Microsoft Cloud Architect - English

Job Description

About the work

We’re Wired CIO — a technology consulting and managed services practice supporting SMB and mid-market clients. We manage Microsoft 365 across many client tenants, and we’re increasingly building AI-assisted workflows on top of that stack — Copilot rollouts, agents that read and act on tenant data, and internal automation.

We’re looking for a certified Microsoft 365 engineer to work with us on an ongoing hourly basis. This is not a helpdesk role. We need someone who can be handed a tenant and a goal and figure out the path — someone who reads the Graph docs rather than guessing, who understands why a Conditional Access policy is breaking something, and who documents what they did so the next person isn’t reverse-engineering it.

You’ll be one of a small number of engineers, working async, with real ownership of the environments you touch.

What you’ll be doing

Tenant engineering and administration

Design and implement Entra ID configurations: Conditional Access, authentication methods, PIM, app registrations, enterprise app SSO, cross-tenant access

Build and maintain Intune configurations — compliance policies, configuration profiles, app deployment, Autopilot, Endpoint Privilege Management

Configure and tune Defender for Office 365 / Defender for Endpoint, safe links and attachments, anti-phishing, and alert tuning that doesn’t drown us in noise

Exchange Online, SharePoint Online, OneDrive, and Teams configuration and governance

Purview work: retention, DLP, sensitivity labels, eDiscovery when it comes up

Migrations and tenant-to-tenant work: mailboxes, OneDrive/SharePoint content, identity cutover

Multi-tenant / MSP specifics

Work across many client tenants without cross-contaminating configuration or data — you take tenant boundaries seriously

Use GDAP correctly; understand delegated access, least-privilege partner roles, and what breaks when GDAP relationships lapse

Standardize: build baselines that can be applied consistently across tenants rather than snowflaking every client

Work with our tooling stack: [CIPP / Microsoft 365 Lighthouse / your RMM / your PSA — list what you actually use]

Write documentation and runbooks as you go, in [Notion / IT Glue / SharePoint]

Automation and scripting

Microsoft Graph (REST and the Graph PowerShell SDK) for reporting, bulk changes, and anything the portal makes painful

PowerShell at a real level — functions, error handling, parameterized scripts others can run, not one-off snippets

Azure Automation, Logic Apps, or Power Automate for scheduled and event-driven work

Registering and scoping app registrations properly: application vs. delegated permissions, admin consent, certificate/secret hygiene, and knowing when a permission request is too broad

AI and Copilot project work

Microsoft 365 Copilot readiness and rollout: licensing, permissions hygiene (oversharing remediation before you turn Copilot on), Copilot Studio agents, Restricted SharePoint Search where needed

Help build and test AI agents that touch tenant data — scoping what an agent is allowed to read and do, and validating it behaves correctly

Pressure-test agent output for correctness and data-boundary problems; help design guardrails

You don’t need to be an AI expert. You need genuine curiosity about it and the discipline to think about what happens when an agent has read access to a client’s entire tenant.

What we’re looking for

Required

Active Microsoft certification — at minimum MS-102 (Microsoft 365 Administrator). Microsoft 365 Certified: Administrator Expert, SC-300 (Identity and Access Administrator), MD-102 (Endpoint Administrator), SC-200, or AZ-104 are all strong additions.

[4]+ years hands-on Microsoft 365 engineering, including production Entra ID and Intune work

Real PowerShell and Microsoft Graph proficiency — you’ll be asked about this specifically

Experience working across multiple tenants (MSP, CSP partner, or consultancy background)

Clear written English. Most of our communication is async and written.

Able to overlap at least [3] hours with US [Central] business hours

Comfortable working in a client-data environment: you follow least privilege, you use MFA, you don’t paste tenant data into random tools

Nice to have

CIPP, Microsoft 365 Lighthouse, or similar multi-tenant management tooling

Azure experience beyond M365 — networking, Key Vault, Functions, App Service

Copilot Studio, Power Platform, or Microsoft 365 Agents SDK experience

Security frameworks: CIS Microsoft 365 Benchmark, CMMC, HIPAA, or SOC 2 exposure

Experience with terminal/IaC approaches to M365 config (Microsoft365DSC, Terraform for Entra)

Python or TypeScript

Not a fit if

You’ve mostly done end-user support and ticket triage

Your M365 experience is a single tenant you inherited

You need to be told each next step .

-Requerimientos- Educación mínima: Universitaria / I.P. / C.F.T.
8 años de experiencia
Idiomas: Inglés
Conocimientos: Azure, Microsoft 365, Sharepoint, Teams, Implementación de soluciones en la nube, Implementación de soluciones itsm
Palabras clave: arquitecto, architecture, arquitectura