Senior Azure & M365 Platform Engineer

Position Description

Purpose
The Senior Azure & M365 Platform Engineer plans, designs, implements, and operates identity, access, and endpoint services across Teichert's hybrid Active Directory / Entra t. This senior role leads SSO, MFA, and MDM initiatives, serves as the senior technical authority on Azure and Microsoft 365 platforms, and partners with security, networking, and end-user computing teams. The position combines hands-on architecture and administration with project delivery, automation, Tier 3 escalation, and mentorship of junior administrators.
Focus & Scope
Essential duties and responsibilities, i.e. those which are basic, necessary, and an integral part of the job, are indicated below:

Architects and administers on-premises Active Directory (forests, domains, replication, Group Policy, DNS, DHCP, DFS) integrated with Entra  Entra Connect, including password hash sync, pass-through authentication, and seamless SSO; maintains hybrid identity health and remediates replication, sync, and authentication issues across the estate.

Implements SSO and MFA across cloud and on-premises applications using Entra , AD FS, SAML, OAuth 2.0, and OpenID Connect including Conditional Access policies, authentication strengths, passwordless, and risk-based access controls.

Manages identity governance: RBAC, Privileged Identity Management (PIM), just-in-time access, access reviews, and tiered admin models; audits AD and Entra  security baselines and remediates findings.

Implements MDM with Microsoft Intune for Windows, iOS, Android, and macOS endpoints; enrollment, configuration profiles, compliance policies, app deployment, app protection policies, and endpoint compliance signals feeding Conditional Access; administers Windows Autopilot, co-management with Configuration Manager, Windows Update for Business, and Bit Locker key escrow.

Administers Azure infrastructure (VMs, VNets, NSGs, storage, hybrid connectivity via Express Route/VPN/Azure Arc) and governance (management groups, subscriptions, RBAC, Azure Policy, Key Vault, Azure Monitor/Log Analytics, cost and tagging); builds and maintains infrastructure as code with Bicep, ARM, or Terraform and CI/CD pipelines in Azure Dev Ops or Git Hub Actions; maintains Windows Server roles (domain controllers, AD CS/PKI) and Windows endpoint baselines via Group Policy and Intune aligned to CIS Benchmarks and NIST 800-171.

Builds identity lifecycle automation across AD, Entra , Microsoft 365, and downstream apps; HRIS-driven joiner/mover/leaver (JML) workflows via Power Shell, Microsoft Graph, Entra  workflows, and SCIM; automates license assignment, group/Teams membership, mailbox and One Drive provisioning, and role/department/location-based entitlements; executes secure offboarding (access revocation, session termination, MFA removal, mailbox conversion/retention, data preservation) and partners with HR, Security, and app owners on source-of-truth integrations and lifecycle audit readiness.

Develops Power Shell, Microsoft Graph, and Azure CLI automation across AD, Entra , Intune, Azure, and Microsoft 365; manages source control, code reviews, and pipeline-based release of configuration and policy artifacts; builds runbooks and self-service tooling that reduce toil and improve change quality.

Leads infrastructure projects including SSO rollouts, MFA deployments, MDM enrollments, tenant migrations, and SharePoint/Teams migrations (Sharegate preferred); produces architectural diagrams, design documents, runbooks, and standard operating procedures.

Acts as Tier 3 escalation for Azure, Microsoft 365, identity, and endpoint incidents and serves as subject matter expert on related change and problem records; mentors junior administrators and partners with the service desk to improve L1/L2 resolution.

Administers Microsoft 365 services (Exchange Online, SharePoint Online, One Drive, Teams) for availability, performance, and adoption including Teams provisioning and lifecycle governance, meeting/messaging policies, third-party and LOB app management, and guest/external access; monitors M365 service health and usage analytics to drive adoption, optimize licensing, and…