Job Description:
The L3/L4 EUC Engineer owns the design deployment and sustained operation of the managed endpoint estate The role covers three disciplines Microsoft Intune for device and policy management Apple Business Manager ABM for Apple device enrollment and appcontent distribution and application packaging for Windows and macOS
The engineer is the technical escalation point for L1L2 teams resolves complex endpoint issues to root cause and turns recurring issues into standard solutions SOPs and automation
Key Responsibilities
Microsoft Intune Endpoint Management
- Design configure and maintain Intune tenant settings enrollment restrictions device categories filters scope tags and RBAC
- Own Windows Autopilot userdriven selfdeploying preprovisioning including hardware hash import deployment profiles and Enrollment Status Page ESP tuning
- Build and manage configuration profiles Settings Catalog policies compliance policies and Conditional Access integration with Entra ID
- Manage Windows Update for Business rings feature updates driverfirmware updates and Windows Autopatch where applicable
- Deploy and govern endpoint security policies Defender for Endpoint onboarding BitLockerFileVault encryption firewall ASR rules and LAPS
- Run comanagement migration from SCCM ConfigMgr to Intune including workload shifts and ongoing hybridjoined device support
- Manage Android Enterprise and iOSiPadOS policies app protection MAM and BYOD scenarios
- Troubleshoot enrollment policy sync and app deployment failures using Intune logs Event Viewer MDM diagnostics and Graph API
- Create reports dashboards and remediation scripts Proactive Remediations Remediations to improve compliance and reduce ticket volume
Apple Business Manager ABM and Apple Device Management
- Administer ABM Apple IDrole management MDM server token lifecycle device assignment and federation with Entra ID
- Configure Automated Device Enrollment ADE with Intune for zerotouch macOS iOS and iPadOS provisioning including enrollment profiles supervision Setup Assistant settings and Await Final Configuration
- Manage Apps and Books VPP licensing app assignment device vs user and license reclamation
- Maintain Managed Apple IDs Apple tokencertificate renewals APNs ABM VPP and resellerserialnumber onboarding
- Deploy macOS configuration FileVault Gatekeeper Platform SSO Enterprise SSO software update enforcement and DDM Declarative Device Management where supported
- Resolve Applespecific escalations such as ADE enrollment failures token expiry activation lock supervision and lostmode scenarios
Application Packaging and Deployment
- Package test and publish applications for Windows Win32 intunewin MSI MSIX scripts and macOS PKG DMG managed LOB apps
- Use industry packaging tools and methods Win32 Content Prep Tool PSAppDeployToolkit Master Packager InstallShield Advanced Installer Apple Composer pkgbuild and Winget Microsoft Store apps
- Define detection rules requirements dependencies supersedence uninstall logic and return codes for every app
- Run packaging lifecycle intake vendor media validation build UAT in pilot rings production release version upgrade and retirement
- Maintain a packaging standard naming convention source repository and version control keep packaging documentation current
- Assess application compatibility for Windows 11 and Apple Silicon Rosetta native and remediate where needed
- Develop PowerShell and shellbash scripts to automate installs configuration and remediation
Operations Escalation and Governance
- Act as L3 escalation point for L2service desk and deskside teams own P1P2 incidents through to RCA and permanent fix
- Contribute to problem management change management CAB and release planning for monthly patching and application releases
- Create and maintain SOPs runbooks knowledge articles and architecturedesign documents
- Identify ticket patterns and drive deflection through selfservice Company Portal automation and SOPbased resolution
- Support audit and security requirements compliance reporting encryption status patch posture
L3 vs L4 Expectations
- DimensionL3 Senior EngineerL4 Lead SME
- ScopeExecutes and supports defined Intune ABM and packaging workstreamsOwns endtoend design and standards across all three domains
- EscalationsResolves complex L2 escalations independentlyHandles P1major incidents vendor escalations Microsoft Apple and RCA ownership
- DesignImplements to approved design recommends improvementsAuthors HLDLLD tenant architecture and policy baselines
- PackagingBuilds and tests complex packages handles upgradesDefines packaging framework quality gates and automation pipeline
- ProjectsContributes to migrations and rolloutsLeads migrations
Skills
Mandatory Skills : Azure AKS, Azure API Management, Azure BLOB, Azure Database Service, Azure Infra Services, Azure Monitor
Microsoft Intune | Apple Business Manager (ABM) | Application Packaging