Forum Discussion
Solved
Audit Logs
I am trying to write a query that will output results of audit logs for external users added to AAD outside of work hours. Below is the query I currently have but it isn't giving me the results I wan...
When you specify just time in a datetime value it implicitly means "Today at hh:mm:ss", so your query searches for any log that is not between "Today 06:00 and Today 23:00".
Maybe you want something like this?
AuditLogs | where OperationName == "Invite external user" | where hourofday(TimeGenerated) !between (6 .. 22)
When you specify just time in a datetime value it implicitly means "Today at hh:mm:ss", so your query searches for any log that is not between "Today 06:00 and Today 23:00".
Maybe you want something like this?
AuditLogs
| where OperationName == "Invite external user"
| where hourofday(TimeGenerated) !between (6 .. 22)
This is excellent. Makes sense now. It is now giving me the desired output of the audit activities outside of the time range indicated in the query. Thank you!