<div class="content-intro"><p><strong>About Nebius:</strong></p> <p>Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.</p> <p>Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.</p> <p>Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.</p></div><p><strong>About the role</strong></p> <p>You own the company's identity provider: who signs in, from where, with which factors, into which applications — and how that access is granted, reviewed, and revoked.<br>Microsoft Entra ID is the primary identity plane and the center of gravity for the role. Google Workspace, Cloud Identity, and Google Cloud IAM form a secondary domain. Microsoft 365 is in scope for tenant, licensing, and access administration.<br>You are the escalation point for identity incidents from operations, security, service desk, and application teams — expected to resolve them, not route them onward.</p> <p><strong>What you'll own</strong></p> <p><strong>Microsoft Entra ID and Microsoft 365</strong><br>– Users, dynamic and assigned groups, administrative units, directory roles, service principals, workload identities.<br>– Conditional Access design and rollout: named locations, client app and platform conditions, session controls, sign-in frequency, break-glass exclusions, report-only staging.<br>– Authentication methods policy and phishing-resistant factors.<br>– Application onboarding over SAML 2.0 (NameID, claims mapping, signing certificate rollover, encrypted assertions) and OIDC / OAuth 2.0 (authorization code with PKCE, client credentials, device code).<br>– App registrations: redirect URIs, permissions, admin consent workflow, secret and certificate lifecycle.<br>– SCIM 2.0 provisioning: attribute mappings, scoping filters, expression transformations, quarantined jobs, drift reconciliation.<br>– Tenant consent settings, OAuth grant review, remediation of over-permissioned and stale applications; defensible controls for SaaS without SSO or SCIM support.<br>– Joiner-mover-leaver as an automated pipeline: provisioning, group-based licensing, revocation with session and refresh token invalidation.<br>– Least privilege for admin access: scoped role assignments, RBAC, PIM, access reviews, entitlement management access packages.<br>– Service account and workload identity governance: ownership, credential rotation, permission scoping, decommissioning.<br>– Microsoft 365 tenant settings, licensing, admin roles; access and permission issues in Exchange Online, SharePoint Online, Power Platform.<br>– Diagnostics from sign-in, audit, and provisioning logs, with diagnostic settings routed to Log Analytics and KQL queries.<br>– Cross-tenant access settings and B2B external collaboration.</p> <p><br><strong>Automation</strong><br>– PowerShell tooling on the Microsoft Graph PowerShell SDK and Graph REST API: lifecycle, licensing, access reporting, recertification.<br>– Google-side automation through the Admin SDK Directory API, Cloud Identity API, and gcloud.<br>– Scheduled and event-driven workflows in Azure Automation Runbooks, Azure Logic Apps, or Power Automate.<br>– Unattended execution on managed identities and narrowly scoped app registrations, with credential rotation, structured logging, error handling, and retries.<br>– Automation treated as production code: version control, peer review, documented rollback.</p> <p><br><strong>What you'll bring</strong></p> <p>We care about what you can do, not which products appear on your CV. Concretely, you can:<br>– Decode a SAML assertion or JWT and pinpoint the failure — audience mismatch, NameID format, expired signing certificate, missing claim — without escalating to the vendor.<br>– Diagnose a failing SCIM job and tell scoping from attribute mapping, transformation expressions, or target schema.<br>– Replace a manual lifecycle process with automation that logs, retries, and can be handed to someone else to run.</p> <p><br><strong>Experience we expect</strong></p> <p>– 3+ years administering Microsoft Entra ID in production as a primary responsibility.<br>– Microsoft 365 tenant: settings, licensing, admin roles, Service Health<br>– Exchange Online: mailbox permissions, groups, mail flow, SPF/DKIM/DMARC<br>– Microsoft Defender: threat policies, quarantine, message trace<br>– Power Platform: environments, DLP connector policies, maker access<br>– PowerShell: Exchange Online module, Microsoft Graph SDK<br>– Enterprise applications, app registrations, consent and permission models, automated provisioning.<br>– Azure Automation Runbooks, Azure Logic Apps, Power Automate, or comparable platforms.<br&g