EUC Engineer

Coforge; Mandaluyong; On-site; PHP 1,200,000 - 1,800,000; Full time

Job summary

Coforge is seeking an experienced Intune specialist to lead MAM policy deployment across iOS, Android, and Windows/macOS where applicable in Manila. You will configure app protection, enrollment and data controls for corporate apps and devices.

The role requires deep knowledge of Entra Conditional Access, BYOD deployments, and strong user-facing support. Travel to Manila is expected for onsite delivery and collaboration with the project team.

Qualifications

• 6+ years hands-on with Microsoft Intune, specifically App Protection (MAM) policies.
• Hands-on Microsoft Entra Conditional Access policy configuration.
• Practical understanding of enrolment-free protection versus full MDM enrolment, and when each applies.

Responsibilities

• Build and deploy Intune App Protection (MAM) policies across iOS, Android, Windows and macOS where in scope.
• Configure app PIN, encryption at rest, jailbreak and root detection, and selective wipe of corporate data only.
• Configure data-movement boundaries — block save-as to personal storage, restrict copy and paste, control screen capture and backup.
• Design and deploy Entra Conditional Access rules, including device-state-aware policies and approved-client-app enforcement.
• Configure restricted, web-only access for unmanaged personal computers, with download, print and sync disabled.
• Support MIP client distribution through Intune, including compatibility validation and phased ring deployment.
• Deploy BYOD controls wave by wave, monitoring adoption and resolving user issues as each wave goes live.
• Enable the client service desk with scripted responses, and help publish the user-facing privacy position.
• Produce the BYOD and Intune policy inventory, runbooks and support procedures at project closure.

Skills

Intune MAM / App Protection

Entra Conditional Access

MAM vs MDM Knowledge

iOS & Android management

Intune app deployment

Purview DLP / labels

End-user support / troubleshooting

SC-300 Certification

Willingness to travel

Job description

• Build and deploy Intune App Protection (MAM) policies across iOS, Android and, where in scope, Windows and macOS.
• Configure app PIN, encryption at rest, jailbreak and root detection, and selective wipe of corporate data only.
• Configure data-movement boundaries — block save-as to personal storage, restrict copy and paste, control screen capture and backup.
• Design and deploy Entra Conditional Access rules, including device-state-aware policies and approved-client-app enforcement.
• Configure restricted, web-only access for unmanaged personal computers, with download, print and sync disabled.
• Support MIP client distribution through Intune, including compatibility validation and phased ring deployment.
• Deploy BYOD controls wave by wave, monitoring adoption and resolving user issues as each wave goes live.
• Enable the client service desk with scripted responses, and help publish the user-facing privacy position.
• Produce the BYOD and Intune policy inventory, runbooks and support procedures at project closure.

Must-Have Skills

• 6+ years hands-on with Microsoft Intune, specifically App Protection (MAM) policies.
• Hands-on Microsoft Entra Conditional Access policy configuration.
• Practical understanding of enrolment-free (MAM without enrolment) protection versus full MDM enrolment, and when each applies.
• iOS and Android management; Windows and macOS endpoint policy configuration.
• Intune application deployment and packaging.
• Exposure to Microsoft Purview DLP and sensitivity labels as they apply on endpoints.
• Strong troubleshooting skills and genuine comfort dealing directly with end users.
• Willingness to travel to Manila — this role has the heaviest onsite requirement on the project.

Good-to-Have Skills

• Endpoint DLP configuration — USB, print, clipboard and cloud-upload egress controls.
• Experience rolling out BYOD in an organisation with contractors and third-party suppliers, not just employees.
• Awareness of employee-privacy considerations in BYOD across multiple jurisdictions.
• Prior service-desk or L2 endpoint support background.
• Experience with Autopilot, co-management or migration from another UEM platform.

Certifications

Mandatory

Preferred

• Microsoft SC-300 — Identity and Access Administrator Associate