Principal Microsoft Entra ID Architect

What success looks like in this role: Highly skilled Security Architect with deep expertise in Microsoft Entra ID to lead the design, implementation, and governance of company Entra ID tenants. The primary focus of this position is advancing the corporate IT strategy to reduce reliance on Active Directory by adopting secure, cloud-based identity capabilities in Microsoft Entra ID. While Active Directory remains critical to current operations, the role also provides senior security architecture and strategic guidance to ensure corporate Active Directory environments remain secure, resilient, operationally sound, and appropriately integrated throughout the transition. This role is pivotal in ensuring identity configurations, security, and operational practices align with Zero Trust principles, corporate security policies, and industry best practices. This is a hands-on role requiring technical depth, architectural leadership, and delivery focus. Entra ID 1. Design architect and SME for corporate tenant directory baseline configurations and settings. 2. Govern roles, permissions and consent management, enforcing least privilege through robust delegated and application permission models. 3. Manage user and admin consent settings and develop automated workflows for reviewing and approving sensitive permission requests. 4. Implement Tenant DR recoverability using best cost-effective means 5. Implement application access reviews to validate permissions and ensure least privileged access. 6. Design and drive optimal security and cost 7. Securely manage application secrets and certificates, integrating with corporate PKI infrastructure and Azure Key Vaults. 8. Design and enforce Conditional Access policies based on user, location, device, and risk signals in coordination with security team. 9. Conduct threat modeling and risk assessments for authentication and authorization flows. 10. Monitor application and service principal activity using Microsoft Sentinel, Azure Monitor, and Entra ID audit logs. 11. Define and maintain the enterprise identity architecture leveraging Microsoft Entra ID. 12. Lead the adoption of modern authentication (OAuth, OIDC, SAML, FIDO2, passwordless). 13. Implement identity lifecycle automation using tools such as Entra ID Governance (IGA), Privileged Identity Management (PIM), and Access Reviews. 14. Deploy and manage Entra Connect, Cloud Sync, federation, and SSO configurations. 15. Integrate third-party SaaS and internal applications with Entra ID for SSO and provisioning (SCIM). 16. Support the rollout of MFA, passwordless authentication, and secure sign-in enhancements. Active Directory Security and Architecture: 1. Provide senior security architecture and strategic direction for Active Directory environments across the corporation, with particular emphasis on the company's production environment. 2. Define and govern enterprise Active Directory architecture, security, privileged access, resilience, and operational standards. 3. Partner with Active Directory engineering and operations teams to ensure critical directory services remain secure, resilient, operationally sound, and recoverable. 4. Architect and oversee secure integration between Active Directory and Microsoft Entra ID across hybrid identity services. 5. Advance the corporate strategy to reduce reliance on Active Directory by modernizing identity services and transitioning appropriate capabilities to Microsoft Entra ID. 6. Assess architectural risks and legacy dependencies, guide remediation and dependency-reduction initiatives, and provide senior escalation for complex or high-risk security and design decisions. Strategic Problem Solving: 1. Lead structured problem-solving for complex, high-impact identity and security challenges, with primary emphasis on Microsoft Entra ID, cloud identity governance, authentication, authorization, and application access. 2. Develop s alable Entra ID target-state architectures and prioritized roadmaps that balance security, availability, operational supportability, cost, and business requirements. 3. Analyze systemic identity risks, legacy dependencies, and integration challenges across cloud and hybrid environments and translate findings into actionable remediation and modernization strategies. 4. Provide senior architectural guidance and escalation support for Active Directory security, architecture, resilience, and hybrid identity issues, partnering with the established Active Directory team rather than assuming day-to-day operational ownership. 5. Drive alignment among security, engineering, operations, governance, leadership, and business-unit teams to ensure identity standards are adopted and material risks are addressed. 6. Track and communicate progress, dependencies, risk reduction, and business impact for major Entra ID and related Active Directory initiatives. 7. Stay current on identity-based threats, Microsoft security capabilities, regulatory requirements, and industry practices to guide the long-term identity security strategy. You will be successful in this role if you have: Required 1. BA/BS degree and 8+ years' relevant experience OR equivalent combination of education and experience 2. 5+ years primary focus on Microsoft Azure/Entra ID 3. Demonstrated experience serving in an engineering or architectural role with responsibility for Microsoft Entra ID, Active Directory, and hybrid identity environments. 4. Experience implementing conditional access, MFA, identity protection, and PIM. 5. Hands-on experience with Entra Connect, Cloud Sync, federation, SSO, and app integrations. 6. Proven experience securing application registrations, service principals, and enterprise applications in single/multi-tenant environments. 7. Deep expertise in Microsoft Entra ID, including Conditional Access, Entra Directory Configuration, Roles and Permissions, Privileged Identity Management (PIM). 8. Proven expertise in PowerShell, Graph API, Automation and ability to create and modify scripts for purposes of configuration settings and report access. 9. Strong understanding of modern authentication protocols: SAML, OAuth 2.0, OpenID Connect, Kerberos and LDAP. 10. Experience with Microsoft Graph API permissions (Application and Delegated) with deep understanding of how they apply and most secure methods for assignment. Preferred 1. 10 or more years of related experience preferred 2. Master's degree preferred