabilities and lifecycle of those features.

SmartGroups provide a different model.

NDM owns the membership policy and maintains the resulting membership in the directory. Entra still contains the group and its members, but the logic determining who belongs to it is managed separately.

That separation gives organizations more control over how membership is defined and makes it possible to build policies that go beyond a single group relationship.

Find where memberOf is being used

Before designing a replacement, you need to know where memberOf is currently in use.

Administrators can use PowerShell to identify Entra dynamic groups with membership rules containing memberOf. This provides a practical way to inventory the configurations that need to be reviewed before the operator is retired.

We created a PowerShell discovery script that identifies dynamic groups using memberOf. You can find it on GitHub.

Once you've identified the affected groups, don't immediately start recreating their rules. First find out what each group actually does and what business purpose its membership serves.

Start with the intent, not just the rule

For each affected group, follow the dependency:

Dynamic rule → Group → Assignment → Business purpose

Understand what the group ultimately controls and what population it was intended to represent.

From there, the affected configurations will generally fall into three categories:

• Direct group membership scenarios that SmartGroups can maintain today;
• Scenarios where combining group membership with attributes or other criteria produces a better membership policy;
• More complex nested or transitive scenarios that require additional planning.

For organizations using Netwrix Directory Manager, the retirement of memberOf doesn't have to mean finding another way to reproduce exactly the same rule.

It's an opportunity to take greater control of dynamic group membership, reconsider the policies behind important groups and use SmartGroups to maintain those memberships independently of Entra's dynamic membership engine.