Azure Engineer - Contract | Outside IR35 | Fully Remote | SC Clearance Required

Azure Engineer - Azure Tenant Separation

Contract | Outside IR35 | Fully Remote | SC Clearance Required

Start: ASAP
Duration: 20-30 days initially, with a strong view to extending into the delivery phase
Location: Fully remote
Security clearance: Current SC clearance essential

We are seeking an experienced Azure Engineer to support an Azure tenant separation project for a UK software and services organisation.

The project involves separating approximately 12 customer Azure subscriptions from a parent tenant into a new, independently governed tenant, supporting data sovereignty and compliance requirements.

The initial engagement will focus on discovery and assessment, working closely with the Azure Architect and Project Manager to establish the current environment, identify dependencies and develop a practical approach to separation. There is a strong view to extending the engagement into implementation and delivery.

Key Responsibilities

• Discover and document Azure resources, configurations and dependencies across the customer subscriptions.
• Assess Microsoft Entra ID dependencies, including users, groups, service principals, app registrations, managed identities and RBAC assignments.
• Evaluate subscription transfer requirements, identifying tenant-bound services, technical constraints and any resources requiring reconfiguration or migration.
• Map networking dependencies, including VNets, peering, private endpoints, DNS, VPNs, ExpressRoute and shared connectivity services.
• Review governance arrangements, including management groups, Azure Policy, access controls, tagging and subscription-level configuration.
• Identify dependencies on shared services, Key Vault, certificates, secrets, monitoring, backup and security tooling.
• Assess Azure DevOps dependencies, including service connections, deployment pipelines, repositories, agent pools and infrastructure-as-code configurations.
• Support the design of the target environment and identify the engineering activities required to establish independent operation.
• Develop detailed cutover runbooks, covering sequencing, prerequisites, validation, rollback and operational handover.
• Contribute technical findings, risks, effort estimates and recommendations to the discovery and assessment outputs.
• Support subscription transfers, resource reconfiguration, testing and cutover during the subsequent delivery phase, subject to extension.

Essential Skills and Experience

• Strong hands-on experience as an Azure Engineer, supporting complex enterprise Azure environments.
• Practical experience of Azure tenant migrations, tenant separation or cross-tenant subscription transfers.
• Strong knowledge of Microsoft Entra ID, Azure RBAC, managed identities, service principals and app registrations.
• Experience assessing the impact of tenant changes on Azure resources, identity, access and service integrations.
• Solid Azure networking knowledge, including private connectivity, DNS and network security.
• Experience with Azure governance, including management groups, Azure Policy and subscription configuration.
• Hands-on experience with Azure DevOps pipelines and service connections, including authentication and deployment dependencies.
• Experience using PowerShell, Azure CLI and infrastructure as code, such as Terraform or Bicep.
• Ability to produce clear technical documentation, dependency maps and executable cutover runbooks.
• Strong troubleshooting skills and the ability to work independently within a focused discovery engagement.
• Current SC clearance is mandatory.

Desirable Experience

• Azure separation projects involving shared enterprise services or multiple customer environments.
• Public sector or other security-sensitive environments.
• Azure landing zones and independently governed tenant setup.
• Planning and delivering migrations with minimal service disruption.

Initial Engagement Deliverables

• Documented resource inventory and dependency assessment.
• Identity, networking, governance and Azure DevOps impact analysis.
• Recommended transfer or migration approach for each subscription.
• Engineering tasks, risks, prerequisites and delivery estimates.
• Draft cutover, validation and rollback runbooks to support the delivery phase.