Project Engineer - Microsoft 365, Entra & Azure

SUMMARY

We are hiring a Project Engineer to deliver Microsoft 365, identity, and migration projects for our clients. This is hands-on cloud engineering, not advisory work: you build and harden tenants, untangle hybrid identity, manage devices through Intune, and move mail, files, and users between platforms without losing data or a weekend.

You will work across many client tenants at once, typically with two to five projects running in parallel at different stages. Each project is yours to execute — discovery, build, pilot, cutover, handover — with a senior engineer available for architecture calls.

JOB RESPONSIBILITIES

Migrations

· Run mailbox, tenant, file, and domain migrations end to end using various migration tools — discovery, pilot group, cutover plan, cutover, post-cutover support.

· Agree rollback criteria and a downtime window with the client before the window opens, and hold to them.

· Reconcile what actually moved against what was supposed to move, and chase the difference.

Microsoft 365 and Entra ID

· Build and harden tenants: Entra ID, Conditional Access, MFA, SSPR, Exchange Online mail flow, SharePoint and OneDrive structure, Teams provisioning.

· Configure and troubleshoot hybrid identity — Entra Connect and Cloud Sync, OU and attribute filtering, sync errors, UPN and domain suffix changes, soft-match and hard-match object merges, immutableID collisions.

· Diagnose mail flow fast when it breaks: MX, SPF, DKIM, DMARC, Autodiscover, connectors, transport rules, message trace.

Azure and endpoints

· Deploy and maintain Azure infrastructure: VMs, virtual networks, NSGs, site-to-site VPN, Azure Files, Azure Backup, and Azure Virtual Desktop where clients use it.

· Manage client devices through Intune: Autopilot enrolment, compliance and configuration profiles, app packaging and deployment, BitLocker and Defender policy, update rings.

Delivery and handover

· Write the as-built documentation into IT Glue and brief the service desk, so nothing undocumented is left behind.

· Keep project time and status current in the PSA so account managers can see where things stand.

· Join client calls to explain what is changing, what will briefly break, and when.

Requirements

• 5-10 years in IT overall, with at least 2 years administering Microsoft 365 and Entra ID across more than one organization or tenant.
  
• At least five migrations you personally executed — mailbox, tenant-to-tenant, file, or Active Directory domain — with the tooling you used named.
  
• You own the technical execution and escalate architecture decisions. You are not expected to design a client's identity strategy from scratch; you are expected to implement one correctly and spot when it is wrong
  

All four of the pillars below are required. Within each, you should be able to do most of what is listed without supervision.

1. Microsoft 365 administration

· Exchange Online: mail flow, connectors, transport rules, shared and resource mailboxes, mailbox delegation, message trace, retention basics

· Mail DNS: MX, SPF, DKIM, DMARC, Autodiscover, and what TTL does to a cutover

· SharePoint Online and OneDrive: site and library creation, permission inheritance, sharing policies, sync troubleshooting

· Microsoft Teams: provisioning, guest access, and how Teams relates to the SharePoint site behind it

· Microsoft 365 admin center, license assignment, and group-based licensing

2. Entra ID (formerly Azure AD)

· Users, groups, dynamic groups, administrative roles and units

· Entra Connect Sync or Cloud Sync: installation, OU and attribute filtering, and resolving sync errors

· Hybrid join versus Entra join, and when each applies

· Conditional Access policy design, MFA rollout, SSPR, and why security defaults are not enough

· Enterprise applications and SAML or OIDC single sign-on

3. Azure

· Virtual machines, virtual networks, NSGs, public IPs, site-to-site VPN

· Azure Files with AD DS or Entra authentication; Azure Virtual Desktop basics

· Azure Backup and Recovery Services vaults

· Subscriptions, resource groups, RBAC, and enough cost management to not surprise a client

4. Intune

· Enrollment: Windows Autopilot, co-management, BYOD, Apple and Android enrollment

· Compliance policies, configuration profiles, and the Settings Catalog

· App deployment: Win32 packaging (.intunewin), Store apps, and line-of-business apps

· BitLocker policy and Defender for Endpoint onboarding

· Update rings and Windows Update for Business

5. Migration delivery — demonstrable experience in at least two of:

· On-premises Exchange to Exchange Online: cutover, staged, or hybrid using the Hybrid Configuration Wizard

· Tenant-to-tenant migration following an acquisition, divestiture, or rebrand

· Google Workspace or IMAP to Microsoft 365

· File server or NAS to SharePoint Online, OneDrive, or Teams

· Active Directory domain migration or consolidation: ADMT, SID history, forest trusts, UPN suffix change, workstation re-domain

· Another MDM platform into Intune

6. Windows Server and AD DS

· Active Directory Domain Services, DNS, DHCP, Group Policy, file and print services

· Hyper-V setup and configuration

7. PowerShell

· Bulk operations against Exchange Online, Microsoft Graph, and Entra

· You read and modify scripts rather than only running ones you found

8. Working style

· Experience working on a fully remote team.

· Client-facing: comfortable explaining a downtime window to a non-technical stakeholder.

· Documentation discipline — across many tenants, undocumented work is lost work.

· Available for scheduled after-hours and weekend cutover windows.

· Prior MSP or multi-client experience.

Security and compliance: Microsoft Purview (DLP, retention, sensitivity labels, eDiscovery), Defender for Office 365, Defender for Cloud Apps, Secure Score remediation, CIS benchmarks, HIPAA or CMMC-adjacent client work

Privileged identity: Privileged Identity Management, access reviews, entitlement management

Automation: Power Automate, Power Apps, Azure Automation, Logic Apps, Graph API scripting beyond cmdlets

CERTIFICATION:

· At least one current Microsoft role-based certification, or demonstrable equivalent experience. Examples:

Certification

Microsoft 365 Administrator Expert

Identity and Access Administrator

Endpoint Administrator

Azure Administrator Associate

Windows Server Hybrid Administrator

Teams Administrator

Security Operations Analyst