Entra.Chat·Aug 25, 2026·42m·Episode #72

Microsoft Entra memberOf Retirement: What Admins Must Do

Download audio Show notes Apple Podcasts

Show notes

It was a preview feature for four years. It is in a lot of production tenants.

In this episode of Entra.Chat, Merill is joined by three guests for the first time: Gregor Reimling, Chief Azure Technologist at adesso SE and Microsoft MVP for Azure and Security; René Wasel, a Microsoft 365 specialist and Microsoft MVP; and returning guest Eric Woodruff, Chief Identity Architect at Semperis. Gregor and René co-organise the Cloud Identity Summit, which happens to fall on the same date the deprecation lands.

The conversation starts with the deadline and quickly becomes something more useful: an honest audit of what groups in Entra actually do, versus what administrators assume they do.

The memberOf operator existed because Entra does not resolve nested groups the way Active Directory does. It was a flattening trick — take the members of several groups and produce one flat group that applications, licensing and policies could read. With it going away, the panel walks through the realistic replacements: move to supported attribute-based rules where an attribute exists, stamp an attribute with PowerShell where one does not, or convert the group to assigned membership and script it. Gregor and René both raise the version of this that is easy to forget — a rule written years ago that nobody documented, using a sync rule editor nobody wants to reopen.

Then the discussion turns to the part that is not on any deprecation notice. Nested groups are supported in Conditional Access. They are not supported for group-based licensing, where only first-level members get a licence. They are not supported for Global Secure Access, where a nested group assigned to a traffic forwarding profile applies only to its direct members with no error, no warning, and nothing in the portal to tell you. Chris Brumm found that one and wrote a Maester test for it, because the only way to know is to go looking.

There is a new group property that blocks nesting in both directions, undocumented when this was recorded. Sensitivity labels have reached Entra security groups in preview, bringing a guest-access control that stops new guests but does not evict the ones already in the group. And Merill spotted something through Entra.News Daily that deserves more attention than it has had: an agent’s user account is a user identity, so existing dynamic user rules already evaluate it. If your licensing group has a broad rule and your developers start creating agent accounts, those accounts qualify. If it is a group behind a Conditional Access policy or an exclusion, that is a different conversation entirely.

Which leads to the sharpest point in the episode, and Eric makes it plainly: the security of a dynamic group is the security of the write permissions on the attributes in its rule. Some of those attributes are self-service. Some flow up from on-premises Active Directory, changed by people who are not thinking about the cloud at all. Microsoft Learn now carries an explicit warning about exactly this, and it is why groups used for privileged access cannot be dynamic.

The last third is about the Cloud Identity Summit itself. More info below.

If you have memberOf in a rule anywhere, the useful thing to do this week is find it. Everything else in this episode can wait until after November.

Featured sponsor

Cloud Identity Summit 2026 → One Day, One Topic, In the Room

Identity. Security. 2026. On Tuesday 3 November in Frankfurt, the Cloud Identity Summit gives cloud identity a conference of its own, now in its seventh year, and free to attend.

Two parallel tracks, Identity Management and Identity Security, run 50-minute sessions in English. It is deliberately vendor-neutral: Microsoft Entra, AWS, Google Cloud and whatever else you actually run. Eric Woodruff keynotes with Identity Security Kindergeburtstag fourteen years of identity being called “the new security perimeter”, and an honest look at what that has actually got us.

Why it is worth the trip:

* It is in person only. No livestream, no catch-up recordings. The organisers built it that way on purpose — “a strong focus on face-to-face conversations to support networking and exchange of experiences.” If you want the hallway conversation, you have to be in the hallway.

* Everything is identity. No filler tracks. A whole day of people who work on the same problems you do, from an international mix of industries.

* The Community Ticket is 100% free. There is an optional paid Supporter Ticket if you want to help fund the event.

* It is easy to get to. adesso SE, Prisma Frankfurt-Niederrad — around ten minutes by S-Bahn from Frankfurt Airport, ten from Frankfurt Hauptbahnhof, and a short walk from Frankfurt-Niederrad station.

* Travelling in? The Crowne Plaza Frankfurt is a ten-minute walk, €89 single with breakfast on the “Cloud Identity Summit” booking code — 50 rooms, held until 5 October.

One more thing, given what this episode is about: 3 November is also the day Microsoft retires the memberOf operator. If you are going to spend that Tuesday thinking about Entra groups anyway, spend it in a room with people solving the same problem.

Subscribe with your favorite podcast player or watch on YouTube

About Gregor Reimling

Gregor is a Microsoft MVP in Azure and Security, Chief Azure Technologist at adesso SE, and a passionate advocate for the Microsoft cloud community. His expertise spans Azure architecture, Microsoft Entra, Zero Trust and hybrid cloud environments; he helps organizations successfully navigate their cloud journey. Beyond his day job, Gregor is a frequent speaker at international events, co-host of the Cloud Inspires podcast and co-founder of the Cloud Identity Summit. As a Microsoft Certified Trainer, he enjoys sharing knowledge, mentoring others, and helping IT professionals get the most out of Microsoft technologies.

LinkedIn - https://www.linkedin.com/in/gregorreimling/

About René Wasel

René is a Microsoft 365 specialist, and a Microsoft MVP for Microsoft 365. He describes his work as helping people actually use the technology they have been given, and he is active in the community as a meetup and event organiser. He co-organises the Cloud Identity Summit.

LinkedIn - https://www.linkedin.com/in/renewasel/

About Eric Woodruff

Throughout his 25-year career in the IT field, Eric has sought out and held a diverse range of roles. Currently the Chief Identity Architect for Semperis; Eric previously was a member of the Security Research and Product teams. Prior to Semperis, Eric worked as a Security and Identity Architect at Microsoft partners, spent time working at Microsoft as a Sr. Premier Field Engineer, and spent almost 15 years in the public sector, with 10 of them as a technical manager.

LinkedIn - https://www.linkedin.com/in/ericonidentity/

Related Links

* MC1448379 - Microsoft Entra ID: Replace MemberOf rules by November 3, 2026 - https://mc.merill.net/message/MC1448379

* Entra.News Daily, Merill’s daily diff of Microsoft Entra documentation changes (mentioned at 26:26) - https://daily.entra.news/changes/2026-08-14/manage-rules-for-dynamic-membership-groups-in-microsoft-entra-id-16/

* Maester, the open-source test framework used for the dynamic-group and nested-group checks discussed (mentioned at 06:09 and 30:06) - https://maester.dev/contributors/agnivesh

* Configure dynamic membership groups with the memberOf operator - the official retirement notice and migration guidance - https://learn.microsoft.com/entra/identity/users/groups-dynamic-rule-member-of

* Manage rules for dynamic membership groups - covers agent user accounts and the attribute write-permission warning - https://learn.microsoft.com/entra/identity/users/groups-dynamic-membership

* Assign users and groups to Global Secure Access traffic forwarding profiles - confirms nested groups are not supported (discussed at 15:50) - https://learn.microsoft.com/entra/global-secure-access/how-to-manage-users-groups-assignment

* Group-based licensing - confirms only first-level members receive licences - https://learn.microsoft.com/entra/fundamentals/concept-group-based-licensing

* Assign sensitivity labels to Microsoft Entra security groups (preview) (discussed at 25:09) - https://learn.microsoft.com/entra/identity/users/groups-sensitivity-labels

* Eric’s Cloud Identity Summit keynote, “Identity Security Kindergeburtstag” (mentioned at 34:12) - https://www.identitysummit.cloud/speaker

Related Entra.Chat Episodes

* Operational Groups in Entra with Nathan McNulty - https://entra.news/p/operational-groups-in-entra-with

* Mastering Microsoft Entra ID: Real-World Passkey Deployment Tips - Eric’s previous episode, referenced at 02:12 - https://entra.news/p/mastering-microsoft-entra-id-real

* From Active Directory to AI Agents: The 25-Year Saga of Microsoft’s Identity - the keynote-turned-podcast Merill promised to link (mentioned at 40:16) - https://entra.news/p/from-active-directory-to-ai-agents

Chapters

00:00 Intro

01:17 Meet Gregor, René and Eric

02:12 Passkeys: what comes after the rollout

04:17 memberOf is being retired

06:45 Workarounds: attributes, PowerShell and sync rules

10:41 Why Entra wants your groups flat

14:36 Where nested groups silently fail

17:45 The new property that blocks nesting

19:27 AD-sourced groups vs Entra-sourced groups 25:09 Sensitivity labels come to security groups

26:23 Agents are already in your dynamic groups

28:23 Why dynamic groups are not a security control

31:31 Inside the Cloud Identity Summit

35:21 Identity is not the “new” perimeter

41:44 November 3, tickets and wrap-up

Podcast Apps

Apple Podcast - https://entra.chat/apple

YouTube - https://entra.chat/youtube

Spotify - https://entra.chat/spotify

Overcast - https://entra.chat/overcast

Pocketcast - https://entra.chat/pocketcast

Others - https://entra.chat/rss

Merill’s socials

YouTube - youtube.com/@merillx

LinkedIn - linkedin.com/in/merill

Twitter - twitter.com/merill

TikTok - tiktok.com/@merillf

Bluesky - bsky.app/profile/merill.net

Mastodon - infosec.exchange/@merill

Threads - threads.net/@merillf

GitHub - github.com/merill

Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe

← Previous

Pass-the-Passkey: What Michael Grafnetter's Black Hat Research Means for Entra Admins

On 3 November 2026, the memberOf operator in Microsoft Entra dynamic membership groups stops working. Nothing errors. Nothing breaks loudly. Every dynamic group, dynamic administrative unit and entitlement management auto-assignment policy that uses it simply freezes in its last known state the people who should be added are not added, and the people who should be removed stay. It was a preview feature for four years. It is in a lot of production tenants. In this episode of Entra.Chat, Merill is joined by three guests for the first time: Gregor Reimling, Chief Azure Technologist at adesso SE and Microsoft MVP for Azure and Security; René Wasel, a Microsoft 365 specialist and Microsoft MVP; and returning guest Eric Woodruff, Chief Identity Architect at Semperis. Gregor and René co-organise the Cloud Identity Summit, which happens to fall on the same date the deprecation lands. The conversation starts with the deadline and quickly becomes something more useful: an honest audit of what groups in Entra actually do, versus what administrators assume they do. The memberOf operator existed because Entra does not resolve nested groups the way Active Directory does. It was a flattening trick — take the members of several groups and produce one flat group that applications, licensing and policies could read. With it going away, the panel walks through the realistic replacements: move to supported attribute-based rules where an attribute exists, stamp an attribute with PowerShell where one does not, or convert the group to assigned membership and script it. Gregor and René both raise the version of this that is easy to forget — a rule written years ago that nobody documented, using a sync rule editor nobody wants to reopen. Then the discussion turns to the part that is not on any deprecation notice. Nested groups are supported in Conditional Access. They are not supported for group-based licensing, where only first-level members get a licence. They are not supported for Global Secure Access, where a nested group assigned to a traffic forwarding profile applies only to its direct members with no error, no warning, and nothing in the portal to tell you. Chris Brumm found that one and wrote a Maester test for it, because the only way to know is to go looking. There is a new group property that blocks nesting in both directions, undocumented when this was recorded. Sensitivity labels have reached Entra security groups in preview, bringing a guest-access control that stops new guests but does not evict the ones already in the group. And Merill spotted something through Entra.News Daily that deserves more attention than it has had: an agent’s user account is a user identity, so existing dynamic user rules already evaluate it. If your licensing group has a broad rule and your developers start creating agent accounts, those accounts qualify. If it is a group behind a Conditional Access policy or an exclusion, that is a different conversation entirely. Which leads to the sharpest point in the episode, and Eric makes it plainly: the security of a dynamic group is the security of the write permissions on the attributes in its rule. Some of those attributes are self-service. Some flow up from on-premises Active Directory, changed by people who are not thinking about the cloud at all. Microsoft Learn now carries an explicit warning about exactly this, and it is why groups used for privileged access cannot be dynamic. The last third is about the Cloud Identity Summit itself. More info below. If you have memberOf in a rule anywhere, the useful thing to do this week is find it. Everything else in this episode can wait until after November. Featured sponsor Cloud Identity Summit 2026 → One Day, One Topic, In the Room Identity. Security. 2026. On Tuesday 3 November in Frankfurt, the Cloud Identity Summit gives cloud identity a conference of its own, now in its seventh year, and free to attend. Two parallel tracks, Identity Management and Identity Security, run 50-minute sessions in English. It is deliberately vendor-neutral: Microsoft Entra, AWS, Google Cloud and whatever else you actually run. Eric Woodruff keynotes with Identity Security Kindergeburtstag fourteen years of identity being called “the new security perimeter”, and an honest look at what that has actually got us. Why it is worth the trip: * It is in person only. No livestream, no catch-up recordings. The organisers built it that way on purpose — “a strong focus on face-to-face conversations to support networking and exchange of experiences.” If you want the hallway conversation, you have to be in the hallway. * Everything is identity. No filler tracks. A whole day of people who work on the same problems you do, from an international mix of industries. * The Community Ticket is 100% free. There is an optional paid Supporter Ticket if you want to help fund the event. * It is easy to get to. adesso SE, Prisma Frankfurt-Niederrad — around ten minutes by S-Bahn from Frankfurt Airport, ten from Frankfurt Hauptbahnhof, and a short walk from Frankfurt-Niederrad station. * Travelling in? The Crowne Plaza Frankfurt is a ten-minute walk, €89 single with breakfast on the “Cloud Identity Summit” booking code — 50 rooms, held until 5 October. One more thing, given what this episode is about: 3 November is also the day Microsoft retires the memberOf operator. If you are going to spend that Tuesday thinking about Entra groups anyway, spend it in a room with people solving the same problem. Subscribe with your favorite podcast player or watch on YouTube About Gregor Reimling Gregor is a Microsoft MVP in Azure and Security, Chief Azure Technologist at adesso SE, and a passionate advocate for the Microsoft cloud community. His expertise spans Azure architecture, Microsoft Entra, Zero Trust and hybrid cloud environments; he helps organizations successfully navigate their cloud journey. Beyond his day job, Gregor is a frequent speaker at international events, co-host of the Cloud Inspires podcast and co-founder of the Cloud Identity Summit. As a Microsoft Certified Trainer, he enjoys sharing knowledge, mentoring others, and helping IT professionals get the most out of Microsoft technologies. LinkedIn - https://www.linkedin.com/in/gregorreimling/ About René Wasel René is a Microsoft 365 specialist, and a Microsoft MVP for Microsoft 365. He describes his work as helping people actually use the technology they have been given, and he is active in the community as a meetup and event organiser. He co-organises the Cloud Identity Summit. LinkedIn - https://www.linkedin.com/in/renewasel/ About Eric Woodruff Throughout his 25-year career in the IT field, Eric has sought out and held a diverse range of roles. Currently the Chief Identity Architect for Semperis; Eric previously was a member of the Security Research and Product teams. Prior to Semperis, Eric worked as a Security and Identity Architect at Microsoft partners, spent time working at Microsoft as a Sr. Premier Field Engineer, and spent almost 15 years in the public sector, with 10 of them as a technical manager. LinkedIn - https://www.linkedin.com/in/ericonidentity/ Related Links * MC1448379 - Microsoft Entra ID: Replace MemberOf rules by November 3, 2026 - https://mc.merill.net/message/MC1448379 * Entra.News Daily, Merill’s daily diff of Microsoft Entra documentation changes (mentioned at 26:26) - https://daily.entra.news/changes/2026-08-14/manage-rules-for-dynamic-membership-groups-in-microsoft-entra-id-16/ * Maester, the open-source test framework used for the dynamic-group and nested-group checks discussed (mentioned at 06:09 and 30:06) - https://maester.dev/contributors/agnivesh * Configure dynamic membership groups with the memberOf operator - the official retirement notice and migration guidance - https://learn.microsoft.com/entra/identity/users/groups-dynamic-rule-member-of * Manage rules for dynamic membership groups - covers agent user accounts and the attribute write-permission warning - https://learn.microsoft.com/entra/identity/users/groups-dynamic-membership * Assign users and groups to Global Secure Access traffic forwarding profiles - confirms nested groups are not supported (discussed at 15:50) - https://learn.microsoft.com/entra/global-secure-access/how-to-manage-users-groups-assignment * Group-based licensing - confirms only first-level members receive licences - https://learn.microsoft.com/entra/fundamentals/concept-group-based-licensing * Assign sensitivity labels to Microsoft Entra security groups (preview) (discussed at 25:09) - https://learn.microsoft.com/entra/identity/users/groups-sensitivity-labels * Eric’s Cloud Identity Summit keynote, “Identity Security Kindergeburtstag” (mentioned at 34:12) - https://www.identitysummit.cloud/speaker Related Entra.Chat Episodes * Operational Groups in Entra with Nathan McNulty - https://entra.news/p/operational-groups-in-entra-with * Mastering Microsoft Entra ID: Real-World Passkey Deployment Tips - Eric’s previous episode, referenced at 02:12 - https://entra.news/p/mastering-microsoft-entra-id-real * From Active Directory to AI Agents: The 25-Year Saga of Microsoft’s Identity - the keynote-turned-podcast Merill promised to link (mentioned at 40:16) - https://entra.news/p/from-active-directory-to-ai-agents Chapters 00:00 Intro 01:17 Meet Gregor, René and Eric 02:12 Passkeys: what comes after the rollout 04:17 memberOf is being retired 06:45 Workarounds: attributes, PowerShell and sync rules 10:41 Why Entra wants your groups flat 14:36 Where nested groups silently fail 17:45 The new property that blocks nesting 19:27 AD-sourced groups vs Entra-sourced groups 25:09 Sensitivity labels come to security groups 26:23 Agents are already in your dynamic groups 28:23 Why dynamic groups are not a security control 31:31 Inside the Cloud Identity Summit 35:21 Identity is not the “new” perimeter 41:44 November 3, tickets and wrap-up Podcast Apps Apple Podcast - https://entra.chat/apple YouTube - https://entra.chat/youtube Spotify - https://entra.chat/spotify Overcast - https://entra.chat/overcast Pocketcast - https://entra.chat/pocketcast Others - https://entra.chat/rss Merill’s socials YouTube - youtube.com/@merillx LinkedIn - linkedin.com/in/merill Twitter - twitter.com/merill TikTok - tiktok.com/@merillf Bluesky - bsky.app/profile/merill.net Mastodon - infosec.exchange/@merill Threads - threads.net/@merillf GitHub - github.com/merill Get full access to Entra.News - Your weekly dose of Microsoft Entra at entra.news/subscribe