Entra ID · Overig
Microsoft retires memberOf: dynamic groups have stood still since 3 November
Dynamic groups that take their members from other groups have not been updated since 3 November. What you notice and what to do now.
Marcel van Beek · IAM Specialist · 3 min read
Since 3 November 2026 the memberOf rule in Microsoft Entra ID no longer works. Dynamic groups that take their members from other groups have not been updated since. Microsoft announced it in August, and the date has now passed.
What has changed
With memberOf you created a dynamic group made up of the members of other groups, for example an "All sales" group from "Sales NL" and "Sales BE". The feature never left preview. Microsoft saw that such rules slowed down the processing of all dynamic groups in a tenant, and has switched them off.
That applies to dynamic groups, dynamic administrative units and auto-assignment policies in entitlement management. The groups remain with the members they had on 3 November. Nobody is added and nobody is removed, and you get no notification of it.
What you notice
A new colleague does land in the team group, but not in the group that used to look at it. If a licence or an application hangs on that group, she does not get it. The other way round, someone who changes department keeps the access of his old team. Conditional Access policies and SCIM connections also stay stuck on whoever was in the group on 3 November.
What to do now
- Find the dynamic groups and administrative units with a
memberOfrule. With Microsoft Graph PowerShell that takes a few lines. - Start with the groups for licences, Conditional Access and provisioning.
- Replace the rule with one on fields such as department or job title, or convert the group to assigned membership.
The script, the three ways to replace a rule and what to check when you save are in Microsoft is retiring memberOf in dynamic groups. Here is what to do now.
With Joinly
In Joinly you do not need memberOf. You create a role for a group of colleagues, for example on department from HR, and link the groups, licences and applications that belong with it. When someone's job changes in HR, the role changes with it, and so does everything attached to it. If you built dynamic groups on groups that Joinly fills, let Joinly manage those groups itself, or build the rule on the department and job title Joinly sets in Entra ID from HR. How roles work is on roles and RBAC.
Explore more blogs
Hoe richt je access reviews in voor groepslidmaatschap?
Hoe geef je toegang tot applicaties via groepen in Entra ID?
Applicatietoegang via groepen regel je in Entra ID door de app als enterprise application te registreren, onder Properties de optie "Assignment required" op Yes te zetten, en vervolgens onder Users and groups je toegangsgroep toe te wijzen, eventueel gekoppeld aan een app role. Vanaf dat moment bepaalt het groepslidmaatschap wie de app ziet en kan gebruiken. De valkuil: alleen directe leden tellen; een geneste groep binnen je toegangsgroep krijgt níéts. Wie dit goed inricht, heeft per applicatie één plek waar toegang geregeld is. Wie het overslaat, heeft apps die voor de hele organisatie openstaan zonder dat iemand dat ooit zo besloten heeft.
Marcel van Beek · 5 min read
How do you create dynamic groups based on HR attributes?
A dynamic group in Entra ID populates itself based on a rule regarding user attributes, for example, everyone with department Finance or jobTitle Team Leader. You create it via Entra ID → Groups → New group, choose membership type Dynamic User, and build the rule in the rule builder. The group only works as well as the HR attributes it runs on: if department and job title are not reliably stored in Entra, even the best rule will not work. The latter is the real work in practice. Building the rule takes five minutes; ensuring that department, jobTitle, and employeeType are populated and up to date for every Employee is an ongoing process. This article covers both sides.
Marcel van Beek · 8 min read
See what Joinly can do for your organisation?
Start a free trial today or get in touch for advice on your HR and Microsoft environment.
No credit card, nothing to install.