- Design and manage Windows 365 Enterprise (and Business when required): sizing, provisioning policies, device groups.
- Build and maintain golden images; app packaging (Win32/MSI), patching via Windows Update for Business / SCCM
- Master Intune/Endpoint Manager: configuration & compliance policies, security baselines, device enrollment, app lifecycle.
- Optimize Teams/AV redirection, performance (CPU/RAM/disk IO), RDP connectivity, endpoint analytics.
- Implement Defender for Endpoint onboarding, ASR rules, application control (WDAC), BitLocker, device CA.
- Automate Cloud PC lifecycle via PowerShell/Graph; reporting and cost/license optimization.
- Produce runbooks and SOPs; coordinate with network/security on NAC, proxies, and monitoring