Microsoft 365, Identity & Endpoint Administrator

Plusrelocation; Minneapolis (MN); Hybrid; USD 84,000 - 105,000; Full time

Benefits offered by this job

Profit‑sharing bonus

Floating holidays

401(k) plan

Medical plans

Dental & Vision

HSA contributions

PTO & volunteer time

Insurance: life/AD&D

EAP

Wellness programs

Job summary

Plus Relocation in Minneapolis is seeking a hands-on Microsoft 365 Identity Endpoint Administrator to own the identity lifecycle across on-prem Active Directory and Entra ID, manage Windows endpoints, and help advance automation, security, and the employee experience.

The role requires design of RBAC with security groups, Group Policy administration, and ongoing access reviews. Strong PowerShell and Graph scripting skills, plus Microsoft 365 administration, are essential for success.

Qualifications

• 3+ years of hands-on Active Directory administration.
• Group Policy experience: authoring, precedence and inheritance, security and troubleshooting.
• Hybrid identity experience with Entra Connect or Cloud Sync.
• Practical knowledge of RBAC, Entra admin roles, least privilege.
• PowerShell and Microsoft Graph scripting.
• Offboarding processes including account disablement and data access revocation.
• Experience with NTFS and share permissions on Windows file servers.
• Microsoft 365 administration and Windows troubleshooting.
• Strong communication and security awareness.

Responsibilities

• Own identity lifecycle across on-prem Active Directory and Entra ID.
• Design and maintain RBAC using security groups and least privilege.
• Administer Group Policy, OU structure, and delegation of control.
• Run access reviews and clean up stale/orphaned accounts; provide audit-ready evidence.
• Administer Microsoft 365 and manage Windows endpoints via Intune/Autopilot.
• Provide hands-on local support and remote support for US/global employees.
• Build PowerShell and Graph automations with service accounts and proper change control.
• Partner with Security on MFA, Conditional Access, audits, and AI tool usage.

Skills

Active Directory

Group Policy

Entra ID

PowerShell

Microsoft 365

Intune

Endpoints management

Hybrid identity

Security awareness

Tools

Azure AD Connect

Autopilot

Graph PowerShell

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Microsoft 365 Identity Endpoint Administrator

Technology Full-time Regular Professional Minneapolis, MN, US

5 days ago Requisition ID: 1031

Salary Range: $84,000.00 To $105,000.00 Annually

Job Title:Microsoft 365, Identity & Endpoint Administrator

Job Type:Full-time, Exempt

Location:Minneapolis, MN (Hybrid)

Own Identify, Support People, Secure the Environment

Plus Relocation is looking for a hands-on Microsoft administrator with deep Active Directory and Group Policy experience who enjoys solving technical problems, helping colleagues locally and around the world, and making technology work better. This is more than a help desk role: you will own the full identity lifecycle across Active Directory and Entra ID, manage our Windows endpoints, and help us improve automation, security and the employee experience.

What You Will Do

• Own the full identity lifecycle across on-prem Active Directory and Entra ID: set up new-hire accounts ahead of start dates and keep them disabled until Day 1, process internal transfers by removing old access as well as adding new, and fully deprovision departing employees within 24 hours
• Design and maintain role-based access using security groups and the AGDLP model, applying least privilege to file shares, applications, and admin roles
• Administer Group Policy, OU structure, and delegation of control
• Run regular access reviews and cleanup of stale and orphaned accounts, unowned groups, nested-group sprawl, and privileged role membership, and produce audit-ready evidence
• Administer Microsoft 365 (Exchange Online, Teams, SharePoint) and manage Windows endpoints through Intune, Autopilot, configuration policies, updates, and application deployment
• Provide excellent hands-on support for local employees, and remote support for US and global employees as needed, across devices, Microsoft 365, and business applications
• Build PowerShell and Microsoft Graph automations that run under dedicated service accounts, gMSAs, or app registrations, with documented permissions, ownership, and change control
• Partner with Security and Compliance on MFA, Conditional Access, data deletion, audits, and the responsible use of approved AI tools

What You Bring

• 3+ years of hands-on Active Directory administration in a production domain: users, groups, OUs, delegation, DNS, and replication basics
• Demonstrated Group Policy experience: authoring, precedence and inheritance, security and WMI filtering, and troubleshooting with gpresult and RSOP
• Hybrid identity experience with Entra Connect or Cloud Sync, including sync scope, source of authority, and the difference between disabling a user on-prem and in the cloud
• Practical knowledge of role-based access and least privilege, including Entra admin roles, the tiered admin model, and separate admin accounts for privileged work
• Working PowerShell skills (ActiveDirectory module and Microsoft Graph PowerShell) for bulk and scheduled identity tasks
• The ability to walk us through a complete offboarding from start to finish: disabling the account and resetting the password, revoking sessions and MFA methods, removing groups and licenses, handling the mailbox and OneDrive, removing device access, and capturing evidence of each step
• Experience with NTFS and share permissions on Windows file servers
• Hands-on Microsoft 365 administration, confident Windows troubleshooting, and solid networking fundamentals
• Clear communication, strong service instincts, sound security judgment, and ownership

Nice to Have

• Intune and Autopilot, Microsoft Defender, Purview, Conditional Access, SaaS administration, and compliance or audit experience
• Certifications such as AZ-802 (Windows Server Hybrid Administrator Associate), SC-300 (Identity and Access Administrator), or MD-102 (Endpoint Administrator). Demonstrated, practical experience matters more to us than certifications.

Room to Grow

We envision a progression from identity, Microsoft administration, and endpoint ownership in Year 1, to automation and technical project leadership in Year 2, with a potential Senior Systems and Automation Engineer path in Year 3. Progression depends on demonstrated capability and business needs.

Compensation and Benefits Summary

This role offers an annual base salary range of $84,000 - $105,000, depending on qualifications. This is a hybrid role based in Minneapolis, MN.

In addition to base salary, this position is eligible for:

• Annual discretionary profit‑sharing bonus
• Paid floating holiday
• 401(k) retirement contributions

Salary Range Note: This is a good faith estimate based on current benchmarks. Final compensation will be based on skills, experience, and internal equity.

• Multiple medical plan options with a significant portion of premiums paid by the company
• Dental and vision coverage
• Health Savings Account (HSA) with employer contributions
• Paid Time Off (PTO) and paid volunteer hours
• Company-paid life, AD&D, short- and long-term disability insurance
• Employee Assistance Program (EAP)
• Wellness incentives and strengths-based development culture

Why Plus Relocation?

Our mission is simple: Deliver Delight. That starts with how we treat our own team. At Plus, you'll join a values-driven group of people who believe in the power of team, hold themselves to a standard of no excuses accountability, and genuinely care about doing right by our clients and each other. We invest in your growth, recognize your contributions, and support you with benefits that go beyond the basics.

Plus Relocation is an equal opportunity employer. This is a hybrid position based in Minneapolis, MN. In accordance with applicable state pay transparency laws, the full salary range for this role is disclosed above.