Microsoft 365 Identity Endpoint Administrator

Plus Relocation•Minneapolis, MN

1d•$84,000 - $105,000•Hybrid

About The Position

Plus Relocation is seeking a hands-on Microsoft administrator to own the identity lifecycle across on-premises Active Directory and Entra ID, administer Microsoft 365, and manage Windows endpoints. The role includes improving automation, security, and the employee technology experience, while providing technical support to local, US-based, and global employees. It is a hybrid position based in Minneapolis, Minnesota. The administrator will manage identity access and lifecycle processes, Group Policy, Microsoft 365 services, and endpoint configuration and deployment. The role also builds and documents PowerShell and Microsoft Graph automations and partners with Security and Compliance on identity security, data deletion, audits, and responsible use of approved AI tools. The position offers an annual base salary of $84,000–$105,000, depending on qualifications. The company describes a potential progression from identity, Microsoft administration, and endpoint ownership in Year 1 to automation and technical project leadership in Year 2, with a potential Senior Systems and Automation Engineer path in Year 3. Progression depends on demonstrated capability and business needs.

Requirements

At least 3 years of hands-on Active Directory administration in a production domain, including users, groups, OUs, delegation, DNS, and replication basics.
Demonstrated Group Policy experience, including authoring, precedence and inheritance, security and WMI filtering, and troubleshooting with gpresult and RSOP.
Hybrid identity experience with Entra Connect or Cloud Sync, including sync scope, source of authority, and the difference between disabling a user on-premises and in the cloud.
Practical knowledge of role-based access and least privilege, including Entra admin roles, the tiered admin model, and separate admin accounts for privileged work.
Working PowerShell skills with the ActiveDirectory module and Microsoft Graph PowerShell for bulk and scheduled identity tasks.
Ability to explain a complete offboarding process, including disabling the account and resetting the password, revoking sessions and MFA methods, removing groups and licenses, handling the mailbox and OneDrive, removing device access, and capturing evidence of each step.
Experience with NTFS and share permissions on Windows file servers.
Hands-on Microsoft 365 administration, confident Windows troubleshooting, and solid networking fundamentals.
Clear communication, strong service instincts, sound security judgment, and ownership.

Nice To Haves

Intune and Autopilot experience.
Microsoft Defender experience.
Purview experience.
Conditional Access experience.
SaaS administration experience.
Compliance or audit experience.
Certifications such as AZ-802 (Windows Server Hybrid Administrator Associate), SC-300 (Identity and Access Administrator), or MD-102 (Endpoint Administrator); practical experience is valued more than certifications.

Responsibilities

Own the identity lifecycle across on-premises Active Directory and Entra ID, including preparing new-hire accounts, processing transfers, and deprovisioning departing employees within 24 hours.
Design and maintain role-based access using security groups and the AGDLP model, applying least privilege to file shares, applications, and administrative roles.
Administer Group Policy, OU structure, and delegation of control.
Conduct access reviews and clean up stale or orphaned accounts, unowned groups, nested-group sprawl, and privileged role membership; produce audit-ready evidence.
Administer Microsoft 365 services, including Exchange Online, Teams, and SharePoint.
Manage Windows endpoints through Intune, Autopilot, configuration policies, updates, and application deployment.
Provide hands-on support to local employees and remote support to US and global employees across devices, Microsoft 365, and business applications.
Build PowerShell and Microsoft Graph automations using dedicated service accounts, gMSAs, or app registrations, with documented permissions, ownership, and change control.
Partner with Security and Compliance on MFA, Conditional Access, data deletion, audits, and responsible use of approved AI tools.

Benefits

Annual discretionary profit-sharing bonus.
Paid floating holiday.
401(k) retirement contributions.
Multiple medical plan options, with a significant portion of premiums paid by the company.
Dental and vision coverage.
Health Savings Account (HSA) with employer contributions.
Paid Time Off (PTO) and paid volunteer hours.
Company-paid life, AD&D, short-term disability, and long-term disability insurance.
Employee Assistance Program (EAP).
Wellness incentives and a strengths-based development culture.
Hybrid work arrangement.