Microsoft 365 engineer in identity management

Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.

• Users, dynamic and assigned groups, administrative units, directory roles, service principals, workload identities.
• Conditional Access design and rollout: named locations, client app and platform conditions, session controls, sign-in frequency, break-glass exclusions, report-only staging.
• Authentication methods policy and phishing-resistant factors.
• Application onboarding over SAML 2.0 (NameID, claims mapping, signing certificate rollover, encrypted assertions) and OIDC / OAuth 2.0 (authorization code with PKCE, client credentials, device code).
• App registrations: redirect URIs, permissions, admin consent workflow, secret and certificate lifecycle.
• SCIM 2.0 provisioning: attribute mappings, scoping filters, expression transformations, quarantined jobs, drift reconciliation.
• Tenant consent settings, OAuth grant review, remediation of over-permissioned and stale applications; defensible controls for SaaS without SSO or SCIM support.
• Joiner-mover-leaver as an automated pipeline: provisioning, group-based licensing, revocation with session and refresh token invalidation.
• Least privilege for admin access: scoped role assignments, RBAC, PIM, access reviews, entitlement management access packages.
• Service account and workload identity governance: ownership, credential rotation, permission scoping, decommissioning.
• Microsoft 365 tenant settings, licensing, admin roles; access and permission issues in Exchange Online, SharePoint Online, Power Platform.
• Diagnostics from sign-in, audit, and provisioning logs, with diagnostic settings routed to Log Analytics and KQL queries.
• Cross-tenant access settings and B2B external collaboration.
• PowerShell tooling on the Microsoft Graph PowerShell SDK and Graph REST API: lifecycle, licensing, access reporting, recertification.
• Google-side automation through the Admin SDK Directory API, Cloud Identity API, and gcloud.
• Scheduled and event-driven workflows in Azure Automation Runbooks, Azure Logic Apps, or Power Automate.
• Unattended execution on managed identities and narrowly scoped app registrations, with credential rotation, structured logging, error handling, and retries.
• Automation treated as production code: version control, peer review, documented rollback.

• Decode a SAML assertion or JWT and pinpoint the failure — audience mismatch, NameID format, expired signing certificate, missing claim — without escalating to the vendor.
• Diagnose a failing SCIM job and tell scoping from attribute mapping, transformation expressions, or target schema.
• Replace a manual lifecycle process with automation that logs, retries, and can be handed to someone else to run.
• 3+ years administering Microsoft Entra ID in production as a primary responsibility.
• Microsoft 365 tenant: settings, licensing, admin roles, Service Health
• Exchange Online: mailbox permissions, groups, mail flow, SPF/DKIM/DMARC
• Microsoft Defender: threat policies, quarantine, message trace
• Power Platform: environments, DLP connector policies, maker access
• PowerShell: Exchange Online module, Microsoft Graph SDK
• Enterprise applications, app registrations, consent and permission models, automated provisioning.
• Azure Automation Runbooks, Azure Logic Apps, Power Automate, or comparable platforms.
• Least privilege, secure administration, change management, and the discipline to leave configurations documented.
• Written and spoken English at B2 or higher.
• Будет плюсом: SC-300, MS-102, or SC-401 — or equivalent demonstrable expertise; Microsoft Entra ID Governance: entitlement management, lifecycle workflows, Privileged Identity Management; Microsoft Purview (DLP, retention, eDiscovery), Microsoft Defender for Cloud Apps, or Microsoft Sentinel; Google Cloud IAM: projects, roles and policies, service accounts, API access, OAuth credentials; Google Cloud workload identity federation, custom roles, organization policy constraints; Git, CI/CD practices, Pester, Bicep, or Terraform; Access evidence for SOC 2, ISO 27001, or comparable audit cycles

• Competitive compensation
• Career growth and learning opportunities
• Flexibility and ownership
• Collaborative and innovative culture
• Opportunity to work on impactful AI projects
• International environment and talented teams
• Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI