Project Engineer - Microsoft 365, Entra & Azure

ScalableOS; Philippines; Remote; PHP 3,790,000 - 5,685,000; Full time

Job summary

ScalableOS is hiring a Project Engineer to deliver Microsoft 365, Entra ID, and migration projects for multiple client tenants. The role is hands-on cloud engineering, building and hardening tenants, managing hybrid identity, and moving mail, files, and users between platforms without data loss.

You will handle 2–5 projects in parallel across discovery, build, pilot, cutover, and handover, with a senior engineer available for architecture guidance. Remote work from the Philippines is supported.

Qualifications

• 5–10 years IT experience with Microsoft 365 and Entra ID across multiple tenants.
• At least five migrations executed (mailbox, tenant, file, or AD migrations) with tools identified.
• Own technical execution and upscale architecture decisions.
• Able to implement a client identity strategy correctly.
• All four pillars of Microsoft 365/Azure administration and migration experience.

Responsibilities

• Migrations end to end across mailbox, file, and domain migrations with guides and post-cutover support.
• Build and harden Entra ID tenants, MFA, CA, SSPR, and mail flow configurations.
• Manage Azure infrastructure, VMs, networks, and Azure Backup; deploy and manage Intune for devices.
• Produce as-built IT Glue documentation and brief service desk; keep PSA status up to date.
• Join client calls to explain changes, potential breakages, and timelines.

Skills

Migration delivery

Hybrid identity management

Azure administration

Intune management

Cloud engineering

Tools

Entra ID

Exchange Online

SharePoint Online

OneDrive

Teams

Azure Virtual Desktop

Intune

Azure Backup

Job description

We are hiring a Project Engineer to deliver Microsoft 365, identity, and migration projects for our clients. This is hands‑on cloud engineering, not advisory work: you build and harden tenants, untangle hybrid identity, manage devices through Intune, and move mail, files, and users between platforms without losing data or a weekend.

You will work across many client tenants at once, typically with two to five projects running in parallel at different stages. Each project is yours to execute: discovery, build, pilot, cutover, and handover, with a senior engineer available for architecture calls.

JOB RESPONSIBILITIES

Migrations

• Run mailbox, tenant, file, and domain migrations end to end using various migration tools: discovery, pilot group, cutover plan, cutover, and post‑cutover support.
• Agree on rollback criteria and a downtime window with the client before the window opens and adhere to them.
• Reconcile what actually moved against what was supposed to move and chase the difference.

Microsoft 365 and Entra ID

• Build and harden tenants: Entra ID, Conditional Access, MFA, SSPR, Exchange Online mail flow, SharePoint and OneDrive structure, and Teams provisioning.
• Configure and troubleshoot hybrid identity: Entra Connect and Cloud Sync, OU and attribute filtering, sync errors, UPN and domain suffix changes, soft‑match and hard‑match object merges, and immutableID collisions.
• Diagnose mail flow quickly when it breaks: MX, SPF, DKIM, DMARC, Autodiscover, connectors, transport rules, and message trace.

Azure and Endpoints

• Deploy and maintain Azure infrastructure: VMs, virtual networks, NSGs, site‑to‑site VPNs, Azure Files, Azure Backup, and Azure Virtual Desktop where clients use it.
• Manage client devices through Intune: Autopilot enrollment, compliance and configuration profiles, app packaging and deployment, BitLocker and Defender policies, and update rings.

Delivery and Handover

• Write the as‑built documentation in IT Glue and brief the service desk so that nothing undocumented is left behind.
• Keep project time and status current in the PSA so that account managers can see where things stand.
• Join client calls to explain what is changing, what will briefly break, and when.

QUALIFICATIONS

• 5–10 years of experience in IT overall, with at least 2 years administering Microsoft 365 and Entra ID across more than one organization or tenant.
• At least five migrations personally executed, including mailbox, tenant‑to‑tenant, file, or Active Directory domain migrations, with the tools used clearly identified.
• Ability to own the technical execution and upscale architecture decisions.
• Ability to correctly implement a client’s identity strategy and identify when it is incorrect.
• All four pillars below are required. Within each pillar, you should be able to perform most of the listed activities without supervision.

Microsoft 365 Administration

• Exchange Online: mail flow, connectors, transport rules, shared and resource mailboxes, mailbox delegation, message trace, and retention basics.
• Mail DNS: MX, SPF, DKIM, DMARC, Autodiscover, and the effect of TTL on a cutover.
• SharePoint Online and OneDrive: site and library creation, permission inheritance, sharing policies, and sync troubleshooting.
• Microsoft Teams: provisioning, guest access, and how Teams relates to the SharePoint site behind it.
• Microsoft 365 admin center, license assignment, and group‑based licensing.
• Users, groups, dynamic groups, administrative roles, and administrative units.
• Entra Connect Sync or Cloud Sync: installation, OU and attribute filtering, and resolution of sync errors.
• Hybrid join versus Entra join and when each applies.
• Conditional Access policy design, MFA rollout, SSPR, and why security defaults are not sufficient.
• Enterprise applications and SAML or OIDC single sign‑on.
• Virtual machines, virtual networks, NSGs, public IPs, and site‑to‑site VPNs.
• Azure Files with AD DS or Entra authentication and Azure Virtual Desktop basics.
• Azure Backup and Recovery Services vaults.
• Subscriptions, resource groups, RBAC, and sufficient cost management knowledge to avoid unexpected client expenses.
• Enrollment: Windows Autopilot, co‑management, BYOD, and Apple and Android enrollment.
• Compliance policies, configuration profiles, and the Settings Catalog.
• App deployment: Win32 packaging (.intunewin), Store apps, and line‑of‑business apps.
• BitLocker policy and Defender for Endpoint onboarding.
• Update rings and Windows Update for Business.

Migration Delivery

• Demonstrable experience in at least two of the following:
• On‑premises Exchange to Exchange Online: cutover, staged, or hybrid migration using the Hybrid Configuration Wizard.
• Tenant‑to‑tenant migration following an acquisition, divestiture, or rebrand.
• Google Workspace or IMAP to Microsoft 365.
• File server or NAS migration to SharePoint Online, OneDrive, or Teams.
• Active Directory domain migration or consolidation: ADMT, SID history, forest trusts, UPN suffix changes, workstation re‑domain, and related activities.
• Migration from another MDM platform to Intune.

Windows Server and AD DS

• Active Directory Domain Services, DNS, DHCP, Group Policy, and file and print services.
• Hyper‑V setup and configuration.

PowerShell

• Bulk operations against Exchange Online, Microsoft Graph, and Entra.
• Ability to read and modify scripts rather than only run existing scripts.

Additional Technical Qualifications

• Security and compliance: Microsoft Purview, including DLP, retention, sensitivity labels, and eDiscovery; Defender for Office 365; Defender for Cloud Apps; Secure Score remediation; CIS benchmarks; and HIPAA‑or CMMC‑adjacent client work.
• Privileged identity: Privileged Identity Management, access reviews, and entitlement management.
• Automation: Power Automate, Power Apps, Azure Automation, Logic Apps, and Graph API scripting beyond cmdlets.

Certifications

• At least one current Microsoft role‑based certification or demonstrable equivalent experience. Examples include:
• MS-102: Microsoft 365 Administrator Expert
• SC-300: Identity and Access Administrator
• AZ-800/AZ-801: Windows Server Hybrid Administrator
• MS-700: Teams Administrator
• SC-200: Security Operations Analyst

JOB REQUIREMENTS

• Experience working on a fully remote team.
• Comfortable explaining a downtime window to a non‑technical stakeholder in a client‑facing setting.
• Strong documentation discipline, as undocumented work across multiple tenants is considered lost work.
• Available for scheduled after‑hours and weekend cutover windows.