Senior Azure & M365 Platform Engineer Job Sacramento area,California USA,IT/Tech

Purpose

The Senior Azure & M365 Platform Engineer plans, designs, implements, and operates identity, access, and endpoint services across Teichert's hybrid Active Directory / Entra t. This senior role leads SSO, MFA, and MDM initiatives, serves as the senior technical authority on Azure and Microsoft 365 platforms, and partners with security, networking, and end‑user computing teams. The position combines hands‑on architecture and administration with project delivery, automation, Tier 3 escalation, and mentorship of junior administrators.

Focus

& Scope

Essential duties and responsibilities, i.e. those which are basic, necessary, and an integral part of the job, are indicated below:

Architects and administers on‑premises Active Directory (forests, domains, replication, Group Policy, DNS, DHCP, DFS) integrated with Entra Entra Connect, including password hash sync, pass‑through authentication, and seamless SSO; maintains hybrid identity health and remediates replication, sync, and authentication issues across the estate.

Implements SSO and MFA across cloud and on‑premises applications using Entra , AD FS, SAML, OAuth 2.0, and OpenID Connect including Conditional Access policies, authentication strengths, passwordless, and risk‑based access controls.

Manages identity governance: RBAC, Privileged Identity Management (PIM), just‑in‑time access, access reviews, and tiered admin models; audits AD and Entra security baselines and remediates findings.

Implements MDM with Microsoft Intune for Windows, iOS, Android, and macOS endpoints; enrollment, configuration profiles, compliance policies, app deployment, app protection policies, and endpoint compliance signals feeding Conditional Access; administers Windows Autopilot, co‑management with Configuration Manager, Windows Update for Business, and Bit Locker key escrow.

Administers Azure infrastructure (VMs, VNets, NSGs, storage, hybrid connectivity via Express Route/VPN/Azure Arc) and governance (management groups, subscriptions, RBAC, Azure Policy, Key Vault, Azure Monitor/Log Analytics, cost and tagging); builds and maintains infrastructure as code with Bicep, ARM, or Terraform and CI/CD pipelines in Azure Dev Ops or Git Hub Actions; maintains Windows Server roles (domain controllers, AD CS/PKI) and Windows endpoint baselines via Group Policy and Intune aligned to CIS Benchmarks and NIST 800‑171.

Builds identity lifecycle automation across AD, Entra , Microsoft 365, and downstream apps; HRIS‑driven joiner/mover/leaver (JML) workflows via Power Shell, Microsoft Graph, Entra workflows, and SCIM; automates license assignment, group/Teams membership, mailbox and One Drive provisioning, and role/department/location‑based entitlements; executes secure offboarding (access revocation, session termination, MFA removal, mailbox conversion/retention, data preservation) and partners with HR, Security, and app owners on source‑of‑truth integrations and lifecycle audit readiness.

Develops Power Shell, Microsoft Graph, and Azure CLI automation across AD, Entra , Intune, Azure, and Microsoft 365; manages source control, code reviews, and pipeline‑based release of configuration and policy artifacts; builds runbooks and self‑service tooling that reduce toil and improve change quality.

Leads infrastructure projects including SSO rollouts, MFA deployments, MDM enrollments, tenant migrations, and SharePoint/Teams migrations (Sharegate preferred); produces architectural diagrams, design documents, runbooks, and standard operating procedures.

Acts as Tier 3 escalation for Azure, Microsoft 365, identity, and endpoint incidents and serves as subject matter expert on related change and problem records; mentors junior administrators and partners with the service desk to improve L1/L2 resolution.

Administers Microsoft 365 services (Exchange Online, SharePoint Online, One Drive, Teams) for availability, performance, and adoption including Teams provisioning and lifecycle governance, meeting/messaging policies, third‑party and LOB app management, and guest/external access; monitors M365 service health and usage analytics to drive adoption, optimize licensing, and communicate status to…