When does the memberOf rule operator stop working?

Microsoft ends the preview after November 3, 2026. From then on, dynamic groups, dynamic administrative units and entitlement management auto-assignment policies that use memberOf stop updating and keep the members they had at their last calculation.

Will my memberOf groups be deleted?

No. The groups, administrative units and policies stay, with their current members. They just stop changing, so anything that grants access, licences or policy through them goes stale over time.

Are Exchange Online dynamic distribution groups affected?

No. Exchange Online dynamic distribution groups are a separate feature with their own filters, and the retirement doesn't touch them.

What is the replacement for memberOf?

Microsoft hasn't shipped one. Its guidance is to replace memberOf with supported rule operators or convert the group to assigned membership. In practice that means rewriting the rule on a user or device attribute, converting to assigned, assigning the source groups directly, or flattening them with a scheduled sync.

Can I convert a memberOf dynamic group to an assigned group?

Yes. Change the group's membership type from dynamic to assigned in the Entra admin center. Do it before November 3, 2026, while membership is still being calculated, and plan who will maintain joiners and leavers afterwards.

Does this affect Azure Virtual Desktop?

Only if your AVD setup uses a memberOf group somewhere: application group assignments, group-based licensing, Conditional Access, Intune targeting of session hosts or profile share permissions. A frozen group there means new users can't see their desktop or get a licence, and leavers keep access.

Is GCC High affected?

No. Microsoft only offered the memberOf operator in the public cloud, so GCC High and DoD tenants have no memberOf rules to migrate.

Entra ID Retires the memberOf Dynamic Group Rule on November 3, 2026: What Freezes and How to Migrate

Microsoft is ending the memberOf preview for Entra ID dynamic membership rules. After November 3, 2026, dynamic groups, dynamic administrative units and access package auto-assignment policies that use it stop updating and stay frozen in their last state. Here is what that breaks, the PowerShell to find every affected object, and four ways to replace the rule.