Microsoft 365 Security Consultant (Entra / Intune)

Prism Digital; Greater London; Hybrid; GBP 101,000 - 148,000; Full time

Job summary

Prism Digital is seeking a Microsoft 365 Security Consultant to establish a cloud-native, documented baseline for a Central London tenant. You will implement Entra ID, Intune, Defender, Purview and Sentinel, delivering end-to-end configuration and automation on an outside IR35 contract with a day rate of £550–£800.

The role requires hands-on experience in Entra ID, Intune, CA, PIM, and ASR rules, with strong PowerShell scripting.

Qualifications

• Azure Cloud-native environment hands-on experience with Entra ID and Intune.
• Delivery of a full M365 tenant baseline end-to-end on your own.
• Experience with CA, PIM, and administrative units in Entra ID.
• Experience with DLP, sensitivity labels, ASR rules, and BitLocker in Purview/Intune.

Responsibilities

• Lead planning and delivery of a hardened M365 baseline for Entra ID and Intune.
• Configure Defender, Purview, and Sentinel to align with best practices.
• Implement access controls, conditional access policies, and governance in rings.
• Produce an as-built pack, runbooks, and handover documentation.

Skills

Entra ID

Intune

Defender

Purview

Sentinel

PowerShell

Azure

Microsoft 365

Tools

Graph API

PnP.PowerShell

Azure Functions

Azure Automation

Job description

Microsoft 365 Security Consultant (Entra / Intune) - Contract, Outside IR35 | Entra ID, Intune, Defender, Purview, Sentinel | Cloud-First Boutique Finance House on a Modern Azure Stack

• Day rate: £550 to £800 per day depending on seniority and experience (Outside IR35)
• Location: Central London, 1 day per week in the office
• Contract length: until the end of the year – Extensions likely

I'm working with a growing boutique finance house in Central London that needs a Microsoft 365 Security Consultant to bring their tenant up to a proper, documented baseline. You'll take a detailed hardening plan across Entra ID, Intune, Defender, Purview and Sentinel and deliver it start to finish, on an outside IR35 contract.

The business is small, with a lean team, and it has grown quickly over the last few years. The whole estate runs on a modern, cloud-first Microsoft platform: Microsoft 365 E5, Entra ID, Intune, Defender, Purview and Sentinel, with Azure Functions and Azure AI Foundry built on top. The latest tooling is already in place and paid for, and your job is to configure it to best practice. You'll report straight to a technical MD and you'll own both the plan and the outcome.

If your background is mainly on-premises Windows Server, Active Directory or SCCM, this one won't be the right fit, as the work is cloud-native Entra and Intune throughout.

What They're Looking For (Non-Negotiables)

• Azure Cloud-native environment
• Microsoft 365: recent, hands-on Entra and Intune work
• Entra ID: Conditional Access, PIM, administrative units, app consent
• Intune and Autopilot: compliance, ASR rules, LAPS, BitLocker
• Purview: sensitivity labels and DLP
• Sentinel and Log Analytics alerting
• PowerShell
• You've delivered an M365 tenant baseline end to end, on your own

What You'll Work With

• AI & Automation
• Microsoft 365 E5
• Defender XDR and Defender for Cloud Apps
• SharePoint and OneDrive: permissions, sharing, access control
• Microsoft Graph and PnP.PowerShell
• Azure Functions and Azure Automation
• A broad estate of SaaS applications

Nice to Haves

• Conditional Access as code, from a published baseline
• Regulated or financial services environments
• GDAP and handover to a managed service provider
• Python

Why Join / Projects

The scope is already mapped out in a detailed plan covering identity, privileged access, app governance, endpoint, data protection, monitoring and documentation. You'll spend a day on the handover with the person who wrote it, put your delivery plan in front of the MD and get going.

• You'll roll out Conditional Access as code in rings, alongside PIM, break-glass accounts and scoped admin roles
• You'll fix the access basics: SharePoint permissions, joiners and leavers, and permission models for Graph integrations
• You'll harden the Windows estate and stand up labelling, DLP and Sentinel alerting
• You'll leave an as-built pack, runbooks and a RACI ready for handover

The pace is quick and the days are intense, so this suits someone who likes owning a clear outcome and working with a decision-maker who knows the tech. The business is investing heavily on AI on Azure, and the secure baseline you build is the foundation that work will sit on.

Microsoft 365 Security Consultant (Entra / Intune) - Contract, Outside IR35 | Entra ID, Intune, Defender, Purview, Sentinel | Cloud-First Boutique Finance House on a Modern Azure Stack