Overview of the video
In a clear and practical presentation, Andy Malone [MVP] explains recent changes to Microsoft Entra Dynamic Groups and focuses on an important shift affecting the memberOf capability. He walks viewers through how dynamic membership rules work, demonstrates both user and device group builds, and highlights where administrators must act before a mandatory change. The video mixes demos with guidance on rule operators and performance considerations, making it useful for identity and IT teams who manage Microsoft Entra at scale.
How dynamic groups work
Malone begins by explaining that dynamic groups automatically add or remove users and devices when attributes change, which reduces manual administration. When a directory attribute updates, Entra evaluates relevant membership rules and updates group membership without human intervention, which supports cleaner lifecycle management. He also clarifies the difference between Assigned (static) groups and dynamic groups, and shows how tenants can swap membership types in the admin center when needed.
The video then covers practical limits and typical use cases, including how organizations rely on dynamic groups for app assignment and licensing. Malone notes that the platform supports large deployments and that Microsoft currently allows up to 15,000 dynamic membership groups per tenant for standard scenarios. He emphasizes building efficient rules in the rule builder or using rule syntax directly to balance maintainability and performance.
The memberOf change and its effects
A central point of the presentation is Microsoft’s retirement of the public-preview memberOf rule operator, which will stop recalculation after November 3, 2026. Malone explains that groups, dynamic administrative units, and entitlement auto-assignment policies relying on memberOf will stop updating and remain frozen at their last processed state unless remediated. This creates immediate risk to licensing, app assignments, and any automation that depends on current group membership.
He also details the preview limits tied to the feature: tenants were limited to 500 dynamic groups using memberOf, and each such group could reference up to 50 member groups. Given those constraints, many organizations used memberOf specifically to flatten nested group scenarios for assignment workflows, so the retirement forces administrators to rethink nested strategies and reconcile group design across the directory.
Tradeoffs and operational challenges
Malone carefully discusses tradeoffs. While memberOf previously simplified nested group logic, removing it reduces a convenient shortcut and may push teams to adopt more attribute-driven rules or manual maintenance. Transitioning away from nested logic can improve transparency and rule performance, yet it may increase initial migration work and complexity for organizations that built many dependent processes.
He also flags performance and rule-efficiency considerations: operators such as Match and Contains often slow processing, whereas simpler operators like Equals, StartsWith, EndsWith, and -in are preferable where they fit the logic. As a result, teams must balance rule precision against recalculation cost, and they must anticipate downstream impacts such as access reviews, licensing consistency, and automated provisioning that assume up-to-date group membership.
Recommendations and next steps for administrators
Practically, Malone urges administrators to inventory any dynamic groups, administrative units, and entitlement policies using memberOf and to replace those rules ahead of the retirement deadline. If a group does not need to be dynamic, converting it to Assigned can be a stopgap, but this increases manual maintenance and may not suit environments that require automated lifecycle control. He also recommends validating downstream effects after any change, especially where app assignment and license provisioning depend on group membership.
Finally, he stresses testing and monitoring as essential steps: test replacements in a pilot tenant, confirm performance improvements by choosing efficient operators, and audit automation that consumes group membership. For teams that need help, Malone offers to share migration checklists and audit approaches, while reminding administrators that careful planning now will reduce service interruptions and protect entitlements when the memberOf preview retires.
