Sr. Microsoft Entra ID & Identity Architecture Consultant

Sr. Microsoft Entra ID & Identity Architecture Consultant

Role Type: Contractor / Sr Consultant (Client-Facing)

Longterm – Remote (with occasional on-site visits as required by the client).

Position Overview

The Microsoft Entra ID Lead serves as the primary subject matter expert and technical authority for enterprise identity, authentication, and access governance. This role bridges deep hands-on engineering with client engagement, guiding enterprise clients through identity modernizations, Zero Trust architecture implementations, hybrid-to-cloud migrations, and access governance.

The ideal candidate combines direct execution in Microsoft Entra ID with strong communication and consulting expertise, capable of leading client discovery workshops, translating business risk into security policy, and directing implementation teams.

Key Responsibilities

1. Client Engagement & Solution Advisory

          Lead technical discovery, architectural assessments, and roadmap workshops directly with client stakeholders (CISOs, Enterprise Architects, IT Directors, and application owners).

          Translate complex identity security concepts, and compliance mandates into clear business justifications and executive ready deliverables.

          Act as the client's trusted advisor for Zero Trust adoption, modern authentication strategies, and identity lifecycle governance.

          Produce comprehensive solution blueprints, Statements of Work (SOWs), High-Level/Low-Level Designs (HLD/LLD), and migration playbooks.

2. Hands-on Entra ID Engineering & Security Architecture

          Architect, configure, and optimize Microsoft Entra ID tenants across enterprise scale multi-directory and multi-cloud footprints.

          Design and implement robust Conditional Access Policies, continuous access evaluation (CAE), risk-based sign-in policies, and phishing resistant authentication (FIDO2, Windows Hello for Business, Certificate-Based Authentication).

          Implement and harden Microsoft Entra Privileged Identity Management (PIM) for Azure and Entra ID roles, incorporating just-in-time (JIT) access, time bound activations, and multi-stage approval workflows.

          Configure Entra ID Governance, including access reviews, entitlement management catalogs, and lifecycle workflows for automated joiner-mover-leaver (JML) processes.

          Lead hybrid identity integrations and migrations utilizing Microsoft Entra Connect Sync and Cloud Sync, resolving synchronization errors, schema extensions, and password writeback configurations.

3. Application Integration, Federation & External Identities

          Architect enterprise single sign-on (SSO) and user provisioning across SaaS and on-premises applications using SAML 2.0, OpenID Connect (OIDC), OAuth 2.0, and SCIM.

          Design secure collaboration architectures for partners and contractors using Microsoft Entra External ID (B2B) and cross-tenant access settings.

          Guide application development teams on integrating custom enterprise applications with Microsoft identity platform, Managed Identities, and Microsoft Graph APIs.

4. Automation, Monitoring & Operational Excellence

          Develop automated workflows, provisioning pipelines, and audit reporting using PowerShell (Microsoft.Graph module), Microsoft Graph REST API, and Azure Logic Apps.

          Integrate Entra audit, sign-in, and risk logs with enterprise SIEM/SOAR platforms (e.g., Microsoft Sentinel, Splunk) for threat detection and posture monitoring.

          Serve as the Tier-3/4 escalation authority for critical production incidents, misconfigurations, and complex federation failures.

Candidate Qualifications

Technical & Hands-On Skills

          10+ years of hands-on experience in Enterprise Identity & Access Management (IAM), with at least 6+ years dedicated to architecture, administration, and engineering in Microsoft Entra ID (formerly Azure Active Directory).

          Demonstrated mastery of Entra security controls: Conditional Access, PIM, Identity Protection, Microsoft Authenticator, and Passwordless mechanisms.

          Production proficiency with identity federation protocols (SAML, OIDC, OAuth 2.0, WS-Fed) and directory protocols (LDAP, Kerberos, SCIM).

          Advanced scripting and automation skills utilizing PowerShell and Microsoft Graph API / SDK.

          Practical familiarity with Microsoft Entra Suite extensions, such as Entra Global Secure Access (Internet Access & Private Access) and Entra Verified ID.

Consulting & Interpersonal Strengths

          Proven track record in a client-facing consulting, professional services, or solutions architecture capacity.

          Exceptional verbal and written communication skills with demonstrated experience presenting to both deep technical teams and executive-level leadership.

          Strong facilitation skills for leading client architectural workshops, dispute resolution, and stakeholder requirement gathering.

          Ability to mentor junior identity engineers and provide technical oversight across concurrent customer engagements.

Preferred Certifications

          Microsoft Certified: Identity and Access Administrator Associate (SC-300)

          Microsoft Certified: Cybersecurity Architect Expert (SC-100)

          Microsoft Certified: Azure Security Engineer Associate (AZ-500)

          CISSP (Certified Information Systems Security Professional) or CISM