Role summary
We are looking for a Modern Workplace / End User Compute (EUC) Engineer to join our managed services practice. You will be the technical owner for a portfolio of client estates, designing, delivering and supporting cloud-first endpoint and virtual desktop platforms built on Microsoft 365, Intune, Entra ID and Azure Virtual Desktop.
This is a hands-on engineering role with real client exposure. You will work alongside architects, project managers and service desk teams to migrate clients away from legacy on-premises management toward modern, zero-trust, cloud-managed environments, and keep those environments secure, patched and performant. Expect a mix of project delivery, escalations from the service desk, and continuous improvement of our managed offerings.
Key responsibilitiesModern endpoint management
• Intune & Autopilot: design, build and operate Microsoft Intune tenants — including Autopilot enrolment profiles, configuration profiles, compliance policies, Endpoint Security baselines and Update Rings across Windows 10/11.
• Application packaging & delivery: package and deploy Win32 apps, MSIX, store apps and Office/Microsoft 365 Apps via Intune; manage app lifecycle, supersedence and assignment strategies.
• Identity & access: configure Entra ID (formerly Azure AD), Conditional Access, MFA, SSPR, hybrid join, and Entra ID Connect synchronisation.
• Co-management & migration: migrate clients from SCCM / Configuration Manager and on-premises AD-joined estates to cloud-native, Entra-joined management.
Windows patch & update management
• Update strategy: design and operate Windows Update for Business (WUfB) policies, Update Rings, feature update profiles and Expedited update policies via Intune for both physical and virtual endpoints.
• Windows Autopatch: onboard eligible client tenants to Windows Autopatch, manage device and update groups, and triage release health alerts.
• Third-party patching: deploy and maintain third-party application patching via Intune (Win32 supersedence, Patch My PC, or equivalent) to keep browsers, runtimes and line-of-business apps current.
• Server & infrastructure patching: co-ordinate Azure Update Manager / WSUS scheduling for AVD session hosts, gold images and any remaining management infrastructure.
• Compliance & reporting: produce monthly patch compliance reports for clients using Intune reporting, Endpoint Analytics and Log Analytics; investigate and remediate non-compliant devices.
• Vulnerability response: work with the security team to prioritise out-of-band patches in response to CVEs and Microsoft Defender Vulnerability Management findings.
Virtual desktop & cloud workspace
• Azure Virtual Desktop (AVD): deploy and operate AVD host pools, session hosts, FSLogix profile containers, image management (custom images, Azure Image Builder) and scaling plans.
• Windows 365: provision and manage Cloud PCs, custom images, provisioning policies and user assignment.
• Citrix (advantageous): support of existing Citrix DaaS / CVAD estates during migration to Microsoft-native alternatives.
• Performance & cost: monitor session performance, right-size hosts and Cloud PCs, and contribute to FinOps reporting for client environments.
Service delivery & client engagement
• Third-line support: act as a senior escalation point for the service desk on EUC, Intune and AVD incidents and problems.
• Change & release: raise, peer-review and implement RFCs across multiple client tenants in line with ITIL change management.
• Documentation: produce and maintain high-quality build documents, run-books, low-level designs and knowledge base articles.
• Client-facing delivery: join client workshops, technical design sessions and project handovers; explain trade-offs in plain language to non-technical stakeholders.
Continuous improvement & automation
• PowerShell & Graph API: automate provisioning, reporting and tenant configuration using PowerShell, Microsoft Graph and Graph PowerShell SDK.
• Service development: feed back into our managed service standards, baselines and reference architectures so every new client benefits from prior work.
Essential skills and experience
• 3–5 years' hands-on experience in an End User Compute, Modern Workplace or Desktop Engineering role.
• Strong production experience with Microsoft Intune, Autopilot and Endpoint Security, ideally across multiple tenants.
• Solid working knowledge of Entra ID, Conditional Access, MFA and modern identity concepts (Zero Trust, device-based trust).
• Experience delivering and supporting at least one virtual desktop platform in production — Azure Virtual Desktop, Windows 365 or Citrix.
• Hands-on experience operating Windows patch management at scale — Windows Update for Business, Update Rings, feature update controls and patch compliance reporting.
• Confident with Windows 10/11, Microsoft 365 Apps, OneDrive Known Folder Move and Teams desktop deployment.
• Practical PowerShell scripting ability — comfortable reading, modifying and writing scripts that interact with Graph and Azure.
• Excellent written English and the ability to produce clear technical documentation for both peers and clients.
• Experience working in an ITIL-aligned environment with formal incident, problem and change processes.
Desirable skills and experience
• Prior experience in a Managed Service Provider (MSP) or IT consultancy environment.
• Exposure to macOS management via Intune or Jamf.
• Familiarity with SCCM / Configuration Manager and co-management migrations.
• Experience with Windows Autopatch, Azure Update Manager or third-party patching tooling (Patch My PC, Ivanti, ManageEngine).
• Experience with FSLogix, App Attach and image management pipelines.
• Working knowledge of Defender for Endpoint, Defender Vulnerability Management and Microsoft Purview.
• Experience with Power Platform — particularly Power Automate for EUC workflows.
Certifications
We are pragmatic about certifications — proven, hands-on experience matters most. However, there may be occasions where we require certification. The following are considered favourably and we will fund continued study and exam costs.
• Expected or in progress: MD-102 Endpoint Administrator Associate or MS-102 Microsoft 365 Administrator Expert.
• Advantageous: AZ-140 (AVD Specialty), SC-300 (Identity & Access Administrator), AZ-104 (Azure Administrator).
What you bring as a person
• A genuine curiosity for how things work — you read release notes, follow the product roadmaps and enjoy experimenting in a lab tenant.
• Calm under pressure during P1 incidents, with a structured approach to troubleshooting.
• A consulting mindset: you ask why before how, and tailor solutions to the client's size, sector and risk appetite.
• Strong communication — you can explain Conditional Access to a CFO and a junior engineer in the same week.
• Pride in clean, well-documented work that the rest of the team can pick up without you.
What we offer
• Genuine variety of work across multiple clients, sectors and platforms — no two weeks are the same.
• A senior, supportive engineering team and an architect community that mentors mid-level engineers toward Senior and Principal roles.
• Funded certifications, vendor training and a dedicated learning day every month.
• Competitive salary, pension, private medical and 25 days' holiday plus bank holidays.