IT & AI brief, 29 October 2026: Entra MemberOf rules stop on 3 November, eMudhra CA keys blocked
Entra dynamic groups using MemberOf stop processing on 3 November, Windows and Edge block eight compromised eMudhra CA keys, and Frontier early access widens to Teams, Outlook, OneDrive and SharePoint.
The most urgent change is in Microsoft Entra ID: dynamic groups, administrative units and access package policies that use the MemberOf operator stop processing on 3 November 2026. Microsoft is also pushing certificate trust updates to block compromised eMudhra certificate authority keys. We found no new CISA advisories we could confirm on a primary source for this window.
Entra ID: MemberOf rule operator retires on 3 November
What changed: MC1529463 (28 October) is the final reminder that the MemberOf rule operator, a public preview feature, retires worldwide on 3 November 2026. Microsoft says it can affect dynamic membership processing across a tenant. After that date, affected dynamic groups, dynamic administrative units and entitlement management auto-assignment policies stop updating and keep their last known state.
Who is affected: Tenants using MemberOf in dynamic groups, dynamic administrative units or auto-assignment policies. Stale membership can mean new users miss licences or access, leavers keep them, and Conditional Access evaluates outdated groups.
What to do: Find rules containing MemberOf, replace them with supported operators or convert the group to assigned membership, then check the resulting membership. Use Microsoft Graph PowerShell for administrative units and access package policies. Background: /blog/entra-id-dynamic-groups-rules.
Windows and Edge block compromised eMudhra CA keys
What changed: MC1529467 says eight eMudhra intermediate CA private keys, six for TLS and two for code signing, could be recovered, so an attacker could issue certificates that look trusted. The fault was in eMudhra's hierarchy, not Microsoft's systems. Microsoft is updating the Disallowed Certificate Trust List, sending a CRLSet update to Edge and WebView2, and removing the affected hierarchies from trust lists. Rollout starts and is expected to finish in late October 2026 in all clouds. The post mentions both eight keys and seven certificates being removed, so confirm the exact list against Microsoft's published guidance.
Who is affected: Organisations using Windows, Edge or WebView2, particularly anyone whose certificates chain to these CAs, and disconnected Windows or Azure devices.
What to do: Keep automatic certificate trust and Edge component updates flowing. Deliver the updated trust list manually to devices that do not update automatically, use refreshed Azure Marketplace images for VM Scale Sets and single VMs, and inventory certificates that chain to the affected CAs so you can replace them.
Frontier early access expands beyond Copilot
What changed: MC1529472 says the Frontier program will include eligible public previews for Teams, the new Outlook for Windows, OneDrive and SharePoint, starting in November 2026. A Copilot licence is no longer required to enrol, though users need a licence for each product they preview. Targeted release retires in January 2027, and its users are not enrolled automatically.
Who is affected: Admins who manage early access, and any tenant where Frontier is set to All users.
What to do: Open Copilot settings in the Microsoft 365 admin center and review Copilot Frontier. If it is set to All users, consider switching to Specific users and groups and starting with an IT pilot group. Add Targeted release users who still want previews.
Azure Backup: cross-tenant restore in public preview
What changed: AZ577117 announces a public preview of restoring Azure VM backups into a separate Azure tenant, giving an independent recovery path from the existing backup copy without extra backup data.
Who is affected: Azure admins who protect VMs with Azure Backup and plan for tenant-level compromise or ransomware recovery.
What to do: No action is required. Prerequisites, regions and a general availability date are not on the announcement page, so read the linked documentation before testing in a non-production tenant. Related guide: /blog/azure-backup-vm-recovery-services-vault.
Defender for Office 365: submission tables in Advanced Hunting, delayed
What changed: MC1484009 adds two Advanced Hunting tables, SubmissionEvents and SubmissionResults, for querying email submissions and their results and using them in custom detections. The 28 October update pushed the schedule back: public preview begins in mid-November 2026 and general availability from late November, finishing by mid-December.
Who is affected: Security teams that investigate user-reported and admin-submitted email in Defender XDR.
What to do: No action is needed now. Update any internal plans that assumed an earlier date, and prepare queries once the tables appear. Query basics: /blog/advanced-hunting-kql-identity-attacks.
Also worth knowing
Was this helpful?
Get the next guide
Free checklists and new guides: a short weekly digest on Sundays, or an email each day with new articles. Unsubscribe in one click.
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.