Skip to content
MitoMito Docs

MT.1197: Remove memberOf rules.
ID MT.1197
Severity Medium
Suite Mito
Product Entra ID
Feature Groups
Security area Identity lifecycle and hygiene
Resource type Group
User impact of fixing Low
Effort to fix Medium
Reads from Microsoft Graph

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Dynamic groups should not use the retiring memberOf rule operator.

Microsoft is ending the memberOf public preview on November 3, 2026. After that date, dynamic groups that still use the operator stop updating and remain in their last known state. Stale membership can leave outdated application access, Conditional Access targeting, Microsoft 365 access, or group-based licensing in place.

This test detects both user.memberOf and device.memberOf rules. It also reports source groups, processing state, license assignments, and Conditional Access references to help prioritize migration.

Remediation action:

Section titled “Remediation action:”
  1. In the Microsoft Entra admin center, open Entra ID > Groups > All groups.
  2. Open each reported group and record its current effective membership and downstream assignments.
  3. Replace memberOf with supported attribute-based rules or convert the group to assigned membership.
  4. Validate membership and every application, Conditional Access policy, Microsoft 365 resource, and license assignment that consumes the group.
  5. Remove obsolete rules and groups. Pausing processing alone does not complete the migration.
Section titled “Related links”

Mito check. Author: agnivesh. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.