Remote: Entra ID consultant

Entra ID consultant

100% Remote

6+ Months

Job Description:

• Large global fast food restaurant chain
• Need a senior, hands-on Identity Implementation Lead who can take a complex identity program from detailed design through build, test, documentation, and handoff.
• Must be an engineer-practitioner, not strategy-only or portal-only.

Core Profile:

• 10–15 years IAM experience, with 5–7+ years deep Microsoft identity work and recent complex Entra implementations.

Must be Strong in:

• Entra tenant build, governance, Conditional Access, PIM, Identity Protection
• Hybrid identity and Entra Connect routing
• Cross-tenant access and synchronization
• Configuration-as-code with Git, Graph, CI/CD, drift detection, and testing
• Application identity, federation, and migration planning
• Delivery leadership, documentation, and customer enablement

Non-Negotiable Technical Skills:

• Greenfield Entra tenant design and production build
• Conditional Access design, rollout safety, and policy interaction testing

Privileged Access:

• FIDO2/passkeys, TAP, break-glass, PIM, admin identities
• Hybrid identity routing across tenants from a shared AD estate
• Graph-based automation and secure DevSecOps

Enterprise App / Federation Patterns:

• SAML, OIDC, OAuth, WS-Fed, ADFS
• Logging, monitoring, audit, SIEM integration, and operational handoff

Ideal Work History:

• Built a production Entra tenant from scratch
• Led a multi-tenant identity program
• Implemented native cross-tenant sync
• Engineered Entra Connect routing and sync rules
• Delivered Graph-based config deployment through CI/CD
• Led a safe Conditional Access rollout
• Left behind tested automation, runbooks, and trained operators

Must be Able to:

• Explain architecture clearly
• Build directly in Entra, Graph, PowerShell, Git, CI/CD
• Sequence technical work and manage risk
• Pair with customer engineers and transfer ownership

Strong Differentiators:

• Large distributed or retail/franchise identity environments
• Microsoft365DSC / Terraform in addition to Graph
• Defender for Identity, LAPS, SIEM, Intune, Tanium
• GitHub Actions / Azure DevOps depth
• Relevant Microsoft certifications

Interview Should Validate:

• Hands-on delivery history
• Safe Conditional Access rollout approach
• Hybrid identity routing knowledge
• Cross-tenant sync design
• Config-as-code / CI-CD design
• Application migration and coexistence experience
• Operational handoff and documentation quality

Red Flags:

• Mostly architecture/presales, not hands-on build work
• Portal-only CA knowledge
• Script-only automation without testing/drift control
• Weak understanding of Entra Connect routing and matching behaviour
• Treating guest access and cross-tenant sync as the same thing
• Overreliance on unsupported/beta features
• Weak documentation, testing, or handoff discipline.