Senior Intune Architect (Windows)

pbLocation: /b Remote within Europe (CET working hours) /p pbStart: /b ASAP /p pbContract: /b Initial 6-month contract with potential extension /p pThis programme is transforming a global Windows estate of approximately b29,000 devices /b from on-premises management to bMicrosoft Intune /b. /p pThe role has two key objectives: /p ulliTransition all production devices from bGroup Policy and SCCM /b to Intune through co-management, replacing legacy GPOs with a standardized policy set aligned to bCIS benchmarks /b, while ensuring migration, orchestration, and rollback processes are fully built and tested prior to deployment. /liliBuild, test, and validate a bWindows Autopilot /b provisioning solution so that it becomes the standard method for deploying Windows devices, with bWindows Hello for Business /b, compliance, and security services operational from first sign-in. /li /ul pAs the bSenior Intune Architect /b, you will own the Intune workstream, including the standard policy framework, GPO analysis and migration to Intune, Autopilot design and implementation, and the delivery of identity and security services required for provisioning. /p pWorking alongside a Senior Endpoint Engineer responsible for co-management, task sequences, application packaging, and deployment automation, you will play a key role in the successful delivery of the programme. /p pThis is a bhands-on delivery role /b. You will build, test, document, deploy, troubleshoot, and support solutions throughout the project lifecycle. /p h3What You Will Deliver /h3 ulliA standardized bIntune policy framework /b for Windows 11, Microsoft Defender, Edge, and Microsoft 365 Apps, aligned to CIS benchmarks, with documented settings, approved exceptions, and phased retirement of legacy policies. /liliA detailed GPO assessment and migration, ensuring required settings are rebuilt in Intune (including certificates, Wi‑Fi, OneDrive, local admin, Start Menu, Taskbar, proxy, and VPN configurations) and legacy policies can be safely retired at cutover. /liliAn end-to-end Windows Autopilot solution, including deployment profiles, ESP, Group Tags, OEM registration, existing device registration, and Hybrid Entra ID Join scenarios. /liliImplementation of Windows Hello for Business, BitLocker, Entra LAPS, Defender for Endpoint, compliance policies, update rings, Intune RBAC, and Conditional Access in partnership with Security and IAM teams. /liliTesting and support of migration activities, including policy transition, rollback procedures, pilot deployments, and production rollout waves. /liliComplete technical documentation, including build notes, SOPs, runbooks, readiness evidence, and service desk knowledge articles. /li /ul h3What You Must Have /h3 ulli8+ years of Windows endpoint engineering experience and 5+ years of hands-on Microsoft Intune experience. /liliProven experience building and deploying Intune solutions for 10,000+ Windows devices, including production rollout ownership. /liliHands-on delivery of Windows Autopilot with Hybrid Entra ID Join, including Intune Connector for Active Directory and Enrollment Status Page (ESP) design. /liliExperience implementing CIS or Microsoft security baselines through Intune Settings Catalog and migrating complex GPO environments to Intune. /liliStrong knowledge of SCCM co-management, workload transitions, and troubleshooting during cutover. /liliExperience with PKCS certificates, Windows Hello for Business, Entra LAPS, Defender for Endpoint, BitLocker, and Conditional Access in hybrid identity environments. /liliProven ability to create build documentation, operational runbooks, and support handover materials for production services. /li /ul h3Nice to Have: /h3 ulliRegulated environment. /liliGlobalProtect pre-logon. /liliIntune Suite. /liliGraph and PowerShell for evidence. /liliMD-102, MS-102 or SC-300. /li /ul h3Important /h3 pThis is a hands-on delivery role, not an advisory, architecture-only, or support-only position. Candidates should have personally delivered enterprise Intune implementations and migrations. Experience limited to support functions or environments smaller than 5,000 endpoints is unlikely to be suitable. /p