Azure Endpoint/Automation Engineer

job summary:
Join our global Client Engineering team, a pivotal group dedicated to managing user devices worldwide and collaborating across the enterprise to deliver an exceptional employee experience. This team is at the forefront of Ford's digital transformation, driving the shift to cloud-native solutions that empower employees to work efficiently and effectively from any location. As an Azure Endpoint and Automation Engineer, you will play a crucial role in this mission, ensuring the health, security, and productivity of thousands of Windows, iOS, and Android devices. You will be instrumental in creating a proactive environment by integrating Intune, Azure Monitor/Log Analytics, KQL, and Power BI to transform raw telemetry into actionable insights, preventing issues before they impact our users.

location: Dearborn, Michigan
job type: Permanent
salary: $100,000 - 155,000 per year
work hours: 9am to 5pm
education: Bachelors

responsibilities:

What you'll do...

• Route and operationalize Intune logs in Azure: configure Intune Diagnostic Settings to send audit/operational/compliance/device logs to Azure Monitor / Log Analytics, then author KQL queries, alerts, and workbooks for proactive monitoring.
• Build executive ready insights: create Power BI dashboards fed by the Intune Data Warehouse and/or Log Analytics queries to trend compliance, deployments, and device health.
• Run multi device queries at scale: use Intune Advanced Analytics - Device query for multiple devices (KQL) to answer fleet wide questions (e.g., drivers, firmware, crash patterns) and drive remediations.
• Measure update compliance: implement Windows Update for Business reports (Azure Monitor Logs) and craft KQL queries/Workbooks that track patch deployments, failures, and safeguards.
• Deploy and optimize Endpoint analytics: enable data collection, interpret startup/sign in scores, and turn insights into configuration changes that reduce help desk tickets.
• Automate with Microsoft Graph: build secure automations and data exports using Graph (PowerShell/REST) for device, app, and policy operations; manage app permissions and throttling considerations.
• Create and manage Microsoft Entra app registrations: design least privilege application permissions/secrets/certificates for Graph integrations; document consent flows and lifecycle.
• Design & develop Azure Workflows: Design, build, and maintain server-less integration workflows using Azure Logic Apps and Azure Function apps to automate business processes.
• Manage Azure substrate for analytics: create and govern Log Analytics workspaces, access control, data retention, and (where needed) data export.
• Secure access with Device Compliance: integrate Intune compliance with Conditional Access to enforce "require compliant device" for key apps while supporting exceptions and staged rollouts.
• Document and mentor: publish runbooks, standards, and KQL/Power BI templates; coach analysts and support engineers.
• Own outcomes end to end: define the signal, build the query, ship the dashboard, and land the fix.
• Partner closely with Security, Networking, and Collaboration teams on Conditional Access, device risk, and rollout strategies.
• Continuously improve: baseline with Endpoint analytics; A/B changes; measure and iterate.

qualifications:
You'll have...

Bachelors Degree or equivalent

Hands on with Azure Monitor / Log Analytics, KQL, and Power BI.

Strong coding skills in languages relevant to Azure automation - C#, PowerShell, Graph API, KQL functions, and automation run books. 4-5 years experience.

Proven experience building Intune Data Warehouse and/or Log Analytics backed dashboards that drive decisions.

Comfort with Intune Advanced Analytics - Device query for multiple devices and writing efficient KQL.

Practical knowledge of Windows Update for Business reports and update compliance troubleshooting.

Ability to create and maintain Microsoft Entra app registrations (secrets/certs) and build automations with Microsoft Graph (PowerShell or REST). 3-4 years experience.

Solid understanding of RBAC for Log Analytics workspaces and least privilege access patterns.

Experience with Azure Integration Experience

Experience with Windows Autopilot end to end, Endpoint analytics tuning, and Azure Workbooks.

Even better, you may have...

Certifications such as Endpoint Administrator Associate, Identity and Access Administrator, Azure Administrator Associate, Enterprise Data Analyst Associate.

Experience with Azure AI Foundry & Security Copilot to build models for analyzing trends from log analytics. 1-2 years experience.

Depth with Android Enterprise and iOS/iPadOS Automated Device Enrollment (ABM/ASM).

Equal Opportunity Employer: Race, Color, Religion, Sex, Sexual Orientation, Gender Identity, National Origin, Age, Genetic Information, Disability, Protected Veteran Status, or any other legally protected group status.

At Randstad Digital, we welcome people of all abilities and want to ensure that our hiring and interview process meets the needs of all applicants. If you require a reasonable accommodation to make your application or interview experience a great one, please contact [email protected].


Pay offered to a successful candidate will be based on several factors including the candidate's education, work experience, work location, specific job duties, certifications, etc. In addition, Randstad Digital offers a comprehensive benefits package, including: medical, prescription, dental, vision, AD&D, and life insurance offerings, short-term disability, and a 401K plan (all benefits are based on eligibility).

This posting is open for thirty (30) days.