Microsoft 365 Engineer

Responsibilities

• Microsoft Entra ID and Microsoft 365
• Users, dynamic and assigned groups, administrative units, directory roles, service principals, workload identities.
• Conditional Access design and rollout: named locations, client app and platform conditions, session controls, sign-in frequency, break-glass exclusions, report-only staging.
• Authentication methods policy and phishing-resistant factors.
• Application onboarding over SAML 2.0 (NameID, claims mapping, signing certificate rollover, encrypted assertions) and OIDC / OAuth 2.0 (authorization code with PKCE, client credentials, device code).
• App registrations: redirect URIs, permissions, admin consent workflow, secret and certificate lifecycle.
• SCIM 2.0 provisioning: attribute mappings, scoping filters, expression transformations, quarantined jobs, drift reconciliation.
• Tenant consent settings, OAuth grant review, remediation of over-permissioned and stale applications; defensible controls for SaaS without SSO or SCIM support.
• Joiner-mover-leaver as an automated pipeline: provisioning, group-based licensing, revocation with session and refresh token invalidation.
• Least privilege for admin access: scoped role assignments, RBAC, PIM, access reviews, entitlement management access packages.

Languages