Privileged Access & Identity Security Architect - Entra ID

Role summary

You will own how identity and privileged access are designed and governed across a hybrid Microsoft estate. As part of a zero-trust program, and building on lessons from recent identity incidents, you will define a tightened privileged access model in Entra ID and on-prem AD, set the policies and standards, and hold teams to them through reviews and governance. You are the policy owner and design authority; platform teams implement and operate under your direction.

Key responsibilities:Privileged access architecture

• Design and own the privileged access model based on Microsoft's Enterprise Access Model (control, management and user/workload planes), covering Entra ID and on-prem AD.
• Define standards for Privileged Identity Management (PIM): just-in-time, time-bound elevation, approval workflows, justification, MFA on activation, and PIM for Groups.
• Minimize standing privilege: remove permanent Global Administrator and other high-impact role assignments, apply least-privilege and custom roles, and use administrative units and restricted management where suitable.
• Define emergency access (break-glass) accounts, privileged access workstation requirements and secure admin pathways.

Identity controls and zero trust

• Design the Conditional Access framework: baseline policies, admin-specific policies, device compliance, location and risk conditions, authentication strengths and session controls.
• Drive phishing-resistant authentication (FIDO2 keys, passkeys, Windows Hello for Business, certificate-based authentication) for all privileged users.
• Use Entra ID Protection user and sign-in risk signals, and define responses to risky identities.
• Govern hybrid identity: Entra Connect / Cloud Sync security, AD tiering, Tier 0 protection and hardening against common AD attacks.

Non-human and workload identities

• Set policy for service principals, managed identities, app registrations and enterprise apps: ownership, credential hygiene, secret and certificate rotation, and workload identity federation in place of secrets.
• Control application consent and high-privilege API permissions (for example, Microsoft Graph) to block consent phishing and over-privileged apps.
• Govern on-prem service accounts and group Managed Service Accounts.

Identity governance and review policies

• Design and run access reviews for privileged roles, groups, guest users and applications, with clear reviewers, cadence and auto-remediation.
• Define joiner-mover-leaver controls with Entra ID Governance (entitlement management, access packages, lifecycle workflows).
• Maintain identity security policies, standards and exceptions; align with ISO 27001, DPDP Act and healthcare/GxP audit requirements.