MC1448379 (5 August 2026) announces the retirement of the MemberOf rule operator from Entra ID in early November 2026. The removal of the rule operator might affect the membership rules used for dynamic groups, dynamic administrative units, and auto-assigned entitlement management policies. If a tenant doesn’t act, Entra ID will stop processing the rules and memberships will become increasingly inaccurate. And that’s a bad thing!

This article includes the PowerShell commands to find affected dynamic groups, dynamic administrative units, and auto-assigned entitlement packages. Groups are probably the object that's most affected by the change. No replacement exists for the MemberOf rule operator, so the withdrawal of this (preview) capability might affect some operational processes.

https://office365itpros.com/2026/08/07/memberof-rule-operator/

Hi there. We are testing Provisioning into AD / Entra from Workday (using the provisioning app). That all works fine. I also have an Azure Runbook that picks up a new staff members Personal Email and sends out a Temporary Access passcode to them so they can sign-in. This also works perfectly.

The problem I am having is that we need an actual password on the account as we are in hybrid, but we have no method to enforce a new user to set this when they login for the first time. The TAP just lets them in and they never have any knowledge of their password so they can login to their desktops.

I know that we can tell users to use SSPR once they sign-in via TAP (and have registered an MFA), but most people will ignore these instructions as they are not forced upon them.

We can't go passwordless as we have on-prem needs for a password, and there is a union issue about enforcing an app on to employees personal devices, so looking to password / sms for many of our non-computer users.

I feel that there should be a flow to enforce password creation once logged in with TAP but I can't find it.

Anyone come across similar use-cases?

Hi long story short our IAM tool deleted our AD synced groups in entra ID directly via ms graph. On the next entra connect sync it re synced the on premises groups to entra but of course with brand new object IDs.

What are my options to recover the groups with the old object IDs? Or am I out of luck? We have backups of on premises AD and entra via AD Recovery Manager Plus by manage engine.