Junior IAM Administrator

Responsibilities

• Provision and de-provision service principal names (SPNs) in Microsoft Entra in accordance with established standards and approval workflows.
• Create and administer Enterprise Applications, including configuration of sign-on settings, ownership assignment, and user/group assignment.
• Evaluate and assign API permissions, ensuring requested permissions are scoped to the minimum required and routed for appropriate approval when privileged.
• Coordinate with the Secrets Management team to track and complete client secret and certificate renewals in advance of expiration, preventing service outages.
• Review new application requests against IAM best practices and provide findings to governance boards prior to purchase or integration decisions.
• Evaluate the IAM components and integration requirements of proposed applications, documenting dependencies and gaps.
• Identify the level of support each application provides for modern authentication protocols, including OIDC, SAML, and Integrated Windows Authentication.
• Determine how users are provisioned and de-provisioned within the application (SCIM, Just-In-Time, or manual) and note the governance implications of each model.
• Review the permissions and privileges required by the application and flag excessive or unsupported access requirements.
• Field IAM consultation requests and provide analytical information regarding Entra, Active Directory, and AD-LDS components.
• Research and report security group information, including owners, membership, naming, and descriptions.
• Perform object management activities for service principals, service accounts, and groups where automation is not currently in place.
• Troubleshoot identity synchronization issues between identity providers, including Entra and Active Directory.
• Provide clear direction to consumers of IAM services on how to submit requests through approved intake channels.
• Troubleshoot and remediate Active Directory account repeat lockout events, identifying and reporting the source of the lockouts.
• Troubleshoot authentication failures for both human and non-human identities across Active Directory, AD-LDS, and Entra.
• Troubleshoot and resolve end user incidents involving YubiKey, HYPR, and LastPass.
• Troubleshoot and resolve authentication issues attributable to Conditional Access policy evaluation.
• Assist with object recovery in Active Directory for user, group, and computer objects.
• Ensure the security and integrity of identity solutions, including compliance with organizational and Information Security principles and practices.
• Perform other duties as assigned.

Requirements

• Associate degree in Information Technology, Computer Science, or a related field, or the equivalent combination of education, training, and experience.
• One to three years of experience in IT operations, service desk, systems administration, or a directly related technical support function.
• Working knowledge of Active Directory fundamentals, including users, groups, computers, organizational units, and authentication basics.
• Foundational understanding of authentication and authorization concepts, including single sign-on, multifactor authentication, and least privilege.
• Familiarity with the Microsoft Entra admin center and basic administration of users, groups, and applications.
• Demonstrated troubleshooting and problem isolation skills, with the ability to document findings clearly.
• Effective verbal and written communication skills and the ability to work directly with end users and application teams.
• Ability to follow documented procedures, change management processes, and approval workflows with a high degree of accuracy.
• Bachelor's degree in Information Technology, Cybersecurity, or a related field.
• Hands-on experience administering service principals, app registrations, and Enterprise Applications in Microsoft Entra, including API permission and consent models.
• Experience with ADFS relying party trusts, claim rules, and SAML signing and encryption certificate management.
• Practical knowledge of modern authentication protocols, including SAML 2.0, OIDC/OAuth 2.0, Kerberos, and Integrated Windows Authentication.
• Experience with SCIM-based or Just-In-Time user provisioning.
• Experience supporting passwordless and phishing-resistant authentication technologies such as YubiKey (FIDO2/PIV) and HYPR.
• Familiarity with AD-LDS and directory synchronization technologies such as Entra Connect.
• PowerShell scripting ability, including use of the Microsoft Graph PowerShell SDK for reporting and bulk object management.
• Experience working within an ITSM platform such as ServiceNow for request, incident, and change management.
• Exposure to identity governance concepts such as access certifications, entitlement management, and Conditional Access policy design.
• Relevant certifications such as Microsoft SC-300, SC-900, AZ-104, or CompTIA Security+.