On 3 November 2026, Microsoft will freeze all dynamic groups, administrative units and Entitlement Management policies that use the MemberOf operator. New students will no longer be placed in the correct groups, former students will not lose their access, and licences will no longer be correctly assigned or revoked.
If you use MemberOf for group management in Microsoft Entra ID, you have less than five months to migrate it
What exactly is stopping, and when?
After 3 November 2026, Entra ID will cease to process any dynamic group, dynamic administrative unit or Entitlement Management policy that uses a MemberOf rule. The groups will be frozen in their last known state. That may sound neutral, but the consequences are anything but neutral:
- New users added to the source group are not added to the dynamic group.
- Users who leave the source group retain their access in the frozen group.
- Group-based licensing no longer correctly allocates and revokes licences.
- Conditional Access policies based on these groups target the wrong users.
- Access to Teams and SharePoint linked to these groups is no longer correct.
That last scenario is particularly dangerous for schools. A former pupil who, after the school year has ended, is technically still a member of a Teams class or has access to SharePoint documents is not only an operational problem, but also a privacy issue.
One date in particular requires special attention: 27 October 2026. Entitlement Management policies for automatic allocation that use MemberOf will be placed in quarantine on that date and will cease to process, even though the policy itself will remain visible. Treat 27 October as your actual deadline, not 3 November.
| Date | What stops |
| 27 October 2026 | The Entitlement Management auto-assignment policy using MemberOf is being placed in quarantine. Processing will stop. |
| 3 november 2026 | Freeze dynamic groups and dynamic administrative units using MemberOf. No further changes to membership. |
Why is Microsoft discontinuing this?
Microsoft states that the MemberOf operator required too much processing power and slowed down the processing of dynamic groups across the entire tenant, even if there was only one group with MemberOf rules.
The impact on other tenants was significant enough to lead to the service being shut down completely.
They do, however, acknowledge that the underlying scenarios for which MemberOf was used are legitimate, and that an alternative is currently being developed.
Exactly what that alternative is and when it will become available has not yet been announced.
What are the technical alternatives?
Microsoft suggests two options. The first is to rewrite the MemberOf rule based on user attributes, such as department, job title or an extension attribute. If your source groups are already based on those attributes, you can simply skip the intermediate step and use the attribute rule directly.
This approach only works if the attributes in Entra ID are filled in consistently, which is precisely the sticking point in many school tenants.
The second option is to convert the dynamic group into an assigned group and manage membership manually or via a script. Please note: during the conversion, all current members will be removed and you will need to add them again. This is feasible for small groups. For a school with hundreds of classes, year groups, licence groups and administrative units, this is not a realistic approach.
An alternative third option – a PowerShell script that reads the source groups and updates the target group’s membership – is technically feasible but requires maintenance, planning and monitoring.
It is not a real-time solution; there is always a delay between a change in the source group and its being reflected in the target group. And it requires someone at the school to run and monitor that script, even at the end of the year when things are already very busy.
Would you like to learn more about PowerShell?
Be sure to check out our two PowerShell courses.
Our solution: EDU-Sync
Automatic management for schools
At Edu-tech, we have developed our own solution to this specific problem: Edu-sync. Edu-sync has been specifically designed for schools and school authorities that wish to synchronise their Microsoft 365 environment with their existing administrative applications and timetable systems, without having to rely on unreliable scripts or manual interventions.
Edu-sync integrates with the timetable and pupil administration systems that schools already use and automatically maps that information to the correct Entra ID groups, licence allocations, Teams classes and administrative units. At the start and end of each school year, the transition takes place automatically: new pupils are granted the correct access, whilst former pupils are correctly removed from the system.
School groups can also use Edu-sync to manage the structure across multiple schools, with centralised control over access policies and licence allocation for each institution.
We do not use fixed structures or templates; instead, everything is tailor-made for the school, meaning the possibilities are virtually endless.
It also integrates with Google Workspace, enabling centralised and automated user management across all platforms.
The MemberOf retirement is not a problem for Edu-sync customers: the logic is not contained in dynamic Entra rules, but in the synchronisation itself.
No freezing, no incorrect settings, no manual follow-up after 3 November.
Further information and demo requests: edu-sync.be
