Project Engineer – Microsoft 365, Entra & Azure

SUMMARY

You will work across many client tenants at once, typically with two to five projects running in parallel at different stages. Each project is yours to execute — discovery, build, pilot, cutover, handover — with a senior engineer available for architecture calls.

Migrations

·       Run mailbox, tenant, file, and domain migrations end to end using various migration tools — discovery, pilot group, cutover plan, cutover, post-cutover support.

·       Agree rollback criteria and a downtime window with the client before the window opens, and hold to them.

·       Reconcile what actually moved against what was supposed to move, and chase the difference.

Microsoft 365 and Entra ID

·       Build and harden tenants: Entra ID, Conditional Access, MFA, SSPR, Exchange Online mail flow, SharePoint and OneDrive structure, Teams provisioning.

·       Configure and troubleshoot hybrid identity — Entra Connect and Cloud Sync, OU and attribute filtering, sync errors, UPN and domain suffix changes, soft-match and hard-match object merges, immutableID collisions.

·       Diagnose mail flow fast when it breaks: MX, SPF, DKIM, DMARC, Autodiscover, connectors, transport rules, message trace.

Azure and endpoints

·       Deploy and maintain Azure infrastructure: VMs, virtual networks, NSGs, site-to-site VPN, Azure Files, Azure Backup, and Azure Virtual Desktop where clients use it.

·       Manage client devices through Intune: Autopilot enrolment, compliance and configuration profiles, app packaging and deployment, BitLocker and Defender policy, update rings.

Delivery and handover

·       Write the as-built documentation into IT Glue and brief the service desk, so nothing undocumented is left behind.

·       Keep project time and status current in the PSA so account managers can see where things stand.

·       Join client calls to explain what is changing, what will briefly break, and when.

Requirements

• 5-10 years in IT overall, with at least 2 years administering Microsoft 365 and Entra ID across more than one organization or tenant.
  
• At least five migrations you personally executed — mailbox, tenant-to-tenant, file, or Active Directory domain — with the tooling you used named.
  
• You own the technical execution and escalate architecture decisions. You are not expected to design a client's identity strategy from scratch; you are expected to implement one correctly and spot when it is wrong
  

1. Microsoft 365 administration

·       Exchange Online: mail flow, connectors, transport rules, shared and resource mailboxes, mailbox delegation, message trace, retention basics

·       Mail DNS: MX, SPF, DKIM, DMARC, Autodiscover, and what TTL does to a cutover

·       SharePoint Online and OneDrive: site and library creation, permission inheritance, sharing policies, sync troubleshooting

·       Microsoft Teams: provisioning, guest access, and how Teams relates to the SharePoint site behind it

·       Microsoft 365 admin center, license assignment, and group-based licensing

2. Entra ID (formerly Azure AD)

·       Users, groups, dynamic groups, administrative roles and units

·       Entra Connect Sync or Cloud Sync: installation, OU and attribute filtering, and resolving sync errors

·       Hybrid join versus Entra join, and when each applies

·       Conditional Access policy design, MFA rollout, SSPR, and why security defaults are not enough

·       Enterprise applications and SAML or OIDC single sign-on

3. Azure

·       Virtual machines, virtual networks, NSGs, public IPs, site-to-site VPN

·       Azure Files with AD DS or Entra authentication; Azure Virtual Desktop basics

·       Azure Backup and Recovery Services vaults

·       Subscriptions, resource groups, RBAC, and enough cost management to not surprise a client

4. Intune

·       Enrollment: Windows Autopilot, co-management, BYOD, Apple and Android enrollment

·       Compliance policies, configuration profiles, and the Settings Catalog

·       App deployment: Win32 packaging (.intunewin), Store apps, and line-of-business apps

·       BitLocker policy and Defender for Endpoint onboarding

·       Update rings and Windows Update for Business

5. Migration delivery — demonstrable experience in at least two of:

·       On-premises Exchange to Exchange Online: cutover, staged, or hybrid using the Hybrid Configuration Wizard

·       Tenant-to-tenant migration following an acquisition, divestiture, or rebrand

·       Google Workspace or IMAP to Microsoft 365

·       File server or NAS to SharePoint Online, OneDrive, or Teams

·       Active Directory domain migration or consolidation: ADMT, SID history, forest trusts, UPN suffix change, workstation re-domain

·       Another MDM platform into Intune

6. Windows Server and AD DS

·       Active Directory Domain Services, DNS, DHCP, Group Policy, file and print services

·       Hyper-V setup and configuration

7. PowerShell

·       Bulk operations against Exchange Online, Microsoft Graph, and Entra

·       You read and modify scripts rather than only running ones you found

8. Working style

·       Experience working on a fully remote team.

·       Client-facing: comfortable explaining a downtime window to a non-technical stakeholder.

·       Documentation discipline — across many tenants, undocumented work is lost work.

·       Available for scheduled after-hours and weekend cutover windows.

·       Prior MSP or multi-client experience.

Security and compliance: Microsoft Purview (DLP, retention, sensitivity labels, eDiscovery), Defender for Office 365, Defender for Cloud Apps, Secure Score remediation, CIS benchmarks, HIPAA or CMMC-adjacent client work

Privileged identity: Privileged Identity Management, access reviews, entitlement management

Automation: Power Automate, Power Apps, Azure Automation, Logic Apps, Graph API scripting beyond cmdlets

CERTIFICATION:

·       At least one current Microsoft role-based certification, or demonstrable equivalent experience. Examples: