Created by Claude - please verify

After-hours admin activity - Exchange admin and Entra directory audit records from a Purview audit search, outside Mon-Fri 07:00-19:00 in the web server's time zone.

Required Microsoft Graph permissions

AuditLogsQuery.Read.All — application permission, granted to the app registration with admin consent.

Licence: Microsoft Purview Audit (Standard).

Endpoints: POST /v1.0/security/auditLog/queries (exchangeAdmin, azureActiveDirectory) · GET /v1.0/security/auditLog/queries/{id}/records

Business hours use the web server's time zone and do not know about holidays or on-call rotas. Actions by apps, service principals and the system are left out. At most 50,000 records are read.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Admin Actions Outside Business Hours (7 days)

Attackers who take over an admin account usually act when nobody is watching - at night and at weekends. Every Exchange or Entra admin action by a person outside business hours in the last 7 days; night and weekend actions are highlighted.

Press Run scan to search 7 days of Exchange and Entra admin activity (takes several minutes).