Admin Actions Outside Business Hours (7 days)

The question it answers: Which Exchange or Entra admin actions did people take outside business hours in the last 7 days?

Attackers who take over an admin account usually act when nobody is watching - at night and at weekends. Every Exchange or Entra admin action by a person outside business hours in the last 7 days; night and weekend actions are highlighted.

Note

Business hours use the web server’s time zone and do not know about holidays or on-call rotas. Actions by apps, service principals and the system are left out. At most 50,000 records are read.

At a glance

Where in the app	Tenant › Compliance & Audit › After-hours Admin Actions
Workload	Compliance
Kind	Table · dashboard tile
Data	A scan: it runs only when someone presses Run scan (or calls the API’s scan action) and can take minutes. The last result is kept until the next scan.
Licence	Microsoft Purview Audit (Standard).
Report id (API and MCP)	tenant.compliance.after-hours-admin-activity

Columns

Column	Key	Type
When (server time)	LocalTime	Status
Day	Day	Text
Who	UserPrincipalName	Text
Operation	Operation	Text
Workload	Workload	Text
Target	Target	Text
Client IP	ClientIp	Text
User type	UserType	Text

Filters

Filter	Key (API)	On when the page opens
Only night and weekend actions	night-weekend	No

What it needs

Licence: Microsoft Purview Audit (Standard).

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
AuditLogsQuery.Read.All	Microsoft Graph	Read audit logs data from all services

Data sources it reads

• POST /v1.0/security/auditLog/queries (exchangeAdmin, azureActiveDirectory)
• GET /v1.0/security/auditLog/queries/{id}/records

Through the API and MCP

GET /ir-api/v1/reports/tenant.compliance.after-hours-admin-activity?size=100
GET /ir-api/v1/reports/tenant.compliance.after-hours-admin-activity?filter=night-weekend
POST /ir-api/v1/reports/tenant.compliance.after-hours-admin-activity/scan

An AI assistant reads it with the MCP tool get_report and the id tenant.compliance.after-hours-admin-activity. The client needs the Run scan grant for Compliance. See Using the API.