The public preview of the MemberOf rule operator is ending

The retirement date is November 3rd, 2026, except of course if your tenant has Microsoft Entra ID Governance then you have until March 31, 2027. If you’re not sure check the message center of your tenant for MC1488839.

As a backup solution for groups when they are converted from Dynamic to Assigned Membership, I prepared this short PowerShell script to perform the work for various security groups that were dependent upon the feature.

PowerShell script leveraging Microsoft Graph Module

function Set-GroupMembers
{
param (
[string[]]$sources,
[string]$target,
[switch]$WhatIf
)

# Get current members of the target group
$targetId = (Get-MgGroup -Filter “displayName eq ‘$target'” -Property Id).Id
$currentMembers = (Get-MgGroupMember -GroupId $targetId -All).Id

# Get all members from the source groups
$desiredMembers = @()
foreach ($source in $sources)
{
$sourceId = (Get-MgGroup -Filter “displayName eq ‘$source'” -Property Id).Id
$members = (Get-MgGroupMember -GroupId $sourceId -All).Id
$desiredMembers += $members
}

$desiredMembers = $desiredMembers | Select-Object -Unique

# Add missing members
$toAdd = $desiredMembers | Where-Object { $_ -notin $currentMembers }
foreach ($userId in $toAdd)
{
if (-not $WhatIf) {
New-MgGroupMember -GroupId $targetId -DirectoryObjectId $userId
}
Write-Host “Added: $userId” -ForegroundColor Green
}

# Remove members that should no longer be there
$toRemove = $currentMembers | Where-Object { $_ -notin $desiredMembers }
foreach ($userId in $toRemove)
{
if (-not $WhatIf) {
Remove-MgGroupMemberByRef -GroupId $targetId -DirectoryObjectId $userId
}
Write-Host “Removed: $userId” -ForegroundColor Red
}

Write-Host “Sync complete on $target. Added: $($toAdd.Count), Removed: $($toRemove.Count)” -ForegroundColor Cyan
}

$data = $jsonText | ConvertFrom-Json
foreach ($item in $data.PSObject.Properties) {
[string]$target = $item.Name
[string[]]$source = @($item.Value)

Set-GroupMembers -Sources $source -Target $target -WhatIf
}

The PowerShell script required the following scopes, if you’re using an App Registration make sure you grant those permissions.

Connect-MgGraph -Scopes "Group.ReadWrite.All", "GroupMember.ReadWrite.All"

The format of the JSON object is as follows:

If you have any comments or feedback let me know!