Microsoft Entra ID Early August 2026: MemberOf Retirement, Passkey Adoption Campaigns, and Zero Trust VPN Replacement

August is shaping up to be a pivotal month for Microsoft Entra ID administrators. Between the looming September 1 passkeys-by-default rollout and a steady stream of new announcements, there’s a lot to track. Today’s update brings three significant developments: a breaking change for dynamic groups that will force many organizations to rethink their group architecture, an AI-powered tool to help manage the passkey migration, and new thought leadership on moving beyond traditional VPNs.

1. MemberOf Rule Operator Retirement — A Breaking Change for Dynamic Groups (MC1448379)

Announced today via Message Center notification MC1448379, Microsoft is ending the public preview of the memberOf rule operator in Entra ID on November 3, 2026. This operator, which has been in preview since approximately 2022, allowed administrators to create dynamic membership rules that pull members from existing groups rather than relying on user or device attributes. It will not be promoted to general availability.

What’s Affected

The retirement impacts three areas:

• Dynamic membership groups that use memberOf rules
• Dynamic administrative units that use memberOf rules
• Entitlement management auto-assignment policies that use memberOf rules

Key Dates

There is no opt-out and no extension available.

Why Microsoft Is Retiring It

The decision comes down to scale and reliability. Microsoft found that even a single memberOf rule in a tenant can cause tenant-wide processing delays across ALL dynamic groups — not just the one using the operator. This performance impact was fundamental enough that Microsoft decided the feature couldn’t be supported at scale, and rather than continuing to let organizations depend on a preview feature with these limitations, they’re retiring it.

Impact of Inaction

If you don’t migrate before the deadlines, the consequences are serious:

• Outdated access: New users won’t receive the access they need while former members retain access to Teams, SharePoint, and other resources
• Broken Conditional Access: Policies evaluating group memberships will be working with stale data
• Licensing drift: Group-based licensing will fail to assign or remove licenses correctly — users may retain licenses they shouldn’t have or miss licenses they need
• Stale administrative scope: Dynamic AUs will have outdated membership, affecting delegated administrative scope
• Frozen entitlement management: Auto-assignment policies will no longer add or remove access package assignments

How to Identify Affected Configurations

Start by running these PowerShell commands using the Microsoft Graph PowerShell module:

# Find dynamic groups using memberOf
Get-MgGroup -Filter "startsWith(membershipRule,'user.memberOf') or startsWith(membershipRule,'device.memberOf')" | Select-Object DisplayName, Id, MembershipRule, MembershipRuleProcessingState

# Find dynamic AUs using memberOf
Get-MgDirectoryAdministrativeUnit -All -Property Id, DisplayName, MembershipRule, MembershipType | Where-Object { $_.MembershipType -eq "Dynamic" -and $_.MembershipRule -match "memberOf" } | Select-Object DisplayName, Id, MembershipRule

For entitlement management auto-assignment policies, use Graph PowerShell to query access package policies that reference memberOf in their assignment rules.

The community has also stepped up — AdminDroid published a comprehensive PowerShell script that scans all three configuration types and generates CSV reports: Find Entra ID Configurations with Deprecated MemberOf Operator

Migration Options

Microsoft’s official guidance offers two primary paths, but there’s a third practical option:

Option 1: Replace with attribute-based dynamic rules. If the same membership can be expressed using user or device attributes (department, extensionAttribute, jobTitle, etc.), rewrite the rule. For example, if your memberOf group pulled in members of “Sales” and “Marketing” groups that were themselves defined by department, you can create a rule like user.department -in ['Sales','Marketing'].

Option 2: Convert to assigned membership. Change the group from Dynamic to Assigned in the Entra admin center (Groups > All Groups > open group > change Membership type from Dynamic to Assigned). Manage membership manually or through automation. Best for small groups or groups that don’t change often.

Option 3: PowerShell sync script. Build a scheduled script that reads the membership of your source groups and syncs it to the target group. This is the most flexible option and closely mimics the memberOf behavior, but it adds operational overhead and the script becomes a maintenance point.

Validation Before Switching

Whatever replacement you choose, validate it before deploying to production. Export the members of your old memberOf group, build your replacement, wait for processing to complete, export the new group’s members, and compare:

# Export members of the old memberOf group
$oldGroupId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
Get-MgGroupMember -GroupId $oldGroupId -All | Select-Object @{N='Id';E={$_.Id}} | Export-Csv -Path .\OldGroup-Members.csv -NoTypeInformation

# Export members of the new replacement group
$newGroupId = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy"
Get-MgGroupMember -GroupId $newGroupId -All | Select-Object @{N='Id';E={$_.Id}} | Export-Csv -Path .\NewGroup-Members.csv -NoTypeInformation

# Compare
$old = Import-Csv .\OldGroup-Members.csv
$new = Import-Csv .\NewGroup-Members.csv
$diff = Compare-Object -ReferenceObject $old.Id -DifferenceObject $new.Id
if ($diff) { Write-Host "Differences found:" -ForegroundColor Yellow; $diff | Format-Table -AutoSize }
else { Write-Host "Membership matches. Safe to switch." -ForegroundColor Green }

Community Reaction

The announcement has generated significant pushback from the IAM community. On Reddit’s r/sysadmin, Spiceworks, and LinkedIn, administrators have expressed frustration that a feature in preview for four years is being pulled without a direct replacement. Many organizations built licensing, Conditional Access, and application access architectures around memberOf during its extended preview period. The lack of a 1:1 alternative for nested group logic means significant rework for affected tenants.

This is a legitimate concern. While Microsoft’s performance reasoning is sound — tenant-wide processing degradation from a single rule is a real problem — the extended preview period created a false sense of permanence. Organizations that adopted memberOf in good faith now face a compressed timeline to rework their group architectures.

2. Passkey Adoption Campaigns with the Conditional Access Optimization Agent (Public Preview)

In better-timed news, Microsoft has introduced a powerful new tool to help organizations manage the upcoming passkey migration. The Conditional Access Optimization Agent, built on Security Copilot, now supports passkey adoption campaigns in public preview.

What It Does

The agent provides an AI-driven, structured approach to rolling out phishing-resistant authentication:

1. Assesses user and device readiness — Identifies which users have compatible devices, which need device updates, and which already have passkeys registered
2. Generates a deployment plan — Includes estimated campaign duration, number of targeted users, and a breakdown of user readiness categories
3. Guides users through steps — Sends Microsoft Teams notifications prompting users to update devices, register passkeys, or prepare for enforcement
4. Enforces Conditional Access policies — Automatically creates CA policies in report-only mode first, then enforces phishing-resistant authentication requirements once users are ready

The agent runs automatically every 24 hours to evaluate progress and advance users through the campaign stages as prerequisites are met.

Why This Matters Now

With passkeys becoming the default authentication method in Entra ID starting September 1, 2026, and Microsoft-provided SMS/voice authentication being retired on February 1, 2027, organizations need structured tools to manage this migration at scale. The passkey adoption campaign agent directly addresses this need.

Starting with privileged administrator users by default is the right security-first approach — these are the highest-value targets for attackers and the accounts where phishing-resistant authentication delivers the most immediate risk reduction.

Requirements and Limitations

Requirements:

• Microsoft Entra ID P1 license minimum
• Available Security Compute Units (SCU) — averages less than 1 SCU per agent run
• Passkeys must be enabled in the Authentication Methods Policy
• Security Administrator role required (Conditional Access Administrator alone is insufficient)

Limitations to be aware of:

• Campaign settings (targeting, grace periods, postponement) cannot be modified after the campaign starts — plan thoroughly before launching
• The agent doesn’t verify whether targeted users are enabled for passkeys in the Authentication Methods Policy — you must configure this prerequisite beforehand
• Postponement is currently only supported for users with Security Copilot Owner or Security Copilot Contributor roles
• Inactive devices are filtered out automatically (e.g., laptops not used in 8 months)
• Break-glass accounts should be explicitly excluded

How to Enable

1. Sign in to the Microsoft Entra admin center as at least a Security Administrator
2. Navigate to Conditional Access Optimization Agent > Settings
3. Under Agent capabilities, select Allow agent to create passkey adoption campaigns
4. The agent begins analyzing your tenant to identify users eligible for a passkey campaign

For detailed documentation, see Deploy passkey adoption campaigns with the Conditional Access Optimization Agent (Preview).

3. End VPN Gaps with Identity-First Access — New Thought Leadership

On August 5, Microsoft published a new blog post by Janice Ricketts titled “End VPN gaps with identity-first access.” While not a product announcement, it’s worth reading for anyone planning a VPN modernization initiative.

The Core Argument

Traditional VPNs extend network access but don’t continuously evaluate identity, device posture, location, user risk, or session context. This leaves AI apps, SaaS, on-premises applications, unmanaged services, and internet traffic unevenly protected. Zero Trust closes this gap by putting identity and policy at the center of every access decision.

The post positions Conditional Access as the policy engine and Global Secure Access (comprising Entra Internet Access and Entra Private Access) as the enforcement layer that extends identity-driven controls across all resource types.

Key Takeaways

• Apply Zero Trust principles everywhere — not just Microsoft 365 and core SaaS apps
• Use the same identity-driven model across AI apps, on-premises apps, SaaS, and internet traffic
• Extend risk-based Conditional Access beyond cloud apps to protect all resources
• Reduce complexity and cost by retiring VPN-heavy architectures in favor of policy-based access
• The goal is one reusable security model across all resource types rather than separate policy models for each

Practical Value

For organizations justifying VPN replacement initiatives to leadership, this post provides a concise framework for the business case: lower breach risk through automated policy-driven responses, faster operations through reduced VPN complexity, improved user experience, and better cost efficiency through reduced on-premises hardware and overlapping security tools.

What This Means for Your Organization

Immediate Actions (This Week)

1. Audit for memberOf usage — Run the PowerShell commands above to identify all affected dynamic groups, administrative units, and entitlement management policies. The October 27 deadline for entitlement management policies is less than 12 weeks away.

2. Inventory your SMS/voice MFA users — Use the entra-sms-voice-usage-analyzer PowerShell script to identify users still on SMS/voice before the September 1 auto-enablement.

3. Evaluate the CA Optimization Agent — If you have Security Copilot licensing, explore the passkey adoption campaign feature to automate your passkey migration for privileged users.

Short-Term Planning (Next 30 Days)

1. Build your memberOf migration plan — For each affected configuration, document its purpose (licensing, Conditional Access, Teams access, app assignment), choose a replacement strategy, and prioritize by complexity and impact.

2. Test passkey registration — Verify that your passkey profiles, authentication methods policy, and device compatibility are ready for the September 1 rollout.

3. Review VPN replacement roadmap — If you’re still relying on traditional VPNs for access to on-premises or cloud resources, use the Global Secure Access framework to evaluate a Zero Trust modernization initiative.

Key Dates Summary

Stay Informed

The Entra ID landscape is evolving rapidly. Between the passkey migration, memberOf retirement, and the broader shift toward AI-driven identity management, IT teams need to stay proactive. We’ll continue tracking these changes and providing actionable guidance as new announcements emerge.

Follow the conversation on X at https://x.com/kkaminsk for real-time updates and analysis.

Big Hat Group Inc. is a Microsoft partner with 20+ years of experience helping organizations navigate identity and security transformations. Contact us to discuss how these changes affect your environment and how we can help you plan your migration.