Identity & Access Management Architect

ROLE OVERVIEW

The Identity & Access Management (IAM) Architect is a senior technical role responsible for designing, implementing and governing enterprise identity architecture across Microsoft Entra ID (Azure AD), on-premises Active Directory, Microsoft 365 and federated SaaS identity providers. The role owns authentication, authorisation, privileged access and the full identity lifecycle ensuring secure, consistent and auditable access across the organisation.

The role combines deep architectural expertise in Entra ID / Active Directory, SSO, conditional access and privileged access management with strong operating discipline across Microsoft 365 governance, endpoint identity, compliance rules and SaaS identity integrations. The ideal candidate is equally comfortable designing JML (joiner-mover-leaver) automation, authoring conditional access and transport / DLP policies, operating PIM / PAM and partnering with Security, HR and Business stakeholders to enforce least-privilege and zero-standing-privilege models.

KEY RESPONSIBILITIES1.Identity & Access Management Architecture

• Act as the IAM architect for the estate — design and maintain the identity architecture across Microsoft Entra ID (Azure AD), on-premises Active Directory and federated / SaaS identity providers.
• Define reference architectures, standards and patterns for identity integration across cloud, on-prem and SaaS workloads.
• Govern tenant-level identity configuration, directory topology, synchronisation (Entra Connect) and hybrid identity design.
• Partner with Security, Risk and Compliance to ensure identity architecture meets enterprise, regulatory and client-audit requirements.

2.Authentication & Authorisation

• Architect authentication and authorisation patterns — Single Sign-On (SSO), Multi-Factor Authentication (MFA), Conditional Access, SCIM provisioning and least-privilege / RBAC and ABAC models.
• Design and operate conditional-access policy frameworks, risk-based access, device compliance signals and session controls.
• Integrate SaaS applications and internal workloads through SAML, OIDC, OAuth 2.0 and SCIM standards.
• Maintain a tested, documented policy baseline with regular review and change-controlled updates.

3.Privileged Access Management (PAM / PIM)

• Design and manage Privileged Access Management (PAM), Privileged Identity Management (PIM) and just-in-time / zero-standing-privilege access.
• Govern break-glass accounts, emergency access procedures and privileged-session monitoring / recording.
• Implement and enforce approval workflows, time-bound access and periodic reviews of all privileged roles.

4.Identity Lifecycle Automation

• Automate the full identity lifecycle — joiner-mover-leaver (JML), access reviews, entitlement management and periodic recertification.