Project Engineer – Microsoft 365, Entra & Azure

SUMMARY

You will work across many client tenants at once, typically with two to five projects running in parallel at different stages. Each project is yours to execute — discovery, build, pilot, cutover, handover — with a senior engineer available for architecture calls.

Migrations

· Run mailbox, tenant, file, and domain migrations end to end using various migration tools — discovery, pilot group, cutover plan, cutover, post-cutover support.

· Agree rollback criteria and a downtime window with the client before the window opens, and hold to them.

· Reconcile what actually moved against what was supposed to move, and chase the difference.

Microsoft 365 and Entra ID

· Build and harden tenants: Entra ID, Conditional Access, MFA, SSPR, Exchange Online mail flow, SharePoint and OneDrive structure, Teams provisioning.

· Configure and troubleshoot hybrid identity — Entra Connect and Cloud Sync, OU and attribute filtering, sync errors, UPN and domain suffix changes, soft-match and hard-match object merges, immutableID collisions.

· Diagnose mail flow fast when it breaks: MX, SPF, DKIM, DMARC, Autodiscover, connectors, transport rules, message trace.

Azure and endpoints

· Deploy and maintain Azure infrastructure: VMs, virtual networks, NSGs, site-to-site VPN, Azure Files, Azure Backup, and Azure Virtual Desktop where clients use it.

· Manage client devices through Intune: Autopilot enrolment, compliance and configuration profiles, app packaging and deployment, BitLocker and Defender policy, update rings.

Delivery and handover

· Write the as-built documentation into IT Glue and brief the service desk, so nothing undocumented is left behind.

· Keep project time and status current in the PSA so account managers can see where things stand.

· Join client calls to explain what is changing, what will briefly break, and when.

Requirements

• 5-10 years in IT overall, with at least 2 years administering Microsoft 365 and Entra ID across more than one organization or tenant.
  
• At least five migrations you personally executed — mailbox, tenant-to-tenant, file, or Active Directory domain — with the tooling you used named.
  
• You own the technical execution and escalate architecture decisions. You are not expected to design a client's identity strategy from scratch; you are expected to implement one correctly and spot when it is wrong
  

1. Microsoft 365 administration

· Exchange Online: mail flow, connectors, transport rules, shared and resource mailboxes, mailbox delegation, message trace, retention basics

· Mail DNS: MX, SPF, DKIM, DMARC, Autodiscover, and what TTL does to a cutover

· SharePoint Online and OneDrive: site and library creation, permission inheritance, sharing policies, sync troubleshooting

· Microsoft Teams: provisioning, guest access, and how Teams relates to the SharePoint site behind it

· Microsoft 365 admin center, license assignment, and group-based licensing

2. Entra ID (formerly Azure AD)

· Users, groups, dynamic groups, administrative roles and units

· Entra Connect Sync or Cloud Sync: installation, OU and attribute filtering, and resolving sync errors

· Hybrid join versus Entra join, and when each applies

· Conditional Access policy design, MFA rollout, SSPR, and why security defaults are not enough

· Enterprise applications and SAML or OIDC single sign-on

3. Azure

· Virtual machines, virtual networks, NSGs, public IPs, site-to-site VPN

· Azure Files with AD DS or Entra authentication; Azure Virtual Desktop basics

· Azure Backup and Recovery Services vaults

· Subscriptions, resource groups, RBAC, and enough cost management to not surprise a client

4. Intune

· Enrollment: Windows Autopilot, co-management, BYOD, Apple and Android enrollment

· Compliance policies, configuration profiles, and the Settings Catalog

· App deployment: Win32 packaging (.intunewin), Store apps, and line-of-business apps

· BitLocker policy and Defender for Endpoint onboarding

· Update rings and Windows Update for Business

5. Migration delivery — demonstrable experience in at least two of:

· On-premises Exchange to Exchange Online: cutover, staged, or hybrid using the Hybrid Configuration Wizard

· Tenant-to-tenant migration following an acquisition, divestiture, or rebrand

· Google Workspace or IMAP to Microsoft 365

· File server or NAS to SharePoint Online, OneDrive, or Teams

· Active Directory domain migration or consolidation: ADMT, SID history, forest trusts, UPN suffix change, workstation re-domain

· Another MDM platform into Intune

6. Windows Server and AD DS

· Active Directory Domain Services, DNS, DHCP, Group Policy, file and print services

· Hyper-V setup and configuration

7. PowerShell

· Bulk operations against Exchange Online, Microsoft Graph, and Entra

· You read and modify scripts rather than only running ones you found

8. Working style

· Experience working on a fully remote team.

· Client-facing: comfortable explaining a downtime window to a non-technical stakeholder.

· Documentation discipline — across many tenants, undocumented work is lost work.

· Available for scheduled after-hours and weekend cutover windows.

· Prior MSP or multi-client experience.

Security and compliance: Microsoft Purview (DLP, retention, sensitivity labels, eDiscovery), Defender for Office 365, Defender for Cloud Apps, Secure Score remediation, CIS benchmarks, HIPAA or CMMC-adjacent client work

Privileged identity: Privileged Identity Management, access reviews, entitlement management

Automation: Power Automate, Power Apps, Azure Automation, Logic Apps, Graph API scripting beyond cmdlets

CERTIFICATION:

· At least one current Microsoft role-based certification, or demonstrable equivalent experience. Examples: