Got any Entra dynamic groups built on other groups? Worth a quick check today.
Picked this up from Entra News while studying this week. Microsoft is retiring the memberOf operator in Entra dynamic group rules. The deadline was 3 November 2026, so if your tenant doesn't have ID Governance, any dynamic group still built on memberOf needs a new rule now. Tenants with ID Governance have until 31 March 2027.
The part that caught my eye is how quiet it could be. If a group based on other groups fails quietly, people may just stop landing in it, and whatever relies on that group slowly drifts.
The quick check I found is to pull every dynamic group and look for memberOf in the rule, with Microsoft Graph PowerShell. Connect first with Connect-MgGraph -Scopes Group.Read.All, then run:
Get-MgGroup -Filter "groupTypes/any(c:c eq 'DynamicMembership')" -All -Property DisplayName,MembershipRule | Where-Object MembershipRule -match "memberOf"
If that comes back empty, you're fine. If it doesn't, those are the groups to rework.
Entra News has the details here: https://entra.news/p/entra-news-173-this-week-in-microsoft
Nothing breaks quite as politely as a group nobody's watching 🙃
For anyone who has already moved off memberOf, what did you replace it with?
Originally shared on LinkedIn.