Active Directory Administrator

About the Job
The Active Directory Administrator is responsible for the day-to-day administration, security, and maintenance of the organization's hybrid identity environment across on-premises Active Directory, Microsoft Entra ID (Azure AD), and Microsoft 365. This is an experienced, hands-on role that handles account and access management, cloud synchronization, endpoint management, and process automation, while helping standardize and improve the identity environment. The Administrator works closely with IT, Security, HR, Operations, and cross-functional teams in our mission to make eyecare easy.
Core Responsibilities
Identity & Directory Administration
- Administer on-premises Active Directory and Microsoft Entra ID (Azure AD), including users, groups, OUs, and domain accounts.
- Maintain hybrid identity and cloud synchronization (Entra Connect / Cloud Sync), monitoring sync health between on-prem AD and Entra ID and resolving issues.
- Support ongoing cleanup and reorganization of Active Directory — OU structure, naming conventions, and removal of stale objects — following established standards.
- Administer domain and privileged accounts with attention to least-privilege and proper governance of service and admin accounts.
Access, Groups & Governance
- Create and manage security groups, including dynamic and static groups, and apply group-based access across on-prem and cloud resources.
- Support access reviews, role-based access, and conditional access policies.
- Manage App Registrations and app/SSO integrations with AD/Entra ID to support accurate reporting across the M365 organization.
Endpoint & Cloud Infrastructure
- Administer Microsoft Intune for device management, compliance, and endpoint security.
- Support and maintain Windows Server infrastructure and Azure Virtual Desktop (AVD) environments, including deployment and patching.
- Create, maintain, and troubleshoot Group Policy Objects (GPOs) across corporate, store, and BPO environments.
Automation & Reporting
- Automate routine identity and directory tasks using PowerShell (and Microsoft Graph where applicable) — account lifecycle, group membership, and reporting.
- Execute and help improve onboarding and offboarding processes, ideally integrated with HR systems such as ADP for timely joiner/mover/leaver handling.
- Produce accurate reporting on identity, licensing, and access across the M365 organization.
Security & Operations
- Apply identity security best practices: MFA, conditional access, and monitoring for unusual activity.
- Serve as an escalation point for AD/Entra/M365 identity issues.
- Maintain documentation and runbooks for the identity environment.
Required Skills
- Technical, logical, and analytical thinker with a solid understanding of cloud-based systems, networks, and hybrid identity, with a keen eye for detail.
- Good understanding of Microsoft Licensing models and the Microsoft 365 / Office suite.
- Windows 11 and modern Windows management knowledge.
- Ability to follow and help maintain structured, documented standards in a complex AD environment.
- Proactive with assignments and strong time and task management across multiple projects at once.
- High degree of confidentiality when handling privileged access and sensitive identity data.
- Ability to communicate cross-functionally with technical and non-technical stakeholders.
- Strong diagnostic, problem-solving, and communication skills.
- Timely, accurate documentation and consistent follow-up, adhering to SLAs and ticketing workflows.
- Ability to work to deadlines and prioritize effectively.
- Strong email and phone communication skills.
Nice to have
- Management of additional device platforms via Intune/MDM: iOS, macOS, Android, and ChromeOS.
- ITIL certification or hands-on experience applying ITIL processes.
Qualifications
- 3+ years of experience in Active Directory / identity administration, including exposure to hybrid AD + Entra ID environments.
- Working knowledge across Entra ID, Intune, App Registrations, Windows Server, Azure Virtual Desktop, GPOs, and cloud synchronization.
- PowerShell scripting and process automation experience.
- Experience with security groups (dynamic and static), RBAC, and conditional access.
- Experience with onboarding/offboarding processes; integration with HR systems (ADP preferred) is a plus.
- Familiarity with ITIL best practices, SLAs, and working within a ticketing system.
- Bachelor's / Master's degree in Computer Science Engineering, or related field preferred.
- Relevant certifications are a plus (e.g., Microsoft SC-300, AZ-104, AZ-800, MS-102).

Work arrangement
No