Project Engineer – Microsoft 365, Entra & Azure

You will work across many client tenants at once typically with two to five projects running in parallel at different stages. Each project is yours to execute discovery build pilot cutover handover with a senior engineer available for architecture calls.

Migrations

Run mailbox tenant file and domain migrations end to end using various migration tools discovery pilot group cutover plan cutover post-cutover support.

Agree rollback criteria and a downtime window with the client before the window opens and hold to them.

Reconcile what actually moved against what was supposed to move and chase the difference.

Microsoft 365 and Entra ID

Build and harden tenants: Entra ID Conditional Access MFA SSPR Exchange Online mail flow SharePoint and OneDrive structure Teams provisioning.

Configure and troubleshoot hybrid identity Entra Connect and Cloud Sync OU and attribute filtering sync errors UPN and domain suffix changes soft-match and hard-match object merges immutableID collisions.

Diagnose mail flow fast when it breaks: MX SPF DKIM DMARC Autodiscover connectors transport rules message trace.

Azure and endpoints

Deploy and maintain Azure infrastructure: VMs virtual networks NSGs site-to-site VPN Azure Files Azure Backup and Azure Virtual Desktop where clients use it.

Manage client devices through Intune: Autopilot enrolment compliance and configuration profiles app packaging and deployment BitLocker and Defender policy update rings.

Delivery and handover

Write the as-built documentation into IT Glue and brief the service desk so nothing undocumented is left behind.

Keep project time and status current in the PSA so account managers can see where things stand.

Join client calls to explain what is changing what will briefly break and when.

• 5-10 years in IT overall with at least 2 years administering Microsoft 365 and Entra ID across more than one organization or tenant.
  
• At least five migrations you personally executed mailbox tenant-to-tenant file or Active Directory domain with the tooling you used named.
  
• You own the technical execution and escalate architecture decisions. You are not expected to design a clients identity strategy from scratch; you are expected to implement one correctly and spot when it is wrong
  

1. Microsoft 365 administration

Exchange Online: mail flow connectors transport rules shared and resource mailboxes mailbox delegation message trace retention basics

Mail DNS: MX SPF DKIM DMARC Autodiscover and what TTL does to a cutover

SharePoint Online and OneDrive: site and library creation permission inheritance sharing policies sync troubleshooting

Microsoft Teams: provisioning guest access and how Teams relates to the SharePoint site behind it

Microsoft 365 admin center license assignment and group-based licensing

2. Entra ID (formerly Azure AD)

Users groups dynamic groups administrative roles and units

Entra Connect Sync or Cloud Sync: installation OU and attribute filtering and resolving sync errors

Hybrid join versus Entra join and when each applies

Conditional Access policy design MFA rollout SSPR and why security defaults are not enough

Enterprise applications and SAML or OIDC single sign-on

3. Azure

Virtual machines virtual networks NSGs public IPs site-to-site VPN

Azure Files with AD DS or Entra authentication; Azure Virtual Desktop basics

Azure Backup and Recovery Services vaults

Subscriptions resource groups RBAC and enough cost management to not surprise a client

4. Intune

Enrollment: Windows Autopilot co-management BYOD Apple and Android enrollment

Compliance policies configuration profiles and the Settings Catalog

App deployment: Win32 packaging (.intunewin) Store apps and line-of-business apps

BitLocker policy and Defender for Endpoint onboarding

Update rings and Windows Update for Business

5. Migration delivery demonstrable experience in at least two of:

On-premises Exchange to Exchange Online: cutover staged or hybrid using the Hybrid Configuration Wizard

Tenant-to-tenant migration following an acquisition divestiture or rebrand

Google Workspace or IMAP to Microsoft 365

File server or NAS to SharePoint Online OneDrive or Teams

Active Directory domain migration or consolidation: ADMT SID history forest trusts UPN suffix change workstation re-domain

Another MDM platform into Intune

6. Windows Server and AD DS

Active Directory Domain Services DNS DHCP Group Policy file and print services

Hyper-V setup and configuration

7. PowerShell

Bulk operations against Exchange Online Microsoft Graph and Entra

You read and modify scripts rather than only running ones you found

8. Working style

Experience working on a fully remote team.

Client-facing: comfortable explaining a downtime window to a non-technical stakeholder.

Documentation discipline across many tenants undocumented work is lost work.

Available for scheduled after-hours and weekend cutover windows.

Prior MSP or multi-client experience.

Security and compliance: Microsoft Purview (DLP retention sensitivity labels eDiscovery) Defender for Office 365 Defender for Cloud Apps Secure Score remediation CIS benchmarks HIPAA or CMMC-adjacent client work

Privileged identity: Privileged Identity Management access reviews entitlement management

Automation: Power Automate Power Apps Azure Automation Logic Apps Graph API scripting beyond cmdlets

CERTIFICATION:

At least one current Microsoft role-based certification or demonstrable equivalent experience. Examples: