Remove memberOf rules

Contributed by Agnivesh S.All contributors →

Part of Maester · Entra ID · Groups · All checks

Run this check

Invoke-Maester -TestId MT.1197

Overview

Dynamic groups should not use the retiring memberOf rule operator.

Microsoft is ending the memberOf public preview on November 3, 2026. After that date, dynamic groups that still use the operator stop updating and remain in their last known state. Stale membership can leave outdated application access, Conditional Access targeting, Microsoft 365 access, or group-based licensing in place.

This test detects both user.memberOf and device.memberOf rules. It also reports source groups, processing state, license assignments, and Conditional Access references to help prioritize migration.

Remediation action:

1. In the Microsoft Entra admin center, open Entra ID > Groups > All groups.
2. Open each reported group and record its current effective membership and downstream assignments.
3. Replace memberOf with supported attribute-based rules or convert the group to assigned membership.
4. Validate membership and every application, Conditional Access policy, Microsoft 365 resource, and license assignment that consumes the group.
5. Remove obsolete rules and groups. Pausing processing alone does not complete the migration.

Related links

• Configure dynamic groups with memberOf and migrate before retirement
• Understand and manage dynamic group processing

Details

Every attribute of this check

Field	Value
Test ID	MT.1197
Severity	Medium
Suite	Maester
Product	Entra ID
Feature	Groups
Area	Identity lifecycle and hygiene
Resource type	Group
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	None
PowerShell test	Test-MtDynamicGroupMemberOfRule
Services	Graph

Source

• Test: tests/maester/entra/Test.MT.1197.ps1
• Documentation: tests/maester/entra/Test.MT.1197.md