Configure dynamic membership with the memberOf operator
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 964d985 · +34 −6 lines · also on GitHub
11
---
2
−title: Configure dynamic membership groups with the memberOf attribute in the Azure portal (preview)
2
+title: Configure dynamic membership groups with the memberOf operator in the Entra Admin Center (preview)
33
description: Learn how to create a dynamic membership group that can contain members of other groups in Microsoft Entra ID.
44
ms.topic: how-to
5
−ms.date: 01/27/2026
6
−ms.reviewer: yukarppa
5
+ms.date: 08/04/2026
6
+ms.reviewer: mbhargav
77
ms.custom: it-pro
88
---
99
10
−# Configure dynamic membership groups with the memberOf attribute in the Entra Admin Center (preview)
10
+# Configure dynamic membership groups with the memberOf operator in the Entra Admin Center (preview)
1111
1212
1313
## Overview
1414
1515
This feature preview in Microsoft Entra ID enables admins to create dynamic membership groups and administrative units that populate by adding members of other groups using the `memberOf` attribute. Apps that couldn't read group-based membership previously in Microsoft Entra ID can now read the entire membership of these new `memberOf` groups. Not only can these groups be used for apps but they can also be used for licensing assignments.
1616
17
−> [!WARNING]
18
−> This is a preview feature and isn't intended for production use. The use of this feature comes with limitations that can affect dynamic group processing in the tenant. Review the [Preview limitations](#preview-limitations) section before using this feature.
17
+> [!IMPORTANT]
18
+> The public preview of the `memberOf` rule operator is ending. After **November 3, 2026**, dynamic membership groups, dynamic administrative units, and entitlement management auto-assignment policies that use the `memberOf` operator stop updating and remain in their last known state. This can lead to stale access and enforcement gaps, including outdated Teams and SharePoint access, Conditional Access targeting, group-based licensing, and access package assignments.
19
+>
20
+> Before November 3, 2026, review all uses of the `memberOf` operator and remove or replace those configurations. See [Migrate before the preview ends](#migrate-before-the-preview-ends). This is a preview feature that isn't intended for production use; review the [Preview limitations](#preview-limitations).
1921
22
+
2023
The following diagram illustrates how you could create Dynamic-Group-A with members of Security-Group-X and Security-Group-Y. Members of the groups inside Security-Group-X and Security-Group-Y don't become members of Dynamic-Group-A.
2124
2225
:::image type="content" source="./media/groups-dynamic-rule-member-of/member-of-diagram.png" alt-text="Diagram that shows how the memberOf attribute works.":::
⋯ 52 unchanged lines
7578
7679
1. Select **OK**.
7780
1. Select **Create group**.
81
+
82
+## Migrate before the preview ends
83
+
84
+As Microsoft continues to improve the scale and reliability of dynamic membership processing, the `memberOf` preview is ending. During preview, we observed that using `memberOf` can slow dynamic membership processing for all groups in a tenant. `memberOf` is a preview operator and isn't recommended for production use.
85
+
86
+We recognize the importance of the customer scenarios that `memberOf` addresses, and we're continuing to develop an alternative solution that meets these needs with the right level of scalability and reliability.
87
+In the interim, identify and replace every configuration that uses the `memberOf` operator before November 3, 2026. After that date, configurations that still use `memberOf` stop updating and stay in their last known state, which can leave access stale and enforcement gaps in place.
88
+
89
+**Dynamic membership groups**
90
+
91
+- Export dynamic membership groups from the Microsoft Entra admin center and identify rules that contain `memberOf`.
92
+- Replace `memberOf` with [supported rule operators](~/identity/users/groups-dynamic-rule-more-efficient.md), or convert the group to assigned membership.
93
+- Validate group membership after making changes. If the group is no longer needed, pause or delete it.
94
+
95
+**Dynamic administrative units**
96
+
97
+- Use Microsoft Graph PowerShell to identify [dynamic administrative units](~/identity/role-based-access-control/admin-units-members-dynamic.md) that use `memberOf` rules.
98
+- Replace `memberOf`-based rules with supported logic, or convert the administrative unit to assigned membership.
99
+- Validate both membership and administrative scope. If the administrative unit is no longer needed, delete it.
100
+
101
+**Entitlement management auto-assignment policies**
102
+
103
+- Use Microsoft Graph PowerShell to identify [auto-assignment policies](~/id-governance/entitlement-management-access-package-auto-assignment-policy.md) that use `memberOf`.
104
+- Replace `memberOf`-based logic with supported attribute-based operators where possible. If no equivalent rule is available, plan an alternative assignment method before retirement.
105
+- Validate access package assignments after making changes.
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.