Sanu VargheseIT & AI notes
Tutorials › PowerShell
IntermediatePowerShell · about 20 min · 3 November 2026

Find and fix Entra dynamic groups that use the MemberOf rule

Microsoft stops processing Entra ID dynamic groups that use the MemberOf rule after 3 November 2026. This tutorial finds every affected group and administrative unit with PowerShell, saves the current members, then fixes each one in the Entra admin center.

Before you start

  • A Windows PC with PowerShell 7 (or Windows PowerShell 5.1).
  • An account with at least the Groups Administrator role to change groups. Reading is enough for the first part.
  • About 20 minutes per tenant, plus time to decide what each group should become.

Part 1: Find the affected groups

  1. Open PowerShell as your normal user (not as administrator is fine).
  2. Install the Microsoft Graph PowerShell module if you don't already have it, then sign in. A browser window opens. Sign in with your admin account and accept the permissions prompt if it appears. 
    Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "GroupMember.Read.All","AdministrativeUnit.Read.All"
  3. List every group whose rule mentions MemberOf and save it to a CSV file in the current folder: 
    Get-MgGroup -All -Property Id,DisplayName,GroupTypes,MembershipRule |
    Where-Object { $_.MembershipRule -match 'memberOf' } |
    Select-Object DisplayName, Id, MembershipRule |
    Export-Csv -Path .\MemberOf-Groups.csv -NoTypeInformation
    If the file is empty or isn't created, no groups use MemberOf. Open the CSV and look at the MembershipRule column: affected rules start with user.memberOf or device.memberOf.
  4. Do the same for dynamic administrative units: 
    Get-MgDirectoryAdministrativeUnit -All -Property Id,DisplayName,MembershipType,MembershipRule |
    Where-Object { $_.MembershipRule -match 'memberOf' } |
    Select-Object DisplayName, Id, MembershipRule |
    Export-Csv -Path .\MemberOf-AdminUnits.csv -NoTypeInformation
  5. For each group in the CSV, save its current members before you change anything. Replace <group-id> with the group's Id from the CSV: 
    Get-MgGroupMember -GroupId "<group-id>" -All |
    Select-Object Id, @{n='Name';e={$_.AdditionalProperties.displayName}} |
    Export-Csv -Path .\<group-name>-members.csv -NoTypeInformation
This only reads data. Nothing in Part 1 changes the tenant. Entitlement management auto-assignment policies can also use MemberOf: if the tenant uses access packages, review their assignment policies as well.

Part 2: Decide what each group becomes

  • Rewrite the rule using attributes such as department, office or extension attributes, if those are accurate.
  • Switch to assigned membership if the group is small and rarely changes.

Check what the group is used for first: licensing, app access, Intune targeting or Conditional Access. That tells you how careful you need to be.

Part 3a: Rewrite a dynamic rule

  1. Sign in to the Microsoft Entra admin center at entra.microsoft.com as at least a Groups Administrator.
  2. Select Microsoft Entra ID, then Groups > All groups.
  3. Select the group to open its profile.
  4. Select Dynamic membership rules. You'll see the rule builder, or the rule syntax text box for longer rules.
  5. Replace the MemberOf rule with your new rule, for example (user.department -eq "Sales") or (user.department -eq "Marketing"). If the rule is invalid, the portal tells you why.
  6. Select Save.
Changing the rule recalculates membership. Anyone who doesn't match the new rule is removed, and they can lose licences or access tied to the group. Test the new rule on a copy of the group first if it controls licensing or Conditional Access, and make the change outside working hours if you can.

Part 3b: Switch a group to assigned membership

  1. In the Entra admin center, go to Microsoft Entra ID > Groups > All groups and open the group.
  2. Select Properties.
  3. Set Membership type to Assigned (static).
  4. Select Save. The group keeps its name and ID, so anything that points at it still works.
  5. Open Members and compare against the CSV you saved in Part 1. Add anyone who is missing.
Microsoft's documentation doesn't say exactly what happens to existing members when a dynamic group becomes assigned. That's why you saved the member list first. Try it on a low-risk group before a licensing or Conditional Access group.

Check it worked

  1. Open the group's Overview page. For a dynamic group, wait until Dynamic rule processing status shows Update complete. Processing error means the rule needs fixing.
  2. Check Last membership change shows a recent date and time.
  3. Compare the member count with your saved CSV. Investigate any big difference before moving on.
  4. Run the command from Part 1, step 3 again. When a group is fixed, it drops off the list.

Sources

← All tutorials
Esc