M365 Specialist

See what you can do with Prophix

At Prophix, we’re building the platform that helps finance teams stop managing spreadsheets and start driving strategy. Prophix One™ brings planning, reporting, consolidation, and automation together in a single place, and we are expanding its AI capabilities faster than ever. If you want to work on a product that genuinely changes how finance teams operate, and do it alongside people who care about getting it right, this is where you want to be.

We’re headquartered in the Greater Toronto Area, with teams and offices across North America, Europe, and Australia. Trusted by more than 3,000 finance teams across 100+ countries, Prophix One™ is built for organizations that want to plan smarter and move faster.

As an M365 Specialist, you are the single owner of Prophix’s Microsoft 365 tenant, accountable for its security, compliance, and day-to-day health for employees across North America, Europe, and Australia. You will work closely with IT, Security, and the service desk to replace reactive, shared coverage with documented controls and clear ownership across Entra ID, Intune, Teams, SharePoint Online, and Exchange Online. Your work reduces risk, keeps evidence ready for ISO, SOC II, and HITRUST assessments, and frees the broader team to focus on higher-order problems.

This is a hybrid role reporting to our Etobicoke, ON headquarters 1x/week or as needed.

What You Will Do

Own the M365 Platform

· Take end-to-end ownership of Entra ID, Intune, Teams, SharePoint Online, OneDrive, and Exchange Online, including policies, permissions, and tenant-wide configuration standards.

· Complete a tenant audit and maintain a documented RACI so every M365 service and critical configuration has a named owner.

· Serve as the Tier 3 escalation point for complex Microsoft 365 incidents from the service desk, and publish the knowledge articles that prevent repeat tickets.

· Monitor the Microsoft 365 Message Center and roadmap, assess the impact of upcoming changes and deprecations, and plan configuration changes and user communications ahead of time.

· Manage M365 licensing and rollout, and set and enforce standards for site and team naming, ownership, and sharing.

· Plan and run tenant-to-tenant and content migrations (Teams, SharePoint, OneDrive, and mailboxes) for acquisitions, divestitures, and reorganizations, using tools such as ShareGate. Map permissions and sensitive-data requirements before content moves, validate results afterward, and document cutover and rollback steps.

Identity, Access, and Endpoint Security

· Administer Entra ID, Conditional Access, and MFA policies, and resolve risky sign-in alerts and exception requests quickly, with new items closed in under five business days.

· Set up and maintain SSO (SAML and OIDC) and SCIM provisioning for new and existing applications.

· Run scheduled access reviews for privileged roles, guest users, app registrations, enterprise applications, and admin-consent grants. Document every decision and removal.

· Maintain a register of certificates and credentials, and renew them before expiry.

· Track patch and vulnerability status across Windows and Mac devices in Intune, follow up on overdue items, and drive remediation to closure with a target of 95% or better critical patch compliance.

Govern Data and Collaboration

· Implement and enforce tenant-wide standards for sensitivity labels, data loss prevention policies, retention configurations, and guest sharing controls, and track progress with a Purview compliance score or equivalent metric.

· Manage SharePoint Online and OneDrive: site provisioning, permission models, external sharing settings, storage consumption, and archival of stale content.

· Extend the same governance standards to Power Platform.

Automate and Manage Change

· Build PowerShell and Microsoft Graph automations for high-frequency recurring work such as access reviews, patch compliance reporting, and certificate expiry tracking, with scheduled reports delivered to IT and security leadership.

· Develop reports in Splunk and workflow automations in n8n to surface compliance status and operational metrics.

· Raise and manage changes in ServiceNow for anything that touches the production environment.

Stay Audit-Ready

· Keep audit evidence current for ISO, SOC II, and HITRUST, with runbooks, supporting documentation, and evidence packages ready for examiner review ahead of each assessment cycle.

· Write and maintain runbooks covering the configurations, automations, and processes you own.

· Identify gaps in existing documentation and close them proactively.