Microsoft Active Directory Engineer (Contractor)

About the role

We are looking for a specialist Microsoft Active Directory Engineer to join a high‑profile government project. The role is a 12‑24 month contract, based in Pretoria with a hybrid working model, and will focus on the administration, optimisation, security and support of enterprise Active Directory and Microsoft Identity environments.

Key responsibilities

• Design, implement, administer and maintain Active Directory Domain Services (AD DS) environments.
• Manage AD architecture, trust relationships, schema administration and directory services.
• Administer Microsoft Entra ID (Azure AD) and configure hybrid identity solutions such as Entra Connect Sync, Pass‑Through Authentication and Seamless SSO.
• Implement identity governance controls including Conditional Access, Privileged Identity Management, Access Reviews and Identity Governance.
• Maintain Group Policy Objects (GPOs) across the enterprise.
• Develop PowerShell automation scripts for user lifecycle management, reporting and administration.
• Troubleshoot AD replication, DNS, DHCP and Sites & Services issues.
• Monitor performance, security and compliance of the identity infrastructure.
• Apply security best practices such as tiered administration, protected users, authentication policies, advanced auditing and LAPS.
• Collaborate with security, infrastructure, networking and application teams and participate in upgrades, migrations and incident resolution.

Required profile

• National Diploma in Information Technology or equivalent qualification.
• Microsoft Certified: Identity and Access Administrator Associate (SC‑300) or Windows Server Hybrid Administrator Associate (AZ‑800/ AZ‑801).
• Microsoft Entra ID Fundamentals or equivalent certification.
• Relevant Microsoft certifications (MCITP, MCSA, MCSE) are a plus.

Required skills

• Microsoft Windows Server 2016/2019/2022
• Active Directory Domain Services (AD DS)
• Microsoft Entra ID (Azure AD)
• Hybrid Identity Solutions (Entra Connect Sync, Pass‑Through Authentication, Seamless SSO)
• Group Policy Management
• DNS and DHCP administration
• PowerShell scripting
• Conditional Access Policies
• Privileged Identity Management (PIM)
• Access Reviews and Identity Governance
• Tiered administration, Protected Users, Authentication Policies
• Advanced Auditing
• Windows LAPS and Legacy LAPS