Microsoft Cloud Architect - Fully Remote

Job Description

Job Description

Job Description

About the work

We’re Wired CIO — a technology consulting and managed services practice supporting SMB and mid-market clients. We manage Microsoft 365 across many client tenants, and we’re increasingly building AI-assisted workflows on top of that stack — Copilot rollouts, agents that read and act on tenant data, and internal automation.

We’re looking for a certified Microsoft 365 engineer to work with us on an ongoing hourly basis. This is not a helpdesk role. We need someone who can be handed a tenant and a goal and figure out the path — someone who reads the Graph docs rather than guessing, who understands why a Conditional Access policy is breaking something, and who documents what they did so the next person isn’t reverse-engineering it.

You’ll be one of a small number of engineers, working async, with real ownership of the environments you touch.

What you’ll be doing

Tenant engineering and administration

• Design and implement Entra ID configurations: Conditional Access, authentication methods, PIM, app registrations, enterprise app SSO, cross-tenant access
• Build and maintain Intune configurations — compliance policies, configuration profiles, app deployment, Autopilot, Endpoint Privilege Management
• Configure and tune Defender for Office 365 / Defender for Endpoint, safe links and attachments, anti-phishing, and alert tuning that doesn’t drown us in noise
• Exchange Online, SharePoint Online, OneDrive, and Teams configuration and governance
• Purview work: retention, DLP, sensitivity labels, eDiscovery when it comes up
• Migrations and tenant-to-tenant work: mailboxes, OneDrive/SharePoint content, identity cutover

Multi-tenant / MSP specifics

• Work across many client tenants without cross-contaminating configuration or data — you take tenant boundaries seriously
• Use GDAP correctly; understand delegated access, least-privilege partner roles, and what breaks when GDAP relationships lapse
• Standardize: build baselines that can be applied consistently across tenants rather than snowflaking every client
• Work with our tooling stack: CIPP, Microsoft 365 Lighthouse, NinjaOne, Huntress EDR, Custom PSA/ITSM
• Write documentation and runbooks as you go

Automation and scripting

• Microsoft Graph (REST and the Graph PowerShell SDK) for reporting, bulk changes, and anything the portal makes painful
• PowerShell at a real level — functions, error handling, parameterized scripts others can run, not one-off snippets
• Azure Automation, Logic Apps, n8n, or Power Automate for scheduled and event-driven work
• Registering and scoping app registrations properly: application vs. delegated permissions, admin consent, certificate/secret hygiene, and knowing when a permission request is too broad

AI and Copilot project work

• Microsoft 365 Copilot readiness and rollout: licensing, permissions hygiene (oversharing remediation before you turn Copilot on), Copilot Studio agents, Restricted SharePoint Search where needed
• Help build and test AI agents that touch tenant data — scoping what an agent is allowed to read and do, and validating it behaves correctly
• Pressure-test agent output for correctness and data-boundary problems; help design guardrails
• You don’t need to be an AI expert. You need genuine curiosity about it and the discipline to think about what happens when an agent has read access to a client’s entire tenant.

What we’re looking for

Required

• Active Microsoft certification — at minimum MS-102 (Microsoft 365 Administrator). Microsoft 365 Certified: Administrator Expert, SC-300 (Identity and Access Administrator), MD-102 (Endpoint Administrator), SC-200, or AZ-104 are all strong additions.
• [4]+ years hands-on Microsoft 365 engineering, including production Entra ID and Intune work
• Real PowerShell and Microsoft Graph proficiency — you’ll be asked about this specifically
• Experience working across multiple tenants (MSP, CSP partner, or consultancy background)
• Clear written English. Most of our communication is async and written.
• Comfortable working in a client-data environment: you follow least privilege, you use MFA, you don’t paste tenant data into random tools

Nice to have

• CIPP, Microsoft 365 Lighthouse, or similar multi-tenant management tooling
• Azure experience beyond M365 — networking, Key Vault, Functions, App Service
• Copilot Studio, Power Platform, or Microsoft 365 Agents SDK experience
• Security frameworks: CIS Microsoft 365 Benchmark, CMMC, HIPAA, or SOC 2 exposure
• Experience with terminal/IaC approaches to M365 config (Microsoft365DSC, Terraform for Entra)
• Python or TypeScript

Not a fit if

• You’ve mostly done end-user support and ticket triage
• Your M365 experience is a single tenant you inherited
• You need to be told each next step