# Remove memberOf rules

Remove memberOf rules. A Maester check for Entra ID, Groups.

Source: https://maester.dev/docs/tests/MT.1197

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/agnivesh" title="Agnivesh S. · Original author"><img src="https://github.com/agnivesh.png" alt="Agnivesh S." width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/agnivesh">Agnivesh S.</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Entra ID · Groups · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1197
```

## Overview

Dynamic groups should not use the retiring `memberOf` rule operator.

Microsoft is ending the `memberOf` public preview on **November 3, 2026**. After that date,
dynamic groups that still use the operator stop updating and remain in their last known state.
Stale membership can leave outdated application access, Conditional Access targeting, Microsoft 365
access, or group-based licensing in place.

This test detects both `user.memberOf` and `device.memberOf` rules. It also reports source groups,
processing state, license assignments, and Conditional Access references to help prioritize
migration.

#### Remediation action:

1. In the **Microsoft Entra admin center**, open **Entra ID** > **Groups** >
   **[All groups][all-groups]**.
2. Open each reported group and record its current effective membership and downstream assignments.
3. Replace `memberOf` with supported attribute-based rules or convert the group to assigned
   membership.
4. Validate membership and every application, Conditional Access policy, Microsoft 365 resource, and
   license assignment that consumes the group.
5. Remove obsolete rules and groups. Pausing processing alone does not complete the migration.

#### Related links

* [Configure dynamic groups with memberOf and migrate before retirement][member-of-retirement]
* [Understand and manage dynamic group processing][dynamic-group-processing]

[all-groups]:
  https://entra.microsoft.com/#view/Microsoft_AAD_IAM/GroupsManagementMenuBlade/~/AllGroups
[member-of-retirement]:
  https://learn.microsoft.com/entra/identity/users/groups-dynamic-rule-member-of
[dynamic-group-processing]:
  https://learn.microsoft.com/entra/identity/users/manage-dynamic-group

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1197 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Groups |
| Area | Identity lifecycle and hygiene |
| Resource type | Group |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtDynamicGroupMemberOfRule](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1197.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/maester/entra/Test.MT.1197.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1197.ps1)
- Documentation: [`tests/maester/entra/Test.MT.1197.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1197.md)