Level 3 Yeti

What a Level 3 Yeti actually does Microsoft 365 — the whole tenant, not just the mailbox

You own M365 environments end to end for a book of small and mid-size business clients. That means Exchange Online mail flow and transport rules, SharePoint and One Drive architecture (including the sites people built badly in 2021 that we now have to live with), Teams governance, licensing that actually matches headcount, retention and litigation hold, and tenant-to-tenant migrations when a client gets acquired or splits.

You should be comfortable in the Exchange admin center, the Purview compliance portal, and the security dashboard — and comfortable telling a client that no, we're not turning off MFA because the owner finds it annoying.

SPF, DKIM, and DMARC should not be three letters you look up. Half of "our email is going to spam" tickets are a DNS record somebody fat-fingered, and we expect you to find it in ten minutes rather than escalating it to the void.

Entra  — identity is the perimeter now

Conditional Access policies designed on purpose, not copy-pasted from a blog post. MFA and passwordless rollouts that don't generate 40 password-reset tickets the next morning. Entra Connect / hybrid join, group strategy that scales past 12 users, app registrations and enterprise app SSO, PIM and role scoping so that not everyone is a Global Admin because it was easier that way in 2019.

You’ll be the one deciding what "least privilege" means for a 30-person construction company that has never heard the phrase. Then you’ll implement it without breaking their day.

Intune — devices, from box to bricked

Autopilot enrollment so a new hire’s laptop ships to their house and configures itself. Compliance and configuration policies, Bit Locker with key escrow that actually works when you need it, Defender for Endpoint integration, Win
32 and store app packaging and deployment, update rings, and remote wipe for the phone that went into the Virgin River.

Bonus points if you’ve done macOS or iOS/Android enrollment too. Extra bonus points if you’ve untangled somebody else’s Intune tenant where three admins each built a competing policy set.

RMM — the machine that watches the machines

You’ll live in our RMM daily: patch policies and approval rings, monitor and alert tuning (an alert that fires constantly is an alert nobody reads), automation policies, script deployment at scale, agent health, and onboarding new client environments into monitoring properly the first time.

We want someone who treats noisy alerting as a bug to be fixed, not weather to be endured.

Scripting — because doing it 40 times by hand is a choice

Power Shell is the big one. Graph API, Exchange Online and Entra modules, and the ability to write something readable that the next Yeti can maintain. Bash and Python are welcome. Version control is welcome. Anything that turns a two-hour repetitive task into a 20-minute script and a coffee is exactly the instinct we’re hiring for.

You do not need to be a software engineer. You do need to reach for automation before you reach for the mouse.

Server management — Windows Server, top to bottom

Active Directory Domain Services, DNS, DHCP, Group Policy, file servers and permissions structures, certificate services, print (sorry), Hyper‑V and/or VMware, and backup and disaster recovery — Veeam or equivalent — including actually testing restores instead of assuming they work.

You should be able to look at a client’s environment and articulate what will break first, and what it’ll cost them when it does.

Server replacement and upgrades — the after‑hours stuff

This is a real part of the job. Speccing replacement hardware and getting it ordered. Building it out. Migrating roles, data, shares, permissions, and applications. Version upgrades and getting clients off end‑of‑life Server versions before Microsoft does it for them. Cutover planning with rollback steps written down before the night begins. Decommissioning the old box and closing the loop.

Some of this happens on a Saturday or after 6 PM, because that’s when businesses aren’t using their servers. It’s not every week — but it’s the job, and we’re upfront about it. We flex your…