Job Title: Microsoft Intune / Microsoft Entra ID Conditional Access Engineer Experience: 8+ years in IT infrastructure, endpoint management, or identity security
Position Overview
We are seeking an experienced Microsoft Intune and Conditional Access Engineer with strong hands-on expertise in Microsoft Intune, Microsoft Entra ID (formerly Azure Active Directory), and Conditional Access Policies.
The ideal candidate will have extensive experience designing, implementing, troubleshooting, and optimizing Conditional Access Policies to enforce secure access to enterprise applications and resources across managed and unmanaged devices.
This role requires deep technical knowledge of device compliance, identity and access management, endpoint security, and Microsoft 365 security integrations.
Key Responsibilities
Microsoft Entra ID & Conditional Access
· Design, implement, manage, and troubleshoot Microsoft Entra ID Conditional Access Policies.
· Configure policies based on user groups, device compliance, application sensitivity, location, and sign-in risk.
· Implement and manage multifactor authentication (MFA), authentication strengths, and risk-based access controls.
· Configure Conditional Access integration with Microsoft Intune device compliance policies.
· Troubleshoot Conditional Access failures using Entra ID sign-in logs, policy evaluation details, and What If analysis.
· Implement policies for managed, unmanaged, and BYOD devices.
· Configure device-based access restrictions, including requiring compliant devices and Microsoft Entra hybrid joined devices.
· Implement secure access policies for Microsoft 365, SaaS applications, and enterprise applications.
· Review existing Conditional Access configurations, identify security gaps, and recommend improvements.
· Test and deploy policies using report-only mode and phased rollouts to minimize business disruption.
· Maintain emergency access exclusions and prevent unintended administrative lockouts.
Microsoft Intune Administration
· Administer Microsoft Intune for Windows, macOS, iOS, and Android devices.
· Configure and manage device enrollment, configuration profiles, compliance policies, and endpoint security settings.
· Integrate Intune device compliance with Microsoft Entra Conditional Access.
· Manage device compliance requirements, including encryption, OS versions, security posture, and device health.
· Troubleshoot device registration, enrollment, compliance evaluation, and synchronization issues.
· Support Microsoft Defender for Endpoint integration with Intune and Conditional Access.
· Implement application protection policies and mobile application management (MAM) for BYOD environments.
· Support Windows Autopilot and endpoint lifecycle management.
Security, Governance & Troubleshooting
· Investigate user access issues caused by Conditional Access, MFA, device compliance, or identity configurations.
· Analyze Microsoft Entra sign-in logs and Intune device compliance reports to identify root causes.
· Apply Zero Trust security principles across identity and endpoint management.
· Develop and maintain technical documentation, policy standards, and operational procedures.
· Collaborate with cybersecurity, infrastructure, identity management, and help desk teams.
· Recommend security improvements while balancing user experience and business continuity.
Requirements
Required Qualifications
· 8+ years of experience in Microsoft infrastructure, endpoint management, or identity and access management.
· 3+ years of hands-on experience implementing and troubleshooting Microsoft Entra ID Conditional Access Policies.
· Strong practical experience administering Microsoft Intune in enterprise environments.
· Deep understanding of the relationship between Intune device compliance and Entra Conditional Access.
· Proven experience troubleshooting Conditional Access policy conflicts, blocked sign-ins, and device compliance failures.
· Strong understanding of MFA, authentication methods, device identities, and Microsoft 365 authentication.
· Experience supporting Windows and mobile device management.
· Knowledge of Zero Trust architecture and identity-based security controls.
· Experience working with Microsoft Entra ID P1/P2 capabilities.
· Strong analytical, troubleshooting, and communication skills.
Preferred Qualifications
· Microsoft Certified: Endpoint Administrator Associate (MD-102).
· Microsoft Certified: Identity and Access Administrator Associate (SC-300).
· Experience with Microsoft Defender for Endpoint.
· Experience with Microsoft Graph API and PowerShell automation.
· Familiarity with Microsoft Purview, Microsoft 365 security, and enterprise security governance.
· Experience supporting large enterprise environments with complex access requirements.
· Experience implementing Conditional Access in regulated industries such as banking, financial services, or healthcare.
Critical Technical Skills
Must Have:
· Microsoft Entra ID Conditional Access Policy design and troubleshooting
· Microsoft Intune device compliance and configuration management
· Conditional Access integration with device compliance
· MFA and authentication controls
· Microsoft Entra sign-in logs and policy evaluation troubleshooting
· Managed and unmanaged device access policies
· Microsoft 365 identity and endpoint security
Nice to Have:
· Microsoft Defender for Endpoint
· Windows Autopilot
· Microsoft Graph API / PowerShell
· Identity Protection and risk-based Conditional Access
· Zero Trust security architecture
Ideal Candidate Profile
The successful candidate will be a hands-on engineer who can independently assess an organization's existing Conditional Access Policies, identify misconfigurations, troubleshoot complex authentication and device compliance issues, and implement secure, scalable solutions.
This is not a general Intune administration role. Strong, demonstrated expertise in Microsoft Entra Conditional Access Policies is essential.
