Endpoint & Virtual Desktop Engineer (Intune / AVD)

We are looking for an experienced Device Management Engineer with strong hands-on expertise in Microsoft Intune (Endpoint Manager) and Azure Virtual Desktop (AVD). The candidate will be responsible for designing, deploying, and managing modern workplace solutions, including device lifecycle management, application deployment, security compliance, and virtual desktop infrastructure on Azure.

• Manage end-to-end device lifecycle (enrollment, configuration, compliance, retirement) for Windows, iOS, Android, and macOS devices using Microsoft Intune.
• Design and deploy configuration profiles, compliance policies, and conditional access policies in collaboration with the security team.
• Implement and manage Windows Autopilot for zero-touch device provisioning.
• Package, deploy, and update applications (Win32, MSI, LOB, Microsoft Store apps) via Intune.
• Manage Windows Update for Business rings, feature/quality update deployments, and patch compliance reporting.
• Implement endpoint security policies including BitLocker, Microsoft Defender for Endpoint integration, ASR rules, and device encryption.
• Handle mobile device management (MDM) and mobile application management (MAM/APP) policies for BYOD and corporate devices.
• Migrate devices from legacy management (SCCM/ConfigMgr, GPO) to modern cloud management, including co-management setups.

• Design, deploy, and manage AVD host pools, application groups, and workspaces.
• Create and maintain golden images using Azure Image Builder / custom images; manage image versioning via Azure Compute Gallery.
• Configure and manage FSLogix profile containers, including storage (Azure Files / Azure NetApp Files) and permissions.
• Implement autoscaling plans to optimize session host capacity and Azure consumption costs.
• Publish RemoteApps and full desktop sessions based on business requirements.
• Monitor AVD environment health, session performance, and user experience using Azure Monitor, Log Analytics, and AVD Insights.
• Troubleshoot session connectivity, profile load issues, latency, and host performance problems.

• Administer Microsoft Entra ID (Azure AD) — device registration, hybrid join, group management, and conditional access.
• Automate routine tasks using PowerShell and Microsoft Graph API.
• Maintain documentation — SOPs, architecture diagrams, runbooks, and knowledge base articles.
• Provide L2/L3 support for escalated endpoint and AVD incidents; work within ITIL-based incident/change management processes.
• Collaborate with security, network, and infrastructure teams on compliance audits and hardening initiatives.
• Stay current with Microsoft roadmap changes and recommend improvements to the modern workplace environment.

• 4–5 years of experience in IT infrastructure/endpoint management, with at least 2–3 years of hands-on experience in Microsoft Intune and Azure Virtual Desktop.
• Strong knowledge of Microsoft Entra ID (Azure AD), conditional access, and identity-driven security.
• Proven experience with Windows Autopilot, application packaging, and compliance/configuration policy design.
• Hands-on experience with FSLogix, host pool management, image management, and AVD scaling.
• Solid PowerShell scripting skills; exposure to Microsoft Graph API is a plus.
• Understanding of networking fundamentals (DNS, DHCP, VPN, proxy) as they relate to endpoint and AVD connectivity.
• Familiarity with Microsoft Defender for Endpoint and endpoint security baselines.
• Experience with SCCM/ConfigMgr and co-management scenarios preferred.
• Strong troubleshooting, documentation, and communication skills.

• MD-102: Microsoft 365 Certified – Endpoint Administrator Associate
• AZ-140: Configuring and Operating Microsoft Azure Virtual Desktop
• AZ-104: Microsoft Azure Administrator (nice to have)
• SC-300 or MS-102 (added advantage)