Last updated: November 8, 2026
By Mike Carter, Managing Director, KORE1
An Azure cloud engineer job description should describe the tenant the hire inherits, name the Azure services in production, flag any retirement deadline, ask for certifications Microsoft still offers, and print a pay range. Most postings skip all five and say “Azure or AWS” instead, which the engineers you want notice right away.
Take most of the Azure postings that land on our desk, swap the word Azure for AWS, and nothing else needs to change. Same bullets about scalable, secure infrastructure. Same request for infrastructure as code. Same “excellent communication skills.” I sold and marketed things for twenty years before staffing, and the first thing they drill into you about an ad is that it should only work for one product. A job posting is an ad, just with lawyers.
Here’s the version of this we saw twice this year, folded into one story with the details changed. A specialty chemicals distributor with about 400 people in an office tower in downtown Cleveland posted for an “Azure Cloud Engineer” and asked for five years of Azure or AWS, AZ-500 required, Azure AD experience, and Terraform. No pay range. It drew 140-odd applicants in three weeks, and the IT director told our recruiter he couldn’t find one he’d put in front of the CFO.
What the company actually had was harder and more interesting than the posting. Fourteen subscriptions and no management groups above them. An Active Directory forest built in 2011, synced to Entra ID by an Entra Connect server nobody wanted to touch. Most of the infrastructure had been built by clicking through the portal, with a few Bicep files from a consultant who left. And the dealer ordering portal ran on Azure Cloud Services (extended support), which Microsoft retires on March 31, 2027. That last fact was the job. It wasn’t anywhere in the ad.
Three of those posting lines were also wrong on their own terms. Microsoft retired the AZ-500 exam on August 31, 2026, so nobody can earn it now. Azure AD has been called Entra ID since 2023. And the missing pay range put the posting out of step with Cleveland’s salary transparency ordinance, which has been in force since October 2025 for employers with 15 or more people working in the city.
Fair warning about who’s writing. KORE1 runs an Azure cloud engineer staffing desk and gets paid when a client hires someone we sent. If your posting is good enough to fill itself, we lose the search. Fine by me. Pay by experience and state is in our Azure cloud engineer salary guide, and the four kinds of Azure seat (platform, AKS, AI, and GCC High) are sorted in our guide to hiring Azure cloud engineers. If you haven’t picked a cloud yet, start with the platform-neutral cloud engineer job description template. This page is only about the posting.
What an Azure Cloud Engineer Actually Does
An Azure cloud engineer builds and runs an organization’s workloads on Microsoft Azure, including subscriptions, networking, identity through Entra ID, compute, storage, and the automation that deploys them. Most of them also keep a hybrid estate working, because few Azure customers have left their own data centers entirely.
That second sentence is what AWS-flavored postings miss. Azure customers are usually Microsoft shops from way back. They run Windows Server, they run Microsoft 365, and they have an on-premises Active Directory that’s older than some of the engineers applying. So the Azure seat usually comes with identity plumbing and a VPN or ExpressRoute circuit back to a building somewhere. An engineer who has only worked in cloud-native startups can be excellent and still be lost in week two.
Some neighboring jobs have their own templates. A seat that mostly writes policy for Defender for Cloud and Sentinel belongs in the cloud security engineer job description template, and the person drawing the landing zone rather than running it is a cloud architect. Once the posting is live, the questions for the loop are in our Azure cloud engineer interview questions.
Describe the Tenant Before You List a Single Duty
The fastest way to make a posting Azure-specific is to describe what the new hire will open on their first morning. Senior candidates will ask anyway. Most of the answers take an afternoon to collect, and someone on your team already knows them.
| Fact about your estate | Who on your team knows it | How it reads in the posting |
|---|---|---|
| Subscriptions and management groups | Whoever holds Owner on the root | “Fourteen subscriptions, no management group hierarchy yet. You’ll design it.” |
| Landing zone | The architect, or the consultant’s handoff deck | “Built on the Cloud Adoption Framework landing zone in 2023, partly drifted since.” |
| Identity | The directory admin | “Hybrid identity through Entra Connect, about 1,900 synced users, Conditional Access in report-only for half of them.” |
| How infrastructure gets built | Check the repos, not the org chart | “About a third in Bicep, the rest built in the portal. Getting it into code is the first-year goal.” |
| Network | The network engineer | “Hub and spoke, one ExpressRoute circuit to the Independence data center, Private Endpoints on the SQL databases.” |
| Containers | The platform or DevOps lead | “Two AKS clusters in production, one Container Apps environment, node upgrades currently done by hand.” |
| Which Azure cloud | Compliance, or the contract | “Commercial Azure only.” Or “GCC High, U.S. person required.” Say it in the first paragraph. |
| Monthly spend | Finance, from Cost Management | “About $85,000 a month, no reservations or savings plan yet.” |
You don’t have to publish all eight. Pick the three that make your seat different from the one down the street, and keep the rest for the first call. The spend line surprises people the most. It tells a candidate whether cost work is part of the job, and the good ones read “no reservations yet” and see an easy first win.
One thing to leave out is anything that would help an attacker map you, such as tenant IDs, IP ranges, or the name of the account that has Global Administrator. Counts and shapes are fine. Specifics aren’t.
Retirement Dates That Turn the Seat Into a Migration Job
Azure retires things on a published schedule, and some of the dates are close. If your estate depends on one of them, the posting is describing a migration with a deadline, whether it says so or not. Two that come up on intake calls this fall are on Microsoft Learn.
Azure Cloud Services (extended support) was deprecated on March 31, 2025, and Microsoft retires it fully on March 31, 2027. Anything still running there has to move to another Azure compute service in the next five months. Azure Front Door (classic) retires the same day, and Microsoft’s retirement FAQ says it already stopped supporting new profiles, new domain onboarding, and managed certificates, so a team that needs to add a custom domain to a classic profile in January can’t.
Is that your job? Azure Advisor lists service retirements that touch your own subscriptions, and so does the Service Health blade. Spend ten minutes there before you write anything.
If something does show up, put it in the title. “Azure Cloud Engineer, Cloud Services Migration (March 2027)” pulls the people who have done that move before, and some of them like the work. A migration with an end date is also the classic reason to staff on contract or as a cloud migration project, then hire the permanent owner of the estate afterward. Mixing the two in one ad gets you a migration specialist who leaves in April, or a steady operator who has never moved a production workload against a date.
Certification Lines That Still Mean Something
Certifications are where Azure postings go stale fastest, because Microsoft retires and renames them often and job templates get copied for years. Here’s what I’d check before the ad goes out.
- AZ-104, the Azure Administrator Associate, is still the floor for most engineering seats. Microsoft’s AZ-104 page was last updated April 17, 2026, and the renewal frequency is 12 months.
- Renewal is free. You pass an online assessment during a six-month window before the expiry date, which means a lapsed AZ-104 usually tells you about someone’s calendar more than their skills.
- Asking for AZ-104 and AZ-305 together is redundant, since the Azure Solutions Architect Expert requires the AZ-104 credential before it’s awarded.
- AZ-500 is gone. Retired August 31, 2026, along with AZ-204 a month earlier. Our Azure salary research lists every exam Microsoft pulled this year and the successors.
- AZ-700, the network engineer associate, is worth naming when the job is mostly ExpressRoute, Virtual WAN, and Private Link.
- “Azure AD” in a posting tells a candidate the template is old. Write Entra ID.
I’d put any certification in the preferred list, not the requirements, unless a customer contract or a government rule actually demands it. The engineers who have run a tenant through two years of incidents often let an associate cert lapse. Not always. But often enough that a hard requirement screens out the person you’d hire, and the AZ-104 study guide itself now weights identity and governance at 20 to 25 percent, which is roughly what the job already tests every day.
Azure Cloud Engineer Job Description Template
Swap each bracket for a real answer. Notes in parentheses are for you and come out before the posting goes live. If a bracket stumps you, ask whoever has Owner rights on the production subscription.
Job Title
[Azure Cloud Engineer / Senior Azure Cloud Engineer / Azure Cloud Engineer, Cloud Services Migration (March 2027) / Azure Platform Engineer, AKS] (Name the seat. If there’s a deadline, it goes in the title.)
About the Role
[Company] [does what] for [customers]. You’ll own [our Azure tenant / the platform our product teams deploy to / the move off Cloud Services before March 31, 2027], working with [N] engineers and reporting to [role]. The job is [on-site in (city) / hybrid, (N) days a week in (city) / remote within (states or time zones)].
The Estate You’ll Inherit
- [Commercial Azure / Azure Government / GCC High], [N] subscriptions [under a management group hierarchy / with no hierarchy yet]
- Identity through Entra ID, [cloud-only / hybrid with Entra Connect or Cloud Sync from an on-premises forest]
- Infrastructure as code in [Bicep / Terraform / ARM templates], covering about [percentage] of production. The rest was built in the portal.
- Network: [hub and spoke / Virtual WAN], [ExpressRoute / site-to-site VPN] to [location], [Private Endpoints on (services)]
- Workloads on [virtual machines / App Service / AKS / Container Apps / Azure Functions], data in [Azure SQL / SQL Managed Instance / Cosmos DB / storage accounts]
- Monitoring with [Azure Monitor and Log Analytics / Datadog / both], security posture in [Defender for Cloud / Sentinel / not set up yet]
- About $[amount] a month in Azure spend, [with / without] reservations or a savings plan
What You’ll Do
- Build and maintain [subscriptions, policy assignments, and RBAC] so new workloads land in a governed place
- Move [what] into [Bicep / Terraform], with deployments running through [Azure DevOps Pipelines / GitHub Actions]
- Run the network, including [ExpressRoute or VPN], firewall rules, private DNS, and Private Endpoints
- Keep [the AKS clusters / the VM fleet] patched and upgraded on a schedule people can plan around
- Look after hybrid identity with the directory team, including Conditional Access and Privileged Identity Management
- [Migrate (workload) off (retiring service) before (date)] (Delete this line if nothing in your estate is retiring.)
- Cut waste from the monthly bill with tagging, rightsizing, and [reservations / savings plan / Azure Hybrid Benefit]
- Take part in an on-call rotation [one week in (N) / during business hours only / not applicable]
What We’re Looking For
- [3+ / 5+] years running production workloads, at least [2 / 4] of them on Azure
- You’ve written and deployed [Bicep / Terraform] for Azure in production and can explain how you handled state or what-if checks
- Comfortable with Entra ID, RBAC, managed identities, and Key Vault
- Azure networking at the level of designing a hub and spoke, not just joining one
- Scripting in [PowerShell / Azure CLI with Bash / Python]
- [Experience with AKS upgrades, node pools, and ingress] (Keep only if containers are part of the job.)
Nice to Have
- Microsoft Certified: Azure Administrator Associate (AZ-104), current, or Azure Network Engineer Associate (AZ-700)
- [A completed migration off Cloud Services, Front Door (classic), or another retired service]
- [Experience in a regulated environment, such as HIPAA, SOC 2, PCI DSS, or CMMC]
Pay and Benefits
The base salary range for this role is $[low] to $[high], [plus (bonus target)]. Where in the range an offer lands depends on [experience and location]. Benefits include [medical, dental, and vision / 401(k) with (match) / (N) days of paid time off / a certification and training budget]. (If the job is performed in Cleveland and you have 15 or more employees there, the range is required. Several states require it too. Print it either way.)
How to Apply
[Apply link or contact]. [Company] is an equal opportunity employer and provides reasonable accommodations to qualified applicants. To ask for one, contact [name or address].
Setting the Pay Range, and Cleveland’s Rule
The range is the line candidates read second, right after the title. Salary.com’s Azure Engineer page puts the national average at $134,810, and it splits that by years of experience, which is the most useful cut we’ve found for writing a posting.
| Experience | Salary.com average, Azure Engineer | What that buys in the estate above |
|---|---|---|
| 1 to 2 years | $100,814 | Runs what’s already there, with someone senior checking the changes |
| 2 to 4 years | $135,195 | Owns a piece outright, such as the AKS clusters or the Bicep repo |
| 5 to 8 years | $151,232 | Designs the management group hierarchy and leads a migration against a date |
| Over 8 years | $171,783 | Sets standards across teams, often edging into architecture |
Those are national base averages. The salary guide adjusts them by state and metro, and our salary benchmark assistant does a quick check for other titles. The mistake we see most is a posting that describes the third row and pays the first, which brings in applicants who can’t do the work and loses the ones who can on the first screen.
Now Cleveland. The city’s Ordinance 104-2025 took effect on October 27, 2025. According to Littler’s summary, it covers employers with at least 15 employees in Cleveland, requires a salary range or scale in postings, and bars asking applicants about their pay history. A Hahn Loeser client alert adds the parts that matter for a staffing desk like ours. It reaches job placement agencies acting for an employer. It applies to work performed in Cleveland no matter where the company is headquartered. And after a 90-day window to fix a violation, the civil penalties run up to $1,000 for a first one, $2,500 for a second, and $5,000 after that.
Those fines are small. The applicants you lose aren’t. An Azure engineer with five years of hybrid identity work gets recruiter messages every week, and the posting without a number is the one they skip. Writing the range is the cheapest improvement in this whole template.
What Hiring Managers Ask Our Azure Desk
Should the posting say Azure only, or Azure and AWS?
Azure only, unless AWS really runs something in production that this person will touch. Listing both tells candidates you haven’t decided what the job is.
If you’re genuinely multi-cloud, name the primary one and the specific secondary workload, such as “Azure primary, plus the AWS account that hosts our data lake.” That reads as a real environment. “Azure, AWS, or GCP” reads as a template.
Bicep or Terraform, which one goes in the requirements?
Whichever one your repos actually contain. If it’s both, say which is the standard going forward.
Engineers move between the two in a few weeks. What takes longer is learning your state files and modules, so the honest line is the one that describes them.
How many years of Azure experience should we require?
Three to five years for a mid-level seat and six or more for someone who will design the hierarchy and lead a migration. Ask for production years, not years since the first login.
We still see “10+ years of Azure” on postings. It’s possible, since Azure went generally available in 2010, but the people with that tenure are usually architects now and price themselves accordingly, so the line ends up filtering for the wrong seat.
Is the AZ-104 worth requiring?
Prefer it, don’t require it. A current AZ-104 shows recent study, and a lapsed one often just means the engineer was busy.
Do we need a separate posting for GCC High?
Separate posting, every time. GCC High seats usually carry U.S. person or clearance requirements and a different service catalog, and the candidate pool is much smaller.
Put the sovereign cloud and the citizenship rule up top, in paragraph one. What that lane costs is in our Azure hiring guide. It’s a lot more than platform work.
Does Cleveland’s pay rule apply to a remote Azure engineer?
It applies to work performed in Cleveland, so a remote engineer living in the city is the case to ask your counsel about.
The ordinance doesn’t define “salary range or scale” either. Most employers we work with just print a real range in every posting and stop worrying about which city a candidate lives in.
Before the Posting Goes Live
Read it once the way a candidate would. If the same ad could run for an AWS job with three words changed, it isn’t done yet. Add the tenant, the date if there is one, and the number.
If you’d like another set of eyes on it, send the draft to our recruiters and we’ll tell you which of the four Azure seats it reads like. Our technology searches average 17 days to a first qualified submittal, and 92 percent of the people we place are still in the job a year later. Neither one helps much if the posting is for a job you don’t actually have.
