The role
Job description
ROLE OVERVIEW
The Identity & Access Management (IAM) Architect is a senior technical role responsible for designing, implementing and governing enterprise identity architecture across Microsoft Entra ID (Azure AD), on-premises Active Directory, Microsoft 365 and federated SaaS identity providers. The role owns authentication, authorisation, privileged access and the full identity lifecycle — ensuring secure, consistent and auditable access across the organisation.
The role combines deep architectural expertise in Entra ID / Active Directory, SSO, conditional access and privileged access management with strong operating discipline across Microsoft 365 governance, endpoint identity, compliance rules and SaaS identity integrations. The ideal candidate is equally comfortable designing JML (joiner-mover-leaver) automation, authoring conditional access and transport / DLP policies, operating PIM / PAM and partnering with Security, HR and Business stakeholders to enforce least-privilege and zero-standing-privilege models.
KEY RESPONSIBILITIES
1. Identity & Access Management Architecture
• Act as the IAM architect for the estate — design and maintain the identity architecture across Microsoft Entra ID (Azure AD), on-premises Active Directory and federated / SaaS identity providers.
• Define reference architectures, standards and patterns for identity integration across cloud, on-prem and SaaS workloads.
• Govern tenant-level identity configuration, directory topology, synchronisation (Entra Connect) and hybrid identity design.
• Partner with Security, Risk and Compliance to ensure identity architecture meets enterprise, regulatory and client-audit requirements.
2. Authentication & Authorisation
• Architect authentication and authorisation patterns — Single Sign-On (SSO), Multi-Factor Authentication (MFA), Conditional Access, SCIM provisioning and least-privilege / RBAC and ABAC models.
• Design and operate conditional-access policy frameworks, risk-based access, device compliance signals and session controls.
• Integrate SaaS applications and internal workloads through SAML, OIDC, OAuth 2.0 and SCIM standards.
• Maintain a tested, documented policy baseline with regular review and change-controlled updates.
3. Privileged Access Management (PAM / PIM)
• Design and manage Privileged Access Management (PAM), Privileged Identity Management (PIM) and just-in-time / zero-standing-privilege access.
• Govern break-glass accounts, emergency access procedures and privileged-session monitoring / recording.
• Implement and enforce approval workflows, time-bound access and periodic reviews of all privileged roles.
4. Identity Lifecycle Automation
• Automate the full identity lifecycle — joiner-mover-leaver (JML), access reviews, entitlement management and periodic recertification.
• Integrate with HRIS and Service Management platforms to drive deterministic provisioning and de-provisioning.
• Operate access reviews and attestation campaigns for applications, groups, privileged roles and guest access.
5. Microsoft 365 Governance & Rule Management
• Administer and govern the Microsoft 365 tenant — Exchange Online, SharePoint, OneDrive, Teams and Intune — to enterprise standards.
• Configure and manage mail-flow / transport rules, retention and DLP policies, compliance and sensitivity labels and eDiscovery.
• Govern identity and licensing within M365 — licence assignment logic, group-based licensing and lifecycle of Teams, M365 Groups and SharePoint sites.
• Define and enforce M365 governance for provisioning, external sharing, guest access and lifecycle management.
6. Endpoint Identity, Device Compliance & Intune
• Manage endpoint provisioning, imaging, patching and compliance through Intune / Autopilot / SCCM (MECM).
• Enforce endpoint security baselines, encryption and configuration policies that feed identity and conditional-access decisions.
• Operate device-trust and device-compliance signals as inputs to the Zero Trust access model.
7. IAM Monitoring, Audit & Reporting
• Implement monitoring, alerting and reporting for identity events — sign-ins, risk detections, privileged-access usage and policy violations.
• Produce access, entitlement and privileged-access reports for client audits, ISO / ISMS and internal governance.
• Automate recurring IAM operations using PowerShell, Microsoft Graph API and Entra ID governance capabilities to reduce manual effort and drift.
• Maintain accurate IAM documentation, runbooks and knowledge-base articles.
8. Vendor, Supplier & Service Management
• Manage identity and M365-adjacent suppliers and partners — performance against SLAs, contract and renewal management and escalations.
• Evaluate new identity / IGA / PAM tooling; build business cases and coordinate procurement with IT and Security leadership.
• Operate within ITIL-aligned change, incident and problem management processes.
EDUCATION & CERTIFICATIONS
Education
• Bachelor’s degree in Computer Science, Information Technology or a related field (or equivalent experience).
Required / Preferred Certifications
• Microsoft Identity (required): SC-300 (Microsoft Identity and Access Administrator).
• Microsoft 365 (required): MS-102 (Microsoft 365 Administrator).
• Microsoft Security (preferred): SC-100 (Cybersecurity Architect Expert); AZ-500 (Azure Security Engineer).
• Azure foundations (advantageous): AZ-104 (Azure Administrator).
• Service Management: ITIL Foundation.
• Security (advantageous): CISM, CISSP or equivalent industry-recognised security certification.
EXPERIENCE REQUIREMENTS
• Minimum 8–10 years of hands-on IT experience, with at least 5 years in a dedicated Identity & Access Management or Microsoft 365 governance role in an enterprise environment.
• Proven, deep expertise in Microsoft Entra ID (Azure AD), on-premises Active Directory and hybrid identity (Entra Connect, federation).
• Demonstrable experience designing and operating Conditional Access, MFA, SSO, SCIM provisioning and RBAC / ABAC authorisation models at scale.
• Hands-on experience with Microsoft 365 governance — transport / DLP / retention rule management, sensitivity labels, eDiscovery and tenant-wide policy.
• Strong track record implementing Privileged Access Management (PAM / PIM), just-in-time access and privileged-session controls.
• Experience automating JML and access-review processes using PowerShell, Microsoft Graph API or an IGA platform.
• Experience managing endpoints and endpoint-identity through Intune / Autopilot / SCCM in a Zero Trust context.
• Experience supporting client audits, ISO / ISMS reviews and privileged-access documentation.
TECHNICAL SKILLS & COMPETENCIES
Core Technical Skills
• Identity platforms: Microsoft Entra ID (Azure AD), on-premises Active Directory, Entra Connect, hybrid identity and federated SaaS identity providers.
• Authentication & authorisation: SSO (SAML, OIDC, OAuth 2.0), MFA, Conditional Access, SCIM provisioning, RBAC and ABAC.
• Privileged access: Entra Privileged Identity Management (PIM), PAM tooling, just-in-time and zero-standing-privilege models, break-glass procedures.
• Microsoft 365: Exchange Online, SharePoint, OneDrive, Teams, Intune; transport / DLP / retention rule management, sensitivity labels, eDiscovery.
• Endpoint & device identity: Intune, Autopilot, SCCM (MECM); device compliance, encryption and endpoint security baselines feeding Conditional Access.
• Identity governance: Entra ID Governance (access reviews, entitlement management, lifecycle workflows); JML automation; recertification.
• Automation: PowerShell, Microsoft Graph API, scripted identity operations; integration with HRIS and Service Management platforms.
• Monitoring & audit: Entra sign-in and audit logs, Identity Protection, Microsoft Defender for Identity, Log Analytics; audit-grade reporting.
SOFT SKILLS & COMPETENCIES
• Problem-solving: Strong analytical and structured problem-solving with a methodical, documentation-driven approach.
• Communication: Clear written and verbal English; able to explain identity, access and governance topics to non-technical stakeholders including HR, Risk and Leadership.
• Ownership: Reliable ownership of identity health, security posture, compliance and audit outcomes with minimal supervision.
• Governance mindset: A default preference for policy-as-code, repeatable controls, access reviews and provable, auditable processes.
• Collaboration: Effective cross-team collaboration with Security, HR, Infrastructure and Application teams within ITIL processes.
ADDITIONAL REQUIREMENTS
• Based in Gurugram or Hyderabad, with flexibility to work in shifts and provide on-call / out-of-hours support as required.
• Willingness to travel occasionally to other sites for identity, M365 and endpoint projects.
• High integrity and commitment to maintaining the confidentiality of all client, applicant and company information.