Migrate Entra MemberOf Rules Before Retirement
Repeated problem · 90-day evidence
Who experiences it
Entra ID and sysadmins whose dynamic rules derive members from on-prem AD or other security/M365 groups (e.g., departments) to drive licensing, Intune app deployment, SharePoint access, and administrative unit scopes — teams that leaned on MemberOf as their practical nested-group workaround.
Workflow
Admins today write rules such as user.memberOf referencing synced on-prem AD groups; Entra evaluates them to populate dynamic groups that assign licenses, apps, and access. After the retirement, these rules stop processing, so admins must discover every affected dynamic group/AU/auto-assignment policy (usually via Graph PowerShell), translate each group-membership condition into supported attribute-based syntax such as user.department, convert the object to assigned membership, or build custom sync automation, then validate that resulting memberships match before November 3, 2026.
Possible direction
A migration workbench that scans a tenant for MemberOf rules and auto-generates equivalent attribute-based replacement rules with membership-diff previews before applying them.
Current context
Microsoft (MC1448379) provides only manual guidance: replace MemberOf with supported attribute operators or convert to assigned membership, and says it is still developing a scalable alternative. Community PowerShell scripts (e.g., Graph-based discovery, AdminDroid's MemberOfRuleDeprecationReport.ps1) and blog guides help locate affected objects, but translation and validation remain manual per rule.
Observed from 3 distinct users across 1 discussion threads in the 90 days ending 2026-08-13. Latest evidence: 2026-08-06.
Keyword suggestions
