Microsoft 365 Security Consultant (Entra / Intune)

Microsoft 365 Security Consultant (Entra / Intune) - Contract, Outside IR35 | Entra ID, Intune, Defender, Purview, Sentinel | Cloud-First Boutique Finance House on a Modern Azure Stack

• Day rate: £550 to £800 per day depending on seniority and experience (Outside IR35)
• Location: Central London, 1 day per week in the office
• Contract length: until the end of the year – Extensions likely

I'm working with a growing boutique finance house in Central London that needs a Microsoft 365 Security Consultant to bring their tenant up to a proper, documented baseline. You'll take a detailed hardening plan across Entra ID, Intune, Defender, Purview and Sentinel and deliver it start to finish, on an outside IR35 contract.

The business is small, with a lean team, and it has grown quickly over the last few years. The whole estate runs on a modern, cloud-first Microsoft platform: Microsoft 365 E5, Entra ID, Intune, Defender, Purview and Sentinel, with Azure Functions and Azure AI Foundry built on top. The latest tooling is already in place and paid for, and your job is to configure it to best practice. You'll report straight to a technical MD and you'll own both the plan and the outcome.

If your background is mainly on-premises Windows Server, Active Directory or SCCM, this one won't be the right fit, as the work is cloud-native Entra and Intune throughout.

What They're Looking For (Non-Negotiables)

• Azure Cloud-native environment
• Microsoft 365: recent, hands-on Entra and Intune work
• Entra ID: Conditional Access, PIM, administrative units, app consent
• Intune and Autopilot: compliance, ASR rules, LAPS, BitLocker
• Purview: sensitivity labels and DLP
• Sentinel and Log Analytics alerting
• PowerShell
• You've delivered an M365 tenant baseline end to end, on your own

What You'll Work With

• AI & Automation
• Microsoft 365 E5
• Defender XDR and Defender for Cloud Apps
• SharePoint and OneDrive: permissions, sharing, access control
• Microsoft Graph and PnP.PowerShell
• Azure Functions and Azure Automation
• A broad estate of SaaS applications

Nice to Haves

• Conditional Access as code, from a published baseline
• Regulated or financial services environments
• GDAP and handover to a managed service provider
• Python

Why Join / Projects

The scope is already mapped out in a detailed plan covering identity, privileged access, app governance, endpoint, data protection, monitoring and documentation. You'll spend a day on the handover with the person who wrote it, put your delivery plan in front of the MD and get going.

• You'll roll out Conditional Access as code in rings, alongside PIM, break-glass accounts and scoped admin roles
• You'll fix the access basics: SharePoint permissions, joiners and leavers, and permission models for Graph integrations
• You'll harden the Windows estate and stand up labelling, DLP and Sentinel alerting
• You'll leave an as-built pack, runbooks and a RACI ready for handover

The pace is quick and the days are intense, so this suits someone who likes owning a clear outcome and working with a decision-maker who knows the tech. The business is investing heavily on AI on Azure, and the secure baseline you build is the foundation that work will sit on.

Microsoft 365 Security Consultant (Entra / Intune) - Contract, Outside IR35 | Entra ID, Intune, Defender, Purview, Sentinel | Cloud-First Boutique Finance House on a Modern Azure Stack

#J-18808-Ljbffr

Full job description from WhatJobs. Apply for this role →