Microsoft 365 and AI Governance Solution Architect

About Reply:

Reply specialises in designing and implementing solutions based on new communication channels and digital media. Structured as a network of highly specialised companies, Reply supports leading European industrial groups in sectors such as Telco & Media, Industry and Services, Banking and Insurance, and Public Administration, helping define and develop business models enabled by new paradigms such as AI, Cloud Computing, Digital Media, and the Internet of Things. Reply's services include Consulting, System Integration, and Digital Services.

Role Overview:

This role is for a Senior Architect who owns Microsoft 365 and Power Platform architecture for regulated clients, from discovery through to design authority and board-level assurance.

You will define how Microsoft AI capability (Copilot, Copilot Studio, Agent 365, Microsoft Foundry) is governed, licensed, monitored and controlled in environments that answer to a regulator or a certification body. You will work directly with client CISOs, heads of architecture and risk functions, carrying the architectural argument yourself rather than relying on a delivery lead to make it for you.

Engagement Profile

You will step into live engagements that are already in flight, and you will be just as comfortable starting from a blank canvas, setting up practices, standards and reusable patterns from scratch where none yet exist. The following engagement types recur, and the capability demanded differs in each:

AI and Agent Governance

• What you do: build the governance framework and maturity model for Copilot Studio and Agent 365, produce architectural impact assessments, and deliver adoption and assurance reporting.

• What it demands: control mapping to CIS Controls v8.1, NIST CSF 2.0, ISO/IEC 42001:2023 and the EU AI Act, translated into Microsoft controls that actually configure.

M365 Workstream Inside an AI Platform Programme

• What you do: own Entra, Purview, Power Platform and Defender governance scope alongside an Azure architect, to deliverable and review-board dates.

• What it demands: holding the M365 position credibly next to other disciplines, and advising on an E3 to E5 move where no E5 or agent capability is designed yet.

Secure Tenant Build to Certification

• What you do: design the tenant against an external scheme, cloud-only, with Intune and Autopilot and access gated on device compliance, and with multiple companies migrating in.

• What it demands: working to certification schemes with fixed deadlines (Defence Cyber Certification, Cyber Essentials Plus) and designing for a client with no internal capability to run it.

You will also help build out the practice's own internal assets, which are still being established. These cover areas such as Statement of Work automation, reusable bid intelligence tooling, enterprise AI deployment patterns, and Entra consolidation and licensing exposure modelling.

Responsibilities:

Architecture & Design Authority

• Own M365, Entra and Power Platform target architectures for regulated clients, including tenant design, identity, device and data boundaries

• Produce high-level designs, architecture decision records and architectural impact assessments that survive a client architecture review board

• Act as design authority over delivery engineers, reviewing and approving their work rather than only producing documents

AI & Agent Governance

• Define governance for Copilot, Copilot Studio, Agent 365 and Microsoft Foundry: environment strategy, agent lifecycle, data loss prevention, model and connector controls, and logging routes through Sentinel or Purview

• Map controls to recognised frameworks (NIST CSF 2.0, ISO/IEC 42001, CIS Controls, EU AI Act) and to the client's own regulatory obligations

• Advise on licensing and consumption models, including Copilot credits and the commercial consequences of agent design choices

Security & Compliance

• Design Zero Trust, Conditional Access, Intune and Autopilot, Defender and Purview in environments subject to external certification (DCC, Cyber Essentials Plus) or regulatory scrutiny

• Provide data protection reasoning under UK GDPR and the Data Protection Act 2018 at a level that satisfies a client privacy function

Client & Commercial

• Hold the senior architectural relationship with client stakeholders up to director level and chair technical workshops

• Write and contribute to proposals and bid responses, setting out the technical approach and the commercial rationale behind it

• Bring commercial awareness to design decisions, weighing technical outcomes against cost, licensing and delivery effort

• Support pre-sales: solution shaping, bid architecture, effort and roadmap estimation, and Statement of Work input

• Mentor consultants and engineers, and contribute reusable assets back to the

About the Candidate:

Core Experience

• 10 years or more in Microsoft infrastructure, identity and security, with at least 3 years as a named architect on client-facing engagements

• Deep Microsoft 365 and Entra ID: tenant architecture, Conditional Access, cross-tenant access policies, entitlement management, B2B, multi-tenant consolidation

• Microsoft Purview: information protection, DLP, data lifecycle, and realistic scoping of scanning in large estates

• Power Platform at architect level: environment strategy, managed environments, DLP policies, ALM, Centre of Excellence design and adoption maturity

• Copilot Studio or equivalent agent platform experience, including governance, not just building agents

• Intune and Autopilot: cloud-only device management with compliance-gated access

• Demonstrable work in a regulated or accredited environment (financial services, defence, government, healthcare) where an external body inspects the outcome

• Commercial awareness, with experience shaping proposals, bids and Statements of Work and estimating delivery effort

• Written output of a standard that goes to a client board without rework: HLDs, ADRs, impact assessments, operating models

• Comfortable leading challenging conversations with client stakeholders on technical, commercial and regulatory matters

Nice to Have

• Microsoft Foundry and Azure AI platform exposure, enough to hold the M365 side of a joint Azure and AI engagement credibly

• Azure landing zone, API Management as an AI or LLM gateway, and MCP-based integration patterns

• Defence Cyber Certification, Cyber Essentials Plus, NIST or ISO/IEC 27001 and 42001 assessment experience

• Regulatory context in financial services or defence: operational resilience, critical third-party arrangements, supervisory expectations

• Data and reporting: Microsoft Graph API, Power BI adoption and assurance dashboards

• Broad hands-on experience and a willingness to get stuck in, prototyping where needed with tools such as Power Apps, Power Automate, PowerShell, Pester or Maester, and basic React or similar for visualising frameworks

Education and Certifications

• A 2:1 degree or higher in Computer Science or a related computing field is required.

• SC-100

• SC-300

• MS-102

• PL-600

• AZ-305, or equivalent demonstrated depth

Security Clearance Requirement (Essential)

Due to the nature of our client engagements, candidates must meet one of the following:

• Hold current UK Security Clearance (SC), or

• Be eligible and willing to undergo SC clearance

Eligibility typically requires:

• Minimum 5 years continuous UK residency

• Right to work in the UK

• Willingness to complete background and identity checks

Reply is an Equal Opportunities Employer and committed to embracing diversity in the workplace. We provide equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type regardless of age, sexual orientation, gender, identity, pregnancy, religion, nationality, ethnic origin, disability, medical history, skin colour, marital status or parental status or any other characteristic protected by the Law.

Reply is committed to making sure that our selection methods are fair to everyone. To help you during the recruitment process, please let us know of any Reasonable Adjustments you may need.