Forum Discussion

tijan2018's avatar
tijan2018
Icon for Microsoft rankMicrosoft
Mar 09, 2022

Audit Logs

I am trying to write a query that will output results of audit logs for external users added to AAD outside of work hours. Below is the query I currently have but it isn't giving me the results I wan...
  • Jonhed's avatar
    Mar 09, 2022

    tijan2018 

    When you specify just time in a datetime value it implicitly means "Today at hh:mm:ss", so your query searches for any log that is not between "Today 06:00 and Today 23:00".

     

    Maybe you want something like this?

    AuditLogs
    | where OperationName == "Invite external user"
    | where hourofday(TimeGenerated) !between (6 .. 22)

Resources