Microsoft 365 Identity Endpoint Administrator

Plus Relocation•Minneapolis, MN

1d•$84,000 - $105,000•Hybrid

About The Position

Plus Relocation is seeking a hands-on Microsoft administrator to own the identity lifecycle across on-premises Active Directory and Entra ID, manage Windows endpoints, and improve automation, security, and the employee experience. This is more than a help desk role and includes administration of Microsoft 365 services and endpoint management, as well as local and remote employee support. The position is hybrid and based in Minneapolis, Minnesota. The role partners with Security and Compliance on identity and endpoint security, audits, data deletion, and responsible use of approved AI tools. The company describes a potential growth path from identity, Microsoft administration, and endpoint ownership in Year 1, to automation and technical project leadership in Year 2, and potentially Senior Systems and Automation Engineer in Year 3. Progression depends on demonstrated capability and business needs. The annual base salary range is $84,000–$105,000, depending on qualifications. The position is eligible for an annual discretionary profit-sharing bonus, paid floating holiday, and 401(k) retirement contributions. Other benefits include medical plans, dental and vision coverage, an HSA with employer contributions, PTO, paid volunteer hours, company-paid life, AD&D, short- and long-term disability insurance, an EAP, wellness incentives, and a strengths-based development culture.

Requirements

At least 3 years of hands-on Active Directory administration in a production domain, including users, groups, OUs, delegation, DNS, and replication basics.
Demonstrated Group Policy experience, including authoring, precedence and inheritance, security and WMI filtering, and troubleshooting with gpresult and RSOP.
Hybrid identity experience with Entra Connect or Cloud Sync, including sync scope, source of authority, and the difference between disabling a user on-premises and in the cloud.
Practical knowledge of role-based access and least privilege, including Entra administrative roles, the tiered admin model, and separate admin accounts for privileged work.
Working PowerShell skills using the ActiveDirectory module and Microsoft Graph PowerShell for bulk and scheduled identity tasks.
Ability to explain a complete offboarding process, including disabling the account and resetting its password, revoking sessions and MFA methods, removing groups and licenses, handling the mailbox and OneDrive, removing device access, and capturing evidence for each step.
Experience with NTFS and share permissions on Windows file servers.
Hands-on Microsoft 365 administration, confident Windows troubleshooting, and solid networking fundamentals.
Clear communication, strong service instincts, sound security judgment, and ownership.

Nice To Haves

Intune and Autopilot experience.
Microsoft Defender experience.
Purview experience.
Conditional Access experience.
SaaS administration experience.
Compliance or audit experience.
Certifications such as AZ-802 (Windows Server Hybrid Administrator Associate), SC-300 (Identity and Access Administrator), or MD-102 (Endpoint Administrator); practical experience is valued more than certifications.

Responsibilities

Own the identity lifecycle across on-premises Active Directory and Entra ID, including preparing new-hire accounts, processing internal transfers, and deprovisioning departing employees within 24 hours.
Design and maintain role-based access using security groups and the AGDLP model, applying least privilege to file shares, applications, and administrative roles.
Administer Group Policy, organizational unit structure, and delegation of control.
Conduct access reviews and clean up stale and orphaned accounts, unowned groups, nested-group sprawl, and privileged role membership; produce audit-ready evidence.
Administer Microsoft 365, including Exchange Online, Teams, and SharePoint.
Manage Windows endpoints through Intune, Autopilot, configuration policies, updates, and application deployment.
Provide hands-on support for local employees and remote support for U.S. and global employees across devices, Microsoft 365, and business applications.
Build PowerShell and Microsoft Graph automations that run under dedicated service accounts, gMSAs, or app registrations, with documented permissions, ownership, and change control.
Partner with Security and Compliance on MFA, Conditional Access, data deletion, audits, and responsible use of approved AI tools.

Benefits

Annual discretionary profit-sharing bonus.
Paid floating holiday.
401(k) retirement contributions.
Multiple medical plan options, with a significant portion of premiums paid by the company.
Dental and vision coverage.
Health Savings Account (HSA) with employer contributions.
Paid Time Off (PTO).
Paid volunteer hours.
Company-paid life, AD&D, short-term disability, and long-term disability insurance.
Employee Assistance Program (EAP).
Wellness incentives.
Strengths-based development culture.
Hybrid work arrangement.