Principal Microsoft Entra ID Architect

Unisys•Whitpain Township, PA

About The Position

The Principal Microsoft Entra ID Architect is a hands-on security architecture role responsible for leading the design, implementation, governance, and ongoing evolution of corporate Microsoft Entra ID tenants. The role advances the corporate strategy to reduce reliance on Active Directory by adopting secure cloud identity capabilities, while providing senior security architecture and strategic guidance to keep Active Directory environments secure, resilient, operationally sound, recoverable, and properly integrated during the transition. The architect establishes enterprise identity architecture and target-state roadmaps aligned with Zero Trust principles, corporate security policies, and industry practices. The position emphasizes Entra ID, cloud identity governance, authentication, authorization, application access, and hybrid identity, balancing security, availability, supportability, cost, and business requirements. It also provides senior architectural guidance and escalation for Active Directory security and hybrid identity issues in partnership with the established Active Directory team, rather than assuming day-to-day operational ownership. The role works across security, engineering, operations, governance, leadership, and business-unit teams to adopt identity standards, address material risks, and deliver modernization initiatives. It monitors and communicates progress, dependencies, risk reduction, and business impact, while staying current on identity threats, Microsoft security capabilities, regulatory requirements, and industry practices. The position may require access to export-controlled commodities and technology; applicants should be eligible for any required U.S. Government authorizations.

Requirements

BA/BS degree and 8 or more years of relevant experience, or an equivalent combination of education and experience.
At least 5 years with a primary focus on Microsoft Azure/Entra ID.
Experience in an engineering or architectural role responsible for Microsoft Entra ID, Active Directory, and hybrid identity environments.
Experience implementing Conditional Access, MFA, identity protection, and PIM.
Hands-on experience with Entra Connect, Cloud Sync, federation, SSO, and application integrations.
Experience securing application registrations, service principals, and enterprise applications in single-tenant and multi-tenant environments.
Deep expertise in Microsoft Entra ID, including Conditional Access, Entra directory configuration, roles and permissions, and PIM.
Proficiency in PowerShell, Graph API, and automation, including creating and modifying scripts for configuration and access reporting.
Strong understanding of modern authentication protocols, including SAML, OAuth 2.0, OpenID Connect, Kerberos, and LDAP.
Experience with Microsoft Graph API application and delegated permissions, including how they apply and secure assignment methods.

Nice To Haves

10 or more years of related experience.
Master’s degree.

Responsibilities

Design and govern corporate Microsoft Entra ID tenant directory baselines, configurations, roles, permissions, and consent management.
Enforce least privilege through delegated and application permission models, and develop automated workflows to review and approve sensitive permission requests.
Implement tenant disaster recovery and recoverability using cost-effective approaches.
Implement application access reviews to validate permissions and maintain least-privileged access.
Secure application secrets and certificates, integrating with corporate PKI and Azure Key Vaults.
Design and enforce Conditional Access policies using user, location, device, and risk signals in coordination with the security team.
Conduct threat modeling and risk assessments for authentication and authorization flows.
Monitor application and service principal activity using Microsoft Sentinel, Azure Monitor, and Entra ID audit logs.
Define and maintain enterprise identity architecture leveraging Microsoft Entra ID.
Lead adoption of modern authentication, including OAuth, OIDC, SAML, FIDO2, and passwordless authentication.
Implement identity lifecycle automation using Entra ID Governance (IGA), Privileged Identity Management (PIM), and Access Reviews.
Deploy and manage Entra Connect, Cloud Sync, federation, and SSO configurations.
Integrate third-party SaaS and internal applications with Entra ID for SSO and SCIM provisioning.
Support rollout of MFA, passwordless authentication, and secure sign-in enhancements.
Provide senior security architecture and strategic direction for corporate Active Directory environments, particularly the production environment.
Define and govern enterprise Active Directory architecture, security, privileged access, resilience, and operational standards.
Partner with Active Directory engineering and operations teams to maintain secure, resilient, operationally sound, and recoverable directory services.
Architect and oversee secure integration between Active Directory and Microsoft Entra ID across hybrid identity services.
Advance the strategy to modernize identity services and transition appropriate capabilities from Active Directory to Microsoft Entra ID.
Assess architectural risks and legacy dependencies, guide remediation and dependency-reduction initiatives, and provide senior escalation for complex or high-risk decisions.
Lead structured problem-solving for complex, high-impact identity and security challenges, primarily involving Entra ID, cloud identity governance, authentication, authorization, and application access.
Develop scalable Entra ID target-state architectures and prioritized roadmaps that balance security, availability, operational supportability, cost, and business requirements.
Analyze systemic identity risks, legacy dependencies, and cloud and hybrid integration challenges, translating findings into remediation and modernization strategies.
Drive alignment among security, engineering, operations, governance, leadership, and business-unit teams to ensure adoption of identity standards and resolution of material risks.
Track and communicate progress, dependencies, risk reduction, and business impact for major Entra ID and related Active Directory initiatives.
Stay current on identity-based threats, Microsoft security capabilities, regulatory requirements, and industry practices to guide identity security strategy.