Microsoft 365 Identity Endpoint Administrator

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Technology Full-time Regular Professional Minneapolis, MN, US

2 days ago Requisition

Salary Range: $84,000.00 To $ Annually

Job Title:Microsoft 365, Identity & Endpoint Administrator

Job Type:Full-time, Exempt

Location:Minneapolis, MN (Hybrid)

Plus Relocation is looking for a hands-on Microsoft administrator with deep Active Directory and Group Policy experience who enjoys solving technical problems, helping colleagues locally and around the world, and making technology work better. This is more than a help desk role: you will own the full identity lifecycle across Active Directory and Entra , manage our Windows endpoints, and help us improve automation, security and the employee experience.

• Own the full identity lifecycle across on-prem Active Directory and Entra  up new-hire accounts ahead of start dates and keep them disabled until Day 1, process internal transfers by removing old access as well as adding new, and fully deprovision departing employees within 24 hours
• Design and maintain role-based access using security groups and the AGDLP model, applying least privilege to file shares, applications, and admin roles
• Administer Group Policy, OU structure, and delegation of control
• Run regular access reviews and cleanup of stale and orphaned accounts, unowned groups, nested-group sprawl, and privileged role membership, and produce audit-ready evidence
• Administer Microsoft 365 (Exchange Online, Teams, SharePoint) and manage Windows endpoints through Intune, Autopilot, configuration policies, updates, and application deployment
• Provide excellent hands‑on support for local employees, and remote support for US and global employees as needed, across devices, Microsoft 365, and business applications
• Build Power Shell and Microsoft Graph automations that run under dedicated service accounts, gMSAs, or app registrations, with documented permissions, ownership, and change control
• Partner with Security and Compliance on MFA, Conditional Access, data deletion, audits, and the responsible use of approved AI tools

• 3+ years of hands‑on Active Directory administration in a production domain: users, groups, OUs, delegation, DNS, and replication basics
• Demonstrated Group Policy experience: authoring, precedence and inheritance, security and WMI filtering, and troubleshooting with gpresult and RSOP
• Hybrid identity experience with Entra Connect or Cloud Sync, including sync scope, source of authority, and the difference between disabling a user on‑prem and in the cloud
• Practical knowledge of role‑based access and least privilege, including Entra admin roles, the tiered admin model, and separate admin accounts for privileged work
• Working Power Shell skills (Active Directory module and Microsoft Graph Power Shell) for bulk and scheduled identity tasks
• The ability to walk us through a complete offboarding from start to finish: disabling the account and resetting the password, revoking sessions and MFA methods, removing groups and licenses, handling the mailbox and One Drive, removing device access, and capturing evidence of each step
• Experience with NTFS and share permissions on Windows file servers
• Hands‑on Microsoft 365 administration, confident Windows troubleshooting, and solid networking fundamentals
• Clear communication, strong service instincts, sound security judgment, and ownership

• Intune and Autopilot, Microsoft Defender, Purview, Conditional Access, SaaS administration, and compliance or audit experience
• Certifications such…