Microsoft Identity Administrator

City of Durham•Durham, NC

5d•Onsite

About The Position

The Microsoft Identity Administrator is responsible for overseeing and maintaining the City of Durham’s enterprise identity and access management infrastructure. This position serves as the primary administrator of Microsoft Entra ID (formerly Azure Active Directory) and on-premises Active Directory, ensuring secure, reliable, and compliant access across all City systems and applications. The role encompasses user lifecycle management, access control, identity security monitoring, hybrid identity synchronization, and authentication policy administration. The Microsoft Identity Administrator also functions as the lead for identity governance, privileged access management, and automation of identity workflows, supporting a Zero Trust security posture across the enterprise. The ideal candidate brings deep technical expertise in Microsoft identity platforms, strong analytical judgment, and the ability to collaborate effectively across IT, cybersecurity, and business operations teams.

Requirements

Bachelor’s degree in Computer Science, Information Technology, Business, or a closely related field; relevant experience may substitute on a year-for-year basis.
Minimum five (5) years of progressive experience managing enterprise identity and access management systems.
Demonstrated hands-on experience with Microsoft Entra ID (Azure Active Directory), on-premises Active Directory, and Microsoft Entra Connect.
Proficiency in PowerShell scripting and Microsoft Graph API for identity automation and administration.
Experience working in compliance-driven environments, preferably within government or other regulated sectors.
Strong knowledge of authentication protocols including SAML 2.0, OAuth 2.0, OpenID Connect, and WS-Federation.
Microsoft Certified: Identity and Access Administrator Associate (SC-300) or equivalent certification required at time of hire or within 12 months of appointment.

Nice To Haves

Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900) preferred.
Experience with Oracle Identity Management (OIM/OAM), including SSO configuration and identity lifecycle automation.
Microsoft Intune administration experience including device enrollment, compliance policy configuration, and application deployment.
Oracle Certified Professional (OCP) designation or other industry-recognized identity and access management certifications.
Familiarity with Microsoft Sentinel, Azure Monitor Workbooks, and SIEM integration for identity log analysis.
Experience with Privileged Identity Management (PIM), entitlement management, and lifecycle workflows within Microsoft Entra ID Governance.
Knowledge of Zero Trust security principles and their application in a hybrid cloud environment.
Strong analytical, written communication, and documentation skills with the ability to translate technical concepts for non-technical audiences.

Responsibilities

Create, modify, and deprovision user, service, and group accounts in Microsoft Entra ID and on-premises Active Directory.
Maintain group memberships, role assignments, and naming conventions in alignment with organizational standards.
Coordinate with Human Resources to ensure identity provisioning aligns with HR data feeds and automated onboarding and offboarding workflows.
Administer Conditional Access policies and Role-Based Access Control (RBAC) across enterprise applications and platforms.
Evaluate and process access requests in accordance with least privilege and separation of duties principles.
Review and enforce access governance policies to ensure compliance with City security standards.
Monitor sign-in activity, Multi-Factor Authentication (MFA) enforcement, and Identity Protection alerts on a daily basis.
Investigate risky users, blocked sign-ins, and compromised accounts; partner with the Security Operations team to contain and resolve identity-based threats.
Produce audit reports for compliance, access reviews, and MFA adoption; provide evidence for internal and external audits.
Manage Microsoft Entra Connect and Cloud Sync configurations to maintain healthy synchronization between on-premises Active Directory and Entra ID.
Troubleshoot directory synchronization errors, password writeback issues, and hybrid join failures.
Monitor Entra Connect Health dashboards and proactively address replication or connectivity issues.
Configure and maintain MFA, passwordless sign-in methods, and FIDO2 authentication keys for City staff.
Support end users with MFA registration, authentication troubleshooting, and self-service password reset (SSPR).
Manage authentication strengths and configure Windows Hello for Business, Microsoft Authenticator App, and certificate-based authentication.
Administer Privileged Identity Management (PIM) to enforce just-in-time (JIT) role activation for privileged accounts.
Review and process privileged access requests, enforce approval workflows, and maintain audit logs of elevated access activity.
Conduct periodic access reviews for privileged roles and group memberships to ensure continued appropriateness.
Develop and enforce identity governance standards, lifecycle management policies, and automation scripts using PowerShell and Microsoft Graph API.
Maintain comprehensive documentation of identity configurations, policies, and administrative procedures.
Evaluate new Microsoft Entra features and recommend enhancements to improve security posture and operational efficiency.
Serve as Tier 2–3 escalation support for authentication, Conditional Access, Single Sign-On (SSO), and identity-related incidents.
Collaborate with IT and cybersecurity teams to resolve incidents efficiently and document root cause and corrective actions.
Provide technical guidance to End User Support engineers, systems administrators, and data center personnel on identity-related issues.
Manage provisioning, modification, and deprovisioning workflows using Oracle Identity Manager (OIM) and Oracle Access Manager (OAM).
Configure and maintain SSO and federation services across enterprise applications integrated with Oracle IAM.
Enroll and manage City endpoints across Windows, macOS, iOS, and Android platforms using Microsoft Intune (Endpoint Manager).
Configure device compliance policies, conditional access rules, application protection policies, and security baselines in Intune.