Forum Discussion
tijan2018
Microsoft
Mar 09, 2022Audit Logs
I am trying to write a query that will output results of audit logs for external users added to AAD outside of work hours. Below is the query I currently have but it isn't giving me the results I wan...
- Mar 09, 2022
When you specify just time in a datetime value it implicitly means "Today at hh:mm:ss", so your query searches for any log that is not between "Today 06:00 and Today 23:00".
Maybe you want something like this?
AuditLogs | where OperationName == "Invite external user" | where hourofday(TimeGenerated) !between (6 .. 22)
GaryBushey
Mar 09, 2022Bronze Contributor
You also want to make sure that the date/time you are looking at is not stored in UTC time but rather your local time.
- JonhedMar 09, 2022Steel ContributorThat is indeed important.